X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blobdiff_plain;f=src%2Fplugins%2Fnat%2Fnat.h;h=76f57542d1607b53cb6eb936ea6244b715c08e3f;hp=61d26b2076ca95fadc130a0b0334a3782371979b;hb=878c646a;hpb=ebdf190a9c4a514329de7e5e9b9178c3af055122 diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h index 61d26b2076c..76f57542d16 100644 --- a/src/plugins/nat/nat.h +++ b/src/plugins/nat/nat.h @@ -28,15 +28,16 @@ #include #include #include +#include #define SNAT_UDP_TIMEOUT 300 -#define SNAT_UDP_TIMEOUT_MIN 120 #define SNAT_TCP_TRANSITORY_TIMEOUT 240 #define SNAT_TCP_ESTABLISHED_TIMEOUT 7440 -#define SNAT_TCP_INCOMING_SYN 6 #define SNAT_ICMP_TIMEOUT 60 +#define NAT_FQ_NELTS 64 + #define SNAT_FLAG_HAIRPINNING (1 << 0) /* Key */ @@ -126,6 +127,14 @@ typedef enum { #undef _ } snat_session_state_t; +#define NAT44_SES_I2O_FIN 1 +#define NAT44_SES_O2I_FIN 2 +#define NAT44_SES_I2O_FIN_ACK 4 +#define NAT44_SES_O2I_FIN_ACK 8 +#define NAT44_SES_I2O_SYN 16 +#define NAT44_SES_O2I_SYN 32 + +#define nat44_is_ses_closed(s) s->state == 0xf #define SNAT_SESSION_FLAG_STATIC_MAPPING 1 #define SNAT_SESSION_FLAG_UNKNOWN_PROTO 2 @@ -163,12 +172,14 @@ typedef CLIB_PACKED(struct { ip4_address_t ext_host_addr; /* 68-71 */ u16 ext_host_port; /* 72-73 */ - /* External hos address and port after translation */ + /* External host address and port after translation */ ip4_address_t ext_host_nat_addr; /* 74-77 */ u16 ext_host_nat_port; /* 78-79 */ /* TCP session state */ u8 state; + u32 i2o_fin_seq; + u32 o2i_fin_seq; }) snat_session_t; @@ -191,6 +202,11 @@ typedef struct { #undef _ } snat_address_t; +typedef struct { + u32 fib_index; + u32 refcount; +} nat_outside_fib_t; + typedef struct { u16 in_port; snat_det_out_key_t out; @@ -215,6 +231,8 @@ typedef struct { u16 port; u8 probability; u8 prefix; + u32 vrf_id; + u32 fib_index; } nat44_lb_addr_port_t; typedef enum { @@ -234,7 +252,7 @@ typedef struct { u32 vrf_id; u32 fib_index; snat_protocol_t proto; - u32 worker_index; + u32 *workers; u8 *tag; nat44_lb_addr_port_t *locals; } snat_static_mapping_t; @@ -262,6 +280,10 @@ typedef struct { clib_bihash_8_8_t out2in; clib_bihash_8_8_t in2out; + /* Endpoint dependent sessions lookup tables */ + clib_bihash_16_8_t out2in_ed; + clib_bihash_16_8_t in2out_ed; + /* Find-a-user => src address lookup */ clib_bihash_8_8_t user_hash; @@ -301,16 +323,11 @@ typedef int nat_alloc_out_addr_and_port_function_t (snat_address_t * addresses, u32 snat_thread_index); typedef struct snat_main_s { - /* Endpoint address dependent sessions lookup tables */ - clib_bihash_16_8_t out2in_ed; - clib_bihash_16_8_t in2out_ed; - snat_icmp_match_function_t * icmp_match_in2out_cb; snat_icmp_match_function_t * icmp_match_out2in_cb; u32 num_workers; u32 first_worker_index; - u32 next_worker; u32 * workers; snat_get_worker_function_t * worker_in2out_cb; snat_get_worker_function_t * worker_out2in_cb; @@ -340,6 +357,9 @@ typedef struct snat_main_s { u8 psid_length; u16 psid; + /* vector of outside fibs */ + nat_outside_fib_t * outside_fibs; + /* Vector of twice NAT addresses for extenal hosts */ snat_address_t * twice_nat_addresses; @@ -362,6 +382,7 @@ typedef struct snat_main_s { u32 in2out_node_index; u32 in2out_output_node_index; u32 