FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
cnat_node_vip.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <vlibmemory/api.h>
17 #include <cnat/cnat_node.h>
18 #include <cnat/cnat_translation.h>
19 
20 #include <vnet/dpo/load_balance.h>
22 
24 {
31 
33 {
38 
41 
42 static u8 *
43 format_cnat_translation_trace (u8 * s, va_list * args)
44 {
45  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
46  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
48  va_arg (*args, cnat_translation_trace_t *);
49 
50  if (t->found_session)
51  s = format (s, "found: %U", format_cnat_session, &t->session, 1);
52  else if (t->created_session)
53  s = format (s, "created: %U\n tr: %U",
56  &t->tr, 0);
57  else if (t->has_tr)
58  s = format (s, "tr pass: %U", format_cnat_translation,
59  &t->tr, 0);
60  else
61  s = format (s, "not found");
62  return s;
63 }
64 
65 /* CNat sub for NAT behind a fib entry (VIP or interposed real IP) */
69  vlib_buffer_t * b,
71 {
74  const cnat_translation_t *ct = NULL;
75  ip4_header_t *ip4 = NULL;
76  ip_protocol_t iproto;
77  ip6_header_t *ip6 = NULL;
78  udp_header_t *udp0;
79  cnat_client_t *cc;
80  u16 next0;
81  index_t cti;
82  int created_session = 0;
83  if (AF_IP4 == ctx->af)
84  {
85  ip4 = vlib_buffer_get_current (b);
86  iproto = ip4->protocol;
87  udp0 = (udp_header_t *) (ip4 + 1);
88  }
89  else
90  {
91  ip6 = vlib_buffer_get_current (b);
92  iproto = ip6->protocol;
93  udp0 = (udp_header_t *) (ip6 + 1);
94  }
95 
96  cc = cnat_client_get (vnet_buffer (b)->ip.adj_index[VLIB_TX]);
97 
98  if (iproto != IP_PROTOCOL_UDP && iproto != IP_PROTOCOL_TCP)
99  {
100  /* Dont translate & follow the fib programming */
101  next0 = cc->cc_parent.dpoi_next_node;
102  vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
103  goto trace;
104  }
105 
107  clib_host_to_net_u16 (udp0->dst_port),
108  iproto);
109 
110  if (!rv)
111  {
112  /* session table hit */
113  cnat_timestamp_update (session->value.cs_ts_index, ctx->now);
114 
115  if (NULL != ct)
116  {
117  /* Translate & follow the translation given LB */
118  next0 = ct->ct_lb.dpoi_next_node;
119  vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi;
120  }
121  else if (session->value.flags & CNAT_SESSION_FLAG_HAS_SNAT)
122  {
123  /* The return needs DNAT, so we need an additionnal
124  * lookup after translation */
126  }
127  else
128  {
129  /* Translate & follow the fib programming */
130  next0 = cc->cc_parent.dpoi_next_node;
131  vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
132  }
133  }
134  else
135  {
136  if (NULL == ct)
137  {
138  /* Dont translate & Follow the fib programming */
139  vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
140  next0 = cc->cc_parent.dpoi_next_node;
141  goto trace;
142  }
143 
144  /* New flow, create the sessions */
145  const load_balance_t *lb0;
146  cnat_ep_trk_t *trk0;
147  u32 hash_c0, bucket0;
148  u32 rsession_flags = 0;
149  const dpo_id_t *dpo0;
150 
151  lb0 = load_balance_get (ct->ct_lb.dpoi_index);
152  if (!lb0->lb_n_buckets)
153  {
154  /* Dont translate & Follow the fib programming */
155  vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
156  next0 = cc->cc_parent.dpoi_next_node;
157  goto trace;
158  }
159 
160  /* session table miss */
161  hash_c0 = (AF_IP4 == ctx->af ?
