src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/dslite.h>
  28 #include <nat/nat_reass.h>
  29 #include <vnet/fib/fib_table.h>
  30 #include <vnet/fib/ip4_fib.h>
  31
  32 #include <vpp/app/version.h>
  33
  34 snat_main_t snat_main;
  35
  36
  37 /* Hook up input features */
  38 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  39   .arc_name = "ip4-unicast",
  40   .node_name = "nat44-in2out",
  41   .runs_before = VNET_FEATURES ("nat44-out2in"),
  42 };
  43 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  44   .arc_name = "ip4-unicast",
  45   .node_name = "nat44-out2in",
  46   .runs_before = VNET_FEATURES ("ip4-lookup"),
  47 };
  48 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  49   .arc_name = "ip4-unicast",
  50   .node_name = "nat44-classify",
  51   .runs_before = VNET_FEATURES ("ip4-lookup"),
  52 };
  53 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  54   .arc_name = "ip4-unicast",
  55   .node_name = "nat44-det-in2out",
  56   .runs_before = VNET_FEATURES ("nat44-det-out2in"),
  57 };
  58 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  59   .arc_name = "ip4-unicast",
  60   .node_name = "nat44-det-out2in",
  61   .runs_before = VNET_FEATURES ("ip4-lookup"),
  62 };
  63 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  64   .arc_name = "ip4-unicast",
  65   .node_name = "nat44-det-classify",
  66   .runs_before = VNET_FEATURES ("ip4-lookup"),
  67 };
  68 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  69   .arc_name = "ip4-unicast",
  70   .node_name = "nat44-in2out-worker-handoff",
  71   .runs_before = VNET_FEATURES ("nat44-out2in-worker-handoff"),
  72 };
  73 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  74   .arc_name = "ip4-unicast",
  75   .node_name = "nat44-out2in-worker-handoff",
  76   .runs_before = VNET_FEATURES ("ip4-lookup"),
  77 };
  78 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
  79   .arc_name = "ip4-unicast",
  80   .node_name = "nat44-handoff-classify",
  81   .runs_before = VNET_FEATURES ("ip4-lookup"),
  82 };
  83 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
  84   .arc_name = "ip4-unicast",
  85   .node_name = "nat44-in2out-fast",
  86   .runs_before = VNET_FEATURES ("nat44-out2in-fast"),
  87 };
  88 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
  89   .arc_name = "ip4-unicast",
  90   .node_name = "nat44-out2in-fast",
  91   .runs_before = VNET_FEATURES ("ip4-lookup"),
  92 };
  93 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
  94   .arc_name = "ip4-unicast",
  95   .node_name = "nat44-hairpin-dst",
  96   .runs_before = VNET_FEATURES ("ip4-lookup"),
  97 };
  98
  99 /* Hook up output features */
 100 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 101   .arc_name = "ip4-output",
 102   .node_name = "nat44-in2out-output",
 103   .runs_before = VNET_FEATURES ("interface-output"),
 104 };
 105 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 106   .arc_name = "ip4-output",
 107   .node_name = "nat44-in2out-output-worker-handoff",
 108   .runs_before = VNET_FEATURES ("interface-output"),
 109 };
 110 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 111   .arc_name = "ip4-output",
 112   .node_name = "nat44-hairpin-src",
 113   .runs_before = VNET_FEATURES ("interface-output"),
 114 };
 115
 116 /* Hook up ip4-local features */
 117 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 118 {
 119   .arc_name = "ip4-local",
 120   .node_name = "nat44-hairpinning",
 121   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 122 };
 123
 124
 125 /* *INDENT-OFF* */
 126 VLIB_PLUGIN_REGISTER () = {
 127     .version = VPP_BUILD_VER,
 128     .description = "Network Address Translation",
 129 };
 130 /* *INDENT-ON* */
 131
 132 vlib_node_registration_t nat44_classify_node;
 133 vlib_node_registration_t nat44_det_classify_node;
 134 vlib_node_registration_t nat44_handoff_classify_node;
 135
 136 typedef enum {
 137   NAT44_CLASSIFY_NEXT_IN2OUT,
 138   NAT44_CLASSIFY_NEXT_OUT2IN,
 139   NAT44_CLASSIFY_N_NEXT,
 140 } nat44_classify_next_t;
 141
 142 void
 143 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
 144 {
 145   snat_session_key_t key;
 146   clib_bihash_kv_8_8_t kv;
 147   nat_ed_ses_key_t ed_key;
 148   clib_bihash_kv_16_8_t ed_kv;
 149   int i;
 150   snat_address_t *a;
 151   snat_main_per_thread_data_t *tsm =
 152     vec_elt_at_index (sm->per_thread_data, thread_index);
 153
 154   /* Endpoint dependent session lookup tables */
 155   if (is_ed_session (s))
 156     {
 157       ed_key.l_addr = s->out2in.addr;
 158       ed_key.r_addr = s->ext_host_addr;
 159       ed_key.fib_index = s->out2in.fib_index;
 160       if (snat_is_unk_proto_session (s))
 161         {
 162           ed_key.proto = s->in2out.port;
 163           ed_key.r_port = 0;
 164           ed_key.l_port = 0;
 165         }
 166       else
 167         {
 168           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 169           ed_key.l_port = s->out2in.port;
 170           ed_key.r_port = s->ext_host_port;
 171         }
 172       ed_kv.key[0] = ed_key.as_u64[0];
 173       ed_kv.key[1] = ed_key.as_u64[1];
 174       if (clib_bihash_add_del_16_8 (&sm->out2in_ed, &ed_kv, 0))
 175         clib_warning ("out2in_ed key del failed");
 176
 177       ed_key.l_addr = s->in2out.addr;
 178       ed_key.fib_index = s->in2out.fib_index;
 179       if (!snat_is_unk_proto_session (s))
 180         ed_key.l_port = s->in2out.port;
 181       if (is_twice_nat_session (s))
 182         {
 183           ed_key.r_addr = s->ext_host_nat_addr;
 184           ed_key.r_port = s->ext_host_nat_port;
 185         }
 186       ed_kv.key[0] = ed_key.as_u64[0];
 187       ed_kv.key[1] = ed_key.as_u64[1];
 188       if (clib_bihash_add_del_16_8 (&sm->in2out_ed, &ed_kv, 0))
 189         clib_warning ("in2out_ed key del failed");
 190     }
 191
 192   if (snat_is_unk_proto_session (s))
 193     return;
 194
 195   /* log NAT event */
 196   snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 197                                       s->out2in.addr.as_u32,
 198                                       s->in2out.protocol,
 199                                       s->in2out.port,
 200                                       s->out2in.port,
 201                                       s->in2out.fib_index);
 202
 203   /* Twice NAT address and port for external host */
 204   if (is_twice_nat_session (s))
 205     {
 206       for (i = 0; i < vec_len (sm->twice_nat_addresses); i++)
 207         {
 208           key.protocol = s->in2out.protocol;
 209           key.port = s->ext_host_nat_port;
 210           a = sm->twice_nat_addresses + i;
 211           if (a->addr.as_u32 == s->ext_host_nat_addr.as_u32)
 212             {
 213               snat_free_outside_address_and_port (sm->twice_nat_addresses,
 214                                                   thread_index, &key, i);
 215               break;
 216             }
 217         }
 218     }
 219
 220   if (is_ed_session (s))
 221     return;
 222
 223   /* Session lookup tables */
 224   kv.key = s->in2out.as_u64;
 225   if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 226     clib_warning ("in2out key del failed");
 227   kv.key = s->out2in.as_u64;
 228   if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 229     clib_warning ("out2in key del failed");
 230
 231   if (snat_is_session_static (s))
 232     return;
 233
 234   if (s->outside_address_index != ~0)
 235     snat_free_outside_address_and_port (sm->addresses, thread_index,
 236                                         &s->out2in, s->outside_address_index);
 237 }
 238
 239 snat_user_t *
 240 nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, u32 fib_index,
 241                         u32 thread_index)
 242 {
 243   snat_user_t *u = 0;
 244   snat_user_key_t user_key;
 245   clib_bihash_kv_8_8_t kv, value;
 246   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 247   dlist_elt_t * per_user_list_head_elt;
 248
 249   user_key.addr.as_u32 = addr->as_u32;
 250   user_key.fib_index = fib_index;
 251   kv.key = user_key.as_u64;
 252
 253   /* Ever heard of the "user" = src ip4 address before? */
 254   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 255     {
 256       /* no, make a new one */
 257       pool_get (tsm->users, u);
 258       memset (u, 0, sizeof (*u));
 259       u->addr.as_u32 = addr->as_u32;
 260       u->fib_index = fib_index;
 261
 262       pool_get (tsm->list_pool, per_user_list_head_elt);
 263
 264       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 265         tsm->list_pool;
 266
 267       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 268
 269       kv.value = u - tsm->users;
 270
 271       /* add user */
 272       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 273         clib_warning ("user_hash keay add failed");
 274     }
 275   else
 276     {
 277       u = pool_elt_at_index (tsm->users, value.value);
 278     }
 279
 280   return u;
 281 }
 282
 283 snat_session_t *
 284 nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, u32 thread_index)
 285 {
 286   snat_session_t *s;
 287   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 288   u32 oldest_per_user_translation_list_index, session_index;
 289   dlist_elt_t * oldest_per_user_translation_list_elt;
 290   dlist_elt_t * per_user_translation_list_elt;
 291
 292   /* Over quota? Recycle the least recently used translation */
 293   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 294     {
 295       oldest_per_user_translation_list_index =
 296         clib_dlist_remove_head (tsm->list_pool,
 297                                 u->sessions_per_user_list_head_index);
 298
 299       ASSERT (oldest_per_user_translation_list_index != ~0);
 300
 301       /* Add it back to the end of the LRU list */
 302       clib_dlist_addtail (tsm->list_pool,
 303                           u->sessions_per_user_list_head_index,
 304                           oldest_per_user_translation_list_index);
 305       /* Get the list element */
 306       oldest_per_user_translation_list_elt =
 307         pool_elt_at_index (tsm->list_pool,
 308                            oldest_per_user_translation_list_index);
 309
 310       /* Get the session index from the list element */
 311       session_index = oldest_per_user_translation_list_elt->value;
 312
 313       /* Get the session */
 314       s = pool_elt_at_index (tsm->sessions, session_index);
 315       nat_free_session_data (sm, s, thread_index);
 316       s->outside_address_index = ~0;
 317       s->flags = 0;
 318       s->total_bytes = 0;
 319       s->total_pkts = 0;
 320     }
 321   else
 322     {
 323       pool_get (tsm->sessions, s);
 324       memset (s, 0, sizeof (*s));
 325       s->outside_address_index = ~0;
 326
 327       /* Create list elts */
 328       pool_get (tsm->list_pool, per_user_translation_list_elt);
 329       clib_dlist_init (tsm->list_pool,
 330                        per_user_translation_list_elt - tsm->list_pool);
 331
 332       per_user_translation_list_elt->value = s - tsm->sessions;
 333       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 334       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 335
 336       clib_dlist_addtail (tsm->list_pool,
 337                           s->per_user_list_head_index,
 338                           per_user_translation_list_elt - tsm->list_pool);
 339     }
 340
 341   return s;
 342 }
 343
 344 static inline uword
 345 nat44_classify_node_fn_inline (vlib_main_t * vm,
 346                                vlib_node_runtime_t * node,
 347                                vlib_frame_t * frame)
 348 {
 349   u32 n_left_from, * from, * to_next;
 350   nat44_classify_next_t next_index;
 351   snat_main_t *sm = &snat_main;
 352
 353   from = vlib_frame_vector_args (frame);
 354   n_left_from = frame->n_vectors;
 355   next_index = node->cached_next_index;
 356
 357   while (n_left_from > 0)
 358     {
 359       u32 n_left_to_next;
 360
 361       vlib_get_next_frame (vm, node, next_index,
 362                            to_next, n_left_to_next);
 363
 364       while (n_left_from > 0 && n_left_to_next > 0)
 365         {
 366           u32 bi0;
 367           vlib_buffer_t *b0;
 368           u32 next0 = NAT44_CLASSIFY_NEXT_IN2OUT;
 369           ip4_header_t *ip0;
 370           snat_address_t *ap;
 371           snat_session_key_t m_key0;
 372           clib_bihash_kv_8_8_t kv0, value0;
 373
 374           /* speculatively enqueue b0 to the current next frame */
 375           bi0 = from[0];
 376           to_next[0] = bi0;
 377           from += 1;
 378           to_next += 1;
 379           n_left_from -= 1;
 380           n_left_to_next -= 1;
 381
 382           b0 = vlib_get_buffer (vm, bi0);
 383           ip0 = vlib_buffer_get_current (b0);
 384
 385           vec_foreach (ap, sm->addresses)
 386             {
 387               if (ip0->dst_address.as_u32 == ap->addr.as_u32)
 388                 {
 389                   next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 390                   goto enqueue0;
 391                 }
 392             }
 393
 394           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
 395             {
 396               m_key0.addr = ip0->dst_address;
 397               m_key0.port = 0;
 398               m_key0.protocol = 0;
 399               m_key0.fib_index = sm->outside_fib_index;
 400               kv0.key = m_key0.as_u64;
 401               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0))
 402                 {
 403                   next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 404                   goto enqueue0;
 405                 }
 406               udp_header_t * udp0 = ip4_next_header (ip0);
 407               m_key0.port = clib_net_to_host_u16 (udp0->dst_port);
 408               m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol);
 409               kv0.key = m_key0.as_u64;
 410               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv0, &value0))
 411                 next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 412             }
 413
 414         enqueue0:
 415           /* verify speculative enqueue, maybe switch current next frame */
 416           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 417                                            to_next, n_left_to_next,
 418                                            bi0, next0);
 419         }
 420
 421       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 422     }
 423
 424   return frame->n_vectors;
 425 }
 426
 427 static uword
 428 nat44_classify_node_fn (vlib_main_t * vm,
 429                         vlib_node_runtime_t * node,
 430                         vlib_frame_t * frame)
 431 {
 432   return nat44_classify_node_fn_inline (vm, node, frame);
 433 };
 434
 435 VLIB_REGISTER_NODE (nat44_classify_node) = {
 436   .function = nat44_classify_node_fn,
 437   .name = "nat44-classify",
 438   .vector_size = sizeof (u32),
 439   .type = VLIB_NODE_TYPE_INTERNAL,
 440   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 441   .next_nodes = {
 442     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out",
 443     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in",
 444   },
 445 };
 446
 447 VLIB_NODE_FUNCTION_MULTIARCH (nat44_classify_node,
 448                               nat44_classify_node_fn);
 449
 450 static uword
 451 nat44_det_classify_node_fn (vlib_main_t * vm,
 452                             vlib_node_runtime_t * node,
 453                             vlib_frame_t * frame)
 454 {
 455   return nat44_classify_node_fn_inline (vm, node, frame);
 456 };
 457
 458 VLIB_REGISTER_NODE (nat44_det_classify_node) = {
 459   .function = nat44_det_classify_node_fn,
 460   .name = "nat44-det-classify",
 461   .vector_size = sizeof (u32),
 462   .type = VLIB_NODE_TYPE_INTERNAL,
 463   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 464   .next_nodes = {
 465     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out",
 466     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in",
 467   },
 468 };
 469
 470 VLIB_NODE_FUNCTION_MULTIARCH (nat44_det_classify_node,
 471                               nat44_det_classify_node_fn);
 472
 473 static uword
 474 nat44_handoff_classify_node_fn (vlib_main_t * vm,
 475                                 vlib_node_runtime_t * node,
 476                                 vlib_frame_t * frame)
 477 {
 478   return nat44_classify_node_fn_inline (vm, node, frame);
 479 };
 480
 481 VLIB_REGISTER_NODE (nat44_handoff_classify_node) = {
 482   .function = nat44_handoff_classify_node_fn,
 483   .name = "nat44-handoff-classify",
 484   .vector_size = sizeof (u32),
 485   .type = VLIB_NODE_TYPE_INTERNAL,
 486   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 487   .next_nodes = {
 488     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out-worker-handoff",
 489     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in-worker-handoff",
 490   },
 491 };
 492
 493 VLIB_NODE_FUNCTION_MULTIARCH (nat44_handoff_classify_node,
 494                               nat44_handoff_classify_node_fn);
 495
 496 /**
 497  * @brief Add/del NAT address to FIB.
 498  *
 499  * Add the external NAT address to the FIB as receive entries. This ensures
 500  * that VPP will reply to ARP for this address and we don't need to enable
 501  * proxy ARP on the outside interface.
 502  *
 503  * @param addr IPv4 address.
 504  * @param plen address prefix length
 505  * @param sw_if_index Interface.
 506  * @param is_add If 0 delete, otherwise add.
