src/plugins/nat/nat44_classify.c

   1 /*
   2  * Copyright (c) 2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 /**
  16  * @file
  17  * @brief Classify for one armed NAT44 (in+out interface)
  18  */
  19
  20 #include <vlib/vlib.h>
  21 #include <vnet/vnet.h>
  22 #include <vnet/fib/ip4_fib.h>
  23 #include <nat/nat.h>
  24 #include <nat/nat_inlines.h>
  25
  26 #define foreach_nat44_classify_error                      \
  27 _(NEXT_IN2OUT, "next in2out")                             \
  28 _(NEXT_OUT2IN, "next out2in")                             \
  29 _(FRAG_CACHED, "fragment cached")
  30
  31 typedef enum
  32 {
  33 #define _(sym,str) NAT44_CLASSIFY_ERROR_##sym,
  34   foreach_nat44_classify_error
  35 #undef _
  36     NAT44_CLASSIFY_N_ERROR,
  37 } nat44_classify_error_t;
  38
  39 static char *nat44_classify_error_strings[] = {
  40 #define _(sym,string) string,
  41   foreach_nat44_classify_error
  42 #undef _
  43 };
  44
  45 typedef enum
  46 {
  47   NAT44_CLASSIFY_NEXT_IN2OUT,
  48   NAT44_CLASSIFY_NEXT_OUT2IN,
  49   NAT44_CLASSIFY_NEXT_DROP,
  50   NAT44_CLASSIFY_N_NEXT,
  51 } nat44_classify_next_t;
  52
  53 typedef struct
  54 {
  55   u8 next_in2out;
  56   u8 cached;
  57 } nat44_classify_trace_t;
  58
  59 static u8 *
  60 format_nat44_classify_trace (u8 * s, va_list * args)
  61 {
  62   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  63   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  64   nat44_classify_trace_t *t = va_arg (*args, nat44_classify_trace_t *);
  65   char *next;
  66
  67   if (t->cached)
  68     s = format (s, "nat44-classify: fragment cached");
  69   else
  70     {
  71       next = t->next_in2out ? "nat44-in2out" : "nat44-out2in";
  72       s = format (s, "nat44-classify: next %s", next);
  73     }
  74
  75   return s;
  76 }
  77
  78 static inline uword
  79 nat44_classify_node_fn_inline (vlib_main_t * vm,
  80                                vlib_node_runtime_t * node,
  81                                vlib_frame_t * frame)
  82 {
  83   u32 n_left_from, *from, *to_next;
  84   nat44_classify_next_t next_index;
  85   snat_main_t *sm = &snat_main;
  86   snat_static_mapping_t *m;
  87   u32 *fragments_to_drop = 0;
  88   u32 next_in2out = 0, next_out2in = 0, frag_cached = 0;
  89
  90   from = vlib_frame_vector_args (frame);
  91   n_left_from = frame->n_vectors;
  92   next_index = node->cached_next_index;
  93
  94   while (n_left_from > 0)
  95     {
  96       u32 n_left_to_next;
  97
  98       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
  99
 100       while (n_left_from > 0 && n_left_to_next > 0)
 101         {
 102           u32 bi0;
 103           vlib_buffer_t *b0;
 104           u32 next0 = NAT44_CLASSIFY_NEXT_IN2OUT;
 105           ip4_header_t *ip0;
 106           snat_address_t *ap;
 107           snat_session_key_t m_key0;
 108           clib_bihash_kv_8_8_t kv0, value0;
 109
 110           /* speculatively enqueue b0 to the current next frame */
 111           bi0 = from[0];
 112           to_next[0] = bi0;
 113           from += 1;
 114           to_next += 1;
 115           n_left_from -= 1;
 116           n_left_to_next -= 1;
 117
 118           b0 = vlib_get_buffer (vm, bi0);
 119           ip0 = vlib_buffer_get_current (b0);
 120
 121           /* *INDENT-OFF* */
 122           vec_foreach (ap, sm->addresses)
 123             {
 124               if (ip0->dst_address.as_u32 == ap->addr.as_u32)
 125                 {
 126                   next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 127                   goto enqueue0;
 128                 }
 129             }
 130           /* *INDENT-ON* */
 131
 132           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
 133             {
 134               m_key0.addr = ip0->dst_address;
 135               m_key0.port = 0;
 136               m_key0.protocol = 0;
 137               m_key0.fib_index = 0;
 138               kv0.key = m_key0.as_u64;
 139               /* try to classify the fragment based on IP header alone */
 140               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external,
