src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/nat66.h>
  28 #include <nat/dslite.h>
  29 #include <nat/nat_reass.h>
  30 #include <nat/nat_inlines.h>
  31 #include <nat/nat_affinity.h>
  32 #include <vnet/fib/fib_table.h>
  33 #include <vnet/fib/ip4_fib.h>
  34
  35 #include <vpp/app/version.h>
  36
  37 snat_main_t snat_main;
  38
  39 /* *INDENT-OFF* */
  40
  41 /* Hook up input features */
  42 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  43   .arc_name = "ip4-unicast",
  44   .node_name = "nat44-in2out",
  45   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  46 };
  47 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  48   .arc_name = "ip4-unicast",
  49   .node_name = "nat44-out2in",
  50   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  51                                "ip4-dhcp-client-detect"),
  52 };
  53 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  54   .arc_name = "ip4-unicast",
  55   .node_name = "nat44-classify",
  56   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  57 };
  58 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  59   .arc_name = "ip4-unicast",
  60   .node_name = "nat44-det-in2out",
  61   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  62 };
  63 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  64   .arc_name = "ip4-unicast",
  65   .node_name = "nat44-det-out2in",
  66   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  67                                "ip4-dhcp-client-detect"),
  68 };
  69 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  70   .arc_name = "ip4-unicast",
  71   .node_name = "nat44-det-classify",
  72   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  73 };
  74 VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = {
  75   .arc_name = "ip4-unicast",
  76   .node_name = "nat44-ed-in2out",
  77   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  78 };
  79 VNET_FEATURE_INIT (ip4_nat44_ed_out2in, static) = {
  80   .arc_name = "ip4-unicast",
  81   .node_name = "nat44-ed-out2in",
  82   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  83                                "ip4-dhcp-client-detect"),
  84 };
  85 VNET_FEATURE_INIT (ip4_nat44_ed_classify, static) = {
  86   .arc_name = "ip4-unicast",
  87   .node_name = "nat44-ed-classify",
  88   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  89 };
  90 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  91   .arc_name = "ip4-unicast",
  92   .node_name = "nat44-in2out-worker-handoff",
  93   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  94 };
  95 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  96   .arc_name = "ip4-unicast",
  97   .node_name = "nat44-out2in-worker-handoff",
  98   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  99                                "ip4-dhcp-client-detect"),
 100 };
 101 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
 102   .arc_name = "ip4-unicast",
 103   .node_name = "nat44-handoff-classify",
 104   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 105 };
 106 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
 107   .arc_name = "ip4-unicast",
 108   .node_name = "nat44-in2out-fast",
 109   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 110 };
 111 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
 112   .arc_name = "ip4-unicast",
 113   .node_name = "nat44-out2in-fast",
 114   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
 115                                "ip4-dhcp-client-detect"),
 116 };
 117 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
 118   .arc_name = "ip4-unicast",
 119   .node_name = "nat44-hairpin-dst",
 120   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 121 };
 122 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_dst, static) = {
 123   .arc_name = "ip4-unicast",
 124   .node_name = "nat44-ed-hairpin-dst",
 125   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 126 };
 127
 128 /* Hook up output features */
 129 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 130   .arc_name = "ip4-output",
 131   .node_name = "nat44-in2out-output",
 132   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 133 };
 134 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 135   .arc_name = "ip4-output",
 136   .node_name = "nat44-in2out-output-worker-handoff",
 137   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 138 };
 139 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 140   .arc_name = "ip4-output",
 141   .node_name = "nat44-hairpin-src",
 142   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 143 };
 144 VNET_FEATURE_INIT (ip4_nat44_ed_in2out_output, static) = {
 145   .arc_name = "ip4-output",
 146   .node_name = "nat44-ed-in2out-output",
 147   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 148 };
 149 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_src, static) = {
 150   .arc_name = "ip4-output",
 151   .node_name = "nat44-ed-hairpin-src",
 152   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 153 };
 154
 155 /* Hook up ip4-local features */
 156 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 157 {
 158   .arc_name = "ip4-local",
 159   .node_name = "nat44-hairpinning",
 160   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 161 };
 162 VNET_FEATURE_INIT (ip4_nat44_ed_hairpinning, static) =
 163 {
 164   .arc_name = "ip4-local",
 165   .node_name = "nat44-ed-hairpinning",
 166   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 167 };
 168
 169
 170 VLIB_PLUGIN_REGISTER () = {
 171     .version = VPP_BUILD_VER,
 172     .description = "Network Address Translation",
 173 };
 174 /* *INDENT-ON* */
 175
 176 void
 177 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
 178 {
 179   snat_session_key_t key;
 180   clib_bihash_kv_8_8_t kv;
 181   nat_ed_ses_key_t ed_key;
 182   clib_bihash_kv_16_8_t ed_kv;
 183   snat_main_per_thread_data_t *tsm =
 184     vec_elt_at_index (sm->per_thread_data, thread_index);
 185
 186   if (is_fwd_bypass_session (s))
 187     {
 188       ed_key.l_addr = s->in2out.addr;
 189       ed_key.r_addr = s->ext_host_addr;
 190       ed_key.l_port = s->in2out.port;
 191       ed_key.r_port = s->ext_host_port;
 192       ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 193       ed_key.fib_index = 0;
 194       ed_kv.key[0] = ed_key.as_u64[0];
 195       ed_kv.key[1] = ed_key.as_u64[1];
 196       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 197         nat_log_warn ("in2out_ed key del failed");
 198       return;
 199     }
 200
 201   /* session lookup tables */
 202   if (is_ed_session (s))
 203     {
 204       if (is_affinity_sessions (s))
 205         nat_affinity_unlock (s->ext_host_addr, s->out2in.addr,
 206                              s->in2out.protocol, s->out2in.port);
 207       ed_key.l_addr = s->out2in.addr;
 208       ed_key.r_addr = s->ext_host_addr;
 209       ed_key.fib_index = s->out2in.fib_index;
 210       if (snat_is_unk_proto_session (s))
 211         {
 212           ed_key.proto = s->in2out.port;
 213           ed_key.r_port = 0;
 214           ed_key.l_port = 0;
 215         }
 216       else
 217         {
 218           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 219           ed_key.l_port = s->out2in.port;
 220           ed_key.r_port = s->ext_host_port;
 221         }
 222       ed_kv.key[0] = ed_key.as_u64[0];
 223       ed_kv.key[1] = ed_key.as_u64[1];
 224       if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &ed_kv, 0))
 225         nat_log_warn ("out2in_ed key del failed");
 226       ed_key.l_addr = s->in2out.addr;
 227       ed_key.fib_index = s->in2out.fib_index;
 228       if (!snat_is_unk_proto_session (s))
 229         ed_key.l_port = s->in2out.port;
 230       if (is_twice_nat_session (s))
 231         {
 232           ed_key.r_addr = s->ext_host_nat_addr;
 233           ed_key.r_port = s->ext_host_nat_port;
 234         }
 235       ed_kv.key[0] = ed_key.as_u64[0];
 236       ed_kv.key[1] = ed_key.as_u64[1];
 237       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 238         nat_log_warn ("in2out_ed key del failed");
 239     }
 240   else
 241     {
 242       kv.key = s->in2out.as_u64;
 243       if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 244         nat_log_warn ("in2out key del failed");
 245       kv.key = s->out2in.as_u64;
 246       if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 247         nat_log_warn ("out2in key del failed");
 248     }
 249
 250   if (snat_is_unk_proto_session (s))
 251     return;
 252
 253   /* log NAT event */
 254   snat_ipfix_logging_nat44_ses_delete (s->in2out.addr.as_u32,
 255                                        s->out2in.addr.as_u32,
 256                                        s->in2out.protocol,
 257                                        s->in2out.port,
 258                                        s->out2in.port, s->in2out.fib_index);
 259
 260   /* Twice NAT address and port for external host */
 261   if (is_twice_nat_session (s))
 262     {
 263       key.protocol = s->in2out.protocol;
 264       key.port = s->ext_host_nat_port;
 265       key.addr.as_u32 = s->ext_host_nat_addr.as_u32;
 266       snat_free_outside_address_and_port (sm->twice_nat_addresses,
 267                                           thread_index, &key);
 268     }
 269
 270   if (snat_is_session_static (s))
 271     return;
 272
 273   snat_free_outside_address_and_port (sm->addresses, thread_index,
 274                                       &s->out2in);
 275 }
 276
 277 snat_user_t *
 278 nat_user_get_or_create (snat_main_t * sm, ip4_address_t * addr, u32 fib_index,
 279                         u32 thread_index)
 280 {
 281   snat_user_t *u = 0;
 282   snat_user_key_t user_key;
 283   clib_bihash_kv_8_8_t kv, value;
 284   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 285   dlist_elt_t *per_user_list_head_elt;
 286
 287   user_key.addr.as_u32 = addr->as_u32;
 288   user_key.fib_index = fib_index;
 289   kv.key = user_key.as_u64;
 290
 291   /* Ever heard of the "user" = src ip4 address before? */
 292   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 293     {
 294       /* no, make a new one */
 295       pool_get (tsm->users, u);
 296       clib_memset (u, 0, sizeof (*u));
 297       u->addr.as_u32 = addr->as_u32;
 298       u->fib_index = fib_index;
 299
 300       pool_get (tsm->list_pool, per_user_list_head_elt);
 301
 302       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 303         tsm->list_pool;
 304
 305       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 306
 307       kv.value = u - tsm->users;
 308
 309       /* add user */
 310       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 311         nat_log_warn ("user_hash keay add failed");
 312     }
 313   else
 314     {
 315       u = pool_elt_at_index (tsm->users, value.value);
 316     }
 317
 318   return u;
 319 }
 320
 321 snat_session_t *
 322 nat_session_alloc_or_recycle (snat_main_t * sm, snat_user_t * u,
 323                               u32 thread_index)
 324 {
 325   snat_session_t *s;
 326   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 327   u32 oldest_per_user_translation_list_index, session_index;
 328   dlist_elt_t *oldest_per_user_translation_list_elt;
 329   dlist_elt_t *per_user_translation_list_elt;
 330
 331   /* Over quota? Recycle the least recently used translation */
 332   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 333     {
 334       oldest_per_user_translation_list_index =
 335         clib_dlist_remove_head (tsm->list_pool,
 336                                 u->sessions_per_user_list_head_index);
 337
 338       ASSERT (oldest_per_user_translation_list_index != ~0);
 339
 340       /* Add it back to the end of the LRU list */
 341       clib_dlist_addtail (tsm->list_pool,
 342                           u->sessions_per_user_list_head_index,
 343                           oldest_per_user_translation_list_index);
 344       /* Get the list element */
 345       oldest_per_user_translation_list_elt =
 346         pool_elt_at_index (tsm->list_pool,
 347                            oldest_per_user_translation_list_index);
 348
 349       /* Get the session index from the list element */
 350       session_index = oldest_per_user_translation_list_elt->value;
 351
 352       /* Get the session */
 353       s = pool_elt_at_index (tsm->sessions, session_index);
 354       nat_free_session_data (sm, s, thread_index);
 355       if (snat_is_session_static (s))
 356         u->nstaticsessions--;
 357       else
 358         u->nsessions--;
 359       s->flags = 0;
 360       s->total_bytes = 0;
 361       s->total_pkts = 0;
 362       s->state = 0;
 363       s->ext_host_addr.as_u32 = 0;
 364       s->ext_host_port = 0;
 365       s->ext_host_nat_addr.as_u32 = 0;
 366       s->ext_host_nat_port = 0;
 367     }
 368   else
 369     {
 370       pool_get (tsm->sessions, s);
 371       clib_memset (s, 0, sizeof (*s));
 372
 373       /* Create list elts */
 374       pool_get (tsm->list_pool, per_user_translation_list_elt);
 375       clib_dlist_init (tsm->list_pool,
 376                        per_user_translation_list_elt - tsm->list_pool);
 377
 378       per_user_translation_list_elt->value = s - tsm->sessions;
 379       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 380       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 381
 382       clib_dlist_addtail (tsm->list_pool,
 383                           s->per_user_list_head_index,
 384                           per_user_translation_list_elt - tsm->list_pool);
 385     }
 386
 387   return s;
 388 }
 389
 390 snat_session_t *
 391 nat_ed_session_alloc (snat_main_t * sm, snat_user_t * u, u32 thread_index,
 392                       f64 now)
 393 {
 394   snat_session_t *s;
 395   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 396   dlist_elt_t *per_user_translation_list_elt, *oldest_elt;
 397   u32 oldest_index;
 398   u64 sess_timeout_time;
 399
 400   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 401     {
 402       oldest_index =
 403         clib_dlist_remove_head (tsm->list_pool,
 404                                 u->sessions_per_user_list_head_index);
 405       oldest_elt = pool_elt_at_index (tsm->list_pool, oldest_index);
 406       s = pool_elt_at_index (tsm->sessions, oldest_elt->value);
 407       sess_timeout_time =
 408         s->last_heard + (f64) nat44_session_get_timeout (sm, s);
 409       if (now >= sess_timeout_time)
 410         {
 411           clib_dlist_addtail (tsm->list_pool,
 412                               u->sessions_per_user_list_head_index,
 413                               oldest_index);
 414           nat_free_session_data (sm, s, thread_index);
 415           if (snat_is_session_static (s))
