1/*
2 * snat_det.c - deterministic NAT
3 *
4 * Copyright (c) 2017 Cisco and/or its affiliates.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 *     http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 */
17/**
18 * @file
19 * @brief deterministic NAT
20 */
21
22#include <nat/nat_det.h>
23
24
25/**
26 * @brief Add/delete deterministic NAT mapping.
27 *
28 * Create bijective mapping of inside address to outside address and port range
29 * pairs, with the purpose of enabling deterministic NAT to reduce logging in
30 * CGN deployments.
31 *
32 * @param sm       SNAT main.
33 * @param in_addr  Inside network address.
34 * @param in_plen  Inside network prefix length.
35 * @param out_addr Outside network address.
36 * @param out_plen Outside network prefix length.
37 * @param is_add   If 0 delete, otherwise add.
38 */
39int
40snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen,
41		  ip4_address_t * out_addr, u8 out_plen, int is_add)
42{
43  snat_det_map_t *det_map;
44  static snat_det_session_t empty_snat_det_session = { 0 };
45  snat_interface_t *i;
46  ip4_address_t in_cmp, out_cmp;
47  u8 found = 0;
48
49  in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
50  out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
51  vec_foreach (det_map, sm->det_maps)
52  {
53    /* Checking for overlapping addresses to be added here */
54    if (det_map->in_addr.as_u32 == in_cmp.as_u32 &&
55	det_map->in_plen == in_plen &&
56	det_map->out_addr.as_u32 == out_cmp.as_u32 &&
57	det_map->out_plen == out_plen)
58      {
59	found = 1;
60	break;
61      }
62  }
63
64  /* If found, don't add again */
65  if (found && is_add)
66    return VNET_API_ERROR_VALUE_EXIST;
67
68  /* If not found, don't delete */
69  if (!found && !is_add)
70    return VNET_API_ERROR_NO_SUCH_ENTRY;
71
72  if (is_add)
73    {
74      pool_get (sm->det_maps, det_map);
75      clib_memset (det_map, 0, sizeof (*det_map));
76      det_map->in_addr.as_u32 = in_cmp.as_u32;
77      det_map->in_plen = in_plen;
78      det_map->out_addr.as_u32 = out_cmp.as_u32;
79      det_map->out_plen = out_plen;
80      det_map->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
81      det_map->ports_per_host = (65535 - 1023) / det_map->sharing_ratio;
82
83      vec_validate_init_empty (det_map->sessions,
84			       SNAT_DET_SES_PER_USER * (1 << (32 - in_plen)) -
85			       1, empty_snat_det_session);
86    }
87  else
88    {
89      vec_free (det_map->sessions);
90      vec_del1 (sm->det_maps, det_map - sm->det_maps);
91    }
92
93  /* Add/del external address range to FIB */
94  /* *INDENT-OFF* */
95  pool_foreach (i, sm->interfaces,
96  ({
97    if (nat_interface_is_inside(i))
98      continue;
99
100    snat_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
101    break;
102  }));
103  /* *INDENT-ON* */
104  return 0;
105}
106
107/**
108 * @brief The 'nat-det-expire-walk' process's main loop.
109 *
110 * Check expire time for active sessions.
111 */
112static uword
113snat_det_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
114			 vlib_frame_t * f)
115{
116  snat_main_t *sm = &snat_main;
117  snat_det_map_t *dm;
118  snat_det_session_t *ses;
119
120  while (sm->deterministic)
121    {
122      vlib_process_wait_for_event_or_clock (vm, 10.0);
123      vlib_process_get_events (vm, NULL);
124      u32 now = (u32) vlib_time_now (vm);
125      /* *INDENT-OFF* */
126      pool_foreach (dm, sm->det_maps,
127      ({
128        vec_foreach(ses, dm->sessions)
129          {
130            /* Delete if session expired */
131            if (ses->in_port && (ses->expire < now))
132              snat_det_ses_close (dm, ses);
133          }
134      }));
135      /* *INDENT-ON* */
136    }
137
138  return 0;
139}
140
141static vlib_node_registration_t snat_det_expire_walk_node;
142
143/* *INDENT-OFF* */
144VLIB_REGISTER_NODE (snat_det_expire_walk_node, static) = {
145    .function = snat_det_expire_walk_fn,
146    .type = VLIB_NODE_TYPE_PROCESS,
147    .name =
148    "nat-det-expire-walk",
149};
150/* *INDENT-ON* */
151
152/*
153 * fd.io coding-style-patch-verification: ON
154 *
155 * Local Variables:
156 * eval: (c-set-style "gnu")
157 * End:
158 */
159