Line data    Source code

       1             : /*
       2             :  * Copyright (c) 2020 Cisco and/or its affiliates.
       3             :  * Licensed under the Apache License, Version 2.0 (the "License");
       4             :  * you may not use this file except in compliance with the License.
       5             :  * You may obtain a copy of the License at:
       6             :  *
       7             :  *     http://www.apache.org/licenses/LICENSE-2.0
       8             :  *
       9             :  * Unless required by applicable law or agreed to in writing, software
      10             :  * distributed under the License is distributed on an "AS IS" BASIS,
      11             :  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      12             :  * See the License for the specific language governing permissions and
      13             :  * limitations under the License.
      14             :  */
      15             : 
      16             : #include <vlibmemory/api.h>
      17             : #include <cnat/cnat_node.h>
      18             : #include <cnat/cnat_inline.h>
      19             : #include <cnat/cnat_src_policy.h>
      20             : 
      21             : typedef enum cnat_translation_next_t_
      22             : {
      23             :   CNAT_TRANSLATION_NEXT_DROP,
      24             :   CNAT_TRANSLATION_NEXT_LOOKUP,
      25             :   CNAT_TRANSLATION_N_NEXT,
      26             : } cnat_translation_next_t;
      27             : 
      28             : vlib_node_registration_t cnat_vip_ip4_node;
      29             : vlib_node_registration_t cnat_vip_ip6_node;
      30             : 
      31             : /* CNat sub for NAT behind a fib entry (VIP or interposed real IP) */
      32             : static uword
      33        4860 : cnat_vip_node_fn (vlib_main_t *vm, vlib_node_runtime_t *node, vlib_buffer_t *b,
      34             :                   cnat_node_ctx_t *ctx, int session_not_found,
      35             :                   cnat_session_t *session)
      36             : {
      37        4860 :   vlib_combined_counter_main_t *cntm = &cnat_translation_counters;
      38        4860 :   cnat_src_policy_main_t *cspm = &cnat_src_policy_main;
      39        4860 :   const cnat_translation_t *ct = NULL;
      40        4860 :   ip4_header_t *ip4 = NULL;
      41             :   ip_protocol_t iproto;
      42        4860 :   ip6_header_t *ip6 = NULL;
      43             :   udp_header_t *udp0;
      44             :   cnat_client_t *cc;
      45             :   u16 next0;
      46             :   index_t cti;
      47        4860 :   u8 trace_flags = 0;
      48             :   int rv;
      49             : 
      50        4860 :   if (AF_IP4 == ctx->af)
      51             :     {
      52        2295 :       ip4 = vlib_buffer_get_current (b);
      53        2295 :       iproto = ip4->protocol;
      54        2295 :       udp0 = (udp_header_t *) (ip4 + 1);
      55             :     }
      56             :   else
      57             :     {
      58        2565 :       ip6 = vlib_buffer_get_current (b);
      59        2565 :       iproto = ip6->protocol;
      60        2565 :       udp0 = (udp_header_t *) (ip6 + 1);
      61             :     }
      62             : 
      63        4860 :   cc = cnat_client_get (vnet_buffer (b)->ip.adj_index[VLIB_TX]);
      64             : 
      65             :   /* Wrong session key */
      66        4860 :   if (session->key.cs_proto == 0)
      67             :     {
      68             :       /* Dont translate & follow the fib programming */
      69           0 :       next0 = cc->cc_parent.dpoi_next_node;
      70           0 :       vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
      71           0 :       goto trace;
      72             :     }
      73             : 
      74        4860 :   if (!session_not_found)
      75             :     {
      76             :       /* session table hit */
      77        3342 :       cnat_timestamp_update (session->value.cs_ts_index, ctx->now);
      78             : 
      79        3342 :       if (INDEX_INVALID != session->value.cs_lbi)
      80             :         {
      81             :           /* Translate & follow the translation given LB */
      82        1632 :           next0 = session->value.dpoi_next_node;
      83        1632 :           vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi;
      84             :         }
      85        1710 :       else if (session->value.flags & CNAT_SESSION_FLAG_HAS_SNAT)
      86             :         {
      87             :           /* The return needs DNAT, so we need an additionnal
