_(MAX_SESSIONS_EXCEEDED, "Maximum sessions exceeded") \
_(DROP_FRAGMENT, "Drop fragment") \
_(MAX_REASS, "Maximum reassemblies exceeded") \
-_(MAX_FRAG, "Maximum fragments per reassembly exceeded")
+_(MAX_FRAG, "Maximum fragments per reassembly exceeded")\
+_(NON_SYN, "non-SYN packet try to create session")
typedef enum
{
snat_session_t *s0 = *p_s0;
if (PREDICT_TRUE (next0 != NAT_IN2OUT_ED_NEXT_DROP && s0))
{
- /* Hairpinning */
- if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0)
- snat_icmp_hairpinning (sm, b0, ip0, icmp0, sm->endpoint_dependent);
/* Accounting */
nat44_session_update_counters (s0, now,
vlib_buffer_length_in_chain
(sm->vlib_main, b0));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s0, thread_index);
}
return next0;
}
snat_session_t ** sessionp,
vlib_node_runtime_t * node, u32 next, u32 thread_index, f64 now)
{
- snat_session_t *s;
+ snat_session_t *s = 0;
snat_user_t *u;
snat_session_key_t key0, key1;
lb_nat_type_t lb = 0, is_sm = 0;
u32 proto = ip_proto_to_snat_proto (key->proto);
nat_outside_fib_t *outside_fib;
fib_node_index_t fei = FIB_NODE_INDEX_INVALID;
+ u8 identity_nat;
fib_prefix_t pfx = {
.fp_proto = FIB_PROTOCOL_IP4,
.fp_len = 32,
key0.fib_index = rx_fib_index;
key1.fib_index = sm->outside_fib_index;
/* First try to match static mapping by local address and port */
- if (snat_static_mapping_match (sm, key0, &key1, 0, 0, 0, &lb, 0))
+ if (snat_static_mapping_match
+ (sm, key0, &key1, 0, 0, 0, &lb, 0, &identity_nat))
{
/* Try to create dynamic translation */
if (snat_alloc_outside_address_and_port (sm->addresses, rx_fib_index,
}
}
else
- is_sm = 1;
+ {
+ if (PREDICT_FALSE (identity_nat))
+ {
+ *sessionp = s;
+ return next;
+ }
+
+ is_sm = 1;
+ }
u = nat_user_get_or_create (sm, &key->l_addr, rx_fib_index, thread_index);
if (!u)
key0.protocol = proto;
key0.fib_index = sm->outside_fib_index;
/* or is static mappings */
- if (!snat_static_mapping_match (sm, key0, &key1, 1, 0, 0, 0, 0))
+ if (!snat_static_mapping_match (sm, key0, &key1, 1, 0, 0, 0, 0, 0))
return 0;
}
else
/* Accounting */
nat44_session_update_counters (s, now,
vlib_buffer_length_in_chain (vm, b));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s, thread_index);
return 1;
}
else
make_ed_kv (&kv, &ip->src_address, &ip->dst_address, proto, tx_fib_index,
src_port, dst_port);
if (!clib_bihash_search_16_8 (&tsm->out2in_ed, &kv, &value))
- return 1;
+ {
+ s = pool_elt_at_index (tsm->sessions, value.value);
+ if (nat44_is_ses_closed (s))
+ {
+ nat_log_debug ("TCP close connection %U", format_snat_session,
+ &sm->per_thread_data[thread_index], s);
+ nat_free_session_data (sm, s, thread_index);
+ nat44_delete_session (sm, s, thread_index);
+ }
+ else
+ s->flags |= SNAT_SESSION_FLAG_OUTPUT_FEATURE;
+ return 1;
+ }
/* dst NAT check */
make_ed_kv (&kv, &ip->dst_address, &ip->src_address, proto, rx_fib_index,
if (PREDICT_FALSE (next == NAT_IN2OUT_ED_NEXT_DROP))
goto out;
+
+ if (!s)
+ {
+ dont_translate = 1;
+ goto out;
+ }
}
else
{
/* Accounting */
nat44_session_update_counters (s, now, vlib_buffer_length_in_chain (vm, b));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s, thread_index);
/* Hairpinning */
if (vnet_buffer (b)->sw_if_index[VLIB_TX] == ~0)
goto trace00;
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace00;