 416             u->nstaticsessions--;
 417           else
 418             u->nsessions--;
 419           s->flags = 0;
 420           s->total_bytes = 0;
 421           s->total_pkts = 0;
 422           s->state = 0;
 423           s->ext_host_addr.as_u32 = 0;
 424           s->ext_host_port = 0;
 425           s->ext_host_nat_addr.as_u32 = 0;
 426           s->ext_host_nat_port = 0;
 427         }
 428       else
 429         {
 430           clib_dlist_addhead (tsm->list_pool,
 431                               u->sessions_per_user_list_head_index,
 432                               oldest_index);
 433           nat_log_warn ("max translations per user %U", format_ip4_address,
 434                         &u->addr);
 435           snat_ipfix_logging_max_entries_per_user
 436             (sm->max_translations_per_user, u->addr.as_u32);
 437           return 0;
 438         }
 439     }
 440   else
 441     {
 442       pool_get (tsm->sessions, s);
 443       clib_memset (s, 0, sizeof (*s));
 444
 445       /* Create list elts */
 446       pool_get (tsm->list_pool, per_user_translation_list_elt);
 447       clib_dlist_init (tsm->list_pool,
 448                        per_user_translation_list_elt - tsm->list_pool);
 449
 450       per_user_translation_list_elt->value = s - tsm->sessions;
 451       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 452       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 453
 454       clib_dlist_addtail (tsm->list_pool,
 455                           s->per_user_list_head_index,
 456                           per_user_translation_list_elt - tsm->list_pool);
 457     }
 458   return s;
 459 }
 460
 461 void
 462 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 463                           int is_add)
 464 {
 465   fib_prefix_t prefix = {
 466     .fp_len = p_len,
 467     .fp_proto = FIB_PROTOCOL_IP4,
 468     .fp_addr = {
 469                 .ip4.as_u32 = addr->as_u32,
 470                 },
 471   };
 472   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
 473
 474   if (is_add)
 475     fib_table_entry_update_one_path (fib_index,
 476                                      &prefix,
 477                                      FIB_SOURCE_PLUGIN_LOW,
 478                                      (FIB_ENTRY_FLAG_CONNECTED |
 479                                       FIB_ENTRY_FLAG_LOCAL |
 480                                       FIB_ENTRY_FLAG_EXCLUSIVE),
 481                                      DPO_PROTO_IP4,
 482                                      NULL,
 483                                      sw_if_index,
 484                                      ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
 485   else
 486     fib_table_entry_delete (fib_index, &prefix, FIB_SOURCE_PLUGIN_LOW);
 487 }
 488
 489 int
 490 snat_add_address (snat_main_t * sm, ip4_address_t * addr, u32 vrf_id,
 491                   u8 twice_nat)
 492 {
 493   snat_address_t *ap;
 494   snat_interface_t *i;
 495   vlib_thread_main_t *tm = vlib_get_thread_main ();
 496
 497   if (twice_nat && !sm->endpoint_dependent)
 498     return VNET_API_ERROR_FEATURE_DISABLED;
 499
 500   /* Check if address already exists */
 501   /* *INDENT-OFF* */
 502   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 503     {
 504       if (ap->addr.as_u32 == addr->as_u32)
 505         return VNET_API_ERROR_VALUE_EXIST;
 506     }
 507   /* *INDENT-ON* */
 508
 509   if (twice_nat)
 510     vec_add2 (sm->twice_nat_addresses, ap, 1);
 511   else
 512     vec_add2 (sm->addresses, ap, 1);
 513
 514   ap->addr = *addr;
 515   if (vrf_id != ~0)
 516     ap->fib_index =
 517       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 518                                          FIB_SOURCE_PLUGIN_LOW);
 519   else
 520     ap->fib_index = ~0;
 521 #define _(N, i, n, s) \
 522   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 523   ap->busy_##n##_ports = 0; \
 524   ap->busy_##n##_ports_per_thread = 0;\
 525   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 526   foreach_snat_protocol
 527 #undef _
 528     if (twice_nat)
 529     return 0;
 530
 531   /* Add external address to FIB */
 532   /* *INDENT-OFF* */
 533   pool_foreach (i, sm->interfaces,
 534   ({
 535     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 536       continue;
 537
 538     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 539     break;
 540   }));
 541   pool_foreach (i, sm->output_feature_interfaces,
 542   ({
 543     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 544       continue;
 545
 546     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 547     break;
 548   }));
 549   /* *INDENT-ON* */
 550
 551   return 0;
 552 }
 553
 554 static int
 555 is_snat_address_used_in_static_mapping (snat_main_t * sm, ip4_address_t addr)
 556 {
 557   snat_static_mapping_t *m;
 558   /* *INDENT-OFF* */
 559   pool_foreach (m, sm->static_mappings,
 560   ({
 561       if (is_addr_only_static_mapping (m) ||
 562           is_out2in_only_static_mapping (m) ||
 563           is_identity_static_mapping (m))
 564         continue;
 565       if (m->external_addr.as_u32 == addr.as_u32)
 566         return 1;
 567   }));
 568   /* *INDENT-ON* */
 569
 570   return 0;
 571 }
 572
 573 void
 574 increment_v4_address (ip4_address_t * a)
 575 {
 576   u32 v;
 577
 578   v = clib_net_to_host_u32 (a->as_u32) + 1;
 579   a->as_u32 = clib_host_to_net_u32 (v);
 580 }
 581
 582 static void
 583 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 584                                        ip4_address_t l_addr,
 585                                        u16 l_port,
 586                                        u32 sw_if_index,
 587                                        u16 e_port,
 588                                        u32 vrf_id,
 589                                        snat_protocol_t proto,
 590                                        int addr_only, int is_add, u8 * tag,
 591                                        int twice_nat, int out2in_only,
 592                                        int identity_nat)
 593 {
 594   snat_static_map_resolve_t *rp;
 595
 596   vec_add2 (sm->to_resolve, rp, 1);
 597   rp->l_addr.as_u32 = l_addr.as_u32;
 598   rp->l_port = l_port;
 599   rp->sw_if_index = sw_if_index;
 600   rp->e_port = e_port;
 601   rp->vrf_id = vrf_id;
 602   rp->proto = proto;
 603   rp->addr_only = addr_only;
 604   rp->is_add = is_add;
 605   rp->twice_nat = twice_nat;
 606   rp->out2in_only = out2in_only;
 607   rp->identity_nat = identity_nat;
 608   rp->tag = vec_dup (tag);
 609 }
 610
 611 static u32
 612 get_thread_idx_by_port (u16 e_port)
 613 {
 614   snat_main_t *sm = &snat_main;
 615   u32 thread_idx = sm->num_workers;
 616   if (sm->num_workers > 1)
 617     {
 618       thread_idx =
 619         sm->first_worker_index +
 620         sm->workers[(e_port - 1024) / sm->port_per_thread];
 621     }
 622   return thread_idx;
 623 }
 624
 625 int
 626 snat_add_static_mapping (ip4_address_t l_addr, ip4_address_t e_addr,
 627                          u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 628                          u32 sw_if_index, snat_protocol_t proto, int is_add,
 629                          twice_nat_type_t twice_nat, u8 out2in_only, u8 * tag,
 630                          u8 identity_nat)
 631 {
 632   snat_main_t *sm = &snat_main;
 633   snat_static_mapping_t *m;
 634   snat_session_key_t m_key;
 635   clib_bihash_kv_8_8_t kv, value;
 636   snat_address_t *a = 0;
 637   u32 fib_index = ~0;
 638   snat_interface_t *interface;
 639   int i;
 640   snat_main_per_thread_data_t *tsm;
 641   snat_user_key_t u_key;
 642   snat_user_t *u;
 643   dlist_elt_t *head, *elt;
 644   u32 elt_index, head_index;
 645   u32 ses_index;
 646   u64 user_index;
 647   snat_session_t *s;
 648   snat_static_map_resolve_t *rp, *rp_match = 0;
 649   nat44_lb_addr_port_t *local;
 650   u8 find = 0;
 651
 652   if (!sm->endpoint_dependent)
 653     {
 654       if (twice_nat || out2in_only)
 655         return VNET_API_ERROR_FEATURE_DISABLED;
 656     }
 657
 658   /* If the external address is a specific interface address */
 659   if (sw_if_index != ~0)
 660     {
 661       ip4_address_t *first_int_addr;
 662
 663       for (i = 0; i < vec_len (sm->to_resolve); i++)
 664         {
 665           rp = sm->to_resolve + i;
 666           if (rp->sw_if_index != sw_if_index ||
 667               rp->l_addr.as_u32 != l_addr.as_u32 ||
 668               rp->vrf_id != vrf_id || rp->addr_only != addr_only)
 669             continue;
 670
 671           if (!addr_only)
 672             {
 673               if (rp->l_port != l_port || rp->e_port != e_port
 674                   || rp->proto != proto)
 675                 continue;
 676             }
 677
 678           rp_match = rp;
 679           break;
 680         }
 681
 682       /* Might be already set... */
 683       first_int_addr = ip4_interface_first_address
 684         (sm->ip4_main, sw_if_index, 0 /* just want the address */ );
 685
 686       if (is_add)
 687         {
 688           if (rp_match)
 689             return VNET_API_ERROR_VALUE_EXIST;
 690
 691           snat_add_static_mapping_when_resolved
 692             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 693              addr_only, is_add, tag, twice_nat, out2in_only, identity_nat);
 694
 695           /* DHCP resolution required? */
 696           if (first_int_addr == 0)
 697             {
 698               return 0;
 699             }
 700           else
 701             {
 702               e_addr.as_u32 = first_int_addr->as_u32;
 703               /* Identity mapping? */
 704               if (l_addr.as_u32 == 0)
 705                 l_addr.as_u32 = e_addr.as_u32;
 706             }
 707         }
 708       else
 709         {
 710           if (!rp_match)
 711             return VNET_API_ERROR_NO_SUCH_ENTRY;
 712
 713           vec_del1 (sm->to_resolve, i);
 714
 715           if (first_int_addr)
 716             {
 717               e_addr.as_u32 = first_int_addr->as_u32;
 718               /* Identity mapping? */
 719               if (l_addr.as_u32 == 0)
 720                 l_addr.as_u32 = e_addr.as_u32;
 721             }
 722           else
 723             return 0;
 724         }
 725     }
 726
 727   m_key.addr = e_addr;
 728   m_key.port = addr_only ? 0 : e_port;
 729   m_key.protocol = addr_only ? 0 : proto;
 730   m_key.fib_index = 0;
 731   kv.key = m_key.as_u64;
 732   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 733     m = 0;
 734   else
 735     m = pool_elt_at_index (sm->static_mappings, value.value);
 736
 737   if (is_add)
 738     {
 739       if (m)
 740         {
 741           if (is_identity_static_mapping (m))
 742             {
 743               /* *INDENT-OFF* */
 744               vec_foreach (local, m->locals)
 745                 {
 746                   if (local->vrf_id == vrf_id)
 747                     return VNET_API_ERROR_VALUE_EXIST;
 748                 }
 749               /* *INDENT-ON* */
 750               vec_add2 (m->locals, local, 1);
 751               local->vrf_id = vrf_id;
 752               local->fib_index =
 753                 fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 754                                                    FIB_SOURCE_PLUGIN_LOW);
 755               m_key.addr = m->local_addr;
 756               m_key.port = m->local_port;
 757               m_key.protocol = m->proto;
 758               m_key.fib_index = local->fib_index;
 759               kv.key = m_key.as_u64;
 760               kv.value = m - sm->static_mappings;
 761               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 762               return 0;
 763             }
 764           else
 765             return VNET_API_ERROR_VALUE_EXIST;
 766         }
 767
 768       if (twice_nat && addr_only)
 769         return VNET_API_ERROR_UNSUPPORTED;
 770
 771       /* Convert VRF id to FIB index */
 772       if (vrf_id != ~0)
 773         fib_index =
 774           fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 775                                              FIB_SOURCE_PLUGIN_LOW);
 776       /* If not specified use inside VRF id from SNAT plugin startup config */
 777       else
 778         {
 779           fib_index = sm->inside_fib_index;
 780           vrf_id = sm->inside_vrf_id;
 781         }
 782
 783       if (!(out2in_only || identity_nat))
 784         {
 785           m_key.addr = l_addr;
 786           m_key.port = addr_only ? 0 : l_port;
 787           m_key.protocol = addr_only ? 0 : proto;
 788           m_key.fib_index = fib_index;
 789           kv.key = m_key.as_u64;
 790           if (!clib_bihash_search_8_8
 791               (&sm->static_mapping_by_local, &kv, &value))
 792             return VNET_API_ERROR_VALUE_EXIST;
 793         }
 794
 795       /* Find external address in allocated addresses and reserve port for
 796          address and port pair mapping when dynamic translations enabled */
 797       if (!(addr_only || sm->static_mapping_only || out2in_only))
 798         {
 799           for (i = 0; i < vec_len (sm->addresses); i++)
 800             {
 801               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 802                 {
 803                   a = sm->addresses + i;
 804                   /* External port must be unused */
 805                   switch (proto)
 806                     {
 807 #define _(N, j, n, s) \
 808                     case SNAT_PROTOCOL_##N: \
 809                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 810                         return VNET_API_ERROR_INVALID_VALUE; \
 811                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 812                       if (e_port > 1024) \
 813                         { \
 814                           a->busy_##n##_ports++; \
 815                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
 816                         } \
 817                       break;
 818                       foreach_snat_protocol
 819 #undef _
 820                     default:
 821                       nat_log_info ("unknown protocol");
 822                       return VNET_API_ERROR_INVALID_VALUE_2;
 823                     }
 824                   break;
 825                 }
 826             }
 827           /* External address must be allocated */
 828           if (!a && (l_addr.as_u32 != e_addr.as_u32))
 829             {
 830               if (sw_if_index != ~0)
 831                 {
 832                   for (i = 0; i < vec_len (sm->to_resolve); i++)
 833                     {
 834                       rp = sm->to_resolve + i;
 835                       if (rp->addr_only)
 836                         continue;
