src/plugins/nat/pnat/pnat.c

   1 /*
   2  * Copyright (c) 2021 Cisco and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include "pnat.h"
  17 #include <arpa/inet.h>
  18 #include <stdbool.h>
  19 #include <vlib/vlib.h>
  20 #include <vnet/feature/feature.h>
  21 #include <vnet/fib/fib_table.h>
  22 #include <vnet/ip/format.h>
  23 #include <vnet/ip/ip4.h>
  24 #include <vnet/ip/ip4_packet.h>
  25 #include <vnet/ip/reass/ip4_sv_reass.h>
  26 #include <vppinfra/clib_error.h>
  27
  28 /*
  29  * This is the main control plane part of the PNAT (Policy 1:1 NAT) feature.
  30  */
  31
  32 pnat_main_t pnat_main;
  33
  34 /*
  35  * Do a lookup in the interface vector (interface_by_sw_if_index)
  36  * and return pool entry.
  37  */
  38 pnat_interface_t *pnat_interface_by_sw_if_index(u32 sw_if_index) {
  39     pnat_main_t *pm = &pnat_main;
  40
  41     if (!pm->interface_by_sw_if_index ||
  42         sw_if_index > (vec_len(pm->interface_by_sw_if_index) - 1))
  43         return 0;
  44     u32 index = pm->interface_by_sw_if_index[sw_if_index];
  45     if (index == ~0)
  46         return 0;
  47     if (pool_is_free_index(pm->interfaces, index))
  48         return 0;
  49     return pool_elt_at_index(pm->interfaces, index);
  50 }
  51
  52 static pnat_mask_fast_t pnat_mask2fast(pnat_mask_t lookup_mask) {
  53     pnat_mask_fast_t m = {0};
  54
  55     if (lookup_mask & PNAT_SA)
  56         m.as_u64[0] = 0xffffffff00000000;
  57     if (lookup_mask & PNAT_DA)
  58         m.as_u64[0] |= 0x00000000ffffffff;
  59     m.as_u64[1] = 0xffffffff00000000;
  60     if (lookup_mask & PNAT_SPORT)
  61         m.as_u64[1] |= 0x00000000ffff0000;
  62     if (lookup_mask & PNAT_DPORT)
  63         m.as_u64[1] |= 0x000000000000ffff;
  64     return m;
  65 }
  66
  67 /*
  68  * Create new PNAT interface object and register the pnat feature in the
  69  * corresponding feature chain.
  70  * Also enable shallow virtual reassembly, to ensure that we have
  71  * L4 ports available for all packets we receive.
  72  */
  73 static clib_error_t *pnat_enable_interface(u32 sw_if_index,
  74                                            pnat_attachment_point_t attachment,
  75                                            pnat_mask_t mask) {
  76     pnat_main_t *pm = &pnat_main;
  77     pnat_interface_t *interface = pnat_interface_by_sw_if_index(sw_if_index);
  78
  79     if (!interface) {
  80         pool_get_zero(pm->interfaces, interface);
  81         interface->sw_if_index = sw_if_index;
  82         vec_validate_init_empty(pm->interface_by_sw_if_index, sw_if_index, ~0);
  83         pm->interface_by_sw_if_index[sw_if_index] = interface - pm->interfaces;
  84     }
  85
  86     char *nodename;
  87     char *arcname;
  88     bool input = false;
  89     switch (attachment) {
  90     case PNAT_IP4_INPUT:
  91         nodename = "pnat-input";
  92         arcname = "ip4-unicast";
  93         input = true;
  94         break;
  95
  96     case PNAT_IP4_OUTPUT:
  97         nodename = "pnat-output";
  98         arcname = "ip4-output";
  99         break;
 100     default:
 101         return clib_error_return(0, "Unknown attachment point %u %u",
 102                                  sw_if_index, attachment);
 103     }
 104
 105     if (!interface->enabled[attachment]) {
 106         if (vnet_feature_enable_disable(arcname, nodename, sw_if_index, 1, 0,
 107                                         0) != 0)
 108             return clib_error_return(0, "PNAT feature enable failed on %u",
 109                                      sw_if_index);
 110
 111         if (input) {
 112             /* TODO: Make shallow virtual reassembly configurable */
 113             ip4_sv_reass_enable_disable_with_refcnt(sw_if_index, 1);
 114         } else {
 115             ip4_sv_reass_output_enable_disable_with_refcnt(sw_if_index, 1);
 116         }
 117
 118         interface->lookup_mask[attachment] = mask;
 119         interface->lookup_mask_fast[attachment] = pnat_mask2fast(mask);
 120         interface->enabled[attachment] = true;
 121
 122     } else {
 123         pnat_mask_t current_mask = interface->lookup_mask[attachment];
 124         if (current_mask != mask) {
 125             return clib_error_return(0,
 126                                      "PNAT lookup mask must be consistent per "
 127                                      "interface/direction %u",
 128                                      sw_if_index);
 129         }
 130     }
 131
 132     interface->refcount++;
 133
 134     return 0;
 135 }
 136
 137 /*
 138  * Delete interface object when no rules reference the interface.
