src/plugins/nat/nat_det_out2in.c

   1 /*
   2  * Copyright (c) 2018 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15 /**
  16  * @file
  17  * @brief Deterministic/CGN NAT44 outside to inside network translation
  18  */
  19
  20 #include <vlib/vlib.h>
  21 #include <vnet/vnet.h>
  22 #include <vnet/ip/ip.h>
  23 #include <vnet/fib/ip4_fib.h>
  24 #include <vppinfra/error.h>
  25 #include <vppinfra/elog.h>
  26 #include <nat/nat.h>
  27 #include <nat/nat_det.h>
  28 #include <nat/nat_inlines.h>
  29
  30 typedef enum
  31 {
  32   NAT_DET_OUT2IN_NEXT_DROP,
  33   NAT_DET_OUT2IN_NEXT_LOOKUP,
  34   NAT_DET_OUT2IN_NEXT_ICMP_ERROR,
  35   NAT_DET_OUT2IN_N_NEXT,
  36 } nat_det_out2in_next_t;
  37
  38 typedef struct
  39 {
  40   u32 sw_if_index;
  41   u32 next_index;
  42   u32 session_index;
  43 } nat_det_out2in_trace_t;
  44
  45 #define foreach_nat_det_out2in_error                       \
  46 _(UNSUPPORTED_PROTOCOL, "Unsupported protocol")         \
  47 _(NO_TRANSLATION, "No translation")                     \
  48 _(BAD_ICMP_TYPE, "unsupported ICMP type")               \
  49 _(OUT2IN_PACKETS, "Good out2in packets processed")
  50
  51 typedef enum
  52 {
  53 #define _(sym,str) NAT_DET_OUT2IN_ERROR_##sym,
  54   foreach_nat_det_out2in_error
  55 #undef _
  56     SNAT_OUT2IN_N_ERROR,
  57 } nat_det_out2in_error_t;
  58
  59 static char *nat_det_out2in_error_strings[] = {
  60 #define _(sym,string) string,
  61   foreach_nat_det_out2in_error
  62 #undef _
  63 };
  64
  65 static u8 *
  66 format_nat_det_out2in_trace (u8 * s, va_list * args)
  67 {
  68   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  69   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  70   nat_det_out2in_trace_t *t = va_arg (*args, nat_det_out2in_trace_t *);
  71
  72   s =
  73     format (s,
  74             "NAT_DET_OUT2IN: sw_if_index %d, next index %d, session index %d",
  75             t->sw_if_index, t->next_index, t->session_index);
  76   return s;
  77 }
  78
  79 #ifndef CLIB_MARCH_VARIANT
  80 /**
  81  * Get address and port values to be used for ICMP packet translation
  82  * and create session if needed
  83  *
  84  * @param[in,out] sm             NAT main
  85  * @param[in,out] node           NAT node runtime
  86  * @param[in] thread_index       thread index
  87  * @param[in,out] b0             buffer containing packet to be translated
  88  * @param[out] p_proto           protocol used for matching
  89  * @param[out] p_value           address and port after NAT translation
  90  * @param[out] p_dont_translate  if packet should not be translated
  91  * @param d                      optional parameter
  92  * @param e                      optional parameter
  93  */
  94 u32
  95 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
  96                        u32 thread_index, vlib_buffer_t * b0,
  97                        ip4_header_t * ip0, u8 * p_proto,
  98                        snat_session_key_t * p_value,
  99                        u8 * p_dont_translate, void *d, void *e)
 100 {
 101   icmp46_header_t *icmp0;
 102   u32 sw_if_index0;
 103   u8 protocol;
 104   snat_det_out_key_t key0;
 105   u8 dont_translate = 0;
 106   u32 next0 = ~0;
 107   icmp_echo_header_t *echo0, *inner_echo0 = 0;
 108   ip4_header_t *inner_ip0;
 109   void *l4_header = 0;
 110   icmp46_header_t *inner_icmp0;
 111   snat_det_map_t *dm0 = 0;
 112   ip4_address_t new_addr0 = { {0} };
 113   snat_det_session_t *ses0 = 0;
 114   ip4_address_t out_addr;
 115
 116   icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
 117   echo0 = (icmp_echo_header_t *) (icmp0 + 1);
 118   sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 119
 120   if (!icmp_type_is_error_message
 121       (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
 122     {
 123       protocol = SNAT_PROTOCOL_ICMP;
 124       key0.ext_host_addr = ip0->src_address;
 125       key0.ext_host_port = 0;
 126       key0.out_port = vnet_buffer (b0)->ip.reass.l4_src_port;
 127       out_addr = ip0->dst_address;
 128     }
 129   else
 130     {
 131       /* if error message, then it's not fragmented and we can access it */
 132       inner_ip0 = (ip4_header_t *) (echo0 + 1);
 133       l4_header = ip4_next_header (inner_ip0);
 134       protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
 135       key0.ext_host_addr = inner_ip0->dst_address;
 136       out_addr = inner_ip0->src_address;
 137       switch (protocol)
 138         {
 139         case SNAT_PROTOCOL_ICMP:
 140           inner_icmp0 = (icmp46_header_t *) l4_header;
 141           inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
 142           key0.ext_host_port = 0;
 143           key0.out_port = inner_echo0->identifier;
 144           break;
 145         case SNAT_PROTOCOL_UDP:
 146         case SNAT_PROTOCOL_TCP:
 147           key0.ext_host_port = ((tcp_udp_header_t *) l4_header)->dst_port;
 148           key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port;
