#include <nat/nat_ipfix_logging.h>
#include <nat/nat_reass.h>
#include <nat/nat_inlines.h>
+#include <nat/nat44_inlines.h>
#include <nat/nat_syslog.h>
#include <nat/nat_ha.h>
};
nat44_is_idle_session_ctx_t ctx0;
+ nat44_session_try_cleanup (&ip0->src_address, rx_fib_index0, thread_index,
+ now);
+
if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
{
b0->error = node->errors[SNAT_IN2OUT_ERROR_MAX_SESSIONS_EXCEEDED];
#include <nat/nat_ipfix_logging.h>
#include <nat/nat_reass.h>
#include <nat/nat_inlines.h>
+#include <nat/nat44_inlines.h>
#include <nat/nat_syslog.h>
#include <nat/nat_ha.h>
};
nat44_is_idle_session_ctx_t ctx;
+ nat44_session_try_cleanup (&key->l_addr, rx_fib_index, thread_index, now);
+
if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
{
b->error = node->errors[NAT_IN2OUT_ED_ERROR_MAX_SESSIONS_EXCEEDED];
u->sessions_per_user_list_head_index);
oldest_elt = pool_elt_at_index (tsm->list_pool, oldest_index);
s = pool_elt_at_index (tsm->sessions, oldest_elt->value);
+
sess_timeout_time = s->last_heard + (f64) nat44_session_get_timeout (sm, s);
if (now >= sess_timeout_time)
{
sm->fq_in2out_index = ~0;
sm->fq_in2out_output_index = ~0;
sm->fq_out2in_index = ~0;
- sm->udp_timeout = SNAT_UDP_TIMEOUT;
- sm->tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
- sm->tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
- sm->icmp_timeout = SNAT_ICMP_TIMEOUT;
+
+
sm->alloc_addr_and_port = nat_alloc_addr_and_port_default;
sm->addr_and_port_alloc_alg = NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT;
sm->forwarding_enabled = 0;
node = vlib_get_node_by_name (vm, (u8 *) "nat-pre-out2in");
sm->pre_out2in_node_index = node->index;
- // TODO: output ?? (special node)
-
node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out");
sm->in2out_node_index = node->index;
node = vlib_get_node_by_name (vm, (u8 *) "nat44-in2out-output");
{
snat_main_t *sm = &snat_main;
nat66_main_t *nm = &nat66_main;
- u32 translation_buckets = 1024;
- u32 translation_memory_size = 128 << 20;
- u32 user_buckets = 128;
- u32 user_memory_size = 64 << 20;
- u32 max_translations_per_user = 100;
- u32 outside_vrf_id = 0;
- u32 outside_ip6_vrf_id = 0;
- u32 inside_vrf_id = 0;
+ dslite_main_t *dm = &dslite_main;
+ snat_main_per_thread_data_t *tsm;
+
u32 static_mapping_buckets = 1024;
u32 static_mapping_memory_size = 64 << 20;
+
u32 nat64_bib_buckets = 1024;
u32 nat64_bib_memory_size = 128 << 20;
+
u32 nat64_st_buckets = 2048;
u32 nat64_st_memory_size = 256 << 20;
+
+ u32 user_buckets = 128;
+ u32 user_memory_size = 64 << 20;
+ u32 translation_buckets = 1024;
+ u32 translation_memory_size = 128 << 20;
+
+ u32 max_translations_per_user = ~0;
+
+ u32 outside_vrf_id = 0;
+ u32 outside_ip6_vrf_id = 0;
+ u32 inside_vrf_id = 0;
u8 static_mapping_only = 0;
u8 static_mapping_connection_tracking = 0;
- snat_main_per_thread_data_t *tsm;
- dslite_main_t *dm = &dslite_main;
+
+ u32 udp_timeout = SNAT_UDP_TIMEOUT;
+ u32 icmp_timeout = SNAT_ICMP_TIMEOUT;
+
+ u32 tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
+ u32 tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
sm->deterministic = 0;
sm->out2in_dpo = 0;
if (unformat
(input, "translation hash buckets %d", &translation_buckets))
;
+ else if (unformat (input, "udp timeout %d", &udp_timeout))
+ ;
+ else if (unformat (input, "icmp timeout %d", &icmp_timeout))
