30 #define NAT44_ED_EXPECTED_ARGUMENT "expected required argument(s)" 41 u8 enable_set = 0, enable = 0, mode_set = 0;
48 if (!mode_set &&
unformat (line_input,
"static-mapping-only"))
52 if (
unformat (line_input,
"connection-tracking"))
63 if (
unformat (line_input,
"disable"))
65 else if (
unformat (line_input,
"enable"))
147 case VNET_API_ERROR_INVALID_WORKER:
150 case VNET_API_ERROR_FEATURE_DISABLED:
152 "Supported only if 2 or more workes available.");
199 if (!
unformat (line_input,
"%d", &log_level))
227 u8 enable_set = 0, enable = 0;
234 if (
unformat (line_input,
"domain %d", &domain_id))
238 else if (!enable_set)
241 if (
unformat (line_input,
"disable"))
243 else if (
unformat (line_input,
"enable"))
283 else if (
unformat (input,
"verbose"))
322 if (
unformat (line_input,
"disable"))
324 else if (
unformat (line_input,
"%d", &mss))
361 u32 start_host_order, end_host_order;
375 if (
unformat (line_input,
"%U - %U",
379 else if (
unformat (line_input,
"tenant-vrf %u", &vrf_id))
383 else if (
unformat (line_input,
"twice-nat"))
385 else if (
unformat (line_input,
"del"))
401 start_host_order = clib_host_to_net_u32 (start_addr.
as_u32);
402 end_host_order = clib_host_to_net_u32 (end_addr.
as_u32);
404 if (end_host_order < start_host_order)
410 count = (end_host_order - start_host_order) + 1;
419 for (i = 0; i <
count; i++)
428 case VNET_API_ERROR_VALUE_EXIST:
431 case VNET_API_ERROR_NO_SUCH_ENTRY:
434 case VNET_API_ERROR_UNSPECIFIED:
464 clib_dlist_remove_head (tsm->lru_pool, tsm->n##_lru_head_index); \ 465 if (~0 != oldest_index) \ 467 oldest_elt = pool_elt_at_index (tsm->lru_pool, oldest_index); \ 468 s = pool_elt_at_index (tsm->sessions, oldest_elt->value); \ 469 sess_timeout_time = \ 470 s->last_heard + (f64) nat44_session_get_timeout (sm, s); \ 471 vlib_cli_output (vm, d " LRU min session timeout %llu (now %llu)", \ 472 sess_timeout_time, now); \ 473 clib_dlist_addhead (tsm->lru_pool, tsm->n##_lru_head_index, \ 476 _ (tcp_estab,
"established tcp");
477 _ (tcp_trans,
"transitory tcp");
479 _ (unk_proto,
"unknown protocol");
496 u64 sess_timeout_time = 0;
498 u32 udp_sessions = 0;
499 u32 tcp_sessions = 0;
500 u32 icmp_sessions = 0;
504 u32 transitory_wait_closed = 0;
505 u32 transitory_closed = 0;
520 sess_timeout_time = s->last_heard +
522 if (now >= sess_timeout_time)
525 switch (s->nat_proto)
527 case NAT_PROTOCOL_ICMP:
530 case NAT_PROTOCOL_TCP:
534 if (s->tcp_closed_timestamp)
536 if (now >= s->tcp_closed_timestamp)
542 ++transitory_wait_closed;
550 case NAT_PROTOCOL_UDP:
565 sess_timeout_time = s->last_heard +
567 if (now >= sess_timeout_time)
570 switch (s->nat_proto)
572 case NAT_PROTOCOL_ICMP:
575 case NAT_PROTOCOL_TCP:
579 if (s->tcp_closed_timestamp)
581 if (now >= s->tcp_closed_timestamp)
587 ++transitory_wait_closed;
595 case NAT_PROTOCOL_UDP:
608 vlib_cli_output (vm,
"total tcp established sessions: %u", established);
610 vlib_cli_output (vm,
"total tcp transitory (WAIT-CLOSED) sessions: %u",
611 transitory_wait_closed);
635 #define _(N, i, n, s) \ 636 vlib_cli_output (vm, " %d busy %s ports", ap->busy_##n##_ports, s); 649 #define _(N, i, n, s) \ 650 vlib_cli_output (vm, " %d busy %s ports", ap->busy_##n##_ports, s); 665 u32 *inside_sw_if_indices = 0;
666 u32 *outside_sw_if_indices = 0;
667 u8 is_output_feature = 0;
681 vec_add1 (inside_sw_if_indices, sw_if_index);
684 vec_add1 (outside_sw_if_indices, sw_if_index);
685 else if (
unformat (line_input,
"output-feature"))
686 is_output_feature = 1;
687 else if (
unformat (line_input,
"del"))
697 if (
vec_len (inside_sw_if_indices))
699 for (i = 0; i <
vec_len (inside_sw_if_indices); i++)
701 sw_if_index = inside_sw_if_indices[
i];
702 if (is_output_feature)
705 (sw_if_index, 1, is_del))
708 is_del ?