 149           break;
 150         default:
 151           b0->error = node->errors[NAT_DET_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
 152           next0 = NAT_DET_OUT2IN_NEXT_DROP;
 153           goto out;
 154         }
 155     }
 156
 157   dm0 = snat_det_map_by_out (sm, &out_addr);
 158   if (PREDICT_FALSE (!dm0))
 159     {
 160       /* Don't NAT packet aimed at the intfc address */
 161       if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
 162                                             ip0->dst_address.as_u32)))
 163         {
 164           dont_translate = 1;
 165           goto out;
 166         }
 167       nat_log_info ("unknown dst address:  %U",
 168                     format_ip4_address, &ip0->dst_address);
 169       goto out;
 170     }
 171
 172   snat_det_reverse (dm0, &ip0->dst_address,
 173                     clib_net_to_host_u16 (key0.out_port), &new_addr0);
 174
 175   ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
 176   if (PREDICT_FALSE (!ses0))
 177     {
 178       /* Don't NAT packet aimed at the intfc address */
 179       if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
 180                                             ip0->dst_address.as_u32)))
 181         {
 182           dont_translate = 1;
 183           goto out;
 184         }
 185       nat_log_info ("no match src %U:%d dst %U:%d for user %U",
 186                     format_ip4_address, &key0.ext_host_addr,
 187                     clib_net_to_host_u16 (key0.ext_host_port),
 188                     format_ip4_address, &out_addr,
 189                     clib_net_to_host_u16 (key0.out_port),
 190                     format_ip4_address, &new_addr0);
 191       b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 192       next0 = NAT_DET_OUT2IN_NEXT_DROP;
 193       goto out;
 194     }
 195
 196   if (PREDICT_FALSE
 197       (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_reply
 198        && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
 199                                        reass.icmp_type_or_tcp_flags)))
 200     {
 201       b0->error = node->errors[NAT_DET_OUT2IN_ERROR_BAD_ICMP_TYPE];
 202       next0 = NAT_DET_OUT2IN_NEXT_DROP;
 203       goto out;
 204     }
 205
 206   goto out;
 207
 208 out:
 209   *p_proto = protocol;
 210   if (ses0)
 211     {
 212       p_value->addr = new_addr0;
 213       p_value->fib_index = sm->inside_fib_index;
 214       p_value->port = ses0->in_port;
 215     }
 216   *p_dont_translate = dont_translate;
 217   if (d)
 218     *(snat_det_session_t **) d = ses0;
 219   if (e)
 220     *(snat_det_map_t **) e = dm0;
 221   return next0;
 222 }
 223 #endif
 224
 225 VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm,
 226                                      vlib_node_runtime_t * node,
 227                                      vlib_frame_t * frame)
 228 {
 229   u32 n_left_from, *from, *to_next;
 230   nat_det_out2in_next_t next_index;
 231   u32 pkts_processed = 0;
 232   snat_main_t *sm = &snat_main;
 233   u32 thread_index = vm->thread_index;
 234
 235   from = vlib_frame_vector_args (frame);
 236   n_left_from = frame->n_vectors;
 237   next_index = node->cached_next_index;
 238
 239   while (n_left_from > 0)
 240     {
 241       u32 n_left_to_next;
 242
 243       vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
 244
 245       while (n_left_from >= 4 && n_left_to_next >= 2)
 246         {
 247           u32 bi0, bi1;
 248           vlib_buffer_t *b0, *b1;
 249           u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP;
 250           u32 next1 = NAT_DET_OUT2IN_NEXT_LOOKUP;
 251           u32 sw_if_index0, sw_if_index1;
 252           ip4_header_t *ip0, *ip1;
 253           ip_csum_t sum0, sum1;
 254           ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
 255           u16 new_port0, old_port0, old_port1, new_port1;
 256           udp_header_t *udp0, *udp1;
 257           tcp_header_t *tcp0, *tcp1;
 258           u32 proto0, proto1;
 259           snat_det_out_key_t key0, key1;
 260           snat_det_map_t *dm0, *dm1;
 261           snat_det_session_t *ses0 = 0, *ses1 = 0;
 262           u32 rx_fib_index0, rx_fib_index1;
 263           icmp46_header_t *icmp0, *icmp1;
 264
 265           /* Prefetch next iteration. */
 266           {
 267             vlib_buffer_t *p2, *p3;
 268
 269             p2 = vlib_get_buffer (vm, from[2]);
 270             p3 = vlib_get_buffer (vm, from[3]);
 271
 272             vlib_prefetch_buffer_header (p2, LOAD);
 273             vlib_prefetch_buffer_header (p3, LOAD);
 274
 275             CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE);
 276             CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, STORE);
 277           }
 278
 279           /* speculatively enqueue b0 and b1 to the current next frame */
 280           to_next[0] = bi0 = from[0];
 281           to_next[1] = bi1 = from[1];
