Line data Source code
1 : /*
2 : * Copyright (c) 2015 Cisco and/or its affiliates.
3 : * Licensed under the Apache License, Version 2.0 (the "License");
4 : * you may not use this file except in compliance with the License.
5 : * You may obtain a copy of the License at:
6 : *
7 : * http://www.apache.org/licenses/LICENSE-2.0
8 : *
9 : * Unless required by applicable law or agreed to in writing, software
10 : * distributed under the License is distributed on an "AS IS" BASIS,
11 : * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 : * See the License for the specific language governing permissions and
13 : * limitations under the License.
14 : */
15 : /*
16 : * Defines used for testing various optimisation schemes
17 : */
18 :
19 : #include "map.h"
20 : #include <vnet/ip/ip_frag.h>
21 : #include <vnet/ip/ip4_to_ip6.h>
22 :
23 : enum ip4_map_next_e
24 : {
25 : IP4_MAP_NEXT_IP6_LOOKUP,
26 : #ifdef MAP_SKIP_IP6_LOOKUP
27 : IP4_MAP_NEXT_IP6_REWRITE,
28 : #endif
29 : IP4_MAP_NEXT_ICMP_ERROR,
30 : IP4_MAP_NEXT_DROP,
31 : IP4_MAP_N_NEXT,
32 : };
33 :
34 : static_always_inline u16
35 12 : ip4_map_port_and_security_check (map_domain_t * d, vlib_buffer_t * b0,
36 : u8 * error)
37 : {
38 : u16 port;
39 12 : if (d->psid_length > 0)
40 : {
41 12 : ip4_header_t *ip = vlib_buffer_get_current (b0);
42 :
43 12 : if (PREDICT_FALSE
44 : ((ip->ip_version_and_header_length != 0x45)
45 : || clib_host_to_net_u16 (ip->length) < 28))
46 : {
47 0 : return 0;
48 : }
49 :
50 12 : port = vnet_buffer (b0)->ip.reass.l4_dst_port;
51 :
52 : /* Verify that port is not among the well-known ports */
53 12 : if ((d->psid_offset > 0)
54 12 : && (clib_net_to_host_u16 (port) < (0x1 << (16 - d->psid_offset))))
55 : {
56 0 : *error = MAP_ERROR_ENCAP_SEC_CHECK;
57 : }
58 : else
59 : {
60 12 : return port;
61 : }
62 : }
63 0 : return (0);
64 : }
65 :
66 : /*
67 : * ip4_map_vtcfl
68 : */
69 : static_always_inline u32
70 12 : ip4_map_vtcfl (ip4_header_t * ip4, vlib_buffer_t * p)
71 : {
72 12 : map_main_t *mm = &map_main;
73 12 : u8 tc = mm->tc_copy ? ip4->tos : mm->tc;
74 12 : u32 vtcfl = 0x6 << 28;
75 12 : vtcfl |= tc << 20;
76 12 : vtcfl |= vnet_buffer (p)->ip.flow_hash & 0x000fffff;
77 :
78 12 : return (clib_host_to_net_u32 (vtcfl));
79 : }
80 :
81 : /*
82 : * ip4_map_ttl
83 : */
84 : static inline void
85 12 : ip4_map_decrement_ttl (ip4_header_t * ip, u8 * error)
86 : {
87 12 : i32 ttl = ip->ttl;
88 :
89 : /* Input node should have reject packets with ttl 0. */
90 12 : ASSERT (ip->ttl > 0);
91 :
92 12 : u32 checksum = ip->checksum + clib_host_to_net_u16 (0x0100);
93 12 : checksum += checksum >= 0xffff;
94 12 : ip->checksum = checksum;
95 12 : ttl -= 1;
96 12 : ip->ttl = ttl;
97 12 : *error = ttl <= 0 ? IP4_ERROR_TIME_EXPIRED : *error;
98 :
99 : /* Verify checksum. */
100 12 : ASSERT (ip4_header_checksum_is_valid (ip));
101 12 : }
102 :
103 : static u32
104 1 : ip4_map_fragment (vlib_main_t * vm, u32 bi, u16 mtu, bool df, u32 ** buffers,
105 : u8 * error)
106 : {
107 1 : map_main_t *mm = &map_main;
108 1 : vlib_buffer_t *b = vlib_get_buffer (vm, bi);
109 :
110 1 : if (mm->frag_inner)
111 : {
112 : /* IPv4 fragmented packets inside of IPv6 */
113 1 : ip4_frag_do_fragment (vm, bi, mtu, sizeof (ip6_header_t), buffers);
114 :
115 : /* Fixup */
116 : u32 *i;
117 3 : vec_foreach (i, *buffers)
118 : {
119 2 : vlib_buffer_t *p = vlib_get_buffer (vm, *i);
120 2 : ip6_header_t *ip6 = vlib_buffer_get_current (p);
121 2 : ip6->payload_length =
122 2 : clib_host_to_net_u16 (p->current_length - sizeof (ip6_header_t));
123 : }
124 : }
125 : else
126 : {
127 0 : if (df && !mm->frag_ignore_df)
128 : {
129 0 : icmp4_error_set_vnet_buffer (b, ICMP4_destination_unreachable,
130 : ICMP4_destination_unreachable_fragmentation_needed_and_dont_fragment_set,
131 : mtu);
132 0 : vlib_buffer_advance (b, sizeof (ip6_header_t));
133 0 : *error = MAP_ERROR_DF_SET;
134 0 : return (IP4_MAP_NEXT_ICMP_ERROR);
135 : }
136 :
137 : /* Create IPv6 fragments here */
