Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

AkhileshSamineni · 2019-09-18T14:27:30Z

Added natmgr, and intfmgr changes.

Link to NAT HLD : https://github.com/Azure/SONiC/blob/master/doc/nat/nat_design_spec.md

Depends on:
sonic-swss : #1126 and #1125
sonic-swss-common : sonic-net/sonic-swss-common#304
sonic-linux-kernel : sonic-net/sonic-linux-kernel#100
sonic-sairedis : sonic-net/sonic-sairedis#519

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

marian-pritsak · 2019-10-28T02:14:17Z

cfgmgr/intfmgr.cpp

+            {
+                FieldValueTuple t("nat_zone", nat_zone);
+                fvVector.push_back(t);
+                m_appIntfTableProducer.set(alias, fvVector);


set is at the end of outer if (!is_lo)

This set it specific to nat_zone only, so using new "fvVector" variable for it.

After resolved merge conflicts, doing set at the end of outer if(!is_lo).

marian-pritsak · 2019-10-28T02:17:34Z

cfgmgr/natmgr.cpp

+        m_cfgNatPoolTable(cfgDb, CFG_NAT_POOL_TABLE_NAME),
+        m_cfgNatBindingsTable(cfgDb, CFG_NAT_BINDINGS_TABLE_NAME),
+        m_cfgNatGlobalTable(cfgDb, CFG_NAT_GLOBAL_TABLE_NAME),
+        m_cfgInterfaceTable(cfgDb, CFG_INTF_TABLE_NAME),


intfmgr is responsible for that table

I have removed these lines, but NatMgr is also a consumer for the Interface Tables, to get the configured nat_zone value on every interface, which will be used as a mark value (zone +1 ) in iptables rules.

marian-pritsak · 2019-10-28T02:21:26Z

cfgmgr/natmgr.cpp

+        m_cfgLagInterfaceTable(cfgDb, CFG_LAG_INTF_TABLE_NAME),
+        m_cfgVlanInterfaceTable(cfgDb, CFG_VLAN_INTF_TABLE_NAME),
+        m_cfgLoopbackInterfaceTable(cfgDb, CFG_LOOPBACK_INTERFACE_TABLE_NAME),
+        m_cfgNatAclTable(cfgDb, CFG_ACL_TABLE_NAME),
+        m_cfgNatAclRuleTable(cfgDb, CFG_ACL_RULE_TABLE_NAME),


Each table has a single manager that should handle it, and these table don't belong to NAT manager.

I have removed these lines, but NatMgr is also a consumer for the Interface Tables, to get the configured nat_zone value on every interface, which will be used as a mark value (zone +1 ) in iptables rules and ACL tables as well.

marian-pritsak · 2019-10-28T02:32:52Z

cfgmgr/natmgr.cpp

+
+    /* Clean the NAT iptables */
+    std::string res;
+    const std::string cmds = std::string("") + IPTABLES_CMD + " -F -t nat ";


Why clear iptables before start?

Before the NAT application, wanted to clearing any stale nat iptables rules.

marian-pritsak · 2019-10-28T02:36:23Z

cfgmgr/natmgr.cpp

+}
+
+/* To check the give global_ip is withing the Prefix subnet or not */
+bool NatMgr::isGlobalIpMatching(const string &prefix, const string &global_ip)


This would fit as a method in IpPrefix class

Yes, will move it to IpPrefix class in next patch.

marian-pritsak · 2019-10-28T02:46:39Z

cfgmgr/natmgr.cpp

+    char ipAddr[INET_ADDRSTRLEN];
+    std::vector<swss::FieldValueTuple> values;
+
+    if (!port_range.empty() and (port_range != "NULL"))


First check if not NULL?

No, When pool is created with only Ip address, "nat_port" value is set to "NULL" string like below

root@sonic:/home/admin# config nat add pool p1 65.55.42.5
root@sonic:/home/admin# redis-cli -n 4
127.0.0.1:6379[4]> keys NA

"NAT_POOL|p1"
127.0.0.1:6379[4]> hgetall NAT_POOL|p1

"nat_port"

"NULL"

"nat_ip"

"65.55.42.5"
127.0.0.1:6379[4]> exit
root@sonic:/home/admin#

marian-pritsak · 2019-10-28T02:50:46Z

cfgmgr/natmgr.cpp

+            ipv4_addr_low = ntohl(ipv4_addr_low);
+        }
+
+        for (ip = ipv4_addr_low; ip <= ipv4_addr_high; ip++)


Why set like this and not as a range?

