src/plugins/nat/nat.c

   1 /*
   2  * snat.c - simple nat plugin
   3  *
   4  * Copyright (c) 2016 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/ip/ip.h>
  20 #include <vnet/ip/ip4.h>
  21 #include <vnet/plugin/plugin.h>
  22 #include <nat/nat.h>
  23 #include <nat/nat_dpo.h>
  24 #include <nat/nat_ipfix_logging.h>
  25 #include <nat/nat_det.h>
  26 #include <nat/nat64.h>
  27 #include <nat/nat66.h>
  28 #include <nat/dslite.h>
  29 #include <nat/nat_reass.h>
  30 #include <nat/nat_inlines.h>
  31 #include <nat/nat_affinity.h>
  32 #include <vnet/fib/fib_table.h>
  33 #include <vnet/fib/ip4_fib.h>
  34
  35 #include <vpp/app/version.h>
  36
  37 snat_main_t snat_main;
  38
  39
  40 /* Hook up input features */
  41 VNET_FEATURE_INIT (ip4_snat_in2out, static) = {
  42   .arc_name = "ip4-unicast",
  43   .node_name = "nat44-in2out",
  44   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  45 };
  46 VNET_FEATURE_INIT (ip4_snat_out2in, static) = {
  47   .arc_name = "ip4-unicast",
  48   .node_name = "nat44-out2in",
  49   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  50                                "ip4-dhcp-client-detect"),
  51 };
  52 VNET_FEATURE_INIT (ip4_nat_classify, static) = {
  53   .arc_name = "ip4-unicast",
  54   .node_name = "nat44-classify",
  55   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  56 };
  57 VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
  58   .arc_name = "ip4-unicast",
  59   .node_name = "nat44-det-in2out",
  60   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  61 };
  62 VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
  63   .arc_name = "ip4-unicast",
  64   .node_name = "nat44-det-out2in",
  65   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  66                                "ip4-dhcp-client-detect"),
  67 };
  68 VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
  69   .arc_name = "ip4-unicast",
  70   .node_name = "nat44-det-classify",
  71   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  72 };
  73 VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = {
  74   .arc_name = "ip4-unicast",
  75   .node_name = "nat44-ed-in2out",
  76   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  77 };
  78 VNET_FEATURE_INIT (ip4_nat44_ed_out2in, static) = {
  79   .arc_name = "ip4-unicast",
  80   .node_name = "nat44-ed-out2in",
  81   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  82                                "ip4-dhcp-client-detect"),
  83 };
  84 VNET_FEATURE_INIT (ip4_nat44_ed_classify, static) = {
  85   .arc_name = "ip4-unicast",
  86   .node_name = "nat44-ed-classify",
  87   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  88 };
  89 VNET_FEATURE_INIT (ip4_snat_in2out_worker_handoff, static) = {
  90   .arc_name = "ip4-unicast",
  91   .node_name = "nat44-in2out-worker-handoff",
  92   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
  93 };
  94 VNET_FEATURE_INIT (ip4_snat_out2in_worker_handoff, static) = {
  95   .arc_name = "ip4-unicast",
  96   .node_name = "nat44-out2in-worker-handoff",
  97   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
  98                                "ip4-dhcp-client-detect"),
  99 };
 100 VNET_FEATURE_INIT (ip4_nat_handoff_classify, static) = {
 101   .arc_name = "ip4-unicast",
 102   .node_name = "nat44-handoff-classify",
 103   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 104 };
 105 VNET_FEATURE_INIT (ip4_snat_in2out_fast, static) = {
 106   .arc_name = "ip4-unicast",
 107   .node_name = "nat44-in2out-fast",
 108   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 109 };
 110 VNET_FEATURE_INIT (ip4_snat_out2in_fast, static) = {
 111   .arc_name = "ip4-unicast",
 112   .node_name = "nat44-out2in-fast",
 113   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
 114                                "ip4-dhcp-client-detect"),
 115 };
 116 VNET_FEATURE_INIT (ip4_snat_hairpin_dst, static) = {
 117   .arc_name = "ip4-unicast",
 118   .node_name = "nat44-hairpin-dst",
 119   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 120 };
 121 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_dst, static) = {
 122   .arc_name = "ip4-unicast",
 123   .node_name = "nat44-ed-hairpin-dst",
 124   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
 125 };
 126
 127 /* Hook up output features */
 128 VNET_FEATURE_INIT (ip4_snat_in2out_output, static) = {
 129   .arc_name = "ip4-output",
 130   .node_name = "nat44-in2out-output",
 131   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 132 };
 133 VNET_FEATURE_INIT (ip4_snat_in2out_output_worker_handoff, static) = {
 134   .arc_name = "ip4-output",
 135   .node_name = "nat44-in2out-output-worker-handoff",
 136   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 137 };
 138 VNET_FEATURE_INIT (ip4_snat_hairpin_src, static) = {
 139   .arc_name = "ip4-output",
 140   .node_name = "nat44-hairpin-src",
 141   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 142 };
 143 VNET_FEATURE_INIT (ip4_nat44_ed_in2out_output, static) = {
 144   .arc_name = "ip4-output",
 145   .node_name = "nat44-ed-in2out-output",
 146   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 147 };
 148 VNET_FEATURE_INIT (ip4_nat44_ed_hairpin_src, static) = {
 149   .arc_name = "ip4-output",
 150   .node_name = "nat44-ed-hairpin-src",
 151   .runs_after = VNET_FEATURES ("acl-plugin-out-ip4-fa"),
 152 };
 153
 154 /* Hook up ip4-local features */
 155 VNET_FEATURE_INIT (ip4_nat_hairpinning, static) =
 156 {
 157   .arc_name = "ip4-local",
 158   .node_name = "nat44-hairpinning",
 159   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 160 };
 161 VNET_FEATURE_INIT (ip4_nat44_ed_hairpinning, static) =
 162 {
 163   .arc_name = "ip4-local",
 164   .node_name = "nat44-ed-hairpinning",
 165   .runs_before = VNET_FEATURES("ip4-local-end-of-arc"),
 166 };
 167
 168
 169 /* *INDENT-OFF* */
 170 VLIB_PLUGIN_REGISTER () = {
 171     .version = VPP_BUILD_VER,
 172     .description = "Network Address Translation",
 173 };
 174 /* *INDENT-ON* */
 175
 176 vlib_node_registration_t nat44_classify_node;
 177 vlib_node_registration_t nat44_ed_classify_node;
 178 vlib_node_registration_t nat44_det_classify_node;
 179 vlib_node_registration_t nat44_handoff_classify_node;
 180
 181 #define foreach_nat44_classify_error                      \
 182 _(MAX_REASS, "Maximum reassemblies exceeded")             \
 183 _(MAX_FRAG, "Maximum fragments per reassembly exceeded")
 184
 185 typedef enum {
 186 #define _(sym,str) NAT44_CLASSIFY_ERROR_##sym,
 187   foreach_nat44_classify_error
 188 #undef _
 189   NAT44_CLASSIFY_N_ERROR,
 190 } nat44_classify_error_t;
 191
 192 static char * nat44_classify_error_strings[] = {
 193 #define _(sym,string) string,
 194   foreach_nat44_classify_error
 195 #undef _
 196 };
 197
 198 typedef enum {
 199   NAT44_CLASSIFY_NEXT_IN2OUT,
 200   NAT44_CLASSIFY_NEXT_OUT2IN,
 201   NAT44_CLASSIFY_NEXT_DROP,
 202   NAT44_CLASSIFY_N_NEXT,
 203 } nat44_classify_next_t;
 204
 205 void
 206 nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index)
 207 {
 208   snat_session_key_t key;
 209   clib_bihash_kv_8_8_t kv;
 210   nat_ed_ses_key_t ed_key;
 211   clib_bihash_kv_16_8_t ed_kv;
 212   snat_main_per_thread_data_t *tsm =
 213     vec_elt_at_index (sm->per_thread_data, thread_index);
 214
 215   if (is_fwd_bypass_session (s))
 216     {
 217       ed_key.l_addr = s->in2out.addr;
 218       ed_key.r_addr = s->ext_host_addr;
 219       ed_key.l_port = s->in2out.port;
 220       ed_key.r_port = s->ext_host_port;
 221       ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 222       ed_key.fib_index = 0;
 223       ed_kv.key[0] = ed_key.as_u64[0];
 224       ed_kv.key[1] = ed_key.as_u64[1];
 225       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 226         nat_log_warn ("in2out_ed key del failed");
 227       return;
 228     }
 229
 230   /* session lookup tables */
 231   if (is_ed_session (s))
 232     {
 233       if (is_affinity_sessions (s))
 234         nat_affinity_unlock (s->ext_host_addr, s->out2in.addr,
 235                              s->in2out.protocol, s->out2in.port);
 236       ed_key.l_addr = s->out2in.addr;
 237       ed_key.r_addr = s->ext_host_addr;
 238       ed_key.fib_index = s->out2in.fib_index;
 239       if (snat_is_unk_proto_session (s))
 240         {
 241           ed_key.proto = s->in2out.port;
 242           ed_key.r_port = 0;
 243           ed_key.l_port = 0;
 244         }
 245       else
 246         {
 247           ed_key.proto = snat_proto_to_ip_proto (s->in2out.protocol);
 248           ed_key.l_port = s->out2in.port;
 249           ed_key.r_port = s->ext_host_port;
 250         }
 251       ed_kv.key[0] = ed_key.as_u64[0];
 252       ed_kv.key[1] = ed_key.as_u64[1];
 253       if (clib_bihash_add_del_16_8 (&tsm->out2in_ed, &ed_kv, 0))
 254         nat_log_warn ("out2in_ed key del failed");
 255       ed_key.l_addr = s->in2out.addr;
 256       ed_key.fib_index = s->in2out.fib_index;
 257       if (!snat_is_unk_proto_session (s))
 258         ed_key.l_port = s->in2out.port;
 259       if (is_twice_nat_session (s))
 260         {
 261           ed_key.r_addr = s->ext_host_nat_addr;
 262           ed_key.r_port = s->ext_host_nat_port;
 263         }
 264       ed_kv.key[0] = ed_key.as_u64[0];
 265       ed_kv.key[1] = ed_key.as_u64[1];
 266       if (clib_bihash_add_del_16_8 (&tsm->in2out_ed, &ed_kv, 0))
 267         nat_log_warn ("in2out_ed key del failed");
 268     }
 269   else
 270     {
 271       kv.key = s->in2out.as_u64;
 272       if (clib_bihash_add_del_8_8 (&tsm->in2out, &kv, 0))
 273         nat_log_warn ("in2out key del failed");
 274       kv.key = s->out2in.as_u64;
 275       if (clib_bihash_add_del_8_8 (&tsm->out2in, &kv, 0))
 276         nat_log_warn ("out2in key del failed");
 277     }
 278
 279   if (snat_is_unk_proto_session (s))
 280     return;
 281
 282   /* log NAT event */
 283   snat_ipfix_logging_nat44_ses_delete(s->in2out.addr.as_u32,
 284                                       s->out2in.addr.as_u32,
 285                                       s->in2out.protocol,
 286                                       s->in2out.port,
 287                                       s->out2in.port,
 288                                       s->in2out.fib_index);
 289
 290   /* Twice NAT address and port for external host */
 291   if (is_twice_nat_session (s))
 292     {
 293       key.protocol = s->in2out.protocol;
 294       key.port = s->ext_host_nat_port;
 295       key.addr.as_u32 = s->ext_host_nat_addr.as_u32;
 296       snat_free_outside_address_and_port (sm->twice_nat_addresses,
 297                                           thread_index, &key);
 298     }
 299
 300   if (snat_is_session_static (s))
 301     return;
 302
 303   if (s->outside_address_index != ~0)
 304     snat_free_outside_address_and_port (sm->addresses, thread_index,
 305                                         &s->out2in);
 306 }
 307
 308 snat_user_t *
 309 nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, u32 fib_index,
 310                         u32 thread_index)
 311 {
 312   snat_user_t *u = 0;
 313   snat_user_key_t user_key;
 314   clib_bihash_kv_8_8_t kv, value;
 315   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 316   dlist_elt_t * per_user_list_head_elt;
 317
 318   user_key.addr.as_u32 = addr->as_u32;
 319   user_key.fib_index = fib_index;
 320   kv.key = user_key.as_u64;
 321
 322   /* Ever heard of the "user" = src ip4 address before? */
 323   if (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
 324     {
 325       /* no, make a new one */
 326       pool_get (tsm->users, u);
 327       memset (u, 0, sizeof (*u));
 328       u->addr.as_u32 = addr->as_u32;
 329       u->fib_index = fib_index;
 330
 331       pool_get (tsm->list_pool, per_user_list_head_elt);
 332
 333       u->sessions_per_user_list_head_index = per_user_list_head_elt -
 334         tsm->list_pool;
 335
 336       clib_dlist_init (tsm->list_pool, u->sessions_per_user_list_head_index);
 337
 338       kv.value = u - tsm->users;
 339
 340       /* add user */
 341       if (clib_bihash_add_del_8_8 (&tsm->user_hash, &kv, 1))
 342         nat_log_warn ("user_hash keay add failed");
 343     }
 344   else
 345     {
 346       u = pool_elt_at_index (tsm->users, value.value);
 347     }
 348
 349   return u;
 350 }
 351
 352 snat_session_t *
 353 nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, u32 thread_index)
 354 {
 355   snat_session_t *s;
 356   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 357   u32 oldest_per_user_translation_list_index, session_index;
 358   dlist_elt_t * oldest_per_user_translation_list_elt;
 359   dlist_elt_t * per_user_translation_list_elt;
 360
 361   /* Over quota? Recycle the least recently used translation */
 362   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 363     {
 364       oldest_per_user_translation_list_index =
 365         clib_dlist_remove_head (tsm->list_pool,
 366                                 u->sessions_per_user_list_head_index);
 367
 368       ASSERT (oldest_per_user_translation_list_index != ~0);
 369
 370       /* Add it back to the end of the LRU list */
 371       clib_dlist_addtail (tsm->list_pool,
 372                           u->sessions_per_user_list_head_index,
 373                           oldest_per_user_translation_list_index);
 374       /* Get the list element */
 375       oldest_per_user_translation_list_elt =
 376         pool_elt_at_index (tsm->list_pool,
 377                            oldest_per_user_translation_list_index);
 378
 379       /* Get the session index from the list element */
 380       session_index = oldest_per_user_translation_list_elt->value;
 381
 382       /* Get the session */
 383       s = pool_elt_at_index (tsm->sessions, session_index);
 384       nat_free_session_data (sm, s, thread_index);
 385       if (snat_is_session_static(s))
 386         u->nstaticsessions--;
 387       else
 388         u->nsessions--;
 389       s->outside_address_index = ~0;
 390       s->flags = 0;
 391       s->total_bytes = 0;
 392       s->total_pkts = 0;
 393       s->state = 0;
 394       s->ext_host_addr.as_u32 = 0;
 395       s->ext_host_port = 0;
 396       s->ext_host_nat_addr.as_u32 = 0;
 397       s->ext_host_nat_port = 0;
 398     }
 399   else
 400     {
 401       pool_get (tsm->sessions, s);
 402       memset (s, 0, sizeof (*s));
 403       s->outside_address_index = ~0;
 404
 405       /* Create list elts */
 406       pool_get (tsm->list_pool, per_user_translation_list_elt);
 407       clib_dlist_init (tsm->list_pool,
 408                        per_user_translation_list_elt - tsm->list_pool);
 409
 410       per_user_translation_list_elt->value = s - tsm->sessions;
 411       s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 412       s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 413
 414       clib_dlist_addtail (tsm->list_pool,
 415                           s->per_user_list_head_index,
 416                           per_user_translation_list_elt - tsm->list_pool);
 417     }
 418
 419   return s;
 420 }
 421
 422 snat_session_t *
 423 nat_ed_session_alloc (snat_main_t *sm, snat_user_t *u, u32 thread_index)
 424 {
 425   snat_session_t *s;
 426   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 427   dlist_elt_t * per_user_translation_list_elt;
 428
 429   if ((u->nsessions + u->nstaticsessions) >= sm->max_translations_per_user)
 430     {
 431       nat_log_warn ("max translations per user %U", format_ip4_address, &u->addr);
 432       snat_ipfix_logging_max_entries_per_user (sm->max_translations_per_user,
 433                                                u->addr.as_u32);
 434       return 0;
 435     }
 436
 437   pool_get (tsm->sessions, s);
 438   memset (s, 0, sizeof (*s));
 439   s->outside_address_index = ~0;
 440
 441   /* Create list elts */
 442   pool_get (tsm->list_pool, per_user_translation_list_elt);
 443   clib_dlist_init (tsm->list_pool,
 444                    per_user_translation_list_elt - tsm->list_pool);
 445
 446   per_user_translation_list_elt->value = s - tsm->sessions;
 447   s->per_user_index = per_user_translation_list_elt - tsm->list_pool;
 448   s->per_user_list_head_index = u->sessions_per_user_list_head_index;
 449
 450   clib_dlist_addtail (tsm->list_pool,
 451                       s->per_user_list_head_index,
 452                       per_user_translation_list_elt - tsm->list_pool);
 453
 454   return s;
 455 }
 456
 457 typedef struct {
 458   u8 next_in2out;
 459   u8 cached;
 460 } nat44_classify_trace_t;
 461
 462 static u8 * format_nat44_classify_trace (u8 * s, va_list * args)
 463 {
 464   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
 465   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
 466   nat44_classify_trace_t *t = va_arg (*args, nat44_classify_trace_t *);
 467   char *next;
 468
 469   if (t->cached)
 470     s = format (s, "nat44-classify: fragment cached");
 471   else
 472     {
 473       next = t->next_in2out ? "nat44-in2out" : "nat44-out2in";
 474       s = format (s, "nat44-classify: next %s", next);
 475     }
 476
 477   return s;
 478 }
 479
 480 static inline uword
 481 nat44_classify_node_fn_inline (vlib_main_t * vm,
 482                                vlib_node_runtime_t * node,
 483                                vlib_frame_t * frame,
 484                                int is_ed)
 485 {
 486   u32 n_left_from, * from, * to_next;
 487   nat44_classify_next_t next_index;
 488   snat_main_t *sm = &snat_main;
 489   snat_static_mapping_t *m;
 490   u32 thread_index = vm->thread_index;
 491   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 492   u32 *fragments_to_drop = 0;
 493   u32 *fragments_to_loopback = 0;
 494
 495   from = vlib_frame_vector_args (frame);
 496   n_left_from = frame->n_vectors;
 497   next_index = node->cached_next_index;
 498
 499   while (n_left_from > 0)
 500     {
 501       u32 n_left_to_next;
 502
 503       vlib_get_next_frame (vm, node, next_index,
 504                            to_next, n_left_to_next);
 505
 506       while (n_left_from > 0 && n_left_to_next > 0)
 507         {
 508           u32 bi0;
 509           vlib_buffer_t *b0;
 510           u32 next0 = NAT44_CLASSIFY_NEXT_IN2OUT, sw_if_index0, rx_fib_index0;
 511           ip4_header_t *ip0;
 512           snat_address_t *ap;
 513           snat_session_key_t m_key0;
 514           clib_bihash_kv_8_8_t kv0, value0;
 515           clib_bihash_kv_16_8_t ed_kv0, ed_value0;
 516           udp_header_t *udp0;
 517           nat_reass_ip4_t *reass0;