 507  */
 508 void
 509 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 510                           int is_add)
 511 {
 512   fib_prefix_t prefix = {
 513     .fp_len = p_len,
 514     .fp_proto = FIB_PROTOCOL_IP4,
 515     .fp_addr = {
 516         .ip4.as_u32 = addr->as_u32,
 517     },
 518   };
 519   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 520
 521   if (is_add)
 522     fib_table_entry_update_one_path(fib_index,
 523                                     &prefix,
 524                                     FIB_SOURCE_PLUGIN_HI,
 525                                     (FIB_ENTRY_FLAG_CONNECTED |
 526                                      FIB_ENTRY_FLAG_LOCAL |
 527                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 528                                     DPO_PROTO_IP4,
 529                                     NULL,
 530                                     sw_if_index,
 531                                     ~0,
 532                                     1,
 533                                     NULL,
 534                                     FIB_ROUTE_PATH_FLAG_NONE);
 535   else
 536     fib_table_entry_delete(fib_index,
 537                            &prefix,
 538                            FIB_SOURCE_PLUGIN_HI);
 539 }
 540
 541 void snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id,
 542                        u8 twice_nat)
 543 {
 544   snat_address_t * ap;
 545   snat_interface_t *i;
 546   vlib_thread_main_t *tm = vlib_get_thread_main ();
 547
 548   /* Check if address already exists */
 549   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 550     {
 551       if (ap->addr.as_u32 == addr->as_u32)
 552         return;
 553     }
 554
 555   if (twice_nat)
 556     vec_add2 (sm->twice_nat_addresses, ap, 1);
 557   else
 558     vec_add2 (sm->addresses, ap, 1);
 559
 560   ap->addr = *addr;
 561   if (vrf_id != ~0)
 562     ap->fib_index =
 563       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 564                                          FIB_SOURCE_PLUGIN_HI);
 565   else
 566     ap->fib_index = ~0;
 567 #define _(N, i, n, s) \
 568   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 569   ap->busy_##n##_ports = 0; \
 570   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 571   foreach_snat_protocol
 572 #undef _
 573
 574   if (twice_nat)
 575     return;
 576
 577   /* Add external address to FIB */
 578   pool_foreach (i, sm->interfaces,
 579   ({
 580     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 581       continue;
 582
 583     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 584     break;
 585   }));
 586   pool_foreach (i, sm->output_feature_interfaces,
 587   ({
 588     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 589       continue;
 590
 591     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 592     break;
 593   }));
 594 }
 595
 596 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 597                                                    ip4_address_t addr)
 598 {
 599   snat_static_mapping_t *m;
 600   pool_foreach (m, sm->static_mappings,
 601   ({
 602       if (m->external_addr.as_u32 == addr.as_u32)
 603         return 1;
 604   }));
 605
 606   return 0;
 607 }
 608
 609 void increment_v4_address (ip4_address_t * a)
 610 {
 611   u32 v;
 612
 613   v = clib_net_to_host_u32(a->as_u32) + 1;
 614   a->as_u32 = clib_host_to_net_u32(v);
 615 }
 616
 617 static void
 618 snat_add_static_mapping_when_resolved (snat_main_t * sm,
 619                                        ip4_address_t l_addr,
 620                                        u16 l_port,
 621                                        u32 sw_if_index,
 622                                        u16 e_port,
 623                                        u32 vrf_id,
 624                                        snat_protocol_t proto,
 625                                        int addr_only,
 626                                        int is_add)
 627 {
 628   snat_static_map_resolve_t *rp;
 629
 630   vec_add2 (sm->to_resolve, rp, 1);
 631   rp->l_addr.as_u32 = l_addr.as_u32;
 632   rp->l_port = l_port;
 633   rp->sw_if_index = sw_if_index;
 634   rp->e_port = e_port;
 635   rp->vrf_id = vrf_id;
 636   rp->proto = proto;
 637   rp->addr_only = addr_only;
 638   rp->is_add = is_add;
 639 }
 640
 641 /**
 642  * @brief Add static mapping.
 643  *
 644  * Create static mapping between local addr+port and external addr+port.
 645  *
 646  * @param l_addr Local IPv4 address.
 647  * @param e_addr External IPv4 address.
 648  * @param l_port Local port number.
 649  * @param e_port External port number.
 650  * @param vrf_id VRF ID.
 651  * @param addr_only If 0 address port and pair mapping, otherwise address only.
 652  * @param sw_if_index External port instead of specific IP address.
 653  * @param is_add If 0 delete static mapping, otherwise add.
 654  * @param twice_nat If 1 translate external host address and port.
 655  * @param out2in_only If 1 rule match only out2in direction
 656  *
 657  * @returns
 658  */
 659 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
 660                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
 661                             u32 sw_if_index, snat_protocol_t proto, int is_add,
 662                             u8 twice_nat, u8 out2in_only)
 663 {
 664   snat_main_t * sm = &snat_main;
 665   snat_static_mapping_t *m;
 666   snat_session_key_t m_key;
 667   clib_bihash_kv_8_8_t kv, value;
 668   snat_address_t *a = 0;
 669   u32 fib_index = ~0;
 670   uword * p;
 671   snat_interface_t *interface;
 672   int i;
 673   snat_main_per_thread_data_t *tsm;
 674
 675   /* If the external address is a specific interface address */
 676   if (sw_if_index != ~0)
 677     {
 678       ip4_address_t * first_int_addr;
 679
 680       /* Might be already set... */
 681       first_int_addr = ip4_interface_first_address
 682         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
 683
 684       /* DHCP resolution required? */
 685       if (first_int_addr == 0)
 686         {
 687           snat_add_static_mapping_when_resolved
 688             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
 689              addr_only,  is_add);
 690           return 0;
 691         }
 692         else
 693         {
 694           e_addr.as_u32 = first_int_addr->as_u32;
 695           /* Identity mapping? */
 696           if (l_addr.as_u32 == 0)
 697             l_addr.as_u32 = e_addr.as_u32;
 698         }
 699     }
 700
 701   m_key.addr = e_addr;
 702   m_key.port = addr_only ? 0 : e_port;
 703   m_key.protocol = addr_only ? 0 : proto;
 704   m_key.fib_index = sm->outside_fib_index;
 705   kv.key = m_key.as_u64;
 706   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
 707     m = 0;
 708   else
 709     m = pool_elt_at_index (sm->static_mappings, value.value);
 710
 711   if (is_add)
 712     {
 713       if (m)
 714         return VNET_API_ERROR_VALUE_EXIST;
 715
 716       if (twice_nat && addr_only)
 717         return VNET_API_ERROR_UNSUPPORTED;
 718
 719       /* Convert VRF id to FIB index */
 720       if (vrf_id != ~0)
 721         {
 722           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
 723           if (!p)
 724             return VNET_API_ERROR_NO_SUCH_FIB;
 725           fib_index = p[0];
 726         }
 727       /* If not specified use inside VRF id from SNAT plugin startup config */
 728       else
 729         {
 730           fib_index = sm->inside_fib_index;
 731           vrf_id = sm->inside_vrf_id;
 732         }
 733
 734       /* Find external address in allocated addresses and reserve port for
 735          address and port pair mapping when dynamic translations enabled */
 736       if (!(addr_only || sm->static_mapping_only || out2in_only))
 737         {
 738           for (i = 0; i < vec_len (sm->addresses); i++)
 739             {
 740               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 741                 {
 742                   a = sm->addresses + i;
 743                   /* External port must be unused */
 744                   switch (proto)
 745                     {
 746 #define _(N, j, n, s) \
 747                     case SNAT_PROTOCOL_##N: \
 748                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
 749                         return VNET_API_ERROR_INVALID_VALUE; \
 750                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
 751                       if (e_port > 1024) \
 752                         { \
 753                           a->busy_##n##_ports++; \
 754                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
 755                         } \
 756                       break;
 757                       foreach_snat_protocol
 758 #undef _
 759                     default:
 760                       clib_warning("unknown_protocol");
 761                       return VNET_API_ERROR_INVALID_VALUE_2;
 762                     }
 763                   break;
 764                 }
 765             }
 766           /* External address must be allocated */
 767           if (!a)
 768             return VNET_API_ERROR_NO_SUCH_ENTRY;
 769         }
 770
 771       pool_get (sm->static_mappings, m);
 772       memset (m, 0, sizeof (*m));
 773       m->local_addr = l_addr;
 774       m->external_addr = e_addr;
 775       m->addr_only = addr_only;
 776       m->vrf_id = vrf_id;
 777       m->fib_index = fib_index;
 778       m->twice_nat = twice_nat;
 779       m->out2in_only = out2in_only;
 780       if (!addr_only)
 781         {
 782           m->local_port = l_port;
 783           m->external_port = e_port;
 784           m->proto = proto;
 785         }
 786
 787       if (sm->workers)
 788         {
 789           ip4_header_t ip = {
 790             .src_address = m->local_addr,
 791           };
 792           m->worker_index = sm->worker_in2out_cb (&ip, m->fib_index);
 793           tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
 794         }
 795       else
 796         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 797
 798       m_key.addr = m->local_addr;
 799       m_key.port = m->local_port;
 800       m_key.protocol = m->proto;
 801       m_key.fib_index = m->fib_index;
 802       kv.key = m_key.as_u64;
 803       kv.value = m - sm->static_mappings;
 804       if (!out2in_only)
 805         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
 806       if (twice_nat || out2in_only)
 807         {
 808           m_key.port = clib_host_to_net_u16 (l_port);
 809           kv.key = m_key.as_u64;
 810           kv.value = ~0ULL;
 811           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
 812             clib_warning ("in2out key add failed");
 813         }
 814
 815       m_key.addr = m->external_addr;
 816       m_key.port = m->external_port;
 817       m_key.fib_index = sm->outside_fib_index;
 818       kv.key = m_key.as_u64;
 819       kv.value = m - sm->static_mappings;
 820       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
 821       if (twice_nat || out2in_only)
 822         {
 823           m_key.port = clib_host_to_net_u16 (e_port);
 824           kv.key = m_key.as_u64;
 825           kv.value = ~0ULL;
 826           if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
 827             clib_warning ("out2in key add failed");
 828         }
 829
 830     }
 831   else
 832     {
 833       if (!m)
 834         return VNET_API_ERROR_NO_SUCH_ENTRY;
 835
 836       /* Free external address port */
 837       if (!(addr_only || sm->static_mapping_only || out2in_only))
 838         {
 839           for (i = 0; i < vec_len (sm->addresses); i++)
 840             {
 841               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
 842                 {
 843                   a = sm->addresses + i;
 844                   switch (proto)
 845                     {
 846 #define _(N, j, n, s) \
 847                     case SNAT_PROTOCOL_##N: \
 848                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
 849                       if (e_port > 1024) \
 850                         { \
 851                           a->busy_##n##_ports--; \
 852                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
 853                         } \
 854                       break;
 855                       foreach_snat_protocol
 856 #undef _
 857                     default:
 858                       clib_warning("unknown_protocol");
 859                       return VNET_API_ERROR_INVALID_VALUE_2;
 860                     }
 861                   break;
 862                 }
 863             }
 864         }
 865
 866       if (sm->num_workers > 1)
 867         tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
 868       else
 869         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
 870
 871       m_key.addr = m->local_addr;
 872       m_key.port = m->local_port;
 873       m_key.protocol = m->proto;
 874       m_key.fib_index = m->fib_index;
 875       kv.key = m_key.as_u64;
 876       if (!out2in_only)
 877         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
 878       if (twice_nat || out2in_only)
 879         {
 880           m_key.port = clib_host_to_net_u16 (m->local_port);
 881           kv.key = m_key.as_u64;
 882           kv.value = ~0ULL;
 883           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
 884             clib_warning ("in2out key del failed");
 885         }
 886
 887       m_key.addr = m->external_addr;
 888       m_key.port = m->external_port;
 889       m_key.fib_index = sm->outside_fib_index;
 890       kv.key = m_key.as_u64;
 891       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
 892       if (twice_nat || out2in_only)
 893         {
 894           m_key.port = clib_host_to_net_u16 (m->external_port);
 895           kv.key = m_key.as_u64;
 896           kv.value = ~0ULL;
 897           if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
 898             clib_warning ("in2out key del failed");
 899         }
 900
 901       /* Delete session(s) for static mapping if exist */
 902       if (!(sm->static_mapping_only) ||
 903           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
 904         {
 905           snat_user_key_t u_key;
 906           snat_user_t *u;
 907           dlist_elt_t * head, * elt;
 908           u32 elt_index, head_index;
 909           u32 ses_index;
 910           u64 user_index;
 911           snat_session_t * s;
 912
 913           u_key.addr = m->local_addr;
 914           u_key.fib_index = m->fib_index;
 915           kv.key = u_key.as_u64;
 916           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 917             {
 918               user_index = value.value;
 919               u = pool_elt_at_index (tsm->users, user_index);
 920               if (u->nstaticsessions)
 921                 {
 922                   head_index = u->sessions_per_user_list_head_index;
 923                   head = pool_elt_at_index (tsm->list_pool, head_index);
 924                   elt_index = head->next;
 925                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
 926                   ses_index = elt->value;
 927                   while (ses_index != ~0)
 928                     {
 929                       s =  pool_elt_at_index (tsm->sessions, ses_index);
 930                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
 931                       ses_index = elt->value;
 932
 933                       if (!addr_only)
 934                         {
 935                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) &&
 936                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
 937                             continue;
 938                         }
 939
 940                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
 941                       clib_dlist_remove (tsm->list_pool, s->per_user_index);
 942                       pool_put_index (tsm->list_pool, s->per_user_index);
 943                       pool_put (tsm->sessions, s);
 944                       u->nstaticsessions--;
 945
 946                       if (!addr_only)
 947                         break;
 948                     }
 949                   if (addr_only)
 950                     {
 951                       pool_put (tsm->users, u);
 952                       clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 0);
 953                     }
 954                 }
 955             }
 956         }
 957
 958       /* Delete static mapping from pool */
 959       pool_put (sm->static_mappings, m);
 960     }
 961
 962   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
 963     return 0;
 964
 965   /* Add/delete external address to FIB */
 966   pool_foreach (interface, sm->interfaces,
 967   ({
 968     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
 969       continue;
 970
 971     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 972     break;
 973   }));
 974   pool_foreach (interface, sm->output_feature_interfaces,
 975   ({
 976     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
 977       continue;
 978
 979     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
 980     break;
 981   }));
 982
 983   return 0;
 984 }
 985
 986 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
 987                                      snat_protocol_t proto, u32 vrf_id,
 988                                      nat44_lb_addr_port_t *locals, u8 is_add,
 989                                      u8 twice_nat, u8 out2in_only)
 990 {
 991   snat_main_t * sm = &snat_main;
 992   snat_static_mapping_t *m;
 993   snat_session_key_t m_key;
 994   clib_bihash_kv_8_8_t kv, value;
 995   u32 fib_index;
 996   snat_address_t *a = 0;
 997   int i;
 998   nat44_lb_addr_port_t *local;
 999   u32 worker_index = 0, elt_index, head_index, ses_index;
1000   snat_main_per_thread_data_t *tsm;
1001   snat_user_key_t u_key;
1002   snat_user_t *u;
1003   snat_session_t * s;
1004   dlist_elt_t * head, * elt;
1005
1006   m_key.addr = e_addr;
1007   m_key.port = e_port;
1008   m_key.protocol = proto;
1009   m_key.fib_index = sm->outside_fib_index;
1010   kv.key = m_key.as_u64;
1011   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1012     m = 0;
1013   else
1014     m = pool_elt_at_index (sm->static_mappings, value.value);
1015
1016   if (is_add)
1017     {
1018       if (m)
1019         return VNET_API_ERROR_VALUE_EXIST;
1020
1021       if (vec_len (locals) < 2)
1022         return VNET_API_ERROR_INVALID_VALUE;
1023
1024       fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
1025                                                      vrf_id,
1026                                                      FIB_SOURCE_PLUGIN_HI);
1027
1028       /* Find external address in allocated addresses and reserve port for
1029          address and port pair mapping when dynamic translations enabled */
1030       if (!(sm->static_mapping_only || out2in_only))
1031         {
1032           for (i = 0; i < vec_len (sm->addresses); i++)
1033             {
1034               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1035                 {
1036                   a = sm->addresses + i;
1037                   /* External port must be unused */
1038                   switch (proto)
1039                     {
1040 #define _(N, j, n, s) \
1041                     case SNAT_PROTOCOL_##N: \
1042                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1043                         return VNET_API_ERROR_INVALID_VALUE; \
1044                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1045                       if (e_port > 1024) \
1046                         { \
1047                           a->busy_##n##_ports++; \
1048                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]++; \
1049                         } \
1050                       break;
1051                       foreach_snat_protocol
1052 #undef _
1053                     default:
1054                       clib_warning("unknown_protocol");
1055                       return VNET_API_ERROR_INVALID_VALUE_2;
1056                     }
1057                   break;
1058                 }
1059             }
1060           /* External address must be allocated */
1061           if (!a)
1062             return VNET_API_ERROR_NO_SUCH_ENTRY;
1063         }
1064
1065       pool_get (sm->static_mappings, m);
1066       memset (m, 0, sizeof (*m));
1067       m->external_addr = e_addr;
1068       m->addr_only = 0;
1069       m->vrf_id = vrf_id;
1070       m->fib_index = fib_index;
1071       m->external_port = e_port;
1072       m->proto = proto;
1073       m->twice_nat = twice_nat;
1074       m->out2in_only = out2in_only;
1075
1076       m_key.addr = m->external_addr;
1077       m_key.port = m->external_port;
1078       m_key.protocol = m->proto;
1079       m_key.fib_index = sm->outside_fib_index;
1080       kv.key = m_key.as_u64;
1081       kv.value = m - sm->static_mappings;
1082       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
1083         {
1084           clib_warning ("static_mapping_by_external key add failed");
1085           return VNET_API_ERROR_UNSPECIFIED;
1086         }
1087
1088       /* Assign worker */
1089       if (sm->workers)
1090         {
1091           worker_index = sm->first_worker_index +
1092             sm->workers[sm->next_worker++ % vec_len (sm->workers)];
1093           tsm = vec_elt_at_index (sm->per_thread_data, worker_index);
1094           m->worker_index = worker_index;
1095         }
1096       else
1097         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1098
1099       m_key.port = clib_host_to_net_u16 (m->external_port);
1100       kv.key = m_key.as_u64;
1101       kv.value = ~0ULL;
1102       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 1))
1103         {
1104           clib_warning ("out2in key add failed");
1105           return VNET_API_ERROR_UNSPECIFIED;
1106         }
1107
1108       m_key.fib_index = m->fib_index;
1109       for (i = 0; i < vec_len (locals); i++)
1110         {
1111           m_key.addr = locals[i].addr;
1112           if (!out2in_only)
1113             {
1114               m_key.port = locals[i].port;
1115               kv.key = m_key.as_u64;
1116               kv.value = m - sm->static_mappings;
1117               clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
1118             }
1119           locals[i].prefix = (i == 0) ? locals[i].probability :\
1120             (locals[i - 1].prefix + locals[i].probability);
1121           vec_add1 (m->locals, locals[i]);
1122
1123           m_key.port = clib_host_to_net_u16 (locals[i].port);
1124           kv.key = m_key.as_u64;