 141                                            &kv0, &value0))
 142                 {
 143                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 144                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 145                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 146                   goto enqueue0;
 147                 }
 148               m_key0.port =
 149                 clib_net_to_host_u16 (vnet_buffer (b0)->ip.reass.l4_dst_port);
 150               m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol);
 151               kv0.key = m_key0.as_u64;
 152               if (!clib_bihash_search_8_8
 153                   (&sm->static_mapping_by_external, &kv0, &value0))
 154                 {
 155                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 156                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 157                     next0 = NAT44_CLASSIFY_NEXT_OUT2IN;
 158                 }
 159             }
 160
 161         enqueue0:
 162           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 163                              && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 164             {
 165               nat44_classify_trace_t *t =
 166                 vlib_add_trace (vm, node, b0, sizeof (*t));
 167               t->cached = 0;
 168               t->next_in2out = next0 == NAT44_CLASSIFY_NEXT_IN2OUT ? 1 : 0;
 169             }
 170
 171           next_in2out += next0 == NAT44_CLASSIFY_NEXT_IN2OUT;
 172           next_out2in += next0 == NAT44_CLASSIFY_NEXT_OUT2IN;
 173
 174           /* verify speculative enqueue, maybe switch current next frame */
 175           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 176                                            to_next, n_left_to_next,
 177                                            bi0, next0);
 178         }
 179
 180       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 181     }
 182
 183   nat_send_all_to_node (vm, fragments_to_drop, node, 0,
 184                         NAT44_CLASSIFY_NEXT_DROP);
 185
 186   vec_free (fragments_to_drop);
 187
 188   vlib_node_increment_counter (vm, node->node_index,
 189                                NAT44_CLASSIFY_ERROR_NEXT_IN2OUT, next_in2out);
 190   vlib_node_increment_counter (vm, node->node_index,
 191                                NAT44_CLASSIFY_ERROR_NEXT_OUT2IN, next_out2in);
 192   vlib_node_increment_counter (vm, node->node_index,
 193                                NAT44_CLASSIFY_ERROR_FRAG_CACHED, frag_cached);
 194
 195   return frame->n_vectors;
 196 }
 197
 198 static inline uword
 199 nat44_ed_classify_node_fn_inline (vlib_main_t * vm,
 200                                   vlib_node_runtime_t * node,
 201                                   vlib_frame_t * frame)
 202 {
 203   u32 n_left_from, *from, *to_next;
 204   nat44_classify_next_t next_index;
 205   snat_main_t *sm = &snat_main;
 206   snat_static_mapping_t *m;
 207   u32 thread_index = vm->thread_index;
 208   snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
 209   u32 *fragments_to_drop = 0;
 210   u32 next_in2out = 0, next_out2in = 0, frag_cached = 0;
 211   u8 in_loopback = 0;
 212
 213   from = vlib_frame_vector_args (frame);
 214   n_left_from = frame->n_vectors;
 215   next_index = node->cached_next_index;
 216
 217   while (n_left_from > 0)
 218     {
 219       u32 n_left_to_next;
 220
 221       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 222
 223       while (n_left_from > 0 && n_left_to_next > 0)
 224         {
 225           u32 bi0;
 226           vlib_buffer_t *b0;
 227           u32 next0 =
 228             NAT_NEXT_IN2OUT_ED_FAST_PATH, sw_if_index0, rx_fib_index0;
 229           ip4_header_t *ip0;
 230           snat_address_t *ap;
 231           snat_session_key_t m_key0;
 232           clib_bihash_kv_8_8_t kv0, value0;
 233           clib_bihash_kv_16_8_t ed_kv0, ed_value0;
 234
 235           /* speculatively enqueue b0 to the current next frame */
 236           bi0 = from[0];
 237           to_next[0] = bi0;
 238           from += 1;
 239           to_next += 1;
 240           n_left_from -= 1;