 518           u8 cached0 = 0;
 519
 520           /* speculatively enqueue b0 to the current next frame */
 521           bi0 = from[0];
 522           to_next[0] = bi0;
 523           from += 1;
 524           to_next += 1;
 525           n_left_from -= 1;
 526           n_left_to_next -= 1;
 527
 528           b0 = vlib_get_buffer (vm, bi0);
 529           ip0 = vlib_buffer_get_current (b0);
 530           udp0 = ip4_next_header (ip0);
 531
 532           if (is_ed && ip0->protocol != IP_PROTOCOL_ICMP)
 533             {
 534               if (!ip4_is_fragment (ip0) || ip4_is_first_fragment (ip0))
 535                 {
 536                   /* process leading fragment/whole packet (with L4 header) */
 537                   sw_if_index0 = vnet_buffer(b0)->sw_if_index[VLIB_RX];
 538                   rx_fib_index0 =
 539                     fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
 540                                                          sw_if_index0);
 541                   make_ed_kv (&ed_kv0, &ip0->src_address, &ip0->dst_address,
 542                               ip0->protocol, rx_fib_index0, udp0->src_port,
 543                               udp0->dst_port);
 544                   if (ip4_is_fragment (ip0))
 545                     {
 546                       reass0 = nat_ip4_reass_find_or_create (ip0->src_address,
 547                                                              ip0->dst_address,
 548                                                              ip0->fragment_id,
 549                                                              ip0->protocol,
 550                                                              1,
 551                                                              &fragments_to_drop);
 552                       if (PREDICT_FALSE (!reass0))
 553                         {
 554                           next0 = NAT44_CLASSIFY_NEXT_DROP;
 555                           b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS];
 556                           nat_log_notice ("maximum reassemblies exceeded");
 557                           goto enqueue0;
 558                         }
 559                       if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &ed_kv0,
 560                                                     &ed_value0))
 561                         {
 562                           /* session exists so classify as IN2OUT,
 563                            * save this information for future fragments and set
 564                            * past fragments to be looped over and reprocessed */
 565                           reass0->sess_index = ed_value0.value;
 566                           reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT;
 567                           nat_ip4_reass_get_frags (reass0,
 568                                                    &fragments_to_loopback);
 569                           goto enqueue0;
 570                         }
 571                       else
 572                         {
 573                           /* session doesn't exist so continue in the code,
 574                            * save this information for future fragments and set
 575                            * past fragments to be looped over and reprocessed */
 576                           reass0->flags |= NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE;
 577                           nat_ip4_reass_get_frags (reass0,
 578                                                    &fragments_to_loopback);
 579                         }
 580                     }
 581                   else
 582                     {
 583                       /* process whole packet */
 584                       if (!clib_bihash_search_16_8 (&tsm->in2out_ed, &ed_kv0,
 585                                                     &ed_value0))
 586                         goto enqueue0;
 587                       /* session doesn't exist so continue in code */
 588                     }
 589                 }
 590               else
 591                 {
 592                   /* process non-first fragment */
 593                   reass0 = nat_ip4_reass_find_or_create (ip0->src_address,
 594                                                          ip0->dst_address,
 595                                                          ip0->fragment_id,
 596                                                          ip0->protocol,
 597                                                          1,
 598                                                          &fragments_to_drop);
 599                   if (PREDICT_FALSE (!reass0))
 600                     {
 601                       next0 = NAT44_CLASSIFY_NEXT_DROP;
 602                       b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS];
 603                       nat_log_notice ("maximum reassemblies exceeded");
 604                       goto enqueue0;
 605                     }
 606                   /* check if first fragment has arrived */
 607                   if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NONE &&
 608                       !(reass0->flags & NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE))
 609                     {
 610                       /* first fragment still hasn't arrived, cache this fragment */
 611                       if (nat_ip4_reass_add_fragment (reass0, bi0,
 612                                                       &fragments_to_drop))
 613                         {
 614                           b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_FRAG];
 615                           nat_log_notice ("maximum fragments per reassembly exceeded");
 616                           next0 = NAT44_CLASSIFY_NEXT_DROP;
 617                           goto enqueue0;
 618                         }
 619                       cached0 = 1;
 620                       goto enqueue0;
 621                     }
 622                   if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT)
 623                     goto enqueue0;
 624                   /* flag NAT_REASS_FLAG_CLASSIFY_ED_CONTINUE is set
 625                    * so keep the default next0 and continue in code to
 626                    * potentially find other classification for this packet */
 627                 }
 628             }
 629
 630           vec_foreach (ap, sm->addresses)
 631             {
 632               if (ip0->dst_address.as_u32 == ap->addr.as_u32)
 633                 {
 634                   next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 635                   goto enqueue0;
 636                 }
 637             }
 638
 639           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
 640             {
 641               m_key0.addr = ip0->dst_address;
 642               m_key0.port = 0;
 643               m_key0.protocol = 0;
 644               m_key0.fib_index = 0;
 645               kv0.key = m_key0.as_u64;
 646               /* try to classify the fragment based on IP header alone */
 647               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external,
 648                                            &kv0, &value0))
 649                 {
 650                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 651                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 652                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 653                   goto enqueue0;
 654                 }
 655               if (!ip4_is_fragment (ip0) || ip4_is_first_fragment (ip0))
 656                 {
 657                   /* process leading fragment/whole packet (with L4 header) */
 658                   m_key0.port = clib_net_to_host_u16 (udp0->dst_port);
 659                   m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol);
 660                   kv0.key = m_key0.as_u64;
 661                   if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external,
 662                                                &kv0, &value0))
 663                     {
 664                       m = pool_elt_at_index (sm->static_mappings, value0.value);
 665                       if (m->local_addr.as_u32 != m->external_addr.as_u32)
 666                         next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 667                     }
 668                   if (ip4_is_fragment (ip0))
 669                     {
 670                       reass0 = nat_ip4_reass_find_or_create (ip0->src_address,
 671                                                              ip0->dst_address,
 672                                                              ip0->fragment_id,
 673                                                              ip0->protocol,
 674                                                              1,
 675                                                              &fragments_to_drop);
 676                       if (PREDICT_FALSE (!reass0))
 677                         {
 678                           next0 = NAT44_CLASSIFY_NEXT_DROP;
 679                           b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS];
 680                           nat_log_notice ("maximum reassemblies exceeded");
 681                           goto enqueue0;
 682                         }
 683                       /* save classification for future fragments and set past
 684                        * fragments to be looped over and reprocessed */
 685                       if (next0 == NAT44_CLASSIFY_NEXT_OUT2IN)
 686                         reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN;
 687                       else
 688                         reass0->classify_next = NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT;
 689                       nat_ip4_reass_get_frags (reass0, &fragments_to_loopback);
 690                     }
 691                 }
 692               else
 693                 {
 694                   /* process non-first fragment */
 695                   reass0 = nat_ip4_reass_find_or_create (ip0->src_address,
 696                                                          ip0->dst_address,
 697                                                          ip0->fragment_id,
 698                                                          ip0->protocol,
 699                                                          1,
 700                                                          &fragments_to_drop);
 701                   if (PREDICT_FALSE (!reass0))
 702                     {
 703                       next0 = NAT44_CLASSIFY_NEXT_DROP;
 704                       b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_REASS];
 705                       nat_log_notice ("maximum reassemblies exceeded");
 706                       goto enqueue0;
 707                     }
 708                   if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NONE)
 709                     /* first fragment still hasn't arrived */
 710                     {
 711                       if (nat_ip4_reass_add_fragment (reass0, bi0,
 712                                                       &fragments_to_drop))
 713                         {
 714                           b0->error = node->errors[NAT44_CLASSIFY_ERROR_MAX_FRAG];
 715                           nat_log_notice ("maximum fragments per reassembly exceeded");
 716                           next0 = NAT44_CLASSIFY_NEXT_DROP;
 717                           goto enqueue0;
 718                         }
 719                       cached0 = 1;
 720                       goto enqueue0;
 721                     }
 722                   else if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_OUT2IN)
 723                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 724                   else if (reass0->classify_next == NAT_REASS_IP4_CLASSIFY_NEXT_IN2OUT)
 725                     next0 = NAT44_CLASSIFY_NEXT_IN2OUT;
 726                 }
 727             }
 728
 729         enqueue0:
 730           if (PREDICT_FALSE((node->flags & VLIB_NODE_FLAG_TRACE)
 731                             && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 732             {
 733               nat44_classify_trace_t *t =
 734                   vlib_add_trace (vm, node, b0, sizeof (*t));
 735               t->cached = cached0;
 736               if (!cached0)
 737                 t->next_in2out = next0 == NAT44_CLASSIFY_NEXT_IN2OUT ? 1 : 0;
 738             }
 739
 740           if (cached0)
 741             {
 742               n_left_to_next++;
 743               to_next--;
 744             }
 745           else
 746             /* verify speculative enqueue, maybe switch current next frame */
 747             vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 748                                              to_next, n_left_to_next,
 749                                              bi0, next0);
 750
 751           if (n_left_from == 0 && vec_len (fragments_to_loopback))
 752             {
 753               from = vlib_frame_vector_args (frame);
 754               u32 len = vec_len (fragments_to_loopback);
 755               if (len <= VLIB_FRAME_SIZE)
 756                 {
 757                   clib_memcpy (from, fragments_to_loopback, sizeof (u32) * len);
 758                   n_left_from = len;
 759                   vec_reset_length (fragments_to_loopback);
 760                 }
 761               else
 762                 {
 763                   clib_memcpy (from,
 764                                fragments_to_loopback + (len - VLIB_FRAME_SIZE),
 765                                sizeof (u32) * VLIB_FRAME_SIZE);
 766                   n_left_from = VLIB_FRAME_SIZE;
 767                   _vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE;
 768                 }
 769             }
 770         }
 771
 772       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 773     }
 774
 775   nat_send_all_to_node (vm, fragments_to_drop, node, 0, NAT44_CLASSIFY_NEXT_DROP);
 776
 777   vec_free (fragments_to_drop);
 778
 779   return frame->n_vectors;
 780 }
 781
 782 static uword
 783 nat44_classify_node_fn (vlib_main_t * vm,
 784                         vlib_node_runtime_t * node,
 785                         vlib_frame_t * frame)
 786 {
 787   return nat44_classify_node_fn_inline (vm, node, frame, 0);
 788 };
 789
 790 VLIB_REGISTER_NODE (nat44_classify_node) = {
 791   .function = nat44_classify_node_fn,
 792   .name = "nat44-classify",
 793   .vector_size = sizeof (u32),
 794   .format_trace = format_nat44_classify_trace,
 795   .type = VLIB_NODE_TYPE_INTERNAL,
 796   .n_errors = ARRAY_LEN(nat44_classify_error_strings),
 797   .error_strings = nat44_classify_error_strings,
 798   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 799   .next_nodes = {
 800     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out",
 801     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in",
 802     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 803   },
 804 };
 805
 806 VLIB_NODE_FUNCTION_MULTIARCH (nat44_classify_node,
 807                               nat44_classify_node_fn);
 808 static uword
 809 nat44_ed_classify_node_fn (vlib_main_t * vm,
 810                            vlib_node_runtime_t * node,
 811                            vlib_frame_t * frame)
 812 {
 813   return nat44_classify_node_fn_inline (vm, node, frame, 1);
 814 };
 815
 816 VLIB_REGISTER_NODE (nat44_ed_classify_node) = {
 817   .function = nat44_ed_classify_node_fn,
 818   .name = "nat44-ed-classify",
 819   .vector_size = sizeof (u32),
 820   .format_trace = format_nat44_classify_trace,
 821   .type = VLIB_NODE_TYPE_INTERNAL,
 822   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 823   .next_nodes = {
 824     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-ed-in2out",
 825     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-ed-out2in",
 826     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 827   },
 828 };
 829
 830 VLIB_NODE_FUNCTION_MULTIARCH (nat44_ed_classify_node,
 831                               nat44_ed_classify_node_fn);
 832
 833 static uword
 834 nat44_det_classify_node_fn (vlib_main_t * vm,
 835                             vlib_node_runtime_t * node,
 836                             vlib_frame_t * frame)
 837 {
 838   return nat44_classify_node_fn_inline (vm, node, frame, 0);
 839 };
 840
 841 VLIB_REGISTER_NODE (nat44_det_classify_node) = {
 842   .function = nat44_det_classify_node_fn,
 843   .name = "nat44-det-classify",
 844   .vector_size = sizeof (u32),
 845   .format_trace = format_nat44_classify_trace,
 846   .type = VLIB_NODE_TYPE_INTERNAL,
 847   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 848   .next_nodes = {
 849     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out",
 850     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in",
 851     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 852   },
 853 };
 854
 855 VLIB_NODE_FUNCTION_MULTIARCH (nat44_det_classify_node,
 856                               nat44_det_classify_node_fn);
 857
 858 static uword
 859 nat44_handoff_classify_node_fn (vlib_main_t * vm,
 860                                 vlib_node_runtime_t * node,
 861                                 vlib_frame_t * frame)
 862 {
 863   return nat44_classify_node_fn_inline (vm, node, frame, 0);
 864 };
 865
 866 VLIB_REGISTER_NODE (nat44_handoff_classify_node) = {
 867   .function = nat44_handoff_classify_node_fn,
 868   .name = "nat44-handoff-classify",
 869   .vector_size = sizeof (u32),
 870   .format_trace = format_nat44_classify_trace,
 871   .type = VLIB_NODE_TYPE_INTERNAL,
 872   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 873   .next_nodes = {
 874     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out-worker-handoff",
 875     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in-worker-handoff",
 876     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 877   },
 878 };
 879
 880 VLIB_NODE_FUNCTION_MULTIARCH (nat44_handoff_classify_node,
 881                               nat44_handoff_classify_node_fn);
 882
 883 /**
 884  * @brief Add/del NAT address to FIB.
 885  *
 886  * Add the external NAT address to the FIB as receive entries. This ensures
 887  * that VPP will reply to ARP for this address and we don't need to enable
 888  * proxy ARP on the outside interface.
 889  *
 890  * @param addr IPv4 address.
 891  * @param plen address prefix length
 892  * @param sw_if_index Interface.
 893  * @param is_add If 0 delete, otherwise add.