 837                       if (rp->sw_if_index != sw_if_index &&
 838                           rp->l_addr.as_u32 != l_addr.as_u32 &&
 839                           rp->vrf_id != vrf_id && rp->l_port != l_port &&
 840                           rp->e_port != e_port && rp->proto != proto)
 841                         continue;
 842
 843                       vec_del1 (sm->to_resolve, i);
 844                       break;
 845                     }
 846                 }
 847               return VNET_API_ERROR_NO_SUCH_ENTRY;
 848             }
 849         }
 850
 851       pool_get (sm->static_mappings, m);
 852       clib_memset (m, 0, sizeof (*m));
 853       m->tag = vec_dup (tag);
 854       m->local_addr = l_addr;
 855       m->external_addr = e_addr;
 856       m->twice_nat = twice_nat;
 857       if (out2in_only)
 858         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
 859       if (addr_only)
 860         m->flags |= NAT_STATIC_MAPPING_FLAG_ADDR_ONLY;
 861       if (identity_nat)
 862         {
 863           m->flags |= NAT_STATIC_MAPPING_FLAG_IDENTITY_NAT;
 864           vec_add2 (m->locals, local, 1);
 865           local->vrf_id = vrf_id;
 866           local->fib_index = fib_index;
 867         }
 868       else
 869         {
 870           m->vrf_id = vrf_id;
 871           m->fib_index = fib_index;
 872         }
 873       if (!addr_only)
 874         {
 875           m->local_port = l_port;
 876           m->external_port = e_port;
 877           m->proto = proto;
 878         }
 879
 880       if (sm->num_workers > 1)
 881         {
 882           ip4_header_t ip = {
 883             .src_address = m->local_addr,
 884           };
 885           vec_add1 (m->workers, sm->worker_in2out_cb (&ip, m->fib_index));
 886           tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
 887         }
 888       else
 889         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 890
 891       m_key.addr = m->local_addr;
 892       m_key.port = m->local_port;
 893       m_key.protocol = m->proto;
 894       m_key.fib_index = fib_index;
 895       kv.key = m_key.as_u64;
 896       kv.value = m - sm->static_mappings;
 897       if (!out2in_only)
 898         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
 899
 900       m_key.addr = m->external_addr;
 901       m_key.port = m->external_port;
 902       m_key.fib_index = 0;
 903       kv.key = m_key.as_u64;
 904       kv.value = m - sm->static_mappings;
 905       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1);
 906
 907       /* Delete dynamic sessions matching local address (+ local port) */
 908       if (!(sm->static_mapping_only))
 909         {
 910           u_key.addr = m->local_addr;
 911           u_key.fib_index = m->fib_index;
 912           kv.key = u_key.as_u64;
 913           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 914             {
 915               user_index = value.value;
 916               u = pool_elt_at_index (tsm->users, user_index);
 917               if (u->nsessions)
 918                 {
 919                   head_index = u->sessions_per_user_list_head_index;
 920                   head = pool_elt_at_index (tsm->list_pool, head_index);
 921                   elt_index = head->next;
 922                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 923                   ses_index = elt->value;
 924                   while (ses_index != ~0)
 925                     {
 926                       s = pool_elt_at_index (tsm->sessions, ses_index);
 927                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
 928                       ses_index = elt->value;
 929
 930                       if (snat_is_session_static (s))
 931                         continue;
 932
 933                       if (!addr_only
 934                           && (clib_net_to_host_u16 (s->in2out.port) !=
 935                               m->local_port))
 936                         continue;
 937
 938                       nat_free_session_data (sm, s,
 939                                              tsm - sm->per_thread_data);
 940                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
 941
 942                       if (!addr_only && !sm->endpoint_dependent)
 943                         break;
 944                     }
 945                 }
 946             }
 947         }
 948     }
 949   else
 950     {
 951       if (!m)
 952         {
 953           if (sw_if_index != ~0)
 954             return 0;
 955           else
 956             return VNET_API_ERROR_NO_SUCH_ENTRY;
 957         }
 958
 959       if (identity_nat)
 960         {
 961           if (vrf_id == ~0)
 962             vrf_id = sm->inside_vrf_id;
 963
 964           for (i = 0; i < vec_len (m->locals); i++)
 965             {
 966               if (m->locals[i].vrf_id == vrf_id)
 967                 {
 968                   find = 1;
 969                   break;
 970                 }
 971             }
 972           if (!find)
 973             return VNET_API_ERROR_NO_SUCH_ENTRY;
 974
 975           fib_index = m->locals[i].fib_index;
 976           vec_del1 (m->locals, i);
 977         }
 978       else
 979         fib_index = m->fib_index;
 980
 981       /* Free external address port */
 982       if (!(addr_only || sm->static_mapping_only || out2in_only))
 983         {
 984           for (i = 0; i < vec_len (sm->addresses); i++)
 985             {
 986               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 987                 {
 988                   a = sm->addresses + i;
 989                   switch (proto)
 990                     {
 991 #define _(N, j, n, s) \
 992                     case SNAT_PROTOCOL_##N: \
 993                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 994                       if (e_port > 1024) \
 995                         { \
 996                           a->busy_##n##_ports--; \
 997                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
 998                         } \
 999                       break;
1000                       foreach_snat_protocol
1001 #undef _
1002                     default:
1003                       nat_log_info ("unknown protocol");
1004                       return VNET_API_ERROR_INVALID_VALUE_2;
1005                     }
1006                   break;
1007                 }
1008             }
1009         }
1010
1011       if (sm->num_workers > 1)
1012         tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
1013       else
1014         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1015
1016       m_key.addr = m->local_addr;
1017       m_key.port = m->local_port;
1018       m_key.protocol = m->proto;
1019       m_key.fib_index = fib_index;
1020       kv.key = m_key.as_u64;
1021       if (!out2in_only)
1022         clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 0);
1023
1024       /* Delete session(s) for static mapping if exist */
1025       if (!(sm->static_mapping_only) ||
1026           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
1027         {
1028           u_key.addr = m->local_addr;
1029           u_key.fib_index = fib_index;
1030           kv.key = u_key.as_u64;
1031           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1032             {
1033               user_index = value.value;
1034               u = pool_elt_at_index (tsm->users, user_index);
1035               if (u->nstaticsessions)
1036                 {
1037                   head_index = u->sessions_per_user_list_head_index;
1038                   head = pool_elt_at_index (tsm->list_pool, head_index);
1039                   elt_index = head->next;
1040                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1041                   ses_index = elt->value;
1042                   while (ses_index != ~0)
1043                     {
1044                       s = pool_elt_at_index (tsm->sessions, ses_index);
1045                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1046                       ses_index = elt->value;
1047
1048                       if (!addr_only)
1049                         {
1050                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) ||
1051                               (clib_net_to_host_u16 (s->out2in.port) !=
1052                                e_port))
1053                             continue;
1054                         }
1055
1056                       if (is_lb_session (s))
1057                         continue;
1058
1059                       if (!snat_is_session_static (s))
1060                         continue;
1061
1062                       nat_free_session_data (sm, s,
1063                                              tsm - sm->per_thread_data);
1064                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1065
1066                       if (!addr_only && !sm->endpoint_dependent)
1067                         break;
1068                     }
1069                 }
1070             }
1071         }
1072
1073       fib_table_unlock (fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1074       if (vec_len (m->locals))
1075         return 0;
1076
1077       m_key.addr = m->external_addr;
1078       m_key.port = m->external_port;
1079       m_key.fib_index = 0;
1080       kv.key = m_key.as_u64;
1081       clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0);
1082
1083       vec_free (m->tag);
1084       vec_free (m->workers);
1085       /* Delete static mapping from pool */
1086       pool_put (sm->static_mappings, m);
1087     }
1088
1089   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
1090     return 0;
1091
1092   /* Add/delete external address to FIB */
1093   /* *INDENT-OFF* */
1094   pool_foreach (interface, sm->interfaces,
1095   ({
1096     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1097       continue;
1098
1099     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1100     break;
1101   }));
1102   pool_foreach (interface, sm->output_feature_interfaces,
1103   ({
1104     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1105       continue;
1106
1107     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1108     break;
1109   }));
1110   /* *INDENT-ON* */
1111
1112   return 0;
1113 }
1114
1115 int
1116 nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
1117                                  snat_protocol_t proto,
1118                                  nat44_lb_addr_port_t * locals, u8 is_add,
1119                                  twice_nat_type_t twice_nat, u8 out2in_only,
1120                                  u8 * tag, u32 affinity)
1121 {
1122   snat_main_t *sm = &snat_main;
1123   snat_static_mapping_t *m;
1124   snat_session_key_t m_key;
1125   clib_bihash_kv_8_8_t kv, value;
1126   snat_address_t *a = 0;
1127   int i;
1128   nat44_lb_addr_port_t *local;
1129   u32 elt_index, head_index, ses_index;
1130   snat_main_per_thread_data_t *tsm;
1131   snat_user_key_t u_key;
1132   snat_user_t *u;
1133   snat_session_t *s;
1134   dlist_elt_t *head, *elt;
1135   uword *bitmap = 0;
1136
1137   if (!sm->endpoint_dependent)
1138     return VNET_API_ERROR_FEATURE_DISABLED;
1139
1140   m_key.addr = e_addr;
1141   m_key.port = e_port;
1142   m_key.protocol = proto;
1143   m_key.fib_index = 0;
1144   kv.key = m_key.as_u64;
1145   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1146     m = 0;
1147   else
1148     m = pool_elt_at_index (sm->static_mappings, value.value);
1149
1150   if (is_add)
1151     {
1152       if (m)
1153         return VNET_API_ERROR_VALUE_EXIST;
1154
1155       if (vec_len (locals) < 2)
1156         return VNET_API_ERROR_INVALID_VALUE;
1157
1158       /* Find external address in allocated addresses and reserve port for
1159          address and port pair mapping when dynamic translations enabled */
1160       if (!(sm->static_mapping_only || out2in_only))
1161         {
1162           for (i = 0; i < vec_len (sm->addresses); i++)
1163             {
1164               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1165                 {
1166                   a = sm->addresses + i;
1167                   /* External port must be unused */
1168                   switch (proto)
1169                     {
1170 #define _(N, j, n, s) \
1171                     case SNAT_PROTOCOL_##N: \
1172                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1173                         return VNET_API_ERROR_INVALID_VALUE; \
1174                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1175                       if (e_port > 1024) \
1176                         { \
1177                           a->busy_##n##_ports++; \
1178                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
1179                         } \
1180                       break;
1181                       foreach_snat_protocol
1182 #undef _
1183                     default:
1184                       nat_log_info ("unknown protocol");
1185                       return VNET_API_ERROR_INVALID_VALUE_2;
1186                     }
1187                   break;
1188                 }
1189             }
1190           /* External address must be allocated */
1191           if (!a)
1192             return VNET_API_ERROR_NO_SUCH_ENTRY;
1193         }
1194
1195       pool_get (sm->static_mappings, m);
1196       clib_memset (m, 0, sizeof (*m));
1197       m->tag = vec_dup (tag);
1198       m->external_addr = e_addr;
1199       m->external_port = e_port;
1200       m->proto = proto;
1201       m->twice_nat = twice_nat;
1202       m->flags |= NAT_STATIC_MAPPING_FLAG_LB;
1203       if (out2in_only)
1204         m->flags |= NAT_STATIC_MAPPING_FLAG_OUT2IN_ONLY;
1205       m->affinity = affinity;
1206
1207       if (affinity)
1208         m->affinity_per_service_list_head_index =
1209           nat_affinity_get_per_service_list_head_index ();
1210       else
1211         m->affinity_per_service_list_head_index = ~0;
1212
1213       m_key.addr = m->external_addr;
1214       m_key.port = m->external_port;
1215       m_key.protocol = m->proto;
1216       m_key.fib_index = 0;
1217       kv.key = m_key.as_u64;
1218       kv.value = m - sm->static_mappings;
1219       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 1))
1220         {
1221           nat_log_err ("static_mapping_by_external key add failed");
1222           return VNET_API_ERROR_UNSPECIFIED;
1223         }
1224
1225       m_key.fib_index = m->fib_index;
1226       for (i = 0; i < vec_len (locals); i++)
1227         {
1228           locals[i].fib_index =
1229             fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1230                                                locals[i].vrf_id,
1231                                                FIB_SOURCE_PLUGIN_LOW);