138 0 : ip6_frag_do_fragment (vm, bi, mtu, 0, buffers);
139 : }
140 1 : return (IP4_MAP_NEXT_IP6_LOOKUP);
141 : }
142 :
143 : /*
144 : * ip4_map
145 : */
146 : static uword
147 8 : ip4_map (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
148 : {
149 : u32 n_left_from, *from, next_index, *to_next, n_left_to_next;
150 : vlib_node_runtime_t *error_node =
151 8 : vlib_node_get_runtime (vm, ip4_map_node.index);
152 8 : from = vlib_frame_vector_args (frame);
153 8 : n_left_from = frame->n_vectors;
154 8 : next_index = node->cached_next_index;
155 8 : map_main_t *mm = &map_main;
156 8 : vlib_combined_counter_main_t *cm = mm->domain_counters;
157 8 : u32 thread_index = vm->thread_index;
158 8 : u32 *buffer0 = 0;
159 :
160 16 : while (n_left_from > 0)
161 : {
162 8 : vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
163 24 : while (n_left_from > 0 && n_left_to_next > 0)
164 : {
165 : u32 pi0;
166 : vlib_buffer_t *p0;
167 : map_domain_t *d0;
168 16 : u8 error0 = MAP_ERROR_NONE;
169 : ip4_header_t *ip40;
170 16 : u16 port0 = 0;
171 : ip6_header_t *ip6h0;
172 16 : u32 next0 = IP4_MAP_NEXT_IP6_LOOKUP;
173 16 : u32 map_domain_index0 = ~0;
174 16 : bool free_original_buffer0 = false;
175 : u32 *frag_from0, frag_left0;
176 :
177 16 : pi0 = to_next[0] = from[0];
178 16 : from += 1;
179 16 : n_left_from -= 1;
180 :
181 16 : p0 = vlib_get_buffer (vm, pi0);
182 16 : ip40 = vlib_buffer_get_current (p0);
183 :
184 : d0 =
185 16 : ip4_map_get_domain (&ip40->dst_address, &map_domain_index0,
186 : &error0);
187 16 : if (!d0)
188 : { /* Guess it wasn't for us */
189 4 : vnet_feature_next (&next0, p0);
190 4 : goto exit;
191 : }
192 :
193 : /*
194 : * Shared IPv4 address
195 : */
196 12 : port0 = ip4_map_port_and_security_check (d0, p0, &error0);
197 :
198 : /*
199 : * Clamp TCP MSS value.
200 : */
201 12 : if (ip40->protocol == IP_PROTOCOL_TCP)
202 : {
203 1 : tcp_header_t *tcp = ip4_next_header (ip40);
204 1 : if (mm->tcp_mss > 0 && tcp_syn (tcp))
205 : {
206 1 : ip_csum_t csum = tcp->checksum;
207 1 : map_mss_clamping (tcp, &csum, mm->tcp_mss);
208 1 : tcp->checksum = ip_csum_fold (csum);
209 : }
210 : }
211 :
212 : /* Decrement IPv4 TTL */
213 12 : ip4_map_decrement_ttl (ip40, &error0);
214 12 : bool df0 =
215 24 : ip40->flags_and_fragment_offset &
216 12 : clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT);
217 :
218 : /* MAP calc */
219 12 : u32 da40 = clib_net_to_host_u32 (ip40->dst_address.as_u32);
220 12 : u16 dp40 = clib_net_to_host_u16 (port0);
221 12 : u64 dal60 = map_get_pfx (d0, da40, dp40);
222 12 : u64 dar60 = map_get_sfx (d0, da40, dp40);
223 12 : if (dal60 == 0 && dar60 == 0 && error0 == MAP_ERROR_NONE)
224 0 : error0 = MAP_ERROR_NO_BINDING;
225 :
226 : /* construct ipv6 header */
227 12 : vlib_buffer_advance (p0, -(sizeof (ip6_header_t)));
228 12 : ip6h0 = vlib_buffer_get_current (p0);
229 12 : vnet_buffer (p0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
230 :
231 12 : ip6h0->ip_version_traffic_class_and_flow_label =
232 12 : ip4_map_vtcfl (ip40, p0);
233 12 : ip6h0->payload_length = ip40->length;
234 12 : ip6h0->protocol = IP_PROTOCOL_IP_IN_IP;
235 12 : ip6h0->hop_limit = 0x40;
236 12 : ip6h0->src_address = d0->ip6_src;
237 12 : ip6h0->dst_address.as_u64[0] = clib_host_to_net_u64 (dal60);
238 12 : ip6h0->dst_address.as_u64[1] = clib_host_to_net_u64 (dar60);
239 :
240 : /*
241 : * Determine next node. Can be one of:
242 : * ip6-lookup, ip6-rewrite, error-drop
243 : */
244 12 : if (PREDICT_TRUE (error0 == MAP_ERROR_NONE))
245 : {
246 12 : if (PREDICT_FALSE
247 : (d0->mtu
248 : && (clib_net_to_host_u16 (ip6h0->payload_length) +
249 : sizeof (*ip6h0) > d0->mtu)))
250 : {
251 1 : next0 =
252 1 : ip4_map_fragment (vm, pi0, d0->mtu, df0, &buffer0,
253 : &error0);
254 :
255 1 : if (error0 == MAP_ERROR_NONE)
256 : {
257 1 : free_original_buffer0 = true;
258 : }
259 : }
260 : else
261 : {
262 11 : next0 =
263 11 : ip4_map_ip6_lookup_bypass (p0,
264 : ip40) ?