 894  */
 895 void
 896 snat_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
 897                           int is_add)
 898 {
 899   fib_prefix_t prefix = {
 900     .fp_len = p_len,
 901     .fp_proto = FIB_PROTOCOL_IP4,
 902     .fp_addr = {
 903         .ip4.as_u32 = addr->as_u32,
 904     },
 905   };
 906   u32 fib_index = ip4_fib_table_get_index_for_sw_if_index(sw_if_index);
 907
 908   if (is_add)
 909     fib_table_entry_update_one_path(fib_index,
 910                                     &prefix,
 911                                     FIB_SOURCE_PLUGIN_LOW,
 912                                     (FIB_ENTRY_FLAG_CONNECTED |
 913                                      FIB_ENTRY_FLAG_LOCAL |
 914                                      FIB_ENTRY_FLAG_EXCLUSIVE),
 915                                     DPO_PROTO_IP4,
 916                                     NULL,
 917                                     sw_if_index,
 918                                     ~0,
 919                                     1,
 920                                     NULL,
 921                                     FIB_ROUTE_PATH_FLAG_NONE);
 922   else
 923     fib_table_entry_delete(fib_index,
 924                            &prefix,
 925                            FIB_SOURCE_PLUGIN_LOW);
 926 }
 927
 928 int snat_add_address (snat_main_t *sm, ip4_address_t *addr, u32 vrf_id,
 929                        u8 twice_nat)
 930 {
 931   snat_address_t * ap;
 932   snat_interface_t *i;
 933   vlib_thread_main_t *tm = vlib_get_thread_main ();
 934
 935   if (twice_nat && !sm->endpoint_dependent)
 936     return VNET_API_ERROR_FEATURE_DISABLED;
 937
 938   /* Check if address already exists */
 939   vec_foreach (ap, twice_nat ? sm->twice_nat_addresses : sm->addresses)
 940     {
 941       if (ap->addr.as_u32 == addr->as_u32)
 942         return VNET_API_ERROR_VALUE_EXIST;
 943     }
 944
 945   if (twice_nat)
 946     vec_add2 (sm->twice_nat_addresses, ap, 1);
 947   else
 948     vec_add2 (sm->addresses, ap, 1);
 949
 950   ap->addr = *addr;
 951   if (vrf_id != ~0)
 952     ap->fib_index =
 953       fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4, vrf_id,
 954                                          FIB_SOURCE_PLUGIN_LOW);
 955   else
 956     ap->fib_index = ~0;
 957 #define _(N, i, n, s) \
 958   clib_bitmap_alloc (ap->busy_##n##_port_bitmap, 65535); \
 959   ap->busy_##n##_ports = 0; \
 960   ap->busy_##n##_ports_per_thread = 0;\
 961   vec_validate_init_empty (ap->busy_##n##_ports_per_thread, tm->n_vlib_mains - 1, 0);
 962   foreach_snat_protocol
 963 #undef _
 964
 965   if (twice_nat)
 966     return 0;
 967
 968   /* Add external address to FIB */
 969   pool_foreach (i, sm->interfaces,
 970   ({
 971     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 972       continue;
 973
 974     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 975     break;
 976   }));
 977   pool_foreach (i, sm->output_feature_interfaces,
 978   ({
 979     if (nat_interface_is_inside(i) || sm->out2in_dpo)
 980       continue;
 981
 982     snat_add_del_addr_to_fib(addr, 32, i->sw_if_index, 1);
 983     break;
 984   }));
 985
 986   return 0;
 987 }
 988
 989 static int is_snat_address_used_in_static_mapping (snat_main_t *sm,
 990                                                    ip4_address_t addr)
 991 {
 992   snat_static_mapping_t *m;
 993   pool_foreach (m, sm->static_mappings,
 994   ({
 995       if (m->external_addr.as_u32 == addr.as_u32)
 996         return 1;
 997   }));
 998
 999   return 0;
1000 }
1001
1002 void increment_v4_address (ip4_address_t * a)
1003 {
1004   u32 v;
1005
1006   v = clib_net_to_host_u32(a->as_u32) + 1;
1007   a->as_u32 = clib_host_to_net_u32(v);
1008 }
1009
1010 static void
1011 snat_add_static_mapping_when_resolved (snat_main_t * sm,
1012                                        ip4_address_t l_addr,
1013                                        u16 l_port,
1014                                        u32 sw_if_index,
1015                                        u16 e_port,
1016                                        u32 vrf_id,
1017                                        snat_protocol_t proto,
1018                                        int addr_only,
1019                                        int is_add,
1020                                        u8 * tag)
1021 {
1022   snat_static_map_resolve_t *rp;
1023
1024   vec_add2 (sm->to_resolve, rp, 1);
1025   rp->l_addr.as_u32 = l_addr.as_u32;
1026   rp->l_port = l_port;
1027   rp->sw_if_index = sw_if_index;
1028   rp->e_port = e_port;
1029   rp->vrf_id = vrf_id;
1030   rp->proto = proto;
1031   rp->addr_only = addr_only;
1032   rp->is_add = is_add;
1033   rp->tag = vec_dup (tag);
1034 }
1035
1036 static u32 get_thread_idx_by_port(u16 e_port)
1037 {
1038     snat_main_t * sm = &snat_main;
1039     u32 thread_idx = sm->num_workers;
1040     if (sm->num_workers > 1)
1041     {
1042         thread_idx = sm->first_worker_index + sm->workers[(e_port - 1024) / sm->port_per_thread];
1043     }
1044     return thread_idx;
1045 }
1046
1047 /**
1048  * @brief Add static mapping.
1049  *
1050  * Create static mapping between local addr+port and external addr+port.
1051  *
1052  * @param l_addr Local IPv4 address.
1053  * @param e_addr External IPv4 address.
1054  * @param l_port Local port number.
1055  * @param e_port External port number.
1056  * @param vrf_id VRF ID.
1057  * @param addr_only If 0 address port and pair mapping, otherwise address only.
1058  * @param sw_if_index External port instead of specific IP address.
1059  * @param is_add If 0 delete static mapping, otherwise add.
1060  * @param twice_nat If value is TWICE_NAT then translate external host address
1061  *                  and port.
1062  *                  If value is TWICE_NAT_SELF then translate external host
1063  *                  address and port whenever external host address equals
1064  *                  local address of internal host.
1065  * @param out2in_only If 1 rule match only out2in direction
1066  * @param tag - opaque string tag
1067  *
1068  * @returns
1069  */
1070 int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr,
1071                             u16 l_port, u16 e_port, u32 vrf_id, int addr_only,
1072                             u32 sw_if_index, snat_protocol_t proto, int is_add,
1073                             twice_nat_type_t twice_nat, u8 out2in_only,
1074                             u8 * tag)
1075 {
1076   snat_main_t * sm = &snat_main;
1077   snat_static_mapping_t *m;
1078   snat_session_key_t m_key;
1079   clib_bihash_kv_8_8_t kv, value;
1080   snat_address_t *a = 0;
1081   u32 fib_index = ~0;
1082   uword * p;
1083   snat_interface_t *interface;
1084   int i;
1085   snat_main_per_thread_data_t *tsm;
1086   snat_user_key_t u_key;
1087   snat_user_t *u;
1088   dlist_elt_t * head, * elt;
1089   u32 elt_index, head_index;
1090   u32 ses_index;
1091   u64 user_index;
1092   snat_session_t * s;
1093   snat_static_map_resolve_t *rp, *rp_match = 0;
1094
1095   if (!sm->endpoint_dependent)
1096     {
1097       if (twice_nat || out2in_only)
1098         return VNET_API_ERROR_FEATURE_DISABLED;
1099     }
1100
1101   /* If the external address is a specific interface address */
1102   if (sw_if_index != ~0)
1103     {
1104       ip4_address_t * first_int_addr;
1105
1106       for (i = 0; i < vec_len (sm->to_resolve); i++)
1107         {
1108           rp = sm->to_resolve + i;
1109           if (rp->sw_if_index != sw_if_index ||
1110               rp->l_addr.as_u32 != l_addr.as_u32 ||
1111               rp->vrf_id != vrf_id || rp->addr_only != addr_only)
1112             continue;
1113
1114           if (!addr_only)
1115             {
1116               if (rp->l_port != l_port || rp->e_port != e_port || rp->proto != proto)
1117                 continue;
1118             }
1119
1120           rp_match = rp;
1121           break;
1122         }
1123
1124       /* Might be already set... */
1125       first_int_addr = ip4_interface_first_address
1126         (sm->ip4_main, sw_if_index, 0 /* just want the address*/);
1127
1128       if (is_add)
1129         {
1130           if (rp_match)
1131             return VNET_API_ERROR_VALUE_EXIST;
1132
1133           snat_add_static_mapping_when_resolved
1134             (sm, l_addr, l_port, sw_if_index, e_port, vrf_id, proto,
1135              addr_only,  is_add, tag);
1136
1137           /* DHCP resolution required? */
1138           if (first_int_addr == 0)
1139             {
1140               return 0;
1141             }
1142           else
1143             {
1144               e_addr.as_u32 = first_int_addr->as_u32;
1145               /* Identity mapping? */
1146               if (l_addr.as_u32 == 0)
1147                 l_addr.as_u32 = e_addr.as_u32;
1148             }
1149         }
1150       else
1151         {
1152           if (!rp_match)
1153             return VNET_API_ERROR_NO_SUCH_ENTRY;
1154
1155           vec_del1 (sm->to_resolve, i);
1156
1157           if (first_int_addr)
1158             {
1159               e_addr.as_u32 = first_int_addr->as_u32;
1160               /* Identity mapping? */
1161               if (l_addr.as_u32 == 0)
1162                 l_addr.as_u32 = e_addr.as_u32;
1163             }
1164           else
1165             return 0;
1166         }
1167     }
1168
1169   m_key.addr = e_addr;
1170   m_key.port = addr_only ? 0 : e_port;
1171   m_key.protocol = addr_only ? 0 : proto;
1172   m_key.fib_index = 0;
1173   kv.key = m_key.as_u64;
1174   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1175     m = 0;
1176   else
1177     m = pool_elt_at_index (sm->static_mappings, value.value);
1178
1179   if (is_add)
1180     {
1181       if (m)
1182         return VNET_API_ERROR_VALUE_EXIST;
1183
1184       if (twice_nat && addr_only)
1185         return VNET_API_ERROR_UNSUPPORTED;
1186
1187       /* Convert VRF id to FIB index */
1188       if (vrf_id != ~0)
1189         {
1190           p = hash_get (sm->ip4_main->fib_index_by_table_id, vrf_id);
1191           if (!p)
1192             return VNET_API_ERROR_NO_SUCH_FIB;
1193           fib_index = p[0];
1194         }
1195       /* If not specified use inside VRF id from SNAT plugin startup config */
1196       else
1197         {
1198           fib_index = sm->inside_fib_index;
1199           vrf_id = sm->inside_vrf_id;
1200         }
1201
1202       if (!out2in_only)
1203         {
1204           m_key.addr = l_addr;
1205           m_key.port = addr_only ? 0 : l_port;
1206           m_key.protocol = addr_only ? 0 : proto;
1207           m_key.fib_index = fib_index;
1208           kv.key = m_key.as_u64;
1209           if (!clib_bihash_search_8_8 (&sm->static_mapping_by_local, &kv, &value))
1210             return VNET_API_ERROR_VALUE_EXIST;
1211         }
1212
1213       /* Find external address in allocated addresses and reserve port for
1214          address and port pair mapping when dynamic translations enabled */
1215       if (!(addr_only || sm->static_mapping_only || out2in_only))
1216         {
1217           for (i = 0; i < vec_len (sm->addresses); i++)
1218             {
1219               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1220                 {
1221                   a = sm->addresses + i;
1222                   /* External port must be unused */
1223                   switch (proto)
1224                     {
1225 #define _(N, j, n, s) \
1226                     case SNAT_PROTOCOL_##N: \
1227                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1228                         return VNET_API_ERROR_INVALID_VALUE; \
1229                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1230                       if (e_port > 1024) \
1231                         { \
1232                           a->busy_##n##_ports++; \
1233                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
1234                         } \
1235                       break;
1236                       foreach_snat_protocol
1237 #undef _
1238                     default:
1239                       nat_log_info ("unknown protocol");
1240                       return VNET_API_ERROR_INVALID_VALUE_2;
1241                     }
1242                   break;
1243                 }
1244             }
1245           /* External address must be allocated */
1246           if (!a && (l_addr.as_u32 != e_addr.as_u32))
1247             {
1248               if (sw_if_index != ~0)
1249                 {
1250                   for (i = 0; i < vec_len (sm->to_resolve); i++)
1251                     {
1252                       rp = sm->to_resolve + i;
1253                       if (rp->addr_only)
1254                          continue;
1255                       if (rp->sw_if_index != sw_if_index &&
1256                           rp->l_addr.as_u32 != l_addr.as_u32 &&
1257                           rp->vrf_id != vrf_id && rp->l_port != l_port &&
1258                           rp->e_port != e_port && rp->proto != proto)
1259                         continue;
1260
1261                       vec_del1 (sm->to_resolve, i);
1262                       break;
1263                     }
1264                 }
1265               return VNET_API_ERROR_NO_SUCH_ENTRY;
1266             }
1267         }
1268
1269       pool_get (sm->static_mappings, m);
1270       memset (m, 0, sizeof (*m));
1271       m->tag = vec_dup (tag);
1272       m->local_addr = l_addr;
1273       m->external_addr = e_addr;
1274       m->addr_only = addr_only;
1275       m->vrf_id = vrf_id;
1276       m->fib_index = fib_index;
1277       m->twice_nat = twice_nat;
1278       m->out2in_only = out2in_only;
1279       if (!addr_only)
1280         {
1281           m->local_port = l_port;
1282           m->external_port = e_port;
1283           m->proto = proto;
1284         }
1285
1286       if (sm->num_workers > 1)
1287         {
1288           ip4_header_t ip = {
1289             .src_address = m->local_addr,
1290           };
1291           vec_add1 (m->workers, sm->worker_in2out_cb (&ip, m->fib_index));
1292           tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
1293         }
1294       else
1295         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1296
1297       m_key.addr = m->local_addr;
1298       m_key.port = m->local_port;
1299       m_key.protocol = m->proto;
1300       m_key.fib_index = m->fib_index;
1301       kv.key = m_key.as_u64;
1302       kv.value = m - sm->static_mappings;
1303       if (!out2in_only)
1304         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
1305
1306       m_key.addr = m->external_addr;
1307       m_key.port = m->external_port;
1308       m_key.fib_index = 0;
1309       kv.key = m_key.as_u64;
1310       kv.value = m - sm->static_mappings;
1311       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1);
1312
1313       /* Delete dynamic sessions matching local address (+ local port) */
1314       if (!(sm->static_mapping_only))
1315         {
1316           u_key.addr = m->local_addr;
1317           u_key.fib_index = m->fib_index;
1318           kv.key = u_key.as_u64;
1319           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1320             {
1321               user_index = value.value;
1322               u = pool_elt_at_index (tsm->users, user_index);
1323               if (u->nsessions)
1324                 {
1325                   head_index = u->sessions_per_user_list_head_index;
1326                   head = pool_elt_at_index (tsm->list_pool, head_index);
1327                   elt_index = head->next;
1328                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1329                   ses_index = elt->value;
1330                   while (ses_index != ~0)
1331                     {
1332                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1333                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1334                       ses_index = elt->value;
1335
1336                       if (snat_is_session_static (s))
1337                         continue;
1338
1339                       if (!addr_only && (clib_net_to_host_u16 (s->in2out.port) != m->local_port))
1340                         continue;
1341
1342                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1343                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1344
1345                       if (!addr_only && !sm->endpoint_dependent)
1346                         break;
1347                     }
1348                 }
1349             }
1350         }
1351     }
1352   else
1353     {
1354       if (!m)
1355         {
1356           if (sw_if_index != ~0)
1357             return 0;
1358           else
1359             return VNET_API_ERROR_NO_SUCH_ENTRY;
1360         }
1361
1362       /* Free external address port */
1363       if (!(addr_only || sm->static_mapping_only || out2in_only))
1364         {
1365           for (i = 0; i < vec_len (sm->addresses); i++)
1366             {
1367               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1368                 {
1369                   a = sm->addresses + i;
1370                   switch (proto)
1371                     {
1372 #define _(N, j, n, s) \
1373                     case SNAT_PROTOCOL_##N: \
1374                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1375                       if (e_port > 1024) \
1376                         { \
1377                           a->busy_##n##_ports--; \
1378                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1379                         } \
1380                       break;
1381                       foreach_snat_protocol
1382 #undef _
1383                     default:
1384                       nat_log_info ("unknown protocol");
1385                       return VNET_API_ERROR_INVALID_VALUE_2;
1386                     }
1387                   break;
1388                 }
1389             }
1390         }
1391
1392       if (sm->num_workers > 1)
1393         tsm = vec_elt_at_index (sm->per_thread_data, m->workers[0]);
1394       else
1395         tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1396
1397       m_key.addr = m->local_addr;
1398       m_key.port = m->local_port;
1399       m_key.protocol = m->proto;
1400       m_key.fib_index = m->fib_index;
1401       kv.key = m_key.as_u64;
1402       if (!out2in_only)
1403         clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0);
1404
1405       m_key.addr = m->external_addr;
1406       m_key.port = m->external_port;
1407       m_key.fib_index = 0;
1408       kv.key = m_key.as_u64;
1409       clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0);
1410
1411       /* Delete session(s) for static mapping if exist */
1412       if (!(sm->static_mapping_only) ||
