diff options
Diffstat (limited to 'src/access')
| -rw-r--r-- | src/access/Makefile | 26 | ||||
| -rw-r--r-- | src/access/flowood_access.c | 1656 | ||||
| -rw-r--r-- | src/access/flwd_access_active_ip_manage.c | 616 | ||||
| -rw-r--r-- | src/access/flwd_access_idle_call.c | 66 | ||||
| -rw-r--r-- | src/access/flwd_access_ip_layer.c | 6 | ||||
| -rw-r--r-- | src/access/flwd_access_l2tp_layer.c | 22 | ||||
| -rw-r--r-- | src/access/flwd_access_maat.c | 582 |
7 files changed, 2974 insertions, 0 deletions
diff --git a/src/access/Makefile b/src/access/Makefile new file mode 100644 index 0000000..be17825 --- /dev/null +++ b/src/access/Makefile @@ -0,0 +1,26 @@ +#CC=gcc +CC=g++ +CCC=g++ + +TARGET=flowood_access.o flwd_access_ip_layer.o flwd_access_active_ip_manage.o flwd_access_idle_call.o flwd_access_maat.o + +CFLAGS=-g -fPIC -shared -D_GNU_SOURCE=1 -D_BSD_SOURCE=1 -D__USE_MISC=1 -D__FAVOR_BSD=1 -D__USE_BSD=1 + +H_DIR=-I../..//inc +H_DIR+=-I/opt/MESA/include +H_DIR+=-I/opt/MESA/include/MESA + +LIBPATH=../lib +LIB=-L/opt/MESA/lib -lpthread + + +all:$(TARGET) + +.c.o: + $(CC) -c $(CFLAGS) -I. $(H_DIR) $< + +.cpp.o: + $(CCC) -c $(CFLAGS) -I. $(H_DIR) $< + +clean: + rm -f *.o diff --git a/src/access/flowood_access.c b/src/access/flowood_access.c new file mode 100644 index 0000000..6af4866 --- /dev/null +++ b/src/access/flowood_access.c @@ -0,0 +1,1656 @@ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" +#include "MESA_htable.h" +#include "MESA_list_queue.h" +#include "MESA_handle_logger.h" +#include "MESA_list_count.h" +#include "ltsm.h" +#include <assert.h> +#include <stdio.h> +#include <unistd.h> +#include <pthread.h> +#include <string.h> +#include <assert.h> +#include <arpa/inet.h> +#include <netinet/tcp.h> +#include <netinet/udp.h> + +/* + IP����ϵͳ��������, ��������ն˵�����, ���ݲ���ѡ���ض�IP��, ��NATת��, + ����ת������, + �Զ������̷�ʽ����. +*/ + +static int flwd_access_fetch_usable_ipport_by_single_ip( + flwd_active_ip_t *flwd_active_ip, flwd_active_ip_port_args_t *usable_active_ipport_args) +{ + int ret; + int try_times; + MESA_list_count_t *usable_sport_queue_head, *sport_list_node; + unsigned short sport; + long buf_len; + flwd_tuple5_t seek_nat_key; + unsigned int compat_io_hash; + char ip_str[64]; + int usable_sport_num; + + if(IPPROTO_TCP == usable_active_ipport_args->protocol){ + usable_sport_queue_head = &flwd_active_ip->usable_tcp_sport_list_head; + }else{ + usable_sport_queue_head = &flwd_active_ip->usable_udp_sport_list_head; + } + + usable_sport_num = MESA_list_count_get_count(usable_sport_queue_head); + if(usable_sport_num <= 0){ + /* ��ǰIP���ö˿���ȫ�������� */ + flwd_log(20, "ip_pool: %s, all usable sport is in used!\n", + flwd_ipt_ntop_r(&flwd_active_ip->active_ip_net_order, ip_str, 64)); + return ITERATE_CB_RET_CONTINUE_FLAG; + } + + flwd_tuple5_dup_to_stack(usable_active_ipport_args->tid, &seek_nat_key, usable_active_ipport_args->nat_key); + + flwd_tuple5_adjust_dir(&seek_nat_key); + + if(FLWD_IP_ADDR_TYPE_V4 == flwd_active_ip->active_ip_net_order.addr_type){ + seek_nat_key.ippair_v4.sip_net_order = flwd_active_ip->active_ip_net_order.addr_ipv4; + }else{ + memcpy(&seek_nat_key.ippair_v6->sip_net_order, + &flwd_active_ip->active_ip_net_order.addr_ipv6, + sizeof(struct in6_addr)); + } + + /* + TODO, + �˴�ѡ����ԴIP, ��Ҫѡ����ʵ�Դ�˿�, ʹ�ظ��������ܷ�������ǰ���͵��߳�, + ����ʹ��ring_queue, ��Ҫ��ͣ�ı������Կ��ö˿�, ֱ��hashֵ���Ϸ�������. + */ + sport_list_node = usable_sport_queue_head->nextele; + + for(try_times = 0; + (try_times < usable_sport_num) && (sport_list_node != usable_sport_queue_head); + try_times++, sport_list_node = sport_list_node->nextele){ + /* �������ж˿�, �鿴�ĸ����ɵ���Ԫ��HASH���ɷ��ϵ�ǰ�߳�id */ + memcpy(&seek_nat_key.sport_net_order, &sport_list_node->quiddity, sizeof(short)); + compat_io_hash = compat_marsio_tuple4_hash(&seek_nat_key); + if((compat_io_hash % flwd_cfg_val.tot_thread_count) == usable_active_ipport_args->tid){ + MESA_list_count_del(usable_sport_queue_head, sport_list_node); /* �ӿ��ö˿��������Ƴ� */ + free(sport_list_node); /* �˿��Ѿ���ȡ��, ������������ṹ */ + goto bingo; + } + } + + /* ��Ȼ�п��ö˿�, ���ǵ�ǰIPû�ҵ��ʺϵ�ǰ�߳�, �Թ�����ʵ�HASHֵ����Ѷ˿�, ����������һ��IP */ + flwd_log(20, "ip_pool: %s,has %d usable sport, but unfortunately no match hash value sport for current thread!\n", + usable_sport_num, + flwd_ipt_ntop_r(&flwd_active_ip->active_ip_net_order, ip_str, 64), usable_sport_num); + return ITERATE_CB_RET_CONTINUE_FLAG ; + +bingo: + usable_active_ipport_args->act_sip_net_order = flwd_active_ip->active_ip_net_order; + usable_active_ipport_args->act_sport_net_order = seek_nat_key.sport_net_order; + + memcpy(&usable_active_ipport_args->gdev_args, &flwd_active_ip->gdev_args, sizeof(flwd_gdev_associated_args_t)); + + return ITERATE_CB_RET_BREAK_FLAG | ITERATE_CB_RET_REVERSE_FLAG; +} + +/* + NOTE: + Ϊ��ͬʱ��Ӧstatic_pool��dynamic_pool, ����һ������, + ��ͬ����static_poolΪһ��flwd_active_ip_t�ṹ������, ��Ҫ�ڴ˺�����ѭ������. +*/ +static int flwd_access_fetch_usable_ipport_by_ip_list_cb( + const uchar * key, uint size, void * data, void *user) +{ + int ret; + flwd_active_ip_t *flwd_active_ip_list_head = (flwd_active_ip_t *)data; + flwd_active_ip_t *tmp_node; + flwd_active_ip_port_args_t *usable_active_ipport_args = (flwd_active_ip_port_args_t *)user; + + tmp_node = flwd_active_ip_list_head; + do{ + ret = flwd_access_fetch_usable_ipport_by_single_ip(tmp_node, usable_active_ipport_args); + if(ITERATE_CB_RET_BREAK_FLAG == ret){ + break; + } + + tmp_node = (flwd_active_ip_t *)tmp_node->active_ip_list_node.nextele->quiddity; + }while(flwd_active_ip_list_head != tmp_node); + + return ret|ITERATE_CB_RET_REVERSE_FLAG /* ��item˳��, ÿ�����Ӹ�����ַ���ﲻͬ��IP */; +} + +/* + ����: ��ʵ�ͻ��˵���Ԫ��; + ���: ���õ�Դ��ԾIP; + + ����ֵ: + 1 : ���в�������, �����ҵ����ŵ�ǰ���ԵĿ���Դip; + 0 : ����; + -1 : �����˲���, ��û�п���IP; + + service_defined��ʽ: + "IR_STRATEGY:123" +*/ +static int flwd_access_snat_search_policy(int tid, + flwd_tuple5_t *tuple5, flwd_active_ip_port_args_t *usable_active_ipport_net_order) +{ + unsigned int usable_active_ip = 0; + int ret; + int found_usable_policy_ip = -1; + +#if FLWD_NO_ACTIVE_IP_DISCOVER + return 0; /* ��ʱ����, ���� */ +#else + unsigned int policy_id; + MESA_list_t *list_node; + flwd_active_ip_t *ip_static_pool_list_head, *list_node_item; + flwd_ip_region_type_t ip_pool_retion; + unsigned char static_ip_group_key[64]; + int static_ip_group_key_len = 64; + + policy_id = flwd_access_maat_scan_rule(tid, tuple5); + if(0 == policy_id){ + return 0; + } + + flwd_log(10, "tuple4 %s hit policy id:%u\n", flwd_tuple5_ntop(tid, tuple5), policy_id); + + /* ���õ�IPΪ��ǰĿ��IP�ķ��� */ + if(FLWD_IP_REGION_INLAND == usable_active_ipport_net_order->dip_region_type){ + ip_pool_retion = FLWD_IP_REGION_OUTLAND; + }else{ + ip_pool_retion = FLWD_IP_REGION_INLAND; + } + + flwd_policy_group_id_key_gen(policy_id, static_ip_group_key, &static_ip_group_key_len); + + ip_static_pool_list_head = flwd_ip_pool_search(FLWD_ACT_IP_STATIC, + flwd_thread_val[tid].flwd_ip_pool_static_htable[tuple5->addr_type][ip_pool_retion], + static_ip_group_key, + static_ip_group_key_len); + if(NULL == ip_static_pool_list_head){ + flwd_log(30, "tuple4 %s hit policy id:%u, but no valid ip in static ip_pool!\n", + flwd_tuple5_ntop(tid, tuple5), policy_id); + return 0; + } + + list_node = &ip_static_pool_list_head->active_ip_list_node; + do{ + list_node_item = (flwd_active_ip_t *)list_node->quiddity; + /* ����htable_cb����, �˴���key, size�ɲ��� */ + ret = flwd_access_fetch_usable_ipport_by_single_ip(list_node_item, usable_active_ipport_net_order); + if(ITERATE_CB_RET_BREAK_FLAG == ret){ + found_usable_policy_ip = 1; + break; + } + list_node = list_node->nextele; + }while(list_node != &ip_static_pool_list_head->active_ip_list_node); + +#endif + + return found_usable_policy_ip; +} + + +/* + �ӵ�ַ����, ���ѡ��һ�����û�ԾIP. + + TODO: + �����ͬ�ͻ���, ʹ���˲�ͬ����, ��ͬһ��ԴIP���ڲ�ͬ�ľ�̬��ַ����, + ������1.2.3.4��Ϊ����IP, �˿ڷ�Χ�ǰ�access_gateway�������ֵ�, + ����ͬһ��access_gateway, ������һ���Ķ˿�, ��ͻ��ô��? + ��ô�����ͻ����??!! + + �����ý��汣֤, һ��IP��ַֻ������һ����̬��ַ��. +*/ +static int flwd_access_snat_fetch_usable_ip_from_pool( + MESA_htable_handle table, pthread_rwlock_t *flwd_ip_pool_rwlock, int tid, + flwd_tuple5_t *nat_key, flwd_active_ip_port_args_t *usable_active_ipport_args) +{ + + pthread_rwlock_wrlock(flwd_ip_pool_rwlock); + + /* ����htable�İ�ʱ�����ȱ�������, ��ѡ���µ�IP, ����dip�ĵ���, ѡ���෴��Դ��Ծip */ + MESA_htable_iterate_bytime(table, + ITERATE_TYPE_NEWEST_FIRST, + flwd_access_fetch_usable_ipport_by_ip_list_cb, + usable_active_ipport_args); + + if((0 == usable_active_ipport_args->act_sip_net_order.addr_ipv4) + || (0 == memcmp(&usable_active_ipport_args->act_sip_net_order.addr_ipv6, + &flwd_global_val.zero_ipv6_addr, sizeof(struct in6_addr)))){ + pthread_rwlock_unlock(flwd_ip_pool_rwlock); + return -1; + } + + pthread_rwlock_unlock(flwd_ip_pool_rwlock); + return 0; +} + +#if FLWD_SUPPORT_DNAT +static void * flwd_search_access_dnat_lb_policy(int tid, + flwd_tuple4v4_t *nat_key, flwd_actual_ip_port_t *actual_ipport_net_order) +{ + /* ����dip, dport�ҵ���ʵ��������dip, dport, �滻�������ݰ�, Ȼ��洢��nat-htable */ + return 0; +} +#endif + + + +/* TODO: + ��ֹ������, �ǶԳ�·������, ����S2C�����������C2S������ͬһ̨ת������, + + Ҫ�����ӱ���ɢ��ȫ����ת������, + + ��Ԫ��, dip+dport+sip, ��Ԫ����̫����, + + sport����һ������ָ���㷨, ɨ����Ԫ������ж�sport. +*/ +static int flwd_link_table_broadcast(int tid, flwd_nat_info_t *nat_info) +{ + /* TODO: + ��ֹ������, �ǶԳ�·������, ����S2C�����������C2S������ͬһ̨ת������, + + Ҫ�����ӱ���ɢ��ȫ����ת������. + */ + return 0; +} + + +/* ��ָ����Ϣ�洢��Դ�˿ڵ��ض��ֶ�, ��������IR�İ�����ʵ�ͻ��˵İ� */ +static void flwd_pkt_signature_hide_to_sport( + unsigned short pkt_signature, flwd_nat_info_t *nat_info) +{ + unsigned short sport_host_order; + + pkt_signature &= (FLWD_UDP_SPORT_HASH_MASK >> 8); + + if(0 == nat_info->outer_nat_tuple5.dir_reverse){ + sport_host_order = ntohs(nat_info->outer_nat_tuple5.sport_net_order); + sport_host_order &= (~FLWD_UDP_SPORT_HASH_MASK); /* �����hash�ֶ� */ + sport_host_order |= (pkt_signature << 8); /* hash�ֶ�������sport�� */ + nat_info->outer_nat_tuple5.sport_net_order = htons(sport_host_order); + }else{ + sport_host_order = ntohs(nat_info->outer_nat_tuple5.dport_net_order); + sport_host_order &= (~FLWD_UDP_SPORT_HASH_MASK); /* �����hash�ֶ� */ + sport_host_order |= (pkt_signature << 8); /* hash�ֶ�������sport�� */ + nat_info->outer_nat_tuple5.dport_net_order = htons(sport_host_order); + } + + return; +} + + +/* + ѡ��Դ�˿���Ҫ��֤����ȥ���߳�id, ��Ӧ�������֮��, ���ܱ�����������ͬһ���߳�, + ������Ҫ���Զ��, �ҵ�һ�����ʵ�sport, ���ɷ��������ķ����㷨. + + ��Ϊdip, dport�Dz��ܱ��, sipҲ�����ѡ�����ܱ�, ֻ����Դ�˿�����һЩtrick, + ���Ҷ����ͬ��������֮��, �������صIJ�ͬ�߳�֮���Ѿ�Ԥ�ȷ����˶˿ڷ�Χ, + ����һ����ԾIP��˵, �˿������������trick�ķ�Χ��С, ����ȷ�Ⱥܵ�! + + ��ȡһ���²���: + 1,TCPЭ��, ʹ��SYN-ISNת������, ͨ��32bit��ISN����hash, ��Ϊָ��; + 2,DNSЭ��, ʹ��DNS-TRANSIDת������, ͨ��16bit��TRANSID��Ϊָ��, ��ͻ�ʱ�TCP_ISN���һЩ; + 3,����UDPЭ��, ѡ�����Ԫ��ʹ��maat_redisȫ����ɢ, ����Э����ܴ�����ʱ������װ���ʧ! +*/ +static int flwd_acc_user_generate_pkt_signature( + int tid, flwd_nat_info_t *nat_info, flwd_raw_pkt_t *raw_pkt) +{ + const flwd_ipv4_hdr_t *flwd_iphdr = (flwd_ipv4_hdr_t *)raw_pkt->inner_ip_layer_hdr; + const flwd_udp_hdr_t *flwd_udphdr; + const flwd_tcp_hdr_t *flwd_tcphdr; + int canot_convert_pro; + unsigned int hash_val; + unsigned short pkt_signature; + + if(FLWD_NAT_TYPE_SNAT != nat_info->nat_type){ + return 0; + } + + if(IPPROTO_TCP == flwd_iphdr->ip_p){ + flwd_tcphdr = (flwd_tcp_hdr_t *)((char *)flwd_iphdr + flwd_iphdr->ip_hl * 4); + assert(TH_SYN == flwd_tcphdr->th_flags); + canot_convert_pro = 0; + /* �˴�Ҫʹ��nat֮�����Ԫ��, ָ����Ϣ��Ҫ����ת������ʶ������internet�����ݰ� */ + hash_val = flwd_tuple5_hash(&nat_info->outer_nat_tuple5, 1); + /* + TODO: + ����TCPЭ��, ʹ�ö˿�HASH�����ʽ��ͻ�ʽϸ�, ������ISN�ķ�ʽ, + */ +#if 0 + nat_info->signature_param = (long long)hash_val - (long long)ntohl(flwd_tcphdr->th_seq); +#else + pkt_signature = hash_val % (FLWD_UDP_SPORT_HASH_MASK >> 8); +#endif + + }else if(IPPROTO_UDP == flwd_iphdr->ip_p){ + /* + TODO, + ����UDPЭ��, ���ö˿�HASH����, ��ͻ��Ҳ�ϸ�, ������redisȫ����ɢ��Ԫ�鹦��, + IP���ú���ʵ�ͻ��˷���ͬһ��������, ���Ҷ˿ڻ����ɳ�ͻ�ļ��ʼ�С. + */ + hash_val = flwd_tuple5_hash(&nat_info->outer_nat_tuple5, 1); + pkt_signature = hash_val % (FLWD_UDP_SPORT_HASH_MASK >> 8); + canot_convert_pro = 0; + }else{ + canot_convert_pro = 1; + } + + if(1 == canot_convert_pro){ + /* TODO: ��ͨUDPЭ�鿿redisʵʱ��ɢ��Ԫ��, ʶ��Ӧ��� */ + //flwd_link_table_broadcast(tid, nat_info); + }else{ + flwd_pkt_signature_hide_to_sport(pkt_signature, nat_info); + } + + return 0; +} + +static flwd_terminal_proto_t flwd_access_proto_identify(flwd_raw_pkt_t *raw_pkt) +{ + flwd_terminal_proto_t flwd_pro = FLWD_TERMINAL_IP_LAYER; + + /* + TODO: + ʶ��L2TP, PPTP���뷽ʽ�����ݰ�. + + ���߿�������ʽ�ս�VPN, תΪ��IP��, ��ͬ��IP�������. + */ + + return flwd_pro; +} + + + +/* �������شӿͻ��˷����հ�, ����ײ�ԭʼ���ݰ���ں��� */ +static int flwd_acc_user_pkt_input(flwd_device_handle_t *device_handle, + int tid, flwd_raw_pkt_t *raw_pkt) +{ + int ret; + + raw_pkt->terminal_proto = flwd_access_proto_identify(raw_pkt); + switch(raw_pkt->terminal_proto){ + case FLWD_TERMINAL_IP_LAYER: + flwd_access_kernal_pkt_input(device_handle, tid, raw_pkt); + break; + + case FLWD_TERMINAL_IP_L2TP: + /* TODO */ + assert(0); + break; + + case FLWD_TERMINAL_IP_PPTP: + /* TODO */ + assert(0); + break; + + default: + assert(0); + } + + return 0; +} + +/* + NAT��ַת��, + ����nat_info��, ����������Ԫ��, �滻���ݰ��е�IP�Ͷ˿�, + �����¼���У���. +*/ +static int flwd_nat_set_new_addr_v4(flwd_topology_t topo_mode, + flwd_nat_type_t nat_type, const flwd_nat_info_t *nat_info, flwd_ipv4_hdr_t *flwd_ip4hdr) +{ + flwd_tcp_hdr_t *flwd_tcp_hdr; + flwd_udp_hdr_t *flwd_udp_hdr; + const flwd_tuple5_t *after_nat_addr; + struct ltsm_result ltsm_res; + unsigned int *tobe_modify_ip; + unsigned short *tobe_modify_port; + unsigned char tcp_flags = 0; + + if(TOPO_ACC_LINK_USER == topo_mode){ + /* C2I����, ��outer�ĵ�ַ, �滻��ǰ����Դip��Դ�˿� */ + after_nat_addr = &nat_info->outer_nat_tuple5; + tobe_modify_ip = &flwd_ip4hdr->ip_src.s_addr; + if(IPPROTO_TCP == flwd_ip4hdr->ip_p){ + flwd_tcp_hdr = (flwd_tcp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + tcp_flags = flwd_tcp_hdr->th_flags; + tobe_modify_port = &flwd_tcp_hdr->th_sport; + }else{ + flwd_udp_hdr = (flwd_udp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + tobe_modify_port = &flwd_udp_hdr->uh_sport; + } + }else{ + /* I2C����, ��inner�ĵ�ַ, �滻��ǰ����Ŀ��ip��Ŀ��˿� */ + after_nat_addr = &nat_info->inner_nat_tuple5; + tobe_modify_ip = &flwd_ip4hdr->ip_dst.s_addr; + if(IPPROTO_TCP == flwd_ip4hdr->ip_p){ + flwd_tcp_hdr = (flwd_tcp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + tcp_flags = flwd_tcp_hdr->th_flags; + tobe_modify_port = &flwd_tcp_hdr->th_dport; + }else{ + flwd_udp_hdr = (flwd_udp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + tobe_modify_port = &flwd_udp_hdr->uh_dport; + } + } + + /* Ϊ��hashֻ����һ��, key�ĵ�ַ�洢���Ǹ���sip>dip�Ľ������, Ҫ���ݴ洢��key�ĵ�ַ����, ѡ��������ԭʼ��ַ */ + if(0 == after_nat_addr->dir_reverse){ + *tobe_modify_ip = after_nat_addr->ippair_v4.sip_net_order; + *tobe_modify_port = after_nat_addr->sport_net_order; + }else{ + *tobe_modify_ip = after_nat_addr->ippair_v4.dip_net_order; + *tobe_modify_port = after_nat_addr->dport_net_order; + } + + if(IPPROTO_TCP == flwd_ip4hdr->ip_p){ + flwd_sendpacket_do_checksum((char *)flwd_ip4hdr, + IPPROTO_TCP, + ntohs(flwd_ip4hdr->ip_len) - flwd_ip4hdr->ip_hl * 4); /* �Ӵ����ͷ����ʼ����ĩβ�ij��� */ + }else{ + flwd_sendpacket_do_checksum((char *)flwd_ip4hdr, + IPPROTO_UDP, + ntohs(flwd_ip4hdr->ip_len) - flwd_ip4hdr->ip_hl * 4); /* �Ӵ����ͷ����ʼ����ĩβ�ij��� */ + } + + flwd_sendpacket_do_checksum((char *)flwd_ip4hdr, + IPPROTO_IP, + sizeof(flwd_ipv4_hdr_t)); + +#if FLWD_USE_LTSM_FOR_QUICK_CLOSE + unsigned char dir; + if(tcp_flags != 0){ + if(FLWD_NAT_TYPE_SNAT == nat_info->nat_type){ + if(TOPO_ACC_LINK_USER == topo_mode){ + dir = LTSM_DIR_C2S; /* SNATģʽ, ��user���յ��Ŀ϶���client�˵İ� */ + }else{ + dir = LTSM_DIR_S2C; + } + }else{ + if(TOPO_ACC_LINK_USER == topo_mode){ + dir = LTSM_DIR_S2C; + }else{ + dir = LTSM_DIR_C2S; + } + } + + ltsm_res = ltsm_get_current_state(nat_info->ltsm_stat_handle, tcp_flags, dir); + } +#endif + + return (int)ltsm_res.fstate; +} + + +static int flwd_nat_set_new_addr_v6(flwd_topology_t topo_mode, + flwd_nat_type_t nat_type, const flwd_nat_info_t *nat_info,flwd_ipv6_hdr_t *flwd_ip6hdr) +{ + /* TODO, IPv6 NAT */ + return -1; +} + + +/* + ����֮ǰ�Ѿ��洢��ת����, ��natת�� + Ŀǰ���õIJ�����ֱ����ԭʼ����IP��ַ�Ͷ˿�, �������, ����ÿ�ζ�malloc/memcpy/free����. +*/ +static int flwd_do_nat(flwd_device_handle_t *device_handle, + flwd_nat_info_t *nat_info, flwd_raw_pkt_t *raw_pkt) +{ + int ret; + + if(FLWD_IP_ADDR_TYPE_V4 == nat_info->outer_nat_tuple5.addr_type){ + ret = flwd_nat_set_new_addr_v4(device_handle->io_para.topo_mode, + nat_info->nat_type, nat_info, + (flwd_ipv4_hdr_t *)raw_pkt->inner_ip_layer_hdr); + }else{ + ret = flwd_nat_set_new_addr_v6(device_handle->io_para.topo_mode, + nat_info->nat_type, nat_info, + (flwd_ipv6_hdr_t *)raw_pkt->inner_ip_layer_hdr); + } + + return ret; +} + +static void *flwd_nat_table_search(void) +{ + /* + ת���������к�, �ὫSNAT��DNAT���ʹ洢��vxlan��ij���ֶΣ� + + ����SNAT, C2S����Ĵ洢NAT�����Ԫ��, ��S2C����Ļ�����, �ٴβ���htable��ͬ��key�� �ָ�֮ǰ��ʵ�ͻ���IP��PORT����; + + ����DNAT, ��һ��SYN��ɨ��IP���ò��Ա�, �ҵ�һ�����õ�RIP��RPORT, Ȼ��Ҳ�洢��htable, + ����������������İ�, ֱ�Ӻ�SNAT�ɸ���һ��htable, ����һ�μ��ɡ� + */ + return 0; +} + + +static void * flwd_acc_to_fwd_pre_output(flwd_device_handle_t *rcv_device_handle, + flwd_device_handle_t *send_device_handle, int tid, flwd_nat_info_t *nat_info, + flwd_raw_pkt_t *raw_pkt, unsigned int out_opt) +{ + flwd_vxlan_hdr_t *outer_vxlan_hdr; + unsigned char *local_acc_gateway_mac = NULL ; + int ret; + flwd_ip_t ip_union; + char ip_str[64]; + flwd_eth_hdr_t *inner_eth_hdr; + + char *unsend_raw_data_ptr = rcv_device_handle->low_level_mbuff_mtod(raw_pkt->low_level_mbuff); + int unsend_raw_data_len = rcv_device_handle->low_level_mbuff_get_pkt_len(raw_pkt->low_level_mbuff); + void *send_mbuff = send_device_handle->low_level_mbuff_malloc(send_device_handle, tid, unsend_raw_data_len+FLWD_VXLAN_OUTER_PACKET_LEN); + char *send_buf_data_ptr; + + /* �����վ���Ļ�����copy�������;���Ļ�����, �����߲���ģʽ���ܲ�һ��, + ����accessʹ��Э��ջģʽ, ��forwardʹ��marsioģʽ, + mbuff����ֱ�Ӹ���, ������һ��malloc/memcpy/free�Ĺ���. + */ + send_device_handle->low_level_mbuff_data_append(send_mbuff, unsend_raw_data_ptr, unsend_raw_data_len); + + /* ָ����ǰ�ƶ�, Ԥ��vxlan���ռ� */ + send_buf_data_ptr = (char *)send_device_handle->low_level_mbuff_data_forward(send_mbuff, FLWD_VXLAN_OUTER_PACKET_LEN); + + /* ����ײ�vxlan��Ϣ, ���迼�Ƿ������, ��Ϊ�����ڲ���Ԫ��hash����, vxlan����ַ����·��Ѱַ���� */ + +#if FLWD_NO_ACTIVE_ARP_QUERY + local_acc_gateway_mac = send_device_handle->io_para.local_mac_addr; + unsigned char remote_fwd_gateway_mac[6] = {0x0c, 0xc4,0x7a,0x14,0x6f,0x5a}; /* 10.0.6.203 */ + flwd_sendpacket_build_ethernet(ETH_P_IP, local_acc_gateway_mac, remote_fwd_gateway_mac, send_buf_data_ptr); +#else + if(send_device_handle->io_para.cap_mode != CAP_MODEL_SOCKET){ /* ��socketģʽ����Ҫ����vxlan����ethernet�� */ + local_acc_gateway_mac = send_device_handle->io_para.local_mac_addr; + + ip_union.addr_type = FLWD_IP_ADDR_TYPE_V4; + ip_union.addr_ipv4 = nat_info->flwd_route_info.next_gateway_ip_net; + + if(memcmp(nat_info->flwd_route_info.next_gateway_mac, flwd_global_val.zero_mac_addr, 6) == 0){ + /* �˴�������MAC���浽nat_info, ����ÿ�ζ���arp�� */ + ret = flwd_arp_table_query(nat_info->tid, &ip_union, send_device_handle, nat_info->flwd_route_info.next_gateway_mac); + if(ret < 0){ + send_device_handle->low_level_mbuff_free(send_device_handle, tid, send_mbuff); + flwd_log(30, "arp query %s, but not found!\n", flwd_ipt_ntop_r(&ip_union, ip_str, 64)); + return NULL; + } + } + + /* ���ݻ�ԾIP�IJ���ʱ��gdevIP, ��ѯGDEV��MAC, ����ethernet header */ + unsigned char *remote_fwd_gateway_mac = nat_info->flwd_route_info.next_gateway_mac; + flwd_sendpacket_build_ethernet(ETH_P_IP, local_acc_gateway_mac, remote_fwd_gateway_mac, send_buf_data_ptr); + } + +#endif + + /* NOTE, ��ʹ��socketģʽ, ����Ҫ����ײ�vxlanԭʼ��, ��DIP, PORT���ܶ���һ��, ����Щֵ���Ƿ�װ�����ݰ���, ��dl_io_send�Ӱ���ȡ */ +#if FLWD_NO_GDEV_ENV + flwd_sendpacket_build_ipv4(unsend_raw_data_len + sizeof(flwd_udp_hdr_t) + sizeof(flwd_vxlan_hdr_t), /* �ڲ�ԭʼ�� + UDP��ͷ + vxlanͷ */ + 0, + 0x1234, + 0, + 64, + IPPROTO_UDP, + send_device_handle->io_para.device_ip_net_order, + nat_info->flwd_route_info.next_gateway_ip_net, + NULL, + 0, + (char *)send_buf_data_ptr + sizeof(flwd_eth_hdr_t)); +#else + flwd_sendpacket_build_ipv4(unsend_raw_data_len + sizeof(flwd_udp_hdr_t) + sizeof(flwd_vxlan_hdr_t), /* �ڲ�ԭʼ�� + UDP��ͷ + vxlanͷ */ + 0, + 0x1234, + 0, + 64, + IPPROTO_UDP, + 0x0100007F, /* ����socket */ + 0x0100007F, /* ����socket */ + NULL, + 0, + (char *)send_buf_data_ptr + sizeof(flwd_eth_hdr_t)); +#endif + + flwd_sendpacket_build_udp(unsend_raw_data_len + sizeof(flwd_vxlan_hdr_t), + htons(50000 + tid), /* TODO, �˴���sport�����ڲ��sport, �ڲ�sport��ȫ��ʶ��ij���������ص�, vxlan��sport�������� */ + htons(60000 + tid), + NULL, + 0, + send_buf_data_ptr + sizeof(flwd_eth_hdr_t) + sizeof(flwd_ipv4_hdr_t)); + + if(CAP_MODEL_SOCKET != send_device_handle->io_para.cap_mode){ /* socketģʽ�ײ���Э��ջ��װ, У�����Э��ջʵ�� */ + flwd_sendpacket_do_checksum((char *)send_buf_data_ptr + sizeof(flwd_eth_hdr_t), + IPPROTO_IP, + sizeof(flwd_ipv4_hdr_t)); + } + + outer_vxlan_hdr = (flwd_vxlan_hdr_t *)(send_buf_data_ptr + sizeof(flwd_eth_hdr_t) + sizeof(flwd_ipv4_hdr_t) + sizeof(flwd_udp_hdr_t)); + memset(outer_vxlan_hdr, 0, sizeof(flwd_vxlan_hdr_t)); + outer_vxlan_hdr->link_id = nat_info->flwd_route_info.gdev_args.link_id; + outer_vxlan_hdr->link_layer_type = 0; /* 0:ethernet; */ + outer_vxlan_hdr->dir = nat_info->flwd_route_info.gdev_args.this_ip_as_sip_route_dir; + if(FLWD_OUTOPT_FIRST_PKT == (out_opt & FLWD_OUTOPT_FIRST_PKT)){ + outer_vxlan_hdr->first_pkt_per_stream = 1; + } + + inner_eth_hdr = (flwd_eth_hdr_t *)(send_buf_data_ptr + sizeof(flwd_eth_hdr_t) + sizeof(flwd_ipv4_hdr_t) + sizeof(flwd_udp_hdr_t) + sizeof(flwd_vxlan_hdr_t)); + memcpy(inner_eth_hdr->h_source, nat_info->flwd_route_info.gdev_args.inner_raw_smac, 6); + memcpy(inner_eth_hdr->h_dest , nat_info->flwd_route_info.gdev_args.inner_raw_dmac, 6); + + if(FLWD_IP_ADDR_TYPE_V4 == nat_info->inner_nat_tuple5.addr_type){ + inner_eth_hdr->h_proto = htons(ETH_P_IP); + }else{ + inner_eth_hdr->h_proto = htons(ETH_P_IPV6); + } + + return send_mbuff; +} + +static void * flwd_acc_to_user_pre_output(flwd_device_handle_t *rcv_device_handle, + flwd_device_handle_t *send_device_handle, int tid, flwd_nat_info_t *nat_info, + flwd_raw_pkt_t *raw_pkt, unsigned int out_opt) +{ + flwd_vxlan_hdr_t *outer_vxlan_dr; + + const char *unsend_raw_data_ptr = raw_pkt->inner_pkt_data; /* ��ָ����flwd_acc_fwd_pkt_input()����, �Ѿ�ָ�����ڲ�ethernetͷ�� */ + int unsend_raw_data_len = raw_pkt->inner_pkt_len; + void *send_mbuff = send_device_handle->low_level_mbuff_malloc(send_device_handle, tid, unsend_raw_data_len + FLWD_VXLAN_OUTER_PACKET_LEN); + char *send_buf_data_ptr; + + /* �����վ���Ļ�����copy�������;���Ļ�����, �����߲���ģʽ���ܲ�һ��, ����ֱ�Ӹ���, ������һ��malloc/memcpy/free�Ĺ��� */ + send_buf_data_ptr = send_device_handle->low_level_mbuff_data_append(send_mbuff, unsend_raw_data_ptr, unsend_raw_data_len); + +#if FLWD_NO_ACTIVE_ARP_QUERY + /* û��ARP��̬��ѯ�Ĺ���ʱ, �ֹ����²����ն˵�mac */ + unsigned char *local_acc_gateway_mac = send_device_handle->io_para.local_mac_addr; + unsigned char *remote_user_mac = nat_info->flwd_route_info.inner_terminal_mac; + + flwd_sendpacket_build_ethernet(ETH_P_IP, local_acc_gateway_mac, remote_user_mac, send_buf_data_ptr); +#else + /* û��ARP��̬��ѯ�Ĺ���ʱ, �ֹ����²����ն˵�mac */ + unsigned char *local_acc_gateway_mac = send_device_handle->io_para.local_mac_addr; + unsigned char *remote_user_mac = nat_info->flwd_route_info.inner_terminal_mac; + + flwd_sendpacket_build_ethernet(ETH_P_IP, local_acc_gateway_mac, remote_user_mac, send_buf_data_ptr); +#endif + + return send_mbuff; +} + + +/* + TODO: + ��ϵͳ����������������ʵ��L2TP, PPTP��������, + ��Iptables ��ppp�������һ������ָ��(�ض���)��һ��tap�豸, + ����, tap�豸�Ķ�ȡ��(��������), ���ܿ��������ڲ���ip��, + �յ�ip�����acc-userһ���Ĵ�������. + + ����: + acc-userֻ��һ��io_handle, Ŀǰ��pcap, marsio, socket, ��tap, + ������pcap��tap�ľ�����Բ�һ��, + + �����ʽ: + 1, һ��Flowood_IO���(�ĸ�����, acc-user, acc-fwd, fwd-acc, fwd-gdev), �ɶ�Ӧ�������IO���, + ��acc-user�����IO�����������������IO���, ��������ͬ�Ľ��뷽ʽ: pcap, l2tp_tap, pptp_tap, + �����������Ľ����ij�; + + 2, ����Ǹ���һ������, ������������Ƕ��, ��ʵ�ʴ�һ����������; + ��acc-user, acc-fwd����һ���������ӵ�������, + Flowood���������, ��ʵ��������һ��, ��ʱӦ�ÿ���ͬ��IP��������, + ��һ���������IP��ַ, �����ݰ���dip�����ĸ���acc-user�İ�, �ĸ���acc-fwd�İ�. + +*/ + +static int flwd_access_output(flwd_device_handle_t *rcv_device_handle, int tid, + flwd_nat_info_t *nat_info, flwd_raw_pkt_t *raw_pkt, unsigned int out_opt) +{ + int ret; + flwd_device_handle_t *send_device_handle; + void *send_mbuff ; + const char *send_actual_ptr; + char debug_outer_tuple4[128]; + + /* + TODO, + + ACC��USERת������ʱ, �������ͨIPЭ��ջ, ����ͨ��low_level_io_send()ֱ�ӽ�������ȥ, + ���п��ܻ���PPTP����, ��ʱ�����ݰ������ڲ����һ����, ���PPP��װ��Ҫ��VPN�������, + ��Ҫע�����������, ������ͨ���ײ�IO�ӿ�ֱ�ӷ��ͳ�����. + + Ӧ�������ֵײ������ӿ�, ���pcap, marsio, socket��ϵͳ��ʽ, + ���ӿ�, ��һ������������IP, ��������������, + ������L2TP, PPTP������, ��ԭʼ�������յ�PPP�İ���, ���ջ�������ڲ�IP��, + + �������������һ�Զ�Ĺ�ϵ, ��ʹ����һ���ӿ�, Ҳ���������һ������, + flowood������������ͨ��, ����ֱ�Ӷ�������. + */ + + if(TOPO_ACC_LINK_USER == rcv_device_handle->io_para.topo_mode){ + send_device_handle = &flwd_global_val.global_io_handle[TOPO_ACC_LINK_FWD]; + send_mbuff = flwd_acc_to_fwd_pre_output(rcv_device_handle, send_device_handle, tid, nat_info, raw_pkt, out_opt); + if(NULL == send_mbuff){ + return -1; + } + ret = send_device_handle->low_level_send(send_device_handle, tid, send_mbuff); + if(ret < 0){ + send_actual_ptr = (char *)rcv_device_handle->low_level_mbuff_mtod(send_mbuff); + flwd_log(30, "ACC: send pkt to forward gateway error! inner_tuple4 is:%s, outer_tuple4 is:%s\n", + flwd_debug_print_tuple4_detail(send_actual_ptr+FLWD_VXLAN_OUTER_PACKET_LEN+sizeof(flwd_eth_hdr_t), tid), + flwd_debug_print_tuple4_detail_r(send_actual_ptr + sizeof(flwd_eth_hdr_t), debug_outer_tuple4, 128)); + }else{ + if(flwd_cfg_val.flwd_log_level <= 10){ + send_actual_ptr = (char *)rcv_device_handle->low_level_mbuff_mtod(send_mbuff); + flwd_log(10, "ACC: send pkt to forward gateway succ, inner_tuple4 is:%s, outer_tuple4 is:%s\n", + flwd_debug_print_tuple4_detail(send_actual_ptr+FLWD_VXLAN_OUTER_PACKET_LEN+sizeof(flwd_eth_hdr_t), tid), + flwd_debug_print_tuple4_detail_r(send_actual_ptr + sizeof(flwd_eth_hdr_t), debug_outer_tuple4, 128)); + } + } + + }else{ + send_device_handle = &flwd_global_val.global_io_handle[TOPO_ACC_LINK_USER]; + send_mbuff = flwd_acc_to_user_pre_output(rcv_device_handle, send_device_handle, tid, nat_info, raw_pkt, out_opt); + ret = send_device_handle->low_level_send(send_device_handle, tid, send_mbuff); + if(ret < 0){ + send_actual_ptr = (char *)rcv_device_handle->low_level_mbuff_mtod(send_mbuff); + flwd_log(30, "ACC: send pkt to user client error! tuple4 is:%s\n", + flwd_debug_print_tuple4_detail(send_actual_ptr+sizeof(flwd_eth_hdr_t), tid)); + }else{ + if(flwd_cfg_val.flwd_log_level <= 10){ + send_actual_ptr = (char *)rcv_device_handle->low_level_mbuff_mtod(send_mbuff); + flwd_log(10, "ACC: send pkt to user client succ! tuple4 is:%s\n", + flwd_debug_print_tuple4_detail(send_actual_ptr+sizeof(flwd_eth_hdr_t), tid)); + + } + } + } + + send_device_handle->low_level_mbuff_free_after_send(send_device_handle, tid, send_mbuff); + + return ret; +} + + +/* + ���ӽ�����, �ͷ�ռ�û�ԾIP��Դ�˿�. +*/ +static void flwd_sport_recycle(flwd_nat_info_t *nat_info) +{ + /* ����nat����, snat����outer->tuple5��sip, ����ʵ����ԴIP; + dnatû�ж��������Դ, ֻ�ǼĽ�virtual_dip:virtual_dport�ij���real_dip:real_dport. + */ + MESA_list_count_t *usable_sport_queue_head; + MESA_list_count_t *recycle_node; + unsigned char *ip_key; + unsigned int ip_key_size; + MESA_htable_handle act_ip_htable; + int tid = nat_info->tid; + const flwd_tuple5_t *recycle_tuple5; + unsigned short recycle_sport; + char ip_str[64]; + + if(FLWD_NAT_TYPE_DNAT == nat_info->nat_type){ + return; /* nothing to do */ + } + + if(FLWD_NAT_TYPE_SNAT == nat_info->nat_type){ + recycle_tuple5 = &nat_info->outer_nat_tuple5; + } + + if(flwd_likely(FLWD_IP_ADDR_TYPE_V4 == nat_info->inner_nat_tuple5.addr_type)){ + if(FLWD_ACT_IP_DYNAMIC == nat_info->act_ip_origin){ + act_ip_htable = flwd_thread_val[tid].flwd_ip_pool_dynamic_htable[FLWD_IP_ADDR_TYPE_V4][nat_info->act_ip_region]; + }else{ + act_ip_htable = flwd_thread_val[tid].flwd_ip_pool_static_htable[FLWD_IP_ADDR_TYPE_V4][nat_info->act_ip_region]; + } + + if(recycle_tuple5->dir_reverse){ + ip_key = (unsigned char *)&recycle_tuple5->ippair_v4.dip_net_order; + recycle_sport = recycle_tuple5->dport_net_order; + }else{ + ip_key = (unsigned char *)&recycle_tuple5->ippair_v4.sip_net_order; + recycle_sport = recycle_tuple5->sport_net_order; + } + ip_key_size = sizeof(int); + }else{ /* IPv6 */ + if(FLWD_ACT_IP_DYNAMIC == nat_info->act_ip_origin){ + act_ip_htable = flwd_thread_val[tid].flwd_ip_pool_dynamic_htable[FLWD_IP_ADDR_TYPE_V6][nat_info->act_ip_region]; + }else{ + act_ip_htable = flwd_thread_val[tid].flwd_ip_pool_static_htable[FLWD_IP_ADDR_TYPE_V6][nat_info->act_ip_region]; + } + + if(recycle_tuple5->dir_reverse){ + ip_key = (unsigned char *)&recycle_tuple5->ippair_v6->dip_net_order; + recycle_sport = recycle_tuple5->dport_net_order; + }else{ + ip_key = (unsigned char *)&recycle_tuple5->ippair_v6->sip_net_order; + recycle_sport = recycle_tuple5->sport_net_order; + } + ip_key_size = sizeof(struct in6_addr); + } + + if(sizeof(int) == ip_key_size){ + inet_ntop(AF_INET, ip_key, ip_str, 64); + }else{ + inet_ntop(AF_INET6, ip_key, ip_str, 64); + } + + pthread_rwlock_wrlock(&flwd_thread_val[tid].flwd_ip_pool_static_rwlock); + + flwd_active_ip_t *flwd_active_ip = (flwd_active_ip_t *)flwd_ip_pool_search(nat_info->act_ip_origin, act_ip_htable, ip_key, ip_key_size); + if(NULL == flwd_active_ip){ + /* NOTE: �������ڼ�˻�ԾIP�Ѿ���ʱ��maat_callback�Ƴ�, Ҳ�Ͳ��ػ��ն˿�, ֱ�ӷ��ؼ��� */ + flwd_log(20, "ACC:sport %u recycle, but active ip:%s is not exist!\n", recycle_sport, ip_str); + goto done; + } + + if(IPPROTO_TCP == nat_info->inner_nat_tuple5.protocol){ /* TCP, UDP������ */ + usable_sport_queue_head = &flwd_active_ip->usable_tcp_sport_list_head; + }else{ + usable_sport_queue_head = &flwd_active_ip->usable_udp_sport_list_head; + } + + /* NOTE: ȡ���ö˿�ʱ�ֳ�free��MESA_list_count_t�����ṹ, �˴�Ҳ���ֳ�malloc */ + recycle_node = (MESA_list_count_t *)malloc(sizeof(MESA_list_count_t)); + memcpy(&recycle_node->quiddity, &recycle_sport, sizeof(short)); + /* �˴�ʹ��MESA_list_count_add_tail, ����head->pre, ���ʹ�� */ + MESA_list_count_add_tail(usable_sport_queue_head, recycle_node); + +done: + pthread_rwlock_unlock(&flwd_thread_val[tid].flwd_ip_pool_static_rwlock); + + flwd_log(10, "ACC:sport recycle, active_ip:%s, port:%u\n", ip_str, recycle_sport); + + return; +} + + +static void flwd_access_nat_htable_data_free(void *data) +{ + flwd_nat_info_t *nat_info = (flwd_nat_info_t *)data; + + if(--nat_info->reference > 0){ + /* ����key����ͬһ��nat_info, ɾ��ʱ����double free, ����reference���� */ + return; + } + + flwd_sport_recycle(nat_info); + + if(FLWD_IP_ADDR_TYPE_V6 == nat_info->inner_nat_tuple5.addr_type ){ + flwd_free(nat_info->tid, nat_info->inner_nat_tuple5.ippair_v6); + } + + if(FLWD_IP_ADDR_TYPE_V6 == nat_info->outer_nat_tuple5.addr_type ){ + flwd_free(nat_info->tid, nat_info->outer_nat_tuple5.ippair_v6); + } + +#if FLWD_USE_LTSM_FOR_QUICK_CLOSE + ltsm_destroy_handle(nat_info->ltsm_stat_handle); +#endif + + flwd_free(nat_info->tid, data); +} + +static int flwd_access_nat_htable_data_expire_notify( + void *data, int eliminate_type) +{ + char str_tmp[256]; + flwd_nat_info_t *nat_info = (flwd_nat_info_t *)data; + + if(1 == nat_info->reference){ /* ��Ϊͬʱ������key����, ֻ���һ�μ�¼��־, �����д����һ������־ */ + flwd_log(10, "pre-nat-tuple4 %s expire!\n", + flwd_tuple5_ntop_r(&nat_info->inner_nat_tuple5, str_tmp, 256)); + } + + return 1; +} + + + +/* + natת����������, ��һ�δ���nat_infoʱ������, + �洢·��ת�������Ϣ, ����ÿ��ת��ʱ����ѯһ��. +*/ +static int flwd_save_session_route_info(flwd_nat_info_t *nat_info, + flwd_raw_pkt_t *raw_pkt, flwd_active_ip_port_args_t *usable_active_ipport_args) +{ + const flwd_eth_hdr_t *ehdr = (flwd_eth_hdr_t *)raw_pkt->outer_pkt_data; + int ret; + + if(FLWD_NAT_TYPE_SNAT == nat_info->nat_type){ + /* user�ն˵�MAC���ò�ѯ, ֱ��ʹ�õ�ǰ������mac�洢�������� */ + memcpy(nat_info->flwd_route_info.inner_terminal_mac, ehdr->h_source, ETH_ALEN); + /* + TODO: + ��εõ���һ��ת�����ص�IP, ��ת������IP? + ������ͬһ���ֵ�������豸������ͨ��, ��ѡһ���Ϳ���, + ��������ɵ�����, + �����֪��GDEV�ķ����㷨�����. + */ +#if 0 + nat_info->flwd_route_info.next_gateway_ip_net = flwd_search_fwd_ip_by_gdev_ip(usable_active_ipport_args->gdev_args.gdev_ip_net_order); +#else + /* TODO, ��̨����, ��д��, ʹ�ñ��ػػ� */ + inet_pton(AF_INET, "127.0.0.1", &nat_info->flwd_route_info.next_gateway_ip_net); +#endif + + memcpy(&nat_info->flwd_route_info.gdev_args, + &usable_active_ipport_args->gdev_args, + sizeof(flwd_gdev_associated_args_t)); + }else{ + /* TODO, DNAT */ + abort(); + } + + return 0; +} + + +/* + NOTE: + + HASH����ʱ, + ��ΪSNAT->C2S����, SNAT->S2C����, DNAT->C2S����, DNAT->S2C����, + ��������ĵ�ַ��ͬ, + ����, ����һ�����ӵ��ڲ���ַ���ⲿ��ַ��˵, Ҫ��������key, ָ��ͬһ��nat_info. + + hash����ʱ, ����ͬһ��nat_info, ʹ��������ͬ��key����. + + ����: + 192.168.10.100:12345->8.8.8.8:53����һ��DNS��ѯ, + ��NAT���غ�����: + 202.43.148.189:34567->8.8.8.8:53, + + Ҫ������������ͬ����Ԫ��ֱ���Ϊkey, �����ҵ�ͬһ��htable���data, ��nat_info. +*/ +static int flwd_new_nat_session_sotre(int tid, flwd_nat_info_t *nat_info) +{ + int ret; + char inner_str[256], outer_str[256]; + + ret = MESA_htable_add(flwd_thread_val[tid].nat_info_table, + (unsigned char *)&nat_info->inner_nat_tuple5, + sizeof(flwd_tuple5_t), + nat_info); + if(ret < 0){ + flwd_log(30, "save nat session error, %s!\n", + flwd_tuple5_ntop_r(&nat_info->inner_nat_tuple5, inner_str, 256)); + nat_info->reference = 1; + flwd_access_nat_htable_data_free(nat_info); + return -1; + } + nat_info->reference++; + + ret = MESA_htable_add(flwd_thread_val[tid].nat_info_table, + (unsigned char *)&nat_info->outer_nat_tuple5, + sizeof(flwd_tuple5_t), + nat_info); + if(ret < 0){ + nat_info->reference = 1; + flwd_log(30, "save nat session error, %s!