Here m_appNaptPoolIpTable is used by NatSyncd code to know whether the packet notified by conntrack table is NAPT'ed or NAT'ed.

For example, Create a NAT pool to do NAPT'ed like "config nat add pool p1 65.55.42.5 100-200"
If packet comes to cpu with Src Ip as 12.0.0.1 and Src port as 100, it get's SNAPT'ed to Src Ip as 65.55.42.5 and Src Port as 100, kernel picks the "100" as it is available from Pool.
So kernel doesn't set any separate flags in the conntrack entry if it is NAPT'ed. Only SNAT/DNAT flags are set in the conntrack entry that is notified to natsyncd.
When the translated port number is the same, Natsyncd will not be able to say if it is NAT'ed or NAPT'ed. So the NaptPoolIpTable is added for every IP address in the pool to help NatSyncd pick the conntrack notifications as NAPT and add them as NAPT entries in the APP_DB.

marian-pritsak

The PR is very substantial. Can you please split it by the daemon it is related to? I think it won't break it.

AkhileshSamineni · 2019-11-11T07:52:20Z

The PR is very substantial. Can you please split it by the daemon it is related to? I think it won't break it.

@marian-pritsak Yes right, Created PRs for orchanget (#1125 ) and Natsyncd (#1126 ).

lguohan · 2019-11-13T05:57:38Z

        if (inet_pton(AF_INET6, ipPrefixKeys[0].c_str(), &ipv6_addr))

we have ipaddress class in sonic swss common, can you use that?

Refers to: cfgmgr/natmgr.cpp:6628 in d7113d6. [](commit_id = d7113d6, deletion_comment = False)

AkhileshSamineni · 2019-11-20T08:33:13Z

        if (inet_pton(AF_INET6, ipPrefixKeys[0].c_str(), &ipv6_addr))
we have ipaddress class in sonic swss common, can you use that?

Refers to: cfgmgr/natmgr.cpp:6628 in d7113d6. [](commit_id = d7113d6, deletion_comment = False)

Yes, added changes to use IpAddress class here.

arlakshm

Are this pytest changes present in PR 1125. I could not fine them. Kindly confirm.

AkhileshSamineni · 2019-12-09T18:20:59Z

Are this pytest changes present in PR 1125. I could not fine them. Kindly confirm.

Added pytest changes in PR 1125.
Here is the link - 69d1b68

- Added natmgr and natorch changes. - Added nat Zone related changes. - Added Warm reboot changes. Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

… as part of PRs sonic-net#1125 and sonic-net#1126

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

AkhileshSamineni · 2019-12-10T15:42:13Z

Retest this please.

AkhileshSamineni · 2020-01-10T09:24:15Z

retest this please.

AkhileshSamineni · 2020-01-12T18:27:13Z

Retest this please.

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

…#1059) Filter fdb was wiping out IPv4 entries when both IPv4 and IPv6 are associated with VLan interface. The reason is IPv6 network was overwriting IPv4 network. This pr add support to filter both IPv4 and IPv6 addresses signed-off-by: Tamer Ahmed <tamer.ahmed@microsoft.com>

The previous regex can only match one device so that the original MACsec devices cannot been cleanup by config reload.

stcheng added the Enhancement ➕ label Sep 19, 2019

This was referenced Sep 20, 2019

Changes in sonic-buildimage to support the NAT feature sonic-net/sonic-buildimage#3494

Merged

Changes in sonic-sairedis repo to support the NAT feature. sonic-net/sonic-sairedis#519

Merged

AkhileshSamineni force-pushed the nat_changes_in_sonic branch from 816a7e2 to 45e30bf Compare October 15, 2019 10:05

marian-pritsak reviewed Oct 28, 2019

View reviewed changes

marian-pritsak requested changes Oct 28, 2019

View reviewed changes

AkhileshSamineni closed this Nov 11, 2019

AkhileshSamineni reopened this Nov 11, 2019

AkhileshSamineni changed the title ~~Changes in sonic-swss sub module to support NAT feature.~~ Natmgrd changes in sonic-swss sub module to support NAT feature. Nov 11, 2019