1413           (sm->static_mapping_only && sm->static_mapping_connection_tracking))
1414         {
1415           u_key.addr = m->local_addr;
1416           u_key.fib_index = m->fib_index;
1417           kv.key = u_key.as_u64;
1418           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1419             {
1420               user_index = value.value;
1421               u = pool_elt_at_index (tsm->users, user_index);
1422               if (u->nstaticsessions)
1423                 {
1424                   head_index = u->sessions_per_user_list_head_index;
1425                   head = pool_elt_at_index (tsm->list_pool, head_index);
1426                   elt_index = head->next;
1427                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1428                   ses_index = elt->value;
1429                   while (ses_index != ~0)
1430                     {
1431                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1432                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1433                       ses_index = elt->value;
1434
1435                       if (!addr_only)
1436                         {
1437                           if ((s->out2in.addr.as_u32 != e_addr.as_u32) ||
1438                               (clib_net_to_host_u16 (s->out2in.port) != e_port))
1439                             continue;
1440                         }
1441
1442                       if (is_lb_session (s))
1443                         continue;
1444
1445                       if (!snat_is_session_static (s))
1446                         continue;
1447
1448                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1449                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1450
1451                       if (!addr_only && !sm->endpoint_dependent)
1452                         break;
1453                     }
1454                 }
1455             }
1456         }
1457
1458       vec_free (m->tag);
1459       vec_free (m->workers);
1460       /* Delete static mapping from pool */
1461       pool_put (sm->static_mappings, m);
1462     }
1463
1464   if (!addr_only || (l_addr.as_u32 == e_addr.as_u32))
1465     return 0;
1466
1467   /* Add/delete external address to FIB */
1468   pool_foreach (interface, sm->interfaces,
1469   ({
1470     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1471       continue;
1472
1473     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1474     break;
1475   }));
1476   pool_foreach (interface, sm->output_feature_interfaces,
1477   ({
1478     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1479       continue;
1480
1481     snat_add_del_addr_to_fib(&e_addr, 32, interface->sw_if_index, is_add);
1482     break;
1483   }));
1484
1485   return 0;
1486 }
1487
1488 int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port,
1489                                      snat_protocol_t proto,
1490                                      nat44_lb_addr_port_t *locals, u8 is_add,
1491                                      twice_nat_type_t twice_nat, u8 out2in_only,
1492                                      u8 *tag, u32 affinity)
1493 {
1494   snat_main_t * sm = &snat_main;
1495   snat_static_mapping_t *m;
1496   snat_session_key_t m_key;
1497   clib_bihash_kv_8_8_t kv, value;
1498   snat_address_t *a = 0;
1499   int i;
1500   nat44_lb_addr_port_t *local;
1501   u32 elt_index, head_index, ses_index;
1502   snat_main_per_thread_data_t *tsm;
1503   snat_user_key_t u_key;
1504   snat_user_t *u;
1505   snat_session_t * s;
1506   dlist_elt_t * head, * elt;
1507   uword *bitmap = 0;
1508
1509   if (!sm->endpoint_dependent)
1510     return VNET_API_ERROR_FEATURE_DISABLED;
1511
1512   m_key.addr = e_addr;
1513   m_key.port = e_port;
1514   m_key.protocol = proto;
1515   m_key.fib_index = 0;
1516   kv.key = m_key.as_u64;
1517   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
1518     m = 0;
1519   else
1520     m = pool_elt_at_index (sm->static_mappings, value.value);
1521
1522   if (is_add)
1523     {
1524       if (m)
1525         return VNET_API_ERROR_VALUE_EXIST;
1526
1527       if (vec_len (locals) < 2)
1528         return VNET_API_ERROR_INVALID_VALUE;
1529
1530       /* Find external address in allocated addresses and reserve port for
1531          address and port pair mapping when dynamic translations enabled */
1532       if (!(sm->static_mapping_only || out2in_only))
1533         {
1534           for (i = 0; i < vec_len (sm->addresses); i++)
1535             {
1536               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1537                 {
1538                   a = sm->addresses + i;
1539                   /* External port must be unused */
1540                   switch (proto)
1541                     {
1542 #define _(N, j, n, s) \
1543                     case SNAT_PROTOCOL_##N: \
1544                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, e_port)) \
1545                         return VNET_API_ERROR_INVALID_VALUE; \
1546                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 1); \
1547                       if (e_port > 1024) \
1548                         { \
1549                           a->busy_##n##_ports++; \
1550                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]++; \
1551                         } \
1552                       break;
1553                       foreach_snat_protocol
1554 #undef _
1555                     default:
1556                       nat_log_info ("unknown protocol");
1557                       return VNET_API_ERROR_INVALID_VALUE_2;
1558                     }
1559                   break;
1560                 }
1561             }
1562           /* External address must be allocated */
1563           if (!a)
1564             return VNET_API_ERROR_NO_SUCH_ENTRY;
1565         }
1566
1567       pool_get (sm->static_mappings, m);
1568       memset (m, 0, sizeof (*m));
1569       m->tag = vec_dup (tag);
1570       m->external_addr = e_addr;
1571       m->addr_only = 0;
1572       m->external_port = e_port;
1573       m->proto = proto;
1574       m->twice_nat = twice_nat;
1575       m->out2in_only = out2in_only;
1576       m->affinity = affinity;
1577
1578       if (affinity)
1579         m->affinity_per_service_list_head_index =
1580           nat_affinity_get_per_service_list_head_index();
1581       else
1582         m->affinity_per_service_list_head_index = ~0;
1583
1584       m_key.addr = m->external_addr;
1585       m_key.port = m->external_port;
1586       m_key.protocol = m->proto;
1587       m_key.fib_index = 0;
1588       kv.key = m_key.as_u64;
1589       kv.value = m - sm->static_mappings;
1590       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 1))
1591         {
1592           nat_log_err ("static_mapping_by_external key add failed");
1593           return VNET_API_ERROR_UNSPECIFIED;
1594         }
1595
1596       m_key.fib_index = m->fib_index;
1597       for (i = 0; i < vec_len (locals); i++)
1598         {
1599           locals[i].fib_index = fib_table_find_or_create_and_lock (
1600             FIB_PROTOCOL_IP4, locals[i].vrf_id, FIB_SOURCE_PLUGIN_LOW);
1601           m_key.addr = locals[i].addr;
1602           m_key.fib_index = locals[i].fib_index;
1603           if (!out2in_only)
1604             {
1605               m_key.port = locals[i].port;
1606               kv.key = m_key.as_u64;
1607               kv.value = m - sm->static_mappings;
1608               clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 1);
1609             }
1610           locals[i].prefix = (i == 0) ? locals[i].probability :\
1611             (locals[i - 1].prefix + locals[i].probability);
1612           vec_add1 (m->locals, locals[i]);
1613           if (sm->num_workers > 1)
1614             {
1615               ip4_header_t ip = {
1616                 .src_address = locals[i].addr,
1617               };
1618               bitmap = clib_bitmap_set (
1619                 bitmap, sm->worker_in2out_cb (&ip, m->fib_index), 1);
1620             }
1621         }
1622
1623       /* Assign workers */
1624       if (sm->num_workers > 1)
1625         {
1626           clib_bitmap_foreach (i, bitmap,
1627             ({
1628                vec_add1(m->workers, i);
1629             }));
1630         }
1631     }
1632   else
1633     {
1634       if (!m)
1635         return VNET_API_ERROR_NO_SUCH_ENTRY;
1636
1637       /* Free external address port */
1638       if (!(sm->static_mapping_only || out2in_only))
1639         {
1640           for (i = 0; i < vec_len (sm->addresses); i++)
1641             {
1642               if (sm->addresses[i].addr.as_u32 == e_addr.as_u32)
1643                 {
1644                   a = sm->addresses + i;
1645                   switch (proto)
1646                     {
1647 #define _(N, j, n, s) \
1648                     case SNAT_PROTOCOL_##N: \
1649                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, e_port, 0); \
1650                       if (e_port > 1024) \
1651                         { \
1652                           a->busy_##n##_ports--; \
1653                           a->busy_##n##_ports_per_thread[get_thread_idx_by_port(e_port)]--; \
1654                         } \
1655                       break;
1656                       foreach_snat_protocol
1657 #undef _
1658                     default:
1659                       nat_log_info ("unknown protocol");
1660                       return VNET_API_ERROR_INVALID_VALUE_2;
1661                     }
1662                   break;
1663                 }
1664             }
1665         }
1666
1667       m_key.addr = m->external_addr;
1668       m_key.port = m->external_port;
1669       m_key.protocol = m->proto;
1670       m_key.fib_index = 0;
1671       kv.key = m_key.as_u64;
1672       if (clib_bihash_add_del_8_8(&sm->static_mapping_by_external, &kv, 0))
1673         {
1674           nat_log_err ("static_mapping_by_external key del failed");
1675           return VNET_API_ERROR_UNSPECIFIED;
1676         }
1677
1678       vec_foreach (local, m->locals)
1679         {
1680           fib_table_unlock (local->fib_index, FIB_PROTOCOL_IP4,
1681                             FIB_SOURCE_PLUGIN_LOW);
1682           m_key.addr = local->addr;
1683           if (!out2in_only)
1684             {
1685               m_key.port = local->port;
1686               m_key.fib_index = local->fib_index;
1687               kv.key = m_key.as_u64;
1688               if (clib_bihash_add_del_8_8(&sm->static_mapping_by_local, &kv, 0))
1689                 {
1690                   nat_log_err ("static_mapping_by_local key del failed");
1691                   return VNET_API_ERROR_UNSPECIFIED;
1692                 }
1693             }
1694
1695           if (sm->num_workers > 1)
1696             {
1697               ip4_header_t ip = {
1698                 .src_address = local->addr,
1699               };
1700               tsm = vec_elt_at_index (sm->per_thread_data,
1701                                       sm->worker_in2out_cb (&ip, m->fib_index));
1702             }
1703           else
1704             tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
1705
1706           /* Delete sessions */
1707           u_key.addr = local->addr;
1708           u_key.fib_index = m->fib_index;
1709           kv.key = u_key.as_u64;
1710           if (!clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value))
1711             {
1712               u = pool_elt_at_index (tsm->users, value.value);
1713               if (u->nstaticsessions)
1714                 {
1715                   head_index = u->sessions_per_user_list_head_index;
1716                   head = pool_elt_at_index (tsm->list_pool, head_index);
1717                   elt_index = head->next;
1718                   elt = pool_elt_at_index (tsm->list_pool, elt_index);
1719                   ses_index = elt->value;
1720                   while (ses_index != ~0)
1721                     {
1722                       s =  pool_elt_at_index (tsm->sessions, ses_index);
1723                       elt = pool_elt_at_index (tsm->list_pool, elt->next);
1724                       ses_index = elt->value;
1725
1726                       if (!(is_lb_session (s)))
1727                         continue;
1728
1729                       if ((s->in2out.addr.as_u32 != local->addr.as_u32) ||
1730                           (clib_net_to_host_u16 (s->in2out.port) != local->port))
1731                         continue;
1732
1733                       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
1734                       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
1735                     }
1736                 }
1737             }
1738         }
1739       if (m->affinity)
1740         nat_affinity_flush_service (m->affinity_per_service_list_head_index);
1741       vec_free(m->locals);
1742       vec_free(m->tag);
1743       vec_free(m->workers);
1744
1745       pool_put (sm->static_mappings, m);
1746     }
1747
1748   return 0;
1749 }
1750
1751 int
1752 snat_del_address (snat_main_t *sm, ip4_address_t addr, u8 delete_sm,
1753                   u8 twice_nat)
1754 {
1755   snat_address_t *a = 0;
1756   snat_session_t *ses;
1757   u32 *ses_to_be_removed = 0, *ses_index;
1758   snat_main_per_thread_data_t *tsm;
1759   snat_static_mapping_t *m;
1760   snat_interface_t *interface;
1761   int i;
1762   snat_address_t *addresses = twice_nat ? sm->twice_nat_addresses : sm->addresses;
1763
1764   /* Find SNAT address */
1765   for (i=0; i < vec_len (addresses); i++)
1766     {
1767       if (addresses[i].addr.as_u32 == addr.as_u32)
1768         {
1769           a = addresses + i;
1770           break;
1771         }
1772     }
1773   if (!a)
1774     return VNET_API_ERROR_NO_SUCH_ENTRY;
1775
1776   if (delete_sm)
1777     {
1778       pool_foreach (m, sm->static_mappings,
1779       ({
1780           if (m->external_addr.as_u32 == addr.as_u32)
1781             (void) snat_add_static_mapping (m->local_addr, m->external_addr,
1782                                             m->local_port, m->external_port,
1783                                             m->vrf_id, m->addr_only, ~0,
1784                                             m->proto, 0, m->twice_nat,
1785                                             m->out2in_only, m->tag);
1786       }));
1787     }
1788   else
1789     {
1790       /* Check if address is used in some static mapping */
1791       if (is_snat_address_used_in_static_mapping(sm, addr))
1792         {
1793           nat_log_notice ("address used in static mapping");
1794           return VNET_API_ERROR_UNSPECIFIED;
1795         }
1796     }
1797
1798   if (a->fib_index != ~0)
1799     fib_table_unlock(a->fib_index, FIB_PROTOCOL_IP4,
1800                      FIB_SOURCE_PLUGIN_LOW);
1801
1802   /* Delete sessions using address */
1803   if (a->busy_tcp_ports || a->busy_udp_ports || a->busy_icmp_ports)
1804     {
1805       vec_foreach (tsm, sm->per_thread_data)
1806         {
1807           pool_foreach (ses, tsm->sessions, ({
1808             if (ses->out2in.addr.as_u32 == addr.as_u32)
1809               {
1810                 ses->outside_address_index = ~0;
1811                 nat_free_session_data (sm, ses, tsm - sm->per_thread_data);
1812                 vec_add1 (ses_to_be_removed, ses - tsm->sessions);
1813               }
1814           }));
1815
1816           vec_foreach (ses_index, ses_to_be_removed)
1817             {
1818               ses = pool_elt_at_index (tsm->sessions, ses_index[0]);
1819               nat44_delete_session (sm, ses, tsm - sm->per_thread_data);
1820             }
1821
1822           vec_free (ses_to_be_removed);
1823        }
1824     }
1825
1826 #define _(N, i, n, s) \
1827   clib_bitmap_free (a->busy_##n##_port_bitmap); \
1828   vec_free (a->busy_##n##_ports_per_thread);
1829   foreach_snat_protocol
1830 #undef _
1831
1832   if (twice_nat)
1833     {
1834       vec_del1 (sm->twice_nat_addresses, i);
1835       return 0;
1836     }
1837   else
1838     vec_del1 (sm->addresses, i);
1839
1840   /* Delete external address from FIB */
1841   pool_foreach (interface, sm->interfaces,
1842   ({
1843     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1844       continue;
1845
1846     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1847     break;
1848   }));
1849   pool_foreach (interface, sm->output_feature_interfaces,
1850   ({
1851     if (nat_interface_is_inside(interface) || sm->out2in_dpo)
1852       continue;
1853
1854     snat_add_del_addr_to_fib(&addr, 32, interface->sw_if_index, 0);
1855     break;
1856   }));
1857
1858   return 0;
1859 }
1860
1861 int snat_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
1862 {
1863   snat_main_t *sm = &snat_main;
1864   snat_interface_t *i;
1865   const char * feature_name, *del_feature_name;
1866   snat_address_t * ap;
1867   snat_static_mapping_t * m;
1868   snat_det_map_t * dm;
1869   nat_outside_fib_t *outside_fib;
1870   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
1871                                                        sw_if_index);
1872
1873   if (sm->out2in_dpo && !is_inside)
1874     return VNET_API_ERROR_UNSUPPORTED;
1875
1876   pool_foreach (i, sm->output_feature_interfaces,
1877   ({
1878     if (i->sw_if_index == sw_if_index)
1879       return VNET_API_ERROR_VALUE_EXIST;
1880   }));
1881
1882   if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
1883     feature_name = is_inside ?  "nat44-in2out-fast" : "nat44-out2in-fast";
1884   else
1885     {
1886       if (sm->num_workers > 1 && !sm->deterministic)
1887         feature_name = is_inside ?  "nat44-in2out-worker-handoff" : "nat44-out2in-worker-handoff";
1888       else if (sm->deterministic)
1889         feature_name = is_inside ?  "nat44-det-in2out" : "nat44-det-out2in";
1890       else if (sm->endpoint_dependent)
1891         feature_name = is_inside ?  "nat44-ed-in2out" : "nat44-ed-out2in";
1892       else
1893         feature_name = is_inside ?  "nat44-in2out" : "nat44-out2in";
1894     }
1895
1896   if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1897     sm->fq_in2out_index = vlib_frame_queue_main_init (sm->in2out_node_index,
1898                                                       NAT_FQ_NELTS);
1899
1900   if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
1901     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index,
1902                                                       NAT_FQ_NELTS);
1903
1904   if (!is_inside)
1905     {
1906       vec_foreach (outside_fib, sm->outside_fibs)
1907         {
1908           if (outside_fib->fib_index == fib_index)
1909             {
1910               if (is_del)
1911                 {
1912                   outside_fib->refcount--;