 139  */
 140 static int pnat_disable_interface(u32 sw_if_index,
 141                                   pnat_attachment_point_t attachment) {
 142     pnat_main_t *pm = &pnat_main;
 143     pnat_interface_t *interface = pnat_interface_by_sw_if_index(sw_if_index);
 144
 145     if (!interface)
 146         return 0;
 147     if (interface->refcount == 0)
 148         return 0;
 149
 150     if (interface->enabled[attachment] && attachment == PNAT_IP4_INPUT) {
 151         if (ip4_sv_reass_enable_disable_with_refcnt(sw_if_index, 0) != 0)
 152             return -1;
 153         if (vnet_feature_enable_disable("ip4-unicast", "pnat-input",
 154                                         sw_if_index, 0, 0, 0) != 0)
 155             return -1;
 156     }
 157     if (interface->enabled[attachment] && attachment == PNAT_IP4_OUTPUT) {
 158         if (ip4_sv_reass_output_enable_disable_with_refcnt(sw_if_index, 0) != 0)
 159             return -1;
 160         if (vnet_feature_enable_disable("ip4-output", "pnat-output",
 161                                         sw_if_index, 0, 0, 0) != 0)
 162             return -1;
 163     }
 164
 165     interface->lookup_mask[attachment] = 0;
 166     interface->enabled[attachment] = false;
 167
 168     interface->refcount--;
 169     if (interface->refcount == 0) {
 170         pm->interface_by_sw_if_index[sw_if_index] = ~0;
 171         pool_put(pm->interfaces, interface);
 172     }
 173     return 0;
 174 }
 175
 176 /*
 177  * From a 5-tuple (with mask) calculate the key used in the flow cache lookup.
 178  */
 179 static inline void pnat_calc_key_from_5tuple(u32 sw_if_index,
 180                                              pnat_attachment_point_t attachment,
 181                                              pnat_match_tuple_t *match,
 182                                              clib_bihash_kv_16_8_t *kv) {
 183     pnat_mask_fast_t mask = pnat_mask2fast(match->mask);
 184     ip4_address_t src, dst;
 185     clib_memcpy(&src, &match->src, 4);
 186     clib_memcpy(&dst, &match->dst, 4);
 187     pnat_calc_key(sw_if_index, attachment, src, dst, match->proto,
 188                   htons(match->sport), htons(match->dport), mask, kv);
 189 }
 190
 191 /*
 192  * Map between the 5-tuple mask and the instruction set of the rewrite node.
 193  */
 194 pnat_instructions_t pnat_instructions_from_mask(pnat_mask_t m) {
 195     pnat_instructions_t i = 0;
 196
 197     if (m & PNAT_SA)
 198         i |= PNAT_INSTR_SOURCE_ADDRESS;
 199     if (m & PNAT_DA)
 200         i |= PNAT_INSTR_DESTINATION_ADDRESS;
 201     if (m & PNAT_SPORT)
 202         i |= PNAT_INSTR_SOURCE_PORT;
 203     if (m & PNAT_DPORT)
 204         i |= PNAT_INSTR_DESTINATION_PORT;
 205     if (m & PNAT_COPY_BYTE)
 206         i |= PNAT_INSTR_COPY_BYTE;
 207     if (m & PNAT_CLEAR_BYTE)
 208         i |= PNAT_INSTR_CLEAR_BYTE;
 209     return i;
 210 }
 211
 212 /*
 213  * "Init" the PNAT datastructures. Called upon first creation of a PNAT rule.
 214  * TODO: Make number of buckets configurable.
 215  */
 216 static void pnat_enable(void) {
 217     pnat_main_t *pm = &pnat_main;
 218     if (pm->enabled)
 219         return;
 220
 221     /* Create new flow cache table */
 222     clib_bihash_init_16_8(&pm->flowhash, "PNAT flow hash",
 223                           PNAT_FLOW_HASH_BUCKETS, 0);
 224
 225     pm->enabled = true;
 226 }
 227 static void pnat_disable(void) {
 228     pnat_main_t *pm = &pnat_main;
 229
 230     if (!pm->enabled)
 231         return;
 232     if (pool_elts(pm->translations))
 233         return;
 234
 235     /* Delete flow cache table */
 236     clib_bihash_free_16_8(&pm->flowhash);
 237
 238     pm->enabled = false;
 239 }
 240
 241 /*
 242  * Ensure that a new rule lookup mask matches what's installed on interface
 243  */
 244 static int pnat_interface_check_mask(u32 sw_if_index,
 245                                      pnat_attachment_point_t attachment,
 246                                      pnat_mask_t mask) {
 247     pnat_interface_t *interface = pnat_interface_by_sw_if_index(sw_if_index);
 248     if (!interface)
 249         return 0;
 250     if (!interface->enabled[attachment])
 251         return 0;
 252     if (interface->lookup_mask[attachment] != mask)
 253         return -1;
 254
 255     return 0;
 256 }
 257
 258 /*
 259  * Add a binding to the binding table.
 260  * Returns 0 on success.