out2in_node_index; + u32 error_node_index; /* Deterministic NAT */ snat_det_map_t * det_maps; @@ -374,6 +395,7 @@ typedef struct snat_main_s { u8 static_mapping_connection_tracking; u8 deterministic; u8 out2in_dpo; + u8 endpoint_dependent; u32 translation_buckets; u32 translation_memory_size; u32 max_translations; @@ -394,6 +416,9 @@ typedef struct snat_main_s { /* API message ID base */ u16 msg_id_base; + /* log class */ + vlib_log_class_t log_class; + /* convenience */ vlib_main_t * vlib_main; vnet_main_t * vnet_main; @@ -402,6 +427,11 @@ typedef struct snat_main_s { api_main_t * api_main; } snat_main_t; +typedef struct { + u32 thread_index; + f64 now; +} nat44_is_idle_session_ctx_t; + extern snat_main_t snat_main; extern vlib_node_registration_t snat_in2out_node; extern vlib_node_registration_t snat_in2out_output_node; @@ -415,11 +445,18 @@ extern vlib_node_registration_t snat_det_in2out_node; extern vlib_node_registration_t snat_det_out2in_node; extern vlib_node_registration_t snat_hairpin_dst_node; extern vlib_node_registration_t snat_hairpin_src_node; +extern vlib_node_registration_t nat44_ed_in2out_node; +extern vlib_node_registration_t nat44_ed_in2out_output_node; +extern vlib_node_registration_t nat44_ed_out2in_node; +extern vlib_node_registration_t nat44_ed_hairpin_dst_node; +extern vlib_node_registration_t nat44_ed_hairpin_src_node; +extern vlib_node_registration_t nat44_ed_in2out_worker_handoff_node; +extern vlib_node_registration_t nat44_ed_in2out_output_worker_handoff_node; +extern vlib_node_registration_t nat44_ed_out2in_worker_handoff_node; void snat_free_outside_address_and_port (snat_address_t * addresses, u32 thread_index, - snat_session_key_t * k, - u32 address_index); + snat_session_key_t * k); int snat_alloc_outside_address_and_port (snat_address_t * addresses, u32 fib_index, @@ -445,6 +482,7 @@ void snat_add_del_addr_to_fib (ip4_address_t * addr, format_function_t format_snat_user; format_function_t format_snat_static_mapping; format_function_t format_snat_static_map_to_resolve; +format_function_t format_snat_session; format_function_t format_det_map_ses; typedef struct { @@ -491,6 +529,17 @@ typedef struct { #define nat_interface_is_inside(i) i->flags & NAT_INTERFACE_FLAG_IS_INSIDE #define nat_interface_is_outside(i) i->flags & NAT_INTERFACE_FLAG_IS_OUTSIDE +#define nat_log_err(...) \ + vlib_log(VLIB_LOG_LEVEL_ERR, snat_main.log_class, __VA_ARGS__) +#define nat_log_warn(...) \ + vlib_log(VLIB_LOG_LEVEL_WARNING, snat_main.log_class, __VA_ARGS__) +#define nat_log_notice(...) \ + vlib_log(VLIB_LOG_LEVEL_NOTICE, snat_main.log_class, __VA_ARGS__) +#define nat_log_info(...) \ + vlib_log(VLIB_LOG_LEVEL_INFO, snat_main.log_class, __VA_ARGS__) +#define nat_log_debug(...)\ + vlib_log(VLIB_LOG_LEVEL_DEBUG, snat_main.log_class, __VA_ARGS__) + /* * Why is this here? Because we don't need to touch this layer to * simply reply to an icmp. We need to change id to a unique @@ -502,31 +551,6 @@ typedef struct { u16 sequence; } icmp_echo_header_t; -always_inline u32 -ip_proto_to_snat_proto (u8 ip_proto) -{ - u32 snat_proto = ~0; - - snat_proto = (ip_proto == IP_PROTOCOL_UDP) ? SNAT_PROTOCOL_UDP : snat_proto; - snat_proto = (ip_proto == IP_PROTOCOL_TCP) ? SNAT_PROTOCOL_TCP : snat_proto; - snat_proto = (ip_proto == IP_PROTOCOL_ICMP) ? SNAT_PROTOCOL_ICMP : snat_proto; - snat_proto = (ip_proto == IP_PROTOCOL_ICMP6) ? SNAT_PROTOCOL_ICMP : snat_proto; - - return snat_proto; -} - -always_inline u8 -snat_proto_to_ip_proto (snat_protocol_t snat_proto) -{ - u8 ip_proto = ~0; - - ip_proto = (snat_proto == SNAT_PROTOCOL_UDP) ? IP_PROTOCOL_UDP : ip_proto; - ip_proto = (snat_proto == SNAT_PROTOCOL_TCP) ? IP_PROTOCOL_TCP : ip_proto; - ip_proto = (snat_proto == SNAT_PROTOCOL_ICMP) ? IP_PROTOCOL_ICMP : ip_proto; - - return ip_proto; -} - typedef struct { u16 src_port, dst_port; } tcp_udp_header_t; @@ -546,6 +570,11 @@ u32 icmp_match_in2out_det(snat_main_t *sm, vlib_node_runtime_t *node, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); +u32 icmp_match_in2out_ed(snat_main_t *sm, vlib_node_runtime_t *node, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, + snat_session_key_t *p_value, + u8 *p_dont_translate, void *d, void *e); u32 icmp_match_out2in_fast(snat_main_t *sm, vlib_node_runtime_t *node, u32 thread_index, vlib_buffer_t *b0, ip4_header_t *ip0, u8 *p_proto, @@ -561,9 +590,14 @@ u32 icmp_match_out2in_det(snat_main_t *sm, vlib_node_runtime_t *node, ip4_header_t *ip0, u8 *p_proto, snat_session_key_t *p_value, u8 *p_dont_translate, void *d, void *e); +u32 icmp_match_out2in_ed(snat_main_t *sm, vlib_node_runtime_t *node, + u32 thread_index, vlib_buffer_t *b0, + ip4_header_t *ip0, u8 *p_proto, + snat_session_key_t *p_value, + u8 *p_dont_translate, void *d, void *e); void increment_v4_address(ip4_address_t * a); -void snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, - u8 twice_nat); +int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, + u8 twice_nat); int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat); void nat44_add_del_address_dpo (ip4_address_t addr, u8 is_add); @@ -582,129 +616,29 @@ int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, uword unformat_snat_protocol(unformat_input_t * input, va_list * args); u8 * format_snat_protocol(u8 * s, va_list * args); int nat44_add_del_lb_static_mapping (ip4_address_t e_addr, u16 e_port, - snat_protocol_t proto, u32 vrf_id, + snat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag); int nat44_del_session (snat_main_t *sm, ip4_address_t *addr, u16 port, snat_protocol_t proto, u32 vrf_id, int is_in); +int nat44_del_ed_session (snat_main_t *sm, ip4_address_t *addr, u16 port, + ip4_address_t *eh_addr, u16 eh_port, u8 proto, + u32 vrf_id, int is_in); void nat_free_session_data (snat_main_t * sm, snat_session_t * s, u32 thread_index); snat_user_t * nat_user_get_or_create (snat_main_t *sm, ip4_address_t *addr, u32 fib_index, u32 thread_index); snat_session_t * nat_session_alloc_or_recycle (snat_main_t *sm, snat_user_t *u, u32 thread_index); +snat_session_t * nat_ed_session_alloc (snat_main_t *sm, snat_user_t *u, + u32 thread_index); void nat_set_alloc_addr_and_port_mape (u16 psid, u16 psid_offset, u16 psid_length); void nat_set_alloc_addr_and_port_default (void); - -static_always_inline u8 -icmp_is_error_message (icmp46_header_t * icmp) -{ - switch(icmp->type) - { - case ICMP4_destination_unreachable: - case ICMP4_time_exceeded: - case ICMP4_parameter_problem: - case