Line data Source code
1 : /*
2 : * det44.c - deterministic NAT
3 : *
4 : * Copyright (c) 2020 Cisco and/or its affiliates.
5 : * Licensed under the Apache License, Version 2.0 (the "License");
6 : * you may not use this file except in compliance with the License.
7 : * You may obtain a copy of the License at:
8 : *
9 : * http://www.apache.org/licenses/LICENSE-2.0
10 : *
11 : * Unless required by applicable law or agreed to in writing, software
12 : * distributed under the License is distributed on an "AS IS" BASIS,
13 : * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 : * See the License for the specific language governing permissions and
15 : * limitations under the License.
16 : */
17 : /**
18 : * @file
19 : * @brief deterministic NAT (CGN)
20 : */
21 :
22 : #include <vnet/vnet.h>
23 : #include <vnet/ip/ip.h>
24 : #include <vnet/ip/ip4.h>
25 : #include <vpp/app/version.h>
26 : #include <vnet/plugin/plugin.h>
27 :
28 : #include <nat/det44/det44.h>
29 :
30 : det44_main_t det44_main;
31 :
32 : /* *INDENT-OFF* */
33 56583 : VNET_FEATURE_INIT (ip4_det44_in2out, static) = {
34 : .arc_name = "ip4-unicast",
35 : .node_name = "det44-in2out",
36 : .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
37 : "ip4-sv-reassembly-feature"),
38 : };
39 56583 : VNET_FEATURE_INIT (ip4_det44_out2in, static) = {
40 : .arc_name = "ip4-unicast",
41 : .node_name = "det44-out2in",
42 : .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
43 : "ip4-sv-reassembly-feature",
44 : "ip4-dhcp-client-detect"),
45 : };
46 : VLIB_PLUGIN_REGISTER () = {
47 : .version = VPP_BUILD_VER,
48 : .description = "Deterministic NAT (CGN)",
49 : };
50 : /* *INDENT-ON* */
51 :
52 : void
53 5 : det44_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
54 : int is_add)
55 : {
56 5 : det44_main_t *dm = &det44_main;
57 5 : fib_prefix_t prefix = {
58 : .fp_len = p_len,
59 : .fp_proto = FIB_PROTOCOL_IP4,
60 : .fp_addr = {
61 5 : .ip4.as_u32 = addr->as_u32,
62 : },
63 : };
64 5 : u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
65 :
66 5 : if (is_add)
67 : {
68 5 : fib_table_entry_update_one_path (fib_index,
69 : &prefix,
70 5 : dm->fib_src_low,
71 : (FIB_ENTRY_FLAG_CONNECTED |
72 : FIB_ENTRY_FLAG_LOCAL |
73 : FIB_ENTRY_FLAG_EXCLUSIVE),
74 : DPO_PROTO_IP4,
75 : NULL,
76 : sw_if_index,
77 : ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
78 : }
79 : else
80 : {
81 0 : fib_table_entry_delete (fib_index, &prefix, dm->fib_src_low);
82 : }
83 5 : }
84 :
85 : /**
86 : * @brief Add/delete deterministic NAT mapping.
87 : *
88 : * Create bijective mapping of inside address to outside address and port range
89 : * pairs, with the purpose of enabling deterministic NAT to reduce logging in
90 : * CGN deployments.
91 : *
92 : * @param in_addr Inside network address.
93 : * @param in_plen Inside network prefix length.
94 : * @param out_addr Outside network address.
95 : * @param out_plen Outside network prefix length.
96 : * @param is_add If 0 delete, otherwise add.