1913                   if (!outside_fib->refcount)
1914                     vec_del1 (sm->outside_fibs, outside_fib - sm->outside_fibs);
1915                 }
1916               else
1917                 outside_fib->refcount++;
1918               goto feature_set;
1919             }
1920         }
1921       if (!is_del)
1922         {
1923           vec_add2 (sm->outside_fibs, outside_fib, 1);
1924           outside_fib->refcount = 1;
1925           outside_fib->fib_index = fib_index;
1926         }
1927     }
1928 feature_set:
1929   pool_foreach (i, sm->interfaces,
1930   ({
1931     if (i->sw_if_index == sw_if_index)
1932       {
1933         if (is_del)
1934           {
1935             if (nat_interface_is_inside(i) && nat_interface_is_outside(i))
1936               {
1937                 if (is_inside)
1938                   i->flags &= ~NAT_INTERFACE_FLAG_IS_INSIDE;
1939                 else
1940                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
1941
1942                 if (sm->num_workers > 1 && !sm->deterministic)
1943                   {
1944                     del_feature_name = "nat44-handoff-classify";
1945                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
1946                                                  "nat44-out2in-worker-handoff";
1947                   }
1948                 else if (sm->deterministic)
1949                   {
1950                     del_feature_name = "nat44-det-classify";
1951                     feature_name = !is_inside ?  "nat44-det-in2out" :
1952                                                  "nat44-det-out2in";
1953                   }
1954                 else if (sm->endpoint_dependent)
1955                   {
1956                     del_feature_name = "nat44-ed-classify";
1957                     feature_name = !is_inside ?  "nat44-ed-in2out" :
1958                                                  "nat44-ed-out2in";
1959                   }
1960                 else
1961                   {
1962                     del_feature_name = "nat44-classify";
1963                     feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
1964                   }
1965
1966                 vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
1967                                              sw_if_index, 0, 0, 0);
1968                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1969                                              sw_if_index, 1, 0, 0);
1970                 if (!is_inside)
1971                   {
1972                     if (sm->endpoint_dependent)
1973                       vnet_feature_enable_disable ("ip4-local",
1974                                                    "nat44-ed-hairpinning",
1975                                                    sw_if_index, 1, 0, 0);
1976                     else if (!sm->deterministic)
1977                       vnet_feature_enable_disable ("ip4-local",
1978                                                    "nat44-hairpinning",
1979                                                    sw_if_index, 1, 0, 0);
1980                   }
1981               }
1982             else
1983               {
1984                 vnet_feature_enable_disable ("ip4-unicast", feature_name,
1985                                              sw_if_index, 0, 0, 0);
1986                 pool_put (sm->interfaces, i);
1987                 if (is_inside)
1988                   {
1989                     if (sm->endpoint_dependent)
1990                       vnet_feature_enable_disable ("ip4-local",
1991                                                    "nat44-ed-hairpinning",
1992                                                    sw_if_index, 0, 0, 0);
1993                     else if (!sm->deterministic)
1994                       vnet_feature_enable_disable ("ip4-local",
1995                                                    "nat44-hairpinning",
1996                                                    sw_if_index, 0, 0, 0);
1997                   }
1998               }
1999           }
2000         else
2001           {
2002             if ((nat_interface_is_inside(i) && is_inside) ||
2003                 (nat_interface_is_outside(i) && !is_inside))
2004               return 0;
2005
2006             if (sm->num_workers > 1 && !sm->deterministic)
2007               {
2008                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
2009                                                  "nat44-out2in-worker-handoff";
2010                 feature_name = "nat44-handoff-classify";
2011               }
2012             else if (sm->deterministic)
2013               {
2014                 del_feature_name = !is_inside ?  "nat44-det-in2out" :
2015                                                  "nat44-det-out2in";
2016                 feature_name = "nat44-det-classify";
2017               }
2018             else if (sm->endpoint_dependent)
2019               {
2020                 del_feature_name = !is_inside ?  "nat44-ed-in2out" :
2021                                                  "nat44-ed-out2in";
2022                 feature_name = "nat44-ed-classify";
2023               }
2024             else
2025               {
2026                 del_feature_name = !is_inside ?  "nat44-in2out" : "nat44-out2in";
2027                 feature_name = "nat44-classify";
2028               }
2029
2030             vnet_feature_enable_disable ("ip4-unicast", del_feature_name,
2031                                          sw_if_index, 0, 0, 0);
2032             vnet_feature_enable_disable ("ip4-unicast", feature_name,
2033                                          sw_if_index, 1, 0, 0);
2034             if (!is_inside)
2035               {
2036                 if (sm->endpoint_dependent)
2037                   vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
2038                                                sw_if_index, 0, 0, 0);
2039                 else if (!sm->deterministic)
2040                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
2041                                                sw_if_index, 0, 0, 0);
2042               }
2043             goto set_flags;
2044           }
2045
2046         goto fib;
2047       }
2048   }));
2049
2050   if (is_del)
2051     return VNET_API_ERROR_NO_SUCH_ENTRY;
2052
2053   pool_get (sm->interfaces, i);
2054   i->sw_if_index = sw_if_index;
2055   i->flags = 0;
2056   vnet_feature_enable_disable ("ip4-unicast", feature_name, sw_if_index, 1, 0, 0);
2057
2058   if (is_inside && !sm->out2in_dpo)
2059     {
2060       if (sm->endpoint_dependent)
2061         vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
2062                                      sw_if_index, 1, 0, 0);
2063       else if (!sm->deterministic)
2064         vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
2065                                      sw_if_index, 1, 0, 0);
2066     }
2067
2068 set_flags:
2069   if (is_inside)
2070     {
2071       i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
2072       return 0;
2073     }
2074   else
2075     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
2076
2077   /* Add/delete external addresses to FIB */
2078 fib:
2079   vec_foreach (ap, sm->addresses)
2080     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
2081
2082   pool_foreach (m, sm->static_mappings,
2083   ({
2084     if (!(m->addr_only) || (m->local_addr.as_u32 == m->external_addr.as_u32))
2085       continue;
2086
2087     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2088   }));
2089
2090   pool_foreach (dm, sm->det_maps,
2091   ({
2092     snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
2093   }));
2094
2095   return 0;
2096 }
2097
2098 int snat_interface_add_del_output_feature (u32 sw_if_index,
2099                                            u8 is_inside,
2100                                            int is_del)
2101 {
2102   snat_main_t *sm = &snat_main;
2103   snat_interface_t *i;
2104   snat_address_t * ap;
2105   snat_static_mapping_t * m;
2106
2107   if (sm->deterministic ||
2108       (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
2109     return VNET_API_ERROR_UNSUPPORTED;
2110
2111   pool_foreach (i, sm->interfaces,
2112   ({
2113     if (i->sw_if_index == sw_if_index)
2114       return VNET_API_ERROR_VALUE_EXIST;
2115   }));
2116
2117   if (is_inside)
2118     {
2119       if (sm->endpoint_dependent)
2120         {
2121           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-hairpin-dst",
2122                                        sw_if_index, !is_del, 0, 0);
2123           vnet_feature_enable_disable ("ip4-output", "nat44-ed-hairpin-src",
2124                                        sw_if_index, !is_del, 0, 0);
2125         }
2126       else
2127         {
2128           vnet_feature_enable_disable ("ip4-unicast", "nat44-hairpin-dst",
2129                                        sw_if_index, !is_del, 0, 0);
2130           vnet_feature_enable_disable ("ip4-output", "nat44-hairpin-src",
2131                                        sw_if_index, !is_del, 0, 0);
2132         }
2133       goto fq;
2134     }
2135
2136   if (sm->num_workers > 1)
2137     {
2138       vnet_feature_enable_disable ("ip4-unicast",
2139                                    "nat44-out2in-worker-handoff",
2140                                    sw_if_index, !is_del, 0, 0);
2141       vnet_feature_enable_disable ("ip4-output",
2142                                    "nat44-in2out-output-worker-handoff",
2143                                    sw_if_index, !is_del, 0, 0);
2144     }
2145   else
2146     {
2147       if (sm->endpoint_dependent)
2148         {
2149           vnet_feature_enable_disable ("ip4-unicast", "nat44-ed-out2in",
2150                                        sw_if_index, !is_del, 0, 0);
2151           vnet_feature_enable_disable ("ip4-output", "nat44-ed-in2out-output",
2152                                        sw_if_index, !is_del, 0, 0);
2153         }
2154       else
2155         {
2156           vnet_feature_enable_disable ("ip4-unicast", "nat44-out2in",
2157                                        sw_if_index, !is_del, 0, 0);
2158           vnet_feature_enable_disable ("ip4-output", "nat44-in2out-output",
2159                                        sw_if_index, !is_del, 0, 0);
2160         }
2161     }
2162
2163 fq:
2164   if (sm->fq_in2out_output_index == ~0 && sm->num_workers > 1)
2165     sm->fq_in2out_output_index =
2166       vlib_frame_queue_main_init (sm->in2out_output_node_index, 0);
2167
2168   if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
2169     sm->fq_out2in_index = vlib_frame_queue_main_init (sm->out2in_node_index, 0);
2170
2171   pool_foreach (i, sm->output_feature_interfaces,
2172   ({
2173     if (i->sw_if_index == sw_if_index)
2174       {
2175         if (is_del)
2176           pool_put (sm->output_feature_interfaces, i);
2177         else
2178           return VNET_API_ERROR_VALUE_EXIST;
2179
2180         goto fib;
2181       }
2182   }));
2183
2184   if (is_del)
2185     return VNET_API_ERROR_NO_SUCH_ENTRY;
2186
2187   pool_get (sm->output_feature_interfaces, i);
2188   i->sw_if_index = sw_if_index;
2189   i->flags = 0;
2190   if (is_inside)
2191     i->flags |= NAT_INTERFACE_FLAG_IS_INSIDE;
2192   else
2193     i->flags |= NAT_INTERFACE_FLAG_IS_OUTSIDE;
2194
2195   /* Add/delete external addresses to FIB */
2196 fib:
2197   if (is_inside)
2198     return 0;
2199
2200   vec_foreach (ap, sm->addresses)
2201     snat_add_del_addr_to_fib(&ap->addr, 32, sw_if_index, !is_del);
2202
2203   pool_foreach (m, sm->static_mappings,
2204   ({
2205     if (!(m->addr_only)  || (m->local_addr.as_u32 == m->external_addr.as_u32))
2206       continue;
2207
2208     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
2209   }));
2210
2211   return 0;
2212 }
2213
2214 int snat_set_workers (uword * bitmap)
2215 {
2216   snat_main_t *sm = &snat_main;
2217   int i, j = 0;
2218
2219   if (sm->num_workers < 2)
2220     return VNET_API_ERROR_FEATURE_DISABLED;
2221
2222   if (clib_bitmap_last_set (bitmap) >= sm->num_workers)
2223     return VNET_API_ERROR_INVALID_WORKER;
2224
2225   vec_free (sm->workers);
2226   clib_bitmap_foreach (i, bitmap,
2227     ({
2228       vec_add1(sm->workers, i);
2229       sm->per_thread_data[sm->first_worker_index + i].snat_thread_index = j;
2230       j++;
2231     }));
2232
2233   sm->port_per_thread = (0xffff - 1024) / _vec_len (sm->workers);
2234   sm->num_snat_thread = _vec_len (sm->workers);
2235
2236   return 0;
2237 }
2238
2239
2240 static void
2241 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
2242                                        uword opaque,
2243                                        u32 sw_if_index,
2244                                        ip4_address_t * address,
2245                                        u32 address_length,
2246                                        u32 if_address_index,
2247                                        u32 is_delete);
2248
2249 static void
2250 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
2251                                  uword opaque,
2252                                  u32 sw_if_index,
2253                                  ip4_address_t * address,
2254                                  u32 address_length,
2255                                  u32 if_address_index,
2256                                  u32 is_delete);
2257
2258 static int
2259 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2260                                  u32 fib_index,
2261                                  u32 thread_index,
2262                                  snat_session_key_t * k,
2263                                  u32 * address_indexp,
2264                                  u16 port_per_thread,
2265                                  u32 snat_thread_index);
2266
2267 static clib_error_t * snat_init (vlib_main_t * vm)
2268 {
2269   snat_main_t * sm = &snat_main;
2270   clib_error_t * error = 0;
2271   ip4_main_t * im = &ip4_main;
2272   ip_lookup_main_t * lm = &im->lookup_main;
2273   uword *p;
2274   vlib_thread_registration_t *tr;
2275   vlib_thread_main_t *tm = vlib_get_thread_main ();
2276   uword *bitmap = 0;
2277   u32 i;
2278   ip4_add_del_interface_address_callback_t cb4;
2279   vlib_node_t * error_drop_node;
2280
2281   sm->vlib_main = vm;
2282   sm->vnet_main = vnet_get_main();
2283   sm->ip4_main = im;
2284   sm->ip4_lookup_main = lm;
2285   sm->api_main = &api_main;
2286   sm->first_worker_index = 0;
2287   sm->num_workers = 0;
2288   sm->num_snat_thread = 1;
2289   sm->workers = 0;
2290   sm->port_per_thread = 0xffff - 1024;
2291   sm->fq_in2out_index = ~0;
2292   sm->fq_out2in_index = ~0;
2293   sm->udp_timeout = SNAT_UDP_TIMEOUT;
2294   sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
2295   sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
2296   sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
2297   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
2298   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
2299   sm->forwarding_enabled = 0;
2300   sm->log_class = vlib_log_register_class ("nat", 0);
2301   error_drop_node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
2302   sm->error_node_index = error_drop_node->index;
2303   sm->mss_clamping = 0;
2304
2305   p = hash_get_mem (tm->thread_registrations_by_name, "workers");
2306   if (p)
2307     {
2308       tr = (vlib_thread_registration_t *) p[0];
2309       if (tr)
2310         {
2311           sm->num_workers = tr->count;
2312           sm->first_worker_index = tr->first_index;
2313         }
2314     }
2315
2316   vec_validate (sm->per_thread_data, tm->n_vlib_mains - 1);
2317
2318   /* Use all available workers by default */
2319   if (sm->num_workers > 1)
2320     {
2321       for (i=0; i < sm->num_workers; i++)
2322         bitmap = clib_bitmap_set (bitmap, i, 1);
2323       snat_set_workers(bitmap);
2324       clib_bitmap_free (bitmap);
2325     }
2326   else
2327     {
2328       sm->per_thread_data[0].snat_thread_index = 0;
2329     }
2330
2331   error = snat_api_init(vm, sm);
2332   if (error)
2333     return error;
2334
2335   /* Set up the interface address add/del callback */
2336   cb4.function = snat_ip4_add_del_interface_address_cb;
2337   cb4.function_opaque = 0;
2338
2339   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2340
2341   cb4.function = nat_ip4_add_del_addr_only_sm_cb;
2342   cb4.function_opaque = 0;
2343
2344   vec_add1 (im->add_del_interface_address_callbacks, cb4);
2345
2346   nat_dpo_module_init ();
2347
2348   /* Init IPFIX logging */
2349   snat_ipfix_logging_init(vm);
2350
2351   /* Init NAT64 */
2352   error = nat64_init(vm);
2353   if (error)
2354     return error;
2355
2356   dslite_init(vm);
2357
2358   nat66_init();
2359
2360   /* Init virtual fragmenentation reassembly */
2361   return nat_reass_init(vm);
2362 }
2363
2364 VLIB_INIT_FUNCTION (snat_init);
2365
2366 void snat_free_outside_address_and_port (snat_address_t * addresses,
2367                                          u32 thread_index,
2368                                          snat_session_key_t * k)
2369 {
2370   snat_address_t *a;
2371   u32 address_index;
2372   u16 port_host_byte_order = clib_net_to_host_u16 (k->port);
2373
2374   for (address_index = 0; address_index < vec_len (addresses); address_index++)
2375     {
2376       if (addresses[address_index].addr.as_u32 == k->addr.as_u32)
2377         break;
2378     }
2379
2380   ASSERT (address_index < vec_len (addresses));
2381
2382   a = addresses + address_index;
2383
2384   switch (k->protocol)
2385     {
2386 #define _(N, i, n, s) \
2387     case SNAT_PROTOCOL_##N: \
2388       ASSERT (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, \
2389         port_host_byte_order) == 1); \
2390       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, \
2391         port_host_byte_order, 0); \
2392       a->busy_##n##_ports--; \
2393       a->busy_##n##_ports_per_thread[thread_index]--; \
2394       break;
2395       foreach_snat_protocol
2396 #undef _
2397     default:
2398       nat_log_info ("unknown protocol");
2399       return;
2400     }
2401 }
2402
2403 /**
2404  * @brief Match NAT44 static mapping.
2405  *
2406  * @param sm          NAT main.
2407  * @param match       Address and port to match.
2408  * @param mapping     External or local address and port of the matched mapping.
2409  * @param by_external If 0 match by local address otherwise match by external
2410  *                    address.
2411  * @param is_addr_only If matched mapping is address only
2412  * @param twice_nat If matched mapping is twice NAT.
2413  * @param lb If matched mapping is load-balanced.
2414  *
2415  * @returns 0 if match found otherwise 1.