1125           kv.value = ~0ULL;
1126           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 1))
1127             {
1128               clib_warning ("in2out key add failed");
1129               return VNET_API_ERROR_UNSPECIFIED;
1130             }
1131         }
1132     }
1133   else
1134     {
1135       if (!m)
1136         return VNET_API_ERROR_NO_SUCH_ENTRY;
1137
1138       fib_table_unlock (m->fib_index, FIB_PROTOCOL_IP4, FIB_SOURCE_PLUGIN_HI);
1139
1140       /* Free external address port */
1141       if (!(sm->static_mapping_only || out2in_only))
1142         {
1143           for (i = 0; i < vec_len (sm->addresses); i++)
1144             {
1145               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1146                 {
1147                   a = sm->addresses + i;
1148                   switch (proto)
1149                     {
1150 #define _(N, j, n, s) \
1151                     case SNAT_PROTOCOL_##N: \
1152                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1153                       if (e_port > 1024) \
1154                         { \
1155                           a->busy_##n##_ports--; \
1156                           a->busy_##n##_ports_per_thread[(e_port - 1024) / sm->port_per_thread]--; \
1157                         } \
1158                       break;
1159                       foreach_snat_protocol
1160 #undef _
1161                     default:
1162                       clib_warning("unknown_protocol");
1163                       return VNET_API_ERROR_INVALID_VALUE_2;
1164                     }
1165                   break;
1166                 }
1167             }
1168         }
1169
1170       tsm = vec_elt_at_index (sm->per_thread_data, m->worker_index);
1171       m_key.addr = m->external_addr;
1172       m_key.port = m->external_port;
1173       m_key.protocol = m->proto;
1174       m_key.fib_index = sm->outside_fib_index;
1175       kv.key = m_key.as_u64;
1176       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
1177         {
1178           clib_warning ("static_mapping_by_external key del failed");
1179           return VNET_API_ERROR_UNSPECIFIED;
1180         }
1181
1182       m_key.port = clib_host_to_net_u16 (m->external_port);
1183       kv.key = m_key.as_u64;
1184       if (clib_bihash_add_del_8_8(&tsm->out2in, &kv, 0))
1185         {
1186           clib_warning ("outi2in key del failed");
1187           return VNET_API_ERROR_UNSPECIFIED;
1188         }
1189
1190       vec_foreach (local, m->locals)
1191         {
1192           m_key.addr = local->addr;
1193           if (!out2in_only)
1194             {
1195               m_key.port = local->port;
1196               m_key.fib_index = m->fib_index;
1197               kv.key = m_key.as_u64;
1198               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1199                 {
1200                   clib_warning ("static_mapping_by_local key del failed");
1201                   return VNET_API_ERROR_UNSPECIFIED;
1202                 }
1203             }
1204
1205           m_key.port = clib_host_to_net_u16 (local->port);
1206           kv.key = m_key.as_u64;
1207           if (clib_bihash_add_del_8_8(&tsm->in2out, &kv, 0))
1208             {
1209               clib_warning ("in2out key del failed");
1210               return VNET_API_ERROR_UNSPECIFIED;
1211             }
1212           /* Delete sessions */
1213           u_key.addr = local->addr;
1214           u_key.fib_index = m->fib_index;
1215           kv.key = u_key.as_u64;
1216           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1217             {
1218               u = pool_elt_at_index (tsm->users, value.value);
1219               if (u->nstaticsessions)
1220                 {
1221                   head_index = u->sessions_per_user_list_head_index;
1222                   head = pool_elt_at_index (tsm->list_pool, head_index);
1223                   elt_index = head->next;
1224                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1225                   ses_index = elt->value;
1226                   while (ses_index != ~0)
1227                     {
1228                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1229                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1230                       ses_index = elt->value;
1231
1232                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) &&
1233                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1234                         continue;
1235
1236                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1237                       clib_dlist_remove (tsm->list_pool, s->per_user_index);
1238                       pool_put_index (tsm->list_pool, s->per_user_index);
1239                       pool_put (tsm->sessions, s);
1240                       u->nstaticsessions--;
1241                     }
1242                 }
1243             }
1244         }
1245       vec_free(m->locals);
1246
1247       pool_put (sm->static_mappings, m);
1248     }
1249
1250   return 0;
1251 }
1252
1253 int
1254 snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm,
1255                   u8 twice_nat)
1256 {
1257   snat_address_t *a = 0;
1258   snat_session_t *ses;
1259   u32 *ses_to_be_removed = 0, *ses_index;
1260   clib_bihash_kv_8_8_t kv, value;
1261   snat_user_key_t user_key;
1262   snat_user_t *u;
1263   snat_main_per_thread_data_t *tsm;
1264   snat_static_mapping_t *m;
1265   snat_interface_t *interface;
1266   int i;
1267   snat_address_t *addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
1268
1269   /* Find SNAT address */
1270   for (i=0; i < vec_len (addresses); i++)
1271     {
1272       if (addresses[i].addr.as_u32 == addr.as_u32)
1273         {
1274           a = addresses + i;
1275           break;
1276         }
1277     }
1278   if (!a)
1279     return VNET_API_ERROR_NO_SUCH_ENTRY;
1280
1281   if (delete_sm)
1282     {
1283       pool_foreach (m, sm->static_mappings,
1284       ({
1285           if (m->external_addr.as_u32 == addr.as_u32)
1286             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1287                                             m->local_port, m->external_port,
1288                                             m->vrf_id, m->addr_only, ~0,
1289                                             m->proto, 0, m->twice_nat,
1290                                             m->out2in_only);
1291       }));
1292     }
1293   else
1294     {
1295       /* Check if address is used in some static mapping */
1296       if (is_snat_address_used_in_static_mapping(sm, addr))
1297         {
1298           clib_warning ("address used in static mapping");
1299           return VNET_API_ERROR_UNSPECIFIED;
1300         }
1301     }
1302
1303   if (a->fib_index != ~0)
1304     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4,
1305                      FIB_SOURCE_PLUGIN_HI);
1306
1307   /* Delete sessions using address */
1308   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1309     {
1310       vec_foreach (tsm, sm->per_thread_data)
1311         {
1312           pool_foreach (ses, tsm->sessions, ({
1313             if (ses->out2in.addr.as_u32 == addr.as_u32)
1314               {
1315                 ses->outside_address_index = ~0;
1316                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
1317                 clib_dlist_remove (tsm->list_pool, ses->per_user_index);
1318                 pool_put_index (tsm->list_pool, ses->per_user_index);
1319                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1320                 user_key.addr = ses->in2out.addr;
1321                 user_key.fib_index = ses->in2out.fib_index;
1322                 kv.key = user_key.as_u64;
1323                 if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1324                   {
1325                     u = pool_elt_at_index (tsm->users, value.value);
1326                     u->nsessions--;
1327                   }
1328               }
1329           }));
1330
1331           vec_foreach (ses_index, ses_to_be_removed)
1332             pool_put_index (tsm->sessions, ses_index[0]);
1333
1334           vec_free (ses_to_be_removed);
1335        }
1336     }
1337
1338   if (twice_nat)
1339     {
1340       vec_del1 (sm->twice_nat_addresses, i);
1341       return 0;
1342     }
1343   else
1344     vec_del1 (sm->addresses, i);
1345
1346   /* Delete external address from FIB */
1347   pool_foreach (interface, sm->interfaces,
1348   ({
1349     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1350       continue;
1351
1352     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1353     break;
1354   }));
1355   pool_foreach (interface, sm->output_feature_interfaces,
1356   ({
1357     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1358       continue;
1359
1360     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1361     break;
1362   }));
1363
1364   return 0;
1365 }
1366
1367 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1368 {
1369   snat_main_t *sm = &snat_main;
1370   snat_interface_t *i;
1371   const char * feature_name, *del_feature_name;
1372   snat_address_t * ap;
1373   snat_static_mapping_t * m;
1374   snat_det_map_t * dm;
1375
1376   if (sm->out2in_dpo && !is_inside)
1377     return VNET_API_ERROR_UNSUPPORTED;
1378
1379   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1380     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
1381   else
1382     {
1383       if (sm->num_workers > 1 && !sm->deterministic)
1384         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
1385       else if (sm->deterministic)
1386         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
1387       else
1388         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
1389     }
1390
1391   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1392     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index, 0);
1393
1394   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1395     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1396
1397   pool_foreach (i, sm->interfaces,
1398   ({
1399     if (i->sw_if_index == sw_if_index)
1400       {
1401         if (is_del)
1402           {
1403             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1404               {
1405                 if (is_inside)
1406                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1407                 else
1408                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1409
1410                 if (sm->num_workers > 1 && !sm->deterministic)
1411                   {
1412                     del_feature_name = "nat44-handoff-classify";
1413                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1414                                                  "nat44-out2in-worker-handoff";
1415                   }
1416                 else if (sm->deterministic)
1417                   {
1418                     del_feature_name = "nat44-det-classify";
1419                     feature_name = !is_inside ?  "nat44-det-in2out" :
1420                                                  "nat44-det-out2in";
1421                   }
1422                 else
1423                   {
1424                     del_feature_name = "nat44-classify";
1425                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1426                   }
1427
1428                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1429                                              sw_if_index, 0, 0, 0);
1430                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1431                                              sw_if_index, 1, 0, 0);
1432               }
1433             else
1434               {
1435                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1436                                              sw_if_index, 0, 0, 0);
1437                 pool_put (sm->interfaces, i);
1438               }
1439           }
1440         else
1441           {
1442             if ((nat_interface_is_inside(i) && is_inside) ||
1443                 (nat_interface_is_outside(i) && !is_inside))
1444               return 0;
1445
1446             if (sm->num_workers > 1 && !sm->deterministic)
1447               {
1448                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1449                                                  "nat44-out2in-worker-handoff";
1450                 feature_name = "nat44-handoff-classify";
1451               }
1452             else if (sm->deterministic)
1453               {
1454                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
1455                                                  "nat44-det-out2in";
1456                 feature_name = "nat44-det-classify";
1457               }
1458             else
1459               {
1460                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1461                 feature_name = "nat44-classify";
1462               }
1463
1464             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1465                                          sw_if_index, 0, 0, 0);
1466             vnet_feature_enable_disable ("ip4-unicast", feature_name,
1467                                          sw_if_index, 1, 0, 0);
1468             goto set_flags;
1469           }
1470
1471         goto fib;
1472       }
1473   }));
1474
1475   if (is_del)
1476     return VNET_API_ERROR_NO_SUCH_ENTRY;
1477
1478   pool_get (sm->interfaces, i);
1479   i->sw_if_index = sw_if_index;
1480   i->flags = 0;
1481   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0, 0);
1482
1483 set_flags:
1484   if (is_inside)
1485     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1486   else
1487     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1488
1489   /* Add/delete external addresses to FIB */
1490 fib:
1491   if (is_inside && !sm->out2in_dpo)
1492     {
1493       vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
1494                                    sw_if_index, !is_del, 0, 0);
1495       return 0;
1496     }
1497
1498   vec_foreach (ap, sm->addresses)
1499     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1500
1501   pool_foreach (m, sm->static_mappings,
1502   ({
1503     if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32))
1504       continue;
1505
1506     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1507   }));
1508
1509   pool_foreach (dm, sm->det_maps,
1510   ({
1511     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
1512   }));
1513
1514   return 0;
1515 }
1516
1517 int snat_interface_add_del_output_feature (u32 sw_if_index,
1518                                            u8 is_inside,
1519                                            int is_del)
1520 {
1521   snat_main_t *sm = &snat_main;
1522   snat_interface_t *i;
1523   snat_address_t * ap;
1524   snat_static_mapping_t * m;
1525
1526   if (sm->deterministic ||
1527       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
1528     return VNET_API_ERROR_UNSUPPORTED;
1529
1530   if (is_inside)
1531     {
1532       vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
1533                                    sw_if_index, !is_del, 0, 0);
1534       vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
1535                                    sw_if_index, !is_del, 0, 0);
1536       goto fq;
1537     }
1538
1539   if (sm->num_workers > 1)
1540     {
1541       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in-worker-handoff",
1542                                    sw_if_index, !is_del, 0, 0);
1543       vnet_feature_enable_disable ("ip4-output",
1544                                    "nat44-in2out-output-worker-handoff",
1545                                    sw_if_index, !is_del, 0, 0);
1546     }
1547   else
1548     {
1549       vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in", sw_if_index,
1550                                    !is_del, 0, 0);
1551       vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
1552                                    sw_if_index, !is_del, 0, 0);
1553     }
1554
1555 fq:
1556   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
1557     sm->fq_in2out_output_index =
1558       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
1559
1560   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
1561     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
1562
1563   pool_foreach (i, sm->output_feature_interfaces,
1564   ({
1565     if (i->sw_if_index == sw_if_index)
1566       {
1567         if (is_del)
1568           pool_put (sm->output_feature_interfaces, i);
1569         else
1570           return VNET_API_ERROR_VALUE_EXIST;
1571
1572         goto fib;
1573       }
1574   }));
1575
1576   if (is_del)
1577     return VNET_API_ERROR_NO_SUCH_ENTRY;
1578
1579   pool_get (sm->output_feature_interfaces, i);
1580   i->sw_if_index = sw_if_index;
1581   i->flags = 0;
1582   if (is_inside)
1583     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
1584   else
1585     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
1586
1587   /* Add/delete external addresses to FIB */
1588 fib:
1589   if (is_inside)
1590     return 0;
1591
1592   vec_foreach (ap, sm->addresses)
1593     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
1594
1595   pool_foreach (m, sm->static_mappings,
1596   ({
1597     if (!(m->addr_only))
1598       continue;
1599
1600     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
1601   }));
1602
1603   return 0;
1604 }
1605
1606 int snat_set_workers (uword * bitmap)
1607 {
1608   snat_main_t *sm = &snat_main;
1609   int i, j = 0;
1610
1611   if (sm->num_workers < 2)
1612     return VNET_API_ERROR_FEATURE_DISABLED;
1613
1614   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
1615     return VNET_API_ERROR_INVALID_WORKER;
1616
1617   vec_free (sm->workers);
1618   clib_bitmap_foreach (i, bitmap,
1619     ({
1620       vec_add1(sm->workers, i);
1621       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
1622       j++;
1623     }));
1624
1625   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
1626   sm->num_snat_thread = _vec_len (sm->workers);
1627
1628   return 0;
1629 }
1630
1631
1632 static void
1633 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
1634                                        uword opaque,
1635                                        u32 sw_if_index,
1636                                        ip4_address_t * address,
1637                                        u32 address_length,
1638                                        u32 if_address_index,
1639                                        u32 is_delete);
1640
1641 static int
1642 nat_alloc_addr_and_port_default (snat_address_t * addresses,
1643                                  u32 fib_index,
1644                                  u32 thread_index,
1645                                  snat_session_key_t * k,
1646                                  u32 * address_indexp,
1647                                  u16 port_per_thread,
1648                                  u32 snat_thread_index);
1649
1650 static clib_error_t * snat_init (vlib_main_t * vm)
1651 {
1652   snat_main_t * sm = &snat_main;
1653   clib_error_t * error = 0;
1654   ip4_main_t * im = &ip4_main;
1655   ip_lookup_main_t * lm = &im->lookup_main;
1656   uword *p;
1657   vlib_thread_registration_t *tr;
1658   vlib_thread_main_t *tm = vlib_get_thread_main ();
1659   uword *bitmap = 0;
1660   u32 i;
1661   ip4_add_del_interface_address_callback_t cb4;
1662
1663   sm->vlib_main = vm;
1664   sm->vnet_main = vnet_get_main();
1665   sm->ip4_main = im;
1666   sm->ip4_lookup_main = lm;
1667   sm->api_main = &api_main;
1668   sm->first_worker_index = 0;
1669   sm->next_worker = 0;
1670   sm->num_workers = 0;
1671   sm->num_snat_thread = 1;
1672   sm->workers = 0;
1673   sm->port_per_thread = 0xffff - 1024;
1674   sm->fq_in2out_index = ~0;
1675   sm->fq_out2in_index = ~0;
1676   sm->udp_timeout = SNAT_UDP_TIMEOUT;
1677   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
1678   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
1679   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
1680   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
1681   sm->forwarding_enabled = 0;
1682
1683   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
1684   if (p)
1685     {
1686       tr = (vlib_thread_registration_t *) p[0];
1687       if (tr)
1688         {
1689           sm->num_workers = tr->count;
1690           sm->first_worker_index = tr->first_index;
1691         }
1692     }
1693
1694   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
1695
1696   /* Use all available workers by default */
1697   if (sm->num_workers > 1)
1698     {
1699       for (i=0; i < sm->num_workers; i++)
1700         bitmap = clib_bitmap_set (bitmap, i, 1);
1701       snat_set_workers(bitmap);
1702       clib_bitmap_free (bitmap);
1703     }
1704   else
1705     {
1706       sm->per_thread_data[0].snat_thread_index = 0;
1707     }
1708
1709   error = snat_api_init(vm, sm);
1710   if (error)
1711     return error;
1712
1713   /* Set up the interface address add/del callback */
1714   cb4.function = snat_ip4_add_del_interface_address_cb;
1715   cb4.function_opaque = 0;
1716
1717   vec_add1 (im->add_del_interface_address_callbacks, cb4);
1718
1719   nat_dpo_module_init ();
1720
1721   /* Init IPFIX logging */
1722   snat_ipfix_logging_init(vm);
1723
1724   /* Init NAT64 */
1725   error = nat64_init(vm);
1726   if (error)
1727     return error;
1728
1729   dslite_init(vm);
1730
1731   /* Init virtual fragmenentation reassembly */
1732   return nat_reass_init(vm);
1733 }
1734
1735 VLIB_INIT_FUNCTION (snat_init);
1736
1737 void snat_free_outside_address_and_port (snat_address_t * addresses,
1738                                          u32 thread_index,
1739                                          snat_session_key_t * k,
1740                                          u32 address_index)
1741 {
1742   snat_address_t *a;
1743   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
1744
1745   ASSERT (address_index < vec_len (addresses));
1746
1747   a = addresses + address_index;
1748
1749   switch (k->protocol)
1750     {
1751 #define _(N, i, n, s) \
1752     case SNAT_PROTOCOL_##N: \
1753       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
1754         port_host_byte_order) == 1); \
1755       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
1756         port_host_byte_order, 0); \
1757       a->busy_##n##_ports--; \
1758       a->busy_##n##_ports_per_thread[thread_index]--; \
1759       break;
1760       foreach_snat_protocol
1761 #undef _
1762     default:
1763       clib_warning("unknown_protocol");
1764       return;
1765     }
1766 }
1767
1768 /**
1769  * @brief Match NAT44 static mapping.
