NAT: fix maximum out of order fragments (VPP-1399)

[vpp.git] / src / plugins / nat / nat64_in2out.c

diff --git a/src/plugins/nat/nat64_in2out.c b/src/plugins/nat/nat64_in2out.c
index 6ff428b..ddbf585 100644 (file)
--- a/src/plugins/nat/nat64_in2out.c
+++ b/src/plugins/nat/nat64_in2out.c
@@ -224,8 +224,6 @@ nat64_in2out_tcp_udp_set_cb (ip6_header_t * ip6, ip4_header_t * ip4,
        return -1;
     }
 
-  nat64_session_reset_timeout (ste, ctx->vm);
-
   ip4->src_address.as_u32 = bibe->out_addr.as_u32;
   udp->src_port = bibe->out_port;
 
@@ -237,12 +235,15 @@ nat64_in2out_tcp_udp_set_cb (ip6_header_t * ip6, ip4_header_t * ip4,
       ip_csum_t csum;
       tcp_header_t *tcp = ip6_next_header (ip6);
 
+      nat64_tcp_session_set_state (ste, tcp, 1);
       checksum = &tcp->checksum;
       csum = ip_csum_sub_even (*checksum, sport);
       csum = ip_csum_add_even (csum, udp->src_port);
       *checksum = ip_csum_fold (csum);
     }
 
+  nat64_session_reset_timeout (ste, ctx->vm);
+
   return 0;
 }
 
@@ -636,6 +637,9 @@ nat64_in2out_tcp_udp_hairpinning (vlib_main_t * vm, vlib_buffer_t * b,
        return -1;
     }
 
+  if (proto == IP_PROTOCOL_TCP)
+    nat64_tcp_session_set_state (ste, tcp, 1);
+
   nat64_session_reset_timeout (ste, vm);
 
   sport = udp->src_port = bibe->out_port;
@@ -922,7 +926,7 @@ nat64_in2out_node_fn_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
   nat64_in2out_next_t next_index;
   u32 pkts_processed = 0;
   u32 stats_node_index;
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
 
   stats_node_index =
     is_slow_path ? nat64_in2out_slowpath_node.index : nat64_in2out_node.index;
@@ -1203,6 +1207,7 @@ nat64_in2out_frag_set_cb (ip6_header_t * ip6, ip4_header_t * ip4, void *arg)
          ip_csum_t csum;
          tcp_header_t *tcp = (tcp_header_t *) udp;
 
+         nat64_tcp_session_set_state (ste, tcp, 1);
          checksum = &tcp->checksum;
          csum = ip_csum_sub_even (*checksum, tcp->src_port);
          csum = ip_csum_sub_even (csum, ip6->src_address.as_u64[0]);
@@ -1263,6 +1268,9 @@ nat64_in2out_frag_hairpinning (vlib_buffer_t * b, ip6_header_t * ip6,
   if (!bibe)
     return -1;
 
+  if (ctx->proto == IP_PROTOCOL_TCP)
+    nat64_tcp_session_set_state (ste, tcp, 1);
+
   nat64_session_reset_timeout (ste, ctx->vm);
 
   sport = bibe->out_port;
@@ -1316,7 +1324,7 @@ nat64_in2out_reass_node_fn (vlib_main_t * vm,
   u32 *fragments_to_drop = 0;
   u32 *fragments_to_loopback = 0;
   nat64_main_t *nm = &nat64_main;
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
 
   from = vlib_frame_vector_args (frame);
   n_left_from = frame->n_vectors;
@@ -1416,7 +1424,8 @@ nat64_in2out_reass_node_fn (vlib_main_t * vm,
              ctx0.first_frag = 0;
              if (PREDICT_FALSE (reass0->sess_index == (u32) ~ 0))
                {
-                 if (nat_ip6_reass_add_fragment (reass0, bi0))
+                 if (nat_ip6_reass_add_fragment
+                     (reass0, bi0, &fragments_to_drop))
                    {
                      b0->error = node->errors[NAT64_IN2OUT_ERROR_MAX_FRAG];
                      next0 = NAT64_IN2OUT_NEXT_DROP;
@@ -1644,7 +1653,7 @@ nat64_in2out_handoff_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
   u32 n_left_to_next_worker = 0, *to_next_worker = 0;
   u32 next_worker_index = 0;
   u32 current_worker_index = ~0;
-  u32 thread_index = vlib_get_thread_index ();
+  u32 thread_index = vm->thread_index;
   u32 fq_index;
   u32 to_node_index;