2416  */
2417 int snat_static_mapping_match (snat_main_t * sm,
2418                                snat_session_key_t match,
2419                                snat_session_key_t * mapping,
2420                                u8 by_external,
2421                                u8 *is_addr_only,
2422                                twice_nat_type_t *twice_nat,
2423                                lb_nat_type_t *lb,
2424                                ip4_address_t * ext_host_addr)
2425 {
2426   clib_bihash_kv_8_8_t kv, value;
2427   snat_static_mapping_t *m;
2428   snat_session_key_t m_key;
2429   clib_bihash_8_8_t *mapping_hash = &sm->static_mapping_by_local;
2430   u32 rand, lo = 0, hi, mid;
2431   u8 backend_index;
2432
2433   m_key.fib_index = match.fib_index;
2434   if (by_external)
2435     {
2436       mapping_hash = &sm->static_mapping_by_external;
2437       m_key.fib_index = 0;
2438     }
2439
2440   m_key.addr = match.addr;
2441   m_key.port = clib_net_to_host_u16 (match.port);
2442   m_key.protocol = match.protocol;
2443
2444   kv.key = m_key.as_u64;
2445
2446   if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2447     {
2448       /* Try address only mapping */
2449       m_key.port = 0;
2450       m_key.protocol = 0;
2451       kv.key = m_key.as_u64;
2452       if (clib_bihash_search_8_8 (mapping_hash, &kv, &value))
2453         return 1;
2454     }
2455
2456   m = pool_elt_at_index (sm->static_mappings, value.value);
2457
2458   if (by_external)
2459     {
2460       if (vec_len (m->locals))
2461         {
2462           if (PREDICT_FALSE(lb != 0))
2463             *lb = m->affinity ? AFFINITY_LB_NAT : LB_NAT;
2464           if (m->affinity)
2465             {
2466               if (nat_affinity_find_and_lock (ext_host_addr[0], match.addr,
2467                   match.protocol, match.port, &backend_index))
2468                 goto get_local;
2469
2470               mapping->addr = m->locals[backend_index].addr;
2471               mapping->port = clib_host_to_net_u16 (m->locals[backend_index].port);
2472               mapping->fib_index = m->locals[backend_index].fib_index;
2473               goto end;
2474             }
2475 get_local:
2476           hi = vec_len (m->locals) - 1;
2477           rand = 1 + (random_u32 (&sm->random_seed) % m->locals[hi].prefix);
2478           while (lo < hi)
2479             {
2480               mid = ((hi - lo) >> 1) + lo;
2481               (rand > m->locals[mid].prefix) ? (lo = mid + 1) : (hi = mid);
2482             }
2483           if (!(m->locals[lo].prefix >= rand))
2484             return 1;
2485           if (PREDICT_FALSE (sm->num_workers > 1))
2486             {
2487               ip4_header_t ip = {
2488                 .src_address = m->locals[lo].addr,
2489               };
2490               if (sm->worker_in2out_cb (&ip, m->fib_index) != vlib_get_thread_index ())
2491                 goto get_local;
2492             }
2493           mapping->addr = m->locals[lo].addr;
2494           mapping->port = clib_host_to_net_u16 (m->locals[lo].port);
2495           mapping->fib_index = m->locals[lo].fib_index;
2496           if (m->affinity)
2497             {
2498               if (nat_affinity_create_and_lock (ext_host_addr[0], match.addr,
2499                   match.protocol, match.port, lo, m->affinity,
2500                   m->affinity_per_service_list_head_index))
2501                 nat_log_info ("create affinity record failed");
2502             }
2503         }
2504       else
2505         {
2506           if (PREDICT_FALSE(lb != 0))
2507             *lb = NO_LB_NAT;
2508           mapping->fib_index = m->fib_index;
2509           mapping->addr = m->local_addr;
2510           /* Address only mapping doesn't change port */
2511           mapping->port = m->addr_only ? match.port
2512             : clib_host_to_net_u16 (m->local_port);
2513         }
2514       mapping->protocol = m->proto;
2515     }
2516   else
2517     {
2518       mapping->addr = m->external_addr;
2519       /* Address only mapping doesn't change port */
2520       mapping->port = m->addr_only ? match.port
2521         : clib_host_to_net_u16 (m->external_port);
2522       mapping->fib_index = sm->outside_fib_index;
2523     }
2524
2525 end:
2526   if (PREDICT_FALSE(is_addr_only != 0))
2527     *is_addr_only = m->addr_only;
2528
2529   if (PREDICT_FALSE(twice_nat != 0))
2530     *twice_nat = m->twice_nat;
2531
2532   return 0;
2533 }
2534
2535 static_always_inline u16
2536 snat_random_port (u16 min, u16 max)
2537 {
2538   snat_main_t *sm = &snat_main;
2539   return min + random_u32 (&sm->random_seed) /
2540     (random_u32_max() / (max - min + 1) + 1);
2541 }
2542
2543 int
2544 snat_alloc_outside_address_and_port (snat_address_t * addresses,
2545                                      u32 fib_index,
2546                                      u32 thread_index,
2547                                      snat_session_key_t * k,
2548                                      u32 * address_indexp,
2549                                      u16 port_per_thread,
2550                                      u32 snat_thread_index)
2551 {
2552   snat_main_t *sm = &snat_main;
2553
2554   return sm->alloc_addr_and_port(addresses, fib_index, thread_index, k,
2555                                  address_indexp, port_per_thread,
2556                                  snat_thread_index);
2557 }
2558
2559 static int
2560 nat_alloc_addr_and_port_default (snat_address_t * addresses,
2561                                  u32 fib_index,
2562                                  u32 thread_index,
2563                                  snat_session_key_t * k,
2564                                  u32 * address_indexp,
2565                                  u16 port_per_thread,
2566                                  u32 snat_thread_index)
2567 {
2568   int i, gi = 0;
2569   snat_address_t *a, *ga = 0;
2570   u32 portnum;
2571
2572   for (i = 0; i < vec_len (addresses); i++)
2573     {
2574       a = addresses + i;
2575       switch (k->protocol)
2576         {
2577 #define _(N, j, n, s) \
2578         case SNAT_PROTOCOL_##N: \
2579           if (a->busy_##n##_ports_per_thread[thread_index] < port_per_thread) \
2580             { \
2581               if (a->fib_index == fib_index) \
2582                 { \
2583                   while (1) \
2584                     { \
2585                       portnum = (port_per_thread * \
2586                         snat_thread_index) + \
2587                         snat_random_port(1, port_per_thread) + 1024; \
2588                       if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2589                         continue; \
2590                       clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2591                       a->busy_##n##_ports_per_thread[thread_index]++; \
2592                       a->busy_##n##_ports++; \
2593                       k->addr = a->addr; \
2594                       k->port = clib_host_to_net_u16(portnum); \
2595                       *address_indexp = i; \
2596                       return 0; \
2597                     } \
2598                 } \
2599               else if (a->fib_index == ~0) \
2600                 { \
2601                   ga = a; \
2602                   gi = i; \
2603                 } \
2604             } \
2605           break;
2606           foreach_snat_protocol
2607 #undef _
2608         default:
2609           nat_log_info ("unknown protocol");
2610           return 1;
2611         }
2612
2613     }
2614
2615   if (ga)
2616     {
2617       a = ga;
2618       switch (k->protocol)
2619         {
2620 #define _(N, j, n, s) \
2621         case SNAT_PROTOCOL_##N: \
2622           while (1) \
2623             { \
2624               portnum = (port_per_thread * \
2625                 snat_thread_index) + \
2626                 snat_random_port(1, port_per_thread) + 1024; \
2627               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2628                 continue; \
2629               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2630               a->busy_##n##_ports_per_thread[thread_index]++; \
2631               a->busy_##n##_ports++; \
2632               k->addr = a->addr; \
2633               k->port = clib_host_to_net_u16(portnum); \
2634               *address_indexp = gi; \
2635               return 0; \
2636             }
2637           break;
2638           foreach_snat_protocol
2639 #undef _
2640         default:
2641           nat_log_info ("unknown protocol");
2642           return 1;
2643         }
2644     }
2645
2646   /* Totally out of translations to use... */
2647   snat_ipfix_logging_addresses_exhausted(0);
2648   return 1;
2649 }
2650
2651 static int
2652 nat_alloc_addr_and_port_mape (snat_address_t * addresses,
2653                               u32 fib_index,
2654                               u32 thread_index,
2655                               snat_session_key_t * k,
2656                               u32 * address_indexp,
2657                               u16 port_per_thread,
2658                               u32 snat_thread_index)
2659 {
2660   snat_main_t *sm = &snat_main;
2661   snat_address_t *a = addresses;
2662   u16 m, ports, portnum, A, j;
2663   m = 16 - (sm->psid_offset + sm->psid_length);
2664   ports = (1 << (16 - sm->psid_length)) - (1 << m);
2665
2666   if (!vec_len (addresses))
2667     goto exhausted;
2668
2669   switch (k->protocol)
2670     {
2671 #define _(N, i, n, s) \
2672     case SNAT_PROTOCOL_##N: \
2673       if (a->busy_##n##_ports < ports) \
2674         { \
2675           while (1) \
2676             { \
2677               A = snat_random_port(1, pow2_mask(sm->psid_offset)); \
2678               j = snat_random_port(0, pow2_mask(m)); \
2679               portnum = A | (sm->psid << sm->psid_offset) | (j << (16 - m)); \
2680               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2681                 continue; \
2682               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2683               a->busy_##n##_ports++; \
2684               k->addr = a->addr; \
2685               k->port = clib_host_to_net_u16 (portnum); \
2686               *address_indexp = i; \
2687               return 0; \
2688             } \
2689         } \
2690       break;
2691       foreach_snat_protocol
2692 #undef _
2693     default:
2694       nat_log_info ("unknown protocol");
2695       return 1;
2696     }
2697
2698 exhausted:
2699   /* Totally out of translations to use... */
2700   snat_ipfix_logging_addresses_exhausted(0);
2701   return 1;
2702 }
2703
2704 static int
2705 nat_alloc_addr_and_port_range (snat_address_t * addresses,
2706                                u32 fib_index,
2707                                u32 thread_index,
2708                                snat_session_key_t * k,
2709                                u32 * address_indexp,
2710                                u16 port_per_thread,
2711                                u32 snat_thread_index)
2712 {
2713   snat_main_t *sm = &snat_main;
2714   snat_address_t *a = addresses;
2715   u16 portnum, ports;
2716
2717   ports = sm->end_port - sm->start_port + 1;
2718
2719   if (!vec_len (addresses))
2720     goto exhausted;
2721
2722   switch (k->protocol)
2723     {
2724 #define _(N, i, n, s) \
2725     case SNAT_PROTOCOL_##N: \
2726       if (a->busy_##n##_ports < ports) \
2727         { \
2728           while (1) \
2729             { \
2730               portnum = snat_random_port(sm->start_port, sm->end_port); \
2731               if (clib_bitmap_get_no_check (a->busy_##n##_port_bitmap, portnum)) \
2732                 continue; \
2733               clib_bitmap_set_no_check (a->busy_##n##_port_bitmap, portnum, 1); \
2734               a->busy_##n##_ports++; \
2735               k->addr = a->addr; \
2736               k->port = clib_host_to_net_u16 (portnum); \
2737               *address_indexp = i; \
2738               return 0; \
2739             } \
2740         } \
2741       break;
2742       foreach_snat_protocol
2743 #undef _
2744     default:
2745       nat_log_info ("unknown protocol");
2746       return 1;
2747     }
2748
2749 exhausted:
2750   /* Totally out of translations to use... */
2751   snat_ipfix_logging_addresses_exhausted(0);
2752   return 1;
2753 }
2754
2755 void
2756 nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add)
2757 {
2758   dpo_id_t dpo_v4 = DPO_INVALID;
2759   fib_prefix_t pfx = {
2760     .fp_proto = FIB_PROTOCOL_IP4,
2761     .fp_len = 32,
2762     .fp_addr.ip4.as_u32 = addr.as_u32,
2763   };
2764
2765   if (is_add)
2766     {
2767       nat_dpo_create (DPO_PROTO_IP4, 0, &dpo_v4);
2768       fib_table_entry_special_dpo_add (0, &pfx, FIB_SOURCE_PLUGIN_HI,
2769                                        FIB_ENTRY_FLAG_EXCLUSIVE, &dpo_v4);
2770       dpo_reset (&dpo_v4);
2771     }
2772   else
2773     {
2774       fib_table_entry_special_remove (0, &pfx, FIB_SOURCE_PLUGIN_HI);
2775     }
2776 }
2777
2778 uword
2779 unformat_snat_protocol (unformat_input_t * input, va_list * args)
2780 {
2781   u32 *r = va_arg (*args, u32 *);
2782
2783   if (0);
2784 #define _(N, i, n, s) else if (unformat (input, s)) *r = SNAT_PROTOCOL_##N;
2785   foreach_snat_protocol
2786 #undef _
2787   else
2788     return 0;
2789   return 1;
2790 }
2791
2792 u8 *
2793 format_snat_protocol (u8 * s, va_list * args)
2794 {
2795   u32 i = va_arg (*args, u32);
2796   u8 *t = 0;
2797
2798   switch (i)
2799     {
2800 #define _(N, j, n, str) case SNAT_PROTOCOL_##N: t = (u8 *) str; break;
2801       foreach_snat_protocol
2802 #undef _
2803     default:
2804       s = format (s, "unknown");
2805       return s;
2806     }
2807   s = format (s, "%s", t);
2808   return s;
2809 }
2810
2811 u8 *
2812 format_nat_addr_and_port_alloc_alg (u8 * s, va_list * args)
2813 {
2814   u32 i = va_arg (*args, u32);
2815   u8 *t = 0;
2816
2817   switch (i)
2818     {
2819 #define _(v, N, s) case NAT_ADDR_AND_PORT_ALLOC_ALG_##N: t = (u8 *) s; break;
2820       foreach_nat_addr_and_port_alloc_alg
2821 #undef _
2822     default:
2823       s = format (s, "unknown");
2824       return s;
2825     }
2826   s = format (s, "%s", t);
2827   return s;
2828 }
2829
2830 u8 * format_snat_key (u8 * s, va_list * args);
2831 u8 * format_static_mapping_key (u8 * s, va_list * args);
2832
2833 u8 *
2834 format_session_kvp (u8 * s, va_list * args)
2835 {
2836   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2837   snat_session_key_t k;
2838
2839   k.as_u64 = v->key;
2840
2841   s = format (s, "%U session-index %llu", format_snat_key, &k, v->value);
2842
2843   return s;
2844 }
2845
2846 u8 *
2847 format_static_mapping_kvp (u8 * s, va_list * args)
2848 {
2849   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2850   snat_session_key_t k;
2851
2852   k.as_u64 = v->key;
2853
2854   s = format (s, "%U static-mapping-index %llu",
2855               format_static_mapping_key, &k, v->value);
2856
2857   return s;
2858 }
2859
2860 u8 *
2861 format_user_kvp (u8 * s, va_list * args)
2862 {
2863   clib_bihash_kv_8_8_t *v = va_arg (*args, clib_bihash_kv_8_8_t *);
2864   snat_user_key_t k;
2865
2866   k.as_u64 = v->key;
2867
2868   s = format (s, "%U fib %d user-index %llu", format_ip4_address, &k.addr,
2869               k.fib_index, v->value);
2870
2871   return s;
2872 }
2873
2874 u8 *
2875 format_ed_session_kvp (u8 * s, va_list * args)
2876 {
2877   clib_bihash_kv_16_8_t *v = va_arg (*args, clib_bihash_kv_16_8_t *);
2878   nat_ed_ses_key_t k;
2879
2880   k.as_u64[0] = v->key[0];
2881   k.as_u64[1] = v->key[1];
2882
2883   s = format (s, "local %U:%d remote %U:%d proto %U fib %d session-index %llu",
2884               format_ip4_address, &k.l_addr, clib_net_to_host_u16 (k.l_port),
2885               format_ip4_address, &k.r_addr, clib_net_to_host_u16 (k.r_port),
2886               format_ip_protocol, k.proto, k.fib_index, v->value);
2887
2888   return s;
2889 }
2890
2891 static u32
2892 snat_get_worker_in2out_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2893 {
2894   snat_main_t *sm = &snat_main;
2895   u32 next_worker_index = 0;
2896   u32 hash;
2897
2898   next_worker_index = sm->first_worker_index;
2899   hash = ip0->src_address.as_u32 + (ip0->src_address.as_u32 >> 8) +
2900          (ip0->src_address.as_u32 >> 16) + (ip0->src_address.as_u32 >>24);
2901
2902   if (PREDICT_TRUE (is_pow2 (_vec_len (sm->workers))))
2903     next_worker_index += sm->workers[hash & (_vec_len (sm->workers) - 1)];
2904   else
2905     next_worker_index += sm->workers[hash % _vec_len (sm->workers)];
2906
2907   return next_worker_index;
2908 }
2909
2910 static u32
2911 snat_get_worker_out2in_cb (ip4_header_t * ip0, u32 rx_fib_index0)
2912 {
2913   snat_main_t *sm = &snat_main;
2914   udp_header_t *udp;
2915   u16 port;
2916   snat_session_key_t m_key;
2917   clib_bihash_kv_8_8_t kv, value;
2918   snat_static_mapping_t *m;
2919   u32 proto;
2920   u32 next_worker_index = 0;
2921
2922   /* first try static mappings without port */
2923   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2924     {
2925       m_key.addr = ip0->dst_address;
2926       m_key.port = 0;
2927       m_key.protocol = 0;
2928       m_key.fib_index = rx_fib_index0;
2929       kv.key = m_key.as_u64;
2930       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
2931         {
2932           m = pool_elt_at_index (sm->static_mappings, value.value);
2933           return m->workers[0];
2934         }
2935     }
2936
2937   proto = ip_proto_to_snat_proto (ip0->protocol);
2938   udp = ip4_next_header (ip0);
2939   port = udp->dst_port;
2940
2941   if (PREDICT_FALSE (ip4_is_fragment (ip0)))
2942     {
2943       if (PREDICT_FALSE (nat_reass_is_drop_frag (0)))
2944         return vlib_get_thread_index ();
2945
2946       if (PREDICT_TRUE (!ip4_is_first_fragment (ip0)))
2947         {
2948           nat_reass_ip4_t *reass;
2949
2950           reass = nat_ip4_reass_find (ip0->src_address, ip0->dst_address,
2951                                       ip0->fragment_id, ip0->protocol);
2952
2953           if (reass && (reass->thread_index != (u32) ~ 0))
2954             return reass->thread_index;
2955           else
