test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class TestNAT44ED(VppTestCase):
  23     """ NAT44ED Test Case """
  24
  25     nat_addr = '10.0.10.3'
  26
  27     tcp_port_in = 6303
  28     tcp_port_out = 6303
  29
  30     udp_port_in = 6304
  31     udp_port_out = 6304
  32
  33     icmp_id_in = 6305
  34     icmp_id_out = 6305
  35
  36     tcp_external_port = 80
  37
  38     max_sessions = 100
  39
  40     def setUp(self):
  41         super().setUp()
  42         self.plugin_enable()
  43
  44     def tearDown(self):
  45         super().tearDown()
  46         if not self.vpp_dead:
  47             self.plugin_disable()
  48
  49     def plugin_enable(self):
  50         self.vapi.nat44_ed_plugin_enable_disable(
  51             sessions=self.max_sessions, enable=1)
  52
  53     def plugin_disable(self):
  54         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  55
  56     @property
  57     def config_flags(self):
  58         return VppEnum.vl_api_nat_config_flags_t
  59
  60     @property
  61     def nat44_config_flags(self):
  62         return VppEnum.vl_api_nat44_config_flags_t
  63
  64     @property
  65     def syslog_severity(self):
  66         return VppEnum.vl_api_syslog_severity_t
  67
  68     @property
  69     def server_addr(self):
  70         return self.pg1.remote_hosts[0].ip4
  71
  72     @staticmethod
  73     def random_port():
  74         return randint(1025, 65535)
  75
  76     @staticmethod
  77     def proto2layer(proto):
  78         if proto == IP_PROTOS.tcp:
  79             return TCP
  80         elif proto == IP_PROTOS.udp:
  81             return UDP
  82         elif proto == IP_PROTOS.icmp:
  83             return ICMP
  84         else:
  85             raise Exception("Unsupported protocol")
  86
  87     @classmethod
  88     def create_and_add_ip4_table(cls, i, table_id=0):
  89         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  90         i.set_table_ip4(table_id)
  91
  92     @classmethod
  93     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  94         if table_id:
  95             cls.create_and_add_ip4_table(i, table_id)
  96
  97         i.admin_up()
  98         i.config_ip4()
  99         i.resolve_arp()
 100
 101         if hosts:
 102             i.generate_remote_hosts(hosts)
 103             i.configure_ipv4_neighbors()
 104
 105     @classmethod
 106     def nat_add_interface_address(cls, i):
 107         cls.vapi.nat44_add_del_interface_addr(
 108             sw_if_index=i.sw_if_index, is_add=1)
 109
 110     def nat_add_inside_interface(self, i):
 111         self.vapi.nat44_interface_add_del_feature(
 112             flags=self.config_flags.NAT_IS_INSIDE,
 113             sw_if_index=i.sw_if_index, is_add=1)
 114
 115     def nat_add_outside_interface(self, i):
 116         self.vapi.nat44_interface_add_del_feature(
 117             flags=self.config_flags.NAT_IS_OUTSIDE,
 118             sw_if_index=i.sw_if_index, is_add=1)
 119
 120     def nat_add_address(self, address, twice_nat=0,
 121                         vrf_id=0xFFFFFFFF, is_add=1):
 122         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 123         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 124                                               last_ip_address=address,
 125                                               vrf_id=vrf_id,
 126                                               is_add=is_add,
 127                                               flags=flags)
 128
 129     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 130                                local_port=0, external_port=0, vrf_id=0,
 131                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 132                                proto=0, tag="", flags=0):
 133
 134         if not (local_port and external_port):
 135             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 136
 137         self.vapi.nat44_add_del_static_mapping(
 138             is_add=is_add,
 139             local_ip_address=local_ip,
 140             external_ip_address=external_ip,
 141             external_sw_if_index=external_sw_if_index,
 142             local_port=local_port,
 143             external_port=external_port,
 144             vrf_id=vrf_id, protocol=proto,
 145             flags=flags,
 146             tag=tag)
 147
 148     @classmethod
 149     def setUpClass(cls):
 150         super().setUpClass()
 151
 152         cls.create_pg_interfaces(range(12))
 153         cls.interfaces = list(cls.pg_interfaces[:4])
 154
 155         cls.create_and_add_ip4_table(cls.pg2, 10)
 156
 157         for i in cls.interfaces:
 158             cls.configure_ip4_interface(i, hosts=3)
 159
 160         # test specific (test-multiple-vrf)
 161         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 162
 163         # test specific (test-one-armed-nat44-static)
 164         cls.pg4.generate_remote_hosts(2)
 165         cls.pg4.config_ip4()
 166         cls.vapi.sw_interface_add_del_address(
 167             sw_if_index=cls.pg4.sw_if_index,
 168             prefix="10.0.0.1/24")
 169         cls.pg4.admin_up()
 170         cls.pg4.resolve_arp()
 171         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 172         cls.pg4.resolve_arp()
 173
 174         # test specific interface (pg5)
 175         cls.pg5._local_ip4 = "10.1.1.1"
 176         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 177         cls.pg5.set_table_ip4(1)
 178         cls.pg5.config_ip4()
 179         cls.pg5.admin_up()
 180         cls.pg5.resolve_arp()
 181
 182         # test specific interface (pg6)
 183         cls.pg6._local_ip4 = "10.1.2.1"
 184         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 185         cls.pg6.set_table_ip4(1)
 186         cls.pg6.config_ip4()
 187         cls.pg6.admin_up()
 188         cls.pg6.resolve_arp()
 189
 190         rl = list()
 191
 192         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 193                              [VppRoutePath("0.0.0.0", 0xffffffff,
 194                                            nh_table_id=0)],
 195                              register=False, table_id=1))
 196         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 197                              [VppRoutePath(cls.pg1.local_ip4,
 198                                            cls.pg1.sw_if_index)],
 199                              register=False))
 200         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 201                              [VppRoutePath("0.0.0.0",
 202                                            cls.pg5.sw_if_index)],
 203                              register=False, table_id=1))
 204         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 205                              [VppRoutePath("0.0.0.0",
 206                                            cls.pg6.sw_if_index)],
 207                              register=False, table_id=1))
 208         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 209                              [VppRoutePath("0.0.0.0", 0xffffffff,
 210                                            nh_table_id=1)],
 211                              register=False, table_id=0))
 212
 213         for r in rl:
 214             r.add_vpp_config()
 215
 216     def get_err_counter(self, path):
 217         return self.statistics.get_err_counter(path)
 218
 219     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 220                           host_in_port, proto=IP_PROTOS.tcp,
 221                           ignore_port=False):
 222         layer = self.proto2layer(proto)
 223
 224         if proto == IP_PROTOS.tcp:
 225             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 226         else:
 227             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 228
 229         # send packet from host to server
 230         pkts = self.create_stream_frag(self.pg0,
 231                                        self.nat_addr,
 232                                        host_in_port,
 233                                        server_out_port,
 234                                        data,
 235                                        proto)
 236         self.pg0.add_stream(pkts)
 237         self.pg_enable_capture(self.pg_interfaces)
 238         self.pg_start()
 239         frags = self.pg0.get_capture(len(pkts))
 240         p = self.reass_frags_and_verify(frags,
 241                                         self.nat_addr,
 242                                         server_addr)
 243         if proto != IP_PROTOS.icmp:
 244             if not ignore_port:
 245                 self.assertNotEqual(p[layer].sport, host_in_port)
 246             self.assertEqual(p[layer].dport, server_in_port)
 247         else:
 248             if not ignore_port:
 249                 self.assertNotEqual(p[layer].id, host_in_port)
 250         self.assertEqual(data, p[Raw].load)
 251
 252     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 253                           ignore_port=False):
 254         layer = self.proto2layer(proto)
 255
 256         if proto == IP_PROTOS.tcp:
 257             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 258         else:
 259             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 260         self.port_in = self.random_port()
 261
 262         for i in range(2):
 263             # in2out
 264             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 265                                            self.port_in, 20, data, proto)
 266             pkts.reverse()
 267             self.pg0.add_stream(pkts)
 268             self.pg_enable_capture(self.pg_interfaces)
 269             self.pg_start()
 270             frags = self.pg1.get_capture(len(pkts))
 271             if not dont_translate:
 272                 p = self.reass_frags_and_verify(frags,
 273                                                 self.nat_addr,
 274                                                 self.pg1.remote_ip4)
 275             else:
 276                 p = self.reass_frags_and_verify(frags,
 277                                                 self.pg0.remote_ip4,
 278                                                 self.pg1.remote_ip4)
 279             if proto != IP_PROTOS.icmp:
 280                 if not dont_translate:
 281                     self.assertEqual(p[layer].dport, 20)
 282                     if not ignore_port:
 283                         self.assertNotEqual(p[layer].sport, self.port_in)
 284                 else:
 285                     self.assertEqual(p[layer].sport, self.port_in)
 286             else:
 287                 if not ignore_port:
 288                     if not dont_translate:
 289                         self.assertNotEqual(p[layer].id, self.port_in)
 290                     else:
 291                         self.assertEqual(p[layer].id, self.port_in)
 292             self.assertEqual(data, p[Raw].load)
 293
 294             # out2in
 295             if not dont_translate:
 296                 dst_addr = self.nat_addr
 297             else:
 298                 dst_addr = self.pg0.remote_ip4
 299             if proto != IP_PROTOS.icmp:
 300                 sport = 20
 301                 dport = p[layer].sport
 302             else:
 303                 sport = p[layer].id
 304                 dport = 0
 305             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 306                                            data, proto, echo_reply=True)
 307             pkts.reverse()
 308             self.pg1.add_stream(pkts)
 309             self.pg_enable_capture(self.pg_interfaces)
 310             self.logger.info(self.vapi.cli("show trace"))
 311             self.pg_start()
 312             frags = self.pg0.get_capture(len(pkts))
 313             p = self.reass_frags_and_verify(frags,
 314                                             self.pg1.remote_ip4,
 315                                             self.pg0.remote_ip4)
 316             if proto != IP_PROTOS.icmp:
 317                 self.assertEqual(p[layer].sport, 20)
 318                 self.assertEqual(p[layer].dport, self.port_in)
 319             else:
 320                 self.assertEqual(p[layer].id, self.port_in)
 321             self.assertEqual(data, p[Raw].load)
 322
 323     def reass_frags_and_verify(self, frags, src, dst):
 324         buffer = BytesIO()
 325         for p in frags:
 326             self.assertEqual(p[IP].src, src)
 327             self.assertEqual(p[IP].dst, dst)
 328             self.assert_ip_checksum_valid(p)
 329             buffer.seek(p[IP].frag * 8)
 330             buffer.write(bytes(p[IP].payload))
 331         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 332                 proto=frags[0][IP].proto)
 333         if ip.proto == IP_PROTOS.tcp:
 334             p = (ip / TCP(buffer.getvalue()))
 335             self.logger.debug(ppp("Reassembled:", p))
 336             self.assert_tcp_checksum_valid(p)
 337         elif ip.proto == IP_PROTOS.udp:
 338             p = (ip / UDP(buffer.getvalue()[:8]) /
 339                  Raw(buffer.getvalue()[8:]))
 340         elif ip.proto == IP_PROTOS.icmp:
 341             p = (ip / ICMP(buffer.getvalue()))
 342         return p
 343
 344     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 345                       ignore_port=False):
 346         layer = self.proto2layer(proto)
 347
 348         if proto == IP_PROTOS.tcp:
 349             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 350         else:
 351             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 352         self.port_in = self.random_port()
 353
 354         # in2out
 355         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 356                                        self.port_in, 20, data, proto)
 357         self.pg0.add_stream(pkts)
 358         self.pg_enable_capture(self.pg_interfaces)
 359         self.pg_start()
 360         frags = self.pg1.get_capture(len(pkts))
 361         if not dont_translate:
 362             p = self.reass_frags_and_verify(frags,
 363                                             self.nat_addr,
 364                                             self.pg1.remote_ip4)
 365         else:
 366             p = self.reass_frags_and_verify(frags,
 367                                             self.pg0.remote_ip4,
 368                                             self.pg1.remote_ip4)
 369         if proto != IP_PROTOS.icmp:
 370             if not dont_translate:
 371                 self.assertEqual(p[layer].dport, 20)
 372                 if not ignore_port:
 373                     self.assertNotEqual(p[layer].sport, self.port_in)
 374             else:
 375                 self.assertEqual(p[layer].sport, self.port_in)
 376         else:
 377             if not ignore_port:
 378                 if not dont_translate:
 379                     self.assertNotEqual(p[layer].id, self.port_in)
 380                 else:
 381                     self.assertEqual(p[layer].id, self.port_in)
 382         self.assertEqual(data, p[Raw].load)
 383
 384         # out2in
 385         if not dont_translate:
 386             dst_addr = self.nat_addr
 387         else:
 388             dst_addr = self.pg0.remote_ip4
 389         if proto != IP_PROTOS.icmp:
 390             sport = 20
 391             dport = p[layer].sport
 392         else:
 393             sport = p[layer].id
 394             dport = 0
 395         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 396                                        proto, echo_reply=True)
 397         self.pg1.add_stream(pkts)
 398         self.pg_enable_capture(self.pg_interfaces)
 399         self.pg_start()
 400         frags = self.pg0.get_capture(len(pkts))
 401         p = self.reass_frags_and_verify(frags,
 402                                         self.pg1.remote_ip4,
 403                                         self.pg0.remote_ip4)
 404         if proto != IP_PROTOS.icmp:
 405             self.assertEqual(p[layer].sport, 20)
 406             self.assertEqual(p[layer].dport, self.port_in)
 407         else:
 408             self.assertEqual(p[layer].id, self.port_in)
 409         self.assertEqual(data, p[Raw].load)
 410
 411     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 412                            dst_ip=None, ignore_port=False):
 413         if nat_ip is None:
 414             nat_ip = self.nat_addr
 415         for packet in capture:
 416             try:
 417                 self.assert_packet_checksums_valid(packet)
 418                 self.assertEqual(packet[IP].src, nat_ip)
 419                 if dst_ip is not None:
 420                     self.assertEqual(packet[IP].dst, dst_ip)
 421                 if packet.haslayer(TCP):
 422                     if not ignore_port:
 423                         if same_port:
 424                             self.assertEqual(
 425                                 packet[TCP].sport, self.tcp_port_in)
 426                         else:
 427                             self.assertNotEqual(
 428                                 packet[TCP].sport, self.tcp_port_in)
 429                     self.tcp_port_out = packet[TCP].sport
 430                     self.assert_packet_checksums_valid(packet)
 431                 elif packet.haslayer(UDP):
 432                     if not ignore_port:
 433                         if same_port:
 434                             self.assertEqual(
 435                                 packet[UDP].sport, self.udp_port_in)
 436                         else:
 437                             self.assertNotEqual(
 438                                 packet[UDP].sport, self.udp_port_in)
 439                     self.udp_port_out = packet[UDP].sport
 440                 else:
 441                     if not ignore_port:
 442                         if same_port:
 443                             self.assertEqual(
 444                                 packet[ICMP].id, self.icmp_id_in)
 445                         else:
 446                             self.assertNotEqual(
 447                                 packet[ICMP].id, self.icmp_id_in)
 448                     self.icmp_id_out = packet[ICMP].id
 449                     self.assert_packet_checksums_valid(packet)
 450             except:
 451                 self.logger.error(ppp("Unexpected or invalid packet "
 452                                       "(outside network):", packet))
 453                 raise
 454
 455     def verify_capture_in(self, capture, in_if):
 456         for packet in capture:
 457             try:
 458                 self.assert_packet_checksums_valid(packet)
 459                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 460                 if packet.haslayer(TCP):
 461                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 462                 elif packet.haslayer(UDP):
 463                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 464                 else:
 465                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 466             except:
 467                 self.logger.error(ppp("Unexpected or invalid packet "