97 : */
98 : int
99 6 : snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
100 : ip4_address_t * out_addr, u8 out_plen, int is_add)
101 : {
102 : static snat_det_session_t empty_snat_det_session = { 0 };
103 6 : det44_main_t *dm = &det44_main;
104 : ip4_address_t in_cmp, out_cmp;
105 : det44_interface_t *i;
106 : snat_det_map_t *mp;
107 6 : u8 found = 0;
108 :
109 6 : in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
110 6 : out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
111 6 : vec_foreach (mp, dm->det_maps)
112 : {
113 : /* Checking for overlapping addresses to be added here */
114 0 : if (mp->in_addr.as_u32 == in_cmp.as_u32 &&
115 0 : mp->in_plen == in_plen &&
116 0 : mp->out_addr.as_u32 == out_cmp.as_u32 && mp->out_plen == out_plen)
117 : {
118 0 : found = 1;
119 0 : break;
120 : }
121 : }
122 :
123 : /* If found, don't add again */
124 6 : if (found && is_add)
125 0 : return VNET_API_ERROR_VALUE_EXIST;
126 :
127 : /* If not found, don't delete */
128 6 : if (!found && !is_add)
129 0 : return VNET_API_ERROR_NO_SUCH_ENTRY;
130 :
131 6 : if (is_add)
132 : {
133 6 : pool_get (dm->det_maps, mp);
134 6 : clib_memset (mp, 0, sizeof (*mp));
135 6 : mp->in_addr.as_u32 = in_cmp.as_u32;
136 6 : mp->in_plen = in_plen;
137 6 : mp->out_addr.as_u32 = out_cmp.as_u32;
138 6 : mp->out_plen = out_plen;
139 6 : mp->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
140 6 : mp->ports_per_host = (65535 - 1023) / mp->sharing_ratio;
141 :
142 516006 : vec_validate_init_empty (mp->sessions,
143 : DET44_SES_PER_USER * (1 << (32 - in_plen)) -
144 : 1, empty_snat_det_session);
145 : }
146 : else
147 : {
148 0 : vec_free (mp->sessions);
149 0 : vec_del1 (dm->det_maps, mp - dm->det_maps);
150 : }
151 :
152 : /* Add/del external address range to FIB */
153 : /* *INDENT-OFF* */
154 6 : pool_foreach (i, dm->interfaces) {
155 0 : if (det44_interface_is_inside(i))
156 0 : continue;
157 0 : det44_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
158 0 : goto out;
159 : }
160 : /* *INDENT-ON* */
161 6 : out:
162 6 : return 0;
163 : }
164 :
165 : int
166 2 : det44_set_timeouts (nat_timeouts_t * timeouts)
167 : {
168 2 : det44_main_t *dm = &det44_main;
169 2 : if (timeouts->udp)
170 2 : dm->timeouts.udp = timeouts->udp;
171 2 : if (timeouts->tcp.established)
172 2 : dm->timeouts.tcp.established = timeouts->tcp.established;
173 2 : if (timeouts->tcp.transitory)
174 2 : dm->timeouts.tcp.transitory = timeouts->tcp.transitory;
175 2 : if (timeouts->icmp)
176 2 : dm->timeouts.icmp = timeouts->icmp;
177 2 : return 0;
178 : }
179 :
180 : nat_timeouts_t
181 9 : det44_get_timeouts ()
182 : {
183 9 : det44_main_t *dm = &det44_main;
184 9 : return dm->timeouts;
185 : }
186 :
187 : void
188 566 : det44_reset_timeouts ()
189 : {
190 566 : det44_main_t *dm = &det44_main;
191 566 : nat_reset_timeouts (&dm->timeouts);
192 566 : }
193 :
194 : int
195 20 : det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
196 : {
197 20 : det44_main_t *dm = &det44_main;
198 20 : det44_interface_t *tmp, *i = 0;
199 : const char *feature_name;
200 : int rv;
201 :
202 : // TODO: if plugin is not enabled do not register nodes on interfaces
203 : // rather make a structure and when enable call is used
204 : // then register nodes
205 :
206 : /* *INDENT-OFF* */
207 25 : pool_foreach (tmp, dm->interfaces) {
208 15 : if (tmp->sw_if_index == sw_if_index)
209 : {
210 10 : i = tmp;
211 10 : goto out;
212 : }
213 : }
214 : /* *INDENT-ON* */
215 10 : out:
216 :
217 20 : feature_name = is_inside ? "det44-in2out" : "det44-out2in";
218 :
219 20 : if (is_del)
220 : {
221 10 : if (!i)
222 : {
223 0 : det44_log_err ("det44 is not enabled on this interface");
224 0 : return VNET_API_ERROR_INVALID_VALUE;
225 : }
226 :
227 10 : rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
228 10 : if (rv)
229 0 : return rv;
230 :
231 10 : rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
232 : sw_if_index, 1, 0, 0);
233 10 : if (rv)
234 0 : return rv;
235 :
236 10 : pool_put (dm->interfaces, i);
237 : }
238 : else
239 : {
240 10 : if (i)
241 : {
242 0 : det44_log_err ("det44 is already enabled on this interface");
243 0 : return VNET_API_ERROR_INVALID_VALUE;
244 : }
245 :
246 10 : rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1);
247 10 : if (rv)
248 0 : return rv;
249 :
250 10 : rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
251 : sw_if_index, 1, 0, 0);
252 10 : if (rv)
253 0 : return rv;
254 :
255 10 : pool_get (dm->interfaces, i);
256 10 : clib_memset (i, 0, sizeof (*i));
257 :
258 10 : i->sw_if_index = sw_if_index;
259 :
260 10 : if (is_inside)
261 5 : i->flags |= DET44_INTERFACE_FLAG_IS_INSIDE;
262 : else
263 5 : i->flags |= DET44_INTERFACE_FLAG_IS_OUTSIDE;
264 : }
265 :
266 20 : if (!is_inside)
267 : {
268 5 : u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
269 : sw_if_index);
270 : // add/del outside interface fib to registry
271 5 : u8 found = 0;
272 : det44_fib_t *outside_fib;
273 : /* *INDENT-OFF* */
274 5 : vec_foreach (outside_fib, dm->outside_fibs)
275 : {
276 4 : if (outside_fib->fib_index == fib_index)
277 : {
278 4 : if (!is_del)
279 : {
280 4 : outside_fib->refcount++;
281 : }
282 : else
283 : {
284 0 : outside_fib->refcount--;
285 0 : if (!outside_fib->refcount)
286 : {
287 0 : vec_del1 (dm->outside_fibs,
288 : outside_fib - dm->outside_fibs);
289 : }
290 : }
291 4 : found = 1;
292 4 : break;
293 : }
294 : }
295 : /* *INDENT-ON* */
296 5 : if (!is_del && !found)
297 : {
298 1 : vec_add2 (dm->outside_fibs, outside_fib, 1);
299 1 : outside_fib->fib_index = fib_index;
300 1 : outside_fib->refcount = 1;
301 : }
302 : // add/del outside address to FIB
303 : snat_det_map_t *mp;
304 : /* *INDENT-OFF* */
305 10 : pool_foreach (mp, dm->det_maps) {
306 5 : det44_add_del_addr_to_fib(&mp->out_addr,
307 5 : mp->out_plen, sw_if_index, !is_del);
308 : }
309 : /* *INDENT-ON* */
310 : }
311 20 : return 0;
312 : }
313 :
314 : /**
315 : * @brief The 'det44-expire-walk' process's main loop.
316 : *
317 : * Check expire time for active sessions.
318 : */
319 : static uword
320 1 : det44_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
321 : vlib_frame_t * f)
322 : {
323 1 : det44_main_t *dm = &det44_main;
324 : snat_det_session_t *ses;
325 : snat_det_map_t *mp;
326 :
327 : while (1)
328 2 : {
329 3 : vlib_process_wait_for_event_or_clock (vm, 10.0);
330 2 : vlib_process_get_events (vm, NULL);
331 2 : u32 now = (u32) vlib_time_now (vm);
332 :
333 2 : if (!plugin_enabled ())
334 : {
335 0 : continue;
336 : }
337 :
338 3 : pool_foreach (mp, dm->det_maps)
339 : {
340 1001 : vec_foreach (ses, mp->sessions)
341 : {
342 : // close expired sessions
343 1000 : if (ses->in_port && (ses->expire < now))
344 : {
345 3 : snat_det_ses_close (mp, ses);
346 : }
347 : }
348 : }
349 : }
350 : return 0;
351 : }
352 :
353 : void
354 7 : det44_create_expire_walk_process ()
355 : {
356 7 : det44_main_t *dm = &det44_main;
357 :
358 7 : if (dm->expire_walk_node_index)