2956             return vlib_get_thread_index ();
2957         }
2958     }
2959
2960   /* unknown protocol */
2961   if (PREDICT_FALSE (proto == ~0))
2962     {
2963       /* use current thread */
2964       return vlib_get_thread_index ();
2965     }
2966
2967   if (PREDICT_FALSE (ip0->protocol == IP_PROTOCOL_ICMP))
2968     {
2969       icmp46_header_t * icmp = (icmp46_header_t *) udp;
2970       icmp_echo_header_t *echo = (icmp_echo_header_t *)(icmp + 1);
2971       if (!icmp_is_error_message (icmp))
2972         port = echo->identifier;
2973       else
2974         {
2975           ip4_header_t *inner_ip = (ip4_header_t *)(echo + 1);
2976           proto = ip_proto_to_snat_proto (inner_ip->protocol);
2977           void *l4_header = ip4_next_header (inner_ip);
2978           switch (proto)
2979             {
2980             case SNAT_PROTOCOL_ICMP:
2981               icmp = (icmp46_header_t*)l4_header;
2982               echo = (icmp_echo_header_t *)(icmp + 1);
2983               port = echo->identifier;
2984               break;
2985             case SNAT_PROTOCOL_UDP:
2986             case SNAT_PROTOCOL_TCP:
2987               port = ((tcp_udp_header_t*)l4_header)->src_port;
2988               break;
2989             default:
2990               return vlib_get_thread_index ();
2991             }
2992         }
2993     }
2994
2995   /* try static mappings with port */
2996   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
2997     {
2998       m_key.addr = ip0->dst_address;
2999       m_key.port = clib_net_to_host_u16 (port);
3000       m_key.protocol = proto;
3001       m_key.fib_index = rx_fib_index0;
3002       kv.key = m_key.as_u64;
3003       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
3004         {
3005           m = pool_elt_at_index (sm->static_mappings, value.value);
3006           return m->workers[0];
3007         }
3008     }
3009
3010   /* worker by outside port */
3011   next_worker_index = sm->first_worker_index;
3012   next_worker_index +=
3013     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
3014   return next_worker_index;
3015 }
3016
3017 static u32
3018 nat44_ed_get_worker_out2in_cb (ip4_header_t * ip, u32 rx_fib_index)
3019 {
3020   snat_main_t *sm = &snat_main;
3021   clib_bihash_kv_8_8_t kv, value;
3022   u32 proto, next_worker_index = 0;
3023   udp_header_t *udp;
3024   u16 port;
3025   snat_static_mapping_t *m;
3026   u32 hash;
3027
3028   /* first try static mappings without port */
3029   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
3030     {
3031       make_sm_kv (&kv, &ip->dst_address, 0, rx_fib_index, 0);
3032       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
3033         {
3034           m = pool_elt_at_index (sm->static_mappings, value.value);
3035           return m->workers[0];
3036         }
3037     }
3038
3039   proto = ip_proto_to_snat_proto (ip->protocol);
3040
3041   /* unknown protocol */
3042   if (PREDICT_FALSE (proto == ~0))
3043     {
3044       /* use current thread */
3045       return vlib_get_thread_index ();
3046     }
3047
3048   udp = ip4_next_header (ip);
3049   port = udp->dst_port;
3050
3051   if (PREDICT_FALSE (ip->protocol == IP_PROTOCOL_ICMP))
3052     {
3053       icmp46_header_t * icmp = (icmp46_header_t *) udp;
3054       icmp_echo_header_t *echo = (icmp_echo_header_t *)(icmp + 1);
3055       if (!icmp_is_error_message (icmp))
3056         port = echo->identifier;
3057       else
3058         {
3059           ip4_header_t *inner_ip = (ip4_header_t *)(echo + 1);
3060           proto = ip_proto_to_snat_proto (inner_ip->protocol);
3061           void *l4_header = ip4_next_header (inner_ip);
3062           switch (proto)
3063             {
3064             case SNAT_PROTOCOL_ICMP:
3065               icmp = (icmp46_header_t*)l4_header;
3066               echo = (icmp_echo_header_t *)(icmp + 1);
3067               port = echo->identifier;
3068               break;
3069             case SNAT_PROTOCOL_UDP:
3070             case SNAT_PROTOCOL_TCP:
3071               port = ((tcp_udp_header_t*)l4_header)->src_port;
3072               break;
3073             default:
3074               return vlib_get_thread_index ();
3075             }
3076         }
3077     }
3078
3079   /* try static mappings with port */
3080   if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
3081     {
3082       make_sm_kv (&kv, &ip->dst_address, proto, rx_fib_index,
3083                   clib_net_to_host_u16 (port));
3084       if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
3085         {
3086           m = pool_elt_at_index (sm->static_mappings, value.value);
3087           if (!vec_len(m->locals))
3088             return m->workers[0];
3089
3090           hash = ip->src_address.as_u32 + (ip->src_address.as_u32 >> 8) +
3091                  (ip->src_address.as_u32 >> 16) + (ip->src_address.as_u32 >>24);
3092
3093           if (PREDICT_TRUE (is_pow2 (_vec_len (m->workers))))
3094             return m->workers[hash & (_vec_len (m->workers) - 1)];
3095           else
3096             return m->workers[hash % _vec_len (m->workers)];
3097         }
3098     }
3099
3100   /* worker by outside port */
3101   next_worker_index = sm->first_worker_index;
3102   next_worker_index +=
3103     sm->workers[(clib_net_to_host_u16 (port) - 1024) / sm->port_per_thread];
3104
3105   return next_worker_index;
3106 }
3107
3108 static clib_error_t *
3109 snat_config (vlib_main_t * vm, unformat_input_t * input)
3110 {
3111   snat_main_t * sm = &snat_main;
3112   nat66_main_t * nm = &nat66_main;
3113   u32 translation_buckets = 1024;
3114   u32 translation_memory_size = 128<<20;
3115   u32 user_buckets = 128;
3116   u32 user_memory_size = 64<<20;
3117   u32 max_translations_per_user = 100;
3118   u32 outside_vrf_id = 0;
3119   u32 outside_ip6_vrf_id = 0;
3120   u32 inside_vrf_id = 0;
3121   u32 static_mapping_buckets = 1024;
3122   u32 static_mapping_memory_size = 64<<20;
3123   u32 nat64_bib_buckets = 1024;
3124   u32 nat64_bib_memory_size = 128 << 20;
3125   u32 nat64_st_buckets = 2048;
3126   u32 nat64_st_memory_size = 256 << 20;
3127   u8 static_mapping_only = 0;
3128   u8 static_mapping_connection_tracking = 0;
3129   snat_main_per_thread_data_t *tsm;
3130   dslite_main_t * dm = &dslite_main;
3131
3132   sm->deterministic = 0;
3133   sm->out2in_dpo = 0;
3134   sm->endpoint_dependent = 0;
3135
3136   while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
3137     {
3138       if (unformat (input, "translation hash buckets %d", &translation_buckets))
3139         ;
3140       else if (unformat (input, "translation hash memory %d",
3141                          &translation_memory_size));
3142       else if (unformat (input, "user hash buckets %d", &user_buckets))
3143         ;
3144       else if (unformat (input, "user hash memory %d",
3145                          &user_memory_size))
3146         ;
3147       else if (unformat (input, "max translations per user %d",
3148                          &max_translations_per_user))
3149         ;
3150       else if (unformat (input, "outside VRF id %d",
3151                          &outside_vrf_id))
3152         ;
3153       else if (unformat (input, "outside ip6 VRF id %d",
3154                          &outside_ip6_vrf_id))
3155         ;
3156       else if (unformat (input, "inside VRF id %d",
3157                          &inside_vrf_id))
3158         ;
3159       else if (unformat (input, "static mapping only"))
3160         {
3161           static_mapping_only = 1;
3162           if (unformat (input, "connection tracking"))
3163             static_mapping_connection_tracking = 1;
3164         }
3165       else if (unformat (input, "deterministic"))
3166         sm->deterministic = 1;
3167       else if (unformat (input, "nat64 bib hash buckets %d",
3168                          &nat64_bib_buckets))
3169         ;
3170       else if (unformat (input, "nat64 bib hash memory %d",
3171                          &nat64_bib_memory_size))
3172         ;
3173       else if (unformat (input, "nat64 st hash buckets %d", &nat64_st_buckets))
3174         ;
3175       else if (unformat (input, "nat64 st hash memory %d",
3176                          &nat64_st_memory_size))
3177         ;
3178       else if (unformat (input, "out2in dpo"))
3179         sm->out2in_dpo = 1;
3180       else if (unformat (input, "dslite ce"))
3181         dslite_set_ce(dm, 1);
3182       else if (unformat (input, "endpoint-dependent"))
3183         sm->endpoint_dependent = 1;
3184       else
3185         return clib_error_return (0, "unknown input '%U'",
3186                                   format_unformat_error, input);
3187     }
3188
3189   if (sm->deterministic && sm->endpoint_dependent)
3190     return clib_error_return (
3191       0, "deterministic and endpoint-dependent modes are mutually exclusive");
3192
3193   if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent))
3194     return clib_error_return (
3195       0, "static mapping only mode available only for simple nat");
3196
3197   if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent))
3198     return clib_error_return (
3199       0, "out2in dpo mode available only for simple nat");
3200
3201   /* for show commands, etc. */
3202   sm->translation_buckets = translation_buckets;
3203   sm->translation_memory_size = translation_memory_size;
3204   /* do not exceed load factor 10 */
3205   sm->max_translations = 10 * translation_buckets;
3206   sm->user_buckets = user_buckets;
3207   sm->user_memory_size = user_memory_size;
3208   sm->max_translations_per_user = max_translations_per_user;
3209   sm->outside_vrf_id = outside_vrf_id;
3210   sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3211                                                              outside_vrf_id,
3212                                                              FIB_SOURCE_PLUGIN_HI);
3213   nm->outside_vrf_id = outside_ip6_vrf_id;
3214   nm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP6,
3215                                                              outside_ip6_vrf_id,
3216                                                              FIB_SOURCE_PLUGIN_HI);
3217   sm->inside_vrf_id = inside_vrf_id;
3218   sm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
3219                                                             inside_vrf_id,
3220                                                             FIB_SOURCE_PLUGIN_HI);
3221   sm->static_mapping_only = static_mapping_only;
3222   sm->static_mapping_connection_tracking = static_mapping_connection_tracking;
3223
3224   nat64_set_hash(nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
3225                  nat64_st_memory_size);
3226
3227   if (sm->deterministic)
3228     {
3229       sm->in2out_node_index = snat_det_in2out_node.index;
3230       sm->in2out_output_node_index = ~0;
3231       sm->out2in_node_index = snat_det_out2in_node.index;
3232       sm->icmp_match_in2out_cb = icmp_match_in2out_det;
3233       sm->icmp_match_out2in_cb = icmp_match_out2in_det;
3234     }
3235   else
3236     {
3237       if (sm->endpoint_dependent)
3238         {
3239           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
3240           sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
3241           sm->in2out_node_index = nat44_ed_in2out_node.index;
3242           sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
3243           sm->out2in_node_index = nat44_ed_out2in_node.index;
3244           sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
3245           sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
3246           nat_affinity_init (vm);
3247         }
3248       else
3249         {
3250           sm->worker_in2out_cb = snat_get_worker_in2out_cb;
3251           sm->worker_out2in_cb = snat_get_worker_out2in_cb;
3252           sm->in2out_node_index = snat_in2out_node.index;
3253           sm->in2out_output_node_index = snat_in2out_output_node.index;
3254           sm->out2in_node_index = snat_out2in_node.index;
3255           sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
3256           sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
3257         }
3258       if (!static_mapping_only ||
3259           (static_mapping_only && static_mapping_connection_tracking))
3260         {
3261           vec_foreach (tsm, sm->per_thread_data)
3262             {
3263               if (sm->endpoint_dependent)
3264                 {
3265                   clib_bihash_init_16_8 (&tsm->in2out_ed, "in2out-ed",
3266                                          translation_buckets,
3267                                          translation_memory_size);
3268                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->in2out_ed,
3269                                                       format_ed_session_kvp);
3270
3271                   clib_bihash_init_16_8 (&tsm->out2in_ed, "out2in-ed",
3272                                          translation_buckets,
3273                                          translation_memory_size);
3274                   clib_bihash_set_kvp_format_fn_16_8 (&tsm->out2in_ed,
3275                                                       format_ed_session_kvp);
3276                 }
3277               else
3278                 {
3279                   clib_bihash_init_8_8 (&tsm->in2out, "in2out",
3280                                         translation_buckets,
3281                                         translation_memory_size);
3282                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->in2out,
3283                                                      format_session_kvp);
3284
3285                   clib_bihash_init_8_8 (&tsm->out2in, "out2in",
3286                                         translation_buckets,
3287                                         translation_memory_size);
3288                   clib_bihash_set_kvp_format_fn_8_8 (&tsm->out2in,
3289                                                      format_session_kvp);
3290                 }
3291
3292               clib_bihash_init_8_8 (&tsm->user_hash, "users", user_buckets,
3293                                     user_memory_size);
3294               clib_bihash_set_kvp_format_fn_8_8 (&tsm->user_hash,
3295                                                  format_user_kvp);
3296             }
3297
3298         }
3299       else
3300         {
3301           sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
3302           sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
3303         }
3304       clib_bihash_init_8_8 (&sm->static_mapping_by_local,
3305                             "static_mapping_by_local", static_mapping_buckets,
3306                             static_mapping_memory_size);
3307       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
3308                                          format_static_mapping_kvp);
3309
3310       clib_bihash_init_8_8 (&sm->static_mapping_by_external,
3311                             "static_mapping_by_external", static_mapping_buckets,
3312                             static_mapping_memory_size);
3313       clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
3314                                          format_static_mapping_kvp);
3315     }
3316
3317   return 0;
3318 }
3319
3320 VLIB_CONFIG_FUNCTION (snat_config, "nat");
3321
3322 u8 * format_snat_session_state (u8 * s, va_list * args)
3323 {
3324   u32 i = va_arg (*args, u32);
3325   u8 *t = 0;
3326
3327   switch (i)
3328     {
3329 #define _(v, N, str) case SNAT_SESSION_##N: t = (u8 *) str; break;
3330     foreach_snat_session_state
3331 #undef _
3332     default:
3333       t = format (t, "unknown");
3334     }
3335   s = format (s, "%s", t);
3336   return s;
3337 }
3338
3339 u8 * format_snat_key (u8 * s, va_list * args)
3340 {
3341   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
3342
3343   s = format (s, "%U proto %U port %d fib %d",
3344               format_ip4_address, &key->addr,
3345               format_snat_protocol, key->protocol,
3346               clib_net_to_host_u16 (key->port), key->fib_index);
3347   return s;
3348 }
3349
3350 u8 * format_static_mapping_key (u8 * s, va_list * args)
3351 {
3352   snat_session_key_t * key = va_arg (*args, snat_session_key_t *);
3353
3354   s = format (s, "%U proto %U port %d fib %d",
3355               format_ip4_address, &key->addr,
3356               format_snat_protocol, key->protocol,
3357               key->port, key->fib_index);
3358   return s;
3359 }
3360
3361 u8 * format_snat_session (u8 * s, va_list * args)
3362 {
3363   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
3364   snat_session_t * sess = va_arg (*args, snat_session_t *);
3365
3366   if (snat_is_unk_proto_session (sess))
3367     {
3368       s = format (s, "  i2o %U proto %u fib %u\n",
3369                   format_ip4_address, &sess->in2out.addr,
3370                   clib_net_to_host_u16 (sess->in2out.port),
3371                   sess->in2out.fib_index);
3372       s = format (s, "    o2i %U proto %u fib %u\n",
3373                   format_ip4_address, &sess->out2in.addr,
3374                   clib_net_to_host_u16 (sess->out2in.port),
3375                   sess->out2in.fib_index);
3376     }
3377   else
3378     {
3379       s = format (s, "  i2o %U\n", format_snat_key, &sess->in2out);
3380       s = format (s, "    o2i %U\n", format_snat_key, &sess->out2in);
3381     }
3382   if (is_ed_session (sess) || is_fwd_bypass_session (sess))
3383     {
3384       if (is_twice_nat_session (sess))
3385         {
3386           s = format (s, "       external host o2i %U:%d i2o %U:%d\n",
3387                       format_ip4_address, &sess->ext_host_addr,
3388                       clib_net_to_host_u16 (sess->ext_host_port),
3389                       format_ip4_address, &sess->ext_host_nat_addr,
3390                       clib_net_to_host_u16 (sess->ext_host_nat_port));
3391         }
3392       else
3393         {
3394           if (sess->ext_host_addr.as_u32)
3395               s = format (s, "       external host %U:%u\n",
3396                           format_ip4_address, &sess->ext_host_addr,
3397                           clib_net_to_host_u16 (sess->ext_host_port));