1232           m_key.addr = locals[i].addr;
1233           m_key.fib_index = locals[i].fib_index;
1234           if (!out2in_only)
1235             {
1236               m_key.port = locals[i].port;
1237               kv.key = m_key.as_u64;
1238               kv.value = m - sm->static_mappings;
1239               clib_bihash_add_del_8_8 (&sm->static_mapping_by_local, &kv, 1);
1240             }
1241           locals[i].prefix = (i == 0) ? locals[i].probability :
1242             (locals[i - 1].prefix + locals[i].probability);
1243           vec_add1 (m->locals, locals[i]);
1244           if (sm->num_workers > 1)
1245             {
1246               ip4_header_t ip = {
1247                 .src_address = locals[i].addr,
1248               };
1249               bitmap =
1250                 clib_bitmap_set (bitmap,
1251                                  sm->worker_in2out_cb (&ip, m->fib_index), 1);
1252             }
1253         }
1254
1255       /* Assign workers */
1256       if (sm->num_workers > 1)
1257         {
1258           /* *INDENT-OFF* */
1259           clib_bitmap_foreach (i, bitmap,
1260             ({
1261                vec_add1(m->workers, i);
1262             }));
1263           /* *INDENT-ON* */
1264         }
1265     }
1266   else
1267     {
1268       if (!m)
1269         return VNET_API_ERROR_NO_SUCH_ENTRY;
1270
1271       if (!is_lb_static_mapping (m))
1272         return VNET_API_ERROR_INVALID_VALUE;
1273
1274       /* Free external address port */
1275       if (!(sm->static_mapping_only || out2in_only))
1276         {
1277           for (i = 0; i < vec_len (sm->addresses); i++)
1278             {
1279               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1280                 {
1281                   a = sm->addresses + i;
1282                   switch (proto)
1283                     {
1284 #define _(N, j, n, s) \
1285                     case SNAT_PROTOCOL_##N: \
1286                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1287                       if (e_port > 1024) \
1288                         { \
1289                           a->busy_##n##_ports--; \
1290                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1291                         } \
1292                       break;
1293                       foreach_snat_protocol
1294 #undef _
1295                     default:
1296                       nat_log_info ("unknown protocol");
1297                       return VNET_API_ERROR_INVALID_VALUE_2;
1298                     }
1299                   break;
1300                 }
1301             }
1302         }
1303
1304       m_key.addr = m->external_addr;
1305       m_key.port = m->external_port;
1306       m_key.protocol = m->proto;
1307       m_key.fib_index = 0;
1308       kv.key = m_key.as_u64;
1309       if (clib_bihash_add_del_8_8 (&sm->static_mapping_by_external, &kv, 0))
1310         {
1311           nat_log_err ("static_mapping_by_external key del failed");
1312           return VNET_API_ERROR_UNSPECIFIED;
1313         }
1314
1315       /* *INDENT-OFF* */
1316       vec_foreach (local, m->locals)
1317         {
1318           fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1319                             FIB_SOURCE_PLUGIN_LOW);
1320           m_key.addr = local->addr;
1321           if (!out2in_only)
1322             {
1323               m_key.port = local->port;
1324               m_key.fib_index = local->fib_index;
1325               kv.key = m_key.as_u64;
1326               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1327                 {
1328                   nat_log_err ("static_mapping_by_local key del failed");
1329                   return VNET_API_ERROR_UNSPECIFIED;
1330                 }
1331             }
1332
1333           if (sm->num_workers > 1)
1334             {
1335               ip4_header_t ip = {
1336                 .src_address = local->addr,
1337               };
1338               tsm = vec_elt_at_index (sm->per_thread_data,
1339                                       sm->worker_in2out_cb (&ip, m->fib_index));
1340             }
1341           else
1342             tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1343
1344           /* Delete sessions */
1345           u_key.addr = local->addr;
1346           u_key.fib_index = m->fib_index;
1347           kv.key = u_key.as_u64;
1348           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1349             {
1350               u = pool_elt_at_index (tsm->users, value.value);
1351               if (u->nstaticsessions)
1352                 {
1353                   head_index = u->sessions_per_user_list_head_index;
1354                   head = pool_elt_at_index (tsm->list_pool, head_index);
1355                   elt_index = head->next;
1356                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1357                   ses_index = elt->value;
1358                   while (ses_index != ~0)
1359                     {
1360                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1361                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1362                       ses_index = elt->value;
1363
1364                       if (!(is_lb_session (s)))
1365                         continue;
1366
1367                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
1368                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1369                         continue;
1370
1371                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1372                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1373                     }
1374                 }
1375             }
1376         }
1377       /* *INDENT-ON* */
1378       if (m->affinity)
1379         nat_affinity_flush_service (m->affinity_per_service_list_head_index);
1380       vec_free (m->locals);
1381       vec_free (m->tag);
1382       vec_free (m->workers);
1383
1384       pool_put (sm->static_mappings, m);
1385     }
1386
1387   return 0;
1388 }
1389
1390 int
1391 snat_del_address (snat_main_t * sm, ip4_address_t addr, u8 delete_sm,
1392                   u8 twice_nat)
1393 {
1394   snat_address_t *a = 0;
1395   snat_session_t *ses;
1396   u32 *ses_to_be_removed = 0, *ses_index;
1397   snat_main_per_thread_data_t *tsm;
1398   snat_static_mapping_t *m;
1399   snat_interface_t *interface;
1400   int i;
1401   snat_address_t *addresses =
1402     twice_nat ? sm->twice_nat_addresses : sm->addresses;
1403
1404   /* Find SNAT address */
1405   for (i = 0; i < vec_len (addresses); i++)
1406     {
1407       if (addresses[i].addr.as_u32 == addr.as_u32)
1408         {
1409           a = addresses + i;
1410           break;
1411         }
1412     }
1413   if (!a)
1414     return VNET_API_ERROR_NO_SUCH_ENTRY;
1415
1416   if (delete_sm)
1417     {
1418       /* *INDENT-OFF* */
1419       pool_foreach (m, sm->static_mappings,
1420       ({
1421           if (m->external_addr.as_u32 == addr.as_u32)
1422             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1423                                             m->local_port, m->external_port,
1424                                             m->vrf_id, is_addr_only_static_mapping(m), ~0,
1425                                             m->proto, 0, m->twice_nat,
1426                                             is_out2in_only_static_mapping(m), m->tag, is_identity_static_mapping(m));
1427       }));
1428       /* *INDENT-ON* */
1429     }
1430   else
1431     {
1432       /* Check if address is used in some static mapping */
1433       if (is_snat_address_used_in_static_mapping (sm, addr))
1434         {
1435           nat_log_notice ("address used in static mapping");
1436           return VNET_API_ERROR_UNSPECIFIED;
1437         }
1438     }
1439
1440   if (a->fib_index != ~0)
1441     fib_table_unlock (a->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_LOW);
1442
1443   /* Delete sessions using address */
1444   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1445     {
1446       /* *INDENT-OFF* */
1447       vec_foreach (tsm, sm->per_thread_data)
1448         {
1449           pool_foreach (ses, tsm->sessions, ({
1450             if (ses->out2in.addr.as_u32 == addr.as_u32)
1451               {
1452                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
1453                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1454               }
1455           }));
1456
1457           vec_foreach (ses_index, ses_to_be_removed)
1458             {
1459               ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
1460               nat44_delete_session (sm, ses, tsm - sm->per_thread_data);
1461             }
1462
1463           vec_free (ses_to_be_removed);
1464         }
1465       /* *INDENT-ON* */
1466     }
1467
1468 #define _(N, i, n, s) \
1469   clib_bitmap_free (a->busy_##n##_port_bitmap); \
1470   vec_free (a->busy_##n##_ports_per_thread);
1471   foreach_snat_protocol
1472 #undef _
1473     if (twice_nat)
1474     {
1475       vec_del1 (sm->twice_nat_addresses, i);
1476       return 0;
1477     }
1478   else
1479     vec_del1 (sm->addresses, i);
1480
1481   /* Delete external address from FIB */
1482   /* *INDENT-OFF* */
1483   pool_foreach (interface, sm->interfaces,
1484   ({
1485     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1486       continue;
1487
1488     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1489     break;
1490   }));
1491   pool_foreach (interface, sm->output_feature_interfaces,
1492   ({
1493     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1494       continue;
1495
1496     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1497     break;
1498   }));
1499   /* *INDENT-ON* */
1500
1501   return 0;
1502 }
1503
1504 int
1505 snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1506 {
1507   snat_main_t *sm = &snat_main;
1508   snat_interface_t *i;
1509   const char *feature_name, *del_feature_name;
1510   snat_address_t *ap;
1511   snat_static_mapping_t *m;
1512   snat_det_map_t *dm;
1513   nat_outside_fib_t *outside_fib;
1514   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
1515                                                        sw_if_index);
1516
1517   if (sm->out2in_dpo && !is_inside)
1518     return VNET_API_ERROR_UNSUPPORTED;
1519
1520   /* *INDENT-OFF* */
1521   pool_foreach (i, sm->output_feature_interfaces,
1522   ({
1523     if (i->sw_if_index == sw_if_index)
1524       return VNET_API_ERROR_VALUE_EXIST;
1525   }));
1526   /* *INDENT-ON* */
1527
1528   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1529     feature_name = is_inside ? "nat44-in2out-fast" : "nat44-out2in-fast";
1530   else
1531     {
1532       if (sm->num_workers > 1 && !sm->deterministic)
1533         feature_name =
1534           is_inside ? "nat44-in2out-worker-handoff" :
1535           "nat44-out2in-worker-handoff";
1536       else if (sm->deterministic)
1537         feature_name = is_inside ? "nat44-det-in2out" : "nat44-det-out2in";
1538       else if (sm->endpoint_dependent)
1539         feature_name = is_inside ? "nat44-ed-in2out" : "nat44-ed-out2in";
1540       else
1541         feature_name = is_inside ? "nat44-in2out" : "nat44-out2in";
1542     }
1543
1544   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1545     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index,
1546                                                       NAT_FQ_NELTS);
1547
1548   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1549     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index,
1550                                                       NAT_FQ_NELTS);
1551
1552   if (!is_inside)
1553     {
1554       /* *INDENT-OFF* */
1555       vec_foreach (outside_fib, sm->outside_fibs)
1556         {
1557           if (outside_fib->fib_index == fib_index)
1558             {
1559               if (is_del)
1560                 {
1561                   outside_fib->refcount--;
1562                   if (!outside_fib->refcount)
1563                     vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
1564                 }
1565               else
1566                 outside_fib->refcount++;
1567               goto feature_set;
1568             }
1569         }
1570       /* *INDENT-ON* */
1571       if (!is_del)
1572         {
1573           vec_add2 (sm->outside_fibs, outside_fib, 1);
1574           outside_fib->refcount = 1;
1575           outside_fib->fib_index = fib_index;
1576         }
1577     }
1578 feature_set:
1579   /* *INDENT-OFF* */
1580   pool_foreach (i, sm->interfaces,
1581   ({
1582     if (i->sw_if_index == sw_if_index)
1583       {
1584         if (is_del)
1585           {
1586             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1587               {
1588                 if (is_inside)
1589                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1590                 else
1591                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1592
1593                 if (sm->num_workers > 1 && !sm->deterministic)
1594                   {
1595                     del_feature_name = "nat44-handoff-classify";
1596                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1597                                                  "nat44-out2in-worker-handoff";
1598                   }
1599                 else if (sm->deterministic)
1600                   {
1601                     del_feature_name = "nat44-det-classify";
1602                     feature_name = !is_inside ?  "nat44-det-in2out" :
1603                                                  "nat44-det-out2in";
1604                   }
1605                 else if (sm->endpoint_dependent)
1606                   {
1607                     del_feature_name = "nat44-ed-classify";
1608                     feature_name = !is_inside ?  "nat44-ed-in2out" :
1609                                                  "nat44-ed-out2in";
1610                   }
1611                 else
1612                   {
1613                     del_feature_name = "nat44-classify";
1614                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1615                   }
1616
1617                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1618                                              sw_if_index, 0, 0, 0);
1619                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1620                                              sw_if_index, 1, 0, 0);
1621                 if (!is_inside)
1622                   {
1623                     if (sm->endpoint_dependent)
1624                       vnet_feature_enable_disable ("ip4-local",
1625                                                    "nat44-ed-hairpinning",
1626                                                    sw_if_index, 1, 0, 0);