1770  *
1771  * @param sm          NAT main.
1772  * @param match       Address and port to match.
1773  * @param mapping     External or local address and port of the matched mapping.
1774  * @param by_external If 0 match by local address otherwise match by external
1775  *                    address.
1776  * @param is_addr_only If matched mapping is address only
1777  * @param twice_nat If matched mapping is twice NAT.
1778  *
1779  * @returns 0 if match found otherwise 1.
1780  */
1781 int snat_static_mapping_match (snat_main_t * sm,
1782                                snat_session_key_t match,
1783                                snat_session_key_t * mapping,
1784                                u8 by_external,
1785                                u8 *is_addr_only,
1786                                u8 *twice_nat)
1787 {
1788   clib_bihash_kv_8_8_t kv, value;
1789   snat_static_mapping_t *m;
1790   snat_session_key_t m_key;
1791   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
1792   u32 rand, lo = 0, hi, mid;
1793
1794   if (by_external)
1795     mapping_hash = &sm->static_mapping_by_external;
1796
1797   m_key.addr = match.addr;
1798   m_key.port = clib_net_to_host_u16 (match.port);
1799   m_key.protocol = match.protocol;
1800   m_key.fib_index = match.fib_index;
1801
1802   kv.key = m_key.as_u64;
1803
1804   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1805     {
1806       /* Try address only mapping */
1807       m_key.port = 0;
1808       m_key.protocol = 0;
1809       kv.key = m_key.as_u64;
1810       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
1811         return 1;
1812     }
1813
1814   m = pool_elt_at_index (sm->static_mappings, value.value);
1815
1816   if (by_external)
1817     {
1818       if (vec_len (m->locals))
1819         {
1820           hi = vec_len (m->locals) - 1;
1821           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
1822           while (lo < hi)
1823             {
1824               mid = ((hi - lo) >> 1) + lo;
1825               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
1826             }
1827           if (!(m->locals[lo].prefix >= rand))
1828             return 1;
1829           mapping->addr = m->locals[lo].addr;
1830           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
1831         }
1832       else
1833         {
1834           mapping->addr = m->local_addr;
1835           /* Address only mapping doesn't change port */
1836           mapping->port = m->addr_only ? match.port
1837             : clib_host_to_net_u16 (m->local_port);
1838         }
1839       mapping->fib_index = m->fib_index;
1840       mapping->protocol = m->proto;
1841     }
1842   else
1843     {
1844       mapping->addr = m->external_addr;
1845       /* Address only mapping doesn't change port */
1846       mapping->port = m->addr_only ? match.port
1847         : clib_host_to_net_u16 (m->external_port);
1848       mapping->fib_index = sm->outside_fib_index;
1849     }
1850
1851   if (PREDICT_FALSE(is_addr_only != 0))
1852     *is_addr_only = m->addr_only;
1853
1854   if (PREDICT_FALSE(twice_nat != 0))
1855     *twice_nat = m->twice_nat;
1856
1857   return 0;
1858 }
1859
1860 static_always_inline u16
1861 snat_random_port (u16 min, u16 max)
1862 {
1863   snat_main_t *sm = &snat_main;
1864   return min + random_u32 (&sm->random_seed) /
1865     (random_u32_max() / (max - min + 1) + 1);
1866 }
1867
1868 int
1869 snat_alloc_outside_address_and_port (snat_address_t * addresses,
1870                                      u32 fib_index,
1871                                      u32 thread_index,
1872                                      snat_session_key_t * k,
1873                                      u32 * address_indexp,
1874                                      u16 port_per_thread,
1875                                      u32 snat_thread_index)
1876 {
1877   snat_main_t *sm = &snat_main;
1878
1879   return sm->alloc_addr_and_port(addresses, fib_index, thread_index, k,
1880                                  address_indexp, port_per_thread,
1881                                  snat_thread_index);
1882 }
1883
1884 static int
1885 nat_alloc_addr_and_port_default (snat_address_t * addresses,
1886                                  u32 fib_index,
1887                                  u32 thread_index,
1888                                  snat_session_key_t * k,
1889                                  u32 * address_indexp,
1890                                  u16 port_per_thread,
1891                                  u32 snat_thread_index)
1892 {
1893   int i, gi = 0;
1894   snat_address_t *a, *ga = 0;
1895   u32 portnum;
1896
1897   for (i = 0; i < vec_len (addresses); i++)
1898     {
1899       a = addresses + i;
1900       switch (k->protocol)
1901         {
1902 #define _(N, j, n, s) \
1903         case SNAT_PROTOCOL_##N: \
1904           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
1905             { \
1906               if (a->fib_index == fib_index) \
1907                 { \
1908                   while (1) \
1909                     { \
1910                       portnum = (port_per_thread * \
1911                         snat_thread_index) + \
1912                         snat_random_port(1, port_per_thread) + 1024; \
1913                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
1914                         continue; \
1915                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
1916                       a->busy_##n##_ports_per_thread[thread_index]++; \
1917                       a->busy_##n##_ports++; \
1918                       k->addr = a->addr; \
1919                       k->port = clib_host_to_net_u16(portnum); \
1920                       *address_indexp = i; \
1921                       return 0; \
1922                     } \
1923                 } \
1924               else if (a->fib_index == ~0) \
1925                 { \
1926                   ga = a; \
1927                   gi = i; \
1928                 } \
1929             } \
1930           break;
1931           foreach_snat_protocol
1932 #undef _
1933         default:
1934           clib_warning("unknown protocol");
1935           return 1;
1936         }
1937
1938     }
1939
1940   if (ga)
1941     {
1942       a = ga;
1943       switch (k->protocol)
1944         {
1945 #define _(N, j, n, s) \
1946         case SNAT_PROTOCOL_##N: \
1947           while (1) \
1948             { \
1949               portnum = (port_per_thread * \
1950                 snat_thread_index) + \
1951                 snat_random_port(1, port_per_thread) + 1024; \
1952               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
1953                 continue; \
1954               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
1955               a->busy_##n##_ports_per_thread[thread_index]++; \
1956               a->busy_##n##_ports++; \
1957               k->addr = a->addr; \
1958               k->port = clib_host_to_net_u16(portnum); \
1959               *address_indexp = gi; \
1960               return 0; \
1961             }
1962           break;
1963           foreach_snat_protocol
1964 #undef _
1965         default:
1966           clib_warning ("unknown protocol");
1967           return 1;
1968         }
1969     }
1970
1971   /* Totally out of translations to use... */
1972   snat_ipfix_logging_addresses_exhausted(0);
1973   return 1;
1974 }
1975
1976 static int
1977 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
1978                               u32 fib_index,
1979                               u32 thread_index,
1980                               snat_session_key_t * k,
1981                               u32 * address_indexp,
1982                               u16 port_per_thread,
1983                               u32 snat_thread_index)
1984 {
1985   snat_main_t *sm = &snat_main;
1986   snat_address_t *a = addresses;
1987   u16 m, ports, portnum, A, j;
1988   m = 16 - (sm->psid_offset + sm->psid_length);
1989   ports = (1 << (16 - sm->psid_length)) - (1 << m);
1990
1991   if (!vec_len (addresses))
1992     goto exhausted;
1993
1994   switch (k->protocol)
1995     {
1996 #define _(N, i, n, s) \
1997     case SNAT_PROTOCOL_##N: \
1998       if (a->busy_##n##_ports < ports) \
1999         { \
2000           while (1) \
2001             { \
2002               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2003               j = snat_random_port(0, pow2_mask(m)); \
2004               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2005               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2006                 continue; \
2007               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2008               a->busy_##n##_ports++; \
2009               k->addr = a->addr; \
2010               k->port = clib_host_to_net_u16 (portnum); \
2011               *address_indexp = i; \
2012               return 0; \
2013             } \
2014         } \
2015       break;
2016       foreach_snat_protocol
2017 #undef _
2018     default:
2019       clib_warning("unknown protocol");
2020       return 1;
2021     }
2022
2023 exhausted:
2024   /* Totally out of translations to use... */
2025   snat_ipfix_logging_addresses_exhausted(0);
2026   return 1;
2027 }
2028
2029 void
2030 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2031 {
2032   dpo_id_t dpo_v4 = DPO_INVALID;
2033   fib_prefix_t pfx = {
2034     .fp_proto = FIB_PROTOCOL_IP4,
2035     .fp_len = 32,
2036     .fp_addr.ip4.as_u32 = addr.as_u32,
2037   };
2038
2039   if (is_add)
2040     {
2041       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2042       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2043                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2044       dpo_reset (&dpo_v4);
2045     }
2046   else
2047     {
2048       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2049     }
2050 }
2051
2052 static clib_error_t *
2053 add_address_command_fn (vlib_main_t * vm,
2054                         unformat_input_t * input,
2055                         vlib_cli_command_t * cmd)
2056 {
2057   unformat_input_t _line_input, *line_input = &_line_input;
2058   snat_main_t * sm = &snat_main;
2059   ip4_address_t start_addr, end_addr, this_addr;
2060   u32 start_host_order, end_host_order;
2061   u32 vrf_id = ~0;
2062   int i, count;
2063   int is_add = 1;
2064   int rv = 0;
2065   clib_error_t *error = 0;
2066   u8 twice_nat = 0;
2067
2068   /* Get a line of input. */
2069   if (!unformat_user (input, unformat_line_input, line_input))
2070     return 0;
2071
2072   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2073     {
2074       if (unformat (line_input, "%U - %U",
2075                     unformat_ip4_address, &start_addr,
2076                     unformat_ip4_address, &end_addr))
2077         ;
2078       else if (unformat (line_input, "tenant-vrf %u", &vrf_id))
2079         ;
2080       else if (unformat (line_input, "%U", unformat_ip4_address, &start_addr))
2081         end_addr = start_addr;
2082       else if (unformat (line_input, "twice-nat"))
2083         twice_nat = 1;
2084       else if (unformat (line_input, "del"))
2085         is_add = 0;
2086       else
2087         {
2088           error = clib_error_return (0, "unknown input '%U'",
2089             format_unformat_error, line_input);
2090           goto done;
2091         }
2092      }
2093
2094   if (sm->static_mapping_only)
2095     {
2096       error = clib_error_return (0, "static mapping only mode");
2097       goto done;
2098     }
2099
2100   start_host_order = clib_host_to_net_u32 (start_addr.as_u32);
2101   end_host_order = clib_host_to_net_u32 (end_addr.as_u32);
2102
2103   if (end_host_order < start_host_order)
2104     {
2105       error = clib_error_return (0, "end address less than start address");
2106       goto done;
2107     }
2108
2109   count = (end_host_order - start_host_order) + 1;
2110
2111   if (count > 1024)
2112     clib_warning ("%U - %U, %d addresses...",
2113                   format_ip4_address, &start_addr,
2114                   format_ip4_address, &end_addr,
2115                   count);
2116
2117   this_addr = start_addr;
2118
2119   for (i = 0; i < count; i++)
2120     {
2121       if (is_add)
2122         snat_add_address (sm, &this_addr, vrf_id, twice_nat);
2123       else
2124         rv = snat_del_address (sm, this_addr, 0, twice_nat);
2125
2126       switch (rv)
2127         {
2128         case VNET_API_ERROR_NO_SUCH_ENTRY:
2129           error = clib_error_return (0, "S-NAT address not exist.");
2130           goto done;
2131         case VNET_API_ERROR_UNSPECIFIED:
2132           error = clib_error_return (0, "S-NAT address used in static mapping.");
2133           goto done;
2134         default:
2135           break;
2136         }
2137
2138       if (sm->out2in_dpo)
2139         nat44_add_del_address_dpo (this_addr, is_add);
2140
2141       increment_v4_address (&this_addr);
2142     }
2143
2144 done:
2145   unformat_free (line_input);
2146
2147   return error;
2148 }
2149
2150 VLIB_CLI_COMMAND (add_address_command, static) = {
2151   .path = "nat44 add address",
2152   .short_help = "nat44 add address <ip4-range-start> [- <ip4-range-end>] "
2153                 "[tenant-vrf <vrf-id>] [twice-nat] [del]",
2154   .function = add_address_command_fn,
2155 };
2156
2157 static clib_error_t *
2158 snat_feature_command_fn (vlib_main_t * vm,
2159                           unformat_input_t * input,
2160                           vlib_cli_command_t * cmd)
2161 {
2162   unformat_input_t _line_input, *line_input = &_line_input;
2163   vnet_main_t * vnm = vnet_get_main();
2164   clib_error_t * error = 0;
2165   u32 sw_if_index;
2166   u32 * inside_sw_if_indices = 0;
2167   u32 * outside_sw_if_indices = 0;
2168   u8 is_output_feature = 0;
2169   int is_del = 0;
2170   int i;
2171
2172   sw_if_index = ~0;
2173
2174   /* Get a line of input. */
2175   if (!unformat_user (input, unformat_line_input, line_input))
2176     return 0;
2177
2178   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2179     {
2180       if (unformat (line_input, "in %U", unformat_vnet_sw_interface,
2181                     vnm, &sw_if_index))
2182         vec_add1 (inside_sw_if_indices, sw_if_index);
2183       else if (unformat (line_input, "out %U", unformat_vnet_sw_interface,
2184                          vnm, &sw_if_index))
2185         vec_add1 (outside_sw_if_indices, sw_if_index);
2186       else if (unformat (line_input, "output-feature"))
2187         is_output_feature = 1;
2188       else if (unformat (line_input, "del"))
2189         is_del = 1;
2190       else
2191         {
2192           error = clib_error_return (0, "unknown input '%U'",
2193             format_unformat_error, line_input);
2194           goto done;
2195         }
2196     }
2197
2198   if (vec_len (inside_sw_if_indices))
2199     {
2200       for (i = 0; i < vec_len(inside_sw_if_indices); i++)
2201         {
2202           sw_if_index = inside_sw_if_indices[i];
2203           if (is_output_feature)
2204             {
2205               if (snat_interface_add_del_output_feature (sw_if_index, 1, is_del))
2206                 {
2207                   error = clib_error_return (0, "%s %U failed",
2208                                              is_del ? "del" : "add",
2209                                              format_vnet_sw_interface_name, vnm,
2210                                              vnet_get_sw_interface (vnm,
2211                                                                     sw_if_index));
2212                   goto done;
2213                 }
2214             }
2215           else
2216             {
2217               if (snat_interface_add_del (sw_if_index, 1, is_del))
2218                 {
2219                   error = clib_error_return (0, "%s %U failed",
2220                                              is_del ? "del" : "add",
2221                                              format_vnet_sw_interface_name, vnm,
2222                                              vnet_get_sw_interface (vnm,
2223                                                                     sw_if_index));
2224                   goto done;
2225                 }
2226             }
2227         }
2228     }
2229
2230   if (vec_len (outside_sw_if_indices))
2231     {
2232       for (i = 0; i < vec_len(outside_sw_if_indices); i++)
2233         {
2234           sw_if_index = outside_sw_if_indices[i];
2235           if (is_output_feature)
2236             {
2237               if (snat_interface_add_del_output_feature (sw_if_index, 0, is_del))
2238                 {
2239                   error = clib_error_return (0, "%s %U failed",
2240                                              is_del ? "del" : "add",
2241                                              format_vnet_sw_interface_name, vnm,
2242                                              vnet_get_sw_interface (vnm,
2243                                                                     sw_if_index));
2244                   goto done;
2245                 }
2246             }
2247           else
2248             {
2249               if (snat_interface_add_del (sw_if_index, 0, is_del))
2250                 {
2251                   error = clib_error_return (0, "%s %U failed",
2252                                              is_del ? "del" : "add",
2253                                              format_vnet_sw_interface_name, vnm,
2254                                              vnet_get_sw_interface (vnm,
2255                                                                     sw_if_index));
2256                   goto done;
2257                 }
2258             }
2259         }
2260     }
2261
2262 done:
2263   unformat_free (line_input);
2264   vec_free (inside_sw_if_indices);
2265   vec_free (outside_sw_if_indices);
2266
2267   return error;
2268 }
2269
2270 VLIB_CLI_COMMAND (set_interface_snat_command, static) = {
2271   .path = "set interface nat44",
2272   .function = snat_feature_command_fn,
2273   .short_help = "set interface nat44 in <intfc> out <intfc> [output-feature] "
2274                 "[del]",
2275 };
2276
2277 uword
2278 unformat_snat_protocol (unformat_input_t * input, va_list * args)
2279 {
2280   u32 *r = va_arg (*args, u32 *);
2281
2282   if (0);
2283 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
2284   foreach_snat_protocol
2285 #undef _
2286   else
2287     return 0;
2288   return 1;
2289 }
2290
2291 u8 *
2292 format_snat_protocol (u8 * s, va_list * args)
2293 {
2294   u32 i = va_arg (*args, u32);
2295   u8 *t = 0;
2296
2297   switch (i)
2298     {
2299 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
2300       foreach_snat_protocol
2301 #undef _
2302     default:
2303       s = format (s, "unknown");
2304       return s;
2305     }
2306   s = format (s, "%s", t);
2307   return s;
2308 }
2309
2310 static clib_error_t *
2311 add_static_mapping_command_fn (vlib_main_t * vm,
2312                                unformat_input_t * input,
2313                                vlib_cli_command_t * cmd)
2314 {
2315   unformat_input_t _line_input, *line_input = &_line_input;
2316   clib_error_t * error = 0;
2317   ip4_address_t l_addr, e_addr;
2318   u32 l_port = 0, e_port = 0, vrf_id = ~0;
2319   int is_add = 1;
2320   int addr_only = 1;
2321   u32 sw_if_index = ~0;
2322   vnet_main_t * vnm = vnet_get_main();
2323   int rv;
2324   snat_protocol_t proto = ~0;
2325   u8 proto_set = 0;
2326   u8 twice_nat = 0;
2327   u8 out2in_only = 0;
2328
2329   /* Get a line of input. */
2330   if (!unformat_user (input, unformat_line_input, line_input))
2331     return 0;
2332
2333   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2334     {
2335       if (unformat (line_input, "local %U %u", unformat_ip4_address, &l_addr,
2336                     &l_port))
2337         addr_only = 0;
2338       else if (unformat (line_input, "local %U", unformat_ip4_address, &l_addr))
2339         ;
2340       else if (unformat (line_input, "external %U %u", unformat_ip4_address,
2341                          &e_addr, &e_port))
2342         addr_only = 0;
2343       else if (unformat (line_input, "external %U", unformat_ip4_address,
2344                          &e_addr))
2345         ;
2346       else if (unformat (line_input, "external %U %u",
2347                          unformat_vnet_sw_interface, vnm, &sw_if_index,
2348                          &e_port))
2349         addr_only = 0;
2350
2351       else if (unformat (line_input, "external %U",
2352                          unformat_vnet_sw_interface, vnm, &sw_if_index))
2353         ;
2354       else if (unformat (line_input, "vrf %u", &vrf_id))
2355         ;
2356       else if (unformat (line_input, "%U", unformat_snat_protocol, &proto))
2357         proto_set = 1;
2358       else if (unformat (line_input, "twice-nat"))
2359         twice_nat = 1;
2360       else if (unformat (line_input, "out2in-only"))
2361         out2in_only = 1;
2362       else if (unformat (line_input, "del"))
2363         is_add = 0;
2364       else
2365         {
2366           error = clib_error_return (0, "unknown input: '%U'",
2367             format_unformat_error, line_input);
2368           goto done;
2369         }
2370     }
2371
2372   if (twice_nat && addr_only)
2373     {
2374       error = clib_error_return (0, "twice NAT only for 1:1 NAPT");
2375       goto done;
2376     }
2377
2378   if (!addr_only && !proto_set)
2379     {
2380       error = clib_error_return (0, "missing protocol");
2381       goto done;
2382     }
2383
2384   rv = snat_add_static_mapping(l_addr, e_addr, (u16) l_port, (u16) e_port,
2385                                vrf_id, addr_only, sw_if_index, proto, is_add,
2386                                twice_nat, out2in_only);
2387
2388   switch (rv)
2389     {
2390     case VNET_API_ERROR_INVALID_VALUE:
2391       error = clib_error_return (0, "External port already in use.");
2392       goto done;
2393     case VNET_API_ERROR_NO_SUCH_ENTRY:
2394       if (is_add)
2395         error = clib_error_return (0, "External addres must be allocated.");
2396       else
2397         error = clib_error_return (0, "Mapping not exist.");
2398       goto done;
2399     case VNET_API_ERROR_NO_SUCH_FIB:
2400       error = clib_error_return (0, "No such VRF id.");
2401       goto done;
2402     case VNET_API_ERROR_VALUE_EXIST:
2403       error = clib_error_return (0, "Mapping already exist.");
2404       goto done;
2405     default:
2406       break;
2407     }
2408
2409 done:
2410   unformat_free (line_input);
2411
2412   return error;
2413 }
2414
2415 /*?