"del" :
"add",
719 is_del ?
"del" :
"add",
728 if (
vec_len (outside_sw_if_indices))
730 for (i = 0; i <
vec_len (outside_sw_if_indices); i++)
732 sw_if_index = outside_sw_if_indices[
i];
733 if (is_output_feature)
736 (sw_if_index, 0, is_del))
739 is_del ?
"del" :
"add",
750 is_del ?
"del" :
"add",
807 int is_add = 1, addr_only = 1,
rv, exact = 0;
833 else if (
unformat (line_input,
"external %U %u",
837 else if (
unformat (line_input,
"external %U",
847 else if (
unformat (line_input,
"twice-nat"))
849 else if (
unformat (line_input,
"self-twice-nat"))
851 else if (
unformat (line_input,
"out2in-only"))
853 else if (
unformat (line_input,
"del"))
863 if (twice_nat && addr_only)
875 "address only mapping doesn't support protocol");
886 l_addr, e_addr, clib_host_to_net_u16 (l_port),
887 clib_host_to_net_u16 (e_port),
vrf_id, addr_only, sw_if_index, proto,
888 is_add, twice_nat, out2in_only, 0, 0, exact_addr, exact);
892 case VNET_API_ERROR_INVALID_VALUE:
895 case VNET_API_ERROR_NO_SUCH_ENTRY:
901 case VNET_API_ERROR_NO_SUCH_FIB:
904 case VNET_API_ERROR_VALUE_EXIST:
943 else if (
unformat (line_input,
"external %U",
951 else if (
unformat (line_input,
"del"))
962 addr, addr, clib_host_to_net_u16 (port), clib_host_to_net_u16 (port),
963 vrf_id, addr_only, sw_if_index, proto, is_add, 0, 0, 0, 1, pool_addr, 0);
967 case VNET_API_ERROR_INVALID_VALUE:
970 case VNET_API_ERROR_NO_SUCH_ENTRY:
976 case VNET_API_ERROR_NO_SUCH_FIB:
979 case VNET_API_ERROR_VALUE_EXIST:
1015 if (
unformat (line_input,
"local %U:%u probability %u",
1019 local.addr = l_addr;
1020 local.port = (
u16) l_port;
1024 else if (
unformat (line_input,
"local %U:%u vrf %u probability %u",
1029 local.addr = l_addr;
1030 local.port = (
u16) l_port;
1041 else if (
unformat (line_input,
"twice-nat"))
1043 else if (
unformat (line_input,
"self-twice-nat"))
1045 else if (
unformat (line_input,
"out2in-only"))
1047 else if (
unformat (line_input,
"del"))
1049 else if (
unformat (line_input,
"affinity %u", &affinity))
1072 is_add, twice_nat, out2in_only, 0,
1077 case VNET_API_ERROR_INVALID_VALUE:
1080 case VNET_API_ERROR_NO_SUCH_ENTRY:
1086 case VNET_API_ERROR_VALUE_EXIST:
1119 if (
unformat (line_input,
"local %U:%u probability %u",
1122 else if (
unformat (line_input,
"local %U:%u vrf %u probability %u",
1132 else if (
unformat (line_input,
"del"))
1142 if (!l_port || !e_port)
1161 case VNET_API_ERROR_INVALID_VALUE:
1165 case VNET_API_ERROR_NO_SUCH_ENTRY:
1168 case VNET_API_ERROR_VALUE_EXIST:
1171 case VNET_API_ERROR_UNSPECIFIED:
1226 else if (
unformat (line_input,
"twice-nat"))
1228 else if (
unformat (line_input,
"del"))
1339 if (
unformat (line_input,
"%u", &session_limit))
1385 else if (
unformat (line_input,
"in"))
1390 else if (
unformat (line_input,
"out"))
1397 else if (
unformat (line_input,
"external-host %U:%u",
1410 clib_host_to_net_u16 (eh_port),
1438 u8 enable_set = 0, enable = 0;
1448 if (
unformat (line_input,
"disable"))
1450 else if (
unformat (line_input,
"enable"))
1485 else if (
unformat (line_input,
"tcp-established %u",
1487 else if (
unformat (line_input,