      88             :            * lookup after translation */
      89         540 :           next0 = CNAT_TRANSLATION_NEXT_LOOKUP;
      90             :         }
      91             :       else
      92             :         {
      93             :           /* Translate & follow the fib programming */
      94        1170 :           next0 = cc->cc_parent.dpoi_next_node;
      95        1170 :           vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
      96             :         }
      97             :     }
      98             :   else
      99             :     {
     100             :       ct =
     101        1518 :         cnat_find_translation (cc->parent_cci,
     102        1518 :                                clib_host_to_net_u16 (udp0->dst_port), iproto);
     103        1518 :       if (NULL == ct)
     104             :         {
     105             :           /* Dont translate & Follow the fib programming */
     106        1170 :           vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
     107        1170 :           next0 = cc->cc_parent.dpoi_next_node;
     108        1170 :           goto trace;
     109             :         }
     110             : 
     111             :       /* New flow, create the sessions */
     112             :       cnat_ep_trk_t *trk0;
     113         348 :       u32 rsession_flags = 0;
     114         348 :       u32 dpoi_index = -1;
     115             : 
     116         348 :       trk0 = cnat_load_balance (ct, ctx->af, ip4, ip6, &dpoi_index);
     117         348 :       if (PREDICT_FALSE (NULL == trk0))
     118             :         {
     119             :           /* Dont translate & Follow the fib programming */
     120           0 :           vnet_buffer (b)->ip.adj_index[VLIB_TX] = cc->cc_parent.dpoi_index;
     121           0 :           next0 = cc->cc_parent.dpoi_next_node;
     122           0 :           goto trace;
     123             :         }
     124             : 
     125             :       /* add the session */
     126         348 :       ip46_address_copy (&session->value.cs_ip[VLIB_TX],
     127         348 :                          &trk0->ct_ep[VLIB_TX].ce_ip.ip);
     128         348 :       if (ip_address_is_zero (&trk0->ct_ep[VLIB_RX].ce_ip))
     129             :         {
     130         348 :           if (AF_IP4 == ctx->af)
     131         174 :             ip46_address_set_ip4 (&session->value.cs_ip[VLIB_RX],
     132         174 :                                   &ip4->src_address);
     133             :           else
     134         174 :             ip46_address_set_ip6 (&session->value.cs_ip[VLIB_RX],
     135         174 :                                   &ip6->src_address);
     136             :         }
     137             :       else
     138             :         {
     139             :           /* We source NAT with the translation */
     140           0 :           rsession_flags |= CNAT_SESSION_FLAG_HAS_SNAT;
     141           0 :           ip46_address_copy (&session->value.cs_ip[VLIB_RX],
     142           0 :                              &trk0->ct_ep[VLIB_RX].ce_ip.ip);
     143             :         }
     144         348 :       session->value.cs_port[VLIB_TX] =
     145         348 :         clib_host_to_net_u16 (trk0->ct_ep[VLIB_TX].ce_port);
     146         348 :       session->value.cs_port[VLIB_RX] =
     147         348 :         clib_host_to_net_u16 (trk0->ct_ep[VLIB_RX].ce_port);
     148             : 
     149         348 :       session->value.dpoi_next_node = ct->ct_lb.dpoi_next_node;
     150         348 :       session->value.cs_lbi = dpoi_index;
     151         348 :       session->value.flags = 0;
     152             : 
     153         348 :       rv = cspm->vip_policy (vm, b, session, &rsession_flags, ct, ctx);
     154         348 :       if (CNAT_SOURCE_ERROR_USE_DEFAULT == rv)
     155           0 :         rv = cspm->default_policy (vm, b, session, &rsession_flags, ct, ctx);
     156         348 :       if (rv)
     157             :         {
     158           0 :           if (CNAT_SOURCE_ERROR_EXHAUSTED_PORTS == rv)
     159             :             {
     160           0 :               vlib_node_registration_t *node =
     161           0 :                 (AF_IP4 == ctx->af) ? &cnat_vip_ip4_node : &cnat_vip_ip6_node;
     162           0 :               vlib_node_increment_counter (vm, node->index,
     163             :                                            CNAT_ERROR_EXHAUSTED_PORTS, 1);
     164             :             }
     165           0 :           next0 = CNAT_TRANSLATION_NEXT_DROP;
     166           0 :           goto trace;
     167             :         }
     168             : 