\n", + flwd_tuple5_ntop_r(&nat_info->outer_nat_tuple5, outer_str, 256)); + /* NOTE: ����ʧ��, �˴�Ҫʹ��inner��key, ��Ϊouter����ʧ�� */ + MESA_htable_del(flwd_thread_val[tid].nat_info_table, + (unsigned char *)&nat_info->inner_nat_tuple5, + sizeof(flwd_tuple5_t), + NULL); + return -1; + } + nat_info->reference++; + + return 0; +} + + +static inline flwd_nat_info_t *flwd_create_new_nat_info_v4(int tid, + flwd_nat_type_t nat_type, flwd_tuple5_t *inner_nat_key, + flwd_active_ip_port_args_t *usable_active_ipport_args, flwd_raw_pkt_t *raw_pkt) +{ + flwd_nat_info_t *nat_info = (flwd_nat_info_t *)flwd_calloc(tid, 1, sizeof(flwd_nat_info_t)); + flwd_tuple5_t *opposite_tuple5; + int differ; + unsigned int outer_actual_dip_net_order; /* �ͻ���ȥ����ʵ��Ŀ��IP, inner��outer��һ����, ����key�Ĵ洢λ��, ��sip,dip�Ĵ�С��ϵ���ܲ�һ�� */ + unsigned int outer_actual_dport_net_order; /* �ͻ���ȥ����ʵ��Ŀ��˿�, inner��outer��һ����, ����key�Ĵ洢λ��, ��sip,dip�Ĵ�С��ϵ���ܲ�һ�� */ + + nat_info->tid = tid; /* ��Ҫ����htable�ص������ڲ���tid�������� */ + nat_info->nat_type = nat_type; + + if(FLWD_NAT_TYPE_SNAT == nat_type){ + /************************** ���� inner tuple5 **************************/ + memcpy(&nat_info->inner_nat_tuple5, inner_nat_key, sizeof(flwd_tuple5_t)); /* snat��inner tuple5ֱ��copy */ + + + /*************************** ����outer tuple5 **************************/ + opposite_tuple5 = &nat_info->outer_nat_tuple5; + + if(inner_nat_key->dir_reverse){ + outer_actual_dip_net_order = inner_nat_key->ippair_v4.sip_net_order; + outer_actual_dport_net_order = inner_nat_key->sport_net_order; + }else{ + outer_actual_dip_net_order = inner_nat_key->ippair_v4.dip_net_order; + outer_actual_dport_net_order = inner_nat_key->dport_net_order; + } + + /* NOTE: �������������Ƚϴ�С, һ��Ҫֱ�ӱȽ�, ������ c = a - b; if(c < 0)�ķ�ʽ!!! */ + if(usable_active_ipport_args->act_sip_net_order.addr_ipv4 > outer_actual_dip_net_order){ + /* �ⲿ��ַ����ʵԴIP�Ǹ�ѡ��Ļ�ԾIP, ��ʵĿ��IP���ǵ�ǰinner_key��Ŀ��ip */ + opposite_tuple5->ippair_v4.sip_net_order = usable_active_ipport_args->act_sip_net_order.addr_ipv4; + opposite_tuple5->ippair_v4.dip_net_order = outer_actual_dip_net_order; + opposite_tuple5->sport_net_order = usable_active_ipport_args->act_sport_net_order; + opposite_tuple5->dport_net_order = outer_actual_dport_net_order; + + opposite_tuple5->dir_reverse = 0; /* �洢��key����ʵ��Ԫ���ַ��һ���� */ + }else if(usable_active_ipport_args->act_sip_net_order.addr_ipv4 < outer_actual_dip_net_order){ + opposite_tuple5->ippair_v4.sip_net_order = outer_actual_dip_net_order; + opposite_tuple5->ippair_v4.dip_net_order = usable_active_ipport_args->act_sip_net_order.addr_ipv4; + opposite_tuple5->sport_net_order = outer_actual_dport_net_order; + opposite_tuple5->dport_net_order = usable_active_ipport_args->act_sport_net_order; + + opposite_tuple5->dir_reverse = 1; /* �洢��key����ʵ��Ԫ���ַ���෴�� */ + }else{ + /* inner��outer��IP��ַ��ͬ, ��������IP����ϵͳ���Dz����ܵ�!!! */ + abort(); + } + + opposite_tuple5->addr_type = inner_nat_key->addr_type; /* TODO, Ԥ��6to4��ַת������?? */ + opposite_tuple5->protocol = inner_nat_key->protocol; + + /* TODO, ����ѡ��Ļ�ԾIP, �������, ȷ��Ӧ�ô��ĸ�FWD���� */ + ////nat_info->next_hop_ip_net_order = flwd_search_fwd_ip_by_gdev_ip(usable_active_ipport_args->related_gdev_ip_net_order); + }else{ +#if FLWD_SUPPORT_DNAT + /* TODO, + DNATֻ����滻dip, dport����, ���ÿ�����ô��ѡ�˿�, �˿ڸ�������, + ��Ϊ����һ���������, ��ʵԴIP,Դport�Ѿ�������������Э��ջ��֤��ͻ��. + */ + assert(0); +#endif + } + + flwd_save_session_route_info(nat_info, raw_pkt, usable_active_ipport_args); + + return nat_info; +} + + +static inline flwd_nat_info_t *flwd_create_new_nat_info_v6(int tid, + flwd_nat_type_t nat_type, flwd_tuple5_t *inner_tuple5_v6, + flwd_active_ip_port_args_t *usable_active_ipport_args, flwd_raw_pkt_t *raw_pkt) +{ + flwd_nat_info_t *nat_info = (flwd_nat_info_t *)flwd_calloc(tid, 1, sizeof(flwd_nat_info_t)); + flwd_tuple5_t *opposite_tuple5; + int differ; + struct in6_addr outer_actual_dip_net_order; /* �ͻ���ȥ����ʵ��Ŀ��IP, inner��outer��һ����, ����key�Ĵ洢λ��, ��sip,dip�Ĵ�С��ϵ���ܲ�һ�� */ + unsigned int outer_actual_dport_net_order; /* �ͻ���ȥ����ʵ��Ŀ��˿�, inner��outer��һ����, ����key�Ĵ洢λ��, ��sip,dip�Ĵ�С��ϵ���ܲ�һ�� */ + + nat_info->tid = tid; /* ��Ҫ����htable�ص������ڲ���tid�������� */ + nat_info->nat_type = nat_type; + + nat_info->inner_nat_tuple5.ippair_v6 = (flwd_ippair_v6_t *)flwd_malloc(tid, sizeof(flwd_ippair_v6_t)); + nat_info->outer_nat_tuple5.ippair_v6 = (flwd_ippair_v6_t *)flwd_malloc(tid, sizeof(flwd_ippair_v6_t)); + + if(FLWD_NAT_TYPE_SNAT == nat_type){ + /********* ���� inner tuple5 ******/ + memcpy(&nat_info->inner_nat_tuple5, inner_tuple5_v6, sizeof(flwd_tuple5_t)); /* snat��inner tuple5ֱ��copy */ + memcpy(nat_info->inner_nat_tuple5.ippair_v6, inner_tuple5_v6->ippair_v6, sizeof(flwd_ippair_v6_t)); + + opposite_tuple5 = &nat_info->outer_nat_tuple5; + /********* ����outer tuple5 ******/ + + if(inner_tuple5_v6->dir_reverse){ + outer_actual_dip_net_order = inner_tuple5_v6->ippair_v6->sip_net_order; + outer_actual_dport_net_order = inner_tuple5_v6->sport_net_order; + }else{ + outer_actual_dip_net_order = inner_tuple5_v6->ippair_v6->dip_net_order; + outer_actual_dport_net_order = inner_tuple5_v6->dport_net_order; + } + + differ = memcmp(&usable_active_ipport_args->act_sip_net_order.addr_ipv6, &outer_actual_dip_net_order, sizeof(struct in6_addr)) ; + if(differ > 0){ /* �ⲿ��ַ����ʵԴIP�Ǹ�ѡ��Ļ�ԾIP, ��ʵĿ��IP���ǵ�ǰinner_key��Ŀ��ip */ + memcpy(&opposite_tuple5->ippair_v6->sip_net_order, &usable_active_ipport_args->act_sip_net_order.addr_ipv6, sizeof(struct in6_addr)); + memcpy(&opposite_tuple5->ippair_v6->dip_net_order, &outer_actual_dip_net_order, sizeof(struct in6_addr)); + opposite_tuple5->sport_net_order = usable_active_ipport_args->act_sport_net_order; + opposite_tuple5->dport_net_order = outer_actual_dport_net_order; + + opposite_tuple5->dir_reverse = 0; /* �洢��key����ʵ��Ԫ���ַ��һ���� */ + }else if(differ < 0){ + memcpy(&opposite_tuple5->ippair_v6->sip_net_order, &outer_actual_dip_net_order, sizeof(struct in6_addr)); + memcpy(&opposite_tuple5->ippair_v6->dip_net_order, &usable_active_ipport_args->act_sip_net_order.addr_ipv6, sizeof(struct in6_addr)); + opposite_tuple5->sport_net_order = outer_actual_dport_net_order; + opposite_tuple5->dport_net_order = usable_active_ipport_args->act_sport_net_order; + + opposite_tuple5->dir_reverse = 1; /* �洢��key����ʵ��Ԫ���ַ���෴�� */ + }else{ + /* inner��outer��IP��ַ��ͬ, ��������flowoodϵͳ���Dz����ܵ�!!! */ + abort(); + } + + opposite_tuple5->addr_type = inner_tuple5_v6->addr_type; /* TODO, Ԥ��6to4��ַת������, �ⲿ��ַ�����Ǹ��ݲ��Եõ�, ��һ���ǹ̶���ipv4תipv4 */ + opposite_tuple5->protocol = inner_tuple5_v6->protocol; + + ////nat_info->next_hop_ip_net_order = flwd_search_fwd_ip_by_gdev_ip(usable_active_ipport_args->related_gdev_ip_net_order); /* TODO, ����ѡ��Ļ�ԾIP, �������, ȷ��Ӧ�ô��ĸ�FWD���� */ + + }else{ +#if FLWD_SUPPORT_DNAT + assert(0); +#endif + } + + flwd_save_session_route_info(nat_info, raw_pkt, usable_active_ipport_args); + + return nat_info; +} + + + +static flwd_nat_info_t *flwd_create_new_nat_info(int tid, + flwd_nat_type_t nat_type, flwd_tuple5_t *inner_nat_key, + flwd_active_ip_port_args_t *usable_active_ipport_args, flwd_raw_pkt_t *raw_pkt) +{ + flwd_nat_info_t *nat_info; + + if(flwd_likely(FLWD_IP_ADDR_TYPE_V4 == inner_nat_key->addr_type)){ + nat_info = flwd_create_new_nat_info_v4(tid, nat_type, inner_nat_key, + usable_active_ipport_args, raw_pkt); + }else{ + nat_info = flwd_create_new_nat_info_v6(tid, nat_type, inner_nat_key, + usable_active_ipport_args, raw_pkt); + } + + if(FLWD_IP_REGION_INLAND == usable_active_ipport_args->dip_region_type){ + nat_info->act_ip_region = FLWD_IP_REGION_OUTLAND; + }else{ + nat_info->act_ip_region = FLWD_IP_REGION_INLAND; + } + + nat_info->nat_type = nat_type; + +#if FLWD_USE_LTSM_FOR_QUICK_CLOSE + nat_info->ltsm_stat_handle = ltsm_create_handle(); +#endif + return nat_info; +} + + + +static flwd_nat_info_t * flwd_new_nat_session(flwd_device_handle_t *device_handle, + int tid, flwd_tuple5_t *nat_key, flwd_raw_pkt_t *raw_pkt) +{ + int ret; + flwd_nat_info_t *nat_info = NULL; + flwd_active_ip_port_args_t usable_active_ipport_args; + flwd_actual_ip_port_t actual_ipport_net_order; + + memset(&usable_active_ipport_args, 0, sizeof(flwd_active_ip_port_args_t)); + + usable_active_ipport_args.dip_region_type = flwd_dstip_location(nat_key); /* �鿴Ŀ��IP��������λ�� */ + usable_active_ipport_args.tid = tid; + usable_active_ipport_args.nat_key = nat_key; + usable_active_ipport_args.protocol = nat_key->protocol; + + if(TOPO_ACC_LINK_USER == device_handle->io_para.topo_mode){ + /* ACC_LINK�ӿ�, NATת����������, �϶���SNAT���װ�, �Ȳ���NAT���ò��� */ + ret = flwd_access_snat_search_policy(tid, nat_key, &usable_active_ipport_args); + if(0 == ret){ + /* ����, ��dynamic-ip-pool�������ѡһ��IP */ + ret = flwd_access_snat_fetch_usable_ip_from_pool(flwd_thread_val[tid].flwd_ip_pool_dynamic_htable[nat_key->addr_type][(int)usable_active_ipport_args.dip_region_type ^ 1], + &flwd_thread_val[tid].flwd_ip_pool_dynamic_rwlock, + tid, nat_key, &usable_active_ipport_args); + if(ret < 0){ + flwd_log(RLOG_LV_INFO, "tuple4 %s not hit any policy, but no according usable active ip in %s dynamic pool !\n", + flwd_tuple5_ntop(tid, nat_key), + flwd_ip_region_ntop((int)usable_active_ipport_args.dip_region_type ^ 1)); + + if(flwd_cfg_val.use_static_pool_ip_if_no_dynamic != 0){ + ret = flwd_access_snat_fetch_usable_ip_from_pool(flwd_thread_val[tid].flwd_ip_pool_static_htable[nat_key->addr_type][(int)usable_active_ipport_args.dip_region_type ^ 1], + &flwd_thread_val[tid].flwd_ip_pool_static_rwlock, + tid, nat_key, &usable_active_ipport_args); + if(ret < 0){ + flwd_log(RLOG_LV_FATAL, "tuple4 %s not hit any policy, but no according usable ip in all %s static and dynamic pool!\n", + flwd_tuple5_ntop(tid, nat_key), + flwd_ip_region_ntop((int)usable_active_ipport_args.dip_region_type ^ 1)); + return NULL; + } + }else{ + flwd_log(RLOG_LV_FATAL, "tuple4 %s not hit any policy, but no according usable active ip in %s dynamic pool, unfortunately 'use_static_pool_ip_if_no_dynamic' is disable!\n", + flwd_tuple5_ntop(tid, nat_key), + flwd_ip_region_ntop((int)usable_active_ipport_args.dip_region_type ^ 1)); + return NULL; + } + } + }else if(-1 == ret){ + if(flwd_cfg_val.use_dynamic_pool_ip_if_no_static != 0){ + ret = flwd_access_snat_fetch_usable_ip_from_pool(flwd_thread_val[tid].flwd_ip_pool_static_htable[nat_key->addr_type][(int)usable_active_ipport_args.dip_region_type ^ 1], + &flwd_thread_val[tid].flwd_ip_pool_static_rwlock, + tid, nat_key, &usable_active_ipport_args); + if(ret < 0){ + flwd_log(RLOG_LV_FATAL, "tuple4 %s hit policy, but no according usable ip in all %s static and dynamic pool!\n", + flwd_tuple5_ntop(tid, nat_key), + flwd_ip_region_ntop((int)usable_active_ipport_args.dip_region_type ^ 1)); + return NULL; + } + }else{ + flwd_log(RLOG_LV_FATAL, "tuple4 %s hit policy, but no according usable ip in %s static pool, unfortunately 'use_dynamic_pool_ip_if_no_static' is disable!\n", + flwd_tuple5_ntop(tid, nat_key), + flwd_ip_region_ntop((int)usable_active_ipport_args.dip_region_type ^ 1)); + return NULL; + } + } + + nat_info = flwd_create_new_nat_info(tid, FLWD_NAT_TYPE_SNAT, nat_key, + &usable_active_ipport_args, raw_pkt); + + flwd_log(RLOG_LV_DEBUG, "---before signature, tuple4:%s", + flwd_tuple5_ntop(tid, &nat_info->outer_nat_tuple5)); + flwd_acc_user_generate_pkt_signature(tid, nat_info, raw_pkt); + flwd_log(RLOG_LV_DEBUG, "---after signature, tuple4:%s", + flwd_tuple5_ntop(tid, &nat_info->outer_nat_tuple5)); + + }else if(TOPO_ACC_LINK_FWD == device_handle->io_para.topo_mode){ + /* FWD���������װ�, ˵����DNAT��һ����, ���ݸ��ؾ�����Բ���������ʵ������IP�Ͷ˿� */ +#if FLWD_SUPPORT_DNAT + flwd_search_access_dnat_lb_policy(tid, nat_key, &actual_ipport_net_order); + + nat_info = flwd_create_new_nat_info(tid, FLWD_NAT_TYPE_DNAT, nat_key, + &usable_active_ipport_args, raw_pkt); +#endif + } + + if(NULL == nat_info){ +#if FLWD_SUPPORT_DNAT + assert(0); +#endif + return NULL; + } + + if(flwd_new_nat_session_sotre(tid, nat_info) < 0){ + return NULL; + } + + char inner_tuple5_str[256]; + char outer_tuple5_str[256]; + + flwd_log(10, "ACC: create new nat session, inner_tuple4:%s, outer_tuple4:%s\n", + flwd_tuple5_ntop_r(&nat_info->inner_nat_tuple5, inner_tuple5_str, 256), + flwd_tuple5_ntop_r(&nat_info->outer_nat_tuple5, outer_tuple5_str, 256)); + + return nat_info; +} + +/* + access����user�հ�, ���nat��������, Ҫ��֤�Ϸ����װ�, + ������TCP->SYN, ������UDP��. + + return value: + 0 : valid; + -1: invalid; +*/ +static int flwd_acc_user_first_pkt_verify(const char *raw_eth_data) +{ + const flwd_eth_hdr_t *flwd_ethhdr = (flwd_eth_hdr_t *)raw_eth_data; + const flwd_ipv4_hdr_t *flwd_ip4hdr; + const flwd_ipv6_hdr_t *flwd_ip6hdr; + unsigned short eth_type = ntohs(flwd_ethhdr->h_proto); + const flwd_tcp_hdr_t *flwd_tcphdr; + int ret = 0; + + if(ETH_P_IP == eth_type){ + flwd_ip4hdr = (flwd_ipv4_hdr_t *)((char *)flwd_ethhdr + sizeof(flwd_eth_hdr_t)); + if(IPPROTO_TCP == flwd_ip4hdr->ip_p){ + flwd_tcphdr = (flwd_tcp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + if(TH_SYN == flwd_tcphdr->th_flags){ + ret = 0; + }else{ + ret = -1; + } + }else if(IPPROTO_UDP == flwd_ip4hdr->ip_p){ + ret = 0; + } + }else if(ETH_P_IPV6 == eth_type){ + flwd_ip6hdr = (flwd_ipv6_hdr_t *)((char *)flwd_ethhdr + sizeof(flwd_eth_hdr_t)); + if(IPPROTO_TCP == flwd_ip6hdr->ip6_nxt_hdr){ + flwd_tcphdr = (flwd_tcp_hdr_t *)((char *)flwd_ip6hdr + sizeof(flwd_ipv6_hdr_t)); + if(TH_SYN == flwd_tcphdr->th_flags){ + ret = 0; + }else{ + ret = -1; + } + }else if(IPPROTO_UDP == flwd_ip4hdr->ip_p){ + ret = 0; + } + }else{ + assert(0); + } + + return ret; +} + +/* + access���ش�fwd�����հ�, ���nat��������, Ҫ��֤�Ϸ����װ�, + ������IP���ò���DNAT�е�ip,port; + ͬʱ��������TCP->SYN, ������UDP��. + + �����SNAT, �϶�Ӧ�����ҵ�nat����֮ǰ�洢��Ԫ��. + + return value: + 