 282           from += 2;
 283           to_next += 2;
 284           n_left_from -= 2;
 285           n_left_to_next -= 2;
 286
 287           b0 = vlib_get_buffer (vm, bi0);
 288           b1 = vlib_get_buffer (vm, bi1);
 289
 290           ip0 = vlib_buffer_get_current (b0);
 291           udp0 = ip4_next_header (ip0);
 292           tcp0 = (tcp_header_t *) udp0;
 293
 294           sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 295
 296           if (PREDICT_FALSE (ip0->ttl == 1))
 297             {
 298               vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 299               icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
 300                                            ICMP4_time_exceeded_ttl_exceeded_in_transit,
 301                                            0);
 302               next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
 303               goto trace0;
 304             }
 305
 306           proto0 = ip_proto_to_snat_proto (ip0->protocol);
 307
 308           if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
 309             {
 310               rx_fib_index0 =
 311                 ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
 312               icmp0 = (icmp46_header_t *) udp0;
 313
 314               next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
 315                                    rx_fib_index0, node, next0, thread_index,
 316                                    &ses0, &dm0);
 317               goto trace0;
 318             }
 319
 320           key0.ext_host_addr = ip0->src_address;
 321           key0.ext_host_port = tcp0->src;
 322           key0.out_port = tcp0->dst;
 323
 324           dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
 325           if (PREDICT_FALSE (!dm0))
 326             {
 327               nat_log_info ("unknown dst address:  %U",
 328                             format_ip4_address, &ip0->dst_address);
 329               next0 = NAT_DET_OUT2IN_NEXT_DROP;
 330               b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 331               goto trace0;
 332             }
 333
 334           snat_det_reverse (dm0, &ip0->dst_address,
 335                             clib_net_to_host_u16 (tcp0->dst), &new_addr0);
 336
 337           ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
 338           if (PREDICT_FALSE (!ses0))
 339             {
 340               nat_log_info ("no match src %U:%d dst %U:%d for user %U",
 341                             format_ip4_address, &ip0->src_address,
 342                             clib_net_to_host_u16 (tcp0->src),
 343                             format_ip4_address, &ip0->dst_address,
 344                             clib_net_to_host_u16 (tcp0->dst),
 345                             format_ip4_address, &new_addr0);
 346               next0 = NAT_DET_OUT2IN_NEXT_DROP;
 347               b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 348               goto trace0;
 349             }
 350           old_port0 = udp0->dst_port;
 351           udp0->dst_port = new_port0 = ses0->in_port;
 352
 353           old_addr0 = ip0->dst_address;
 354           ip0->dst_address = new_addr0;
 355           vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
 356
 357           sum0 = ip0->checksum;
 358           sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 359                                  ip4_header_t,
 360                                  dst_address /* changed member */ );
 361           ip0->checksum = ip_csum_fold (sum0);
 362
 363           if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
 364             {
 365               if (tcp0->flags & TCP_FLAG_FIN
 366                   && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
 367                 ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
 368               else if (tcp0->flags & TCP_FLAG_ACK
 369                        && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
 370                 snat_det_ses_close (dm0, ses0);
 371
 372               sum0 = tcp0->checksum;
 373               sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 374                                      ip4_header_t,
 375                                      dst_address /* changed member */ );
 376               sum0 = ip_csum_update (sum0, old_port0, new_port0,
 377                                      ip4_header_t /* cheat */ ,
 378                                      length /* changed member */ );
 379               tcp0->checksum = ip_csum_fold (sum0);
 380             }
 381           else if (udp0->checksum)
 382             {
 383               sum0 = udp0->checksum;
 384               sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 385                                      ip4_header_t,
 386                                      dst_address /* changed member */ );
 387               sum0 = ip_csum_update (sum0, old_port0, new_port0,