 468                                       "(inside network):", packet))
 469                 raise
 470
 471     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 472         if dst_ip is None:
 473             dst_ip = out_if.remote_ip4
 474
 475         pkts = []
 476         # TCP
 477         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 478              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 479              TCP(sport=self.tcp_port_in, dport=20))
 480         pkts.extend([p, p])
 481
 482         # UDP
 483         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 484              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 485              UDP(sport=self.udp_port_in, dport=20))
 486         pkts.append(p)
 487
 488         # ICMP
 489         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 490              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 491              ICMP(id=self.icmp_id_in, type='echo-request'))
 492         pkts.append(p)
 493
 494         return pkts
 495
 496     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 497                           use_inside_ports=False):
 498         if dst_ip is None:
 499             dst_ip = self.nat_addr
 500         if not use_inside_ports:
 501             tcp_port = self.tcp_port_out
 502             udp_port = self.udp_port_out
 503             icmp_id = self.icmp_id_out
 504         else:
 505             tcp_port = self.tcp_port_in
 506             udp_port = self.udp_port_in
 507             icmp_id = self.icmp_id_in
 508         pkts = []
 509         # TCP
 510         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 511              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 512              TCP(dport=tcp_port, sport=20))
 513         pkts.extend([p, p])
 514
 515         # UDP
 516         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 517              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 518              UDP(dport=udp_port, sport=20))
 519         pkts.append(p)
 520
 521         # ICMP
 522         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 523              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 524              ICMP(id=icmp_id, type='echo-reply'))
 525         pkts.append(p)
 526
 527         return pkts
 528
 529     def create_tcp_stream(self, in_if, out_if, count):
 530         pkts = []
 531         port = 6303
 532
 533         for i in range(count):
 534             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 535                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 536                  TCP(sport=port + i, dport=20))
 537             pkts.append(p)
 538
 539         return pkts
 540
 541     def create_stream_frag(self, src_if, dst, sport, dport, data,
 542                            proto=IP_PROTOS.tcp, echo_reply=False):
 543         if proto == IP_PROTOS.tcp:
 544             p = (IP(src=src_if.remote_ip4, dst=dst) /
 545                  TCP(sport=sport, dport=dport) /
 546                  Raw(data))
 547             p = p.__class__(scapy.compat.raw(p))
 548             chksum = p[TCP].chksum
 549             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 550         elif proto == IP_PROTOS.udp:
 551             proto_header = UDP(sport=sport, dport=dport)
 552         elif proto == IP_PROTOS.icmp:
 553             if not echo_reply:
 554                 proto_header = ICMP(id=sport, type='echo-request')
 555             else:
 556                 proto_header = ICMP(id=sport, type='echo-reply')
 557         else:
 558             raise Exception("Unsupported protocol")
 559         id = self.random_port()
 560         pkts = []
 561         if proto == IP_PROTOS.tcp:
 562             raw = Raw(data[0:4])
 563         else:
 564             raw = Raw(data[0:16])
 565         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 566              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 567              proto_header /
 568              raw)
 569         pkts.append(p)
 570         if proto == IP_PROTOS.tcp:
 571             raw = Raw(data[4:20])
 572         else:
 573             raw = Raw(data[16:32])
 574         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 575              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 576                 proto=proto) /
 577              raw)
 578         pkts.append(p)
 579         if proto == IP_PROTOS.tcp:
 580             raw = Raw(data[20:])
 581         else:
 582             raw = Raw(data[32:])
 583         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 584              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 585                 id=id) /
 586              raw)
 587         pkts.append(p)
 588         return pkts
 589
 590     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 591                                   proto=IP_PROTOS.tcp):
 592
 593         layer = self.proto2layer(proto)
 594
 595         if proto == IP_PROTOS.tcp:
 596             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 597         else:
 598             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 599         port_in = self.random_port()
 600
 601         for i in range(2):
 602             # out2in
 603             pkts = self.create_stream_frag(self.pg0, out_addr,
 604                                            port_in, out_port,
 605                                            data, proto)
 606             self.pg0.add_stream(pkts)
 607             self.pg_enable_capture(self.pg_interfaces)
 608             self.pg_start()
 609             frags = self.pg1.get_capture(len(pkts))
 610             p = self.reass_frags_and_verify(frags,
 611                                             self.pg0.remote_ip4,
 612                                             in_addr)
 613             if proto != IP_PROTOS.icmp:
 614                 self.assertEqual(p[layer].sport, port_in)
 615                 self.assertEqual(p[layer].dport, in_port)
 616             else:
 617                 self.assertEqual(p[layer].id, port_in)
 618             self.assertEqual(data, p[Raw].load)
 619
 620             # in2out
 621             if proto != IP_PROTOS.icmp:
 622                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 623                                                in_port,
 624                                                p[layer].sport, data, proto)
 625             else:
 626                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 627                                                p[layer].id, 0, data, proto,
 628                                                echo_reply=True)
 629             self.pg1.add_stream(pkts)
 630             self.pg_enable_capture(self.pg_interfaces)
 631             self.pg_start()
 632             frags = self.pg0.get_capture(len(pkts))
 633             p = self.reass_frags_and_verify(frags,
 634                                             out_addr,
 635                                             self.pg0.remote_ip4)
 636             if proto != IP_PROTOS.icmp:
 637                 self.assertEqual(p[layer].sport, out_port)
 638                 self.assertEqual(p[layer].dport, port_in)
 639             else:
 640                 self.assertEqual(p[layer].id, port_in)
 641             self.assertEqual(data, p[Raw].load)
 642
 643     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 644                                       out_port, proto=IP_PROTOS.tcp):
 645
 646         layer = self.proto2layer(proto)
 647
 648         if proto == IP_PROTOS.tcp:
 649             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 650         else:
 651             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 652         port_in = self.random_port()
 653
 654         for i in range(2):
 655             # out2in
 656             pkts = self.create_stream_frag(self.pg0, out_addr,
 657                                            port_in, out_port,
 658                                            data, proto)
 659             pkts.reverse()
 660             self.pg0.add_stream(pkts)
 661             self.pg_enable_capture(self.pg_interfaces)
 662             self.pg_start()
 663             frags = self.pg1.get_capture(len(pkts))
 664             p = self.reass_frags_and_verify(frags,
 665                                             self.pg0.remote_ip4,
 666                                             in_addr)
 667             if proto != IP_PROTOS.icmp:
 668                 self.assertEqual(p[layer].dport, in_port)
 669                 self.assertEqual(p[layer].sport, port_in)
 670                 self.assertEqual(p[layer].dport, in_port)
 671             else:
 672                 self.assertEqual(p[layer].id, port_in)
 673             self.assertEqual(data, p[Raw].load)
 674
 675             # in2out
 676             if proto != IP_PROTOS.icmp:
 677                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 678                                                in_port,
 679                                                p[layer].sport, data, proto)
 680             else:
 681                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 682                                                p[layer].id, 0, data, proto,
 683                                                echo_reply=True)
 684             pkts.reverse()
 685             self.pg1.add_stream(pkts)
 686             self.pg_enable_capture(self.pg_interfaces)
 687             self.pg_start()
 688             frags = self.pg0.get_capture(len(pkts))
 689             p = self.reass_frags_and_verify(frags,
 690                                             out_addr,
 691                                             self.pg0.remote_ip4)
 692             if proto != IP_PROTOS.icmp:
 693                 self.assertEqual(p[layer].sport, out_port)
 694                 self.assertEqual(p[layer].dport, port_in)
 695             else:
 696                 self.assertEqual(p[layer].id, port_in)
 697             self.assertEqual(data, p[Raw].load)
 698
 699     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 700         # SYN packet in->out
 701         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 702              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 703              TCP(sport=in_port, dport=ext_port, flags="S"))
 704         in_if.add_stream(p)
 705         self.pg_enable_capture(self.pg_interfaces)
 706         self.pg_start()
 707         capture = out_if.get_capture(1)
 708         p = capture[0]
 709         out_port = p[TCP].sport
 710
 711         # SYN + ACK packet out->in
 712         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 713              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 714              TCP(sport=ext_port, dport=out_port, flags="SA"))
 715         out_if.add_stream(p)
 716         self.pg_enable_capture(self.pg_interfaces)
 717         self.pg_start()
 718         in_if.get_capture(1)
 719
 720         # ACK packet in->out
 721         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 722              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 723              TCP(sport=in_port, dport=ext_port, flags="A"))
 724         in_if.add_stream(p)
 725         self.pg_enable_capture(self.pg_interfaces)
 726         self.pg_start()
 727         out_if.get_capture(1)
 728
 729         return out_port
 730
 731     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 732                          client_id=None):
 733         twice_nat_addr = '10.0.1.3'
 734
 735         port_in = 8080
 736         if lb:
 737             if not same_pg:
 738                 port_in1 = port_in
 739                 port_in2 = port_in
 740             else:
 741                 port_in1 = port_in + 1
 742                 port_in2 = port_in + 2
 743
 744         port_out = 80
 745         eh_port_out = 4567
 746
 747         server1 = self.pg0.remote_hosts[0]
 748         server2 = self.pg0.remote_hosts[1]
 749         if lb and same_pg:
 750             server2 = server1
 751         if not lb:
 752             server = server1
 753
 754         pg0 = self.pg0
 755         if same_pg:
 756             pg1 = self.pg0
 757         else:
 758             pg1 = self.pg1
 759
 760         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 761                         client_id == 1)
 762
 763         self.nat_add_address(self.nat_addr)
 764         self.nat_add_address(twice_nat_addr, twice_nat=1)
 765
 766         flags = 0
 767         if self_twice_nat:
 768             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 769         else:
 770             flags |= self.config_flags.NAT_IS_TWICE_NAT
 771
 772         if not lb:
 773             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 774                                         port_in, port_out,
 775                                         proto=IP_PROTOS.tcp,
 776                                         flags=flags)
 777         else:
 778             locals = [{'addr': server1.ip4,
 779                        'port': port_in1,
 780                        'probability': 50,
 781                        'vrf_id': 0},
 782                       {'addr': server2.ip4,
 783                        'port': port_in2,
 784                        'probability': 50,
 785                        'vrf_id': 0}]
 786             out_addr = self.nat_addr
 787
 788             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 789                                                       external_addr=out_addr,
 790                                                       external_port=port_out,
 791                                                       protocol=IP_PROTOS.tcp,
 792                                                       local_num=len(locals),
 793                                                       locals=locals)
 794         self.nat_add_inside_interface(pg0)
 795         self.nat_add_outside_interface(pg1)
 796
 797         if same_pg:
 798             if not lb:
 799                 client = server
 800             else:
 801                 assert client_id is not None
 802                 if client_id == 1:
 803                     client = self.pg0.remote_hosts[0]
 804                 elif client_id == 2:
 805                     client = self.pg0.remote_hosts[1]
 806         else:
 807             client = pg1.remote_hosts[0]
 808         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 809              IP(src=client.ip4, dst=self.nat_addr) /
 810              TCP(sport=eh_port_out, dport=port_out))
 811         pg1.add_stream(p)
 812         self.pg_enable_capture(self.pg_interfaces)
 813         self.pg_start()
 814         capture = pg0.get_capture(1)
 815         p = capture[0]
 816         try:
 817             ip = p[IP]
 818             tcp = p[TCP]
 819             if lb:
 820                 if ip.dst == server1.ip4:
 821                     server = server1
 822                     port_in = port_in1
 823                 else:
 824                     server = server2
 825                     port_in = port_in2
 826             self.assertEqual(ip.dst, server.ip4)
 827             if lb and same_pg:
 828                 self.assertIn(tcp.dport, [port_in1, port_in2])
 829             else:
 830                 self.assertEqual(tcp.dport, port_in)
 831             if eh_translate:
 832                 self.assertEqual(ip.src, twice_nat_addr)
 833                 self.assertNotEqual(tcp.sport, eh_port_out)
 834             else:
 835                 self.assertEqual(ip.src, client.ip4)
 836                 self.assertEqual(tcp.sport, eh_port_out)
 837             eh_addr_in = ip.src
 838             eh_port_in = tcp.sport
 839             saved_port_in = tcp.dport
 840             self.assert_packet_checksums_valid(p)
 841         except:
 842             self.logger.error(ppp("Unexpected or invalid packet:", p))
 843             raise
 844
 845         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 846              IP(src=server.ip4, dst=eh_addr_in) /
 847              TCP(sport=saved_port_in, dport=eh_port_in))
 848         pg0.add_stream(p)
 849         self.pg_enable_capture(self.pg_interfaces)
 850         self.pg_start()
 851         capture = pg1.get_capture(1)
 852         p = capture[0]
 853         try:
 854             ip = p[IP]
 855             tcp = p[TCP]
 856             self.assertEqual(ip.dst, client.ip4)
 857             self.assertEqual(ip.src, self.nat_addr)
 858             self.assertEqual(tcp.dport, eh_port_out)
 859             self.assertEqual(tcp.sport, port_out)
 860             self.assert_packet_checksums_valid(p)
 861         except:
 862             self.logger.error(ppp("Unexpected or invalid packet:", p))
 863             raise
 864
 865         if eh_translate:
 866             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 867             self.assertEqual(len(sessions), 1)
 868             self.assertTrue(sessions[0].flags &
 869                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 870             self.assertTrue(sessions[0].flags &
 871                             self.config_flags.NAT_IS_TWICE_NAT)
 872             self.logger.info(self.vapi.cli("show nat44 sessions"))
 873             self.vapi.nat44_del_session(
 874                 address=sessions[0].inside_ip_address,
 875                 port=sessions[0].inside_port,
 876                 protocol=sessions[0].protocol,
 877                 flags=(self.config_flags.NAT_IS_INSIDE |
 878                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 879                 ext_host_address=sessions[0].ext_host_nat_address,
 880                 ext_host_port=sessions[0].ext_host_nat_port)
 881             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 882             self.assertEqual(len(sessions), 0)
 883
 884     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 885         message = data.decode('utf-8')
 886         try:
 887             message = SyslogMessage.parse(message)
 888         except ParseError as e:
 889             self.logger.error(e)
 890             raise
 891         else:
 892             self.assertEqual(message.severity, SyslogSeverity.info)
 893             self.assertEqual(message.appname, 'NAT')
 894             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 895             sd_params = message.sd.get('nsess')
 896             self.assertTrue(sd_params is not None)
 897             if is_ip6:
 898                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 899                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 900             else:
 901                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 902                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 903                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 904             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 905             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 906             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 907             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 908             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 909             self.assertEqual(sd_params.get('SVLAN'), '0')