1627                     else if (!sm->deterministic)
1628                       vnet_feature_enable_disable ("ip4-local",
1629                                                    "nat44-hairpinning",
1630                                                    sw_if_index, 1, 0, 0);
1631                   }
1632               }
1633             else
1634               {
1635                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1636                                              sw_if_index, 0, 0, 0);
1637                 pool_put (sm->interfaces, i);
1638                 if (is_inside)
1639                   {
1640                     if (sm->endpoint_dependent)
1641                       vnet_feature_enable_disable ("ip4-local",
1642                                                    "nat44-ed-hairpinning",
1643                                                    sw_if_index, 0, 0, 0);
1644                     else if (!sm->deterministic)
1645                       vnet_feature_enable_disable ("ip4-local",
1646                                                    "nat44-hairpinning",
1647                                                    sw_if_index, 0, 0, 0);
1648                   }
1649               }
1650           }
1651         else
1652           {
1653             if ((nat_interface_is_inside(i) && is_inside) ||
1654                 (nat_interface_is_outside(i) && !is_inside))
1655               return 0;
1656
1657             if (sm->num_workers > 1 && !sm->deterministic)
1658               {
1659                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1660                                                  "nat44-out2in-worker-handoff";
1661                 feature_name = "nat44-handoff-classify";
1662               }
1663             else if (sm->deterministic)
1664               {
1665                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
1666                                                  "nat44-det-out2in";
1667                 feature_name = "nat44-det-classify";
1668               }
1669             else if (sm->endpoint_dependent)
1670               {
1671                 del_feature_name = !is_inside ?  "nat44-ed-in2out" :
1672                                                  "nat44-ed-out2in";
1673                 feature_name = "nat44-ed-classify";
1674               }
1675             else
1676               {
1677                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1678                 feature_name = "nat44-classify";
1679               }
1680
1681             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1682                                          sw_if_index, 0, 0, 0);
1683             vnet_feature_enable_disable ("ip4-unicast", feature_name,
1684                                          sw_if_index, 1, 0, 0);
1685             if (!is_inside)
1686               {
1687                 if (sm->endpoint_dependent)
1688                   vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1689                                                sw_if_index, 0, 0, 0);
1690                 else if (!sm->deterministic)
1691                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1692                                                sw_if_index, 0, 0, 0);
1693               }
1694             goto set_flags;
1695           }
1696
1697         goto fib;
1698       }
1699   }));
1700   /* *INDENT-ON* */
1701
1702   if (is_del)
1703     return VNET_API_ERROR_NO_SUCH_ENTRY;
1704
1705   pool_get (sm->interfaces, i);
1706   i->sw_if_index = sw_if_index;
1707   i->flags = 0;
1708   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0,
1709                                0);
1710
1711   if (is_inside && !sm->out2in_dpo)
1712     {
1713       if (sm->endpoint_dependent)
1714         vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
1715                                      sw_if_index, 1, 0, 0);
1716       else if (!sm->deterministic)
1717         vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1718                                      sw_if_index, 1, 0, 0);
1719     }
1720
1721 set_flags:
1722   if (is_inside)
1723     {
1724       i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1725       return 0;
1726     }
1727   else
1728     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1729
1730   /* Add/delete external addresses to FIB */
1731 fib:
1732   /* *INDENT-OFF* */
1733   vec_foreach (ap, sm->addresses)
1734     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1735
1736   pool_foreach (m, sm->static_mappings,
1737   ({
1738     if (!(is_addr_only_static_mapping(m)) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1739       continue;
1740
1741     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1742   }));
1743
1744   pool_foreach (dm, sm->det_maps,
1745   ({
1746     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1747   }));
1748   /* *INDENT-ON* */
1749
1750   return 0;
1751 }
1752
1753 int
1754 snat_interface_add_del_output_feature (u32 sw_if_index,
1755                                        u8 is_inside, int is_del)
1756 {
1757   snat_main_t *sm = &snat_main;
1758   snat_interface_t *i;
1759   snat_address_t *ap;
1760   snat_static_mapping_t *m;
1761
1762   if (sm->deterministic ||
1763       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1764     return VNET_API_ERROR_UNSUPPORTED;
1765
1766   /* *INDENT-OFF* */
1767   pool_foreach (i, sm->interfaces,
1768   ({
1769     if (i->sw_if_index == sw_if_index)
1770       return VNET_API_ERROR_VALUE_EXIST;
1771   }));
1772   /* *INDENT-ON* */
1773
1774   if (is_inside)
1775     {
1776       if (sm->endpoint_dependent)
1777         {
1778           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-hairpin-dst",
1779                                        sw_if_index, !is_del, 0, 0);
1780           vnet_feature_enable_disable ("ip4-output", "nat44-ed-hairpin-src",
1781                                        sw_if_index, !is_del, 0, 0);
1782         }
1783       else
1784         {
1785           vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1786                                        sw_if_index, !is_del, 0, 0);
1787           vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1788                                        sw_if_index, !is_del, 0, 0);
1789         }
1790       goto fq;
1791     }
1792
1793   if (sm->num_workers > 1)
1794     {
1795       vnet_feature_enable_disable ("ip4-unicast",
1796                                    "nat44-out2in-worker-handoff",
1797                                    sw_if_index, !is_del, 0, 0);
1798       vnet_feature_enable_disable ("ip4-output",
1799                                    "nat44-in2out-output-worker-handoff",
1800                                    sw_if_index, !is_del, 0, 0);
1801     }
1802   else
1803     {
1804       if (sm->endpoint_dependent)
1805         {
1806           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-out2in",
1807                                        sw_if_index, !is_del, 0, 0);
1808           vnet_feature_enable_disable ("ip4-output", "nat44-ed-in2out-output",
1809                                        sw_if_index, !is_del, 0, 0);
1810         }
1811       else
1812         {
1813           vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in",
1814                                        sw_if_index, !is_del, 0, 0);
1815           vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1816                                        sw_if_index, !is_del, 0, 0);
1817         }
1818     }
1819
1820 fq:
1821   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1822     sm->fq_in2out_output_index =
1823       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1824
1825   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1826     sm->fq_out2in_index =
1827       vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1828
1829   /* *INDENT-OFF* */
1830   pool_foreach (i, sm->output_feature_interfaces,
1831   ({
1832     if (i->sw_if_index == sw_if_index)
1833       {
1834         if (is_del)
1835           pool_put (sm->output_feature_interfaces, i);
1836         else
1837           return VNET_API_ERROR_VALUE_EXIST;
1838
1839         goto fib;
1840       }
1841   }));
1842   /* *INDENT-ON* */
1843
1844   if (is_del)
1845     return VNET_API_ERROR_NO_SUCH_ENTRY;
1846
1847   pool_get (sm->output_feature_interfaces, i);
1848   i->sw_if_index = sw_if_index;
1849   i->flags = 0;
1850   if (is_inside)
1851     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1852   else
1853     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1854
1855   /* Add/delete external addresses to FIB */
1856 fib:
1857   if (is_inside)
1858     return 0;
1859
1860   /* *INDENT-OFF* */
1861   vec_foreach (ap, sm->addresses)
1862     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1863
1864   pool_foreach (m, sm->static_mappings,
1865   ({
1866     if (!((is_addr_only_static_mapping(m)))  || (m->local_addr.as_u32 == m->external_addr.as_u32))
1867       continue;
1868
1869     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1870   }));
1871   /* *INDENT-ON* */
1872
1873   return 0;
1874 }
1875
1876 int
1877 snat_set_workers (uword * bitmap)
1878 {
1879   snat_main_t *sm = &snat_main;
1880   int i, j = 0;
1881
1882   if (sm->num_workers < 2)
1883     return VNET_API_ERROR_FEATURE_DISABLED;
1884
1885   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1886     return VNET_API_ERROR_INVALID_WORKER;
1887
1888   vec_free (sm->workers);
1889   /* *INDENT-OFF* */
1890   clib_bitmap_foreach (i, bitmap,
1891     ({
1892       vec_add1(sm->workers, i);
1893       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
1894       j++;
1895     }));
1896   /* *INDENT-ON* */
1897
1898   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1899   sm->num_snat_thread = _vec_len (sm->workers);
1900
1901   return 0;
1902 }
1903
1904
1905 static void
1906 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1907                                        uword opaque,
1908                                        u32 sw_if_index,
1909                                        ip4_address_t * address,
1910                                        u32 address_length,
1911                                        u32 if_address_index, u32 is_delete);
1912
1913 static void
1914 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
1915                                  uword opaque,
1916                                  u32 sw_if_index,
1917                                  ip4_address_t * address,
1918                                  u32 address_length,
1919                                  u32 if_address_index, u32 is_delete);
1920
1921 static int
1922 nat_alloc_addr_and_port_default (snat_address_t * addresses,
1923                                  u32 fib_index,
1924                                  u32 thread_index,
1925                                  snat_session_key_t * k,
1926                                  u16 port_per_thread, u32 snat_thread_index);
1927
1928 static clib_error_t *
1929 snat_init (vlib_main_t * vm)
1930 {
1931   snat_main_t *sm = &snat_main;
1932   clib_error_t *error = 0;
1933   ip4_main_t *im = &ip4_main;
1934   ip_lookup_main_t *lm = &im->lookup_main;
1935   uword *p;
1936   vlib_thread_registration_t *tr;
1937   vlib_thread_main_t *tm = vlib_get_thread_main ();
1938   uword *bitmap = 0;
1939   u32 i;
1940   ip4_add_del_interface_address_callback_t cb4;
1941   vlib_node_t *error_drop_node;
1942
1943   sm->vlib_main = vm;
1944   sm->vnet_main = vnet_get_main ();
1945   sm->ip4_main = im;
1946   sm->ip4_lookup_main = lm;
1947   sm->api_main = &api_main;
1948   sm->first_worker_index = 0;
1949   sm->num_workers = 0;
1950   sm->num_snat_thread = 1;
1951   sm->workers = 0;
1952   sm->port_per_thread = 0xffff - 1024;
1953   sm->fq_in2out_index = ~0;
1954   sm->fq_out2in_index = ~0;
1955   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1956   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1957   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1958   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1959   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
1960   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
1961   sm->forwarding_enabled = 0;
1962   sm->log_class = vlib_log_register_class ("nat", 0);
1963   error_drop_node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
1964   sm->error_node_index = error_drop_node->index;
1965   sm->mss_clamping = 0;
1966
1967   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1968   if (p)
1969     {
1970       tr = (vlib_thread_registration_t *) p[0];
1971       if (tr)
1972         {
1973           sm->num_workers = tr->count;
1974           sm->first_worker_index = tr->first_index;
1975         }
1976     }
1977
1978   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1979
1980   /* Use all available workers by default */
1981   if (sm->num_workers > 1)
1982     {
1983       for (i = 0; i < sm->num_workers; i++)
1984         bitmap = clib_bitmap_set (bitmap, i, 1);
1985       snat_set_workers (bitmap);
1986       clib_bitmap_free (bitmap);
1987     }
1988   else
1989     {
1990       sm->per_thread_data[0].snat_thread_index = 0;
1991     }
1992
1993   error = snat_api_init (vm, sm);
1994   if (error)
1995     return error;
1996
1997   /* Set up the interface address add/del callback */
1998   cb4.function = snat_ip4_add_del_interface_address_cb;
1999   cb4.function_opaque = 0;
2000
2001   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2002
2003   cb4.function = nat_ip4_add_del_addr_only_sm_cb;
2004   cb4.function_opaque = 0;
2005
2006   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2007
2008   nat_dpo_module_init ();
2009
2010   /* Init IPFIX logging */
2011   snat_ipfix_logging_init (vm);
2012
2013   /* Init NAT64 */
2014   error = nat64_init (vm);
2015   if (error)
2016     return error;
2017
2018   dslite_init (vm);
2019
2020   nat66_init ();
2021
2022   /* Init virtual fragmenentation reassembly */
2023   return nat_reass_init (vm);
2024 }
2025
2026 VLIB_INIT_FUNCTION (snat_init);
2027
2028 void
2029 snat_free_outside_address_and_port (snat_address_t * addresses,
2030                                     u32 thread_index, snat_session_key_t * k)
2031 {
2032   snat_address_t *a;
2033   u32 address_index;
2034   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
2035
2036   for (address_index = 0; address_index < vec_len (addresses);
2037        address_index++)
2038     {
2039       if (addresses[address_index].addr.as_u32 == k->addr.as_u32)
2040         break;
2041     }
2042
2043   ASSERT (address_index < vec_len (addresses));
2044
2045   a = addresses + address_index;
2046
2047   switch (k->protocol)
2048     {