0 : valid; + -1: invalid; +*/ +static int flwd_acc_fwd_first_pkt_verify(char *inner_mac_hdr) +{ + const flwd_eth_hdr_t *flwd_ethhdr = (flwd_eth_hdr_t *)inner_mac_hdr; + const flwd_ipv4_hdr_t *flwd_ip4hdr; + const flwd_ipv6_hdr_t *flwd_ip6hdr; + unsigned short eth_type = ntohs(flwd_ethhdr->h_proto); + const flwd_tcp_hdr_t *flwd_tcphdr; + int ret = 0; + + if(ETH_P_IP == eth_type){ + flwd_ip4hdr = (flwd_ipv4_hdr_t *)((char *)flwd_ethhdr + sizeof(flwd_eth_hdr_t)); + if(IPPROTO_TCP == flwd_ip4hdr->ip_p){ + flwd_tcphdr = (flwd_tcp_hdr_t *)((char *)flwd_ip4hdr + flwd_ip4hdr->ip_hl * 4); + if(TH_SYN == flwd_tcphdr->th_flags){ /* ����DNAT��˵ */ + ret = 0; + }if((TH_SYN|TH_ACK) == flwd_tcphdr->th_flags){ /* ����SNAT��˵ */ + ret = 0; + }else{ + ret = -1; + } + }else if(IPPROTO_UDP == flwd_ip4hdr->ip_p){ + ret = 0; + } + }else if(ETH_P_IPV6 == eth_type){ + flwd_ip6hdr = (flwd_ipv6_hdr_t *)((char *)flwd_ethhdr + sizeof(flwd_eth_hdr_t)); + if(IPPROTO_TCP == flwd_ip6hdr->ip6_nxt_hdr){ /* TODO, IPv6���п��ܰ�������ͷ��, ��ʵ��Ӧ����ôֱ��ȡnext_hdr */ + flwd_tcphdr = (flwd_tcp_hdr_t *)((char *)flwd_ip6hdr + sizeof(flwd_ipv6_hdr_t)); + if(TH_SYN == flwd_tcphdr->th_flags){ /* ����DNAT��˵ */ + ret = 0; + }if((TH_SYN|TH_ACK) == flwd_tcphdr->th_flags){ /* ����SNAT��˵ */ + ret = 0; + }else{ + ret = -1; + } + }else if(IPPROTO_UDP == flwd_ip4hdr->ip_p){ + ret = 0; + } + }else{ + assert(0); + } + + return ret; +} + +/* �ͻ��˽��뷽��IP��, ���߰�ȥ������(��L2TP, PPTP������װ)����ʵ�ͻ����ڲ����ݰ���ں��� */ +int flwd_access_kernal_pkt_input(flwd_device_handle_t *device_handle, + int tid, flwd_raw_pkt_t *raw_pkt) +{ + void *ip_strategy; + flwd_nat_info_t *nat_info; + char nat_key_buf[sizeof(flwd_tuple4v6_t)]; /* v4, v6����, ʹ��v6�ռ����� */ + flwd_tuple5_t nat_key; + unsigned char dir_reverse; + int ret; + int ltsm_stat; + unsigned int out_opt = 0; + + ret = flwd_build_tuple4_key(tid, &nat_key, raw_pkt); + if(ret < 0){ + return -1; + } + + nat_info = (flwd_nat_info_t *)MESA_htable_search(flwd_thread_val[tid].nat_info_table, + (const uchar *)&nat_key, sizeof(flwd_tuple5_t)); + if(NULL == nat_info){ + if((TOPO_ACC_LINK_USER == device_handle->io_para.topo_mode) + && (flwd_acc_user_first_pkt_verify(raw_pkt->outer_pkt_data) < 0)){ + return -1; + }else if((TOPO_ACC_LINK_FWD == device_handle->io_para.topo_mode) + && (flwd_acc_fwd_first_pkt_verify(raw_pkt->inner_pkt_data) < 0)){ + return -1; + } + + nat_info = flwd_new_nat_session(device_handle, tid, &nat_key, raw_pkt); + if(NULL == nat_info){ + if(TOPO_ACC_LINK_FWD == device_handle->io_para.topo_mode){ + flwd_log(30, "recv pkt from gdev, but not found nat_info:%s!", + flwd_tuple5_ntop(tid, &nat_key)); + } + return -1; + } + out_opt |= FLWD_OUTOPT_FIRST_PKT; + } + + ltsm_stat = flwd_do_nat(device_handle, nat_info, raw_pkt); + + flwd_access_output(device_handle, tid, nat_info, raw_pkt, out_opt); + +#if FLWD_USE_LTSM_FOR_QUICK_CLOSE + if(FTSM_CLOSED == ltsm_stat){ + flwd_log(10, "tuple4 %s state is CLOSED, quick destroy nat_info!\n", + flwd_tuple5_ntop(tid, &nat_key)); + MESA_htable_del(flwd_thread_val[tid].nat_info_table, + (const uchar *)&nat_key, sizeof(flwd_tuple5_t), NULL); + } +#endif + + return 0; +} + +static void *flwd_access_nat_table_create(void) +{ + int opt_int; + MESA_htable_handle htable; + + htable = MESA_htable_born(); + assert(htable != NULL); + + opt_int = 0; /* ÿ���̶߳���, ����ģʽ */ + MESA_htable_set_opt(htable, MHO_THREAD_SAFE, &opt_int, sizeof(int)); + + opt_int = 1024 * 256; + MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &opt_int, sizeof(int)); + + MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &flwd_cfg_val.nat_htable_max_num, sizeof(int)); + + /* TODO, Ŀǰ���ó�ʱ��̭, ����TCPӦ��������״̬��, TCP������������̭, �����ͷ��ڴ� */ + MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &flwd_cfg_val.nat_htable_timeout, sizeof(int)); + + opt_int = HASH_ELIMINATE_ALGO_LRU; + MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_int, sizeof(int)); + + MESA_htable_set_opt(htable, MHO_CBFUN_KEY_COMPARE, (void *)&flwd_nat_htable_key_cmp, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_KEY_TO_INDEX, (void *)&flwd_nat_htable_key2index, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_COMPLEX_KEY_DUP, (void *)flwd_nat_htable_key_dup, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_COMPLEX_KEY_FREE, (void *)flwd_nat_htable_key_free, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void *)&flwd_access_nat_htable_data_free, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_DATA_EXPIRE_NOTIFY, (void *)&flwd_access_nat_htable_data_expire_notify, sizeof(void *)); + + opt_int = 1; + MESA_htable_set_opt(htable, MHO_AUTO_UPDATE_TIME, &opt_int, sizeof(int)); + + opt_int = 0; + MESA_htable_set_opt(htable, MHO_SCREEN_PRINT_CTRL, &opt_int, sizeof(int)); + + opt_int = 100; + MESA_htable_set_opt(htable, MHO_HASH_LIST_COLLIDE_THRESHOLD, &opt_int, sizeof(int)); + + char *err_log = (char *)"./flwd_hash_collide.log"; + MESA_htable_set_opt(htable, MHO_HASH_LOG_FILE, (void *)err_log, strlen(err_log)); + + int ret = MESA_htable_mature(htable); + assert(ret >= 0); + + return htable; +} + + +/* + �������ش�ת�����ط����հ�, ����vxlan��. +*/ +static int flwd_acc_fwd_pkt_input(flwd_device_handle_t *rcv_device_handle, + int tid, flwd_raw_pkt_t *raw_pkt) +{ + int ret; + + raw_pkt->inner_ip_layer_hdr = (const char *)raw_pkt->outer_pkt_data + FLWD_VXLAN_OUTER_PACKET_LEN + sizeof(flwd_eth_hdr_t); /* �����������vxlanͷ�����ڲ�ethernetͷ�� */ + raw_pkt->inner_pkt_data = (char *)raw_pkt->outer_pkt_data + FLWD_VXLAN_OUTER_PACKET_LEN; /* ָ���ڲ�ethernet��ʼ��ַ */ + raw_pkt->inner_pkt_len = raw_pkt->outer_pkt_len - FLWD_VXLAN_OUTER_PACKET_LEN; + ret = flwd_access_kernal_pkt_input(rcv_device_handle, tid, raw_pkt); + + return ret; +} + +int flwd_acc_pkt_input(flwd_device_handle_t *device_handle, int tid, flwd_raw_pkt_t *raw_pkt) +{ + int ret; + + flwd_thread_val[tid].pkt_stat.eth_pkt_num++; + flwd_thread_val[tid].pkt_stat.eth_pkt_byte += raw_pkt->outer_pkt_len; + + if(TOPO_ACC_LINK_FWD == device_handle->io_para.topo_mode){ + ret = flwd_rubbish_pkt_identify(device_handle, raw_pkt, 1); + }else{ + ret = flwd_rubbish_pkt_identify(device_handle, raw_pkt, 0); + } + if(ret != 0){ + return 0; + } + + ret = flwd_protocol_stack_process(device_handle, tid, raw_pkt); + if(ret != 0){ + return 0; + } + + switch((int)device_handle->io_para.topo_mode){ + case TOPO_ACC_LINK_USER: + flwd_log(10, "ACC: recv pkt from user client, tuple4:%s\n", + flwd_debug_print_tuple4_detail((char *)raw_pkt->outer_pkt_data + sizeof(flwd_eth_hdr_t), tid)); + flwd_acc_user_pkt_input(device_handle, tid, raw_pkt); + break; + + case TOPO_ACC_LINK_FWD: + { + char inner_tuple4[128]; + char outer_tuple4[128]; + flwd_log(10, "ACC: recv pkt from forward gateway, inner_tuple4:%s, outer_tuple4:%s\n", + flwd_debug_print_tuple4_detail_r((char *)raw_pkt->outer_pkt_data + FLWD_VXLAN_OUTER_PACKET_LEN + sizeof(flwd_eth_hdr_t), inner_tuple4, 128), + flwd_debug_print_tuple4_detail_r((char *)raw_pkt->outer_pkt_data + sizeof(flwd_eth_hdr_t), outer_tuple4, 128)); + + flwd_acc_fwd_pkt_input(device_handle, tid, raw_pkt); + } + break; + } + + return 0; +} + + +void *flwd_packet_io_work_thread(void *arg) +{ + int ret1, ret2, ret3; + int tseq = *((int *)arg); + flwd_raw_pkt_t raw_pkt; + unsigned long long last_idle_call_in_ms = 0; + flwd_device_handle_t *dev_handle; + int tot_work_times = 0; /* �ܽ��հ�, idle���� */ + int success_work_times_in_recent_100 = 0; /* ���100�γɹ��Ĵ��� */ + + while(1){ + dev_handle = &flwd_global_val.global_io_handle[TOPO_ACC_LINK_USER]; + ret1 = dev_handle->low_level_pkt_recv(dev_handle, tseq, &raw_pkt.low_level_mbuff); + if(ret1 >= 0){ + raw_pkt.outer_pkt_data = dev_handle->low_level_mbuff_mtod(raw_pkt.low_level_mbuff); + raw_pkt.outer_pkt_len = dev_handle->low_level_mbuff_get_pkt_len(raw_pkt.low_level_mbuff); + flwd_pre_process_pkt_input(dev_handle, &raw_pkt); + flwd_acc_pkt_input(dev_handle, tseq, &raw_pkt); + dev_handle->low_level_pkt_free(dev_handle, tseq, raw_pkt.low_level_mbuff); + } + + dev_handle = &flwd_global_val.global_io_handle[TOPO_ACC_LINK_FWD]; + ret2 = dev_handle->low_level_pkt_recv(dev_handle, tseq, &raw_pkt.low_level_mbuff); + if(ret2 >= 0){ + raw_pkt.outer_pkt_data = dev_handle->low_level_mbuff_mtod(raw_pkt.low_level_mbuff); + raw_pkt.outer_pkt_len = dev_handle->low_level_mbuff_get_pkt_len(raw_pkt.low_level_mbuff); + flwd_pre_process_pkt_input(dev_handle, &raw_pkt); + flwd_acc_pkt_input(dev_handle, tseq, &raw_pkt); + dev_handle->low_level_pkt_free(dev_handle, tseq, raw_pkt.low_level_mbuff); + } + + tot_work_times++; + + if((ret1 < 0) && (ret2 < 0)){ + ret3 = flwd_idle_call(tseq); + if(0 == ret3){ + /* ����������������, idle_call()Ҳ���¿���, ����һ�� */ + flwd_adapt_sleep(success_work_times_in_recent_100); + }else{ + success_work_times_in_recent_100++; + } + }else{ + success_work_times_in_recent_100++; + } + + if(tot_work_times >= 100){ + /////printf("%d/100\n", success_work_times_in_recent_100); + tot_work_times = 0; + success_work_times_in_recent_100 = 0; + } + } + + return NULL; +} + +/* �������س�ʼ������� */ +int flwd_gateway_init(void) +{ + int i, ret; + char str_tmp[256]; + +#if FLWD_NO_ACTIVE_IP_DISCOVER + printf("\033[1;31;40m[Warning] TEST NO IP DISCOVER is enable!\033[0m\n" ); + sleep(2); +#endif + + MESA_load_profile_int_def(FLWD_CONFIG_FILE, "main", "nat_htable_max_num", &flwd_cfg_val.nat_htable_max_num, 50000); + MESA_load_profile_int_def(FLWD_CONFIG_FILE, "main", "nat_htable_timeout", &flwd_cfg_val.nat_htable_timeout, 30); + + for(i = 0; i < flwd_cfg_val.tot_thread_count; i++){ + flwd_thread_val[i].nat_info_table = flwd_access_nat_table_create(); + } + + + /* TODO, PPTP, L2TP server ��ʼ�� */ + + /* TODO, IP��ַ��ȫ��, ip-hot-pool �ṹ��ʼ�� */ + + /* IP���ò��Խṹ��ʼ��, HASH��, ����SNAT, keyΪdip+dport, ����DNAT, keyΪRIP+RPORT */ + + ret = flwd_packet_io_init(TOPO_ACC_LINK_USER, TOPO_ACC_LINK_FWD); + if(ret < 0){ + return -1; + } + + ret = flwd_access_active_ip_init(); + if(ret < 0){ + return -1; + } + + ret = flwd_network_conn_init(); + if(ret < 0){ + return -1; + } + + /* NOTE: maat��÷���������, ��Ϊ��callback, ��ʼ����ر���������, ����������ݽṹ��û��ʼ�����, ����flwd_access_active_ip_init(), callback�����! */ + ret = flwd_access_maat_init(); + if(ret < 0){ + return -1; + } + + return 0; +} + diff --git a/src/access/flwd_access_active_ip_manage.c b/src/access/flwd_access_active_ip_manage.c new file mode 100644 index 0000000..8b3e876 --- /dev/null +++ b/src/access/flwd_access_active_ip_manage.c @@ -0,0 +1,616 @@ +/* + ��ԾIP��ַ����ģ��, + ����IP������ϵͳ��IP, ����MAAT-IP�ص���, +*/ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" +#include "MESA_handle_logger.h" +#include "MESA_htable.h" +#include <arpa/inet.h> +#include <linux/if_ether.h> +#include <linux/if_arp.h> +#include <stdio.h> +#include <unistd.h> +#include <pthread.h> +#include <string.h> +#include <assert.h> + + +/* + TODO: + ȫ�����н������ط���Ψһ��id, ����Ȼ��1��ʼ, + ��������N����ÿ����������ʹ�õ�Դ�˿ڷ�Χ, ������1ʹ��10001-20000, ����2ʹ��20001-30000�ȵ�, + IP��ȫ�ֹ���, ��ͬ��������֮��Ķ˿ڰ���Χ����, ��֤���֮�以����ͻ! + + ÿ�����������ڲ��ٸ����߳�����, ���������ö˿ڷֳ�THREAD_NUM��, + ������1���߳�1ʹ��10001-12000, ����1���߳�2ʹ��12001-14000, �ȵ�. +*/ + + +MESA_ATOMIC_T flwd_temp_active_ip_op_flag[FLWD_MAX_THREAD_NUM]; +MESA_lqueue_head flwd_temp_active_ip_to_deal[FLWD_MAX_THREAD_NUM]; /* �ṹ: flwd_temp_to_deal_act_ip_t */ + + +typedef struct{ + flwd_ip_t active_ip_net_order; + char is_valid; /* 1:usabel, add; 0:disable, del */ +}flwd_temp_to_deal_act_ip_t; + +static void flwd_act_ip_htable_data_free(void *data); + + +static unsigned short flwd_act_ip_mask_to_num(unsigned short mask_to_num) +{ + int i; + + for(i = 0; i < 16; i++){ + if(0 != (mask_to_num & 1)){ /* һֱ����, ֱ�����λ��Ϊ0Ϊֹ */ + break; + }else{ + mask_to_num = mask_to_num >> 1; + } + } + + return mask_to_num; +} + + +static unsigned short flwd_act_ip_get_acc_gateway_num(void) +{ + return flwd_act_ip_mask_to_num(FLWD_SPORT_ACC_ID_MASK); +} + +unsigned short flwd_act_ip_get_usable_udp_sport_num(void) +{ + return flwd_act_ip_mask_to_num(FLWD_UDP_SPORT_ACTUAL_PORT_MASK); +} + +unsigned short flwd_act_ip_get_usable_tcp_sport_num(void) +{ + return flwd_act_ip_mask_to_num(FLWD_TCP_SPORT_ACTUAL_PORT_MASK); +} + +static int flwd_act_ip_get_tcp_usable_sport(int tid, + unsigned short *begin_port, unsigned short *usable_count) +{ + unsigned short this_gateway_begin_port; + unsigned short this_thread_usable_tot_count; + unsigned short this_gateway_usable_tot_count; + + this_gateway_usable_tot_count = flwd_act_ip_get_usable_tcp_sport_num(); + + /* NOTE: current_access_gateway_idΪ�˷�������, ����Ȼ��1��ʼ, �˴���Ҫ��1, ���߳�id��0��ʼ, �����1 */ + + /* gateway_id���Ƶ����λ */ + this_gateway_begin_port = (((unsigned short)flwd_cfg_val.current_access_gateway_id - 1) << (FLWD_SPORT_ACC_ID_SHIFT_NUM)); + + this_thread_usable_tot_count = this_gateway_usable_tot_count/flwd_cfg_val.tot_thread_count; + + *usable_count = this_gateway_usable_tot_count/flwd_cfg_val.tot_thread_count; + + *begin_port = this_gateway_begin_port | (*usable_count) * tid; + + return 0; +} + + +static int flwd_act_ip_get_udp_usable_sport(int tid, + unsigned short *begin_port, unsigned short *usable_count) +{ + unsigned short this_gateway_begin_port; + unsigned short this_thread_usable_tot_count; + unsigned short this_gateway_usable_tot_count; + + this_gateway_usable_tot_count = flwd_act_ip_get_usable_udp_sport_num(); + + /* NOTE: current_access_gateway_idΪ�˷�������, ����Ȼ��1��ʼ, �˴���Ҫ��1, ���߳�id��0��ʼ, �����1 */ + + /* gateway_id���Ƶ����λ */ + this_gateway_begin_port = (((unsigned short)flwd_cfg_val.current_access_gateway_id - 1) << (FLWD_SPORT_ACC_ID_SHIFT_NUM)); + + this_thread_usable_tot_count = this_gateway_usable_tot_count/flwd_cfg_val.tot_thread_count; + + *usable_count = this_gateway_usable_tot_count/flwd_cfg_val.tot_thread_count; + + *begin_port = this_gateway_begin_port | (*usable_count) * tid; + + return 0; +} + +/* + NOTE: + ���ݻص����������Ļ�ԾIP, ��Ϊkey����htable, + ���ݵ�ǰ�������ص�id, ������������, ���߳�ID, ���ɿ��õĶ˿��б�. +*/ +static flwd_active_ip_t *flwd_act_ip_create_new_node(int tid, const flwd_active_ip_t *act_ip_stack) +{ + flwd_active_ip_t *act_ip_heap; + unsigned short udp_begin_port, tcp_begin_port, tport; + unsigned short udp_usable_count, tcp_usable_count; + unsigned short i; + MESA_list_count_t *list_node; + + act_ip_heap = (flwd_active_ip_t *)malloc(sizeof(flwd_active_ip_t)); + memcpy(act_ip_heap, act_ip_stack, sizeof(flwd_active_ip_t)); + + MESA_list_init_head(&act_ip_heap->active_ip_list_node); + act_ip_heap->active_ip_list_node.quiddity = act_ip_heap; /* Ϊ�˽�Լ�ڴ�, ����ͷҲ�洢����, ��������dynamic���ͺͽ���һ��IP��static������˵, �������¹���һ���ڵ�, quiddityִ�������ṹ��ͷ�� */ + + /* TCP��UDP�Ķ˿ڷֿ��洢ʹ��, ������չһ����ԾIP��ʵ�ʸ��÷�Χ */ + MESA_list_count_init_head(&act_ip_heap->usable_tcp_sport_list_head); + MESA_list_count_init_head(&act_ip_heap->usable_udp_sport_list_head); + + flwd_act_ip_get_udp_usable_sport(tid, &udp_begin_port, &udp_usable_count); + + for(i = 0; i < udp_usable_count; i++){ + list_node = (MESA_list_count_t *)calloc(1, sizeof(MESA_list_count_t)); + tport = udp_begin_port + i; + tport |= (flwd_cfg_val.current_access_gateway_id << FLWD_SPORT_ACC_ID_SHIFT_NUM); + tport = htons(tport); /* convert to net_order */ + memcpy(&list_node->quiddity, &tport, sizeof(short)); /* ԭ���˴�������ָ��, ֱ�Ӹ����ڴ��ַ, �洢2���ֽڵĶ˿�ֵ, net_order */ + MESA_list_count_add(&act_ip_heap->usable_udp_sport_list_head, list_node); + } + + flwd_act_ip_get_tcp_usable_sport(tid, &tcp_begin_port, &tcp_usable_count); + + for(i = 0; i < tcp_usable_count; i++){ + list_node = (MESA_list_count_t *)calloc(1, sizeof(MESA_list_count_t)); + tport = tcp_begin_port + i; + tport |= (flwd_cfg_val.current_access_gateway_id << FLWD_SPORT_ACC_ID_SHIFT_NUM); + tport = htons(tport); /* convert to net_order */ + + memcpy(&list_node->quiddity, &tport, sizeof(short)); /* ԭ���˴�������ָ��, ֱ�Ӹ����ڴ��ַ, �洢2���ֽڵĶ˿�ֵ, net_order */ + MESA_list_count_add(&act_ip_heap->usable_tcp_sport_list_head, list_node); + } + + return act_ip_heap; +} + +#if FLWD_ASYNC_LOCK_FREE +/* NOTE: �˺����ڰ������߳���������, ����ģʽ�����µĻ�Ծip */ +int flwd_act_ip_hash_proc(int tid, flwd_active_ip_t *act_ip_stack) +{ + MESA_htable_handle flwd_act_htable; + unsigned char *ip_key; + unsigned int ip_key_size; + flwd_active_ip_t *act_ip_heap; + int ret; + char ip_str[64]; + + if(flwd_likely(FLWD_IP_ADDR_TYPE_V4 == act_ip_stack->active_ip_net_order.addr_type)){ + if(FLWD_IP_REGION_INLAND == act_ip_stack->ip_region_type){ + flwd_act_htable = flwd_thread_val[tid].flwd_active_ipv4_pool_inland; + }else{ + flwd_act_htable = flwd_thread_val[tid].flwd_active_ipv4_pool_outland; + } + ip_key = (unsigned char *)&act_ip_stack->active_ip_net_order.addr_ipv4; + ip_key_size = sizeof(int); + inet_ntop(AF_INET, &act_ip_stack->active_ip_net_order.addr_ipv4, ip_str, 64); + }else{ + if(FLWD_IP_REGION_INLAND == act_ip_stack->ip_region_type){ + flwd_act_htable = flwd_thread_val[tid].flwd_active_ipv6_pool_inland; + }else{ + flwd_act_htable = flwd_thread_val[tid].flwd_active_ipv6_pool_outland; + } + ip_key = (unsigned char *)&act_ip_stack->active_ip_net_order.addr_ipv6; + ip_key_size = sizeof(struct in6_addr); + inet_ntop(AF_INET6, &act_ip_stack->active_ip_net_order.addr_ipv6, ip_str, 64); + } + + if(act_ip_stack->is_valid){ + if(MESA_htable_search(flwd_act_htable, ip_key, ip_key_size) == NULL){ + act_ip_heap = flwd_act_ip_create_new_node(tid, act_ip_stack); + ret = MESA_htable_add(flwd_act_htable, ip_key, ip_key_size, act_ip_heap); + if(ret < 0){ + flwd_act_ip_htable_data_free(act_ip_heap); + flwd_log(30, "add new active ip to htable fail, ret=%d\n", ret); + }else{ + flwd_log(10, "add new active ip:%s\n", ip_str); + } + }else{ + ; /* already exist, do nothing. */ + } + }else{ + /* */ + MESA_htable_del(flwd_act_htable, ip_key, ip_key_size, NULL); + flwd_log(10, "del old active ip:%s\n", ip_str); + } + + return 0; +} +#endif + + +static void flwd_act_ip_dynamic_update(const flwd_active_ip_t *stack_act_ip) +{ + int i, ret; + flwd_active_ip_t *heap_act_ip; + unsigned int key_size; + unsigned char *key; + char ip_str[64]; + + if(FLWD_IP_ADDR_TYPE_V4 == stack_act_ip->active_ip_net_order.addr_type){ + key = (unsigned char *)&stack_act_ip->active_ip_net_order.addr_ipv4; + key_size = sizeof(int); + }else{ + key = (unsigned char *)&stack_act_ip->active_ip_net_order.addr_ipv6; + key_size = sizeof(struct in6_addr); + } + + for(i = 0; i < flwd_cfg_val.tot_thread_count; i++){ + pthread_rwlock_wrlock(&flwd_thread_val[i].flwd_ip_pool_dynamic_rwlock); + + if(0 == stack_act_ip->is_valid){ + MESA_htable_del(flwd_thread_val[i].flwd_ip_pool_dynamic_htable[stack_act_ip->active_ip_net_order.addr_type][stack_act_ip->ip_region_type], + key, key_size, NULL); + }else{ + /* ���������, ����һ��, htable���Ƿ��Ѿ����� */ + heap_act_ip = (flwd_active_ip_t *)MESA_htable_search(flwd_thread_val[i].flwd_ip_pool_dynamic_htable[stack_act_ip->active_ip_net_order.addr_type][stack_act_ip->ip_region_type], + key, key_size); + if(heap_act_ip != NULL){ + /* ��ԾIP�ظ�, do nonthing !! */ + pthread_rwlock_unlock(&flwd_thread_val[i].flwd_ip_pool_dynamic_rwlock); + return; + } + + heap_act_ip = flwd_act_ip_create_new_node(i, stack_act_ip); + ret = MESA_htable_add(flwd_thread_val[i].flwd_ip_pool_dynamic_htable[stack_act_ip->active_ip_net_order.addr_type][stack_act_ip->ip_region_type], + key, key_size, heap_act_ip); + assert(ret >= 0); + flwd_log(10, "add dynamic ip pool addr:'%s'\n ", flwd_ipt_ntop_r(&stack_act_ip->active_ip_net_order, ip_str, 64)); + } + + pthread_rwlock_unlock(&flwd_thread_val[i].flwd_ip_pool_dynamic_rwlock); + } + + return; +} + + +/* �ж�IP�Ƿ�����е��ظ�(�˹�����, ���������ظ�IP), ������ʱҲ���ܸ���һ����IP�Ͷ˿�, ������� */ + +static int flwd_static_ip_pool_is_dup(const flwd_active_ip_t *act_ip_head, + const flwd_active_ip_t *stack_act_ip) +{ + const MESA_list_t *in_list_node = &act_ip_head->active_ip_list_node; + const flwd_active_ip_t *in_list_ipt; + + do{ + in_list_ipt = (flwd_active_ip_t *)in_list_node->quiddity; + if(flwd_ipt_equal(&in_list_ipt->active_ip_net_order, &stack_act_ip->active_ip_net_order) == 1){ + return 1; + } + in_list_node = in_list_node->nextele; + }while(in_list_node != &act_ip_head->active_ip_list_node); /* ˫��ѭ������, ��ֹ��ѭ�� */ + + return 0; +} + + +/* ��̬IP����group_idΪkey, IP_listΪdata */ +static void flwd_act_ip_static_update(const flwd_active_ip_t *stack_act_ip) +{ + int i, ret; + flwd_active_ip_t *act_ip_head;/* htable�е�ip�ڵ� */ + flwd_active_ip_t *heap_act_ip; /* ����������ip */ + char ip_str[64]; + void *ip_static_htable; + + /* NOTE: ���Ӻ�ɾ��IPʱʹ��group_id����ip_list, Ȼ���ٱ���; �����ö˿ڻ���ʱ, ֻ��IP�Ͷ˿�, û��Group_id�ĸ���, + ��flwd_ip_pool_static_htable��, ʹ��������ͬ��key, ����ͬһ��data, ��ip_list. + + update_cbʹ��group_id����ip_list; + sport_recycleʹ��ip��ַ����ip_list; + + Ϊ�˷�ֹ��һgroup_id��ipv4��ַ��ͻ, ��groupתΪ�ַ���ģʽ, ǰ�����GPIDǰ, ������֤key�ij��ȶ���һ��, �϶�Ҳ�����ͻ. + */ + unsigned char static_ip_group_key[64]; + int static_ip_group_key_len = 64; + flwd_policy_group_id_key_gen(stack_act_ip->policy_group_id, static_ip_group_key, &static_ip_group_key_len); + + for(i = 0; i < flwd_cfg_val.tot_thread_count; i++){ + /* NOTE: �˺�������maat�ص��߳�������, �����������̵߳����ݽṹ, ��Ҫ����! */ + pthread_rwlock_wrlock(&flwd_thread_val[i].flwd_ip_pool_static_rwlock); + + ip_static_htable = flwd_thread_val[i].flwd_ip_pool_static_htable[stack_act_ip->active_ip_net_order.addr_type][stack_act_ip->ip_region_type]; + + if(0 == stack_act_ip->is_valid){ + flwd_ip_pool_del(FLWD_ACT_IP_STATIC, + ip_static_htable, + stack_act_ip->policy_group_id, + flwd_act_ip_htable_data_free, + stack_act_ip); + }else{ + /* ���������, ����һ��htable���Ƿ��Ѿ����� */ + act_ip_head = (flwd_active_ip_t *)flwd_ip_pool_search(FLWD_ACT_IP_STATIC, + ip_static_htable, + (unsigned char *)static_ip_group_key, + static_ip_group_key_len); + if(act_ip_head != NULL){ + /* group-list�Ѵ���, �ж�IP�Ƿ�����е��ظ�(�˹�����, ���������ظ�IP), ������ʱҲ���ܸ���һ����IP�Ͷ˿�, ������� */ + if(flwd_static_ip_pool_is_dup(act_ip_head, stack_act_ip) == 0){ + heap_act_ip = flwd_act_ip_create_new_node(i, stack_act_ip); + + MESA_list_add(&act_ip_head->active_ip_list_node, &heap_act_ip->active_ip_list_node); + + /* ��ipΪkey, �ٲ���һ��hash��, ���ڶ˿ڻ���ʱ, û��group_id, Ҳ�ܿ�ip�ҵ���Ӧ��ip_list */ + ret = MESA_htable_add(ip_static_htable, + stack_act_ip->active_ip_net_order.addr_value, + stack_act_ip->active_ip_net_order.addr_len, + heap_act_ip); + assert(ret >= 0); + flwd_log(10, "add static ip pool addr:'%s'\n ", + flwd_ipt_ntop_r(&stack_act_ip->active_ip_net_order, ip_str, 64)); + }else{ + flwd_log(20, "static ip pool %s is duplicated!