 910             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 911             self.assertEqual(sd_params.get('XDPORT'),
 912                              "%d" % self.tcp_external_port)
 913
 914     def test_icmp_error(self):
 915         """ NAT44ED test ICMP error message with inner header"""
 916
 917         payload = "H" * 10
 918
 919         self.nat_add_address(self.nat_addr)
 920         self.nat_add_inside_interface(self.pg0)
 921         self.nat_add_outside_interface(self.pg1)
 922
 923         # in2out (initiate connection)
 924         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 925               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 926               UDP(sport=21, dport=20) / payload)
 927
 928         self.pg0.add_stream(p1)
 929         self.pg_enable_capture(self.pg_interfaces)
 930         self.pg_start()
 931         capture = self.pg1.get_capture(1)[0]
 932
 933         # out2in (send error message)
 934         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 935               IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
 936               ICMP(type='dest-unreach', code='port-unreachable') /
 937               capture[IP:])
 938
 939         self.pg1.add_stream(p2)
 940         self.pg_enable_capture(self.pg_interfaces)
 941         self.pg_start()
 942
 943         capture = self.pg0.get_capture(1)[0]
 944
 945         self.logger.info(ppp("p1 packet:", p1))
 946         self.logger.info(ppp("p2 packet:", p2))
 947         self.logger.info(ppp("capture packet:", capture))
 948
 949     def test_icmp_echo_reply_trailer(self):
 950         """ ICMP echo reply with ethernet trailer"""
 951
 952         self.nat_add_address(self.nat_addr)
 953         self.nat_add_inside_interface(self.pg0)
 954         self.nat_add_outside_interface(self.pg1)
 955
 956         # in2out
 957         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 958               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 959               ICMP(type=8, id=0xabcd, seq=0))
 960
 961         self.pg0.add_stream(p1)
 962         self.pg_enable_capture(self.pg_interfaces)
 963         self.pg_start()
 964         c = self.pg1.get_capture(1)[0]
 965
 966         self.logger.debug(self.vapi.cli("show trace"))
 967
 968         # out2in
 969         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 970               IP(src=self.pg1.remote_ip4, dst=self.nat_addr, id=0xee59) /
 971               ICMP(type=0, id=c[ICMP].id, seq=0))
 972
 973         # force checksum calculation
 974         p2 = p2.__class__(bytes(p2))
 975
 976         self.logger.debug(ppp("Packet before modification:", p2))
 977
 978         # hex representation of vss monitoring ethernet trailer
 979         # this seems to be just added to end of packet without modifying
 980         # IP or ICMP lengths / checksums
 981         p2 = p2 / Raw("\x00\x00\x52\x54\x00\x46\xab\x04\x84\x18")
 982         # change it so that IP/ICMP is unaffected
 983         p2[IP].len = 28
 984
 985         self.logger.debug(ppp("Packet with added trailer:", p2))
 986
 987         self.pg1.add_stream(p2)
 988         self.pg_enable_capture(self.pg_interfaces)
 989         self.pg_start()
 990
 991         self.pg0.get_capture(1)
 992
 993     def test_users_dump(self):
 994         """ NAT44ED API test - nat44_user_dump """
 995
 996         self.nat_add_address(self.nat_addr)
 997         self.nat_add_inside_interface(self.pg0)
 998         self.nat_add_outside_interface(self.pg1)
 999
1000         self.vapi.nat44_forwarding_enable_disable(enable=1)
1001
1002         local_ip = self.pg0.remote_ip4
1003         external_ip = self.nat_addr
1004         self.nat_add_static_mapping(local_ip, external_ip)
1005
1006         users = self.vapi.nat44_user_dump()
1007         self.assertEqual(len(users), 0)
1008
1009         # in2out - static mapping match
1010
1011         pkts = self.create_stream_out(self.pg1)
1012         self.pg1.add_stream(pkts)
1013         self.pg_enable_capture(self.pg_interfaces)
1014         self.pg_start()
1015         capture = self.pg0.get_capture(len(pkts))
1016         self.verify_capture_in(capture, self.pg0)
1017
1018         pkts = self.create_stream_in(self.pg0, self.pg1)
1019         self.pg0.add_stream(pkts)
1020         self.pg_enable_capture(self.pg_interfaces)
1021         self.pg_start()
1022         capture = self.pg1.get_capture(len(pkts))
1023         self.verify_capture_out(capture, same_port=True)
1024
1025         users = self.vapi.nat44_user_dump()
1026         self.assertEqual(len(users), 1)
1027         static_user = users[0]
1028         self.assertEqual(static_user.nstaticsessions, 3)
1029         self.assertEqual(static_user.nsessions, 0)
1030
1031         # in2out - no static mapping match (forwarding test)
1032
1033         host0 = self.pg0.remote_hosts[0]
1034         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1035         try:
1036             pkts = self.create_stream_out(self.pg1,
1037                                           dst_ip=self.pg0.remote_ip4,
1038                                           use_inside_ports=True)
1039             self.pg1.add_stream(pkts)
1040             self.pg_enable_capture(self.pg_interfaces)
1041             self.pg_start()
1042             capture = self.pg0.get_capture(len(pkts))
1043             self.verify_capture_in(capture, self.pg0)
1044
1045             pkts = self.create_stream_in(self.pg0, self.pg1)
1046             self.pg0.add_stream(pkts)
1047             self.pg_enable_capture(self.pg_interfaces)
1048             self.pg_start()
1049             capture = self.pg1.get_capture(len(pkts))
1050             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1051                                     same_port=True)
1052         finally:
1053             self.pg0.remote_hosts[0] = host0
1054
1055         users = self.vapi.nat44_user_dump()
1056         self.assertEqual(len(users), 2)
1057         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1058             non_static_user = users[1]
1059             static_user = users[0]
1060         else:
1061             non_static_user = users[0]
1062             static_user = users[1]
1063         self.assertEqual(static_user.nstaticsessions, 3)
1064         self.assertEqual(static_user.nsessions, 0)
1065         self.assertEqual(non_static_user.nstaticsessions, 0)
1066         self.assertEqual(non_static_user.nsessions, 3)
1067
1068         users = self.vapi.nat44_user_dump()
1069         self.assertEqual(len(users), 2)
1070         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1071             non_static_user = users[1]
1072             static_user = users[0]
1073         else:
1074             non_static_user = users[0]
1075             static_user = users[1]
1076         self.assertEqual(static_user.nstaticsessions, 3)
1077         self.assertEqual(static_user.nsessions, 0)
1078         self.assertEqual(non_static_user.nstaticsessions, 0)
1079         self.assertEqual(non_static_user.nsessions, 3)
1080
1081     def test_frag_out_of_order_do_not_translate(self):
1082         """ NAT44ED don't translate fragments arriving out of order """
1083         self.nat_add_inside_interface(self.pg0)
1084         self.nat_add_outside_interface(self.pg1)
1085         self.vapi.nat44_forwarding_enable_disable(enable=True)
1086         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1087
1088     def test_forwarding(self):
1089         """ NAT44ED forwarding test """
1090
1091         self.nat_add_inside_interface(self.pg0)
1092         self.nat_add_outside_interface(self.pg1)
1093         self.vapi.nat44_forwarding_enable_disable(enable=1)
1094
1095         real_ip = self.pg0.remote_ip4
1096         alias_ip = self.nat_addr
1097         flags = self.config_flags.NAT_IS_ADDR_ONLY
1098         self.vapi.nat44_add_del_static_mapping(is_add=1,
1099                                                local_ip_address=real_ip,
1100                                                external_ip_address=alias_ip,
1101                                                external_sw_if_index=0xFFFFFFFF,
1102                                                flags=flags)
1103
1104         try:
1105             # in2out - static mapping match
1106
1107             pkts = self.create_stream_out(self.pg1)
1108             self.pg1.add_stream(pkts)
1109             self.pg_enable_capture(self.pg_interfaces)
1110             self.pg_start()
1111             capture = self.pg0.get_capture(len(pkts))
1112             self.verify_capture_in(capture, self.pg0)
1113
1114             pkts = self.create_stream_in(self.pg0, self.pg1)
1115             self.pg0.add_stream(pkts)
1116             self.pg_enable_capture(self.pg_interfaces)
1117             self.pg_start()
1118             capture = self.pg1.get_capture(len(pkts))
1119             self.verify_capture_out(capture, same_port=True)
1120
1121             # in2out - no static mapping match
1122
1123             host0 = self.pg0.remote_hosts[0]
1124             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1125             try:
1126                 pkts = self.create_stream_out(self.pg1,
1127                                               dst_ip=self.pg0.remote_ip4,
1128                                               use_inside_ports=True)
1129                 self.pg1.add_stream(pkts)
1130                 self.pg_enable_capture(self.pg_interfaces)
1131                 self.pg_start()
1132                 capture = self.pg0.get_capture(len(pkts))
1133                 self.verify_capture_in(capture, self.pg0)
1134
1135                 pkts = self.create_stream_in(self.pg0, self.pg1)
1136                 self.pg0.add_stream(pkts)
1137                 self.pg_enable_capture(self.pg_interfaces)
1138                 self.pg_start()
1139                 capture = self.pg1.get_capture(len(pkts))
1140                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1141                                         same_port=True)
1142             finally:
1143                 self.pg0.remote_hosts[0] = host0
1144
1145             user = self.pg0.remote_hosts[1]
1146             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1147             self.assertEqual(len(sessions), 3)
1148             self.assertTrue(sessions[0].flags &
1149                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1150             self.vapi.nat44_del_session(
1151                 address=sessions[0].inside_ip_address,
1152                 port=sessions[0].inside_port,
1153                 protocol=sessions[0].protocol,
1154                 flags=(self.config_flags.NAT_IS_INSIDE |
1155                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1156                 ext_host_address=sessions[0].ext_host_address,
1157                 ext_host_port=sessions[0].ext_host_port)
1158             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1159             self.assertEqual(len(sessions), 2)
1160
1161         finally:
1162             self.vapi.nat44_forwarding_enable_disable(enable=0)
1163             flags = self.config_flags.NAT_IS_ADDR_ONLY
1164             self.vapi.nat44_add_del_static_mapping(
1165                 is_add=0,
1166                 local_ip_address=real_ip,
1167                 external_ip_address=alias_ip,
1168                 external_sw_if_index=0xFFFFFFFF,
1169                 flags=flags)
1170
1171     def test_output_feature_and_service2(self):
1172         """ NAT44ED interface output feature and service host direct access """
1173         self.vapi.nat44_forwarding_enable_disable(enable=1)
1174         self.nat_add_address(self.nat_addr)
1175
1176         self.vapi.nat44_interface_add_del_output_feature(
1177             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1178
1179         # session initiated from service host - translate
1180         pkts = self.create_stream_in(self.pg0, self.pg1)
1181         self.pg0.add_stream(pkts)
1182         self.pg_enable_capture(self.pg_interfaces)
1183         self.pg_start()
1184         capture = self.pg1.get_capture(len(pkts))
1185         self.verify_capture_out(capture, ignore_port=True)
1186
1187         pkts = self.create_stream_out(self.pg1)
1188         self.pg1.add_stream(pkts)
1189         self.pg_enable_capture(self.pg_interfaces)
1190         self.pg_start()
1191         capture = self.pg0.get_capture(len(pkts))
1192         self.verify_capture_in(capture, self.pg0)
1193
1194         # session initiated from remote host - do not translate
1195         tcp_port_in = self.tcp_port_in
1196         udp_port_in = self.udp_port_in
1197         icmp_id_in = self.icmp_id_in
1198
1199         self.tcp_port_in = 60303
1200         self.udp_port_in = 60304
1201         self.icmp_id_in = 60305
1202
1203         try:
1204             pkts = self.create_stream_out(self.pg1,
1205                                           self.pg0.remote_ip4,
1206                                           use_inside_ports=True)
1207             self.pg1.add_stream(pkts)
1208             self.pg_enable_capture(self.pg_interfaces)
1209             self.pg_start()
1210             capture = self.pg0.get_capture(len(pkts))
1211             self.verify_capture_in(capture, self.pg0)
1212
1213             pkts = self.create_stream_in(self.pg0, self.pg1)
1214             self.pg0.add_stream(pkts)
1215             self.pg_enable_capture(self.pg_interfaces)
1216             self.pg_start()
1217             capture = self.pg1.get_capture(len(pkts))
1218             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1219                                     same_port=True)
1220         finally:
1221             self.tcp_port_in = tcp_port_in
1222             self.udp_port_in = udp_port_in
1223             self.icmp_id_in = icmp_id_in
1224
1225     def test_twice_nat(self):
1226         """ NAT44ED Twice NAT """
1227         self.twice_nat_common()
1228
1229     def test_self_twice_nat_positive(self):
1230         """ NAT44ED Self Twice NAT (positive test) """
1231         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1232
1233     def test_self_twice_nat_lb_positive(self):
1234         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1235         """
1236         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1237                               client_id=1)
1238
1239     def test_twice_nat_lb(self):
1240         """ NAT44ED Twice NAT local service load balancing """
1241         self.twice_nat_common(lb=True)
1242
1243     def test_output_feature(self):
1244         """ NAT44ED interface output feature (in2out postrouting) """
1245         self.vapi.nat44_forwarding_enable_disable(enable=1)
1246         self.nat_add_address(self.nat_addr)
1247
1248         self.nat_add_outside_interface(self.pg0)
1249         self.vapi.nat44_interface_add_del_output_feature(
1250             sw_if_index=self.pg1.sw_if_index, is_add=1)
1251
1252         # in2out
1253         pkts = self.create_stream_in(self.pg0, self.pg1)
1254         self.pg0.add_stream(pkts)
1255         self.pg_enable_capture(self.pg_interfaces)
1256         self.pg_start()
1257         capture = self.pg1.get_capture(len(pkts))
1258         self.verify_capture_out(capture, ignore_port=True)
1259         self.logger.debug(self.vapi.cli("show trace"))
1260
1261         # out2in
1262         pkts = self.create_stream_out(self.pg1)
1263         self.pg1.add_stream(pkts)
1264         self.pg_enable_capture(self.pg_interfaces)
1265         self.pg_start()
1266         capture = self.pg0.get_capture(len(pkts))
1267         self.verify_capture_in(capture, self.pg0)
1268         self.logger.debug(self.vapi.cli("show trace"))
1269
1270         # in2out
1271         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1272         self.pg0.add_stream(pkts)
1273         self.pg_enable_capture(self.pg_interfaces)
1274         self.pg_start()
1275         capture = self.pg1.get_capture(len(pkts))
1276         self.verify_capture_out(capture, ignore_port=True)
1277         self.logger.debug(self.vapi.cli("show trace"))
1278
1279         # out2in
1280         pkts = self.create_stream_out(self.pg1, ttl=2)
1281         self.pg1.add_stream(pkts)
1282         self.pg_enable_capture(self.pg_interfaces)
1283         self.pg_start()
1284         capture = self.pg0.get_capture(len(pkts))
1285         self.verify_capture_in(capture, self.pg0)
1286         self.logger.debug(self.vapi.cli("show trace"))
1287
1288         # in2out
1289         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1290         self.pg0.add_stream(pkts)
1291         self.pg_enable_capture(self.pg_interfaces)
1292         self.pg_start()
1293         capture = self.pg0.get_capture(len(pkts))
1294         for p in capture:
1295             self.assertIn(ICMP, p)
1296             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1297
1298     def test_static_with_port_out2(self):
1299         """ NAT44ED 1:1 NAPT asymmetrical rule """
1300
1301         external_port = 80
1302         local_port = 8080
1303
1304         self.vapi.nat44_forwarding_enable_disable(enable=1)
1305         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1306         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1307                                     local_port, external_port,
1308                                     proto=IP_PROTOS.tcp, flags=flags)
1309
1310         self.nat_add_inside_interface(self.pg0)
1311         self.nat_add_outside_interface(self.pg1)
1312
1313         # from client to service
1314         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1315              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1316              TCP(sport=12345, dport=external_port))
1317         self.pg1.add_stream(p)
1318         self.pg_enable_capture(self.pg_interfaces)
1319         self.pg_start()
1320         capture = self.pg0.get_capture(1)
1321         p = capture[0]
1322         try:
1323             ip = p[IP]
1324             tcp = p[TCP]
1325             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1326             self.assertEqual(tcp.dport, local_port)
1327             self.assert_packet_checksums_valid(p)
1328         except:
1329             self.logger.error(ppp("Unexpected or invalid packet:", p))
1330             raise
1331
1332         # ICMP error
1333         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1334              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1335              ICMP(type=11) / capture[0][IP])
1336         self.pg0.add_stream(p)
1337         self.pg_enable_capture(self.pg_interfaces)
1338         self.pg_start()
1339         capture = self.pg1.get_capture(1)
1340         p = capture[0]
1341         try:
1342             self.assertEqual(p[IP].src, self.nat_addr)
1343             inner = p[IPerror]
1344             self.assertEqual(inner.dst, self.nat_addr)
1345             self.assertEqual(inner[TCPerror].dport, external_port)
1346         except:
1347             self.logger.error(ppp("Unexpected or invalid packet:", p))
1348             raise
1349
1350         # from service back to client
1351         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1352              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1353              TCP(sport=local_port, dport=12345))
1354         self.pg0.add_stream(p)
1355         self.pg_enable_capture(self.pg_interfaces)
1356         self.pg_start()
1357         capture = self.pg1.get_capture(1)
1358         p = capture[0]
1359         try:
1360             ip = p[IP]
1361             tcp = p[TCP]
1362             self.assertEqual(ip.src, self.nat_addr)
1363             self.assertEqual(tcp.sport, external_port)
1364             self.assert_packet_checksums_valid(p)
1365         except:
1366             self.logger.error(ppp("Unexpected or invalid packet:", p))
1367             raise
1368
1369         # ICMP error
1370         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1371              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1372              ICMP(type=11) / capture[0][IP])
1373         self.pg1.add_stream(p)
1374         self.pg_enable_capture(self.pg_interfaces)
1375         self.pg_start()
1376         capture = self.pg0.get_capture(1)
1377         p = capture[0]
1378         try:
1379             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1380             inner = p[IPerror]
1381             self.assertEqual(inner.src, self.pg0.remote_ip4)
1382             self.assertEqual(inner[TCPerror].sport, local_port)
1383         except:
1384             self.logger.error(ppp("Unexpected or invalid packet:", p))
1385             raise
1386
1387         # from client to server (no translation)
1388         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1389              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1390              TCP(sport=12346, dport=local_port))
1391         self.pg1.add_stream(p)
1392         self.pg_enable_capture(self.pg_interfaces)
1393         self.pg_start()
1394         capture = self.pg0.get_capture(1)
1395         p = capture[0]
1396         try:
1397             ip = p[IP]
1398             tcp = p[TCP]
1399             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1400             self.assertEqual(tcp.dport, local_port)
1401             self.assert_packet_checksums_valid(p)
1402         except:
1403             self.logger.error(ppp("Unexpected or invalid packet:", p))
1404             raise
1405
1406         # from service back to client (no translation)
1407         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1408              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1409              TCP(sport=local_port, dport=12346))
1410         self.pg0.add_stream(p)
1411         self.pg_enable_capture(self.pg_interfaces)
1412         self.pg_start()
1413         capture = self.pg1.get_capture(1)
1414         p = capture[0]
1415         try:
1416             ip = p[IP]
1417             tcp = p[TCP]
1418             self.assertEqual(ip.src, self.pg0.remote_ip4)
1419             self.assertEqual(tcp.sport, local_port)
1420             self.assert_packet_checksums_valid(p)
1421         except:
1422             self.logger.error(ppp("Unexpected or invalid packet:", p))
1423             raise
1424
1425     def test_static_lb(self):
1426         """ NAT44ED local service load balancing """
1427         external_addr_n = self.nat_addr
1428         external_port = 80
1429         local_port = 8080
1430         server1 = self.pg0.remote_hosts[0]
1431         server2 = self.pg0.remote_hosts[1]
1432
1433         locals = [{'addr': server1.ip4,
1434                    'port': local_port,
1435                    'probability': 70,
1436                    'vrf_id': 0},
1437                   {'addr': server2.ip4,
1438                    'port': local_port,
1439                    'probability': 30,
1440                    'vrf_id': 0}]
1441
1442         self.nat_add_address(self.nat_addr)
1443         self.vapi.nat44_add_del_lb_static_mapping(
1444             is_add=1,
1445             external_addr=external_addr_n,
1446             external_port=external_port,
1447             protocol=IP_PROTOS.tcp,
1448             local_num=len(locals),
1449             locals=locals)
1450         flags = self.config_flags.NAT_IS_INSIDE
1451         self.vapi.nat44_interface_add_del_feature(
1452             sw_if_index=self.pg0.sw_if_index,
1453             flags=flags, is_add=1)
1454         self.vapi.nat44_interface_add_del_feature(
1455             sw_if_index=self.pg1.sw_if_index,
1456             is_add=1)
1457
1458         # from client to service
1459         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1460              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1461              TCP(sport=12345, dport=external_port))
1462         self.pg1.add_stream(p)
1463         self.pg_enable_capture(self.pg_interfaces)
1464         self.pg_start()
1465         capture = self.pg0.get_capture(1)
1466         p = capture[0]
1467         server = None
1468         try:
1469             ip = p[IP]
1470             tcp = p[TCP]
1471             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1472             if ip.dst == server1.ip4:
1473                 server = server1
1474             else:
1475                 server = server2
1476             self.assertEqual(tcp.dport, local_port)
1477             self.assert_packet_checksums_valid(p)
1478         except:
1479             self.logger.error(ppp("Unexpected or invalid packet:", p))
1480             raise
1481
1482         # from service back to client
1483         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1484              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1485              TCP(sport=local_port, dport=12345))
1486         self.pg0.add_stream(p)
1487         self.pg_enable_capture(self.pg_interfaces)
1488         self.pg_start()
1489         capture = self.pg1.get_capture(1)
1490         p = capture[0]
1491         try:
1492             ip = p[IP]
1493             tcp = p[TCP]
1494             self.assertEqual(ip.src, self.nat_addr)
1495             self.assertEqual(tcp.sport, external_port)
1496             self.assert_packet_checksums_valid(p)
1497         except:
1498             self.logger.error(ppp("Unexpected or invalid packet:", p))
1499             raise
1500
1501         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1502         self.assertEqual(len(sessions), 1)
1503         self.assertTrue(sessions[0].flags &
1504                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1505         self.vapi.nat44_del_session(
1506             address=sessions[0].inside_ip_address,
1507             port=sessions[0].inside_port,
1508             protocol=sessions[0].protocol,
1509             flags=(self.config_flags.NAT_IS_INSIDE |
1510                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1511             ext_host_address=sessions[0].ext_host_address,
1512             ext_host_port=sessions[0].ext_host_port)
1513         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1514         self.assertEqual(len(sessions), 0)
1515
1516     def test_static_lb_2(self):
1517         """ NAT44ED local service load balancing (asymmetrical rule) """
1518         external_addr = self.nat_addr
1519         external_port = 80
1520         local_port = 8080
1521         server1 = self.pg0.remote_hosts[0]
1522         server2 = self.pg0.remote_hosts[1]
1523
1524         locals = [{'addr': server1.ip4,
1525                    'port': local_port,
1526                    'probability': 70,
1527                    'vrf_id': 0},
1528                   {'addr': server2.ip4,
1529                    'port': local_port,
1530                    'probability': 30,
1531                    'vrf_id': 0}]
1532
1533         self.vapi.nat44_forwarding_enable_disable(enable=1)
1534         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1535         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1536                                                   external_addr=external_addr,
1537                                                   external_port=external_port,
1538                                                   protocol=IP_PROTOS.tcp,
1539                                                   local_num=len(locals),
1540                                                   locals=locals)
1541         flags = self.config_flags.NAT_IS_INSIDE
1542         self.vapi.nat44_interface_add_del_feature(
1543             sw_if_index=self.pg0.sw_if_index,
1544             flags=flags, is_add=1)
1545         self.vapi.nat44_interface_add_del_feature(
1546             sw_if_index=self.pg1.sw_if_index,
1547             is_add=1)
1548
1549         # from client to service
1550         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1551              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1552              TCP(sport=12345, dport=external_port))
1553         self.pg1.add_stream(p)
1554         self.pg_enable_capture(self.pg_interfaces)
1555         self.pg_start()
1556         capture = self.pg0.get_capture(1)
1557         p = capture[0]
1558         server = None
1559         try:
1560             ip = p[IP]
1561             tcp = p[TCP]
1562             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1563             if ip.dst == server1.ip4:
1564                 server = server1
1565             else:
1566                 server = server2
1567             self.assertEqual(tcp.dport, local_port)
1568             self.assert_packet_checksums_valid(p)
1569         except:
1570             self.logger.error(ppp("Unexpected or invalid packet:", p))
1571             raise
1572
1573         # from service back to client
1574         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1575              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1576              TCP(sport=local_port, dport=12345))
1577         self.pg0.add_stream(p)
1578         self.pg_enable_capture(self.pg_interfaces)
1579         self.pg_start()
1580         capture = self.pg1.get_capture(1)
1581         p = capture[0]
1582         try:
1583             ip = p[IP]
1584             tcp = p[TCP]
1585             self.assertEqual(ip.src, self.nat_addr)
1586             self.assertEqual(tcp.sport, external_port)
1587             self.assert_packet_checksums_valid(p)
1588         except:
1589             self.logger.error(ppp("Unexpected or invalid packet:", p))
1590             raise
1591
1592         # from client to server (no translation)
1593         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1594              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1595              TCP(sport=12346, dport=local_port))
1596         self.pg1.add_stream(p)
1597         self.pg_enable_capture(self.pg_interfaces)
1598         self.pg_start()
1599         capture = self.pg0.get_capture(1)
1600         p = capture[0]
1601         server = None
1602         try:
1603             ip = p[IP]
1604             tcp = p[TCP]
1605             self.assertEqual(ip.dst, server1.ip4)
1606             self.assertEqual(tcp.dport, local_port)
1607             self.assert_packet_checksums_valid(p)
1608         except:
1609             self.logger.error(ppp("Unexpected or invalid packet:", p))
1610             raise
1611
1612         # from service back to client (no translation)
1613         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1614              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1615              TCP(sport=local_port, dport=12346))
1616         self.pg0.add_stream(p)
1617         self.pg_enable_capture(self.pg_interfaces)
1618         self.pg_start()
1619         capture = self.pg1.get_capture(1)
1620         p = capture[0]
1621         try:
1622             ip = p[IP]
1623             tcp = p[TCP]
1624             self.assertEqual(ip.src, server1.ip4)
1625             self.assertEqual(tcp.sport, local_port)
1626             self.assert_packet_checksums_valid(p)
1627         except:
1628             self.logger.error(ppp("Unexpected or invalid packet:", p))
1629             raise
1630
1631     def test_lb_affinity(self):
1632         """ NAT44ED local service load balancing affinity """
1633         external_addr = self.nat_addr
1634         external_port = 80
1635         local_port = 8080
1636         server1 = self.pg0.remote_hosts[0]
1637         server2 = self.pg0.remote_hosts[1]
1638
1639         locals = [{'addr': server1.ip4,
1640                    'port': local_port,
1641                    'probability': 50,
1642                    'vrf_id': 0},
1643                   {'addr': server2.ip4,
1644                    'port': local_port,
1645                    'probability': 50,
1646                    'vrf_id': 0}]
1647
1648         self.nat_add_address(self.nat_addr)
1649         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1650                                                   external_addr=external_addr,
1651                                                   external_port=external_port,
1652                                                   protocol=IP_PROTOS.tcp,
1653                                                   affinity=10800,
1654                                                   local_num=len(locals),
1655                                                   locals=locals)
1656         flags = self.config_flags.NAT_IS_INSIDE
1657         self.vapi.nat44_interface_add_del_feature(
1658             sw_if_index=self.pg0.sw_if_index,
1659             flags=flags, is_add=1)
1660         self.vapi.nat44_interface_add_del_feature(
1661             sw_if_index=self.pg1.sw_if_index,
1662             is_add=1)
1663
1664         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1665              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1666              TCP(sport=1025, dport=external_port))
1667         self.pg1.add_stream(p)
1668         self.pg_enable_capture(self.pg_interfaces)
1669         self.pg_start()
1670         capture = self.pg0.get_capture(1)
1671         backend = capture[0][IP].dst
1672
1673         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1674         self.assertEqual(len(sessions), 1)
1675         self.assertTrue(sessions[0].flags &
1676                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1677         self.vapi.nat44_del_session(
1678             address=sessions[0].inside_ip_address,
1679             port=sessions[0].inside_port,
1680             protocol=sessions[0].protocol,
1681             flags=(self.config_flags.NAT_IS_INSIDE |
1682                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1683             ext_host_address=sessions[0].ext_host_address,
1684             ext_host_port=sessions[0].ext_host_port)
1685
1686         pkts = []
1687         for port in range(1030, 1100):
1688             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1689                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1690                  TCP(sport=port, dport=external_port))
1691             pkts.append(p)
1692         self.pg1.add_stream(pkts)
1693         self.pg_enable_capture(self.pg_interfaces)
1694         self.pg_start()
1695         capture = self.pg0.get_capture(len(pkts))
1696         for p in capture:
1697             self.assertEqual(p[IP].dst, backend)
1698
1699     def test_multiple_vrf_1(self):
1700         """ Multiple VRF - both client & service in VRF1 """
1701
1702         external_addr = '1.2.3.4'
1703         external_port = 80
1704         local_port = 8080
1705         port = 0
1706
1707         flags = self.config_flags.NAT_IS_INSIDE
1708         self.vapi.nat44_interface_add_del_feature(
1709             sw_if_index=self.pg5.sw_if_index,
1710             is_add=1)
1711         self.vapi.nat44_interface_add_del_feature(
1712             sw_if_index=self.pg5.sw_if_index,
1713             is_add=1, flags=flags)
1714         self.vapi.nat44_interface_add_del_feature(
1715             sw_if_index=self.pg6.sw_if_index,
1716             is_add=1)
1717         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1718         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1719                                     local_port, external_port, vrf_id=1,
1720                                     proto=IP_PROTOS.tcp, flags=flags)
1721
1722         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1723              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1724              TCP(sport=12345, dport=external_port))
1725         self.pg6.add_stream(p)
1726         self.pg_enable_capture(self.pg_interfaces)
1727         self.pg_start()
1728         capture = self.pg5.get_capture(1)
1729         p = capture[0]
1730         try:
1731             ip = p[IP]
1732             tcp = p[TCP]
1733             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1734             self.assertEqual(tcp.dport, local_port)
1735             self.assert_packet_checksums_valid(p)
1736         except:
1737             self.logger.error(ppp("Unexpected or invalid packet:", p))
1738             raise
1739
1740         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1741              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1742              TCP(sport=local_port, dport=12345))
1743         self.pg5.add_stream(p)
1744         self.pg_enable_capture(self.pg_interfaces)
1745         self.pg_start()
1746         capture = self.pg6.get_capture(1)
1747         p = capture[0]
1748         try:
1749             ip = p[IP]
1750             tcp = p[TCP]
1751             self.assertEqual(ip.src, external_addr)
1752             self.assertEqual(tcp.sport, external_port)
1753             self.assert_packet_checksums_valid(p)
1754         except:
1755             self.logger.error(ppp("Unexpected or invalid packet:", p))
1756             raise
1757
1758     def test_multiple_vrf_2(self):
1759         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1760
1761         external_addr = '1.2.3.4'
1762         external_port = 80
1763         local_port = 8080
1764         port = 0
1765
1766         self.nat_add_address(self.nat_addr)
1767         flags = self.config_flags.NAT_IS_INSIDE
1768         self.vapi.nat44_interface_add_del_output_feature(
1769             sw_if_index=self.pg1.sw_if_index,
1770             is_add=1)
1771         self.vapi.nat44_interface_add_del_feature(
1772             sw_if_index=self.pg5.sw_if_index,
1773             is_add=1)
1774         self.vapi.nat44_interface_add_del_feature(
1775             sw_if_index=self.pg5.sw_if_index,
1776             is_add=1, flags=flags)
1777         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1778         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1779                                     local_port, external_port, vrf_id=1,
1780                                     proto=IP_PROTOS.tcp, flags=flags)
1781
1782         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1783              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1784              TCP(sport=2345, dport=22))