2049 #define _(N, i, n, s) \
2050     case SNAT_PROTOCOL_##N: \
2051       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
2052         port_host_byte_order) == 1); \
2053       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
2054         port_host_byte_order, 0); \
2055       a->busy_##n##_ports--; \
2056       a->busy_##n##_ports_per_thread[thread_index]--; \
2057       break;
2058       foreach_snat_protocol
2059 #undef _
2060     default:
2061       nat_log_info ("unknown protocol");
2062       return;
2063     }
2064 }
2065
2066 int
2067 snat_static_mapping_match (snat_main_t * sm,
2068                            snat_session_key_t match,
2069                            snat_session_key_t * mapping,
2070                            u8 by_external,
2071                            u8 * is_addr_only,
2072                            twice_nat_type_t * twice_nat,
2073                            lb_nat_type_t * lb, ip4_address_t * ext_host_addr,
2074                            u8 * is_identity_nat)
2075 {
2076   clib_bihash_kv_8_8_t kv, value;
2077   snat_static_mapping_t *m;
2078   snat_session_key_t m_key;
2079   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
2080   u32 rand, lo = 0, hi, mid;
2081   u8 backend_index;
2082
2083   m_key.fib_index = match.fib_index;
2084   if (by_external)
2085     {
2086       mapping_hash = &sm->static_mapping_by_external;
2087       m_key.fib_index = 0;
2088     }
2089
2090   m_key.addr = match.addr;
2091   m_key.port = clib_net_to_host_u16 (match.port);
2092   m_key.protocol = match.protocol;
2093
2094   kv.key = m_key.as_u64;
2095
2096   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2097     {
2098       /* Try address only mapping */
2099       m_key.port = 0;
2100       m_key.protocol = 0;
2101       kv.key = m_key.as_u64;
2102       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2103         return 1;
2104     }
2105
2106   m = pool_elt_at_index (sm->static_mappings, value.value);
2107
2108   if (by_external)
2109     {
2110       if (is_lb_static_mapping (m))
2111         {
2112           if (PREDICT_FALSE (lb != 0))
2113             *lb = m->affinity ? AFFINITY_LB_NAT : LB_NAT;
2114           if (m->affinity)
2115             {
2116               if (nat_affinity_find_and_lock (ext_host_addr[0], match.addr,
2117                                               match.protocol, match.port,
2118                                               &backend_index))
2119                 goto get_local;
2120
2121               mapping->addr = m->locals[backend_index].addr;
2122               mapping->port =
2123                 clib_host_to_net_u16 (m->locals[backend_index].port);
2124               mapping->fib_index = m->locals[backend_index].fib_index;
2125               goto end;
2126             }
2127         get_local:
2128           hi = vec_len (m->locals) - 1;
2129           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
2130           while (lo < hi)
2131             {
2132               mid = ((hi - lo) >> 1) + lo;
2133               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
2134             }
2135           if (!(m->locals[lo].prefix >= rand))
2136             return 1;
2137           if (PREDICT_FALSE (sm->num_workers > 1))
2138             {
2139               ip4_header_t ip = {
2140                 .src_address = m->locals[lo].addr,
2141               };
2142               if (sm->worker_in2out_cb (&ip, m->fib_index) !=
2143                   vlib_get_thread_index ())
2144                 goto get_local;
2145             }
2146           mapping->addr = m->locals[lo].addr;
2147           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
2148           mapping->fib_index = m->locals[lo].fib_index;
2149           if (m->affinity)
2150             {
2151               if (nat_affinity_create_and_lock (ext_host_addr[0], match.addr,
2152                                                 match.protocol, match.port,
2153                                                 lo, m->affinity,
2154                                                 m->affinity_per_service_list_head_index))
2155                 nat_log_info ("create affinity record failed");
2156             }
2157         }
2158       else
2159         {
2160           if (PREDICT_FALSE (lb != 0))
2161             *lb = NO_LB_NAT;
2162           mapping->fib_index = m->fib_index;
2163           mapping->addr = m->local_addr;
2164           /* Address only mapping doesn't change port */
2165           mapping->port = is_addr_only_static_mapping (m) ? match.port
2166             : clib_host_to_net_u16 (m->local_port);
2167         }
2168       mapping->protocol = m->proto;
2169     }
2170   else
2171     {
2172       mapping->addr = m->external_addr;
2173       /* Address only mapping doesn't change port */
2174       mapping->port = is_addr_only_static_mapping (m) ? match.port
2175         : clib_host_to_net_u16 (m->external_port);
2176       mapping->fib_index = sm->outside_fib_index;
2177     }
2178
2179 end:
2180   if (PREDICT_FALSE (is_addr_only != 0))
2181     *is_addr_only = is_addr_only_static_mapping (m);
2182
2183   if (PREDICT_FALSE (twice_nat != 0))
2184     *twice_nat = m->twice_nat;
2185
2186   if (PREDICT_FALSE (is_identity_nat != 0))
2187     *is_identity_nat = is_identity_static_mapping (m);
2188
2189   return 0;
2190 }
2191
2192 static_always_inline u16
2193 snat_random_port (u16 min, u16 max)
2194 {
2195   snat_main_t *sm = &snat_main;
2196   return min + random_u32 (&sm->random_seed) /
2197     (random_u32_max () / (max - min + 1) + 1);
2198 }
2199
2200 int
2201 snat_alloc_outside_address_and_port (snat_address_t * addresses,
2202                                      u32 fib_index,
2203                                      u32 thread_index,
2204                                      snat_session_key_t * k,
2205                                      u16 port_per_thread,
2206                                      u32 snat_thread_index)
2207 {
2208   snat_main_t *sm = &snat_main;
2209
2210   return sm->alloc_addr_and_port (addresses, fib_index, thread_index, k,
2211                                   port_per_thread, snat_thread_index);
2212 }
2213
2214 static int
2215 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2216                                  u32 fib_index,
2217                                  u32 thread_index,
2218                                  snat_session_key_t * k,
2219                                  u16 port_per_thread, u32 snat_thread_index)
2220 {
2221   int i;
2222   snat_address_t *a, *ga = 0;
2223   u32 portnum;
2224
2225   for (i = 0; i < vec_len (addresses); i++)
2226     {
2227       a = addresses + i;
2228       switch (k->protocol)
2229         {
2230 #define _(N, j, n, s) \
2231         case SNAT_PROTOCOL_##N: \
2232           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
2233             { \
2234               if (a->fib_index == fib_index) \
2235                 { \
2236                   while (1) \
2237                     { \
2238                       portnum = (port_per_thread * \
2239                         snat_thread_index) + \
2240                         snat_random_port(1, port_per_thread) + 1024; \
2241                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2242                         continue; \
2243                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2244                       a->busy_##n##_ports_per_thread[thread_index]++; \
2245                       a->busy_##n##_ports++; \
2246                       k->addr = a->addr; \
2247                       k->port = clib_host_to_net_u16(portnum); \
2248                       return 0; \
2249                     } \
2250                 } \
2251               else if (a->fib_index == ~0) \
2252                 { \
2253                   ga = a; \
2254                 } \
2255             } \
2256           break;
2257           foreach_snat_protocol
2258 #undef _
2259         default:
2260           nat_log_info ("unknown protocol");
2261           return 1;
2262         }
2263
2264     }
2265
2266   if (ga)
2267     {
2268       a = ga;
2269       switch (k->protocol)
2270         {
2271 #define _(N, j, n, s) \
2272         case SNAT_PROTOCOL_##N: \
2273           while (1) \
2274             { \
2275               portnum = (port_per_thread * \
2276                 snat_thread_index) + \
2277                 snat_random_port(1, port_per_thread) + 1024; \
2278               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2279                 continue; \
2280               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2281               a->busy_##n##_ports_per_thread[thread_index]++; \
2282               a->busy_##n##_ports++; \
2283               k->addr = a->addr; \
2284               k->port = clib_host_to_net_u16(portnum); \
2285               return 0; \
2286             }
2287           break;
2288           foreach_snat_protocol
2289 #undef _
2290         default:
2291           nat_log_info ("unknown protocol");
2292           return 1;
2293         }
2294     }
2295
2296   /* Totally out of translations to use... */
2297   snat_ipfix_logging_addresses_exhausted (0);
2298   return 1;
2299 }
2300
2301 static int
2302 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
2303                               u32 fib_index,
2304                               u32 thread_index,
2305                               snat_session_key_t * k,
2306                               u16 port_per_thread, u32 snat_thread_index)
2307 {
2308   snat_main_t *sm = &snat_main;
2309   snat_address_t *a = addresses;
2310   u16 m, ports, portnum, A, j;
2311   m = 16 - (sm->psid_offset + sm->psid_length);
2312   ports = (1 << (16 - sm->psid_length)) - (1 << m);
2313
2314   if (!vec_len (addresses))
2315     goto exhausted;
2316
2317   switch (k->protocol)
2318     {
2319 #define _(N, i, n, s) \
2320     case SNAT_PROTOCOL_##N: \
2321       if (a->busy_##n##_ports < ports) \
2322         { \
2323           while (1) \
2324             { \
2325               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2326               j = snat_random_port(0, pow2_mask(m)); \
2327               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2328               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2329                 continue; \
2330               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2331               a->busy_##n##_ports++; \
2332               k->addr = a->addr; \
2333               k->port = clib_host_to_net_u16 (portnum); \
2334               return 0; \
2335             } \
2336         } \
2337       break;
2338       foreach_snat_protocol
2339 #undef _
2340     default:
2341       nat_log_info ("unknown protocol");
2342       return 1;
2343     }
2344
2345 exhausted:
2346   /* Totally out of translations to use... */
2347   snat_ipfix_logging_addresses_exhausted (0);
2348   return 1;
2349 }
2350
2351 static int
2352 nat_alloc_addr_and_port_range (snat_address_t * addresses,
2353                                u32 fib_index,
2354                                u32 thread_index,
2355                                snat_session_key_t * k,
2356                                u16 port_per_thread, u32 snat_thread_index)
2357 {
2358   snat_main_t *sm = &snat_main;
2359   snat_address_t *a = addresses;
2360   u16 portnum, ports;
2361
2362   ports = sm->end_port - sm->start_port + 1;
2363
2364   if (!vec_len (addresses))
2365     goto exhausted;
2366
2367   switch (k->protocol)
2368     {
2369 #define _(N, i, n, s) \
2370     case SNAT_PROTOCOL_##N: \
2371       if (a->busy_##n##_ports < ports) \
2372         { \
2373           while (1) \
2374             { \
2375               portnum = snat_random_port(sm->start_port, sm->end_port); \
2376               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2377                 continue; \
2378               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2379               a->busy_##n##_ports++; \
2380               k->addr = a->addr; \
2381               k->port = clib_host_to_net_u16 (portnum); \
2382               return 0; \
2383             } \
2384         } \
2385       break;
2386       foreach_snat_protocol
2387 #undef _
2388     default:
2389       nat_log_info ("unknown protocol");
2390       return 1;
2391     }
2392
2393 exhausted:
2394   /* Totally out of translations to use... */
2395   snat_ipfix_logging_addresses_exhausted (0);
2396   return 1;
2397 }
2398
2399 void
2400 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2401 {
2402   dpo_id_t dpo_v4 = DPO_INVALID;
2403   fib_prefix_t pfx = {
2404     .fp_proto = FIB_PROTOCOL_IP4,
2405     .fp_len = 32,
2406     .fp_addr.ip4.as_u32 = addr.as_u32,
2407   };
2408
2409   if (is_add)
2410     {
2411       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2412       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2413                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2414       dpo_reset (&dpo_v4);
2415     }
2416   else
2417     {
2418       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2419     }
2420 }
2421
2422 u8 *
2423 format_session_kvp (u8 * s, va_list * args)
2424 {
2425   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2426   snat_session_key_t k;
2427
2428   k.as_u64 = v->key;
2429
2430   s = format (s, "%U session-index %llu", format_snat_key, &k, v->value);
2431
2432   return s;
2433 }
2434
2435 u8 *
2436 format_static_mapping_kvp (u8 * s, va_list * args)
2437 {
2438   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2439   snat_session_key_t k;
2440
2441   k.as_u64 = v->key;
2442
2443   s = format (s, "%U static-mapping-index %llu",
2444               format_static_mapping_key, &k, v->value);
2445
2446   return s;
2447 }
2448
2449 u8 *
2450 format_user_kvp (u8 * s, va_list * args)
2451 {
2452   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2453   snat_user_key_t k;
2454
2455   k.as_u64 = v->key;
2456
2457   s = format (s, "%U fib %d user-index %llu", format_ip4_address, &k.addr,
2458               k.fib_index, v->value);
2459
2460   return s;
2461 }
2462
2463 u8 *
2464 format_ed_session_kvp (u8 * s, va_list * args)
2465 {
2466   clib_bihash_kv_16_8_t *v = va_arg (*args, clib_bihash_kv_16_8_t *);
2467   nat_ed_ses_key_t k;
2468
2469   k.as_u64[0] = v->key[0];
2470   k.as_u64[1] = v->key[1];
2471
2472   s =
2473     format (s, "local %U:%d remote %U:%d proto %U fib %d session-index %llu",
2474             format_ip4_address, &k.l_addr, clib_net_to_host_u16 (k.l_port),
2475             format_ip4_address, &k.r_addr, clib_net_to_host_u16 (k.r_port),
2476             format_ip_protocol, k.proto, k.fib_index, v->value);
2477
2478   return s;
2479 }
2480
2481 static u32