"tcp-transitory %u",
1490 else if (
unformat (line_input,
"reset"))
1527 u32 frame_queue_nelts = 0;
1534 if (
unformat (line_input,
"%u", &frame_queue_nelts))
1543 if (!frame_queue_nelts)
1574 .short_help =
"nat44 <enable [sessions <max-number>] [static-mapping-only " 1575 "connection-tracking] [inside-vrf <vrf-id>] " 1576 "[outside-vrf <vrf-id>]>|disable",
1588 .path =
"set nat workers",
1590 .short_help =
"set nat workers <workers-list>",
1604 .path =
"show nat workers",
1605 .short_help =
"show nat workers",
1619 .path =
"set nat timeout",
1622 "set nat timeout [udp <sec> | tcp-established <sec> " 1623 "tcp-transitory <sec> | icmp <sec> | reset]",
1638 .path =
"show nat timeouts",
1639 .short_help =
"show nat timeouts",
1650 .path =
"set nat frame-queue-nelts",
1652 .short_help =
"set nat frame-queue-nelts <number>",
1663 .path =
"nat set logging level",
1665 .short_help =
"nat set logging level <level>",
1678 .path =
"nat ipfix logging",
1680 .short_help =
"nat ipfix logging disable|<enable [domain <domain-id>] " 1681 "[src-port <port>]>",
1695 .path =
"nat mss-clamping",
1696 .short_help =
"nat mss-clamping <mss-value>|disable",
1707 .path =
"show nat mss-clamping",
1708 .short_help =
"show nat mss-clamping",
1719 .path =
"show nat44 hash tables",
1720 .short_help =
"show nat44 hash tables [detail|verbose]",
1736 .path =
"nat44 add address",
1737 .short_help =
"nat44 add address <ip4-range-start> [- <ip4-range-end>] " 1738 "[tenant-vrf <vrf-id>] [twice-nat] [del]",
1750 .path =
"show nat44 summary",
1751 .short_help =
"show nat44 summary",
1780 .path =
"show nat44 addresses",
1781 .short_help =
"show nat44 addresses",
1796 .path =
"set interface nat44",
1798 .short_help =
"set interface nat44 in <intfc> out <intfc> [output-feature] " 1813 .path =
"show nat44 interfaces",
1814 .short_help =
"show nat44 interfaces",
1838 .path =
"nat44 add static mapping",
1841 "nat44 add static mapping tcp|udp|icmp local <addr> [<port|icmp-echo-id>] " 1842 "external <addr> [<port|icmp-echo-id>] [vrf <table-id>] [twice-nat|self-twice-nat] " 1843 "[out2in-only] [exact <pool-addr>] [del]",
1860 .path =
"nat44 add identity mapping",
1862 .short_help =
"nat44 add identity mapping <ip4-addr>|external <interface> " 1863 "[<protocol> <port>] [vrf <table-id>] [del]",
1877 .path =
"nat44 add load-balancing static mapping",
1880 "nat44 add load-balancing static mapping protocol tcp|udp " 1881 "external <addr>:<port> local <addr>:<port> [vrf <table-id>] " 1882 "probability <n> [twice-nat|self-twice-nat] [out2in-only] " 1883 "[affinity <timeout-seconds>] [del]",
1896 .path =
"nat44 add load-balancing back-end",
1899 "nat44 add load-balancing back-end protocol tcp|udp " 1900 "external <addr>:<port> local <addr>:<port> [vrf <table-id>] " 1901 "probability <n> [del]",
1920 .path =
"show nat44 static mappings",
1921 .short_help =
"show nat44 static mappings",
1934 .path =
"nat44 add interface address",
1935 .short_help =
"nat44 add interface address <interface> [twice-nat] [del]",
1951 .path =
"show nat44 interface address",
1952 .short_help =
"show nat44 interface address",