 388                                      ip4_header_t /* cheat */ ,
 389                                      length /* changed member */ );
 390               udp0->checksum = ip_csum_fold (sum0);
 391             }
 392
 393         trace0:
 394
 395           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 396                              && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 397             {
 398               nat_det_out2in_trace_t *t =
 399                 vlib_add_trace (vm, node, b0, sizeof (*t));
 400               t->sw_if_index = sw_if_index0;
 401               t->next_index = next0;
 402               t->session_index = ~0;
 403               if (ses0)
 404                 t->session_index = ses0 - dm0->sessions;
 405             }
 406
 407           pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
 408
 409           b1 = vlib_get_buffer (vm, bi1);
 410
 411           ip1 = vlib_buffer_get_current (b1);
 412           udp1 = ip4_next_header (ip1);
 413           tcp1 = (tcp_header_t *) udp1;
 414
 415           sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
 416
 417           if (PREDICT_FALSE (ip1->ttl == 1))
 418             {
 419               vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 420               icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
 421                                            ICMP4_time_exceeded_ttl_exceeded_in_transit,
 422                                            0);
 423               next1 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
 424               goto trace1;
 425             }
 426
 427           proto1 = ip_proto_to_snat_proto (ip1->protocol);
 428
 429           if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
 430             {
 431               rx_fib_index1 =
 432                 ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
 433               icmp1 = (icmp46_header_t *) udp1;
 434
 435               next1 = icmp_out2in (sm, b1, ip1, icmp1, sw_if_index1,
 436                                    rx_fib_index1, node, next1, thread_index,
 437                                    &ses1, &dm1);
 438               goto trace1;
 439             }
 440
 441           key1.ext_host_addr = ip1->src_address;
 442           key1.ext_host_port = tcp1->src;
 443           key1.out_port = tcp1->dst;
 444
 445           dm1 = snat_det_map_by_out (sm, &ip1->dst_address);
 446           if (PREDICT_FALSE (!dm1))
 447             {
 448               nat_log_info ("unknown dst address:  %U",
 449                             format_ip4_address, &ip1->dst_address);
 450               next1 = NAT_DET_OUT2IN_NEXT_DROP;
 451               b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 452               goto trace1;
 453             }
 454
 455           snat_det_reverse (dm1, &ip1->dst_address,
 456                             clib_net_to_host_u16 (tcp1->dst), &new_addr1);
 457
 458           ses1 = snat_det_get_ses_by_out (dm1, &new_addr1, key1.as_u64);
 459           if (PREDICT_FALSE (!ses1))
 460             {
 461               nat_log_info ("no match src %U:%d dst %U:%d for user %U",
 462                             format_ip4_address, &ip1->src_address,
 463                             clib_net_to_host_u16 (tcp1->src),
 464                             format_ip4_address, &ip1->dst_address,
 465                             clib_net_to_host_u16 (tcp1->dst),
 466                             format_ip4_address, &new_addr1);
 467               next1 = NAT_DET_OUT2IN_NEXT_DROP;
 468               b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 469               goto trace1;
 470             }
 471           old_port1 = udp1->dst_port;
 472           udp1->dst_port = new_port1 = ses1->in_port;
 473
 474           old_addr1 = ip1->dst_address;
 475           ip1->dst_address = new_addr1;
 476           vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
 477
 478           sum1 = ip1->checksum;
 479           sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
 480                                  ip4_header_t,
 481                                  dst_address /* changed member */ );
 482           ip1->checksum = ip_csum_fold (sum1);
 483
 484           if (PREDICT_TRUE (proto1 == SNAT_PROTOCOL_TCP))
 485             {
 486               if (tcp1->flags & TCP_FLAG_FIN
 487                   && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
 488                 ses1->state = SNAT_SESSION_TCP_CLOSE_WAIT;
 489               else if (tcp1->flags & TCP_FLAG_ACK
 490                        && ses1->state == SNAT_SESSION_TCP_LAST_ACK)
 491                 snat_det_ses_close (dm1, ses1);
 492
 493               sum1 = tcp1->checksum;
 494               sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
 495                                      ip4_header_t,
 496                                      dst_address /* changed member */ );