359 6 : return;
360 :
361 1 : dm->expire_walk_node_index = vlib_process_create (vlib_get_main (),
362 : "det44-expire-walk",
363 : det44_expire_walk_fn,
364 : 16 /* stack_bytes */ );
365 : }
366 :
367 : int
368 7 : det44_plugin_enable (det44_config_t c)
369 : {
370 7 : det44_main_t *dm = &det44_main;
371 :
372 7 : if (plugin_enabled () == 1)
373 : {
374 0 : det44_log_err ("plugin already enabled!");
375 0 : return 1;
376 : }
377 :
378 7 : det44_log_err ("inside %u, outside %u", c.inside_vrf_id, c.outside_vrf_id);
379 :
380 14 : dm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
381 : c.outside_vrf_id,
382 7 : dm->fib_src_hi);
383 14 : dm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
384 : c.inside_vrf_id,
385 7 : dm->fib_src_hi);
386 :
387 7 : dm->mss_clamping = 0;
388 7 : dm->config = c;
389 7 : dm->enabled = 1;
390 :
391 7 : det44_create_expire_walk_process ();
392 7 : return 0;
393 : }
394 :
395 : int
396 7 : det44_plugin_disable ()
397 : {
398 7 : det44_main_t *dm = &det44_main;
399 : det44_interface_t *i, *interfaces;
400 : snat_det_map_t *mp;
401 7 : int rv = 0;
402 :
403 7 : if (plugin_enabled () == 0)
404 : {
405 0 : det44_log_err ("plugin already disabled!");
406 0 : return 1;
407 : }
408 :
409 7 : dm->enabled = 0;
410 :
411 : // DET44 cleanup (order dependent)
412 : // 1) remove interfaces (det44_interface_add_del) removes map ranges from fib
413 : // 2) free sessions
414 : // 3) free maps
415 :
416 7 : interfaces = vec_dup (dm->interfaces);
417 17 : vec_foreach (i, interfaces)
418 : {
419 10 : vnet_main_t *vnm = vnet_get_main ();
420 :
421 10 : if (i->flags & DET44_INTERFACE_FLAG_IS_INSIDE)
422 : {
423 5 : rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
424 5 : if (rv)
425 : {
426 0 : det44_log_err ("inside interface %U del failed",
427 : unformat_vnet_sw_interface, vnm, i->sw_if_index);
428 : }
429 : }
430 :
431 10 : if (i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE)
432 : {
433 5 : rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
434 5 : if (rv)
435 : {
436 0 : det44_log_err ("outside interface %U del failed",
437 : unformat_vnet_sw_interface, vnm, i->sw_if_index);
438 : }
439 :
440 : }
441 : }
442 7 : vec_free (interfaces);
443 :
444 : /* *INDENT-OFF* */
445 13 : pool_foreach (mp, dm->det_maps)
446 : {
447 6 : vec_free (mp->sessions);
448 : }
449 : /* *INDENT-ON* */
450 :
451 7 : det44_reset_timeouts ();
452 :
453 7 : pool_free (dm->interfaces);
454 7 : pool_free (dm->det_maps);
455 :
456 7 : return rv;
457 : }
458 :
459 : static void
460 896 : det44_update_outside_fib (ip4_main_t * im,
461 : uword opaque,
462 : u32 sw_if_index, u32 new_fib_index,
463 : u32 old_fib_index)
464 : {
465 896 : det44_main_t *dm = &det44_main;
466 :
467 : det44_fib_t *outside_fib;
468 : det44_interface_t *i;
469 :
470 896 : u8 is_add = 1;
471 896 : u8 match = 0;
472 :
473 896 : if (plugin_enabled () == 0)
474 896 : return;
475 :
476 0 : if (new_fib_index == old_fib_index)
477 0 : return;
478 :
479 0 : if (!vec_len (dm->outside_fibs))
480 0 : return;
481 :
482 : /* *INDENT-OFF* */
483 0 : pool_foreach (i, dm->interfaces)
484 : {
485 0 : if (i->sw_if_index == sw_if_index)
486 : {
487 0 : if (!(det44_interface_is_outside (i)))
488 0 : return;
489 0 : match = 1;
490 : }
491 : }
492 : /* *INDENT-ON* */
493 :
494 0 : if (!match)
495 0 : return;
496 :
497 0 : vec_foreach (outside_fib, dm->outside_fibs)
498 : {
499 0 : if (outside_fib->fib_index == old_fib_index)
500 : {
501 0 : outside_fib->refcount--;