     169             :       /* refcnt session in current client */
     170         348 :       cnat_client_cnt_session (cc);
     171         348 :       cnat_session_create (session, ctx, CNAT_LOCATION_FIB, rsession_flags);
     172         348 :       trace_flags |= CNAT_TRACE_SESSION_CREATED;
     173             : 
     174         348 :       next0 = ct->ct_lb.dpoi_next_node;
     175         348 :       vnet_buffer (b)->ip.adj_index[VLIB_TX] = session->value.cs_lbi;
     176             :     }
     177             : 
     178        3690 :   if (AF_IP4 == ctx->af)
     179        1710 :     cnat_translation_ip4 (session, ip4, udp0);
     180             :   else
     181        1980 :     cnat_translation_ip6 (session, ip6, udp0);
     182             : 
     183        3690 :   if (NULL != ct)
     184             :     {
     185         348 :       cti = ct - cnat_translation_pool;
     186         348 :       vlib_increment_combined_counter (cntm, ctx->thread_index, cti, 1,
     187             :                                        vlib_buffer_length_in_chain (vm, b));
     188             :     }
     189             : 
     190        3342 : trace:
     191        4860 :   if (PREDICT_FALSE (ctx->do_trace))
     192             :     {
     193        4860 :       trace_flags |= session_not_found ? 0 : CNAT_TRACE_SESSION_FOUND;
     194        4860 :       cnat_add_trace (vm, node, b, session, ct, trace_flags);
     195             :     }
     196        4860 :   return next0;
     197             : }
     198             : 
     199         712 : VLIB_NODE_FN (cnat_vip_ip4_node) (vlib_main_t * vm,
     200             :                                   vlib_node_runtime_t * node,
     201             :                                   vlib_frame_t * frame)
     202             : {
     203         153 :   if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
     204         153 :     return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP4,
     205             :                              CNAT_LOCATION_FIB, 1 /* do_trace */);
     206           0 :   return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP4,
     207             :                            CNAT_LOCATION_FIB, 0 /* do_trace */);
     208             : }
     209             : 
     210         730 : VLIB_NODE_FN (cnat_vip_ip6_node) (vlib_main_t * vm,
     211             :                                   vlib_node_runtime_t * node,
     212             :                                   vlib_frame_t * frame)
     213             : {
     214         171 :   if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
     215         171 :     return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP6,
     216             :                              CNAT_LOCATION_FIB, 1 /* do_trace */);
     217           0 :   return cnat_node_inline (vm, node, frame, cnat_vip_node_fn, AF_IP6,
     218             :                            CNAT_LOCATION_FIB, 0 /* do_trace */);
     219             : }
     220             : 
     221      159080 : VLIB_REGISTER_NODE (cnat_vip_ip4_node) =
     222             : {
     223             :   .name = "ip4-cnat-tx",
     224             :   .vector_size = sizeof (u32),
     225             :   .format_trace = format_cnat_trace,
     226             :   .type = VLIB_NODE_TYPE_INTERNAL,
     227             :   .n_errors = 0,
     228             :   .n_next_nodes = CNAT_TRANSLATION_N_NEXT,
     229             :   .next_nodes =
     230             :   {
     231             :     [CNAT_TRANSLATION_NEXT_DROP] = "ip4-drop",
     232             :     [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip4-lookup",
     233             :   },
     234             : };
     235      159080 : VLIB_REGISTER_NODE (cnat_vip_ip6_node) =
     236             : {
     237             :   .name = "ip6-cnat-tx",
     238             :   .vector_size = sizeof (u32),
     239             :   .format_trace = format_cnat_trace,
     240             :   .type = VLIB_NODE_TYPE_INTERNAL,
     241             :   .n_errors = 0,
     242             :   .n_next_nodes = CNAT_TRANSLATION_N_NEXT,
     243             :   .next_nodes =
     244             :   {
     245             :     [CNAT_TRANSLATION_NEXT_DROP] = "ip6-drop",
     246             :     [CNAT_TRANSLATION_NEXT_LOOKUP] = "ip6-lookup",
     247             :   },
     248             : };
     249             : 
     250             : /*
     251             :  * fd.io coding-style-patch-verification: ON
     252             :  *
     253             :  * Local Variables:
     254             :  * eval: (c-set-style "gnu")
     255             :  * End:
     256             :  */