 497               sum1 = ip_csum_update (sum1, old_port1, new_port1,
 498                                      ip4_header_t /* cheat */ ,
 499                                      length /* changed member */ );
 500               tcp1->checksum = ip_csum_fold (sum1);
 501             }
 502           else if (udp1->checksum)
 503             {
 504               sum1 = udp1->checksum;
 505               sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
 506                                      ip4_header_t,
 507                                      dst_address /* changed member */ );
 508               sum1 = ip_csum_update (sum1, old_port1, new_port1,
 509                                      ip4_header_t /* cheat */ ,
 510                                      length /* changed member */ );
 511               udp1->checksum = ip_csum_fold (sum1);
 512             }
 513
 514         trace1:
 515
 516           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 517                              && (b1->flags & VLIB_BUFFER_IS_TRACED)))
 518             {
 519               nat_det_out2in_trace_t *t =
 520                 vlib_add_trace (vm, node, b1, sizeof (*t));
 521               t->sw_if_index = sw_if_index1;
 522               t->next_index = next1;
 523               t->session_index = ~0;
 524               if (ses1)
 525                 t->session_index = ses1 - dm1->sessions;
 526             }
 527
 528           pkts_processed += next1 != NAT_DET_OUT2IN_NEXT_DROP;
 529
 530           /* verify speculative enqueues, maybe switch current next frame */
 531           vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
 532                                            to_next, n_left_to_next,
 533                                            bi0, bi1, next0, next1);
 534         }
 535
 536       while (n_left_from > 0 && n_left_to_next > 0)
 537         {
 538           u32 bi0;
 539           vlib_buffer_t *b0;
 540           u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP;
 541           u32 sw_if_index0;
 542           ip4_header_t *ip0;
 543           ip_csum_t sum0;
 544           ip4_address_t new_addr0, old_addr0;
 545           u16 new_port0, old_port0;
 546           udp_header_t *udp0;
 547           tcp_header_t *tcp0;
 548           u32 proto0;
 549           snat_det_out_key_t key0;
 550           snat_det_map_t *dm0;
 551           snat_det_session_t *ses0 = 0;
 552           u32 rx_fib_index0;
 553           icmp46_header_t *icmp0;
 554
 555           /* speculatively enqueue b0 to the current next frame */
 556           bi0 = from[0];
 557           to_next[0] = bi0;
 558           from += 1;
 559           to_next += 1;
 560           n_left_from -= 1;
 561           n_left_to_next -= 1;
 562
 563           b0 = vlib_get_buffer (vm, bi0);
 564
 565           ip0 = vlib_buffer_get_current (b0);
 566           udp0 = ip4_next_header (ip0);
 567           tcp0 = (tcp_header_t *) udp0;
 568
 569           sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
 570
 571           if (PREDICT_FALSE (ip0->ttl == 1))
 572             {
 573               vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 574               icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
 575                                            ICMP4_time_exceeded_ttl_exceeded_in_transit,
 576                                            0);
 577               next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
 578               goto trace00;
 579             }
 580
 581           proto0 = ip_proto_to_snat_proto (ip0->protocol);
 582
 583           if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
 584             {
 585               rx_fib_index0 =
 586                 ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
 587               icmp0 = (icmp46_header_t *) udp0;
 588
 589               next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
 590                                    rx_fib_index0, node, next0, thread_index,
 591                                    &ses0, &dm0);
 592               goto trace00;
 593             }
 594
 595           key0.ext_host_addr = ip0->src_address;
 596           key0.ext_host_port = tcp0->src;
 597           key0.out_port = tcp0->dst;
 598
 599           dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
 600           if (PREDICT_FALSE (!dm0))
 601             {
 602               nat_log_info ("unknown dst address:  %U",
 603                             format_ip4_address, &ip0->dst_address);
 604               next0 = NAT_DET_OUT2IN_NEXT_DROP;
 605               b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 606               goto trace00;
 607             }
 608
 609           snat_det_reverse (dm0, &ip0->dst_address,
 610                             clib_net_to_host_u16 (tcp0->dst), &new_addr0);
 611
 612           ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
 613           if (PREDICT_FALSE (!ses0))