2482 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2483 {
2484   snat_main_t *sm = &snat_main;
2485   u32 next_worker_index = 0;
2486   u32 hash;
2487
2488   next_worker_index = sm->first_worker_index;
2489   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2490     (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >> 24);
2491
2492   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2493     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2494   else
2495     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2496
2497   return next_worker_index;
2498 }
2499
2500 static u32
2501 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2502 {
2503   snat_main_t *sm = &snat_main;
2504   udp_header_t *udp;
2505   u16 port;
2506   snat_session_key_t m_key;
2507   clib_bihash_kv_8_8_t kv, value;
2508   snat_static_mapping_t *m;
2509   u32 proto;
2510   u32 next_worker_index = 0;
2511
2512   /* first try static mappings without port */
2513   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2514     {
2515       m_key.addr = ip0->dst_address;
2516       m_key.port = 0;
2517       m_key.protocol = 0;
2518       m_key.fib_index = rx_fib_index0;
2519       kv.key = m_key.as_u64;
2520       if (!clib_bihash_search_8_8
2521           (&sm->static_mapping_by_external, &kv, &value))
2522         {
2523           m = pool_elt_at_index (sm->static_mappings, value.value);
2524           return m->workers[0];
2525         }
2526     }
2527
2528   proto = ip_proto_to_snat_proto (ip0->protocol);
2529   udp = ip4_next_header (ip0);
2530   port = udp->dst_port;
2531
2532   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2533     {
2534       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2535         return vlib_get_thread_index ();
2536
2537       if (PREDICT_TRUE (!ip4_is_first_fragment (ip0)))
2538         {
2539           nat_reass_ip4_t *reass;
2540
2541           reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2542                                       ip0->fragment_id, ip0->protocol);
2543
2544           if (reass && (reass->thread_index != (u32) ~ 0))
2545             return reass->thread_index;
2546           else
2547             return vlib_get_thread_index ();
2548         }
2549     }
2550
2551   /* unknown protocol */
2552   if (PREDICT_FALSE (proto == ~0))
2553     {
2554       /* use current thread */
2555       return vlib_get_thread_index ();
2556     }
2557
2558   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2559     {
2560       icmp46_header_t *icmp = (icmp46_header_t *) udp;
2561       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
2562       if (!icmp_is_error_message (icmp))
2563         port = echo->identifier;
2564       else
2565         {
2566           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
2567           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2568           void *l4_header = ip4_next_header (inner_ip);
2569           switch (proto)
2570             {
2571             case SNAT_PROTOCOL_ICMP:
2572               icmp = (icmp46_header_t *) l4_header;
2573               echo = (icmp_echo_header_t *) (icmp + 1);
2574               port = echo->identifier;
2575               break;
2576             case SNAT_PROTOCOL_UDP:
2577             case SNAT_PROTOCOL_TCP:
2578               port = ((tcp_udp_header_t *) l4_header)->src_port;
2579               break;
2580             default:
2581               return vlib_get_thread_index ();
2582             }
2583         }
2584     }
2585
2586   /* try static mappings with port */
2587   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2588     {
2589       m_key.addr = ip0->dst_address;
2590       m_key.port = clib_net_to_host_u16 (port);
2591       m_key.protocol = proto;
2592       m_key.fib_index = rx_fib_index0;
2593       kv.key = m_key.as_u64;
2594       if (!clib_bihash_search_8_8
2595           (&sm->static_mapping_by_external, &kv, &value))
2596         {
2597           m = pool_elt_at_index (sm->static_mappings, value.value);
2598           return m->workers[0];
2599         }
2600     }
2601
2602   /* worker by outside port */
2603   next_worker_index = sm->first_worker_index;
2604   next_worker_index +=
2605     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2606   return next_worker_index;
2607 }
2608
2609 static u32
2610 nat44_ed_get_worker_out2in_cb (ip4_header_t * ip, u32 rx_fib_index)
2611 {
2612   snat_main_t *sm = &snat_main;
2613   clib_bihash_kv_8_8_t kv, value;
2614   u32 proto, next_worker_index = 0;
2615   udp_header_t *udp;
2616   u16 port;
2617   snat_static_mapping_t *m;
2618   u32 hash;
2619
2620   /* first try static mappings without port */
2621   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2622     {
2623       make_sm_kv (&kv, &ip->dst_address, 0, rx_fib_index, 0);
2624       if (!clib_bihash_search_8_8
2625           (&sm->static_mapping_by_external, &kv, &value))
2626         {
2627           m = pool_elt_at_index (sm->static_mappings, value.value);
2628           return m->workers[0];
2629         }
2630     }
2631
2632   proto = ip_proto_to_snat_proto (ip->protocol);
2633
2634   /* unknown protocol */
2635   if (PREDICT_FALSE (proto == ~0))
2636     {
2637       /* use current thread */
2638       return vlib_get_thread_index ();
2639     }
2640
2641   udp = ip4_next_header (ip);
2642   port = udp->dst_port;
2643
2644   if (PREDICT_FALSE (ip->protocol == IP_PROTOCOL_ICMP))
2645     {
2646       icmp46_header_t *icmp = (icmp46_header_t *) udp;
2647       icmp_echo_header_t *echo = (icmp_echo_header_t *) (icmp + 1);
2648       if (!icmp_is_error_message (icmp))
2649         port = echo->identifier;
2650       else
2651         {
2652           ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1);
2653           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2654           void *l4_header = ip4_next_header (inner_ip);
2655           switch (proto)
2656             {
2657             case SNAT_PROTOCOL_ICMP:
2658               icmp = (icmp46_header_t *) l4_header;
2659               echo = (icmp_echo_header_t *) (icmp + 1);
2660               port = echo->identifier;
2661               break;
2662             case SNAT_PROTOCOL_UDP:
2663             case SNAT_PROTOCOL_TCP:
2664               port = ((tcp_udp_header_t *) l4_header)->src_port;
2665               break;
2666             default:
2667               return vlib_get_thread_index ();
2668             }
2669         }
2670     }
2671
2672   /* try static mappings with port */
2673   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2674     {
2675       make_sm_kv (&kv, &ip->dst_address, proto, rx_fib_index,
2676                   clib_net_to_host_u16 (port));
2677       if (!clib_bihash_search_8_8
2678           (&sm->static_mapping_by_external, &kv, &value))
2679         {
2680           m = pool_elt_at_index (sm->static_mappings, value.value);
2681           if (!is_lb_static_mapping (m))
2682             return m->workers[0];
2683
2684           hash = ip->src_address.as_u32 + (ip->src_address.as_u32 >> 8) +
2685             (ip->src_address.as_u32 >> 16) + (ip->src_address.as_u32 >> 24);
2686
2687           if (PREDICT_TRUE (is_pow2 (_vec_len (m->workers))))
2688             return m->workers[hash & (_vec_len (m->workers) - 1)];
2689           else
2690             return m->workers[hash % _vec_len (m->workers)];
2691         }
2692     }
2693
2694   /* worker by outside port */
2695   next_worker_index = sm->first_worker_index;
2696   next_worker_index +=
2697     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2698
2699   return next_worker_index;
2700 }
2701
2702 static clib_error_t *
2703 snat_config (vlib_main_t * vm, unformat_input_t * input)
2704 {
2705   snat_main_t *sm = &snat_main;
2706   nat66_main_t *nm = &nat66_main;
2707   u32 translation_buckets = 1024;
2708   u32 translation_memory_size = 128 << 20;
2709   u32 user_buckets = 128;
2710   u32 user_memory_size = 64 << 20;
2711   u32 max_translations_per_user = 100;
2712   u32 outside_vrf_id = 0;
2713   u32 outside_ip6_vrf_id = 0;
2714   u32 inside_vrf_id = 0;
2715   u32 static_mapping_buckets = 1024;
2716   u32 static_mapping_memory_size = 64 << 20;
2717   u32 nat64_bib_buckets = 1024;
2718   u32 nat64_bib_memory_size = 128 << 20;
2719   u32 nat64_st_buckets = 2048;
2720   u32 nat64_st_memory_size = 256 << 20;
2721   u8 static_mapping_only = 0;
2722   u8 static_mapping_connection_tracking = 0;
2723   snat_main_per_thread_data_t *tsm;
2724   dslite_main_t *dm = &dslite_main;
2725
2726   sm->deterministic = 0;
2727   sm->out2in_dpo = 0;
2728   sm->endpoint_dependent = 0;
2729
2730   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2731     {
2732       if (unformat
2733           (input, "translation hash buckets %d", &translation_buckets))
2734         ;
2735       else if (unformat (input, "translation hash memory %d",
2736                          &translation_memory_size));
2737       else if (unformat (input, "user hash buckets %d", &user_buckets))
2738         ;
2739       else if (unformat (input, "user hash memory %d", &user_memory_size))
2740         ;
2741       else if (unformat (input, "max translations per user %d",
2742                          &max_translations_per_user))
2743         ;
2744       else if (unformat (input, "outside VRF id %d", &outside_vrf_id))
2745         ;
2746       else if (unformat (input, "outside ip6 VRF id %d", &outside_ip6_vrf_id))
2747         ;
2748       else if (unformat (input, "inside VRF id %d", &inside_vrf_id))
2749         ;
2750       else if (unformat (input, "static mapping only"))
2751         {
2752           static_mapping_only = 1;
2753           if (unformat (input, "connection tracking"))
2754             static_mapping_connection_tracking = 1;
2755         }
2756       else if (unformat (input, "deterministic"))
2757         sm->deterministic = 1;
2758       else if (unformat (input, "nat64 bib hash buckets %d",
2759                          &nat64_bib_buckets))
2760         ;
2761       else if (unformat (input, "nat64 bib hash memory %d",
2762                          &nat64_bib_memory_size))
2763         ;
2764       else
2765         if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
2766         ;
2767       else if (unformat (input, "nat64 st hash memory %d",
2768                          &nat64_st_memory_size))
2769         ;
2770       else if (unformat (input, "out2in dpo"))
2771         sm->out2in_dpo = 1;
2772       else if (unformat (input, "dslite ce"))
2773         dslite_set_ce (dm, 1);
2774       else if (unformat (input, "endpoint-dependent"))
2775         sm->endpoint_dependent = 1;
2776       else
2777         return clib_error_return (0, "unknown input '%U'",
2778                                   format_unformat_error, input);
2779     }
2780
2781   if (sm->deterministic && sm->endpoint_dependent)
2782     return clib_error_return (0,
2783                               "deterministic and endpoint-dependent modes are mutually exclusive");
2784
2785   if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent))
2786     return clib_error_return (0,
2787                               "static mapping only mode available only for simple nat");
2788
2789   if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent))
2790     return clib_error_return (0,
2791                               "out2in dpo mode available only for simple nat");
2792
2793   /* for show commands, etc. */
2794   sm->translation_buckets = translation_buckets;
2795   sm->translation_memory_size = translation_memory_size;
2796   /* do not exceed load factor 10 */
2797   sm->max_translations = 10 * translation_buckets;
2798   sm->user_buckets = user_buckets;
2799   sm->user_memory_size = user_memory_size;
2800   sm->max_translations_per_user = max_translations_per_user;
2801   sm->outside_vrf_id = outside_vrf_id;
2802   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2803                                                              outside_vrf_id,
2804                                                              FIB_SOURCE_PLUGIN_HI);
2805   nm->outside_vrf_id = outside_ip6_vrf_id;
2806   nm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP6,
2807                                                              outside_ip6_vrf_id,
2808                                                              FIB_SOURCE_PLUGIN_HI);
2809   sm->inside_vrf_id = inside_vrf_id;
2810   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
2811                                                             inside_vrf_id,
2812                                                             FIB_SOURCE_PLUGIN_HI);
2813   sm->static_mapping_only = static_mapping_only;
2814   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
2815
2816   nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
2817                   nat64_st_memory_size);
2818
2819   if (sm->deterministic)
2820     {
2821       sm->in2out_node_index = snat_det_in2out_node.index;
2822       sm->in2out_output_node_index = ~0;
2823       sm->out2in_node_index = snat_det_out2in_node.index;
2824       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
2825       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
2826     }
2827   else
2828     {
2829       if (sm->endpoint_dependent)
2830         {
2831           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2832           sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
2833           sm->in2out_node_index = nat44_ed_in2out_node.index;
2834           sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
2835           sm->out2in_node_index = nat44_ed_out2in_node.index;
2836           sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
2837           sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
2838           nat_affinity_init (vm);
2839         }
2840       else
2841         {
2842           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
2843           sm->worker_out2in_cb = snat_get_worker_out2in_cb;
2844           sm->in2out_node_index = snat_in2out_node.index;
2845           sm->in2out_output_node_index = snat_in2out_output_node.index;
2846           sm->out2in_node_index = snat_out2in_node.index;
2847           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
2848           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
2849         }
2850       if (!static_mapping_only ||
2851           (static_mapping_only && static_mapping_connection_tracking))
2852         {
2853           /* *INDENT-OFF* */
2854           vec_foreach (tsm, sm->per_thread_data)
2855             {
2856               if (sm->endpoint_dependent)
2857                 {
2858                   clib_bihash_init_16_8 (&tsm->in2out_ed, "in2out-ed",
2859                                          translation_buckets,