+ ;
+ else if (unformat (input, "tcp transitory timeout %d",
+ &tcp_transitory_timeout));
+ else if (unformat (input, "tcp established timeout %d",
+ &tcp_established_timeout));
else if (unformat (input, "translation hash memory %d",
&translation_memory_size));
else if (unformat (input, "user hash buckets %d", &user_buckets))
return clib_error_return (0,
"out2in dpo mode available only for simple nat");
- /* for show commands, etc. */
+ /* optionally configurable timeouts for testing purposes */
+ sm->udp_timeout = udp_timeout;
+ sm->icmp_timeout = icmp_timeout;
+ sm->tcp_transitory_timeout = tcp_transitory_timeout;
+ sm->tcp_established_timeout = tcp_established_timeout;
+
+ sm->user_buckets = user_buckets;
+ sm->user_memory_size = user_memory_size;
+
sm->translation_buckets = translation_buckets;
sm->translation_memory_size = translation_memory_size;
+
/* do not exceed load factor 10 */
sm->max_translations = 10 * translation_buckets;
- sm->user_buckets = user_buckets;
- sm->user_memory_size = user_memory_size;
- sm->max_translations_per_user = max_translations_per_user;
+ sm->max_translations_per_user = max_translations_per_user == ~0 ?
+ sm->max_translations : max_translations_per_user;
+
sm->outside_vrf_id = outside_vrf_id;
sm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
outside_vrf_id,
sm->handoff_out2in_index = nat_pre_out2in_node.index;
sm->handoff_in2out_index = nat_pre_in2out_node.index;
- // TODO: test
sm->handoff_in2out_output_index = nat44_ed_in2out_output_node.index;
sm->in2out_node_index = nat44_ed_in2out_node.index;
sm->handoff_out2in_index = snat_in2out_node.index;
sm->handoff_in2out_index = snat_out2in_node.index;
- // TODO: test
sm->handoff_in2out_output_index = snat_in2out_output_node.index;
sm->in2out_node_index = snat_in2out_node.index;
/* values of various timeouts */
u32 udp_timeout;
- u32 tcp_established_timeout;
- u32 tcp_transitory_timeout;
u32 icmp_timeout;
+ u32 tcp_transitory_timeout;
+ u32 tcp_established_timeout;
/* TCP MSS clamping */
u16 mss_clamping;
--- /dev/null
+/*
+ * Copyright (c) 2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * @brief The NAT44 inline functions
+ */
+#ifndef __included_nat44_inlines_h__
+#define __included_nat44_inlines_h__
+
+#include <vnet/fib/ip4_fib.h>
+#include <nat/nat.h>
+
+static_always_inline void
+nat44_session_cleanup (snat_session_t * s, u32 thread_index)
+{
+ snat_main_t *sm = &snat_main;
+
+ nat_free_session_data (sm, s, thread_index, 0);
+ nat44_delete_session (sm, s, thread_index);
+}
+
+static_always_inline void
+nat44_user_try_cleanup (snat_user_t * u, u32 thread_index, f64 now)
+{
+ dlist_elt_t *elt;
+ snat_session_t *s;
+ u64 sess_timeout_time;
+
+ snat_main_t *sm = &snat_main;
+ snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+
+ // get head
+ elt = pool_elt_at_index (tsm->list_pool,
+ u->sessions_per_user_list_head_index);
+ // get first element
+ elt = pool_elt_at_index (tsm->list_pool, elt->next);
+
+ while (elt->value != ~0)
+ {
+ s = pool_elt_at_index (tsm->sessions, elt->value);
+ elt = pool_elt_at_index (tsm->list_pool, elt->next);
+
+ sess_timeout_time = s->last_heard +
+ (f64) nat44_session_get_timeout (sm, s);
+
+ if (now < sess_timeout_time)
+ continue;
+
+ nat44_session_cleanup (s, thread_index);
+ }
+}
+
+static_always_inline void
+nat44_session_try_cleanup (ip4_address_t * addr,