1963 .path =
"show nat44 sessions",
1964 .short_help =
"show nat44 sessions",
1975 .path =
"set nat44 session limit",
1976 .short_help =
"set nat44 session limit <limit> [vrf <table-id>]",
1990 .path =
"nat44 del session",
1991 .short_help =
"nat44 del session in|out <addr>:<port> tcp|udp|icmp [vrf <id>] [external-host <addr>:<port>]",
2008 .path =
"nat44 forwarding",
2009 .short_help =
"nat44 forwarding enable|disable",
static clib_error_t * snat_set_log_level_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
format_function_t format_snat_static_mapping
vl_api_address_t end_addr
u32 * max_translations_per_fib
#define vec_foreach_index(var, v)
Iterate over vector indices.
static u32 nat44_session_get_timeout(snat_main_t *sm, snat_session_t *s)
static clib_error_t * nat44_ed_enable_disable_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int snat_add_address(snat_main_t *sm, ip4_address_t *addr, u32 vrf_id, u8 twice_nat)
Add external address to NAT44 pool.
#define pool_foreach(VAR, POOL)
Iterate through pool.
static clib_error_t * nat44_show_addresses_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int nat44_ed_set_frame_queue_nelts(u32 frame_queue_nelts)
vl_api_address_t start_addr
int nat44_del_ed_session(snat_main_t *sm, ip4_address_t *addr, u16 port, ip4_address_t *eh_addr, u16 eh_port, u8 proto, u32 vrf_id, int is_in)
Delete NAT44 endpoint-dependent session.
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static f64 vlib_time_now(vlib_main_t *vm)
#define vec_add1(V, E)
Add 1 element to end of vector (unspecified alignment).
NAT plugin client-IP based session affinity for load-balancing.
static clib_error_t * add_address_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * nat44_show_static_mappings_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
unformat_function_t unformat_nat_protocol
unformat_function_t unformat_vnet_sw_interface
static clib_error_t * snat_forwarding_set_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int nat_ipfix_logging_enable_disable(int enable, u32 domain_id, u16 src_port)
Enable/disable NAT plugin IPFIX logging.
format_function_t format_vnet_sw_if_index_name
static_always_inline void nat_reset_timeouts(nat_timeouts_t *timeouts)
format_function_t format_snat_static_map_to_resolve
#define NAT44_ED_EXPECTED_ARGUMENT
static clib_error_t * snat_ipfix_logging_enable_disable_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_bihash_16_8_t affinity_hash
#define vec_elt_at_index(v, i)
Get vector value at index i checking that i is in bounds.
#define clib_error_return(e, args...)
vnet_main_t * vnet_get_main(void)
static_always_inline u8 nat_proto_to_ip_proto(nat_protocol_t nat_proto)
static clib_error_t * nat44_show_interface_address_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
format_function_t format_snat_session
u32 * auto_add_sw_if_indices_twice_nat
int snat_del_address(snat_main_t *sm, ip4_address_t addr, u8 delete_sm, u8 twice_nat)
Delete external address from NAT44 pool.
vlib_worker_thread_t * vlib_worker_threads
vl_api_interface_index_t sw_if_index
#define nat_log_info(...)