1785         self.pg5.add_stream(p)
1786         self.pg_enable_capture(self.pg_interfaces)
1787         self.pg_start()
1788         capture = self.pg1.get_capture(1)
1789         p = capture[0]
1790         try:
1791             ip = p[IP]
1792             tcp = p[TCP]
1793             self.assertEqual(ip.src, self.nat_addr)
1794             self.assert_packet_checksums_valid(p)
1795             port = tcp.sport
1796         except:
1797             self.logger.error(ppp("Unexpected or invalid packet:", p))
1798             raise
1799
1800         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1801              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1802              TCP(sport=22, dport=port))
1803         self.pg1.add_stream(p)
1804         self.pg_enable_capture(self.pg_interfaces)
1805         self.pg_start()
1806         capture = self.pg5.get_capture(1)
1807         p = capture[0]
1808         try:
1809             ip = p[IP]
1810             tcp = p[TCP]
1811             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1812             self.assertEqual(tcp.dport, 2345)
1813             self.assert_packet_checksums_valid(p)
1814         except:
1815             self.logger.error(ppp("Unexpected or invalid packet:", p))
1816             raise
1817
1818     def test_multiple_vrf_3(self):
1819         """ Multiple VRF - client in VRF1, service in VRF0 """
1820
1821         external_addr = '1.2.3.4'
1822         external_port = 80
1823         local_port = 8080
1824         port = 0
1825
1826         flags = self.config_flags.NAT_IS_INSIDE
1827         self.vapi.nat44_interface_add_del_feature(
1828             sw_if_index=self.pg0.sw_if_index,
1829             is_add=1)
1830         self.vapi.nat44_interface_add_del_feature(
1831             sw_if_index=self.pg0.sw_if_index,
1832             is_add=1, flags=flags)
1833         self.vapi.nat44_interface_add_del_feature(
1834             sw_if_index=self.pg6.sw_if_index,
1835             is_add=1)
1836         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1837         self.nat_add_static_mapping(
1838             self.pg0.remote_ip4,
1839             external_sw_if_index=self.pg0.sw_if_index,
1840             local_port=local_port,
1841             vrf_id=0,
1842             external_port=external_port,
1843             proto=IP_PROTOS.tcp,
1844             flags=flags
1845         )
1846
1847         # from client VRF1 to service VRF0
1848         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1849              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1850              TCP(sport=12346, dport=external_port))
1851         self.pg6.add_stream(p)
1852         self.pg_enable_capture(self.pg_interfaces)
1853         self.pg_start()
1854         capture = self.pg0.get_capture(1)
1855         p = capture[0]
1856         try:
1857             ip = p[IP]
1858             tcp = p[TCP]
1859             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1860             self.assertEqual(tcp.dport, local_port)
1861             self.assert_packet_checksums_valid(p)
1862         except:
1863             self.logger.error(ppp("Unexpected or invalid packet:", p))
1864             raise
1865
1866         # from service VRF0 back to client VRF1
1867         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1868              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1869              TCP(sport=local_port, dport=12346))
1870         self.pg0.add_stream(p)
1871         self.pg_enable_capture(self.pg_interfaces)
1872         self.pg_start()
1873         capture = self.pg6.get_capture(1)
1874         p = capture[0]
1875         try:
1876             ip = p[IP]
1877             tcp = p[TCP]
1878             self.assertEqual(ip.src, self.pg0.local_ip4)
1879             self.assertEqual(tcp.sport, external_port)
1880             self.assert_packet_checksums_valid(p)
1881         except:
1882             self.logger.error(ppp("Unexpected or invalid packet:", p))
1883             raise
1884
1885     def test_multiple_vrf_4(self):
1886         """ Multiple VRF - client in VRF0, service in VRF1 """
1887
1888         external_addr = '1.2.3.4'
1889         external_port = 80
1890         local_port = 8080
1891         port = 0
1892
1893         flags = self.config_flags.NAT_IS_INSIDE
1894         self.vapi.nat44_interface_add_del_feature(
1895             sw_if_index=self.pg0.sw_if_index,
1896             is_add=1)
1897         self.vapi.nat44_interface_add_del_feature(
1898             sw_if_index=self.pg0.sw_if_index,
1899             is_add=1, flags=flags)
1900         self.vapi.nat44_interface_add_del_feature(
1901             sw_if_index=self.pg5.sw_if_index,
1902             is_add=1)
1903         self.vapi.nat44_interface_add_del_feature(
1904             sw_if_index=self.pg5.sw_if_index,
1905             is_add=1, flags=flags)
1906         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1907         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1908                                     local_port, external_port, vrf_id=1,
1909                                     proto=IP_PROTOS.tcp, flags=flags)
1910
1911         # from client VRF0 to service VRF1
1912         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1913              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1914              TCP(sport=12347, dport=external_port))
1915         self.pg0.add_stream(p)
1916         self.pg_enable_capture(self.pg_interfaces)
1917         self.pg_start()
1918         capture = self.pg5.get_capture(1)
1919         p = capture[0]
1920         try:
1921             ip = p[IP]
1922             tcp = p[TCP]
1923             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1924             self.assertEqual(tcp.dport, local_port)
1925             self.assert_packet_checksums_valid(p)
1926         except:
1927             self.logger.error(ppp("Unexpected or invalid packet:", p))
1928             raise
1929
1930         # from service VRF1 back to client VRF0
1931         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1932              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1933              TCP(sport=local_port, dport=12347))
1934         self.pg5.add_stream(p)
1935         self.pg_enable_capture(self.pg_interfaces)
1936         self.pg_start()
1937         capture = self.pg0.get_capture(1)
1938         p = capture[0]
1939         try:
1940             ip = p[IP]
1941             tcp = p[TCP]
1942             self.assertEqual(ip.src, external_addr)
1943             self.assertEqual(tcp.sport, external_port)
1944             self.assert_packet_checksums_valid(p)
1945         except:
1946             self.logger.error(ppp("Unexpected or invalid packet:", p))
1947             raise
1948
1949     def test_multiple_vrf_5(self):
1950         """ Multiple VRF - forwarding - no translation """
1951
1952         external_addr = '1.2.3.4'
1953         external_port = 80
1954         local_port = 8080
1955         port = 0
1956
1957         self.vapi.nat44_forwarding_enable_disable(enable=1)
1958         flags = self.config_flags.NAT_IS_INSIDE
1959         self.vapi.nat44_interface_add_del_feature(
1960             sw_if_index=self.pg0.sw_if_index,
1961             is_add=1)
1962         self.vapi.nat44_interface_add_del_feature(
1963             sw_if_index=self.pg0.sw_if_index,
1964             is_add=1, flags=flags)
1965         self.vapi.nat44_interface_add_del_feature(
1966             sw_if_index=self.pg5.sw_if_index,
1967             is_add=1)
1968         self.vapi.nat44_interface_add_del_feature(
1969             sw_if_index=self.pg5.sw_if_index,
1970             is_add=1, flags=flags)
1971         self.vapi.nat44_interface_add_del_feature(
1972             sw_if_index=self.pg6.sw_if_index,
1973             is_add=1)
1974         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1975         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1976                                     local_port, external_port, vrf_id=1,
1977                                     proto=IP_PROTOS.tcp, flags=flags)
1978         self.nat_add_static_mapping(
1979             self.pg0.remote_ip4,
1980             external_sw_if_index=self.pg0.sw_if_index,
1981             local_port=local_port,
1982             vrf_id=0,
1983             external_port=external_port,
1984             proto=IP_PROTOS.tcp,
1985             flags=flags
1986         )
1987
1988         # from client to server (both VRF1, no translation)
1989         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1990              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1991              TCP(sport=12348, dport=local_port))
1992         self.pg6.add_stream(p)
1993         self.pg_enable_capture(self.pg_interfaces)
1994         self.pg_start()
1995         capture = self.pg5.get_capture(1)
1996         p = capture[0]
1997         try:
1998             ip = p[IP]
1999             tcp = p[TCP]
2000             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2001             self.assertEqual(tcp.dport, local_port)
2002             self.assert_packet_checksums_valid(p)
2003         except:
2004             self.logger.error(ppp("Unexpected or invalid packet:", p))
2005             raise
2006
2007         # from server back to client (both VRF1, no translation)
2008         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2009              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
2010              TCP(sport=local_port, dport=12348))
2011         self.pg5.add_stream(p)
2012         self.pg_enable_capture(self.pg_interfaces)
2013         self.pg_start()
2014         capture = self.pg6.get_capture(1)
2015         p = capture[0]
2016         try:
2017             ip = p[IP]
2018             tcp = p[TCP]
2019             self.assertEqual(ip.src, self.pg5.remote_ip4)
2020             self.assertEqual(tcp.sport, local_port)
2021             self.assert_packet_checksums_valid(p)
2022         except:
2023             self.logger.error(ppp("Unexpected or invalid packet:", p))
2024             raise
2025
2026         # from client VRF1 to server VRF0 (no translation)
2027         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2028              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2029              TCP(sport=local_port, dport=12349))
2030         self.pg0.add_stream(p)
2031         self.pg_enable_capture(self.pg_interfaces)
2032         self.pg_start()
2033         capture = self.pg6.get_capture(1)
2034         p = capture[0]
2035         try:
2036             ip = p[IP]
2037             tcp = p[TCP]
2038             self.assertEqual(ip.src, self.pg0.remote_ip4)
2039             self.assertEqual(tcp.sport, local_port)
2040             self.assert_packet_checksums_valid(p)
2041         except:
2042             self.logger.error(ppp("Unexpected or invalid packet:", p))
2043             raise
2044
2045         # from server VRF0 back to client VRF1 (no translation)
2046         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2047              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2048              TCP(sport=local_port, dport=12349))
2049         self.pg0.add_stream(p)
2050         self.pg_enable_capture(self.pg_interfaces)
2051         self.pg_start()
2052         capture = self.pg6.get_capture(1)
2053         p = capture[0]
2054         try:
2055             ip = p[IP]
2056             tcp = p[TCP]
2057             self.assertEqual(ip.src, self.pg0.remote_ip4)
2058             self.assertEqual(tcp.sport, local_port)
2059             self.assert_packet_checksums_valid(p)
2060         except:
2061             self.logger.error(ppp("Unexpected or invalid packet:", p))
2062             raise
2063
2064         # from client VRF0 to server VRF1 (no translation)
2065         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2066              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
2067              TCP(sport=12344, dport=local_port))
2068         self.pg0.add_stream(p)
2069         self.pg_enable_capture(self.pg_interfaces)
2070         self.pg_start()
2071         capture = self.pg5.get_capture(1)
2072         p = capture[0]
2073         try:
2074             ip = p[IP]
2075             tcp = p[TCP]
2076             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2077             self.assertEqual(tcp.dport, local_port)
2078             self.assert_packet_checksums_valid(p)
2079         except:
2080             self.logger.error(ppp("Unexpected or invalid packet:", p))
2081             raise
2082
2083         # from server VRF1 back to client VRF0 (no translation)
2084         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2085              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2086              TCP(sport=local_port, dport=12344))
2087         self.pg5.add_stream(p)
2088         self.pg_enable_capture(self.pg_interfaces)
2089         self.pg_start()
2090         capture = self.pg0.get_capture(1)
2091         p = capture[0]
2092         try:
2093             ip = p[IP]
2094             tcp = p[TCP]
2095             self.assertEqual(ip.src, self.pg5.remote_ip4)
2096             self.assertEqual(tcp.sport, local_port)
2097             self.assert_packet_checksums_valid(p)
2098         except:
2099             self.logger.error(ppp("Unexpected or invalid packet:", p))
2100             raise
2101
2102     def test_outside_address_distribution(self):
2103         """ Outside address distribution based on source address """
2104
2105         x = 100
2106         nat_addresses = []
2107
2108         for i in range(1, x):
2109             a = "10.0.0.%d" % i
2110             nat_addresses.append(a)
2111
2112         self.nat_add_inside_interface(self.pg0)
2113         self.nat_add_outside_interface(self.pg1)
2114
2115         self.vapi.nat44_add_del_address_range(
2116             first_ip_address=nat_addresses[0],
2117             last_ip_address=nat_addresses[-1],
2118             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2119
2120         self.pg0.generate_remote_hosts(x)
2121
2122         pkts = []
2123         for i in range(x):
2124             info = self.create_packet_info(self.pg0, self.pg1)
2125             payload = self.info_to_payload(info)
2126             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2127                  IP(src=self.pg0.remote_hosts[i].ip4,
2128                      dst=self.pg1.remote_ip4) /
2129                  UDP(sport=7000+i, dport=8000+i) /
2130                  Raw(payload))
2131             info.data = p
2132             pkts.append(p)
2133
2134         self.pg0.add_stream(pkts)
2135         self.pg_enable_capture(self.pg_interfaces)
2136         self.pg_start()
2137         recvd = self.pg1.get_capture(len(pkts))
2138         for p_recvd in recvd:
2139             payload_info = self.payload_to_info(p_recvd[Raw])
2140             packet_index = payload_info.index
2141             info = self._packet_infos[packet_index]
2142             self.assertTrue(info is not None)
2143             self.assertEqual(packet_index, info.index)
2144             p_sent = info.data
2145             packed = socket.inet_aton(p_sent[IP].src)
2146             numeric = struct.unpack("!L", packed)[0]
2147             numeric = socket.htonl(numeric)
2148             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2149             self.assertEqual(
2150                 a, p_recvd[IP].src,
2151                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2152                 % (p_sent[IP].src, p_recvd[IP].src, a))
2153
2154
2155 class TestNAT44EDMW(TestNAT44ED):
2156     """ NAT44ED MW Test Case """
2157     vpp_worker_count = 4
2158     max_sessions = 5000
2159
2160     def test_dynamic(self):
2161         """ NAT44ED dynamic translation test """
2162         pkt_count = 1500
2163         tcp_port_offset = 20
2164         udp_port_offset = 20
2165         icmp_id_offset = 20
2166
2167         self.nat_add_address(self.nat_addr)
2168         self.nat_add_inside_interface(self.pg0)
2169         self.nat_add_outside_interface(self.pg1)
2170
2171         # in2out
2172         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2173         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2174         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2175         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2176
2177         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2178
2179         for i in range(pkt_count):
2180             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2181                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2182                  TCP(sport=tcp_port_offset + i, dport=20))
2183             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2184
2185             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2186                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2187                  UDP(sport=udp_port_offset + i, dport=20))
2188             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2189
2190             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2191                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2192                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2193             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2194
2195         for i in range(0, self.vpp_worker_count):
2196             if len(i2o_pkts[i]) > 0:
2197                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2198
2199         self.pg_enable_capture(self.pg_interfaces)
2200         self.pg_start()
2201         capture = self.pg1.get_capture(pkt_count * 3, timeout=5)
2202
2203         if_idx = self.pg0.sw_if_index
2204         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2205         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2206         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2207         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2208
2209         self.assertEqual(
2210             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2211         self.assertEqual(
2212             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2213         self.assertEqual(
2214             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2215         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2216
2217         self.logger.info(self.vapi.cli("show trace"))
2218
2219         # out2in
2220         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2221         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2222         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2223         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2224
2225         recvd_tcp_ports = set()
2226         recvd_udp_ports = set()
2227         recvd_icmp_ids = set()
2228
2229         for p in capture:
2230             if TCP in p:
2231                 recvd_tcp_ports.add(p[TCP].sport)
2232             if UDP in p:
2233                 recvd_udp_ports.add(p[UDP].sport)
2234             if ICMP in p:
2235                 recvd_icmp_ids.add(p[ICMP].id)