2416  * @cliexpar
2417  * @cliexstart{snat add static mapping}
2418  * Static mapping allows hosts on the external network to initiate connection
2419  * to to the local network host.
2420  * To create static mapping between local host address 10.0.0.3 port 6303 and
2421  * external address 4.4.4.4 port 3606 for TCP protocol use:
2422  *  vpp# nat44 add static mapping tcp local 10.0.0.3 6303 external 4.4.4.4 3606
2423  * If not runnig "static mapping only" NAT plugin mode use before:
2424  *  vpp# nat44 add address 4.4.4.4
2425  * To create static mapping between local and external address use:
2426  *  vpp# nat44 add static mapping local 10.0.0.3 external 4.4.4.4
2427  * @cliexend
2428 ?*/
2429 VLIB_CLI_COMMAND (add_static_mapping_command, static) = {
2430   .path = "nat44 add static mapping",
2431   .function = add_static_mapping_command_fn,
2432   .short_help =
2433     "nat44 add static mapping tcp|udp|icmp local <addr> [<port>] "
2434     "external <addr> [<port>] [vrf <table-id>] [twice-nat] [out2in-only] [del]",
2435 };
2436
2437 static clib_error_t *
2438 add_identity_mapping_command_fn (vlib_main_t * vm,
2439                                  unformat_input_t * input,
2440                                  vlib_cli_command_t * cmd)
2441 {
2442   unformat_input_t _line_input, *line_input = &_line_input;
2443   clib_error_t * error = 0;
2444   ip4_address_t addr;
2445   u32 port = 0, vrf_id = ~0;
2446   int is_add = 1;
2447   int addr_only = 1;
2448   u32 sw_if_index = ~0;
2449   vnet_main_t * vnm = vnet_get_main();
2450   int rv;
2451   snat_protocol_t proto;
2452
2453   addr.as_u32 = 0;
2454
2455   /* Get a line of input. */
2456   if (!unformat_user (input, unformat_line_input, line_input))
2457     return 0;
2458
2459   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2460     {
2461       if (unformat (line_input, "%U", unformat_ip4_address, &addr))
2462         ;
2463       else if (unformat (line_input, "external %U",
2464                          unformat_vnet_sw_interface, vnm, &sw_if_index))
2465         ;
2466       else if (unformat (line_input, "vrf %u", &vrf_id))
2467         ;
2468       else if (unformat (line_input, "%U %u", unformat_snat_protocol, &proto,
2469                          &port))
2470         addr_only = 0;
2471       else if (unformat (line_input, "del"))
2472         is_add = 0;
2473       else
2474         {
2475           error = clib_error_return (0, "unknown input: '%U'",
2476             format_unformat_error, line_input);
2477           goto done;
2478         }
2479     }
2480
2481   rv = snat_add_static_mapping(addr, addr, (u16) port, (u16) port,
2482                                vrf_id, addr_only, sw_if_index, proto, is_add,
2483                                0, 0);
2484
2485   switch (rv)
2486     {
2487     case VNET_API_ERROR_INVALID_VALUE:
2488       error = clib_error_return (0, "External port already in use.");
2489       goto done;
2490     case VNET_API_ERROR_NO_SUCH_ENTRY:
2491       if (is_add)
2492         error = clib_error_return (0, "External addres must be allocated.");
2493       else
2494         error = clib_error_return (0, "Mapping not exist.");
2495       goto done;
2496     case VNET_API_ERROR_NO_SUCH_FIB:
2497       error = clib_error_return (0, "No such VRF id.");
2498       goto done;
2499     case VNET_API_ERROR_VALUE_EXIST:
2500       error = clib_error_return (0, "Mapping already exist.");
2501       goto done;
2502     default:
2503       break;
2504     }
2505
2506 done:
2507   unformat_free (line_input);
2508
2509   return error;
2510 }
2511
2512 /*?
2513  * @cliexpar
2514  * @cliexstart{snat add identity mapping}
2515  * Identity mapping translate an IP address to itself.
2516  * To create identity mapping for address 10.0.0.3 port 6303 for TCP protocol
2517  * use:
2518  *  vpp# nat44 add identity mapping 10.0.0.3 tcp 6303
2519  * To create identity mapping for address 10.0.0.3 use:
2520  *  vpp# nat44 add identity mapping 10.0.0.3
2521  * To create identity mapping for DHCP addressed interface use:
2522  *  vpp# nat44 add identity mapping GigabitEthernet0/a/0 tcp 3606
2523  * @cliexend
2524 ?*/
2525 VLIB_CLI_COMMAND (add_identity_mapping_command, static) = {
2526   .path = "nat44 add identity mapping",
2527   .function = add_identity_mapping_command_fn,
2528   .short_help = "nat44 add identity mapping <interface>|<ip4-addr> "
2529     "[<protocol> <port>] [vrf <table-id>] [del]",
2530 };
2531
2532 static clib_error_t *
2533 add_lb_static_mapping_command_fn (vlib_main_t * vm,
2534                                   unformat_input_t * input,
2535                                   vlib_cli_command_t * cmd)
2536 {
2537   unformat_input_t _line_input, *line_input = &_line_input;
2538   clib_error_t * error = 0;
2539   ip4_address_t l_addr, e_addr;
2540   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0;
2541   int is_add = 1;
2542   int rv;
2543   snat_protocol_t proto;
2544   u8 proto_set = 0;
2545   nat44_lb_addr_port_t *locals = 0, local;
2546   u8 twice_nat = 0;
2547   u8 out2in_only = 0;
2548
2549   /* Get a line of input. */
2550   if (!unformat_user (input, unformat_line_input, line_input))
2551     return 0;
2552
2553   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2554     {
2555       if (unformat (line_input, "local %U:%u probability %u",
2556                     unformat_ip4_address, &l_addr, &l_port, &probability))
2557         {
2558           memset (&local, 0, sizeof (local));
2559           local.addr = l_addr;
2560           local.port = (u16) l_port;
2561           local.probability = (u8) probability;
2562           vec_add1 (locals, local);
2563         }
2564       else if (unformat (line_input, "external %U:%u", unformat_ip4_address,
2565                          &e_addr, &e_port))
2566         ;
2567       else if (unformat (line_input, "vrf %u", &vrf_id))
2568         ;
2569       else if (unformat (line_input, "protocol %U", unformat_snat_protocol,
2570                          &proto))
2571         proto_set = 1;
2572       else if (unformat (line_input, "twice-nat"))
2573         twice_nat = 1;
2574       else if (unformat (line_input, "out2in-only"))
2575         out2in_only = 1;
2576       else if (unformat (line_input, "del"))
2577         is_add = 0;
2578       else
2579         {
2580           error = clib_error_return (0, "unknown input: '%U'",
2581             format_unformat_error, line_input);
2582           goto done;
2583         }
2584     }
2585
2586   if (vec_len (locals) < 2)
2587     {
2588       error = clib_error_return (0, "at least two local must be set");
2589       goto done;
2590     }
2591
2592   if (!proto_set)
2593     {
2594       error = clib_error_return (0, "missing protocol");
2595       goto done;
2596     }
2597
2598   rv = nat44_add_del_lb_static_mapping (e_addr, (u16) e_port, proto, vrf_id,
2599                                         locals, is_add, twice_nat, out2in_only);
2600
2601   switch (rv)
2602     {
2603     case VNET_API_ERROR_INVALID_VALUE:
2604       error = clib_error_return (0, "External port already in use.");
2605       goto done;
2606     case VNET_API_ERROR_NO_SUCH_ENTRY:
2607       if (is_add)
2608         error = clib_error_return (0, "External addres must be allocated.");
2609       else
2610         error = clib_error_return (0, "Mapping not exist.");
2611       goto done;
2612     case VNET_API_ERROR_VALUE_EXIST:
2613       error = clib_error_return (0, "Mapping already exist.");
2614       goto done;
2615     default:
2616       break;
2617     }
2618
2619 done:
2620   unformat_free (line_input);
2621   vec_free (locals);
2622
2623   return error;
2624 }
2625
2626 VLIB_CLI_COMMAND (add_lb_static_mapping_command, static) = {
2627   .path = "nat44 add load-balancing static mapping",
2628   .function = add_lb_static_mapping_command_fn,
2629   .short_help =
2630     "nat44 add load-balancing static mapping protocol tcp|udp "
2631     "external <addr>:<port> local <addr>:<port> probability <n> [twice-nat] "
2632     "[vrf <table-id>] [out2in-only] [del]",
2633 };
2634
2635 static clib_error_t *
2636 set_workers_command_fn (vlib_main_t * vm,
2637                         unformat_input_t * input,
2638                         vlib_cli_command_t * cmd)
2639 {
2640   unformat_input_t _line_input, *line_input = &_line_input;
2641   uword *bitmap = 0;
2642   int rv = 0;
2643   clib_error_t *error = 0;
2644
2645   /* Get a line of input. */
2646   if (!unformat_user (input, unformat_line_input, line_input))
2647     return 0;
2648
2649   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2650     {
2651       if (unformat (line_input, "%U", unformat_bitmap_list, &bitmap))
2652         ;
2653       else
2654         {
2655           error = clib_error_return (0, "unknown input '%U'",
2656             format_unformat_error, line_input);
2657           goto done;
2658         }
2659      }
2660
2661   if (bitmap == 0)
2662     {
2663       error = clib_error_return (0, "List of workers must be specified.");
2664       goto done;
2665     }
2666
2667   rv = snat_set_workers(bitmap);
2668
2669   clib_bitmap_free (bitmap);
2670
2671   switch (rv)
2672     {
2673     case VNET_API_ERROR_INVALID_WORKER:
2674       error = clib_error_return (0, "Invalid worker(s).");
2675       goto done;
2676     case VNET_API_ERROR_FEATURE_DISABLED:
2677       error = clib_error_return (0,
2678         "Supported only if 2 or more workes available.");
2679       goto done;
2680     default:
2681       break;
2682     }
2683
2684 done:
2685   unformat_free (line_input);
2686
2687   return error;
2688 }
2689
2690 /*?
2691  * @cliexpar
2692  * @cliexstart{set snat workers}
2693  * Set NAT workers if 2 or more workers available, use:
2694  *  vpp# set snat workers 0-2,5
2695  * @cliexend
2696 ?*/
2697 VLIB_CLI_COMMAND (set_workers_command, static) = {
2698   .path = "set nat workers",
2699   .function = set_workers_command_fn,
2700   .short_help =
2701     "set nat workers <workers-list>",
2702 };
2703
2704 static clib_error_t *
2705 snat_ipfix_logging_enable_disable_command_fn (vlib_main_t * vm,
2706                                               unformat_input_t * input,
2707                                               vlib_cli_command_t * cmd)
2708 {
2709   unformat_input_t _line_input, *line_input = &_line_input;
2710   u32 domain_id = 0;
2711   u32 src_port = 0;
2712   u8 enable = 1;
2713   int rv = 0;
2714   clib_error_t *error = 0;
2715
2716   /* Get a line of input. */
2717   if (!unformat_user (input, unformat_line_input, line_input))
2718     return 0;
2719
2720   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
2721     {
2722       if (unformat (line_input, "domain %d", &domain_id))
2723         ;
2724       else if (unformat (line_input, "src-port %d", &src_port))
2725         ;
2726       else if (unformat (line_input, "disable"))
2727         enable = 0;
2728       else
2729         {
2730           error = clib_error_return (0, "unknown input '%U'",
2731             format_unformat_error, line_input);
2732           goto done;
2733         }
2734      }
2735
2736   rv = snat_ipfix_logging_enable_disable (enable, domain_id, (u16) src_port);
2737
2738   if (rv)
2739     {
2740       error = clib_error_return (0, "ipfix logging enable failed");
2741       goto done;
2742     }
2743
2744 done:
2745   unformat_free (line_input);
2746
2747   return error;
2748 }
2749
2750 /*?