164  bucket0 = hash_c0 & lb0->lb_n_buckets_minus_1;
165  dpo0 = load_balance_get_fwd_bucket (lb0, bucket0);
166 
167  /* add the session */
168  trk0 = &ct->ct_paths[bucket0];
169 
170  ip46_address_copy (&session->value.cs_ip[VLIB_TX],
171  &trk0->ct_ep[VLIB_TX].ce_ip.ip);
172  if (ip_address_is_zero (&trk0->ct_ep[VLIB_RX].ce_ip))
173  {
174  if (AF_IP4 == ctx->af)
176  &ip4->src_address);
177  else
179  &ip6->src_address);
180  }
181  else
182  {
183  /* We source NAT with the translation */
184  rsession_flags |= CNAT_SESSION_FLAG_HAS_SNAT;
185  ip46_address_copy (&session->value.cs_ip[VLIB_RX],
186  &trk0->ct_ep[VLIB_RX].ce_ip.ip);
187  }
188  session->value.cs_port[VLIB_TX] =
189  clib_host_to_net_u16 (trk0->ct_ep[VLIB_TX].ce_port);
190  session->value.cs_port[VLIB_RX] =
191  clib_host_to_net_u16 (trk0->ct_ep[VLIB_RX].ce_port);
192 
193  session->value.flags = 0;
194  if (!session->value.cs_port[VLIB_RX])
195  {
196  u16 sport;
197  sport = udp0->src_port;
198  /* Allocate a port only if asked and if we actually sNATed */
200  && (rsession_flags & CNAT_SESSION_FLAG_HAS_SNAT)) {
201  sport = 0; /* force allocation */
203  rv = cnat_allocate_port (cm, &sport);
204  if (rv)
205  {
207  CNAT_ERROR_EXHAUSTED_PORTS, 1);
209  goto trace;
210  }
211  }
212 
213  session->value.cs_port[VLIB_RX] = sport;
214  }
215  session->value.cs_lbi = dpo0->dpoi_index;
216 
218  cnat_session_create (session, ctx, rsession_flags);
219  created_session = 1;
220 
221  next0 = ct->ct_lb.dpoi_next_node;
222  vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi;
223  }
224 
225 
226  if (AF_IP4 == ctx->af)
227  cnat_translation_ip4 (session, ip4, udp0);
228  else
229  cnat_translation_ip6 (session, ip6, udp0);
230 
231  if (NULL != ct)
232  {
233  cti = ct - cnat_translation_pool;
234  vlib_increment_combined_counter (cntm, ctx->thread_index, cti, 1,
236  }
237 
238 trace:
239  if (PREDICT_FALSE (ctx->do_trace))
240  {
242 
243  t = vlib_add_trace (vm, node, b, sizeof (*t));
244 
245  t->found_session = !rv;
247  if (t->found_session || t->created_session)
248  clib_memcpy (&t->session, session, sizeof (t->session));
249  t->has_tr = (NULL != ct);
250  if (t->has_tr)
251  clib_memcpy (&t->tr, ct, sizeof (cnat_translation_t));
252  }
253  return next0;
254 }
255 
259 {
260  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
262  1 /* do_trace */ );
264  0 /* do_trace */ );
265 }
266 
270 {
271  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
273  1 /* do_trace */ );
275  0 /* do_trace */ );
276 }
277 
278 /* *INDENT-OFF* */
280 {
281  .name = "ip4-cnat-tx",
282  .vector_size = sizeof (u32),
283  .format_trace = format_cnat_translation_trace,
285  .n_errors = 0,
286  .n_next_nodes = CNAT_TRANSLATION_N_NEXT,
287  .next_nodes =
288  {
289  [CNAT_TRANSLATION_NEXT_DROP] = "ip4-drop",
290  [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip4-lookup",
291  }
292 };
294 {
295  .name = "ip6-cnat-tx",
296  .vector_size = sizeof (u32),
297  .format_trace = format_cnat_translation_trace,
299  .n_errors = 0,
300  .n_next_nodes = CNAT_TRANSLATION_N_NEXT,
301  .next_nodes =
302  {
303  [CNAT_TRANSLATION_NEXT_DROP] = "ip6-drop",
304  [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip6-lookup",
305  }
306 };
307 /* *INDENT-ON* */
308 
u16 lb_n_buckets
number of buckets in the load-balance.