 241           n_left_to_next -= 1;
 242
 243           b0 = vlib_get_buffer (vm, bi0);
 244           ip0 = vlib_buffer_get_current (b0);
 245
 246           if (!in_loopback)
 247             {
 248               u32 arc_next = 0;
 249
 250               vnet_feature_next (&arc_next, b0);
 251               nat_buffer_opaque (b0)->arc_next = arc_next;
 252             }
 253
 254           if (ip0->protocol != IP_PROTOCOL_ICMP)
 255             {
 256               /* process leading fragment/whole packet (with L4 header) */
 257               sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 258               rx_fib_index0 =
 259                 fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
 260                                                      sw_if_index0);
 261               make_ed_kv (&ed_kv0, &ip0->src_address,
 262                           &ip0->dst_address, ip0->protocol,
 263                           rx_fib_index0,
 264                           vnet_buffer (b0)->ip.reass.l4_src_port,
 265                           vnet_buffer (b0)->ip.reass.l4_dst_port);
 266               /* process whole packet */
 267               if (!clib_bihash_search_16_8
 268                   (&tsm->in2out_ed, &ed_kv0, &ed_value0))
 269                 goto enqueue0;
 270               /* session doesn't exist so continue in code */
 271             }
 272
 273           /* *INDENT-OFF* */
 274           vec_foreach (ap, sm->addresses)
 275             {
 276               if (ip0->dst_address.as_u32 == ap->addr.as_u32)
 277                 {
 278                   next0 = NAT_NEXT_OUT2IN_ED_FAST_PATH;
 279                   goto enqueue0;
 280                 }
 281             }
 282           /* *INDENT-ON* */
 283
 284           if (PREDICT_FALSE (pool_elts (sm->static_mappings)))
 285             {
 286               m_key0.addr = ip0->dst_address;
 287               m_key0.port = 0;
 288               m_key0.protocol = 0;
 289               m_key0.fib_index = 0;
 290               kv0.key = m_key0.as_u64;
 291               /* try to classify the fragment based on IP header alone */
 292               if (!clib_bihash_search_8_8 (&sm->static_mapping_by_external,
 293                                            &kv0, &value0))
 294                 {
 295                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 296                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 297                     next0 = NAT_NEXT_OUT2IN_ED_FAST_PATH;
 298                   goto enqueue0;
 299                 }
 300               m_key0.port =
 301                 clib_net_to_host_u16 (vnet_buffer (b0)->ip.reass.l4_dst_port);
 302               m_key0.protocol = ip_proto_to_snat_proto (ip0->protocol);
 303               kv0.key = m_key0.as_u64;
 304               if (!clib_bihash_search_8_8
 305                   (&sm->static_mapping_by_external, &kv0, &value0))
 306                 {
 307                   m = pool_elt_at_index (sm->static_mappings, value0.value);
 308                   if (m->local_addr.as_u32 != m->external_addr.as_u32)
 309                     next0 = NAT_NEXT_OUT2IN_ED_FAST_PATH;
 310                 }
 311             }
 312
 313         enqueue0:
 314           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 315                              && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 316             {
 317               nat44_classify_trace_t *t =
 318                 vlib_add_trace (vm, node, b0, sizeof (*t));
 319               t->cached = 0;
 320               t->next_in2out = next0 == NAT_NEXT_IN2OUT_ED_FAST_PATH ? 1 : 0;
 321             }
 322
 323           next_in2out += next0 == NAT_NEXT_IN2OUT_ED_FAST_PATH;
 324           next_out2in += next0 == NAT_NEXT_OUT2IN_ED_FAST_PATH;
 325
 326           /* verify speculative enqueue, maybe switch current next frame */
 327           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 328                                            to_next, n_left_to_next,
 329                                            bi0, next0);
 330         }
 331