2751  * @cliexpar
2752  * @cliexstart{snat ipfix logging}
2753  * To enable NAT IPFIX logging use:
2754  *  vpp# nat ipfix logging
2755  * To set IPFIX exporter use:
2756  *  vpp# set ipfix exporter collector 10.10.10.3 src 10.10.10.1
2757  * @cliexend
2758 ?*/
2759 VLIB_CLI_COMMAND (snat_ipfix_logging_enable_disable_command, static) = {
2760   .path = "nat ipfix logging",
2761   .function = snat_ipfix_logging_enable_disable_command_fn,
2762   .short_help = "nat ipfix logging [domain <domain-id>] [src-port <port>] [disable]",
2763 };
2764
2765 static u32
2766 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2767 {
2768   snat_main_t *sm = &snat_main;
2769   u32 next_worker_index = 0;
2770   u32 hash;
2771
2772   next_worker_index = sm->first_worker_index;
2773   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2774          (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >>24);
2775
2776   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2777     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2778   else
2779     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2780
2781   return next_worker_index;
2782 }
2783
2784 static u32
2785 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2786 {
2787   snat_main_t *sm = &snat_main;
2788   udp_header_t *udp;
2789   u16 port;
2790   snat_session_key_t m_key;
2791   clib_bihash_kv_8_8_t kv, value;
2792   snat_static_mapping_t *m;
2793   nat_ed_ses_key_t key;
2794   clib_bihash_kv_16_8_t s_kv, s_value;
2795   snat_main_per_thread_data_t *tsm;
2796   snat_session_t *s;
2797   int i;
2798   u32 proto;
2799   u32 next_worker_index = 0;
2800
2801   /* first try static mappings without port */
2802   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2803     {
2804       m_key.addr = ip0->dst_address;
2805       m_key.port = 0;
2806       m_key.protocol = 0;
2807       m_key.fib_index = rx_fib_index0;
2808       kv.key = m_key.as_u64;
2809       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2810         {
2811           m = pool_elt_at_index (sm->static_mappings, value.value);
2812           return m->worker_index;
2813         }
2814     }
2815
2816   proto = ip_proto_to_snat_proto (ip0->protocol);
2817   udp = ip4_next_header (ip0);
2818   port = udp->dst_port;
2819
2820   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2821     {
2822       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2823         return vlib_get_thread_index ();
2824
2825       if (PREDICT_TRUE (!ip4_is_first_fragment (ip0)))
2826         {
2827           nat_reass_ip4_t *reass;
2828
2829           reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2830                                       ip0->fragment_id, ip0->protocol);
2831
2832           if (reass && (reass->thread_index != (u32) ~ 0))
2833             return reass->thread_index;
2834           else
2835             return vlib_get_thread_index ();
2836         }
2837     }
2838
2839   /* unknown protocol */
2840   if (PREDICT_FALSE (proto == ~0))
2841     {
2842       key.l_addr = ip0->dst_address;
2843       key.r_addr = ip0->src_address;
2844       key.fib_index = rx_fib_index0;
2845       key.proto = ip0->protocol;
2846       key.r_port = 0;
2847       key.l_port = 0;
2848       s_kv.key[0] = key.as_u64[0];
2849       s_kv.key[1] = key.as_u64[1];
2850
2851       if (!clib_bihash_search_16_8 (&sm->out2in_ed, &s_kv, &s_value))
2852         {
2853           for (i = 0; i < _vec_len (sm->per_thread_data); i++)
2854             {
2855               tsm = vec_elt_at_index (sm->per_thread_data, i);
2856               if (!pool_is_free_index(tsm->sessions, s_value.value))
2857                 {
2858                   s = pool_elt_at_index (tsm->sessions, s_value.value);
2859                   if (s->out2in.addr.as_u32 == ip0->dst_address.as_u32 &&
2860                       s->out2in.port == ip0->protocol &&
2861                       snat_is_unk_proto_session (s))
2862                     return i;
2863                 }
2864             }
2865          }
2866
2867       /* if no session use current thread */
2868       return vlib_get_thread_index ();
2869     }
2870
2871   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2872     {
2873       icmp46_header_t * icmp = (icmp46_header_t *) udp;
2874       icmp_echo_header_t *echo = (icmp_echo_header_t *)(icmp + 1);
2875       if (!icmp_is_error_message (icmp))
2876         port = echo->identifier;
2877       else
2878         {
2879           ip4_header_t *inner_ip = (ip4_header_t *)(echo + 1);
2880           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2881           void *l4_header = ip4_next_header (inner_ip);
2882           switch (proto)
2883             {
2884             case SNAT_PROTOCOL_ICMP:
2885               icmp = (icmp46_header_t*)l4_header;
2886               echo = (icmp_echo_header_t *)(icmp + 1);
2887               port = echo->identifier;
2888               break;
2889             case SNAT_PROTOCOL_UDP:
2890             case SNAT_PROTOCOL_TCP:
2891               port = ((tcp_udp_header_t*)l4_header)->src_port;
2892               break;
2893             default:
2894               return vlib_get_thread_index ();
2895             }
2896         }
2897     }
2898
2899   /* try static mappings with port */
2900   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2901     {
2902       m_key.addr = ip0->dst_address;
2903       m_key.port = clib_net_to_host_u16 (port);
2904       m_key.protocol = proto;
2905       m_key.fib_index = rx_fib_index0;
2906       kv.key = m_key.as_u64;
2907       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2908         {
2909           m = pool_elt_at_index (sm->static_mappings, value.value);
2910           return m->worker_index;
2911         }
2912     }
2913
2914   /* worker by outside port */
2915   next_worker_index = sm->first_worker_index;
2916   next_worker_index +=
2917     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
2918   return next_worker_index;
2919 }
2920
2921 static clib_error_t *
2922 snat_config (vlib_main_t * vm, unformat_input_t * input)
2923 {
2924   snat_main_t * sm = &snat_main;
2925   u32 translation_buckets = 1024;
2926   u32 translation_memory_size = 128<<20;
2927   u32 user_buckets = 128;
2928   u32 user_memory_size = 64<<20;
2929   u32 max_translations_per_user = 100;
2930   u32 outside_vrf_id = 0;
2931   u32 inside_vrf_id = 0;
2932   u32 static_mapping_buckets = 1024;
2933   u32 static_mapping_memory_size = 64<<20;
2934   u32 nat64_bib_buckets = 1024;
2935   u32 nat64_bib_memory_size = 128 << 20;
2936   u32 nat64_st_buckets = 2048;
2937   u32 nat64_st_memory_size = 256 << 20;
2938   u8 static_mapping_only = 0;
2939   u8 static_mapping_connection_tracking = 0;
2940   snat_main_per_thread_data_t *tsm;
2941   dslite_main_t * dm = &dslite_main;
2942
2943   sm->deterministic = 0;
2944   sm->out2in_dpo = 0;
2945
2946   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
2947     {
2948       if (unformat (input, "translation hash buckets %d", &translation_buckets))
2949         ;
2950       else if (unformat (input, "translation hash memory %d",
2951                          &translation_memory_size));
2952       else if (unformat (input, "user hash buckets %d", &user_buckets))
2953         ;
2954       else if (unformat (input, "user hash memory %d",
2955                          &user_memory_size))
2956         ;
2957       else if (unformat (input, "max translations per user %d",
2958                          &max_translations_per_user))
2959         ;
2960       else if (unformat (input, "outside VRF id %d",
2961                          &outside_vrf_id))
2962         ;
2963       else if (unformat (input, "inside VRF id %d",
2964                          &inside_vrf_id))
2965         ;
2966       else if (unformat (input, "static mapping only"))
2967         {
2968           static_mapping_only = 1;
2969           if (unformat (input, "connection tracking"))
2970             static_mapping_connection_tracking = 1;
2971         }
2972       else if (unformat (input, "deterministic"))
2973         sm->deterministic = 1;
2974       else if (unformat (input, "nat64 bib hash buckets %d",
2975                          &nat64_bib_buckets))
2976         ;
2977       else if (unformat (input, "nat64 bib hash memory %d",
2978                          &nat64_bib_memory_size))
2979         ;
2980       else if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
2981         ;
2982       else if (unformat (input, "nat64 st hash memory %d",
2983                          &nat64_st_memory_size))
2984         ;
2985       else if (unformat (input, "out2in dpo"))
2986         sm->out2in_dpo = 1;
2987       else if (unformat (input, "dslite ce"))
2988         dslite_set_ce(dm, 1);
2989       else
2990         return clib_error_return (0, "unknown input '%U'",
2991                                   format_unformat_error, input);
2992     }
2993
2994   /* for show commands, etc. */
2995   sm->translation_buckets = translation_buckets;
2996   sm->translation_memory_size = translation_memory_size;
2997   /* do not exceed load factor 10 */
2998   sm->max_translations = 10 * translation_buckets;
2999   sm->user_buckets = user_buckets;
3000   sm->user_memory_size = user_memory_size;
3001   sm->max_translations_per_user = max_translations_per_user;
3002   sm->outside_vrf_id = outside_vrf_id;
3003   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3004                                                              outside_vrf_id,
3005                                                              FIB_SOURCE_PLUGIN_HI);
3006   sm->inside_vrf_id = inside_vrf_id;
3007   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3008                                                             inside_vrf_id,
3009                                                             FIB_SOURCE_PLUGIN_HI);
3010   sm->static_mapping_only = static_mapping_only;
3011   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
3012
3013   nat64_set_hash(nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
3014                  nat64_st_memory_size);
3015
3016   if (sm->deterministic)
3017     {
3018       sm->in2out_node_index = snat_det_in2out_node.index;
3019       sm->in2out_output_node_index = ~0;
3020       sm->out2in_node_index = snat_det_out2in_node.index;
3021       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
3022       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
3023     }
3024   else
3025     {
3026       sm->worker_in2out_cb = snat_get_worker_in2out_cb;
3027       sm->worker_out2in_cb = snat_get_worker_out2in_cb;
3028       sm->in2out_node_index = snat_in2out_node.index;
3029       sm->in2out_output_node_index = snat_in2out_output_node.index;
3030       sm->out2in_node_index = snat_out2in_node.index;
3031       if (!static_mapping_only ||
3032           (static_mapping_only && static_mapping_connection_tracking))
3033         {
3034           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
3035           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
3036
3037           vec_foreach (tsm, sm->per_thread_data)
3038             {
3039               clib_bihash_init_8_8 (&tsm->in2out, "in2out", translation_buckets,
3040                                     translation_memory_size);
3041
3042               clib_bihash_init_8_8 (&tsm->out2in, "out2in", translation_buckets,
3043                                     translation_memory_size);
3044
3045               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
3046                                     user_memory_size);
3047             }
3048
3049           clib_bihash_init_16_8 (&sm->in2out_ed, "in2out-ed",
3050                                  translation_buckets, translation_memory_size);
3051
3052           clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
3053                                  translation_buckets, translation_memory_size);
3054         }
3055       else
3056         {
3057           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
3058           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
3059         }
3060       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
3061                             "static_mapping_by_local", static_mapping_buckets,
3062                             static_mapping_memory_size);
3063
3064       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
3065                             "static_mapping_by_external", static_mapping_buckets,
3066                             static_mapping_memory_size);
3067     }
3068
3069   return 0;
3070 }
3071
3072 VLIB_CONFIG_FUNCTION (snat_config, "nat");
3073
3074 u8 * format_snat_session_state (u8 * s, va_list * args)
3075 {
3076   u32 i = va_arg (*args, u32);
3077   u8 *t = 0;
3078
3079   switch (i)
3080     {
3081 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
3082     foreach_snat_session_state
3083 #undef _
3084     default:
3085       t = format (t, "unknown");
3086     }
3087   s = format (s, "%s", t);
3088   return s;
3089 }
3090
3091 u8 * format_snat_key (u8 * s, va_list * args)
3092 {
3093   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
3094
3095   s = format (s, "%U proto %U port %d fib %d",
3096               format_ip4_address, &key->addr,
3097               format_snat_protocol, key->protocol,
3098               clib_net_to_host_u16 (key->port), key->fib_index);
3099   return s;
3100 }
3101
3102 u8 * format_snat_session (u8 * s, va_list * args)
3103 {
3104   snat_main_t * sm __attribute__((unused)) = va_arg (*args, snat_main_t *);
3105   snat_session_t * sess = va_arg (*args, snat_session_t *);
3106
3107   if (snat_is_unk_proto_session (sess))
3108     {
3109       s = format (s, "  i2o %U proto %u fib %u\n",
3110                   format_ip4_address, &sess->in2out.addr,
3111                   clib_net_to_host_u16 (sess->in2out.port),
3112                   sess->in2out.fib_index);
3113       s = format (s, "    o2i %U proto %u fib %u\n",
3114                   format_ip4_address, &sess->out2in.addr,
3115                   clib_net_to_host_u16 (sess->out2in.port),
3116                   sess->out2in.fib_index);
3117     }
3118   else
3119     {
3120       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
3121       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
3122     }
3123   if (is_twice_nat_session (sess))
3124     {
3125       s = format (s, "       external host o2i %U:%d i2o %U:%d\n",
3126                   format_ip4_address, &sess->ext_host_addr,
3127                   clib_net_to_host_u16 (sess->ext_host_port),
3128                   format_ip4_address, &sess->ext_host_nat_addr,
3129                   clib_net_to_host_u16 (sess->ext_host_nat_port));
3130     }
3131   else
3132     {
3133       if (sess->ext_host_addr.as_u32)
3134           s = format (s, "       external host %U\n",
3135                       format_ip4_address, &sess->ext_host_addr);
3136     }
3137   s = format (s, "       last heard %.2f\n", sess->last_heard);
3138   s = format (s, "       total pkts %d, total bytes %lld\n",
3139               sess->total_pkts, sess->total_bytes);
3140   if (snat_is_session_static (sess))
3141     s = format (s, "       static translation\n");
3142   else
3143     s = format (s, "       dynamic translation\n");
3144   if (sess->flags & SNAT_SESSION_FLAG_LOAD_BALANCING)
3145     s = format (s, "       load-balancing\n");
3146   if (is_twice_nat_session (sess))
3147     s = format (s, "       twice-nat\n");
3148
3149   return s;
3150 }
3151
3152 u8 * format_snat_user (u8 * s, va_list * args)
3153 {
3154   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
3155   snat_user_t * u = va_arg (*args, snat_user_t *);
3156   int verbose = va_arg (*args, int);
3157   dlist_elt_t * head, * elt;
3158   u32 elt_index, head_index;
3159   u32 session_index;
3160   snat_session_t * sess;
3161
3162   s = format (s, "%U: %d dynamic translations, %d static translations\n",
3163               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
3164
3165   if (verbose == 0)
3166     return s;
3167
3168   if (u->nsessions || u->nstaticsessions)
3169     {
3170       head_index = u->sessions_per_user_list_head_index;
3171       head = pool_elt_at_index (sm->list_pool, head_index);
3172
3173       elt_index = head->next;
3174       elt = pool_elt_at_index (sm->list_pool, elt_index);
3175       session_index = elt->value;
3176
3177       while (session_index != ~0)
3178         {
3179           sess = pool_elt_at_index (sm->sessions, session_index);
3180
3181           s = format (s, "  %U\n", format_snat_session, sm, sess);
3182
3183           elt_index = elt->next;
3184           elt = pool_elt_at_index (sm->list_pool, elt_index);
3185           session_index = elt->value;
3186         }
3187     }
3188
3189   return s;
3190 }
3191
3192 u8 * format_snat_static_mapping (u8 * s, va_list * args)
3193 {
3194   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
3195   nat44_lb_addr_port_t *local;
3196
3197   if (m->addr_only)
3198       s = format (s, "local %U external %U vrf %d %s",
3199                   format_ip4_address, &m->local_addr,
3200                   format_ip4_address, &m->external_addr,
3201                   m->vrf_id, m->twice_nat ? "twice-nat" : "");
3202   else
3203    {
3204       if (vec_len (m->locals))
3205         {
3206           s = format (s, "%U vrf %d external %U:%d %s %s",
3207                       format_snat_protocol, m->proto,
3208                       m->vrf_id,
3209                       format_ip4_address, &m->external_addr, m->external_port,
3210                       m->twice_nat ? "twice-nat" : "",
3211                       m->out2in_only ? "out2in-only" : "");
3212           vec_foreach (local, m->locals)
3213             s = format (s, "\n  local %U:%d probability %d\%",
3214                         format_ip4_address, &local->addr, local->port,
3215                         local->probability);
3216         }
3217       else
3218         s = format (s, "%U local %U:%d external %U:%d vrf %d %s %s",
3219                     format_snat_protocol, m->proto,
3220                     format_ip4_address, &m->local_addr, m->local_port,
3221                     format_ip4_address, &m->external_addr, m->external_port,
3222                     m->vrf_id, m->twice_nat ? "twice-nat" : "",
3223                     m->out2in_only ? "out2in-only" : "");
3224    }
3225   return s;
3226 }
3227
3228 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
3229 {
3230   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
3231   vnet_main_t *vnm = vnet_get_main();
3232
3233   if (m->addr_only)
3234       s = format (s, "local %U external %U vrf %d",
3235                   format_ip4_address, &m->l_addr,
3236                   format_vnet_sw_interface_name, vnm,
3237                   vnet_get_sw_interface (vnm, m->sw_if_index),
3238                   m->vrf_id);
3239   else
3240       s = format (s, "%U local %U:%d external %U:%d vrf %d",
3241                   format_snat_protocol, m->proto,
3242                   format_ip4_address, &m->l_addr, m->l_port,
3243                   format_vnet_sw_interface_name, vnm,
3244                   vnet_get_sw_interface (vnm, m->sw_if_index), m->e_port,
3245                   m->vrf_id);
3246
3247   return s;
3248 }
3249
3250 u8 * format_det_map_ses (u8 * s, va_list * args)
3251 {
3252   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
3253   ip4_address_t in_addr, out_addr;
3254   u32 in_offset, out_offset;
3255   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
3256   u32 * i = va_arg (*args, u32 *);
3257
3258   u32 user_index = *i / SNAT_DET_SES_PER_USER;
3259   in_addr.as_u32 = clib_host_to_net_u32 (
3260     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
3261   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
3262     clib_net_to_host_u32(det_map->in_addr.as_u32);
3263   out_offset = in_offset / det_map->sharing_ratio;
3264   out_addr.as_u32 = clib_host_to_net_u32(
3265     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
3266   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
3267               format_ip4_address, &in_addr,
3268               clib_net_to_host_u16 (ses->in_port),
3269               format_ip4_address, &out_addr,
3270               clib_net_to_host_u16 (ses->out.out_port),
3271               format_ip4_address, &ses->out.ext_host_addr,
3272               clib_net_to_host_u16 (ses->out.ext_host_port),
3273               format_snat_session_state, ses->state,
3274               ses->expire);
3275
3276   return s;
3277 }
3278
3279 static clib_error_t *
3280 show_snat_command_fn (vlib_main_t * vm,
3281                  unformat_input_t * input,
3282                  vlib_cli_command_t * cmd)
3283 {
3284   int verbose = 0;
3285   snat_main_t * sm = &snat_main;
3286   snat_user_t * u;
3287   snat_static_mapping_t *m;
3288   snat_interface_t *i;
3289   snat_address_t * ap;
3290   vnet_main_t *vnm = vnet_get_main();
3291   snat_main_per_thread_data_t *tsm;
3292   u32 users_num = 0, sessions_num = 0, *worker, *sw_if_index;
3293   uword j = 0;
3294   snat_static_map_resolve_t *rp;
3295   snat_det_map_t * dm;
3296   snat_det_session_t * ses;
3297
3298   if (unformat (input, "detail"))
3299     verbose = 1;
3300   else if (unformat (input, "verbose"))
3301     verbose = 2;
3302
3303   if (sm->static_mapping_only)
3304     {
3305       if (sm->static_mapping_connection_tracking)
3306         vlib_cli_output (vm, "NAT plugin mode: static mapping only connection "
3307                          "tracking");
3308       else
3309         vlib_cli_output (vm, "NAT plugin mode: static mapping only");
3310     }
3311   else if (sm->deterministic)
3312     {
3313       vlib_cli_output (vm, "NAT plugin mode: deterministic mapping");
3314     }
3315   else
3316     {
3317       vlib_cli_output (vm, "NAT plugin mode: dynamic translations enabled");
3318     }
3319
3320   if (verbose > 0)
3321     {
3322       pool_foreach (i, sm->interfaces,
3323       ({
3324         vlib_cli_output (vm, "%U %s", format_vnet_sw_interface_name, vnm,
3325                          vnet_get_sw_interface (vnm, i->sw_if_index),
3326                          (nat_interface_is_inside(i) &&
3327                           nat_interface_is_outside(i)) ? "in out" :
3328                          (nat_interface_is_inside(i) ? "in" : "out"));
3329       }));
3330
3331       pool_foreach (i, sm->output_feature_interfaces,
3332       ({
3333         vlib_cli_output (vm, "%U output-feature %s",
3334                          format_vnet_sw_interface_name, vnm,
3335                          vnet_get_sw_interface (vnm, i->sw_if_index),
3336                          (nat_interface_is_inside(i) &&