2860                                          translation_memory_size);
2861                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->in2out_ed,
2862                                                       format_ed_session_kvp);
2863
2864                   clib_bihash_init_16_8 (&tsm->out2in_ed, "out2in-ed",
2865                                          translation_buckets,
2866                                          translation_memory_size);
2867                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->out2in_ed,
2868                                                       format_ed_session_kvp);
2869                 }
2870               else
2871                 {
2872                   clib_bihash_init_8_8 (&tsm->in2out, "in2out",
2873                                         translation_buckets,
2874                                         translation_memory_size);
2875                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->in2out,
2876                                                      format_session_kvp);
2877
2878                   clib_bihash_init_8_8 (&tsm->out2in, "out2in",
2879                                         translation_buckets,
2880                                         translation_memory_size);
2881                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->out2in,
2882                                                      format_session_kvp);
2883                 }
2884
2885               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
2886                                     user_memory_size);
2887               clib_bihash_set_kvp_format_fn_8_8 (&tsm->user_hash,
2888                                                  format_user_kvp);
2889             }
2890           /* *INDENT-ON* */
2891
2892         }
2893       else
2894         {
2895           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
2896           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
2897         }
2898       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
2899                             "static_mapping_by_local", static_mapping_buckets,
2900                             static_mapping_memory_size);
2901       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
2902                                          format_static_mapping_kvp);
2903
2904       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
2905                             "static_mapping_by_external",
2906                             static_mapping_buckets,
2907                             static_mapping_memory_size);
2908       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
2909                                          format_static_mapping_kvp);
2910     }
2911
2912   return 0;
2913 }
2914
2915 VLIB_CONFIG_FUNCTION (snat_config, "nat");
2916
2917 static void
2918 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
2919                                  uword opaque,
2920                                  u32 sw_if_index,
2921                                  ip4_address_t * address,
2922                                  u32 address_length,
2923                                  u32 if_address_index, u32 is_delete)
2924 {
2925   snat_main_t *sm = &snat_main;
2926   snat_static_map_resolve_t *rp;
2927   snat_static_mapping_t *m;
2928   snat_session_key_t m_key;
2929   clib_bihash_kv_8_8_t kv, value;
2930   int i, rv;
2931   ip4_address_t l_addr;
2932
2933   for (i = 0; i < vec_len (sm->to_resolve); i++)
2934     {
2935       rp = sm->to_resolve + i;
2936       if (rp->addr_only == 0)
2937         continue;
2938       if (rp->sw_if_index == sw_if_index)
2939         goto match;
2940     }
2941
2942   return;
2943
2944 match:
2945   m_key.addr.as_u32 = address->as_u32;
2946   m_key.port = rp->addr_only ? 0 : rp->e_port;
2947   m_key.protocol = rp->addr_only ? 0 : rp->proto;
2948   m_key.fib_index = sm->outside_fib_index;
2949   kv.key = m_key.as_u64;
2950   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2951     m = 0;
2952   else
2953     m = pool_elt_at_index (sm->static_mappings, value.value);
2954
2955   if (!is_delete)
2956     {
2957       /* Don't trip over lease renewal, static config */
2958       if (m)
2959         return;
2960     }
2961   else
2962     {
2963       if (!m)
2964         return;
2965     }
2966
2967   /* Indetity mapping? */
2968   if (rp->l_addr.as_u32 == 0)
2969     l_addr.as_u32 = address[0].as_u32;
2970   else
2971     l_addr.as_u32 = rp->l_addr.as_u32;
2972   /* Add the static mapping */
2973   rv = snat_add_static_mapping (l_addr,
2974                                 address[0],
2975                                 rp->l_port,
2976                                 rp->e_port,
2977                                 rp->vrf_id,
2978                                 rp->addr_only, ~0 /* sw_if_index */ ,
2979                                 rp->proto, !is_delete, rp->twice_nat,
2980                                 rp->out2in_only, rp->tag, rp->identity_nat);
2981   if (rv)
2982     nat_log_notice ("snat_add_static_mapping returned %d", rv);
2983 }
2984
2985 static void
2986 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2987                                        uword opaque,
2988                                        u32 sw_if_index,
2989                                        ip4_address_t * address,
2990                                        u32 address_length,
2991                                        u32 if_address_index, u32 is_delete)
2992 {
2993   snat_main_t *sm = &snat_main;
2994   snat_static_map_resolve_t *rp;
2995   ip4_address_t l_addr;
2996   int i, j;
2997   int rv;
2998   u8 twice_nat = 0;
2999   snat_address_t *addresses = sm->addresses;
3000
3001   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices); i++)
3002     {
3003       if (sw_if_index == sm->auto_add_sw_if_indices[i])
3004         goto match;
3005     }
3006
3007   for (i = 0; i < vec_len (sm->auto_add_sw_if_indices_twice_nat); i++)
3008     {
3009       twice_nat = 1;
3010       addresses = sm->twice_nat_addresses;
3011       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
3012         goto match;
3013     }
3014
3015   return;
3016
3017 match:
3018   if (!is_delete)
3019     {
3020       /* Don't trip over lease renewal, static config */
3021       for (j = 0; j < vec_len (addresses); j++)
3022         if (addresses[j].addr.as_u32 == address->as_u32)
3023           return;
3024
3025       (void) snat_add_address (sm, address, ~0, twice_nat);
3026       /* Scan static map resolution vector */
3027       for (j = 0; j < vec_len (sm->to_resolve); j++)
3028         {
3029           rp = sm->to_resolve + j;
3030           if (rp->addr_only)
3031             continue;
3032           /* On this interface? */
3033           if (rp->sw_if_index == sw_if_index)
3034             {
3035               /* Indetity mapping? */
3036               if (rp->l_addr.as_u32 == 0)
3037                 l_addr.as_u32 = address[0].as_u32;
3038               else
3039                 l_addr.as_u32 = rp->l_addr.as_u32;
3040               /* Add the static mapping */
3041               rv = snat_add_static_mapping (l_addr,
3042                                             address[0],
3043                                             rp->l_port,
3044                                             rp->e_port,
3045                                             rp->vrf_id,
3046                                             rp->addr_only,
3047                                             ~0 /* sw_if_index */ ,
3048                                             rp->proto,
3049                                             rp->is_add, rp->twice_nat,
3050                                             rp->out2in_only, rp->tag,
3051                                             rp->identity_nat);
3052               if (rv)
3053                 nat_log_notice ("snat_add_static_mapping returned %d", rv);
3054             }
3055         }
3056       return;
3057     }
3058   else
3059     {
3060       (void) snat_del_address (sm, address[0], 1, twice_nat);
3061       return;
3062     }
3063 }
3064
3065
3066 int
3067 snat_add_interface_address (snat_main_t * sm, u32 sw_if_index, int is_del,
3068                             u8 twice_nat)
3069 {
3070   ip4_main_t *ip4_main = sm->ip4_main;
3071   ip4_address_t *first_int_addr;
3072   snat_static_map_resolve_t *rp;
3073   u32 *indices_to_delete = 0;
3074   int i, j;
3075   u32 *auto_add_sw_if_indices =
3076     twice_nat ? sm->
3077     auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3078
3079   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index, 0        /* just want the address */
3080     );
3081
3082   for (i = 0; i < vec_len (auto_add_sw_if_indices); i++)
3083     {
3084       if (auto_add_sw_if_indices[i] == sw_if_index)
3085         {
3086           if (is_del)
3087             {
3088               /* if have address remove it */
3089               if (first_int_addr)
3090                 (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3091               else
3092                 {
3093                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3094                     {
3095                       rp = sm->to_resolve + j;
3096                       if (rp->sw_if_index == sw_if_index)
3097                         vec_add1 (indices_to_delete, j);
3098                     }
3099                   if (vec_len (indices_to_delete))
3100                     {
3101                       for (j = vec_len (indices_to_delete) - 1; j >= 0; j--)
3102                         vec_del1 (sm->to_resolve, j);
3103                       vec_free (indices_to_delete);
3104                     }
3105                 }
3106               if (twice_nat)
3107                 vec_del1 (sm->auto_add_sw_if_indices_twice_nat, i);
3108               else
3109                 vec_del1 (sm->auto_add_sw_if_indices, i);
3110             }
3111           else
3112             return VNET_API_ERROR_VALUE_EXIST;
3113
3114           return 0;
3115         }
3116     }
3117
3118   if (is_del)
3119     return VNET_API_ERROR_NO_SUCH_ENTRY;
3120
3121   /* add to the auto-address list */
3122   if (twice_nat)
3123     vec_add1 (sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3124   else
3125     vec_add1 (sm->auto_add_sw_if_indices, sw_if_index);
3126
3127   /* If the address is already bound - or static - add it now */
3128   if (first_int_addr)
3129     (void) snat_add_address (sm, first_int_addr, ~0, twice_nat);
3130
3131   return 0;
3132 }
3133
3134 int
3135 nat44_del_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3136                    snat_protocol_t proto, u32 vrf_id, int is_in)
3137 {
3138   snat_main_per_thread_data_t *tsm;
3139   clib_bihash_kv_8_8_t kv, value;
3140   ip4_header_t ip;
3141   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3142   snat_session_key_t key;
3143   snat_session_t *s;
3144   clib_bihash_8_8_t *t;
3145
3146   if (sm->endpoint_dependent)
3147     return VNET_API_ERROR_UNSUPPORTED;
3148
3149   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3150   if (sm->num_workers > 1)
3151     tsm =
3152       vec_elt_at_index (sm->per_thread_data,
3153                         sm->worker_in2out_cb (&ip, fib_index));
3154   else
3155     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3156
3157   key.addr.as_u32 = addr->as_u32;
3158   key.port = clib_host_to_net_u16 (port);
3159   key.protocol = proto;
3160   key.fib_index = fib_index;
3161   kv.key = key.as_u64;
3162   t = is_in ? &tsm->in2out : &tsm->out2in;
3163   if (!clib_bihash_search_8_8 (t, &kv, &value))
3164     {
3165       if (pool_is_free_index (tsm->sessions, value.value))
3166         return VNET_API_ERROR_UNSPECIFIED;
3167
3168       s = pool_elt_at_index (tsm->sessions, value.value);
3169       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3170       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3171       return 0;
3172     }
3173
3174   return VNET_API_ERROR_NO_SUCH_ENTRY;
3175 }
3176
3177 int
3178 nat44_del_ed_session (snat_main_t * sm, ip4_address_t * addr, u16 port,
3179                       ip4_address_t * eh_addr, u16 eh_port, u8 proto,
3180                       u32 vrf_id, int is_in)
3181 {
3182   ip4_header_t ip;
3183   clib_bihash_16_8_t *t;
3184   nat_ed_ses_key_t key;
3185   clib_bihash_kv_16_8_t kv, value;
3186   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3187   snat_session_t *s;
3188   snat_main_per_thread_data_t *tsm;
3189
3190   if (!sm->endpoint_dependent)
3191     return VNET_API_ERROR_FEATURE_DISABLED;
3192
3193   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3194   if (sm->num_workers > 1)
3195     tsm =
3196       vec_elt_at_index (sm->per_thread_data,
3197                         sm->worker_in2out_cb (&ip, fib_index));
3198   else
3199     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3200
3201   t = is_in ? &tsm->in2out_ed : &tsm->out2in_ed;
3202   key.l_addr.as_u32 = addr->as_u32;
3203   key.r_addr.as_u32 = eh_addr->as_u32;
3204   key.l_port = clib_host_to_net_u16 (port);
3205   key.r_port = clib_host_to_net_u16 (eh_port);
3206   key.proto = proto;
3207   key.fib_index = fib_index;
3208   kv.key[0] = key.as_u64[0];
3209   kv.key[1] = key.as_u64[1];
3210   if (clib_bihash_search_16_8 (t, &kv, &value))
3211     return VNET_API_ERROR_NO_SUCH_ENTRY;
3212
3213   if (pool_is_free_index (tsm->sessions, value.value))
3214     return VNET_API_ERROR_UNSPECIFIED;
3215   s = pool_elt_at_index (tsm->sessions, value.value);
3216   nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3217   nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3218   return 0;
3219 }
3220
3221 void
3222 nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length)
3223 {
3224   snat_main_t *sm = &snat_main;
3225
3226   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_MAPE;
3227   sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
3228   sm->psid = psid;
3229   sm->psid_offset = psid_offset;
3230   sm->psid_length = psid_length;
3231 }
3232
3233 void
3234 nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port)
3235 {
3236   snat_main_t *sm = &snat_main;
3237
3238   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_RANGE;
3239   sm->alloc_addr_and_port = nat_alloc_addr_and_port_range;
3240   sm->start_port = start_port;
3241   sm->end_port = end_port;
3242 }
3243
3244 void
3245 nat_set_alloc_addr_and_port_default (void)
3246 {
3247   snat_main_t *sm = &snat_main;
3248
3249   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
3250   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
3251 }
3252
3253 /*
3254  * fd.io coding-style-patch-verification: ON
3255  *
3256  * Local Variables:
3257  * eval: (c-set-style "gnu")
3258  * End:
3259  */