\n ", + flwd_ipt_ntop_r(&stack_act_ip->active_ip_net_order, ip_str, 64)); + } + }else{ + /* ��ǰpolicy��û��IP, ��һ��, Ҳ����������ͷ�ڵ�, ֱ����MESA_htable_add����, */ + heap_act_ip = flwd_act_ip_create_new_node(i, stack_act_ip); + ret = MESA_htable_add(ip_static_htable, + (unsigned char *)static_ip_group_key, + static_ip_group_key_len, + heap_act_ip); + assert(ret >= 0); + /* ��ipΪkey, �ٲ���һ��hash��, ���ڶ˿ڻ���ʱ, û��group_id, Ҳ�ܿ�ip�ҵ���Ӧ��ip_list */ + ret = MESA_htable_add(ip_static_htable, + stack_act_ip->active_ip_net_order.addr_value, + stack_act_ip->active_ip_net_order.addr_len, + heap_act_ip); + if(ret < 0){ + /* ������IP�ظ���! �����Dz�ͬ�������������ͬ��IP��ַ! */ + /* TODO, ���������ô��?? ͬһ��IP���ڲ�ͬ����, �ɲ�����?? */ + //flwd_act_ip_htable_data_free(heap_act_ip); + flwd_log(30, "add static ip pool addr:'%s' error, ret=%d\n ", + flwd_ipt_ntop_r(&stack_act_ip->active_ip_net_order, ip_str, 64), ret); + }else{ + flwd_log(10, "add static ip pool addr:'%s'\n ", + flwd_ipt_ntop_r(&stack_act_ip->active_ip_net_order, ip_str, 64)); + } + } + } + + pthread_rwlock_unlock(&flwd_thread_val[i].flwd_ip_pool_static_rwlock); + } + + return; +} + +/* + NOTE: + ��̬��ԾIP��IP��ַΪkey, dataΪflwd_active_ip_t, ֻ����һ���ڵ�, active_ip_list_nodeָ�붼�ǿ�; + ��̬IP��ַ�صĵ�ַ�Բ�����IDΪkey, dataΪflwd_active_ip_t������, ����������ͬpolicy_id��IP; +*/ +void flwd_act_ip_update(const flwd_active_ip_t *stack_act_ip) +{ + if(FLWD_ACT_IP_DYNAMIC == stack_act_ip->ip_origin_type){ + flwd_act_ip_dynamic_update(stack_act_ip); + }else{ + flwd_act_ip_static_update(stack_act_ip); + } + + return; +} + + + +#if FLWD_NO_ACTIVE_IP_DISCOVER +/* ģ���ԾIP����ϵͳ, ��һЩ������ģ�� */ + +/* + ���ݿ����ʽ: + "id addr_type ipaddr port user_region(GDEV_IP) location is_valid op_time" + "1 4 11.22.33.44 0 100 0 1 2018-06-03 11:11:11" +*/ +static void flwd_phony_act_ipv4_gen(int is_valid, unsigned ip_addr, unsigned int group_id, flwd_ip_region_type_t region_type, flwd_active_ip_type_t origin_type) +{ + int rand_num; + flwd_active_ip_t stack_act_ip; + + rand_num = rand(); + + stack_act_ip.is_valid = is_valid; + stack_act_ip.policy_group_id = group_id; + + stack_act_ip.ip_region_type = region_type; /* ����ipΪ���� */ + + stack_act_ip.ip_origin_type = origin_type; + + stack_act_ip.active_ip_net_order.addr_ipv4 = ip_addr; + stack_act_ip.active_ip_net_order.addr_type = FLWD_IP_ADDR_TYPE_V4; + stack_act_ip.active_ip_net_order.addr_len = sizeof(int); + + stack_act_ip.gdev_args.gdev_ip_net_order = 0x01010101; + + flwd_act_ip_update(&stack_act_ip); + +} + +static void *flwd_act_ip_phony_discoverer(void *arg) +{ + int i = 0; + time_t tstart; + + tstart = time(NULL); + + while(1){ + for(i = 0; i < 100; i++){ + flwd_phony_act_ipv4_gen(1, i, i, FLWD_IP_REGION_INLAND, FLWD_ACT_IP_DYNAMIC); + flwd_phony_act_ipv4_gen(1, i, i, FLWD_IP_REGION_OUTLAND, FLWD_ACT_IP_DYNAMIC); + + flwd_phony_act_ipv4_gen(1, i, i, FLWD_IP_REGION_INLAND, FLWD_ACT_IP_STATIC); + flwd_phony_act_ipv4_gen(1, i, i, FLWD_IP_REGION_OUTLAND, FLWD_ACT_IP_STATIC); + } + + usleep(10); +#if 1 + for(i = 0; i < 100; i++){ + flwd_phony_act_ipv4_gen(0, i, i, FLWD_IP_REGION_INLAND, FLWD_ACT_IP_DYNAMIC); + flwd_phony_act_ipv4_gen(0, i, i, FLWD_IP_REGION_INLAND, FLWD_ACT_IP_STATIC); + flwd_phony_act_ipv4_gen(0, i, i, FLWD_IP_REGION_OUTLAND, FLWD_ACT_IP_DYNAMIC); + flwd_phony_act_ipv4_gen(0, i, i, FLWD_IP_REGION_OUTLAND, FLWD_ACT_IP_STATIC); + } +#endif + + if(tstart + 60 < time(NULL)){ + sleep(5); + exit(1); + } + } + + return NULL; +} +#endif + +static int flwd_act_ip_htable_key_cmp(const uchar * key1, uint size1, const uchar * key2, uint size2) +{ + if(size1 != size2){ + return -1; + } + + return memcmp(key1, key2, size1); +} + +static uint flwd_act_ip_htable_key2index(const MESA_htable_handle table, const uchar * key, uint size) +{ + unsigned int hash = 131; + unsigned seed = 13131; + unsigned int i; + + for(i = 0; i < size; i++){ + hash = hash * seed + *key++; + } + + return hash; +} + +static void flwd_act_ip_htable_data_free(void *data) +{ + flwd_active_ip_t *act_ip = (flwd_active_ip_t *)data; + MESA_list_count_t *list_node, *next_node; + char ip_str[64]; + + while((0 == MESA_list_count_is_empty(&act_ip->usable_tcp_sport_list_head))){ + list_node = act_ip->usable_tcp_sport_list_head.nextele; + MESA_list_count_del(&act_ip->usable_tcp_sport_list_head, list_node); + free(list_node); + } + + while((0 == MESA_list_count_is_empty(&act_ip->usable_udp_sport_list_head))){ + list_node = act_ip->usable_udp_sport_list_head.nextele; + MESA_list_count_del(&act_ip->usable_udp_sport_list_head, list_node); + free(list_node); + } + + flwd_log(10, "del ip pool addr:'%s'\n ", flwd_ipt_ntop_r(&act_ip->active_ip_net_order, ip_str, 64)); + + memset(act_ip, 0xFE, sizeof(flwd_active_ip_t)); + + free(data); +} + +static MESA_htable_handle flwd_act_ip_htable_create(void) +{ + int opt_int; + MESA_htable_handle htable; + + htable = MESA_htable_born(); + assert(htable != NULL); + + opt_int = 0; /* ���ⲿ��rwlock��д��ʵ�ֶ��̰߳�ȫ, ��htable�ڲ��Ļ��������ܸ���һЩ */ + MESA_htable_set_opt(htable, MHO_THREAD_SAFE, &opt_int, sizeof(int)); + + opt_int = 1024 * 32; + MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &opt_int, sizeof(int)); + + opt_int = 100000; + MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &opt_int, sizeof(int)); + + opt_int = 0; /* ��ԾIP�ص����г�ʱɾ������, ��redis�ص�ʵ��, ����htable������ʱ */ + MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &opt_int, sizeof(int)); + + MESA_htable_set_opt(htable, MHO_CBFUN_KEY_COMPARE, (void *)&flwd_act_ip_htable_key_cmp, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_KEY_TO_INDEX, (void *)&flwd_act_ip_htable_key2index, sizeof(void *)); + + MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void *)&flwd_act_ip_htable_data_free, sizeof(void *)); + + opt_int = 1; + MESA_htable_set_opt(htable, MHO_AUTO_UPDATE_TIME, &opt_int, sizeof(int)); + + opt_int = 0; + MESA_htable_set_opt(htable, MHO_SCREEN_PRINT_CTRL, &opt_int, sizeof(int)); + + /* searchʱ�ӵ��Ƕ���, ֻ����FIFOģʽ, LRUģʽ�ڲ���д���� */ + opt_int = HASH_ELIMINATE_ALGO_FIFO; + MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_int, sizeof(int)); + + opt_int = 100; + MESA_htable_set_opt(htable, MHO_HASH_LIST_COLLIDE_THRESHOLD, &opt_int, sizeof(int)); + + char *err_log = (char *)"./flwd_hash_collide.log"; + MESA_htable_set_opt(htable, MHO_HASH_LOG_FILE, (void *)err_log, strlen(err_log)); + + int ret = MESA_htable_mature(htable); + assert(ret >= 0); + + return htable; +} + + +/* + TODO: + ����SNAT��˵, act_ip����IP������ϵͳ�ش���IP, ��������; + ����DNAT��˵, act_ip�ǽ��������������ip, ��Ϊֻ��һ��ip����65535���˿ڿ���, �������ļ��������������̬ip��ʼ��ַ������: + + [TOPO_ACC_LINK_USER] + gateway_slave_ip_range = 10.0.9.100 + gateway_slave_ip_num = 10 + + ��˼�Ǵ�10.0.9.100��ʼ, ��10.0.9.109���ǽ�����������������ʵ�ڲ���������ip, + Ҫ������ЩIP��arp����, �ظ�Ӧ���. +*/ + + +int flwd_access_active_ip_init(void) +{ + int i; + int v4_or_v6, in_or_out; + + for(i = 0; i < flwd_cfg_val.tot_thread_count; i++){ + flwd_temp_active_ip_to_deal[i] = MESA_lqueue_create(0, 1000); /* �첽������б�������, ��ԭ�ӱ������� */ + + MESA_ATOMIC_SET(flwd_temp_active_ip_op_flag[i], 0); +#if 0 + flwd_thread_val[i].flwd_active_ipv4_pool_inland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_active_ipv4_pool_outland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_active_ipv6_pool_inland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_active_ipv6_pool_outland = flwd_act_ip_htable_create(); + + flwd_thread_val[i].flwd_static_ipv4_pool_inland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_static_ipv4_pool_outland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_static_ipv6_pool_inland = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_static_ipv6_pool_outland = flwd_act_ip_htable_create(); +#else + for(v4_or_v6 = 0; v4_or_v6 <= 1; v4_or_v6++){ + for(in_or_out = 0; in_or_out <= 1; in_or_out++){ + flwd_thread_val[i].flwd_ip_pool_dynamic_htable[v4_or_v6][in_or_out] = flwd_act_ip_htable_create(); + flwd_thread_val[i].flwd_ip_pool_static_htable[v4_or_v6][in_or_out] = flwd_act_ip_htable_create(); + } + } + pthread_rwlock_init(&flwd_thread_val[i].flwd_ip_pool_dynamic_rwlock, NULL); + pthread_rwlock_init(&flwd_thread_val[i].flwd_ip_pool_static_rwlock, NULL); +#endif + } + +#if FLWD_NO_ACTIVE_IP_DISCOVER + pthread_t pid; + + pthread_create(&pid, NULL, flwd_act_ip_phony_discoverer, NULL); +#endif + + return 0; +} + diff --git a/src/access/flwd_access_idle_call.c b/src/access/flwd_access_idle_call.c new file mode 100644 index 0000000..a842728 --- /dev/null +++ b/src/access/flwd_access_idle_call.c @@ -0,0 +1,66 @@ +/* + �����������ݰ�, CPU����ʱ, �ڰ������̵߳��������е��ô˽ӿ�, + ������htable��ʱ��̭, + ��ԾIP���ø���(ԭ�������Ե�, �û�������һ������, ����в��Ե���; ��֮, ԭ�������в���, ��ɾ����), + + ��˺����ӿ��ڰ������̵߳���������, ��ʵ�ְ������߳���������ʱ������, �������!! +*/ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" +#include "MESA_handle_logger.h" +#include "MESA_atomic.h" +#include <linux/if_ether.h> +#include <linux/if_arp.h> +#include <stdio.h> +#include <unistd.h> +#include <pthread.h> +#include <string.h> +#include <assert.h> + +extern MESA_ATOMIC_T flwd_temp_active_ip_op_flag[FLWD_MAX_THREAD_NUM]; + + +/* �ڰ������߳������Ĵ�����ԾIP�ĸ���, ����ģʽ */ +static int flwd_act_ip_update_in_process_thread_context(int tid) +{ +#if FLWD_ASYNC_LOCK_FREE + int ret; + flwd_active_ip_t tmp_act_ip; + long buf_len; + + if(0 == MESA_lqueue_get_count(flwd_temp_active_ip_to_deal[tid])){ + /* û���µ����� */ + return 0; + } + + if(FLWD_ACT_IP_OP_OR_MASK_BY_CALLBACK & __sync_or_and_fetch(&flwd_temp_active_ip_op_flag[tid], FLWD_ACT_IP_OP_OR_MASK_BY_PROC)){ + /* callback�̻߳��ڴ�����, �˴����ܵȴ�, ��ձ�־λ��, ֱ�ӷ��ص���һ�ε��� */ + __sync_and_and_fetch(&flwd_temp_active_ip_op_flag[tid], FLWD_ACT_IP_OP_AND_MASK_BY_PROC); + return 0; + } + + buf_len = sizeof(flwd_active_ip_t); + ret = MESA_lqueue_get_head(flwd_temp_active_ip_to_deal[tid], &tmp_act_ip, &buf_len); + assert(ret >= 0); + + flwd_act_ip_hash_proc(tid, &tmp_act_ip); + + /* �������, �����־λ */ + __sync_and_and_fetch(&flwd_temp_active_ip_op_flag[tid], FLWD_ACT_IP_OP_AND_MASK_BY_PROC); + + return 1; +#else + return 0; +#endif +} + + +int flwd_idle_call(int tid) +{ + int ret; + ret = flwd_act_ip_update_in_process_thread_context(tid); + + return ret; +} + diff --git a/src/access/flwd_access_ip_layer.c b/src/access/flwd_access_ip_layer.c new file mode 100644 index 0000000..1fcfb4a --- /dev/null +++ b/src/access/flwd_access_ip_layer.c @@ -0,0 +1,6 @@ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" + + + diff --git a/src/access/flwd_access_l2tp_layer.c b/src/access/flwd_access_l2tp_layer.c new file mode 100644 index 0000000..43c76af --- /dev/null +++ b/src/access/flwd_access_l2tp_layer.c @@ -0,0 +1,22 @@ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" +#include "MESA_handle_logger.h" +#include <linux/if_ether.h> +#include <linux/if_arp.h> +#include <stdio.h> +#include <unistd.h> +#include <pthread.h> +#include <string.h> +#include <assert.h> + + +int flwd_access_l2tp_layer_input(flwd_device_handle_t *device_handle, int tid, flwd_raw_pkt_t *raw_pkt) +{ + /* TODO, ����l2tpЭ��ջ����, �ҵ�l2tp���, ������Ϻ�, ����access���Ĵ���ģ�� */ + + flwd_access_kernal_pkt_input(device_handle, tid, raw_pkt); + + return 0; +} + diff --git a/src/access/flwd_access_maat.c b/src/access/flwd_access_maat.c new file mode 100644 index 0000000..be30508 --- /dev/null +++ b/src/access/flwd_access_maat.c @@ -0,0 +1,582 @@ +#include "flowood.h" +#include "flowood_fun.h" +#include "flwd_net.h" +#include "MESA_htable.h" +#include "MESA_list_queue.h" +#include "MESA_handle_logger.h" +#include "MESA_list_count.h" +#include "Maat_rule.h" +#include <assert.h> +#include <stdio.h> +#include <unistd.h> +#include <pthread.h> +#include <string.h> +#include <assert.h> +#include <arpa/inet.h> +#include <netinet/tcp.h> +#include <netinet/udp.h> +#include <ctype.h> + + +static unsigned int flwd_fetch_policy_id_from_user_region(struct Maat_rule_t *maat_res) +{ + char *policy_section; + + /* �������, �洢���Զ�����, ����ǰ���Ե�IP��ַ�ص���� */ + policy_section = strcasestr(maat_res->service_defined, "IR_STRATEGY="); + if(NULL == policy_section){ + return 0; + } + + policy_section += strlen("IR_STRATEGY="); + + return (unsigned int)atoi(policy_section); +} + + +/* + ���ݵ�ǰ�ͻ��˵�ԴIP, PORT, ɨ�������ĸ����ò���: policy_id. + return value: + > 0: success, policy id. + 0: not hit rule; +*/ +unsigned int flwd_access_maat_scan_rule(int tid, const flwd_tuple5_t *tuple5) +{ + int ret; + struct Maat_rule_t maat_res[1]; /* ��̫���ܶ�����, �����Ƕ�����, ���Ҳֻ��Ҫһ�����, �˴�res��Ϊ1 */ + struct ipaddr client_addr; + scan_status_t mid = NULL; + unsigned int hit_policy_id; + + memset(&maat_res[0], 0, sizeof(maat_res)); + + flwd_tuple5_to_stream_addr(tid, tuple5, &client_addr); + + ret = Maat_scan_addr(flwd_global_val.maat_static_handle, + flwd_global_val.maat_table_info[FLWD_MAAT_TB_IR_POLICY_IP].table_id, /* TODO, SNAT��DNAT���Էֿ�, table_id�ֳ�����!! */ + &client_addr, + maat_res, + 1, + &mid, + tid); + if(ret <= 0){ + return 0; + } + + hit_policy_id = flwd_fetch_policy_id_from_user_region(&maat_res[0]); + + return hit_policy_id; +} + +static void nouse_maat_start_cb(int update_type,void* u_para) +{ + return; +} + +static void nouse_maat_finish_cb(void* u_para) +{ + return; +} + + +struct layer_addr_mac_in_mac +{ + unsigned char outer_dst_mac[6]; /* �����mac��ַ, network order */ + unsigned char outer_src_mac[6]; /* �����mac��ַ, network order */ + unsigned char inner_dst_mac[6]; /* �ڲ�mac��ַ, network order */ + unsigned char inner_src_mac[6]; /* �ڲ�mac��ַ, network order */ +}; + + +/* ascii�ַ�ת16���� */ +static char MESA_ascii_to_hex(char ascii) +{ + char c = 0; + + switch(ascii) + { + case '0': + case '1': + case '2': + case '3': + case '4': + case '5': + case '6': + case '7': + case '8': + case '9': + c = ascii - 0x30; + break; + + case 'a': + case 'b': + case 'c': + case 'd': + case 'e': + case 'f': + c = 10 + ascii - 0x61; + break; + + case 'A': + case 'B': + case 'C': + case 'D': + case 'E': + case 'F': + c = 10 + ascii - 0x41; + break; + } + + return c; +} + +/* + "000100032202-00e0fc030007,000100032202-00e0fc030007" + copy from sapp. +*/ +static int flwd_mac_in_mac_pton(char *addr_str, struct layer_addr_mac_in_mac *minm) +{ + int i; + char *str_val = addr_str; + unsigned char tmp_bin_val; + + memset(minm, 0, sizeof(struct layer_addr_mac_in_mac)); + + for(i = 0; i < 6; i++){ + tmp_bin_val = 0; /* ������, ������ֵ��䶼�ǻ���� */ + if(isxdigit(*str_val)==0){ + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val) << 4; + str_val++; + + if(isxdigit(*str_val)==0) { + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val); + str_val++; + minm->inner_src_mac[i] = tmp_bin_val; + } + + if(*str_val != '-'){ + printf("MAC string type error!