2236
2237         recvd_tcp_ports = list(recvd_tcp_ports)
2238         recvd_udp_ports = list(recvd_udp_ports)
2239         recvd_icmp_ids = list(recvd_icmp_ids)
2240
2241         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2242         for i in range(pkt_count):
2243             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2244                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2245                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2246             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2247
2248             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2249                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2250                  UDP(dport=choice(recvd_udp_ports), sport=20))
2251             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2252
2253             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2254                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2255                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2256             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2257
2258         for i in range(0, self.vpp_worker_count):
2259             if len(o2i_pkts[i]) > 0:
2260                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2261
2262         self.pg_enable_capture(self.pg_interfaces)
2263         self.pg_start()
2264         capture = self.pg0.get_capture(pkt_count * 3)
2265         for packet in capture:
2266             try:
2267                 self.assert_packet_checksums_valid(packet)
2268                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2269                 if packet.haslayer(TCP):
2270                     self.assert_in_range(
2271                         packet[TCP].dport, tcp_port_offset,
2272                         tcp_port_offset + pkt_count, "dst TCP port")
2273                 elif packet.haslayer(UDP):
2274                     self.assert_in_range(
2275                         packet[UDP].dport, udp_port_offset,
2276                         udp_port_offset + pkt_count, "dst UDP port")
2277                 else:
2278                     self.assert_in_range(
2279                         packet[ICMP].id, icmp_id_offset,
2280                         icmp_id_offset + pkt_count, "ICMP id")
2281             except:
2282                 self.logger.error(ppp("Unexpected or invalid packet "
2283                                       "(inside network):", packet))
2284                 raise
2285
2286         if_idx = self.pg1.sw_if_index
2287         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2288         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2289         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2290         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2291
2292         self.assertEqual(
2293             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2294         self.assertEqual(
2295             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2296         self.assertEqual(
2297             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2298         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2299
2300         sc = self.statistics['/nat44-ed/total-sessions']
2301         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2302                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2303
2304     def test_frag_in_order(self):
2305         """ NAT44ED translate fragments arriving in order """
2306
2307         self.nat_add_address(self.nat_addr)
2308         self.nat_add_inside_interface(self.pg0)
2309         self.nat_add_outside_interface(self.pg1)
2310
2311         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2312         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2313         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2314
2315     def test_frag_in_order_do_not_translate(self):
2316         """ NAT44ED don't translate fragments arriving in order """
2317
2318         self.nat_add_address(self.nat_addr)
2319         self.nat_add_inside_interface(self.pg0)
2320         self.nat_add_outside_interface(self.pg1)
2321         self.vapi.nat44_forwarding_enable_disable(enable=True)
2322
2323         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2324
2325     def test_frag_out_of_order(self):
2326         """ NAT44ED translate fragments arriving out of order """
2327
2328         self.nat_add_address(self.nat_addr)
2329         self.nat_add_inside_interface(self.pg0)
2330         self.nat_add_outside_interface(self.pg1)
2331
2332         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2333         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2334         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2335
2336     def test_frag_in_order_in_plus_out(self):
2337         """ NAT44ED in+out interface fragments in order """
2338
2339         in_port = self.random_port()
2340         out_port = self.random_port()
2341
2342         self.nat_add_address(self.nat_addr)
2343         self.nat_add_inside_interface(self.pg0)
2344         self.nat_add_outside_interface(self.pg0)
2345         self.nat_add_inside_interface(self.pg1)
2346         self.nat_add_outside_interface(self.pg1)
2347
2348         # add static mappings for server
2349         self.nat_add_static_mapping(self.server_addr,
2350                                     self.nat_addr,
2351                                     in_port,
2352                                     out_port,
2353                                     proto=IP_PROTOS.tcp)
2354         self.nat_add_static_mapping(self.server_addr,
2355                                     self.nat_addr,
2356                                     in_port,
2357                                     out_port,
2358                                     proto=IP_PROTOS.udp)
2359         self.nat_add_static_mapping(self.server_addr,
2360                                     self.nat_addr,
2361                                     proto=IP_PROTOS.icmp)
2362
2363         # run tests for each protocol
2364         self.frag_in_order_in_plus_out(self.server_addr,
2365                                        self.nat_addr,
2366                                        in_port,
2367                                        out_port,
2368                                        IP_PROTOS.tcp)
2369         self.frag_in_order_in_plus_out(self.server_addr,
2370                                        self.nat_addr,
2371                                        in_port,
2372                                        out_port,
2373                                        IP_PROTOS.udp)
2374         self.frag_in_order_in_plus_out(self.server_addr,
2375                                        self.nat_addr,
2376                                        in_port,
2377                                        out_port,
2378                                        IP_PROTOS.icmp)
2379
2380     def test_frag_out_of_order_in_plus_out(self):
2381         """ NAT44ED in+out interface fragments out of order """
2382
2383         in_port = self.random_port()
2384         out_port = self.random_port()
2385
2386         self.nat_add_address(self.nat_addr)
2387         self.nat_add_inside_interface(self.pg0)
2388         self.nat_add_outside_interface(self.pg0)
2389         self.nat_add_inside_interface(self.pg1)
2390         self.nat_add_outside_interface(self.pg1)
2391
2392         # add static mappings for server
2393         self.nat_add_static_mapping(self.server_addr,
2394                                     self.nat_addr,
2395                                     in_port,
2396                                     out_port,
2397                                     proto=IP_PROTOS.tcp)
2398         self.nat_add_static_mapping(self.server_addr,
2399                                     self.nat_addr,
2400                                     in_port,
2401                                     out_port,
2402                                     proto=IP_PROTOS.udp)
2403         self.nat_add_static_mapping(self.server_addr,
2404                                     self.nat_addr,
2405                                     proto=IP_PROTOS.icmp)
2406
2407         # run tests for each protocol
2408         self.frag_out_of_order_in_plus_out(self.server_addr,
2409                                            self.nat_addr,
2410                                            in_port,
2411                                            out_port,
2412                                            IP_PROTOS.tcp)
2413         self.frag_out_of_order_in_plus_out(self.server_addr,
2414                                            self.nat_addr,
2415                                            in_port,
2416                                            out_port,
2417                                            IP_PROTOS.udp)
2418         self.frag_out_of_order_in_plus_out(self.server_addr,
2419                                            self.nat_addr,
2420                                            in_port,
2421                                            out_port,
2422                                            IP_PROTOS.icmp)
2423
2424     def test_reass_hairpinning(self):
2425         """ NAT44ED fragments hairpinning """
2426
2427         server_addr = self.pg0.remote_hosts[1].ip4
2428
2429         host_in_port = self.random_port()
2430         server_in_port = self.random_port()
2431         server_out_port = self.random_port()
2432
2433         self.nat_add_address(self.nat_addr)
2434         self.nat_add_inside_interface(self.pg0)
2435         self.nat_add_outside_interface(self.pg1)
2436
2437         # add static mapping for server
2438         self.nat_add_static_mapping(server_addr, self.nat_addr,
2439                                     server_in_port, server_out_port,
2440                                     proto=IP_PROTOS.tcp)
2441         self.nat_add_static_mapping(server_addr, self.nat_addr,
2442                                     server_in_port, server_out_port,
2443                                     proto=IP_PROTOS.udp)
2444         self.nat_add_static_mapping(server_addr, self.nat_addr)
2445
2446         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2447                                host_in_port, proto=IP_PROTOS.tcp,
2448                                ignore_port=True)
2449         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2450                                host_in_port, proto=IP_PROTOS.udp,
2451                                ignore_port=True)
2452         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2453                                host_in_port, proto=IP_PROTOS.icmp,
2454                                ignore_port=True)
2455
2456     def test_session_limit_per_vrf(self):
2457         """ NAT44ED per vrf session limit """
2458
2459         inside = self.pg0
2460         inside_vrf10 = self.pg2
2461         outside = self.pg1
2462
2463         limit = 5
2464
2465         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2466         # non existing vrf_id makes process core dump
2467         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2468
2469         self.nat_add_inside_interface(inside)
2470         self.nat_add_inside_interface(inside_vrf10)
2471         self.nat_add_outside_interface(outside)
2472
2473         # vrf independent
2474         self.nat_add_interface_address(outside)
2475
2476         # BUG: causing core dump - when bad vrf_id is specified
2477         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2478
2479         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2480         inside_vrf10.add_stream(stream)
2481
2482         self.pg_enable_capture(self.pg_interfaces)
2483         self.pg_start()
2484
2485         capture = outside.get_capture(limit)
2486
2487         stream = self.create_tcp_stream(inside, outside, limit * 2)
2488         inside.add_stream(stream)
2489
2490         self.pg_enable_capture(self.pg_interfaces)
2491         self.pg_start()
2492
2493         capture = outside.get_capture(len(stream))
2494
2495     def test_show_max_translations(self):
2496         """ NAT44ED API test - max translations per thread """
2497         nat_config = self.vapi.nat_show_config_2()
2498         self.assertEqual(self.max_sessions,
2499                          nat_config.max_translations_per_thread)
2500
2501     def test_lru_cleanup(self):
2502         """ NAT44ED LRU cleanup algorithm """
2503
2504         self.nat_add_address(self.nat_addr)
2505         self.nat_add_inside_interface(self.pg0)
2506         self.nat_add_outside_interface(self.pg1)
2507
2508         self.vapi.nat_set_timeouts(
2509             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2510
2511         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2512         pkts = []
2513         for i in range(0, self.max_sessions - 1):
2514             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2515                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2516                  UDP(sport=7000+i, dport=80))
2517             pkts.append(p)
2518
2519         self.pg0.add_stream(pkts)
2520         self.pg_enable_capture(self.pg_interfaces)
2521         self.pg_start()
2522         self.pg1.get_capture(len(pkts))
2523         self.virtual_sleep(1.5, "wait for timeouts")
2524
2525         pkts = []
2526         for i in range(0, self.max_sessions - 1):
2527             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2528                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2529                  ICMP(id=8000+i, type='echo-request'))
2530             pkts.append(p)
2531
2532         self.pg0.add_stream(pkts)
2533         self.pg_enable_capture(self.pg_interfaces)
2534         self.pg_start()
2535         self.pg1.get_capture(len(pkts))
2536
2537     def test_session_rst_timeout(self):
2538         """ NAT44ED session RST timeouts """
2539
2540         self.nat_add_address(self.nat_addr)
2541         self.nat_add_inside_interface(self.pg0)
2542         self.nat_add_outside_interface(self.pg1)
2543
2544         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2545                                    tcp_transitory=5, icmp=60)
2546
2547         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2548                               self.tcp_external_port)
2549         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2550              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2551              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2552                  flags="R"))
2553         self.pg0.add_stream(p)
2554         self.pg_enable_capture(self.pg_interfaces)
2555         self.pg_start()
2556         self.pg1.get_capture(1)
2557
2558         self.virtual_sleep(6)
2559
2560         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2561              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2562              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2563                  flags="S"))
2564         self.pg0.add_stream(p)
2565         self.pg_enable_capture(self.pg_interfaces)
2566         self.pg_start()
2567         self.pg1.get_capture(1)
2568
2569     def test_dynamic_out_of_ports(self):
2570         """ NAT44ED dynamic translation test: out of ports """
2571
2572         self.nat_add_inside_interface(self.pg0)
2573         self.nat_add_outside_interface(self.pg1)
2574
2575         # in2out and no NAT addresses added
2576         err_old = self.statistics.get_err_counter(
2577             '/err/nat44-ed-in2out-slowpath/out of ports')
2578
2579         pkts = self.create_stream_in(self.pg0, self.pg1)
2580         self.pg0.add_stream(pkts)
2581         self.pg_enable_capture(self.pg_interfaces)
2582         self.pg_start()
2583         self.pg1.get_capture(0, timeout=1)
2584
2585         err_new = self.statistics.get_err_counter(
2586             '/err/nat44-ed-in2out-slowpath/out of ports')
2587
2588         self.assertEqual(err_new - err_old, len(pkts))
2589
2590         # in2out after NAT addresses added
2591         self.nat_add_address(self.nat_addr)
2592
2593         err_old = self.statistics.get_err_counter(
2594             '/err/nat44-ed-in2out-slowpath/out of ports')
2595
2596         pkts = self.create_stream_in(self.pg0, self.pg1)
2597         self.pg0.add_stream(pkts)
2598         self.pg_enable_capture(self.pg_interfaces)
2599         self.pg_start()
2600         capture = self.pg1.get_capture(len(pkts))
2601         self.verify_capture_out(capture, ignore_port=True)
2602
2603         err_new = self.statistics.get_err_counter(
2604             '/err/nat44-ed-in2out-slowpath/out of ports')
2605
2606         self.assertEqual(err_new, err_old)
2607
2608     def test_unknown_proto(self):
2609         """ NAT44ED translate packet with unknown protocol """
2610
2611         self.nat_add_address(self.nat_addr)
2612         self.nat_add_inside_interface(self.pg0)
2613         self.nat_add_outside_interface(self.pg1)
2614
2615         # in2out
2616         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2617              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2618              TCP(sport=self.tcp_port_in, dport=20))
2619         self.pg0.add_stream(p)
2620         self.pg_enable_capture(self.pg_interfaces)
2621         self.pg_start()
2622         p = self.pg1.get_capture(1)
2623
2624         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2625              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2626              GRE() /
2627              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2628              TCP(sport=1234, dport=1234))
2629         self.pg0.add_stream(p)
2630         self.pg_enable_capture(self.pg_interfaces)
2631         self.pg_start()
2632         p = self.pg1.get_capture(1)
2633         packet = p[0]
2634         try:
2635             self.assertEqual(packet[IP].src, self.nat_addr)
2636             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2637             self.assertEqual(packet.haslayer(GRE), 1)
2638             self.assert_packet_checksums_valid(packet)
2639         except:
2640             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2641             raise
2642
2643         # out2in
2644         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2645              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2646              GRE() /
2647              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2648              TCP(sport=1234, dport=1234))
2649         self.pg1.add_stream(p)
2650         self.pg_enable_capture(self.pg_interfaces)
2651         self.pg_start()
2652         p = self.pg0.get_capture(1)
2653         packet = p[0]
2654         try:
2655             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2656             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2657             self.assertEqual(packet.haslayer(GRE), 1)
2658             self.assert_packet_checksums_valid(packet)
2659         except:
2660             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2661             raise
2662