265 11 : IP4_MAP_NEXT_IP6_REWRITE : next0;
266 11 : vlib_increment_combined_counter (cm + MAP_DOMAIN_COUNTER_TX,
267 : thread_index,
268 : map_domain_index0, 1,
269 22 : clib_net_to_host_u16
270 11 : (ip6h0->payload_length) +
271 : 40);
272 : }
273 : }
274 : else
275 : {
276 0 : next0 = IP4_MAP_NEXT_DROP;
277 : }
278 :
279 12 : if (PREDICT_FALSE (p0->flags & VLIB_BUFFER_IS_TRACED))
280 : {
281 12 : map_add_trace (vm, node, p0, map_domain_index0, port0);
282 : }
283 :
284 12 : p0->error = error_node->errors[error0];
285 16 : exit:
286 : /* Send fragments that were added in the frame */
287 16 : if (free_original_buffer0)
288 : {
289 1 : vlib_buffer_free_one (vm, pi0); /* Free original packet */
290 : }
291 : else
292 : {
293 15 : vec_add1 (buffer0, pi0);
294 : }
295 :
296 16 : frag_from0 = buffer0;
297 16 : frag_left0 = vec_len (buffer0);
298 :
299 32 : while (frag_left0 > 0)
300 : {
301 33 : while (frag_left0 > 0 && n_left_to_next > 0)
302 : {
303 : u32 i0;
304 17 : i0 = to_next[0] = frag_from0[0];
305 17 : frag_from0 += 1;
306 17 : frag_left0 -= 1;
307 17 : to_next += 1;
308 17 : n_left_to_next -= 1;
309 :
310 34 : vlib_get_buffer (vm, i0)->error =
311 17 : error_node->errors[error0];
312 17 : vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
313 : to_next, n_left_to_next,
314 : i0, next0);
315 : }
316 16 : vlib_put_next_frame (vm, node, next_index, n_left_to_next);
317 16 : vlib_get_next_frame (vm, node, next_index, to_next,
318 : n_left_to_next);
319 : }
320 16 : vec_reset_length (buffer0);
321 : }
322 8 : vlib_put_next_frame (vm, node, next_index, n_left_to_next);
323 : }
324 :
325 8 : vec_free (buffer0);
326 8 : return frame->n_vectors;
327 : }
328 :
329 : /* *INDENT-OFF* */
330 46657 : VNET_FEATURE_INIT (ip4_map_feature, static) =
331 : {
332 : .arc_name = "ip4-unicast",
333 : .node_name = "ip4-map",
334 : .runs_before = VNET_FEATURES ("ip4-flow-classify"),
335 : .runs_after = VNET_FEATURES("ip4-sv-reassembly-feature"),
336 : };
337 :
338 87002 : VLIB_REGISTER_NODE(ip4_map_node) = {
339 : .function = ip4_map,
340 : .name = "ip4-map",
341 : .vector_size = sizeof(u32),
342 : .format_trace = format_map_trace,
343 : .type = VLIB_NODE_TYPE_INTERNAL,
344 :
345 : .n_errors = MAP_N_ERROR,
346 : .error_counters = map_error_counters,
347 :
348 : .n_next_nodes = IP4_MAP_N_NEXT,
349 : .next_nodes = {
350 : [IP4_MAP_NEXT_IP6_LOOKUP] = "ip6-lookup",
351 : #ifdef MAP_SKIP_IP6_LOOKUP
352 : [IP4_MAP_NEXT_IP6_REWRITE] = "ip6-load-balance",
353 : #endif
354 : [IP4_MAP_NEXT_ICMP_ERROR] = "ip4-icmp-error",
355 : [IP4_MAP_NEXT_DROP] = "error-drop",
356 : },
357 : };
358 : /* *INDENT-ON* */
359 :
360 : /*
361 : * fd.io coding-style-patch-verification: ON
362 : *
363 : * Local Variables:
364 : * eval: (c-set-style "gnu")
365 : * End:
366 : */
|