ICMP4_source_quench: - case ICMP4_redirect: - case ICMP4_alternate_host_address: - return 1; - } - return 0; -} - -static_always_inline u8 -is_interface_addr(snat_main_t *sm, vlib_node_runtime_t *node, u32 sw_if_index0, - u32 ip4_addr) -{ - snat_runtime_t *rt = (snat_runtime_t *) node->runtime_data; - ip4_address_t * first_int_addr; - - if (PREDICT_FALSE(rt->cached_sw_if_index != sw_if_index0)) - { - first_int_addr = - ip4_interface_first_address (sm->ip4_main, sw_if_index0, - 0 /* just want the address */); - rt->cached_sw_if_index = sw_if_index0; - if (first_int_addr) - rt->cached_ip4_address = first_int_addr->as_u32; - else - rt->cached_ip4_address = 0; - } - - if (PREDICT_FALSE(ip4_addr == rt->cached_ip4_address)) - return 1; - else - return 0; -} - -always_inline u8 -maximum_sessions_exceeded (snat_main_t *sm, u32 thread_index) -{ - if (pool_elts (sm->per_thread_data[thread_index].sessions) >= sm->max_translations) - return 1; - - return 0; -} - -static_always_inline void -nat_send_all_to_node(vlib_main_t *vm, u32 *bi_vector, - vlib_node_runtime_t *node, vlib_error_t *error, u32 next) -{ - u32 n_left_from, *from, next_index, *to_next, n_left_to_next; - - from = bi_vector; - n_left_from = vec_len(bi_vector); - next_index = node->cached_next_index; - while (n_left_from > 0) { - vlib_get_next_frame(vm, node, next_index, to_next, n_left_to_next); - while (n_left_from > 0 && n_left_to_next > 0) { - u32 bi0 = to_next[0] = from[0]; - from += 1; - n_left_from -= 1; - to_next += 1; - n_left_to_next -= 1; - vlib_buffer_t *p0 = vlib_get_buffer(vm, bi0); - p0->error = *error; - vlib_validate_buffer_enqueue_x1(vm, node, next_index, to_next, - n_left_to_next, bi0, next); - } - vlib_put_next_frame(vm, node, next_index, n_left_to_next); - } -} - -always_inline void -user_session_increment(snat_main_t *sm, snat_user_t *u, u8 is_static) -{ - if (u->nsessions + u->nstaticsessions < sm->max_translations_per_user) - { - if (is_static) - u->nstaticsessions++; - else - u->nsessions++; - } -} - -always_inline void -nat44_set_tcp_session_state(snat_main_t * sm, snat_session_t * ses, - tcp_header_t * tcp, u32 thread_index) -{ - if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_UNKNOWN) - ses->state = SNAT_SESSION_TCP_FIN_WAIT; - else if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_TCP_FIN_WAIT) - ses->state = SNAT_SESSION_TCP_CLOSING; - else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_FIN_WAIT) - ses->state = SNAT_SESSION_TCP_CLOSE_WAIT; - else if (tcp->flags & TCP_FLAG_FIN && ses->state == SNAT_SESSION_TCP_CLOSE_WAIT) - ses->state = SNAT_SESSION_TCP_LAST_ACK; - else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_CLOSING) - ses->state = SNAT_SESSION_TCP_LAST_ACK; - else if (tcp->flags & TCP_FLAG_ACK && ses->state == SNAT_SESSION_TCP_LAST_ACK) - { - nat_free_session_data (sm, ses, thread_index); - ses->state = SNAT_SESSION_TCP_CLOSED; - } -} +int nat44_i2o_ed_is_idle_session_cb (clib_bihash_kv_16_8_t *kv, void *arg); +int nat44_o2i_ed_is_idle_session_cb (clib_bihash_kv_16_8_t *kv, void *arg); +int nat44_i2o_is_idle_session_cb (clib_bihash_kv_8_8_t *kv, void *arg); +int nat44_o2i_is_idle_session_cb (clib_bihash_kv_8_8_t *kv, void *arg); #endif /* __included_snat_h__ */