2663     def test_hairpinning_unknown_proto(self):
2664         """ NAT44ED translate packet with unknown protocol - hairpinning """
2665         host = self.pg0.remote_hosts[0]
2666         server = self.pg0.remote_hosts[1]
2667         host_in_port = 1234
2668         server_out_port = 8765
2669         server_nat_ip = "10.0.0.11"
2670
2671         self.nat_add_address(self.nat_addr)
2672         self.nat_add_inside_interface(self.pg0)
2673         self.nat_add_outside_interface(self.pg1)
2674
2675         # add static mapping for server
2676         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2677
2678         # host to server
2679         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2680              IP(src=host.ip4, dst=server_nat_ip) /
2681              TCP(sport=host_in_port, dport=server_out_port))
2682         self.pg0.add_stream(p)
2683         self.pg_enable_capture(self.pg_interfaces)
2684         self.pg_start()
2685         self.pg0.get_capture(1)
2686
2687         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2688              IP(src=host.ip4, dst=server_nat_ip) /
2689              GRE() /
2690              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2691              TCP(sport=1234, dport=1234))
2692         self.pg0.add_stream(p)
2693         self.pg_enable_capture(self.pg_interfaces)
2694         self.pg_start()
2695         p = self.pg0.get_capture(1)
2696         packet = p[0]
2697         try:
2698             self.assertEqual(packet[IP].src, self.nat_addr)
2699             self.assertEqual(packet[IP].dst, server.ip4)
2700             self.assertEqual(packet.haslayer(GRE), 1)
2701             self.assert_packet_checksums_valid(packet)
2702         except:
2703             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2704             raise
2705
2706         # server to host
2707         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2708              IP(src=server.ip4, dst=self.nat_addr) /
2709              GRE() /
2710              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2711              TCP(sport=1234, dport=1234))
2712         self.pg0.add_stream(p)
2713         self.pg_enable_capture(self.pg_interfaces)
2714         self.pg_start()
2715         p = self.pg0.get_capture(1)
2716         packet = p[0]
2717         try:
2718             self.assertEqual(packet[IP].src, server_nat_ip)
2719             self.assertEqual(packet[IP].dst, host.ip4)
2720             self.assertEqual(packet.haslayer(GRE), 1)
2721             self.assert_packet_checksums_valid(packet)
2722         except:
2723             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2724             raise
2725
2726     def test_output_feature_and_service(self):
2727         """ NAT44ED interface output feature and services """
2728         external_addr = '1.2.3.4'
2729         external_port = 80
2730         local_port = 8080
2731
2732         self.vapi.nat44_forwarding_enable_disable(enable=1)
2733         self.nat_add_address(self.nat_addr)
2734         flags = self.config_flags.NAT_IS_ADDR_ONLY
2735         self.vapi.nat44_add_del_identity_mapping(
2736             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2737             flags=flags, is_add=1)
2738         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2739         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2740                                     local_port, external_port,
2741                                     proto=IP_PROTOS.tcp, flags=flags)
2742
2743         self.nat_add_inside_interface(self.pg0)
2744         self.nat_add_outside_interface(self.pg0)
2745         self.vapi.nat44_ed_add_del_output_interface(
2746             sw_if_index=self.pg1.sw_if_index, is_add=1)
2747
2748         # from client to service
2749         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2750              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2751              TCP(sport=12345, dport=external_port))
2752         self.pg1.add_stream(p)
2753         self.pg_enable_capture(self.pg_interfaces)
2754         self.pg_start()
2755         capture = self.pg0.get_capture(1)
2756         p = capture[0]
2757         try:
2758             ip = p[IP]
2759             tcp = p[TCP]
2760             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2761             self.assertEqual(tcp.dport, local_port)
2762             self.assert_packet_checksums_valid(p)
2763         except:
2764             self.logger.error(ppp("Unexpected or invalid packet:", p))
2765             raise
2766
2767         # from service back to client
2768         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2769              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2770              TCP(sport=local_port, dport=12345))
2771         self.pg0.add_stream(p)
2772         self.pg_enable_capture(self.pg_interfaces)
2773         self.pg_start()
2774         capture = self.pg1.get_capture(1)
2775         p = capture[0]
2776         try:
2777             ip = p[IP]
2778             tcp = p[TCP]
2779             self.assertEqual(ip.src, external_addr)
2780             self.assertEqual(tcp.sport, external_port)
2781             self.assert_packet_checksums_valid(p)
2782         except:
2783             self.logger.error(ppp("Unexpected or invalid packet:", p))
2784             raise
2785
2786         # from local network host to external network
2787         pkts = self.create_stream_in(self.pg0, self.pg1)
2788         self.pg0.add_stream(pkts)
2789         self.pg_enable_capture(self.pg_interfaces)
2790         self.pg_start()
2791         capture = self.pg1.get_capture(len(pkts))
2792         self.verify_capture_out(capture, ignore_port=True)
2793         pkts = self.create_stream_in(self.pg0, self.pg1)
2794         self.pg0.add_stream(pkts)
2795         self.pg_enable_capture(self.pg_interfaces)
2796         self.pg_start()
2797         capture = self.pg1.get_capture(len(pkts))
2798         self.verify_capture_out(capture, ignore_port=True)
2799
2800         # from external network back to local network host
2801         pkts = self.create_stream_out(self.pg1)
2802         self.pg1.add_stream(pkts)
2803         self.pg_enable_capture(self.pg_interfaces)
2804         self.pg_start()
2805         capture = self.pg0.get_capture(len(pkts))
2806         self.verify_capture_in(capture, self.pg0)
2807
2808     def test_output_feature_and_service3(self):
2809         """ NAT44ED interface output feature and DST NAT """
2810         external_addr = '1.2.3.4'
2811         external_port = 80
2812         local_port = 8080
2813
2814         self.vapi.nat44_forwarding_enable_disable(enable=1)
2815         self.nat_add_address(self.nat_addr)
2816         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2817         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2818                                     local_port, external_port,
2819                                     proto=IP_PROTOS.tcp, flags=flags)
2820
2821         self.nat_add_inside_interface(self.pg0)
2822         self.nat_add_outside_interface(self.pg0)
2823         self.vapi.nat44_ed_add_del_output_interface(
2824             sw_if_index=self.pg1.sw_if_index, is_add=1)
2825
2826         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2827              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2828              TCP(sport=12345, dport=external_port))
2829         self.pg0.add_stream(p)
2830         self.pg_enable_capture(self.pg_interfaces)
2831         self.pg_start()
2832         capture = self.pg1.get_capture(1)
2833         p = capture[0]
2834         try:
2835             ip = p[IP]
2836             tcp = p[TCP]
2837             self.assertEqual(ip.src, self.pg0.remote_ip4)
2838             self.assertEqual(tcp.sport, 12345)
2839             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2840             self.assertEqual(tcp.dport, local_port)
2841             self.assert_packet_checksums_valid(p)
2842         except:
2843             self.logger.error(ppp("Unexpected or invalid packet:", p))
2844             raise
2845
2846         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2847              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2848              TCP(sport=local_port, dport=12345))
2849         self.pg1.add_stream(p)
2850         self.pg_enable_capture(self.pg_interfaces)
2851         self.pg_start()
2852         capture = self.pg0.get_capture(1)
2853         p = capture[0]
2854         try:
2855             ip = p[IP]
2856             tcp = p[TCP]
2857             self.assertEqual(ip.src, external_addr)
2858             self.assertEqual(tcp.sport, external_port)
2859             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2860             self.assertEqual(tcp.dport, 12345)
2861             self.assert_packet_checksums_valid(p)
2862         except:
2863             self.logger.error(ppp("Unexpected or invalid packet:", p))
2864             raise
2865
2866     def test_self_twice_nat_lb_negative(self):
2867         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2868         """
2869         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2870                               client_id=2)
2871
2872     def test_self_twice_nat_negative(self):
2873         """ NAT44ED Self Twice NAT (negative test) """
2874         self.twice_nat_common(self_twice_nat=True)
2875
2876     def test_static_lb_multi_clients(self):
2877         """ NAT44ED local service load balancing - multiple clients"""
2878
2879         external_addr = self.nat_addr
2880         external_port = 80
2881         local_port = 8080
2882         server1 = self.pg0.remote_hosts[0]
2883         server2 = self.pg0.remote_hosts[1]
2884         server3 = self.pg0.remote_hosts[2]
2885
2886         locals = [{'addr': server1.ip4,
2887                    'port': local_port,
2888                    'probability': 90,
2889                    'vrf_id': 0},
2890                   {'addr': server2.ip4,
2891                    'port': local_port,
2892                    'probability': 10,
2893                    'vrf_id': 0}]
2894
2895         flags = self.config_flags.NAT_IS_INSIDE
2896         self.vapi.nat44_interface_add_del_feature(
2897             sw_if_index=self.pg0.sw_if_index,
2898             flags=flags, is_add=1)
2899         self.vapi.nat44_interface_add_del_feature(
2900             sw_if_index=self.pg1.sw_if_index,
2901             is_add=1)
2902
2903         self.nat_add_address(self.nat_addr)
2904         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2905                                                   external_addr=external_addr,
2906                                                   external_port=external_port,
2907                                                   protocol=IP_PROTOS.tcp,
2908                                                   local_num=len(locals),
2909                                                   locals=locals)
2910
2911         server1_n = 0
2912         server2_n = 0
2913         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2914         pkts = []
2915         for client in clients:
2916             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2917                  IP(src=client, dst=self.nat_addr) /
2918                  TCP(sport=12345, dport=external_port))
2919             pkts.append(p)
2920         self.pg1.add_stream(pkts)
2921         self.pg_enable_capture(self.pg_interfaces)
2922         self.pg_start()
2923         capture = self.pg0.get_capture(len(pkts))
2924         for p in capture:
2925             if p[IP].dst == server1.ip4:
2926                 server1_n += 1
2927             else:
2928                 server2_n += 1
2929         self.assertGreaterEqual(server1_n, server2_n)
2930
2931         local = {
2932             'addr': server3.ip4,
2933             'port': local_port,
2934             'probability': 20,
2935             'vrf_id': 0
2936         }
2937
2938         # add new back-end
2939         self.vapi.nat44_lb_static_mapping_add_del_local(
2940             is_add=1,
2941             external_addr=external_addr,
2942             external_port=external_port,
2943             local=local,
2944             protocol=IP_PROTOS.tcp)
2945         server1_n = 0
2946         server2_n = 0
2947         server3_n = 0
2948         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2949         pkts = []
2950         for client in clients:
2951             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2952                  IP(src=client, dst=self.nat_addr) /
2953                  TCP(sport=12346, dport=external_port))
2954             pkts.append(p)
2955         self.assertGreater(len(pkts), 0)
2956         self.pg1.add_stream(pkts)
2957         self.pg_enable_capture(self.pg_interfaces)
2958         self.pg_start()
2959         capture = self.pg0.get_capture(len(pkts))
2960         for p in capture:
2961             if p[IP].dst == server1.ip4:
2962                 server1_n += 1
2963             elif p[IP].dst == server2.ip4:
2964                 server2_n += 1
2965             else:
2966                 server3_n += 1
2967         self.assertGreater(server1_n, 0)
2968         self.assertGreater(server2_n, 0)
2969         self.assertGreater(server3_n, 0)
2970
2971         local = {
2972             'addr': server2.ip4,
2973             'port': local_port,
2974             'probability': 10,
2975             'vrf_id': 0
2976         }
2977
2978         # remove one back-end
2979         self.vapi.nat44_lb_static_mapping_add_del_local(
2980             is_add=0,
2981             external_addr=external_addr,
2982             external_port=external_port,
2983             local=local,
2984             protocol=IP_PROTOS.tcp)
2985         server1_n = 0
2986         server2_n = 0
2987         server3_n = 0
2988         self.pg1.add_stream(pkts)
2989         self.pg_enable_capture(self.pg_interfaces)
2990         self.pg_start()
2991         capture = self.pg0.get_capture(len(pkts))
2992         for p in capture:
2993             if p[IP].dst == server1.ip4:
2994                 server1_n += 1
2995             elif p[IP].dst == server2.ip4:
2996                 server2_n += 1
2997             else:
2998                 server3_n += 1
2999         self.assertGreater(server1_n, 0)
3000         self.assertEqual(server2_n, 0)
3001         self.assertGreater(server3_n, 0)
3002
3003     def test_syslog_sess(self):
3004         """ NAT44ED Test syslog session creation and deletion """
3005         self.vapi.syslog_set_filter(
3006             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3007         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3008
3009         self.nat_add_address(self.nat_addr)
3010         self.nat_add_inside_interface(self.pg0)
3011         self.nat_add_outside_interface(self.pg1)
3012
3013         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3014              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3015              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3016         self.pg0.add_stream(p)
3017         self.pg_enable_capture(self.pg_interfaces)
3018         self.pg_start()
3019         capture = self.pg1.get_capture(1)
3020         self.tcp_port_out = capture[0][TCP].sport
3021         capture = self.pg3.get_capture(1)
3022         self.verify_syslog_sess(capture[0][Raw].load)
3023
3024         self.pg_enable_capture(self.pg_interfaces)
3025         self.pg_start()
3026         self.nat_add_address(self.nat_addr, is_add=0)
3027         capture = self.pg3.get_capture(1)
3028         self.verify_syslog_sess(capture[0][Raw].load, False)
3029
3030     def test_twice_nat_interface_addr(self):
3031         """ NAT44ED Acquire twice NAT addresses from interface """
3032         flags = self.config_flags.NAT_IS_TWICE_NAT
3033         self.vapi.nat44_add_del_interface_addr(
3034             sw_if_index=self.pg11.sw_if_index,
3035             flags=flags, is_add=1)
3036
3037         # no address in NAT pool
3038         adresses = self.vapi.nat44_address_dump()
3039         self.assertEqual(0, len(adresses))
3040
3041         # configure interface address and check NAT address pool
3042         self.pg11.config_ip4()
3043         adresses = self.vapi.nat44_address_dump()
3044         self.assertEqual(1, len(adresses))
3045         self.assertEqual(str(adresses[0].ip_address),
3046                          self.pg11.local_ip4)
3047         self.assertEqual(adresses[0].flags, flags)
3048
3049         # remove interface address and check NAT address pool
3050         self.pg11.unconfig_ip4()
3051         adresses = self.vapi.nat44_address_dump()
3052         self.assertEqual(0, len(adresses))
3053
3054     def test_output_feature_stateful_acl(self):
3055         """ NAT44ED output feature works with stateful ACL """
3056
3057         self.nat_add_address(self.nat_addr)
3058         self.vapi.nat44_ed_add_del_output_interface(
3059             sw_if_index=self.pg1.sw_if_index, is_add=1)
3060
3061         # First ensure that the NAT is working sans ACL
3062
3063         # send packets out2in, no sessions yet so packets should drop
3064         pkts_out2in = self.create_stream_out(self.pg1)
3065         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3066
3067         # send packets into inside intf, ensure received via outside intf
3068         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3069         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3070                                        len(pkts_in2out))
3071         self.verify_capture_out(capture, ignore_port=True)
3072
3073         # send out2in again, with sessions created it should work now
3074         pkts_out2in = self.create_stream_out(self.pg1)
3075         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3076                                        len(pkts_out2in))
3077         self.verify_capture_in(capture, self.pg0)
3078
3079         # Create an ACL blocking everything
3080         out2in_deny_rule = AclRule(is_permit=0)
3081         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3082         out2in_acl.add_vpp_config()
3083
3084         # create an ACL to permit/reflect everything
3085         in2out_reflect_rule = AclRule(is_permit=2)
3086         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3087         in2out_acl.add_vpp_config()
3088
3089         # apply as input acl on interface and confirm it blocks everything
3090         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3091                                  n_input=1, acls=[out2in_acl])
3092         acl_if.add_vpp_config()
3093         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3094
3095         # apply output acl
3096         acl_if.acls = [out2in_acl, in2out_acl]
3097         acl_if.add_vpp_config()
3098         # send in2out to generate ACL state (NAT state was created earlier)
3099         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3100                                        len(pkts_in2out))
3101         self.verify_capture_out(capture, ignore_port=True)
3102
3103         # send out2in again. ACL state exists so it should work now.