+ }
+
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
next0, thread_index, now);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace00;
+
+ if (PREDICT_FALSE (!s0))
+ goto trace00;
}
else
{
nat44_session_update_counters (s0, now,
vlib_buffer_length_in_chain (vm,
b0));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s0, thread_index);
trace00:
if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
goto trace01;
}
+ if ((proto1 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp1))
+ {
+ b1->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next1 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace01;
+ }
+
next1 =
slow_path_ed (sm, b1, rx_fib_index1, &kv1, &s1, node,
next1, thread_index, now);
if (PREDICT_FALSE (next1 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace01;
+
+ if (PREDICT_FALSE (!s1))
+ goto trace01;
}
else
{
nat44_session_update_counters (s1, now,
vlib_buffer_length_in_chain (vm,
b1));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s1, thread_index);
trace01:
if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
goto trace0;
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace0;
+ }
+
next0 =
slow_path_ed (sm, b0, rx_fib_index0, &kv0, &s0, node,
next0, thread_index, now);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace0;
+
+ if (PREDICT_FALSE (!s0))
+ goto trace0;
}
else
{
nat44_session_update_counters (s0, now,
vlib_buffer_length_in_chain (vm,
b0));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s0, thread_index);
trace0:
if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
}
}
+ if ((proto0 == SNAT_PROTOCOL_TCP) && !tcp_is_init (tcp0))
+ {
+ b0->error = node->errors[NAT_IN2OUT_ED_ERROR_NON_SYN];
+ next0 = NAT_IN2OUT_ED_NEXT_DROP;
+ goto trace0;
+ }
+
next0 = slow_path_ed (sm, b0, rx_fib_index0, &kv0,
&s0, node, next0, thread_index, now);
if (PREDICT_FALSE (next0 == NAT_IN2OUT_ED_NEXT_DROP))
goto trace0;
+ if (PREDICT_FALSE (!s0))
+ {
+ reass0->flags |= NAT_REASS_FLAG_ED_DONT_TRANSLATE;
+ goto trace0;
+ }
+
reass0->sess_index = s0 - per_thread_data->sessions;
}
else
}
/* Hairpinning */
- if (PREDICT_TRUE (proto0 != SNAT_PROTOCOL_ICMP))
- nat44_reass_hairpinning (sm, b0, ip0, s0->out2in.port,
- s0->ext_host_port, proto0, 1);
- else
- snat_icmp_hairpinning (sm, b0, ip0, icmp0, 1);
+ nat44_reass_hairpinning (sm, b0, ip0, s0->out2in.port,
+ s0->ext_host_port, proto0, 1);
/* Accounting */
nat44_session_update_counters (s0, now,
vlib_buffer_length_in_chain (vm,
b0));
+ /* Per-user LRU list maintenance */
+ nat44_session_update_lru (sm, s0, thread_index);
trace0:
if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
u32 len = vec_len (fragments_to_loopback);
if (len <= VLIB_FRAME_SIZE)
{
- clib_memcpy (from, fragments_to_loopback,
- sizeof (u32) * len);
+ clib_memcpy_fast (from, fragments_to_loopback,
+ sizeof (u32) * len);
n_left_from = len;
vec_reset_length (fragments_to_loopback);
}
else
{
- clib_memcpy (from,
- fragments_to_loopback + (len -
- VLIB_FRAME_SIZE),
- sizeof (u32) * VLIB_FRAME_SIZE);
+ clib_memcpy_fast (from, fragments_to_loopback +
+ (len - VLIB_FRAME_SIZE),
+ sizeof (u32) * VLIB_FRAME_SIZE);
n_left_from = VLIB_FRAME_SIZE;
_vec_len (fragments_to_loopback) = len - VLIB_FRAME_SIZE;
}
Code Review / vpp.git / blobdiff