\n"); + return -1; + } + str_val++; + + for(i = 0; i < 6; i++){ + tmp_bin_val = 0; /* ������, ������ֵ��䶼�ǻ���� */ + if(isxdigit(*str_val)==0){ + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val) << 4; + str_val++; + + if(isxdigit(*str_val)==0) { + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val); + str_val++; + minm->inner_dst_mac[i] = tmp_bin_val; + } + + if(*str_val != ','){ + printf("MAC_IN_MAC string type error!\n"); + return -1; + } + str_val++; + + for(i = 0; i < 6; i++){ + tmp_bin_val = 0; /* ������, ������ֵ��䶼�ǻ���� */ + if(isxdigit(*str_val)==0){ + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val) << 4; + str_val++; + + if(isxdigit(*str_val)==0) { + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val); + str_val++; + minm->outer_src_mac[i] = tmp_bin_val; + } + + if(*str_val != '-'){ + printf("MAC_IN_MAC string type error!\n"); + return -1; + } + str_val++; + + for(i = 0; i < 6; i++){ + tmp_bin_val = 0; /* ������, ������ֵ��䶼�ǻ���� */ + if(isxdigit(*str_val)==0){ + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val) << 4; + str_val++; + + if(isxdigit(*str_val)==0) { + printf("MAC string type error!\n"); + return -1; + } + tmp_bin_val |= MESA_ascii_to_hex(*str_val); + str_val++; + minm->outer_dst_mac[i] = tmp_bin_val; + } + + return 0; +} + +/* + region_id=1;dev_id=1;link_id=2;route_dir=0;smac=xxxxxx;dmac=xxxxx; + + ����user_region��ʽʹ��MAC-IN-MAC��ʽ�������ڲ㣬���������. + inner_smac-inner-dmac, outer_smac-outer_dmat, + 000100032202-00e0fc030007,000100032202-00e0fc030007 + +*/ +static int flwd_act_ip_user_region_parse(char *user_region, flwd_active_ip_t *act_ip) +{ + int ret; + struct layer_addr_mac_in_mac minm; + + + /* TODO + flwd_search_fwd_ip_by_gdev_ip(), ͨ��dev_id, region_id�Զ���ѯ. + */ + + +#if FLWD_RUN_IN_CEIEC_TEST + /* ��ʱ���ԣ��ֶ�д���ڲ�mac */ + //char manual_inner_smac[6] = {0x3c, 0x97, 0x0e, 0x18, 0x18, 0x41}; + //char manual_inner_smac[6] = {0xe4, 0x95, 0x6e, 0x20, 0x0d, 0x06}; + char manual_inner_smac[6] = {0x28, 0xd2, 0x44, 0x43, 0x12, 0x34}; /* ��ԾIP��SMAC */ + char manual_inner_dmac[6] = {0xe8, 0x61, 0x1f, 0x13, 0x70, 0x7a}; /* Ŀ�������MAC */ + + //inet_pton(AF_INET, "10.3.127.3", &act_ip->gdev_args.gdev_ip_net_order); + inet_pton(AF_INET, "10.1.1.1", &act_ip->gdev_args.gdev_ip_net_order); + act_ip->gdev_args.link_id = 1; /* TODO, ���ݻ�ԾIP������ȡ, ���ϲ���Ϊ1 */ + act_ip->gdev_args.this_ip_as_sip_route_dir = 1; /* TODO, ���ݻ�ԾIP������ȡ,���ϲ���Ϊ1 */ + memcpy(act_ip->gdev_args.inner_raw_smac, manual_inner_smac, 6); + memcpy(act_ip->gdev_args.inner_raw_dmac, manual_inner_dmac, 6); +#else + ret = flwd_mac_in_mac_pton(user_region, &minm); + if(ret < 0){ + return -1; + } + + memcpy(act_ip->gdev_args.inner_raw_dmac, minm.inner_dst_mac, 6); + memcpy(act_ip->gdev_args.inner_raw_smac, minm.inner_src_mac, 6); + +#endif + + return 0; +} + + +/* + �����ʽ: + ID,addr_type, protocol,ip,port,direction,user_region,location,is_valid,action,service,policy_group,op_time; + + TODO: + ����user_region��ʽ��ǰ���Ƿ���mac-in-mac��ʽ, ����ԭʼMAC��ʽδ��, ��ʹ��gdev_ip=1.1.1.1��GDEVIP������. +*/ +static void flwd_ip_static_pool_cb(int table_id, const char *table_line, void* u_para) +{ + char *stack_buf = strdup(table_line); + char *save_ptr; + char *section; + const char *delim = "\t "; + flwd_active_ip_t act_ip; + int tmp_int; + char for_log_ip_str[128]; + + memset(&act_ip, 0, sizeof(act_ip)); + + /* ID */ + section = strtok_r(stack_buf, delim, &save_ptr); + assert(section); + + /* addr_type */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + tmp_int = atoi(section); + if(4 == tmp_int){ + act_ip.active_ip_net_order.addr_type = FLWD_IP_ADDR_TYPE_V4; + act_ip.active_ip_net_order.addr_len = sizeof(int); + }else if(6 == tmp_int){ + act_ip.active_ip_net_order.addr_type = FLWD_IP_ADDR_TYPE_V6; + act_ip.active_ip_net_order.addr_len = sizeof(struct in6_addr); + }else{ + assert(0); + } + + /* protocol, �ݲ����� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + /* ip */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + if(FLWD_IP_ADDR_TYPE_V4 == act_ip.active_ip_net_order.addr_type){ + inet_pton(AF_INET, section, &act_ip.active_ip_net_order.addr_ipv4); + }else{ + inet_pton(AF_INET6, section, &act_ip.active_ip_net_order.addr_ipv6); + } + strncpy(for_log_ip_str, section, 128); + + /* port */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + tmp_int = atoi(section); + if(tmp_int < 0 || tmp_int > 65535){ + assert(0); + } + act_ip.active_ip_net_order.dport = (unsigned short)tmp_int; + + /* direction, ��GDEV�µķ���Ӧ�ö���Ŀ��IP, 0��ʾԴIP��1��ʾĿ��IP��2��ʾ˫�� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + /* user region, �洢GDEV�����Ϣ */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + if(flwd_act_ip_user_region_parse(section, &act_ip) < 0){ + goto done; + } + + /* location, */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + +#if FLWD_IP_REGION_BY_LIB + if(FLWD_IP_ADDR_TYPE_V4 == act_ip.active_ip_net_order.addr_type){ + act_ip.ip_region_type = flwd_ipv4_location(ntohl(act_ip.active_ip_net_order.addr_ipv4)); + }else{ + act_ip.ip_region_type = flwd_ipv6_location(&act_ip.active_ip_net_order.addr_ipv6); + } +#else + tmp_int = atoi(section); + if((tmp_int != FLWD_IP_REGION_INLAND) && (tmp_int != FLWD_IP_REGION_OUTLAND)){ + assert(0); + } + + act_ip.ip_region_type = (flwd_ip_region_type_t)tmp_int; +#endif + + /* is_valid */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + act_ip.is_valid = atoi(section); + + /* action, TODO, 20180910, ���ֶ��Ѿ�ɾ��!!! */ + //section = strtok_r(NULL, delim, &save_ptr); + //assert(section); + + /* service */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + /* policy group id */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + act_ip.policy_group_id = strtoul(section, NULL, 10); + + /* op_time */ + section = strtok_r(NULL, delim, &save_ptr); + //assert(section); + + act_ip.ip_origin_type = FLWD_ACT_IP_STATIC; + flwd_act_ip_update(&act_ip); + + flwd_log(10, "ip_static_pool update callback: recv ip %s, region:%d, policy_id:%u\n", + for_log_ip_str, act_ip.ip_region_type, act_ip.policy_group_id); + +done: + while(strtok_r(NULL, delim, &save_ptr)); + + free(stack_buf); + + return; +} + + +/* + �����ʽ: + ID,addr_type, protocol,ip,port,direction,user_region,location,is_valid,op_time; + + TODO: + ����user_region��ʽʹ��MAC-IN-MAC��ʽ�������ڲ㣬���������. + inner_smac-inner-dmac, outer_smac-outer_dmat, + 000100032202-00e0fc030007,000100032202-00e0fc030007 +*/ +void flwd_ip_dyn_sift_pool_cb(int table_id,const char* table_line,void* u_para) +{ + char *stack_buf = strdup(table_line); + char *save_ptr; + char *section; + const char *delim = "\t "; + flwd_active_ip_t act_ip; + int tmp_int; + char *for_log_ip_str; + + memset(&act_ip, 0, sizeof(act_ip)); + + /* ID */ + section = strtok_r(stack_buf, delim, &save_ptr); + assert(section); + + /* addr_type */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + tmp_int = atoi(section); + if(4 == tmp_int){ + act_ip.active_ip_net_order.addr_type = FLWD_IP_ADDR_TYPE_V4; + act_ip.active_ip_net_order.addr_len = sizeof(int); + }else if(6 == tmp_int){ + act_ip.active_ip_net_order.addr_type = FLWD_IP_ADDR_TYPE_V6; + act_ip.active_ip_net_order.addr_len = sizeof(struct in6_addr); + }else{ + assert(0); + } + + /* protocol, �ݲ����� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + /* ip */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + if(FLWD_IP_ADDR_TYPE_V4 == act_ip.active_ip_net_order.addr_type){ + inet_pton(AF_INET, section, &act_ip.active_ip_net_order.addr_ipv4); + }else{ + inet_pton(AF_INET6, section, &act_ip.active_ip_net_order.addr_ipv6); + } + for_log_ip_str = section; + + /* port, ��ַ�ص�PORT�ֶ������� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + tmp_int = atoi(section); + if(tmp_int < 0 || tmp_int > 65535){ + assert(0); + } + act_ip.active_ip_net_order.dport = (unsigned short)tmp_int; + + /* direction, ��GDEV�µķ���Ӧ�ö���Ŀ��IP, 0��ʾԴIP��1��ʾĿ��IP��2��ʾ˫�� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + /* user region, �ݲ����� */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + if(flwd_act_ip_user_region_parse(section, &act_ip) < 0){ + goto done; + } + + /* location, */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); +#if FLWD_IP_REGION_BY_LIB + if(FLWD_IP_ADDR_TYPE_V4 == act_ip.active_ip_net_order.addr_type){ + act_ip.ip_region_type = flwd_ipv4_location(ntohl(act_ip.active_ip_net_order.addr_ipv4)); + }else{ + act_ip.ip_region_type = flwd_ipv6_location(&act_ip.active_ip_net_order.addr_ipv6); + } +#else + tmp_int = atoi(section); + if((tmp_int != FLWD_IP_REGION_INLAND) && (tmp_int != FLWD_IP_REGION_OUTLAND)){ + assert(0); + } + + act_ip.ip_region_type = (flwd_ip_region_type_t)tmp_int; +#endif + + /* is_valid */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + act_ip.is_valid = atoi(section); + + /* op_time */ + section = strtok_r(NULL, delim, &save_ptr); + assert(section); + + act_ip.ip_origin_type = FLWD_ACT_IP_DYNAMIC; + + flwd_act_ip_update(&act_ip); + + flwd_log(10, "ip_dynamic_pool update callback: recv ip %s, region:%d\n", + for_log_ip_str, act_ip.ip_region_type); +done: + while(strtok_r(NULL, delim, &save_ptr)); /* ���strtok���� */ + + free(stack_buf); + + return; +} + + +int flwd_access_maat_init(void) +{ +#if 0 == FLWD_NO_MAAT + int ret; + + ret = flwd_maat_talbe_name_init(); + if(ret < 0){ + return -1; + } + + flwd_global_val.maat_static_handle = flwd_maat_summon(FLWD_CONFIG_FILE, "maat_static"); + if(NULL == flwd_global_val.maat_static_handle){ + return -1; + } + + flwd_global_val.maat_dynamic_handle = flwd_maat_summon(FLWD_CONFIG_FILE, "maat_dynamic"); + if(NULL == flwd_global_val.maat_dynamic_handle){ + return -1; + } + + flwd_maat_table_register(flwd_global_val.maat_static_handle, (int)FLWD_MAAT_TB_IR_POLICY_COMPILE); + flwd_maat_table_register(flwd_global_val.maat_static_handle, (int)FLWD_MAAT_TB_IR_POLICY_GROUP); + flwd_maat_table_register(flwd_global_val.maat_static_handle, (int)FLWD_MAAT_TB_IR_POLICY_IP); + flwd_maat_table_register(flwd_global_val.maat_static_handle, (int)FLWD_MAAT_TB_IR_STATIC_IP_POOL_CB); + flwd_maat_table_register(flwd_global_val.maat_dynamic_handle, (int)FLWD_MAAT_TB_IR_DYN_SIFT_IP_CB); + flwd_maat_table_register(flwd_global_val.maat_dynamic_handle, (int)FLWD_MAAT_TB_IR_DYN_CONN_IP); + + ret = Maat_table_callback_register(flwd_global_val.maat_static_handle, + flwd_global_val.maat_table_info[FLWD_MAAT_TB_IR_STATIC_IP_POOL_CB].table_id, + nouse_maat_start_cb, + flwd_ip_static_pool_cb, + nouse_maat_finish_cb, + flwd_global_val.maat_log_handle); + if(ret < 0){ + flwd_log(30, "Maat_table_callback_register %s error!\n", + flwd_global_val.maat_table_info[FLWD_MAAT_TB_IR_STATIC_IP_POOL_CB].table_name); + return -1; + } + + ret = Maat_table_callback_register(flwd_global_val.maat_dynamic_handle, + flwd_global_val.maat_table_info[FLWD_MAAT_TB_IR_DYN_SIFT_IP_CB].table_id, + nouse_maat_start_cb, + flwd_ip_dyn_sift_pool_cb, + nouse_maat_finish_cb, + flwd_global_val.maat_log_handle); + if(ret < 0){ + flwd_log(30, "Maat_table_callback_register %s error!\n", + flwd_global_val.maat_table_info[FLWD_MAAT_TB_IR_DYN_SIFT_IP_CB].table_name); + return -1; + } + +#endif + + return 0; +} + |