3337                           nat_interface_is_outside(i)) ? "in out" :
3338                          (nat_interface_is_inside(i) ? "in" : "out"));
3339       }));
3340
3341       if (vec_len (sm->auto_add_sw_if_indices))
3342         {
3343           vlib_cli_output (vm, "NAT44 pool addresses interfaces:");
3344           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
3345             {
3346               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
3347                                vnet_get_sw_interface (vnm, *sw_if_index));
3348             }
3349         }
3350
3351       if (vec_len (sm->auto_add_sw_if_indices_twice_nat))
3352         {
3353           vlib_cli_output (vm, "NAT44 twice-nat pool addresses interfaces:");
3354           vec_foreach (sw_if_index, sm->auto_add_sw_if_indices_twice_nat)
3355             {
3356               vlib_cli_output (vm, "%U", format_vnet_sw_interface_name, vnm,
3357                                vnet_get_sw_interface (vnm, *sw_if_index));
3358             }
3359         }
3360
3361       vlib_cli_output (vm, "NAT44 pool addresses:");
3362       vec_foreach (ap, sm->addresses)
3363         {
3364           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
3365           if (ap->fib_index != ~0)
3366               vlib_cli_output (vm, "  tenant VRF: %u",
3367                                ip4_fib_get(ap->fib_index)->table_id);
3368           else
3369             vlib_cli_output (vm, "  tenant VRF independent");
3370 #define _(N, i, n, s) \
3371           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
3372           foreach_snat_protocol
3373 #undef _
3374         }
3375
3376       vlib_cli_output (vm, "NAT44 twice-nat pool addresses:");
3377       vec_foreach (ap, sm->twice_nat_addresses)
3378         {
3379           vlib_cli_output (vm, "%U", format_ip4_address, &ap->addr);
3380           if (ap->fib_index != ~0)
3381               vlib_cli_output (vm, "  tenant VRF: %u",
3382                                ip4_fib_get(ap->fib_index)->table_id);
3383           else
3384             vlib_cli_output (vm, "  tenant VRF independent");
3385 #define _(N, i, n, s) \
3386           vlib_cli_output (vm, "  %d busy %s ports", ap->busy_##n##_ports, s);
3387           foreach_snat_protocol
3388 #undef _
3389         }
3390     }
3391
3392   if (sm->num_workers > 1)
3393     {
3394       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
3395       if (verbose > 0)
3396         {
3397           vec_foreach (worker, sm->workers)
3398             {
3399               vlib_worker_thread_t *w =
3400                 vlib_worker_threads + *worker + sm->first_worker_index;
3401               vlib_cli_output (vm, "  %s", w->name);
3402             }
3403         }
3404     }
3405
3406   if (sm->deterministic)
3407     {
3408       vlib_cli_output (vm, "udp timeout: %dsec", sm->udp_timeout);
3409       vlib_cli_output (vm, "tcp-established timeout: %dsec",
3410                        sm->tcp_established_timeout);
3411       vlib_cli_output (vm, "tcp-transitory timeout: %dsec",
3412                        sm->tcp_transitory_timeout);
3413       vlib_cli_output (vm, "icmp timeout: %dsec", sm->icmp_timeout);
3414       vlib_cli_output (vm, "%d deterministic mappings",
3415                        pool_elts (sm->det_maps));
3416       if (verbose > 0)
3417         {
3418           pool_foreach (dm, sm->det_maps,
3419           ({
3420             vlib_cli_output (vm, "in %U/%d out %U/%d\n",
3421                              format_ip4_address, &dm->in_addr, dm->in_plen,
3422                              format_ip4_address, &dm->out_addr, dm->out_plen);
3423             vlib_cli_output (vm, " outside address sharing ratio: %d\n",
3424                              dm->sharing_ratio);
3425             vlib_cli_output (vm, " number of ports per inside host: %d\n",
3426                              dm->ports_per_host);
3427             vlib_cli_output (vm, " sessions number: %d\n", dm->ses_num);
3428             if (verbose > 1)
3429               {
3430                 vec_foreach_index (j, dm->sessions)
3431                   {
3432                     ses = vec_elt_at_index (dm->sessions, j);
3433                     if (ses->in_port)
3434                       vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses,
3435                                        &j);
3436                   }
3437               }
3438           }));
3439         }
3440     }
3441   else
3442     {
3443       if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
3444         {
3445           vlib_cli_output (vm, "%d static mappings",
3446                            pool_elts (sm->static_mappings));
3447
3448           if (verbose > 0)
3449             {
3450               pool_foreach (m, sm->static_mappings,
3451               ({
3452                 vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
3453               }));
3454             }
3455         }
3456       else
3457         {
3458           vec_foreach (tsm, sm->per_thread_data)
3459             {
3460               users_num += pool_elts (tsm->users);
3461               sessions_num += pool_elts (tsm->sessions);
3462             }
3463
3464           vlib_cli_output (vm, "%d users, %d outside addresses, %d active sessions,"
3465                            " %d static mappings, %d twice-nat addresses",
3466                            users_num,
3467                            vec_len (sm->addresses),
3468                            sessions_num,
3469                            pool_elts (sm->static_mappings),
3470                            vec_len (sm->twice_nat_addresses));
3471
3472           if (verbose > 0)
3473             {
3474               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->in2out_ed,
3475                                verbose - 1);
3476               vlib_cli_output (vm, "%U", format_bihash_16_8, &sm->out2in_ed,
3477                                verbose - 1);
3478               vec_foreach_index (j, sm->per_thread_data)
3479                 {
3480                   tsm = vec_elt_at_index (sm->per_thread_data, j);
3481
3482                   if (pool_elts (tsm->users) == 0)
3483                     continue;
3484
3485                   vlib_worker_thread_t *w = vlib_worker_threads + j;
3486                   vlib_cli_output (vm, "Thread %d (%s at lcore %u):", j, w->name,
3487                                    w->lcore_id);
3488                   vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->in2out,
3489                                    verbose - 1);
3490                   vlib_cli_output (vm, "  %U", format_bihash_8_8, &tsm->out2in,
3491                                    verbose - 1);
3492                   vlib_cli_output (vm, "  %d list pool elements",
3493                                    pool_elts (tsm->list_pool));
3494
3495                   pool_foreach (u, tsm->users,
3496                   ({
3497                     vlib_cli_output (vm, "  %U", format_snat_user, tsm, u,
3498                                      verbose - 1);
3499                   }));
3500                 }
3501
3502               if (pool_elts (sm->static_mappings))
3503                 {
3504                   vlib_cli_output (vm, "static mappings:");
3505                   pool_foreach (m, sm->static_mappings,
3506                   ({
3507                     vlib_cli_output (vm, "%U", format_snat_static_mapping, m);
3508                   }));
3509                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3510                     {
3511                       rp = sm->to_resolve + j;
3512                       vlib_cli_output (vm, "%U",
3513                                        format_snat_static_map_to_resolve, rp);
3514                     }
3515                 }
3516             }
3517         }
3518     }
3519
3520   return 0;
3521 }
3522
3523 VLIB_CLI_COMMAND (show_snat_command, static) = {
3524     .path = "show nat44",
3525     .short_help = "show nat44",
3526     .function = show_snat_command_fn,
3527 };
3528
3529
3530 static void
3531 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
3532                                        uword opaque,
3533                                        u32 sw_if_index,
3534                                        ip4_address_t * address,
3535                                        u32 address_length,
3536                                        u32 if_address_index,
3537                                        u32 is_delete)
3538 {
3539   snat_main_t *sm = &snat_main;
3540   snat_static_map_resolve_t *rp;
3541   u32 *indices_to_delete = 0;
3542   ip4_address_t l_addr;
3543   int i, j;
3544   int rv;
3545   u8 twice_nat = 0;
3546   snat_address_t *addresses = sm->addresses;
3547
3548   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
3549     {
3550       if (sw_if_index == sm->auto_add_sw_if_indices[i])
3551           goto match;
3552     }
3553
3554   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices_twice_nat); i++)
3555     {
3556       twice_nat = 1;
3557       addresses = sm->twice_nat_addresses;
3558       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
3559           goto match;
3560     }
3561
3562   return;
3563
3564 match:
3565   if (!is_delete)
3566     {
3567       /* Don't trip over lease renewal, static config */
3568       for (j = 0; j < vec_len(addresses); j++)
3569         if (addresses[j].addr.as_u32 == address->as_u32)
3570           return;
3571
3572       snat_add_address (sm, address, ~0, twice_nat);
3573       /* Scan static map resolution vector */
3574       for (j = 0; j < vec_len (sm->to_resolve); j++)
3575         {
3576           rp = sm->to_resolve + j;
3577           /* On this interface? */
3578           if (rp->sw_if_index == sw_if_index)
3579             {
3580               /* Indetity mapping? */
3581               if (rp->l_addr.as_u32 == 0)
3582                 l_addr.as_u32 = address[0].as_u32;
3583               else
3584                 l_addr.as_u32 = rp->l_addr.as_u32;
3585               /* Add the static mapping */
3586               rv = snat_add_static_mapping (l_addr,
3587                                             address[0],
3588                                             rp->l_port,
3589                                             rp->e_port,
3590                                             rp->vrf_id,
3591                                             rp->addr_only,
3592                                             ~0 /* sw_if_index */,
3593                                             rp->proto,
3594                                             rp->is_add,
3595                                             0, 0);
3596               if (rv)
3597                 clib_warning ("snat_add_static_mapping returned %d",
3598                               rv);
3599               vec_add1 (indices_to_delete, j);
3600             }
3601         }
3602       /* If we resolved any of the outstanding static mappings */
3603       if (vec_len(indices_to_delete))
3604         {
3605           /* Delete them */
3606           for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
3607             vec_delete(sm->to_resolve, 1, j);
3608           vec_free(indices_to_delete);
3609         }
3610       return;
3611     }
3612   else
3613     {
3614       (void) snat_del_address(sm, address[0], 1, twice_nat);
3615       return;
3616     }
3617 }
3618
3619
3620 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del,
3621                                 u8 twice_nat)
3622 {
3623   ip4_main_t * ip4_main = sm->ip4_main;
3624   ip4_address_t * first_int_addr;
3625   snat_static_map_resolve_t *rp;
3626   u32 *indices_to_delete = 0;
3627   int i, j;
3628   u32 *auto_add_sw_if_indices =
3629     twice_nat ? sm->auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3630
3631   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
3632                                                 0 /* just want the address*/);
3633
3634   for (i = 0; i < vec_len(auto_add_sw_if_indices); i++)
3635     {
3636       if (auto_add_sw_if_indices[i] == sw_if_index)
3637         {
3638           if (is_del)
3639             {
3640               /* if have address remove it */
3641               if (first_int_addr)
3642                   (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3643               else
3644                 {
3645                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3646                     {
3647                       rp = sm->to_resolve + j;
3648                       if (rp->sw_if_index == sw_if_index)
3649                         vec_add1 (indices_to_delete, j);
3650                     }
3651                   if (vec_len(indices_to_delete))
3652                     {
3653                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
3654                         vec_del1(sm->to_resolve, j);
3655                       vec_free(indices_to_delete);
3656                     }
3657                 }
3658               if (twice_nat)
3659                 vec_del1(sm->auto_add_sw_if_indices_twice_nat, i);
3660               else
3661                 vec_del1(sm->auto_add_sw_if_indices, i);
3662             }
3663           else
3664             return VNET_API_ERROR_VALUE_EXIST;
3665
3666           return 0;
3667         }
3668     }
3669
3670   if (is_del)
3671     return VNET_API_ERROR_NO_SUCH_ENTRY;
3672
3673   /* add to the auto-address list */
3674   if (twice_nat)
3675     vec_add1(sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3676   else
3677     vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
3678
3679   /* If the address is already bound - or static - add it now */
3680   if (first_int_addr)
3681       snat_add_address (sm, first_int_addr, ~0, twice_nat);
3682
3683   return 0;
3684 }
3685
3686 static clib_error_t *
3687 snat_add_interface_address_command_fn (vlib_main_t * vm,
3688                                        unformat_input_t * input,
3689                                        vlib_cli_command_t * cmd)
3690 {
3691   snat_main_t *sm = &snat_main;
3692   unformat_input_t _line_input, *line_input = &_line_input;
3693   u32 sw_if_index;
3694   int rv;
3695   int is_del = 0;
3696   clib_error_t *error = 0;
3697   u8 twice_nat = 0;
3698
3699   /* Get a line of input. */
3700   if (!unformat_user (input, unformat_line_input, line_input))
3701     return 0;
3702
3703   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3704     {
3705       if (unformat (line_input, "%U", unformat_vnet_sw_interface,
3706                     sm->vnet_main, &sw_if_index))
3707         ;
3708       else if (unformat (line_input, "twice-nat"))
3709         twice_nat = 1;
3710       else if (unformat (line_input, "del"))
3711         is_del = 1;
3712       else
3713         {
3714           error = clib_error_return (0, "unknown input '%U'",
3715                                      format_unformat_error, line_input);
3716           goto done;
3717         }
3718     }
3719
3720   rv = snat_add_interface_address (sm, sw_if_index, is_del, twice_nat);
3721
3722   switch (rv)
3723     {
3724     case 0:
3725       break;
3726
3727     default:
3728       error = clib_error_return (0, "snat_add_interface_address returned %d",
3729                                  rv);
3730       goto done;
3731     }
3732
3733 done:
3734   unformat_free (line_input);
3735
3736   return error;
3737 }
3738
3739 VLIB_CLI_COMMAND (snat_add_interface_address_command, static) = {
3740     .path = "nat44 add interface address",
3741     .short_help = "nat44 add interface address <interface> [twice-nat] [del]",
3742     .function = snat_add_interface_address_command_fn,
3743 };
3744
3745 int
3746 nat44_del_session (snat_main_t *sm, ip4_address_t *addr, u16 port,
3747                    snat_protocol_t proto, u32 vrf_id, int is_in)
3748 {
3749   snat_main_per_thread_data_t *tsm;
3750   clib_bihash_kv_8_8_t kv, value;
3751   ip4_header_t ip;
3752   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3753   snat_session_key_t key;
3754   snat_session_t *s;
3755   clib_bihash_8_8_t *t;
3756   snat_user_key_t u_key;
3757   snat_user_t *u;
3758
3759   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3760   if (sm->num_workers)
3761     tsm =
3762       vec_elt_at_index (sm->per_thread_data,
3763                         sm->worker_in2out_cb (&ip, fib_index));
3764   else
3765     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3766
3767   key.addr.as_u32 = addr->as_u32;
3768   key.port = clib_host_to_net_u16 (port);
3769   key.protocol = proto;
3770   key.fib_index = fib_index;
3771   kv.key = key.as_u64;
3772   t = is_in ? &tsm->in2out : &tsm->out2in;
3773   if (!clib_bihash_search_8_8 (t, &kv, &value))
3774     {
3775       s = pool_elt_at_index (tsm->sessions, value.value);
3776       kv.key = s->in2out.as_u64;
3777       clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0);
3778       kv.key = s->out2in.as_u64;
3779       clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0);
3780       u_key.addr = s->in2out.addr;
3781       u_key.fib_index = s->in2out.fib_index;
3782       kv.key = u_key.as_u64;
3783       if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
3784         {
3785           u = pool_elt_at_index (tsm->users, value.value);
3786           u->nsessions--;
3787         }
3788       clib_dlist_remove (tsm->list_pool, s->per_user_index);
3789       pool_put (tsm->sessions, s);
3790       return 0;
3791     }
3792
3793   return VNET_API_ERROR_NO_SUCH_ENTRY;
3794 }
3795
3796 static clib_error_t *
3797 nat44_del_session_command_fn (vlib_main_t * vm,
3798                               unformat_input_t * input,
3799                               vlib_cli_command_t * cmd)
3800 {
3801   snat_main_t *sm = &snat_main;
3802   unformat_input_t _line_input, *line_input = &_line_input;
3803   int is_in = 0;
3804   clib_error_t *error = 0;
3805   ip4_address_t addr;
3806   u32 port = 0, vrf_id = sm->outside_vrf_id;
3807   snat_protocol_t proto;
3808   int rv;
3809
3810   /* Get a line of input. */
3811   if (!unformat_user (input, unformat_line_input, line_input))
3812     return 0;
3813
3814   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3815     {
3816       if (unformat (line_input, "%U:%u %U", unformat_ip4_address, &addr, &port,
3817           unformat_snat_protocol, &proto))
3818         ;
3819       else if (unformat (line_input, "in"))
3820         {
3821           is_in = 1;
3822           vrf_id = sm->inside_vrf_id;
3823         }
3824       else if (unformat (line_input, "vrf %u", &vrf_id))
3825         ;
3826       else
3827         {
3828           error = clib_error_return (0, "unknown input '%U'",
3829                                      format_unformat_error, line_input);
3830           goto done;
3831         }
3832     }
3833
3834   rv = nat44_del_session(sm, &addr, port, proto, vrf_id, is_in);
3835
3836   switch (rv)
3837     {
3838     case 0:
3839       break;
3840
3841     default:
3842       error = clib_error_return (0, "nat44_del_session returned %d", rv);
3843       goto done;
3844     }
3845
3846 done:
3847   unformat_free (line_input);
3848
3849   return error;
3850 }
3851
3852 VLIB_CLI_COMMAND (nat44_del_session_command, static) = {
3853     .path = "nat44 del session",
3854     .short_help = "nat44 del session in|out <addr>:<port> tcp|udp|icmp [vrf <id>]",
3855     .function = nat44_del_session_command_fn,
3856 };
3857
3858 static clib_error_t *
3859 nat44_set_alloc_addr_and_port_alg_command_fn (vlib_main_t * vm,
3860                                               unformat_input_t * input,
3861                                               vlib_cli_command_t * cmd)
3862 {
3863   snat_main_t *sm = &snat_main;
3864   unformat_input_t _line_input, *line_input = &_line_input;
3865   clib_error_t *error = 0;
3866   u32 psid, psid_offset, psid_length;
3867
3868   /* Get a line of input. */
3869   if (!unformat_user (input, unformat_line_input, line_input))
3870     return 0;
3871
3872   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3873     {
3874       if (unformat (line_input, "default"))
3875         sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
3876       else if (unformat (line_input, "map-e psid %d psid-offset %d psid-len %d",
3877                &psid, &psid_offset, &psid_length))
3878         {
3879           sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
3880           sm->psid = (u16) psid;
3881           sm->psid_offset = (u16) psid_offset;
3882           sm->psid_length = (u16) psid_length;
3883         }
3884       else
3885         {
3886           error = clib_error_return (0, "unknown input '%U'",
3887                                      format_unformat_error, line_input);
3888           goto done;
3889         }
3890     }
3891
3892 done:
3893   unformat_free (line_input);
3894
3895   return error;
3896 };
3897
3898 VLIB_CLI_COMMAND (nat44_set_alloc_addr_and_port_alg_command, static) = {
3899     .path = "nat addr-port-assignment-alg",
3900     .short_help = "nat addr-port-assignment-alg <alg-name> [<alg-params>]",
3901     .function = nat44_set_alloc_addr_and_port_alg_command_fn,
3902 };
3903
3904 static clib_error_t *
3905 snat_det_map_command_fn (vlib_main_t * vm,
3906                          unformat_input_t * input,
3907                          vlib_cli_command_t * cmd)
3908 {
3909   snat_main_t *sm = &snat_main;
3910   unformat_input_t _line_input, *line_input = &_line_input;
3911   ip4_address_t in_addr, out_addr;
3912   u32 in_plen, out_plen;
3913   int is_add = 1, rv;
3914   clib_error_t *error = 0;
3915
3916   /* Get a line of input. */
3917   if (!unformat_user (input, unformat_line_input, line_input))
3918     return 0;
3919
3920   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3921     {
3922       if (unformat (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
3923         ;
3924       else if (unformat (line_input, "out %U/%u", unformat_ip4_address, &out_addr, &out_plen))
3925         ;
3926       else if (unformat (line_input, "del"))
3927         is_add = 0;
3928       else
3929         {
3930           error = clib_error_return (0, "unknown input '%U'",
3931                                      format_unformat_error, line_input);
3932           goto done;
3933         }
3934     }
3935
3936   rv = snat_det_add_map(sm, &in_addr, (u8) in_plen, &out_addr, (u8)out_plen,
3937                         is_add);
3938
3939   if (rv)
3940     {
3941       error = clib_error_return (0, "snat_det_add_map return %d", rv);
3942       goto done;
3943     }
3944
3945 done:
3946   unformat_free (line_input);
3947
3948   return error;
3949 }
3950
3951 /*?