+ u32 fib_index, u32 thread_index, f64 now)
+{
+ snat_user_t *u = 0;
+ snat_user_key_t user_key;
+ clib_bihash_kv_8_8_t kv, value;
+
+ snat_main_t *sm = &snat_main;
+ snat_main_per_thread_data_t *tsm = &sm->per_thread_data[thread_index];
+
+ user_key.addr.as_u32 = addr->as_u32;
+ user_key.fib_index = fib_index;
+ kv.key = user_key.as_u64;
+
+ // lookup user for this traffic
+ if (PREDICT_FALSE (clib_bihash_search_8_8 (&tsm->user_hash, &kv, &value)))
+ {
+ // there is still place and a new user can be created
+ if (PREDICT_TRUE (pool_elts (tsm->sessions) < sm->max_translations))
+ return;
+
+ // there is no place so we try to cleanup all users in this thread
+ /* *INDENT-OFF* */
+ pool_foreach (u, tsm->users,
+ ({
+ nat44_user_try_cleanup (u, thread_index, now);
+ }));
+ /* *INDENT-ON* */
+ return;
+ }
+
+ // each time user creates a new session we try to cleanup expired sessions
+ nat44_user_try_cleanup (pool_elt_at_index (tsm->users, value.value),
+ thread_index, now);
+}
+
+#endif /* __included_nat44_inlines_h__ */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
#include <nat/nat_ipfix_logging.h>
#include <nat/nat_reass.h>
#include <nat/nat_inlines.h>
+#include <nat/nat44_inlines.h>
#include <nat/nat_syslog.h>
#include <nat/nat_ha.h>
udp_header_t *udp0;
nat44_is_idle_session_ctx_t ctx0;
+ nat44_session_try_cleanup (&in2out.addr, in2out.fib_index, thread_index,
+ now);
+
if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
{
b0->error = node->errors[SNAT_OUT2IN_ERROR_MAX_SESSIONS_EXCEEDED];
#include <nat/nat_ipfix_logging.h>
#include <nat/nat_reass.h>
#include <nat/nat_inlines.h>
+#include <nat/nat44_inlines.h>
#include <nat/nat_syslog.h>
#include <nat/nat_ha.h>
snat_session_key_t eh_key;
nat44_is_idle_session_ctx_t ctx;
+ nat44_session_try_cleanup (&l_key.addr, l_key.fib_index, thread_index, now);
+
if (PREDICT_FALSE (maximum_sessions_exceeded (sm, thread_index)))
{
b->error = node->errors[NAT_OUT2IN_ED_ERROR_MAX_SESSIONS_EXCEEDED];
self.logger.error(ppp("Unexpected or invalid packet:", packet))
raise
- def test_max_translations_per_user(self):
- """ MAX translations per user - recycle the least recently used """
-
- self.nat44_add_address(self.nat_addr)
- flags = self.config_flags.NAT_IS_INSIDE
- self.vapi.nat44_interface_add_del_feature(
- sw_if_index=self.pg0.sw_if_index,
- flags=flags, is_add=1)
- self.vapi.nat44_interface_add_del_feature(
- sw_if_index=self.pg1.sw_if_index,
- is_add=1)
-
- # get maximum number of translations per user
- nat44_config = self.vapi.nat_show_config()
-
- # send more than maximum number of translations per user packets
- pkts_num = nat44_config.max_translations_per_user + 5
- pkts = []
- for port in range(0, pkts_num):
- p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
- IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
- TCP(sport=1025 + port))
- pkts.append(p)
- self.pg0.add_stream(pkts)
- self.pg_enable_capture(self.pg_interfaces)
- self.pg_start()
-
- # verify number of translated packet
- self.pg1.get_capture(pkts_num)
-
- users = self.vapi.nat44_user_dump()
- for user in users:
- if user.ip_address == self.pg0.remote_ip4:
- self.assertEqual(user.nsessions,
- nat44_config.max_translations_per_user)
- self.assertEqual(user.nstaticsessions, 0)
-
- tcp_port = 22
- self.nat44_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