snat_static_mapping_t * static_mappings
static clib_error_t * snat_add_interface_address_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
nat_affinity_main_t nat_affinity_main
int nat44_update_session_limit(u32 session_limit, u32 vrf_id)
Update NAT44 session limit flushing all data (session limit, vrf id)
clib_bihash_8_8_t static_mapping_by_external
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
static clib_error_t * add_lb_static_mapping_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
snat_interface_t * output_feature_interfaces
vl_api_ip_port_and_mask_t src_port
int nat44_lb_static_mapping_add_del_local(ip4_address_t e_addr, u16 e_port, ip4_address_t l_addr, u16 l_port, nat_protocol_t proto, u32 vrf_id, u8 probability, u8 is_add)
struct nat_timeouts_t::@732 tcp
u32 ft_table_id
Table ID (hash key) for this FIB.
sll srl srl sll sra u16x4 i
int snat_add_static_mapping(ip4_address_t l_addr, ip4_address_t e_addr, u16 l_port, u16 e_port, u32 vrf_id, int addr_only, u32 sw_if_index, nat_protocol_t proto, int is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u8 identity_nat, ip4_address_t pool_addr, int exact)
Add/delete NAT44 static mapping.
#define vec_free(V)
Free vector's memory (no header).
int nat44_plugin_disable()
Disable NAT44 plugin.
static clib_error_t * nat44_show_summary_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
__clib_export uword unformat_bitmap_list(unformat_input_t *input, va_list *va)
unformat a list of bit ranges into a bitmap (eg "0-3,5-7,11" )
static clib_error_t * snat_feature_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * nat44_del_session_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * nat44_set_session_limit_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define nat_interface_is_outside(i)
Check if NAT interface is outside.
#define VLIB_CLI_COMMAND(x,...)
static clib_error_t * set_frame_queue_nelts_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
u32 * auto_add_sw_if_indices
static clib_error_t * nat_show_workers_commnad_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * set_timeout_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
void vlib_cli_output(vlib_main_t *vm, char *fmt,...)
int nat44_add_del_lb_static_mapping(ip4_address_t e_addr, u16 e_port, nat_protocol_t proto, nat44_lb_addr_port_t *locals, u8 is_add, twice_nat_type_t twice_nat, u8 out2in_only, u8 *tag, u32 affinity)
Add/delete static mapping with load-balancing (multiple backends)
static clib_error_t * nat_show_timeouts_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * nat44_show_hash_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * set_workers_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int snat_add_interface_address(snat_main_t *sm, u32 sw_if_index, int is_del, u8 twice_nat)
Add/delete NAT44 pool address from specific interface.
#define clib_bitmap_free(v)
Free a bitmap.
snat_address_t * twice_nat_addresses
static clib_error_t * add_identity_mapping_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
#define nat_interface_is_inside(i)
Check if NAT interface is inside.
static clib_error_t * nat_show_mss_clamping_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static void nat44_show_lru_summary(vlib_main_t *vm, snat_main_per_thread_data_t *tsm, u64 now, u64 sess_timeout_time)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
snat_main_per_thread_data_t * per_thread_data
fib_table_t * fib_table_get(fib_node_index_t index, fib_protocol_t proto)
Get a pointer to a FIB table.
snat_address_t * addresses
snat_static_map_resolve_t * to_resolve
static void increment_v4_address(ip4_address_t *a)
static clib_error_t * add_static_mapping_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
NAT port/address allocation lib.
int snat_interface_add_del(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 feature on the interface.
#define vec_foreach(var, vec)
Vector iterator.
static clib_error_t * add_lb_backend_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
static clib_error_t * nat44_show_interfaces_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
clib_bihash_16_8_t flow_hash
int snat_set_workers(uword *bitmap)
Set NAT plugin workers.
static clib_error_t * nat_set_mss_clamping_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int snat_interface_add_del_output_feature(u32 sw_if_index, u8 is_inside, int is_del)
Enable/disable NAT44 output feature on the interface (postrouting NAT)
static clib_error_t * nat44_show_sessions_command_fn(vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd)
int nat44_plugin_enable(nat44_config_t c)
Enable NAT44 plugin.
snat_session_t * sessions
static unsigned char * print(const cJSON *const item, cJSON_bool format, const internal_hooks *const hooks)
clib_bihash_8_8_t static_mapping_by_local
snat_interface_t * interfaces
static uword pool_elts(void *v)
Number of active elements in a pool.