3398         }
3399     }
3400   s = format (s, "       index %llu\n", sess - sm->sessions);
3401   s = format (s, "       last heard %.2f\n", sess->last_heard);
3402   s = format (s, "       total pkts %d, total bytes %lld\n",
3403               sess->total_pkts, sess->total_bytes);
3404   if (snat_is_session_static (sess))
3405     s = format (s, "       static translation\n");
3406   else
3407     s = format (s, "       dynamic translation\n");
3408   if (is_fwd_bypass_session (sess))
3409     s = format (s, "       forwarding-bypass\n");
3410   if (is_lb_session (sess))
3411     s = format (s, "       load-balancing\n");
3412   if (is_twice_nat_session (sess))
3413     s = format (s, "       twice-nat\n");
3414
3415   return s;
3416 }
3417
3418 u8 * format_snat_user (u8 * s, va_list * args)
3419 {
3420   snat_main_per_thread_data_t * sm = va_arg (*args, snat_main_per_thread_data_t *);
3421   snat_user_t * u = va_arg (*args, snat_user_t *);
3422   int verbose = va_arg (*args, int);
3423   dlist_elt_t * head, * elt;
3424   u32 elt_index, head_index;
3425   u32 session_index;
3426   snat_session_t * sess;
3427
3428   s = format (s, "%U: %d dynamic translations, %d static translations\n",
3429               format_ip4_address, &u->addr, u->nsessions, u->nstaticsessions);
3430
3431   if (verbose == 0)
3432     return s;
3433
3434   if (u->nsessions || u->nstaticsessions)
3435     {
3436       head_index = u->sessions_per_user_list_head_index;
3437       head = pool_elt_at_index (sm->list_pool, head_index);
3438
3439       elt_index = head->next;
3440       elt = pool_elt_at_index (sm->list_pool, elt_index);
3441       session_index = elt->value;
3442
3443       while (session_index != ~0)
3444         {
3445           sess = pool_elt_at_index (sm->sessions, session_index);
3446
3447           s = format (s, "  %U\n", format_snat_session, sm, sess);
3448
3449           elt_index = elt->next;
3450           elt = pool_elt_at_index (sm->list_pool, elt_index);
3451           session_index = elt->value;
3452         }
3453     }
3454
3455   return s;
3456 }
3457
3458 u8 * format_snat_static_mapping (u8 * s, va_list * args)
3459 {
3460   snat_static_mapping_t *m = va_arg (*args, snat_static_mapping_t *);
3461   nat44_lb_addr_port_t *local;
3462
3463   if (m->addr_only)
3464       s = format (s, "local %U external %U vrf %d %s %s",
3465                   format_ip4_address, &m->local_addr,
3466                   format_ip4_address, &m->external_addr,
3467                   m->vrf_id,
3468                   m->twice_nat == TWICE_NAT ? "twice-nat" :
3469                   m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
3470                   m->out2in_only ? "out2in-only" : "");
3471   else
3472    {
3473       if (vec_len (m->locals))
3474         {
3475           s = format (s, "%U external %U:%d %s %s",
3476                       format_snat_protocol, m->proto,
3477                       format_ip4_address, &m->external_addr, m->external_port,
3478                       m->twice_nat == TWICE_NAT ? "twice-nat" :
3479                       m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
3480                       m->out2in_only ? "out2in-only" : "");
3481           vec_foreach (local, m->locals)
3482             s = format (s, "\n  local %U:%d vrf %d probability %d\%",
3483                         format_ip4_address, &local->addr, local->port,
3484                         local->vrf_id, local->probability);
3485         }
3486       else
3487         s = format (s, "%U local %U:%d external %U:%d vrf %d %s %s",
3488                     format_snat_protocol, m->proto,
3489                     format_ip4_address, &m->local_addr, m->local_port,
3490                     format_ip4_address, &m->external_addr, m->external_port,
3491                     m->vrf_id,
3492                     m->twice_nat == TWICE_NAT ? "twice-nat" :
3493                     m->twice_nat == TWICE_NAT_SELF ? "self-twice-nat" : "",
3494                     m->out2in_only ? "out2in-only" : "");
3495    }
3496   return s;
3497 }
3498
3499 u8 * format_snat_static_map_to_resolve (u8 * s, va_list * args)
3500 {
3501   snat_static_map_resolve_t *m = va_arg (*args, snat_static_map_resolve_t *);
3502   vnet_main_t *vnm = vnet_get_main();
3503
3504   if (m->addr_only)
3505       s = format (s, "local %U external %U vrf %d",
3506                   format_ip4_address, &m->l_addr,
3507                   format_vnet_sw_if_index_name, vnm, m->sw_if_index,
3508                   m->vrf_id);
3509   else
3510       s = format (s, "%U local %U:%d external %U:%d vrf %d",
3511                   format_snat_protocol, m->proto,
3512                   format_ip4_address, &m->l_addr, m->l_port,
3513                   format_vnet_sw_if_index_name, vnm, m->sw_if_index,
3514                   m->e_port, m->vrf_id);
3515
3516   return s;
3517 }
3518
3519 u8 * format_det_map_ses (u8 * s, va_list * args)
3520 {
3521   snat_det_map_t * det_map = va_arg (*args, snat_det_map_t *);
3522   ip4_address_t in_addr, out_addr;
3523   u32 in_offset, out_offset;
3524   snat_det_session_t * ses = va_arg (*args, snat_det_session_t *);
3525   u32 * i = va_arg (*args, u32 *);
3526
3527   u32 user_index = *i / SNAT_DET_SES_PER_USER;
3528   in_addr.as_u32 = clib_host_to_net_u32 (
3529     clib_net_to_host_u32(det_map->in_addr.as_u32) + user_index);
3530   in_offset = clib_net_to_host_u32(in_addr.as_u32) -
3531     clib_net_to_host_u32(det_map->in_addr.as_u32);
3532   out_offset = in_offset / det_map->sharing_ratio;
3533   out_addr.as_u32 = clib_host_to_net_u32(
3534     clib_net_to_host_u32(det_map->out_addr.as_u32) + out_offset);
3535   s = format (s, "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
3536               format_ip4_address, &in_addr,
3537               clib_net_to_host_u16 (ses->in_port),
3538               format_ip4_address, &out_addr,
3539               clib_net_to_host_u16 (ses->out.out_port),
3540               format_ip4_address, &ses->out.ext_host_addr,
3541               clib_net_to_host_u16 (ses->out.ext_host_port),
3542               format_snat_session_state, ses->state,
3543               ses->expire);
3544
3545   return s;
3546 }
3547
3548 static void
3549 nat_ip4_add_del_addr_only_sm_cb (ip4_main_t * im,
3550                                  uword opaque,
3551                                  u32 sw_if_index,
3552                                  ip4_address_t * address,
3553                                  u32 address_length,
3554                                  u32 if_address_index,
3555                                  u32 is_delete)
3556 {
3557   snat_main_t *sm = &snat_main;
3558   snat_static_map_resolve_t *rp;
3559   snat_static_mapping_t *m;
3560   snat_session_key_t m_key;
3561   clib_bihash_kv_8_8_t kv, value;
3562   int i, rv;
3563   ip4_address_t l_addr;
3564
3565   for (i = 0; i < vec_len (sm->to_resolve); i++)
3566     {
3567       rp = sm->to_resolve + i;
3568       if (rp->addr_only == 0)
3569         continue;
3570       if (rp->sw_if_index == sw_if_index)
3571         goto match;
3572     }
3573
3574   return;
3575
3576 match:
3577   m_key.addr.as_u32 = address->as_u32;
3578   m_key.port = rp->addr_only ? 0 : rp->e_port;
3579   m_key.protocol = rp->addr_only ? 0 : rp->proto;
3580   m_key.fib_index = sm->outside_fib_index;
3581   kv.key = m_key.as_u64;
3582   if (clib_bihash_search_8_8 (&sm->static_mapping_by_external, &kv, &value))
3583     m = 0;
3584   else
3585     m = pool_elt_at_index (sm->static_mappings, value.value);
3586
3587   if (!is_delete)
3588     {
3589       /* Don't trip over lease renewal, static config */
3590       if (m)
3591         return;
3592     }
3593   else
3594     {
3595       if (!m)
3596         return;
3597     }
3598
3599   /* Indetity mapping? */
3600   if (rp->l_addr.as_u32 == 0)
3601     l_addr.as_u32 = address[0].as_u32;
3602   else
3603     l_addr.as_u32 = rp->l_addr.as_u32;
3604   /* Add the static mapping */
3605   rv = snat_add_static_mapping (l_addr,
3606                                 address[0],
3607                                 rp->l_port,
3608                                 rp->e_port,
3609                                 rp->vrf_id,
3610                                 rp->addr_only,
3611                                 ~0 /* sw_if_index */,
3612                                 rp->proto,
3613                                 !is_delete,
3614                                 0, 0, rp->tag);
3615   if (rv)
3616     nat_log_notice ("snat_add_static_mapping returned %d", rv);
3617 }
3618
3619 static void
3620 snat_ip4_add_del_interface_address_cb (ip4_main_t * im,
3621                                        uword opaque,
3622                                        u32 sw_if_index,
3623                                        ip4_address_t * address,
3624                                        u32 address_length,
3625                                        u32 if_address_index,
3626                                        u32 is_delete)
3627 {
3628   snat_main_t *sm = &snat_main;
3629   snat_static_map_resolve_t *rp;
3630   ip4_address_t l_addr;
3631   int i, j;
3632   int rv;
3633   u8 twice_nat = 0;
3634   snat_address_t *addresses = sm->addresses;
3635
3636   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices); i++)
3637     {
3638       if (sw_if_index == sm->auto_add_sw_if_indices[i])
3639           goto match;
3640     }
3641
3642   for (i = 0; i < vec_len(sm->auto_add_sw_if_indices_twice_nat); i++)
3643     {
3644       twice_nat = 1;
3645       addresses = sm->twice_nat_addresses;
3646       if (sw_if_index == sm->auto_add_sw_if_indices_twice_nat[i])
3647           goto match;
3648     }
3649
3650   return;
3651
3652 match:
3653   if (!is_delete)
3654     {
3655       /* Don't trip over lease renewal, static config */
3656       for (j = 0; j < vec_len(addresses); j++)
3657         if (addresses[j].addr.as_u32 == address->as_u32)
3658           return;
3659
3660       (void) snat_add_address (sm, address, ~0, twice_nat);
3661       /* Scan static map resolution vector */
3662       for (j = 0; j < vec_len (sm->to_resolve); j++)
3663         {
3664           rp = sm->to_resolve + j;
3665           if (rp->addr_only)
3666             continue;
3667           /* On this interface? */
3668           if (rp->sw_if_index == sw_if_index)
3669             {
3670               /* Indetity mapping? */
3671               if (rp->l_addr.as_u32 == 0)
3672                 l_addr.as_u32 = address[0].as_u32;
3673               else
3674                 l_addr.as_u32 = rp->l_addr.as_u32;
3675               /* Add the static mapping */
3676               rv = snat_add_static_mapping (l_addr,
3677                                             address[0],
3678                                             rp->l_port,
3679                                             rp->e_port,
3680                                             rp->vrf_id,
3681                                             rp->addr_only,
3682                                             ~0 /* sw_if_index */,
3683                                             rp->proto,
3684                                             rp->is_add,
3685                                             0, 0, rp->tag);
3686               if (rv)
3687                 nat_log_notice ("snat_add_static_mapping returned %d", rv);
3688             }
3689         }
3690       return;
3691     }
3692   else
3693     {
3694       (void) snat_del_address(sm, address[0], 1, twice_nat);
3695       return;
3696     }
3697 }
3698
3699
3700 int snat_add_interface_address (snat_main_t *sm, u32 sw_if_index, int is_del,
3701                                 u8 twice_nat)
3702 {
3703   ip4_main_t * ip4_main = sm->ip4_main;
3704   ip4_address_t * first_int_addr;
3705   snat_static_map_resolve_t *rp;
3706   u32 *indices_to_delete = 0;
3707   int i, j;
3708   u32 *auto_add_sw_if_indices =
3709     twice_nat ? sm->auto_add_sw_if_indices_twice_nat : sm->auto_add_sw_if_indices;
3710
3711   first_int_addr = ip4_interface_first_address (ip4_main, sw_if_index,
3712                                                 0 /* just want the address*/);
3713
3714   for (i = 0; i < vec_len(auto_add_sw_if_indices); i++)
3715     {
3716       if (auto_add_sw_if_indices[i] == sw_if_index)
3717         {
3718           if (is_del)
3719             {
3720               /* if have address remove it */
3721               if (first_int_addr)
3722                   (void) snat_del_address (sm, first_int_addr[0], 1, twice_nat);
3723               else
3724                 {
3725                   for (j = 0; j < vec_len (sm->to_resolve); j++)
3726                     {
3727                       rp = sm->to_resolve + j;
3728                       if (rp->sw_if_index == sw_if_index)
3729                         vec_add1 (indices_to_delete, j);
3730                     }
3731                   if (vec_len(indices_to_delete))
3732                     {
3733                       for (j = vec_len(indices_to_delete)-1; j >= 0; j--)
3734                         vec_del1(sm->to_resolve, j);
3735                       vec_free(indices_to_delete);
3736                     }
3737                 }
3738               if (twice_nat)
3739                 vec_del1(sm->auto_add_sw_if_indices_twice_nat, i);
3740               else
3741                 vec_del1(sm->auto_add_sw_if_indices, i);
3742             }
3743           else
3744             return VNET_API_ERROR_VALUE_EXIST;
3745
3746           return 0;
3747         }
3748     }
3749
3750   if (is_del)
3751     return VNET_API_ERROR_NO_SUCH_ENTRY;
3752
3753   /* add to the auto-address list */
3754   if (twice_nat)
3755     vec_add1(sm->auto_add_sw_if_indices_twice_nat, sw_if_index);
3756   else
3757     vec_add1(sm->auto_add_sw_if_indices, sw_if_index);
3758
3759   /* If the address is already bound - or static - add it now */
3760   if (first_int_addr)
3761       (void) snat_add_address (sm, first_int_addr, ~0, twice_nat);
3762
3763   return 0;
3764 }
3765
3766 int
3767 nat44_del_session (snat_main_t *sm, ip4_address_t *addr, u16 port,
3768                    snat_protocol_t proto, u32 vrf_id, int is_in)
3769 {
3770   snat_main_per_thread_data_t *tsm;
3771   clib_bihash_kv_8_8_t kv, value;
3772   ip4_header_t ip;
3773   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3774   snat_session_key_t key;
3775   snat_session_t *s;
3776   clib_bihash_8_8_t *t;
3777
3778   if (sm->endpoint_dependent)
3779     return VNET_API_ERROR_UNSUPPORTED;
3780
3781   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3782   if (sm->num_workers > 1)
3783     tsm =
3784       vec_elt_at_index (sm->per_thread_data,
3785                         sm->worker_in2out_cb (&ip, fib_index));
3786   else
3787     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3788
3789   key.addr.as_u32 = addr->as_u32;
3790   key.port = clib_host_to_net_u16 (port);
3791   key.protocol = proto;
3792   key.fib_index = fib_index;
3793   kv.key = key.as_u64;
3794   t = is_in ? &tsm->in2out : &tsm->out2in;
3795   if (!clib_bihash_search_8_8 (t, &kv, &value))
3796     {
3797       if (pool_is_free_index (tsm->sessions, value.value))
3798         return VNET_API_ERROR_UNSPECIFIED;
3799
3800       s = pool_elt_at_index (tsm->sessions, value.value);
3801       nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3802       nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3803       return 0;
3804     }
3805
3806   return VNET_API_ERROR_NO_SUCH_ENTRY;
3807 }
3808
3809 int
3810 nat44_del_ed_session (snat_main_t *sm, ip4_address_t *addr, u16 port,
3811                       ip4_address_t *eh_addr, u16 eh_port, u8 proto,
3812                       u32 vrf_id, int is_in)
3813 {
3814   ip4_header_t ip;
3815   clib_bihash_16_8_t *t;
3816   nat_ed_ses_key_t key;
3817   clib_bihash_kv_16_8_t kv, value;
3818   u32 fib_index = fib_table_find (FIB_PROTOCOL_IP4, vrf_id);
3819   snat_session_t *s;
3820   snat_main_per_thread_data_t *tsm;
3821
3822   if (!sm->endpoint_dependent)
3823     return VNET_API_ERROR_FEATURE_DISABLED;
3824
3825   ip.dst_address.as_u32 = ip.src_address.as_u32 = addr->as_u32;
3826   if (sm->num_workers > 1)
3827     tsm =
3828       vec_elt_at_index (sm->per_thread_data,
3829                         sm->worker_in2out_cb (&ip, fib_index));
3830   else
3831     tsm = vec_elt_at_index (sm->per_thread_data, sm->num_workers);
3832
3833   t = is_in ? &tsm->in2out_ed : &tsm->out2in_ed;
3834   key.l_addr.as_u32 = addr->as_u32;
3835   key.r_addr.as_u32 = eh_addr->as_u32;
3836   key.l_port = clib_host_to_net_u16 (port);
3837   key.r_port = clib_host_to_net_u16 (eh_port);
3838   key.proto = proto;
3839   key.fib_index = clib_host_to_net_u32 (fib_index);
3840   kv.key[0] = key.as_u64[0];
3841   kv.key[1] = key.as_u64[1];
3842   if (clib_bihash_search_16_8 (t, &kv, &value))
3843     return VNET_API_ERROR_NO_SUCH_ENTRY;
3844
3845   if (pool_is_free_index (tsm->sessions, value.value))
3846     return VNET_API_ERROR_UNSPECIFIED;
3847   s = pool_elt_at_index (tsm->sessions, value.value);
3848   nat_free_session_data (sm, s, tsm - sm->per_thread_data);
3849   nat44_delete_session (sm, s, tsm - sm->per_thread_data);
3850   return 0;
3851 }
3852
3853 void
3854 nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length)
3855 {
3856   snat_main_t *sm = &snat_main;
3857
3858   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_MAPE;
3859   sm->alloc_addr_and_port = nat_alloc_addr_and_port_mape;
3860   sm->psid = psid;
3861   sm->psid_offset = psid_offset;
3862   sm->psid_length = psid_length;
3863 }
3864
3865 void
3866 nat_set_alloc_addr_and_port_range (u16 start_port, u16 end_port)
3867 {
3868   snat_main_t *sm = &snat_main;
3869
3870   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_RANGE;
3871   sm->alloc_addr_and_port = nat_alloc_addr_and_port_range;
3872   sm->start_port = start_port;
3873   sm->end_port = end_port;
3874 }
3875
3876 void
3877 nat_set_alloc_addr_and_port_default (void)
3878 {
3879   snat_main_t *sm = &snat_main;
3880
3881   sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
3882   sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
3883 }
3884