Definition: load_balance.h:116
static vlib_cli_command_t trace
(constructor) VLIB_CLI_COMMAND (trace)
Definition: vlib_api_cli.c:899
vlib_node_registration_t cnat_vip_ip6_node
(constructor) VLIB_REGISTER_NODE (cnat_vip_ip6_node)
Definition: cnat_node_vip.c:40
#define CLIB_UNUSED(x)
Definition: clib.h:87
static void vlib_increment_combined_counter(vlib_combined_counter_main_t *cm, u32 thread_index, u32 index, u64 n_packets, u64 n_bytes)
Increment a combined counter.
Definition: counter.h:220
ip4_address_t src_address
Definition: ip4_packet.h:125
static u32 ip4_compute_flow_hash(const ip4_header_t *ip, flow_hash_config_t flow_hash_config)
Definition: ip4.h:310
flow_hash_config_t lb_hash_config
the hash config to use when selecting a bucket.
Definition: load_balance.h:161
static const dpo_id_t * load_balance_get_fwd_bucket(const load_balance_t *lb, u16 bucket)
u16 cs_port[VLIB_N_DIR]
ports in rx/tx
Definition: cnat_session.h:53
ip46_address_t ip
Definition: ip_types.h:49
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:41
u8 * format_cnat_session(u8 *s, va_list *args)
Definition: cnat_session.c:70
dpo_id_t cc_parent
How to send packets to this client post translation.
Definition: cnat_client.h:47
A Translation represents the translation of a VEP to one of a set of real server addresses.
cnat_translation_t tr
Definition: cnat_node_vip.c:26
vlib_main_t * vm
Definition: in2out_ed.c:1582
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:424
enum cnat_translation_next_t_ cnat_translation_next_t
index_t parent_cci
Parent cnat_client index if cloned via interpose or own index if vanilla client.
Definition: cnat_client.h:74
static_always_inline void ip46_address_set_ip6(ip46_address_t *dst, const ip6_address_t *src)
Definition: ip46_address.h:130
#define VLIB_NODE_FN(node)
Definition: node.h:202
static uword vlib_buffer_length_in_chain(vlib_main_t *vm, vlib_buffer_t *b)
Get length in bytes of the buffer chain.
Definition: buffer_funcs.h:402
ip6_address_t src_address
Definition: ip6_packet.h:310
unsigned char u8
Definition: types.h:56
cnat_translation_t * cnat_translation_pool
#define clib_memcpy(d, s, n)
Definition: string.h:180
A session represents the memory of a translation.
Definition: cnat_session.h:38
static uword cnat_vip_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_buffer_t *b, cnat_node_ctx_t *ctx, int rv, cnat_session_t *session)
Definition: cnat_node_vip.c:67
static_always_inline cnat_translation_t * cnat_find_translation(index_t cti, u16 port, ip_protocol_t proto)
vl_api_ip6_address_t ip6
Definition: one.api:424
u16 lb_n_buckets_minus_1
number of buckets in the load-balance - 1.
Definition: load_balance.h:121
unsigned int u32
Definition: types.h:88
ip46_address_t cs_ip[VLIB_N_DIR]
IP 4/6 address in the rx/tx direction.
Definition: cnat_session.h:48
u32 cs_ts_index
Timestamp index this session was last used.
Definition: cnat_session.h:93
vl_api_fib_path_type_t type
Definition: fib_types.api:123
static_always_inline u32 cnat_client_cnt_session(cnat_client_t *cc)
Add a session refcnt to this client.
Definition: cnat_client.h:202
The identity of a DPO is a combination of its type and its instance number/index of objects of that t...
Definition: dpo.h:170
enum ip_protocol ip_protocol_t
vnet_crypto_main_t * cm
Definition: quic_crypto.c:53
static_always_inline void ip46_address_copy(ip46_address_t *dst, const ip46_address_t *src)
Definition: ip46_address.h:123
long ctx[MAX_CONNS]
Definition: main.c:144
static int cnat_allocate_port(cnat_main_t *cm, u16 *port)
Definition: cnat_types.h:252
unsigned short u16
Definition: types.h:57
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
static u32 ip6_compute_flow_hash(const ip6_header_t *ip, flow_hash_config_t flow_hash_config)
Definition: ip6.h:382
The FIB DPO provieds;.