This was referenced Nov 11, 2019

Natsyncd changes in sonic-swss submodule to support NAT feature. #1126

Merged

Orchagent changes in sonic-swss submodule to support NAT feature. #1125

Merged

Changes in swss-utilities submodule to support NAT feature. sonic-net/sonic-utilities#645

Merged

marian-pritsak approved these changes Nov 14, 2019

View reviewed changes

arlakshm reviewed Nov 27, 2019

View reviewed changes

AkhileshSamineni added 6 commits December 10, 2019 00:47

Changes in sonic-swss submodule to support NAT feature.

4e0d0a1

- Added natmgr and natorch changes. - Added nat Zone related changes. - Added Warm reboot changes. Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Added neighsync changes to support warm reboot for NAT.

29bb539

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Loopback related changes for NAT.

b53c888

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

Removed the Orchagent and Natsyncd related files as those are covered…

fd733b8

… as part of PRs sonic-net#1125 and sonic-net#1126

Removed pytest related files and added those to PR sonic-net#1125

5b09c41

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Corrected Makefile.am change.

904e80b

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

AkhileshSamineni added 5 commits December 10, 2019 01:13

Fix for string compilation issue

d750132

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Compilation fix to pick proper ACL Table name - CFG_ACL_TABLE_TABLE_NAME

ae6eb80

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Addressed review comments

ed405bf

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Added missed check

4028803

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

Fix in cleanup.

3fcfea3

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

AkhileshSamineni force-pushed the nat_changes_in_sonic branch from 7d2c620 to 3fcfea3 Compare December 10, 2019 09:15

Fixed compilation issue after forced push.

2086ad2

Signed-off-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>

arlakshm approved these changes Dec 20, 2019

View reviewed changes

rlhui merged commit 85036df into sonic-net:master Jan 16, 2020

lguohan added a commit that referenced this pull request Jan 30, 2020

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

86aceac

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

rlhui added the request_for_201911_branch label Jan 31, 2020

abdosi added Included in 201911 Branch and removed Included in 201911 Branch labels Feb 4, 2020

abdosi pushed a commit that referenced this pull request Feb 4, 2020

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

9e9b6e4

Signed-off-by: Akhilesh Samineni akhilesh.samineni@broadcom.com

venkatmahalingam mentioned this pull request May 11, 2020

NAT mgr clears the iptables NAT rules added by other Apps during bootup #1292

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

AkhileshSamineni commented Sep 18, 2019 •

edited

Loading

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

AkhileshSamineni Nov 13, 2019

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019 •

edited

Loading

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

marian-pritsak Oct 28, 2019

AkhileshSamineni Nov 11, 2019

marian-pritsak left a comment

AkhileshSamineni commented Nov 11, 2019

lguohan commented Nov 13, 2019

AkhileshSamineni commented Nov 20, 2019

arlakshm left a comment

AkhileshSamineni commented Dec 9, 2019

AkhileshSamineni commented Dec 10, 2019

AkhileshSamineni commented Jan 10, 2020

AkhileshSamineni commented Jan 12, 2020

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

Natmgrd changes in sonic-swss sub module to support NAT feature. #1059

Conversation

AkhileshSamineni commented Sep 18, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AkhileshSamineni Nov 11, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marian-pritsak left a comment

Choose a reason for hiding this comment

AkhileshSamineni commented Nov 11, 2019

lguohan commented Nov 13, 2019

AkhileshSamineni commented Nov 20, 2019

arlakshm left a comment

Choose a reason for hiding this comment

AkhileshSamineni commented Dec 9, 2019

AkhileshSamineni commented Dec 10, 2019

AkhileshSamineni commented Jan 10, 2020

AkhileshSamineni commented Jan 12, 2020

AkhileshSamineni commented Sep 18, 2019 •

edited

Loading

AkhileshSamineni Nov 11, 2019 •

edited

Loading