502 0 : if (!outside_fib->refcount)
503 0 : vec_del1 (dm->outside_fibs, outside_fib - dm->outside_fibs);
504 0 : break;
505 : }
506 : }
507 :
508 0 : vec_foreach (outside_fib, dm->outside_fibs)
509 : {
510 0 : if (outside_fib->fib_index == new_fib_index)
511 : {
512 0 : outside_fib->refcount++;
513 0 : is_add = 0;
514 0 : break;
515 : }
516 : }
517 :
518 0 : if (is_add)
519 : {
520 0 : vec_add2 (dm->outside_fibs, outside_fib, 1);
521 0 : outside_fib->refcount = 1;
522 0 : outside_fib->fib_index = new_fib_index;
523 : }
524 : }
525 :
526 : static clib_error_t *
527 559 : det44_init (vlib_main_t * vm)
528 : {
529 559 : det44_main_t *dm = &det44_main;
530 : ip4_table_bind_callback_t cb;
531 : vlib_node_t *node;
532 :
533 559 : clib_memset (dm, 0, sizeof (*dm));
534 :
535 559 : dm->ip4_main = &ip4_main;
536 559 : dm->log_class = vlib_log_register_class ("det44", 0);
537 :
538 559 : node = vlib_get_node_by_name (vm, (u8 *) "det44-in2out");
539 559 : dm->in2out_node_index = node->index;
540 559 : node = vlib_get_node_by_name (vm, (u8 *) "det44-out2in");
541 559 : dm->out2in_node_index = node->index;
542 :
543 559 : dm->fib_src_hi = fib_source_allocate ("det44-hi",
544 : FIB_SOURCE_PRIORITY_HI,
545 : FIB_SOURCE_BH_SIMPLE);
546 559 : dm->fib_src_low = fib_source_allocate ("det44-low",
547 : FIB_SOURCE_PRIORITY_LOW,
548 : FIB_SOURCE_BH_SIMPLE);
549 :
550 559 : cb.function = det44_update_outside_fib;
551 559 : cb.function_opaque = 0;
552 559 : vec_add1 (dm->ip4_main->table_bind_callbacks, cb);
553 :
554 559 : det44_reset_timeouts ();
555 559 : return det44_api_hookup (vm);
556 : }
557 :
558 1119 : VLIB_INIT_FUNCTION (det44_init);
559 :
560 : u8 *
561 3 : format_det44_session_state (u8 * s, va_list * args)
562 : {
563 3 : u32 i = va_arg (*args, u32);
564 3 : u8 *t = 0;
565 :
566 3 : switch (i)
567 : {
568 : #define _(v, N, str) case DET44_SESSION_##N: t = (u8 *) str; break;
569 3 : foreach_det44_session_state
570 : #undef _
571 0 : default:
572 0 : t = format (t, "unknown");
573 : }
574 3 : s = format (s, "%s", t);
575 3 : return s;
576 : }
577 :
578 : u8 *
579 3 : format_det_map_ses (u8 * s, va_list * args)
580 : {
581 3 : snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *);
582 : ip4_address_t in_addr, out_addr;
583 : u32 in_offset, out_offset;
584 3 : snat_det_session_t *ses = va_arg (*args, snat_det_session_t *);
585 3 : u32 *i = va_arg (*args, u32 *);
586 :
587 3 : u32 user_index = *i / DET44_SES_PER_USER;
588 3 : in_addr.as_u32 =
589 3 : clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) +
590 : user_index);
591 3 : in_offset =
592 3 : clib_net_to_host_u32 (in_addr.as_u32) -
593 3 : clib_net_to_host_u32 (det_map->in_addr.as_u32);
594 3 : out_offset = in_offset / det_map->sharing_ratio;
595 3 : out_addr.as_u32 =
596 3 : clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) +
597 : out_offset);
598 : s =
599 3 : format (s,
600 : "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
601 3 : format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port),
602 : format_ip4_address, &out_addr,
603 3 : clib_net_to_host_u16 (ses->out.out_port), format_ip4_address,
604 : &ses->out.ext_host_addr,
605 3 : clib_net_to_host_u16 (ses->out.ext_host_port),
606 3 : format_det44_session_state, ses->state, ses->expire);
607 :
608 3 : return s;
609 : }
610 :
611 : /*
612 : * fd.io coding-style-patch-verification: ON
613 : *
614 : * Local Variables:
615 : * eval: (c-set-style "gnu")
616 : * End:
617 : */
|