- tcp_port, tcp_port,
- proto=IP_PROTOS.tcp)
- p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
- IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
- TCP(sport=tcp_port))
- self.pg0.add_stream(p)
- self.pg_enable_capture(self.pg_interfaces)
- self.pg_start()
- self.pg1.get_capture(1)
- users = self.vapi.nat44_user_dump()
- for user in users:
- if user.ip_address == self.pg0.remote_ip4:
- self.assertEqual(user.nsessions,
- nat44_config.max_translations_per_user - 1)
- self.assertEqual(user.nstaticsessions, 1)
-
def test_interface_addr(self):
""" Acquire NAT44 addresses from interface """
self.vapi.nat44_add_del_interface_addr(
self.logger.info(self.vapi.cli("show nat ha"))
+class TestNAT44EndpointDependent2(MethodHolder):
+ """ Endpoint-Dependent session test cases """
+
+ icmp_timeout = 2
+
+ @classmethod
+ def setUpConstants(cls):
+ super(TestNAT44EndpointDependent2, cls).setUpConstants()
+ cls.vpp_cmdline.extend(["nat", "{", "endpoint-dependent",
+ "translation", "hash", "buckets", "1",
+ "icmp", "timeout", str(cls.icmp_timeout), "}"])
+
+ @classmethod
+ def setUpClass(cls):
+ super(TestNAT44EndpointDependent2, cls).setUpClass()
+ try:
+ translation_buckets = 1
+ cls.max_translations = 10 * translation_buckets
+
+ cls.create_pg_interfaces(range(2))
+ cls.interfaces = list(cls.pg_interfaces[0:2])
+
+ for i in cls.interfaces:
+ i.admin_up()
+ i.config_ip4()
+ i.resolve_arp()
+
+ cls.pg0.generate_remote_hosts(1)
+ cls.pg0.configure_ipv4_neighbors()
+
+ cls.pg1.generate_remote_hosts(1)
+ cls.pg1.configure_ipv4_neighbors()
+
+ except Exception:
+ super(TestNAT44EndpointDependent2, cls).tearDownClass()
+ raise
+
+ def create_icmp_stream(self, in_if, out_if, count):
+ """
+ Create ICMP packet stream for inside network
+
+ :param in_if: Inside interface
+ :param out_if: Outside interface
+ :param count: Number of packets
+ """
+
+ self.assertTrue(count > 0)
+ icmp_id = random.randint(0, 65535 - (count - 1))
+
+ pkts = list()
+ for i in range(count):
+ p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
+ IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
+ ICMP(id=icmp_id + i, type='echo-request'))
+ pkts.append(p)
+ return pkts
+
+ def send_pkts(self, pkts, expected=None):
+ self.pg0.add_stream(pkts)
+ self.pg_enable_capture(self.pg_interfaces)
+ self.pg_start()
+ return self.pg1.get_capture(
+ len(pkts) if expected is None else expected)
+
+ def test_session_cleanup(self):
+ """ NAT44 session cleanup test """
+
+ self.nat44_add_address(self.pg1.local_ip4)
+ flags = self.config_flags.NAT_IS_INSIDE
+ self.vapi.nat44_interface_add_del_feature(
+ sw_if_index=self.pg0.sw_if_index,
+ flags=flags, is_add=1)
+ self.vapi.nat44_interface_add_del_feature(
+ sw_if_index=self.pg1.sw_if_index,
+ is_add=1)
+
+ nat_config = self.vapi.nat_show_config()
+ self.assertEqual(1, nat_config.endpoint_dependent)
+
+ pkts = self.create_icmp_stream(self.pg0, self.pg1,
+ self.max_translations + 2)
+ sz = len(pkts)
+
+ # positive test
+ self.send_pkts(pkts[0:self.max_translations])
+
+ # false positive test
+ self.send_pkts(pkts[self.max_translations:sz - 1], 0)
+
+ sleep(self.icmp_timeout)
+
+ # positive test
+ self.send_pkts(pkts[self.max_translations + 1:sz])
+
+
class TestNAT44EndpointDependent(MethodHolder):
""" Endpoint-Dependent mapping and filtering test cases """
Code Review / vpp.git / commitdiff