3952  * @cliexpar
3953  * @cliexstart{snat deterministic add}
3954  * Create bijective mapping of inside address to outside address and port range
3955  * pairs, with the purpose of enabling deterministic NAT to reduce logging in
3956  * CGN deployments.
3957  * To create deterministic mapping between inside network 10.0.0.0/18 and
3958  * outside network 1.1.1.0/30 use:
3959  * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30
3960  * @cliexend
3961 ?*/
3962 VLIB_CLI_COMMAND (snat_det_map_command, static) = {
3963     .path = "nat44 deterministic add",
3964     .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
3965     .function = snat_det_map_command_fn,
3966 };
3967
3968 static clib_error_t *
3969 snat_det_forward_command_fn (vlib_main_t * vm,
3970                              unformat_input_t * input,
3971                              vlib_cli_command_t * cmd)
3972 {
3973   snat_main_t *sm = &snat_main;
3974   unformat_input_t _line_input, *line_input = &_line_input;
3975   ip4_address_t in_addr, out_addr;
3976   u16 lo_port;
3977   snat_det_map_t * dm;
3978   clib_error_t *error = 0;
3979
3980   /* Get a line of input. */
3981   if (!unformat_user (input, unformat_line_input, line_input))
3982     return 0;
3983
3984   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
3985     {
3986       if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
3987         ;
3988       else
3989         {
3990           error = clib_error_return (0, "unknown input '%U'",
3991                                      format_unformat_error, line_input);
3992           goto done;
3993         }
3994     }
3995
3996   dm = snat_det_map_by_user(sm, &in_addr);
3997   if (!dm)
3998     vlib_cli_output (vm, "no match");
3999   else
4000     {
4001       snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
4002       vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
4003                        lo_port, lo_port + dm->ports_per_host - 1);
4004     }
4005
4006 done:
4007   unformat_free (line_input);
4008
4009   return error;
4010 }
4011
4012 /*?
4013  * @cliexpar
4014  * @cliexstart{snat deterministic forward}
4015  * Return outside address and port range from inside address for deterministic
4016  * NAT.
4017  * To obtain outside address and port of inside host use:
4018  *  vpp# nat44 deterministic forward 10.0.0.2
4019  *  1.1.1.0:<1054-1068>
4020  * @cliexend
4021 ?*/
4022 VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
4023     .path = "nat44 deterministic forward",
4024     .short_help = "nat44 deterministic forward <addr>",
4025     .function = snat_det_forward_command_fn,
4026 };
4027
4028 static clib_error_t *
4029 snat_det_reverse_command_fn (vlib_main_t * vm,
4030                              unformat_input_t * input,
4031                              vlib_cli_command_t * cmd)
4032 {
4033   snat_main_t *sm = &snat_main;
4034   unformat_input_t _line_input, *line_input = &_line_input;
4035   ip4_address_t in_addr, out_addr;
4036   u32 out_port;
4037   snat_det_map_t * dm;
4038   clib_error_t *error = 0;
4039
4040   /* Get a line of input. */
4041   if (!unformat_user (input, unformat_line_input, line_input))
4042     return 0;
4043
4044   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
4045     {
4046       if (unformat (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
4047         ;
4048       else
4049         {
4050           error =  clib_error_return (0, "unknown input '%U'",
4051                                       format_unformat_error, line_input);
4052           goto done;
4053         }
4054     }
4055
4056   if (out_port < 1024 || out_port > 65535)
4057     {
4058       error = clib_error_return (0, "wrong port, must be <1024-65535>");
4059       goto done;
4060     }
4061
4062   dm = snat_det_map_by_out(sm, &out_addr);
4063   if (!dm)
4064     vlib_cli_output (vm, "no match");
4065   else
4066     {
4067       snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
4068       vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
4069     }
4070
4071 done:
4072   unformat_free (line_input);
4073
4074   return error;
4075 }
4076
4077 /*?
4078  * @cliexpar
4079  * @cliexstart{snat deterministic reverse}
4080  * Return inside address from outside address and port for deterministic NAT.
4081  * To obtain inside host address from outside address and port use:
4082  *  #vpp nat44 deterministic reverse 1.1.1.1:1276
4083  *  10.0.16.16
4084  * @cliexend
4085 ?*/
4086 VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
4087     .path = "nat44 deterministic reverse",
4088     .short_help = "nat44 deterministic reverse <addr>:<port>",
4089     .function = snat_det_reverse_command_fn,
4090 };
4091
4092 static clib_error_t *
4093 set_timeout_command_fn (vlib_main_t * vm,
4094                         unformat_input_t * input,
4095                         vlib_cli_command_t * cmd)
4096 {
4097   snat_main_t *sm = &snat_main;
4098   unformat_input_t _line_input, *line_input = &_line_input;
4099   clib_error_t *error = 0;
4100
4101   /* Get a line of input. */
4102   if (!unformat_user (input, unformat_line_input, line_input))
4103     return 0;
4104
4105   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
4106     {
4107       if (unformat (line_input, "udp %u", &sm->udp_timeout))
4108         ;
4109       else if (unformat (line_input, "tcp-established %u",
4110                &sm->tcp_established_timeout))
4111         ;
4112       else if (unformat (line_input, "tcp-transitory %u",
4113                &sm->tcp_transitory_timeout))
4114         ;
4115       else if (unformat (line_input, "icmp %u", &sm->icmp_timeout))
4116         ;
4117       else if (unformat (line_input, "reset"))
4118         {
4119           sm->udp_timeout = SNAT_UDP_TIMEOUT;
4120           sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
4121           sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
4122           sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
4123         }
4124       else
4125         {
4126           error = clib_error_return (0, "unknown input '%U'",
4127                                      format_unformat_error, line_input);
4128           goto done;
4129         }
4130     }
4131
4132 done:
4133   unformat_free (line_input);
4134
4135   return error;
4136 }
4137
4138 /*?
4139  * @cliexpar
4140  * @cliexstart{set snat deterministic timeout}
4141  * Set values of timeouts for deterministic NAT (in seconds), use:
4142  *  vpp# set nat44 deterministic timeout udp 120 tcp-established 7500
4143  *  tcp-transitory 250 icmp 90
4144  * To reset default values use:
4145  *  vpp# set nat44 deterministic timeout reset
4146  * @cliexend
4147 ?*/
4148 VLIB_CLI_COMMAND (set_timeout_command, static) = {
4149   .path = "set nat44 deterministic timeout",
4150   .function = set_timeout_command_fn,
4151   .short_help =
4152     "set nat44 deterministic timeout [udp <sec> | tcp-established <sec> "
4153     "tcp-transitory <sec> | icmp <sec> | reset]",
4154 };
4155
4156 static clib_error_t *
4157 snat_det_close_session_out_fn (vlib_main_t *vm,
4158                                unformat_input_t * input,
4159                                vlib_cli_command_t * cmd)
4160 {
4161   snat_main_t *sm = &snat_main;
4162   unformat_input_t _line_input, *line_input = &_line_input;
4163   ip4_address_t out_addr, ext_addr, in_addr;
4164   u32 out_port, ext_port;
4165   snat_det_map_t * dm;
4166   snat_det_session_t * ses;
4167   snat_det_out_key_t key;
4168   clib_error_t *error = 0;
4169
4170   /* Get a line of input. */
4171   if (!unformat_user (input, unformat_line_input, line_input))
4172     return 0;
4173
4174   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
4175     {
4176       if (unformat (line_input, "%U:%d %U:%d",
4177                     unformat_ip4_address, &out_addr, &out_port,
4178                     unformat_ip4_address, &ext_addr, &ext_port))
4179         ;
4180       else
4181         {
4182           error = clib_error_return (0, "unknown input '%U'",
4183                                      format_unformat_error, line_input);
4184           goto done;
4185         }
4186     }
4187
4188   unformat_free (line_input);
4189
4190   dm = snat_det_map_by_out(sm, &out_addr);
4191   if (!dm)
4192     vlib_cli_output (vm, "no match");
4193   else
4194     {
4195       snat_det_reverse(dm, &ext_addr, (u16)out_port, &in_addr);
4196       key.ext_host_addr = out_addr;
4197       key.ext_host_port = ntohs((u16)ext_port);
4198       key.out_port = ntohs((u16)out_port);
4199       ses = snat_det_get_ses_by_out(dm, &out_addr, key.as_u64);
4200       if (!ses)
4201         vlib_cli_output (vm, "no match");
4202       else
4203        snat_det_ses_close(dm, ses);
4204     }
4205
4206 done:
4207   unformat_free (line_input);
4208
4209   return error;
4210 }
4211
4212 /*?
4213  * @cliexpar
4214  * @cliexstart{snat deterministic close session out}
4215  * Close session using outside ip address and port
4216  * and external ip address and port, use:
4217  *  vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
4218  * @cliexend
4219 ?*/
4220 VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
4221   .path = "nat44 deterministic close session out",
4222   .short_help = "nat44 deterministic close session out "
4223                 "<out_addr>:<out_port> <ext_addr>:<ext_port>",
4224   .function = snat_det_close_session_out_fn,
4225 };
4226
4227 static clib_error_t *
4228 snat_det_close_session_in_fn (vlib_main_t *vm,
4229                               unformat_input_t * input,
4230                               vlib_cli_command_t * cmd)
4231 {
4232   snat_main_t *sm = &snat_main;
4233   unformat_input_t _line_input, *line_input = &_line_input;
4234   ip4_address_t in_addr, ext_addr;
4235   u32 in_port, ext_port;
4236   snat_det_map_t * dm;
4237   snat_det_session_t * ses;
4238   snat_det_out_key_t key;
4239   clib_error_t *error = 0;
4240
4241   /* Get a line of input. */
4242   if (!unformat_user (input, unformat_line_input, line_input))
4243     return 0;
4244
4245   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
4246     {
4247       if (unformat (line_input, "%U:%d %U:%d",
4248                     unformat_ip4_address, &in_addr, &in_port,
4249                     unformat_ip4_address, &ext_addr, &ext_port))
4250         ;
4251       else
4252         {
4253           error = clib_error_return (0, "unknown input '%U'",
4254                                      format_unformat_error, line_input);
4255           goto done;
4256         }
4257     }
4258
4259   unformat_free (line_input);
4260
4261   dm = snat_det_map_by_user (sm, &in_addr);
4262   if (!dm)
4263     vlib_cli_output (vm, "no match");
4264   else
4265     {
4266       key.ext_host_addr = ext_addr;
4267       key.ext_host_port = ntohs ((u16)ext_port);
4268       ses = snat_det_find_ses_by_in (dm, &in_addr, ntohs((u16)in_port), key);
4269       if (!ses)
4270         vlib_cli_output (vm, "no match");
4271       else
4272         snat_det_ses_close(dm, ses);
4273     }
4274
4275 done:
4276   unformat_free(line_input);
4277
4278   return error;
4279 }
4280
4281 /*?
4282  * @cliexpar
4283  * @cliexstart{snat deterministic close_session_in}
4284  * Close session using inside ip address and port
4285  * and external ip address and port, use:
4286  *  vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
4287  * @cliexend
4288 ?*/
4289 VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
4290   .path = "nat44 deterministic close session in",
4291   .short_help = "nat44 deterministic close session in "
4292                 "<in_addr>:<in_port> <ext_addr>:<ext_port>",
4293   .function = snat_det_close_session_in_fn,
4294 };
4295
4296 static clib_error_t *
4297 snat_forwarding_set_command_fn (vlib_main_t *vm,
4298                                 unformat_input_t * input,
4299                                 vlib_cli_command_t * cmd)
4300 {
4301   snat_main_t *sm = &snat_main;
4302   unformat_input_t _line_input, *line_input = &_line_input;
4303   u8 forwarding_enable;
4304   u8 forwarding_enable_set = 0;
4305   clib_error_t *error = 0;
4306
4307   /* Get a line of input. */
4308   if (!unformat_user (input, unformat_line_input, line_input))
4309       return clib_error_return (0, "'enable' or 'disable' expected");
4310
4311   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
4312     {
4313       if (!forwarding_enable_set && unformat (line_input, "enable"))
4314         {
4315           forwarding_enable = 1;
4316           forwarding_enable_set = 1;
4317         }
4318       else if (!forwarding_enable_set && unformat (line_input, "disable"))
4319         {
4320           forwarding_enable = 0;
4321           forwarding_enable_set = 1;
4322         }
4323       else
4324         {
4325           error = clib_error_return (0, "unknown input '%U'",
4326                                      format_unformat_error, line_input);
4327           goto done;
4328         }
4329     }
4330
4331   if (!forwarding_enable_set)
4332     {
4333       error = clib_error_return (0, "'enable' or 'disable' expected");
4334       goto done;
4335     }
4336
4337   sm->forwarding_enabled = forwarding_enable;
4338
4339 done:
4340   unformat_free(line_input);
4341
4342   return error;
4343 }
4344
4345 /*?
4346  * @cliexpar
4347  * @cliexstart{nat44 forwarding}
4348  * Enable or disable forwarding
4349  * Forward packets which don't match existing translation
4350  * or static mapping instead of dropping them.
4351  * To enable forwarding, use:
4352  *  vpp# nat44 forwarding enable
4353  * To disable forwarding, use:
4354  *  vpp# nat44 forwarding disable
4355  * @cliexend
4356 ?*/
4357 VLIB_CLI_COMMAND (snat_forwarding_set_command, static) = {
4358   .path = "nat44 forwarding",
4359   .short_help = "nat44 forwarding enable|disable",
4360   .function = snat_forwarding_set_command_fn,
4361 };