 332       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 333     }
 334
 335   nat_send_all_to_node (vm, fragments_to_drop, node, 0,
 336                         NAT44_CLASSIFY_NEXT_DROP);
 337
 338   vec_free (fragments_to_drop);
 339
 340   vlib_node_increment_counter (vm, node->node_index,
 341                                NAT44_CLASSIFY_ERROR_NEXT_IN2OUT, next_in2out);
 342   vlib_node_increment_counter (vm, node->node_index,
 343                                NAT44_CLASSIFY_ERROR_NEXT_OUT2IN, next_out2in);
 344   vlib_node_increment_counter (vm, node->node_index,
 345                                NAT44_CLASSIFY_ERROR_FRAG_CACHED, frag_cached);
 346
 347   return frame->n_vectors;
 348 }
 349
 350 VLIB_NODE_FN (nat44_classify_node) (vlib_main_t * vm,
 351                                     vlib_node_runtime_t * node,
 352                                     vlib_frame_t * frame)
 353 {
 354   return nat44_classify_node_fn_inline (vm, node, frame);
 355 }
 356
 357 /* *INDENT-OFF* */
 358 VLIB_REGISTER_NODE (nat44_classify_node) = {
 359   .name = "nat44-classify",
 360   .vector_size = sizeof (u32),
 361   .format_trace = format_nat44_classify_trace,
 362   .type = VLIB_NODE_TYPE_INTERNAL,
 363   .n_errors = ARRAY_LEN(nat44_classify_error_strings),
 364   .error_strings = nat44_classify_error_strings,
 365   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 366   .next_nodes = {
 367     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out",
 368     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in",
 369     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 370   },
 371 };
 372 /* *INDENT-ON* */
 373
 374 VLIB_NODE_FN (nat44_ed_classify_node) (vlib_main_t * vm,
 375                                        vlib_node_runtime_t * node,
 376                                        vlib_frame_t * frame)
 377 {
 378   return nat44_ed_classify_node_fn_inline (vm, node, frame);
 379 }
 380
 381 /* *INDENT-OFF* */
 382 VLIB_REGISTER_NODE (nat44_ed_classify_node) = {
 383   .name = "nat44-ed-classify",
 384   .vector_size = sizeof (u32),
 385   .sibling_of = "nat-default",
 386   .format_trace = format_nat44_classify_trace,
 387   .type = VLIB_NODE_TYPE_INTERNAL,
 388 };
 389 /* *INDENT-ON* */
 390
 391 VLIB_NODE_FN (nat44_det_classify_node) (vlib_main_t * vm,
 392                                         vlib_node_runtime_t * node,
 393                                         vlib_frame_t * frame)
 394 {
 395   return nat44_classify_node_fn_inline (vm, node, frame);
 396 }
 397
 398 /* *INDENT-OFF* */
 399 VLIB_REGISTER_NODE (nat44_det_classify_node) = {
 400   .name = "nat44-det-classify",
 401   .vector_size = sizeof (u32),
 402   .format_trace = format_nat44_classify_trace,
 403   .type = VLIB_NODE_TYPE_INTERNAL,
 404   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 405   .next_nodes = {
 406     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out",
 407     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in",
 408     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 409   },
 410 };
 411 /* *INDENT-ON* */
 412
 413 VLIB_NODE_FN (nat44_handoff_classify_node) (vlib_main_t * vm,
 414                                             vlib_node_runtime_t * node,
 415                                             vlib_frame_t * frame)
 416 {
 417   return nat44_classify_node_fn_inline (vm, node, frame);
 418 }
 419
 420 /* *INDENT-OFF* */
 421 VLIB_REGISTER_NODE (nat44_handoff_classify_node) = {
 422   .name = "nat44-handoff-classify",
 423   .vector_size = sizeof (u32),
 424   .format_trace = format_nat44_classify_trace,
 425   .type = VLIB_NODE_TYPE_INTERNAL,
 426   .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
 427   .next_nodes = {
 428     [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-in2out-worker-handoff",
 429     [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-out2in-worker-handoff",
 430     [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
 431   },
 432 };
 433
 434 /* *INDENT-ON* */
 435
 436 /*
 437  * fd.io coding-style-patch-verification: ON
 438  *
 439  * Local Variables:
 440  * eval: (c-set-style "gnu")
 441  * End:
 442  */