 261  *  -1: Invalid mask
 262  *  -2: Only matches ports for UDP or TCP
 263  *
 264  */
 265 int pnat_binding_add(pnat_match_tuple_t *match, pnat_rewrite_tuple_t *rewrite,
 266                      u32 *index) {
 267     pnat_main_t *pm = &pnat_main;
 268
 269     *index = -1;
 270
 271     /* If we aren't matching or rewriting, why are we here? */
 272     if (match->mask == 0 || rewrite->mask == 0)
 273         return -1;
 274
 275     /* Check if protocol is set if ports are set */
 276     if ((match->dport || match->sport) &&
 277         (match->proto != IP_API_PROTO_UDP && match->proto != IP_API_PROTO_TCP))
 278         return -2;
 279
 280     /* Create pool entry */
 281     pnat_translation_t *t;
 282     pool_get_zero(pm->translations, t);
 283     memcpy(&t->post_da, &rewrite->dst, 4);
 284     memcpy(&t->post_sa, &rewrite->src, 4);
 285     t->post_sp = rewrite->sport;
 286     t->post_dp = rewrite->dport;
 287     t->from_offset = rewrite->from_offset;
 288     t->to_offset = rewrite->to_offset;
 289     t->clear_offset = rewrite->clear_offset;
 290     t->instructions = pnat_instructions_from_mask(rewrite->mask);
 291
 292     /* These are only used for show commands and trace */
 293     t->match = *match;
 294     t->rewrite = *rewrite;
 295
 296     *index = t - pm->translations;
 297
 298     return 0;
 299 }
 300
 301 /*
 302  * Looks a match flow in the flow cache, returns the index  in the binding table
 303  */
 304 u32 pnat_flow_lookup(u32 sw_if_index, pnat_attachment_point_t attachment,
 305                      pnat_match_tuple_t *match) {
 306     pnat_main_t *pm = &pnat_main;
 307     clib_bihash_kv_16_8_t kv, value;
 308     pnat_calc_key_from_5tuple(sw_if_index, attachment, match, &kv);
 309     if (clib_bihash_search_16_8(&pm->flowhash, &kv, &value) == 0) {
 310         return value.value;
 311     }
 312     return ~0;
 313 }
 314
 315 /*
 316  * Attach a binding to an interface / direction.
 317  * Returns 0 on success.
 318  * -1: Binding does not exist
 319  * -2: Interface mask does not match
 320  * -3: Existing match entry in flow table
 321  * -4: Adding flow table entry failed
 322  */
 323 int pnat_binding_attach(u32 sw_if_index, pnat_attachment_point_t attachment,
 324                         u32 binding_index) {
 325     pnat_main_t *pm = &pnat_main;
 326
 327     if (!pm->translations ||
 328         pool_is_free_index(pm->translations, binding_index))
 329         return -1;
 330
 331     pnat_translation_t *t = pool_elt_at_index(pm->translations, binding_index);
 332
 333     if (pnat_interface_check_mask(sw_if_index, attachment, t->match.mask) != 0)
 334         return -2;
 335
 336     pnat_enable();
 337
 338     /* Verify non-duplicate */
 339     clib_bihash_kv_16_8_t kv, value;
 340     pnat_calc_key_from_5tuple(sw_if_index, attachment, &t->match, &kv);
 341     if (clib_bihash_search_16_8(&pm->flowhash, &kv, &value) == 0) {
 342         return -3;
 343     }
 344
 345     /* Create flow cache */
 346     kv.value = binding_index;
 347     if (clib_bihash_add_del_16_8(&pm->flowhash, &kv, 1)) {
 348         pool_put(pm->translations, t);
 349         return -4;
 350     }
 351
 352     /* Register interface */
 353     pnat_enable_interface(sw_if_index, attachment, t->match.mask);
 354
 355     return 0;
 356 }
 357
 358 int pnat_binding_detach(u32 sw_if_index, pnat_attachment_point_t attachment,
 359                         u32 binding_index) {
 360     pnat_main_t *pm = &pnat_main;
 361
 362     if (!pm->translations ||
 363         pool_is_free_index(pm->translations, binding_index))
 364         return -1;
 365
 366     pnat_translation_t *t = pool_elt_at_index(pm->translations, binding_index);
 367
 368     /* Verify non-duplicate */
 369     clib_bihash_kv_16_8_t kv;
 370     pnat_calc_key_from_5tuple(sw_if_index, attachment, &t->match, &kv);
 371     if (clib_bihash_add_del_16_8(&pm->flowhash, &kv, 0)) {
 372         return -2;
 373     }
 374
 375     /* Deregister interface */
 376     pnat_disable_interface(sw_if_index, attachment);
 377
 378     pnat_disable();
 379
 380     return 0;
 381 }
 382
 383 /*
 384  * Delete a translation using the index returned from pnat_add_translation.
 385  */
 386 int pnat_binding_del(u32 index) {
 387     pnat_main_t *pm = &pnat_main;
 388
 389     if (pool_is_free_index(pm->translations, index)) {
 390         clib_warning("Binding delete: translation does not exist: %d", index);
 391         return -1;
 392     }
 393
 394     pnat_translation_t *t = pool_elt_at_index(pm->translations, index);
 395     pool_put(pm->translations, t);
 396
 397     return 0;
 398 }