Definition: load_balance.h:106
bool ip_address_is_zero(const ip_address_t *ip)
Definition: ip_types.c:99
#define PREDICT_FALSE(x)
Definition: clib.h:120
#define always_inline
Definition: ipsec.h:28
vl_api_ip4_address_t ip4
Definition: one.api:376
static_always_inline void cnat_translation_ip6(const cnat_session_t *session, ip6_header_t *ip6, udp_header_t *udp)
Definition: cnat_node.h:225
cnat_ep_trk_t * ct_paths
The vector of tracked back-ends.
index_t cs_lbi
The load balance object to use to forward.
Definition: cnat_session.h:88
static void vlib_node_increment_counter(vlib_main_t *vm, u32 node_index, u32 counter_index, u64 increment)
Definition: node_funcs.h:1231
static_always_inline cnat_client_t * cnat_client_get(index_t i)
Definition: cnat_client.h:91
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
cnat_endpoint_t ct_ep[VLIB_N_DIR]
The EP being tracked.
cnat_translation_next_t_
Definition: cnat_node_vip.c:32
static u8 * format_cnat_translation_trace(u8 *s, va_list *args)
Definition: cnat_node_vip.c:43
struct cnat_translation_trace_t_ cnat_translation_trace_t
vlib_node_registration_t cnat_vip_ip4_node
(constructor) VLIB_REGISTER_NODE (cnat_vip_ip4_node)
Definition: cnat_node_vip.c:39
vlib_main_t vlib_node_runtime_t * node
Definition: in2out_ed.c:1582
u32 flags
Indicates a return path session that was source NATed on the way in.
Definition: cnat_session.h:98
struct cnat_session_t_::@637 value
this value sits in the same memory location a &#39;value&#39; in the bihash kvp
static void cnat_timestamp_update(u32 index, f64 t)
Definition: cnat_types.h:199
static_always_inline void cnat_translation_ip4(const cnat_session_t *session, ip4_header_t *ip4, udp_header_t *udp)
Definition: cnat_node.h:129
dpo_id_t ct_lb
The LB used to forward to the backends.
static load_balance_t * load_balance_get(index_t lbi)
Definition: load_balance.h:220
u8 * format_cnat_translation(u8 *s, va_list *args)
struct _vlib_node_registration vlib_node_registration_t
vlib_combined_counter_main_t cnat_translation_counters
Counters for each translation.
Definition: defs.h:47
index_t dpoi_index
the index of objects of that type
Definition: dpo.h:186
vl_api_address_t ip
Definition: l2.api:501
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: in2out_ed.c:1583
VLIB buffer representation.
Definition: buffer.h:102
u64 uword
Definition: types.h:112
cnat_main_t cnat_main
Definition: cnat_types.c:18
A collection of combined counters.
Definition: counter.h:188
#define vnet_buffer(b)
Definition: buffer.h:417
ip_address_family_t af
Definition: cnat_types.h:147
ip_address_t ce_ip
Definition: cnat_types.h:54
void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace.c:577
static_always_inline void cnat_session_create(cnat_session_t *session, cnat_node_ctx_t *ctx, u8 rsession_flags)
Create NAT sessions.
Definition: cnat_node.h:305
u16 dpoi_next_node
The next VLIB node to follow.
Definition: dpo.h:182
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:301
Data used to track an EP in the FIB.
u8 flags
Translation flags.
static void ip46_address_set_ip4(ip46_address_t *ip46, const ip4_address_t *ip)
Definition: ip46_address.h:67
static uword cnat_node_inline(vlib_main_t *vm, vlib_node_runtime_t *node, vlib_frame_t *frame, cnat_node_sub_t cnat_sub, ip_address_family_t af, u8 do_trace)
Definition: cnat_node.h:404
Definition: defs.h:46
A client is a representation of an IP address behind the NAT.
Definition: cnat_client.h:35