 614             {
 615               nat_log_info ("no match src %U:%d dst %U:%d for user %U",
 616                             format_ip4_address, &ip0->src_address,
 617                             clib_net_to_host_u16 (tcp0->src),
 618                             format_ip4_address, &ip0->dst_address,
 619                             clib_net_to_host_u16 (tcp0->dst),
 620                             format_ip4_address, &new_addr0);
 621               next0 = NAT_DET_OUT2IN_NEXT_DROP;
 622               b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
 623               goto trace00;
 624             }
 625           old_port0 = udp0->dst_port;
 626           udp0->dst_port = new_port0 = ses0->in_port;
 627
 628           old_addr0 = ip0->dst_address;
 629           ip0->dst_address = new_addr0;
 630           vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
 631
 632           sum0 = ip0->checksum;
 633           sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 634                                  ip4_header_t,
 635                                  dst_address /* changed member */ );
 636           ip0->checksum = ip_csum_fold (sum0);
 637
 638           if (PREDICT_TRUE (proto0 == SNAT_PROTOCOL_TCP))
 639             {
 640               if (tcp0->flags & TCP_FLAG_FIN
 641                   && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
 642                 ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
 643               else if (tcp0->flags & TCP_FLAG_ACK
 644                        && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
 645                 snat_det_ses_close (dm0, ses0);
 646
 647               sum0 = tcp0->checksum;
 648               sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 649                                      ip4_header_t,
 650                                      dst_address /* changed member */ );
 651               sum0 = ip_csum_update (sum0, old_port0, new_port0,
 652                                      ip4_header_t /* cheat */ ,
 653                                      length /* changed member */ );
 654               tcp0->checksum = ip_csum_fold (sum0);
 655             }
 656           else if (udp0->checksum)
 657             {
 658               sum0 = udp0->checksum;
 659               sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
 660                                      ip4_header_t,
 661                                      dst_address /* changed member */ );
 662               sum0 = ip_csum_update (sum0, old_port0, new_port0,
 663                                      ip4_header_t /* cheat */ ,
 664                                      length /* changed member */ );
 665               udp0->checksum = ip_csum_fold (sum0);
 666             }
 667
 668         trace00:
 669
 670           if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 671                              && (b0->flags & VLIB_BUFFER_IS_TRACED)))
 672             {
 673               nat_det_out2in_trace_t *t =
 674                 vlib_add_trace (vm, node, b0, sizeof (*t));
 675               t->sw_if_index = sw_if_index0;
 676               t->next_index = next0;
 677               t->session_index = ~0;
 678               if (ses0)
 679                 t->session_index = ses0 - dm0->sessions;
 680             }
 681
 682           pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
 683
 684           /* verify speculative enqueue, maybe switch current next frame */
 685           vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
 686                                            to_next, n_left_to_next,
 687                                            bi0, next0);
 688         }
 689
 690       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 691     }
 692
 693   vlib_node_increment_counter (vm, sm->det_out2in_node_index,
 694                                NAT_DET_OUT2IN_ERROR_OUT2IN_PACKETS,
 695                                pkts_processed);
 696   return frame->n_vectors;
 697 }
 698
 699 /* *INDENT-OFF* */
 700 VLIB_REGISTER_NODE (snat_det_out2in_node) = {
 701   .name = "nat44-det-out2in",
 702   .vector_size = sizeof (u32),
 703   .format_trace = format_nat_det_out2in_trace,
 704   .type = VLIB_NODE_TYPE_INTERNAL,
 705   .n_errors = ARRAY_LEN(nat_det_out2in_error_strings),
 706   .error_strings = nat_det_out2in_error_strings,
 707   .runtime_data_bytes = sizeof (snat_runtime_t),
 708   .n_next_nodes = NAT_DET_OUT2IN_N_NEXT,
 709   /* edit / add dispositions here */
 710   .next_nodes = {
 711     [NAT_DET_OUT2IN_NEXT_DROP] = "error-drop",
 712     [NAT_DET_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
 713     [NAT_DET_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
 714   },
 715 };
 716 /* *INDENT-ON* */
 717
 718 /*
 719  * fd.io coding-style-patch-verification: ON
 720  *
 721  * Local Variables:
 722  * eval: (c-set-style "gnu")
 723  * End:
 724  */