3104         # TCP packets with the syn flag set also need the ack flag
3105         for p in pkts_out2in:
3106             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3107                 p[TCP].flags |= 0x10
3108         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3109                                        len(pkts_out2in))
3110         self.verify_capture_in(capture, self.pg0)
3111         self.logger.info(self.vapi.cli("show trace"))
3112
3113     def test_tcp_close(self):
3114         """ NAT44ED Close TCP session from inside network - output feature """
3115         old_timeouts = self.vapi.nat_get_timeouts()
3116         new_transitory = 2
3117         self.vapi.nat_set_timeouts(
3118             udp=old_timeouts.udp,
3119             tcp_established=old_timeouts.tcp_established,
3120             icmp=old_timeouts.icmp,
3121             tcp_transitory=new_transitory)
3122
3123         self.vapi.nat44_forwarding_enable_disable(enable=1)
3124         self.nat_add_address(self.pg1.local_ip4)
3125         twice_nat_addr = '10.0.1.3'
3126         service_ip = '192.168.16.150'
3127         self.nat_add_address(twice_nat_addr, twice_nat=1)
3128
3129         flags = self.config_flags.NAT_IS_INSIDE
3130         self.vapi.nat44_interface_add_del_feature(
3131             sw_if_index=self.pg0.sw_if_index,
3132             is_add=1)
3133         self.vapi.nat44_interface_add_del_feature(
3134             sw_if_index=self.pg0.sw_if_index,
3135             flags=flags, is_add=1)
3136         self.vapi.nat44_ed_add_del_output_interface(
3137             is_add=1,
3138             sw_if_index=self.pg1.sw_if_index)
3139
3140         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3141                  self.config_flags.NAT_IS_TWICE_NAT)
3142         self.nat_add_static_mapping(self.pg0.remote_ip4,
3143                                     service_ip, 80, 80,
3144                                     proto=IP_PROTOS.tcp,
3145                                     flags=flags)
3146         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3147         start_sessnum = len(sessions)
3148
3149         # SYN packet out->in
3150         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3151              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3152              TCP(sport=33898, dport=80, flags="S"))
3153         self.pg1.add_stream(p)
3154         self.pg_enable_capture(self.pg_interfaces)
3155         self.pg_start()
3156         capture = self.pg0.get_capture(1)
3157         p = capture[0]
3158         tcp_port = p[TCP].sport
3159
3160         # SYN + ACK packet in->out
3161         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3162              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3163              TCP(sport=80, dport=tcp_port, flags="SA"))
3164         self.pg0.add_stream(p)
3165         self.pg_enable_capture(self.pg_interfaces)
3166         self.pg_start()
3167         self.pg1.get_capture(1)
3168
3169         # ACK packet out->in
3170         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3171              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3172              TCP(sport=33898, dport=80, flags="A"))
3173         self.pg1.add_stream(p)
3174         self.pg_enable_capture(self.pg_interfaces)
3175         self.pg_start()
3176         self.pg0.get_capture(1)
3177
3178         # FIN packet in -> out
3179         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3180              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3181              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3182         self.pg0.add_stream(p)
3183         self.pg_enable_capture(self.pg_interfaces)
3184         self.pg_start()
3185         self.pg1.get_capture(1)
3186
3187         # FIN+ACK packet out -> in
3188         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3189              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3190              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3191         self.pg1.add_stream(p)
3192         self.pg_enable_capture(self.pg_interfaces)
3193         self.pg_start()
3194         self.pg0.get_capture(1)
3195
3196         # ACK packet in -> out
3197         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3198              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3199              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3200         self.pg0.add_stream(p)
3201         self.pg_enable_capture(self.pg_interfaces)
3202         self.pg_start()
3203         self.pg1.get_capture(1)
3204
3205         # session now in transitory timeout
3206         # try SYN packet out->in - should be dropped
3207         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3208              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3209              TCP(sport=33898, dport=80, flags="S"))
3210         self.pg1.add_stream(p)
3211         self.pg_enable_capture(self.pg_interfaces)
3212         self.pg_start()
3213
3214         self.virtual_sleep(new_transitory, "wait for transitory timeout")
3215         self.pg0.assert_nothing_captured(0)
3216
3217         # session should still exist
3218         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3219         self.assertEqual(len(sessions) - start_sessnum, 1)
3220
3221         # send FIN+ACK packet out -> in - will cause session to be wiped
3222         # but won't create a new session
3223         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3224              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3225              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3226         self.pg1.add_stream(p)
3227         self.pg_enable_capture(self.pg_interfaces)
3228         self.pg_start()
3229
3230         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3231         self.assertEqual(len(sessions) - start_sessnum, 0)
3232         self.pg0.assert_nothing_captured(0)
3233
3234     def test_tcp_session_close_in(self):
3235         """ NAT44ED Close TCP session from inside network """
3236
3237         in_port = self.tcp_port_in
3238         out_port = 10505
3239         ext_port = self.tcp_external_port
3240
3241         self.nat_add_address(self.nat_addr)
3242         self.nat_add_inside_interface(self.pg0)
3243         self.nat_add_outside_interface(self.pg1)
3244         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3245                                     in_port, out_port, proto=IP_PROTOS.tcp,
3246                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3247
3248         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3249         session_n = len(sessions)
3250
3251         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3252                                    tcp_transitory=2, icmp=5)
3253
3254         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3255
3256         # FIN packet in -> out
3257         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3258              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3259              TCP(sport=in_port, dport=ext_port,
3260                  flags="FA", seq=100, ack=300))
3261         self.pg0.add_stream(p)
3262         self.pg_enable_capture(self.pg_interfaces)
3263         self.pg_start()
3264         self.pg1.get_capture(1)
3265
3266         pkts = []
3267
3268         # ACK packet out -> in
3269         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3270              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3271              TCP(sport=ext_port, dport=out_port,
3272                  flags="A", seq=300, ack=101))
3273         pkts.append(p)
3274
3275         # FIN packet out -> in
3276         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3277              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3278              TCP(sport=ext_port, dport=out_port,
3279                  flags="FA", seq=300, ack=101))
3280         pkts.append(p)
3281
3282         self.pg1.add_stream(pkts)
3283         self.pg_enable_capture(self.pg_interfaces)
3284         self.pg_start()
3285         self.pg0.get_capture(2)
3286
3287         # ACK packet in -> out
3288         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3289              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3290              TCP(sport=in_port, dport=ext_port,
3291                  flags="A", seq=101, ack=301))
3292         self.pg0.add_stream(p)
3293         self.pg_enable_capture(self.pg_interfaces)
3294         self.pg_start()
3295         self.pg1.get_capture(1)
3296
3297         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3298         self.assertEqual(len(sessions) - session_n, 1)
3299
3300         out2in_drops = self.get_err_counter(
3301             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3302         in2out_drops = self.get_err_counter(
3303             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3304
3305         # extra FIN packet out -> in - this should be dropped
3306         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3307              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3308              TCP(sport=ext_port, dport=out_port,
3309                  flags="FA", seq=300, ack=101))
3310
3311         self.pg1.add_stream(p)
3312         self.pg_enable_capture(self.pg_interfaces)
3313         self.pg_start()
3314         self.pg0.assert_nothing_captured()
3315
3316         # extra ACK packet in -> out - this should be dropped
3317         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3318              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3319              TCP(sport=in_port, dport=ext_port,
3320                  flags="A", seq=101, ack=301))
3321         self.pg0.add_stream(p)
3322         self.pg_enable_capture(self.pg_interfaces)
3323         self.pg_start()
3324         self.pg1.assert_nothing_captured()
3325
3326         stats = self.get_err_counter(
3327             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3328         self.assertEqual(stats - out2in_drops, 1)
3329         stats = self.get_err_counter(
3330             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3331         self.assertEqual(stats - in2out_drops, 1)
3332
3333         self.virtual_sleep(3)
3334         # extra ACK packet in -> out - this will cause session to be wiped
3335         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3336              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3337              TCP(sport=in_port, dport=ext_port,
3338                  flags="A", seq=101, ack=301))
3339         self.pg0.add_stream(p)
3340         self.pg_enable_capture(self.pg_interfaces)
3341         self.pg_start()
3342         self.pg1.assert_nothing_captured()
3343         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3344         self.assertEqual(len(sessions) - session_n, 0)
3345
3346     def test_tcp_session_close_out(self):
3347         """ NAT44ED Close TCP session from outside network """
3348
3349         in_port = self.tcp_port_in
3350         out_port = 10505
3351         ext_port = self.tcp_external_port
3352
3353         self.nat_add_address(self.nat_addr)
3354         self.nat_add_inside_interface(self.pg0)
3355         self.nat_add_outside_interface(self.pg1)
3356         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3357                                     in_port, out_port, proto=IP_PROTOS.tcp,
3358                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3359
3360         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3361         session_n = len(sessions)
3362
3363         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3364                                    tcp_transitory=2, icmp=5)
3365
3366         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3367
3368         # FIN packet out -> in
3369         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3370              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3371              TCP(sport=ext_port, dport=out_port,
3372                  flags="FA", seq=100, ack=300))
3373         self.pg1.add_stream(p)
3374         self.pg_enable_capture(self.pg_interfaces)
3375         self.pg_start()
3376         self.pg0.get_capture(1)
3377
3378         # FIN+ACK packet in -> out
3379         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3380              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3381              TCP(sport=in_port, dport=ext_port,
3382                  flags="FA", seq=300, ack=101))
3383
3384         self.pg0.add_stream(p)
3385         self.pg_enable_capture(self.pg_interfaces)
3386         self.pg_start()
3387         self.pg1.get_capture(1)
3388
3389         # ACK packet out -> in
3390         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3391              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3392              TCP(sport=ext_port, dport=out_port,
3393                  flags="A", seq=101, ack=301))
3394         self.pg1.add_stream(p)
3395         self.pg_enable_capture(self.pg_interfaces)
3396         self.pg_start()
3397         self.pg0.get_capture(1)
3398
3399         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3400         self.assertEqual(len(sessions) - session_n, 1)
3401
3402         out2in_drops = self.get_err_counter(
3403             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3404         in2out_drops = self.get_err_counter(
3405             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3406
3407         # extra FIN packet out -> in - this should be dropped
3408         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3409              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3410              TCP(sport=ext_port, dport=out_port,
3411                  flags="FA", seq=300, ack=101))
3412
3413         self.pg1.add_stream(p)
3414         self.pg_enable_capture(self.pg_interfaces)
3415         self.pg_start()
3416         self.pg0.assert_nothing_captured()
3417
3418         # extra ACK packet in -> out - this should be dropped
3419         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3420              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3421              TCP(sport=in_port, dport=ext_port,
3422                  flags="A", seq=101, ack=301))
3423         self.pg0.add_stream(p)
3424         self.pg_enable_capture(self.pg_interfaces)
3425         self.pg_start()
3426         self.pg1.assert_nothing_captured()
3427
3428         stats = self.get_err_counter(
3429             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3430         self.assertEqual(stats - out2in_drops, 1)
3431         stats = self.get_err_counter(
3432             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3433         self.assertEqual(stats - in2out_drops, 1)
3434
3435         self.virtual_sleep(3)
3436         # extra ACK packet in -> out - this will cause session to be wiped
3437         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3438              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3439              TCP(sport=in_port, dport=ext_port,
3440                  flags="A", seq=101, ack=301))
3441         self.pg0.add_stream(p)
3442         self.pg_enable_capture(self.pg_interfaces)
3443         self.pg_start()
3444         self.pg1.assert_nothing_captured()
3445         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3446         self.assertEqual(len(sessions) - session_n, 0)
3447
3448     def test_tcp_session_close_simultaneous(self):
3449         """ NAT44ED Close TCP session from inside network """
3450
3451         in_port = self.tcp_port_in
3452         ext_port = 10505
3453
3454         self.nat_add_address(self.nat_addr)
3455         self.nat_add_inside_interface(self.pg0)
3456         self.nat_add_outside_interface(self.pg1)
3457         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3458                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3459                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3460
3461         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3462         session_n = len(sessions)
3463
3464         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3465                                    tcp_transitory=2, icmp=5)
3466
3467         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3468
3469         # FIN packet in -> out
3470         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3471              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3472              TCP(sport=in_port, dport=ext_port,
3473                  flags="FA", seq=100, ack=300))
3474         self.pg0.add_stream(p)
3475         self.pg_enable_capture(self.pg_interfaces)
3476         self.pg_start()
3477         self.pg1.get_capture(1)
3478
3479         # FIN packet out -> in
3480         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3481              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3482              TCP(sport=ext_port, dport=out_port,
3483                  flags="FA", seq=300, ack=100))
3484         self.pg1.add_stream(p)
3485         self.pg_enable_capture(self.pg_interfaces)
3486         self.pg_start()
3487         self.pg0.get_capture(1)
3488
3489         # ACK packet in -> out
3490         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3491              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3492              TCP(sport=in_port, dport=ext_port,
3493                  flags="A", seq=101, ack=301))
3494         self.pg0.add_stream(p)
3495         self.pg_enable_capture(self.pg_interfaces)
3496         self.pg_start()
3497         self.pg1.get_capture(1)
3498
3499         # ACK packet out -> in
3500         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3501              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3502              TCP(sport=ext_port, dport=out_port,
3503                  flags="A", seq=301, ack=101))
3504         self.pg1.add_stream(p)
3505         self.pg_enable_capture(self.pg_interfaces)
3506         self.pg_start()
3507         self.pg0.get_capture(1)
3508
3509         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3510         self.assertEqual(len(sessions) - session_n, 1)
3511
3512         out2in_drops = self.get_err_counter(
3513             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3514         in2out_drops = self.get_err_counter(
3515             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3516
3517         # extra FIN packet out -> in - this should be dropped
3518         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3519              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3520              TCP(sport=ext_port, dport=out_port,
3521                  flags="FA", seq=300, ack=101))
3522
3523         self.pg1.add_stream(p)
3524         self.pg_enable_capture(self.pg_interfaces)
3525         self.pg_start()
3526         self.pg0.assert_nothing_captured()
3527
3528         # extra ACK packet in -> out - this should be dropped
3529         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3530              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3531              TCP(sport=in_port, dport=ext_port,
3532                  flags="A", seq=101, ack=301))
3533         self.pg0.add_stream(p)
3534         self.pg_enable_capture(self.pg_interfaces)
3535         self.pg_start()
3536         self.pg1.assert_nothing_captured()
3537
3538         stats = self.get_err_counter(
3539             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3540         self.assertEqual(stats - out2in_drops, 1)
3541         stats = self.get_err_counter(
3542             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3543         self.assertEqual(stats - in2out_drops, 1)
3544
3545         self.virtual_sleep(3)
3546         # extra ACK packet in -> out - this will cause session to be wiped
3547         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3548              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3549              TCP(sport=in_port, dport=ext_port,
3550                  flags="A", seq=101, ack=301))
3551         self.pg0.add_stream(p)
3552         self.pg_enable_capture(self.pg_interfaces)
3553         self.pg_start()
3554         self.pg1.assert_nothing_captured()
3555         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3556         self.assertEqual(len(sessions) - session_n, 0)
3557
3558     def test_dynamic_vrf(self):
3559         """ NAT44ED dynamic translation test: different VRF"""
3560
3561         vrf_id_in = 33
3562         vrf_id_out = 34
3563
3564         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3565
3566         try:
3567             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3568             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3569
3570             self.nat_add_inside_interface(self.pg7)
3571             self.nat_add_outside_interface(self.pg8)
3572
3573             # just basic stuff nothing special
3574             pkts = self.create_stream_in(self.pg7, self.pg8)
3575             self.pg7.add_stream(pkts)
3576             self.pg_enable_capture(self.pg_interfaces)
3577             self.pg_start()
3578             capture = self.pg8.get_capture(len(pkts))
3579             self.verify_capture_out(capture, ignore_port=True)
3580
3581             pkts = self.create_stream_out(self.pg8)
3582             self.pg8.add_stream(pkts)
3583             self.pg_enable_capture(self.pg_interfaces)
3584             self.pg_start()
3585             capture = self.pg7.get_capture(len(pkts))
3586             self.verify_capture_in(capture, self.pg7)
3587
3588         finally:
3589             self.pg7.unconfig()
3590             self.pg8.unconfig()
3591
3592             self.vapi.ip_table_add_del(is_add=0,
3593                                        table={'table_id': vrf_id_in})
3594             self.vapi.ip_table_add_del(is_add=0,
3595                                        table={'table_id': vrf_id_out})
3596
3597     def test_dynamic_output_feature_vrf(self):
3598         """ NAT44ED dynamic translation test: output-feature, VRF"""
3599
3600         # other then default (0)
3601         new_vrf_id = 22
3602
3603         self.nat_add_address(self.nat_addr)
3604         self.vapi.nat44_interface_add_del_output_feature(
3605             sw_if_index=self.pg8.sw_if_index, is_add=1)
3606
3607         try:
3608             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3609             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3610
3611             # in2out
3612             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3613             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3614             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3615             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3616
3617             pkts = self.create_stream_in(self.pg7, self.pg8)
3618             self.pg7.add_stream(pkts)
3619             self.pg_enable_capture(self.pg_interfaces)
3620             self.pg_start()
3621             capture = self.pg8.get_capture(len(pkts))
3622             self.verify_capture_out(capture, ignore_port=True)
3623
3624             if_idx = self.pg8.sw_if_index
3625             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3626             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3627             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3628             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3629             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3630             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3631             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3632             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3633
3634             # out2in
3635             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3636             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3637             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3638             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3639
3640             pkts = self.create_stream_out(self.pg8)
3641             self.pg8.add_stream(pkts)
3642             self.pg_enable_capture(self.pg_interfaces)
3643             self.pg_start()
3644             capture = self.pg7.get_capture(len(pkts))
3645             self.verify_capture_in(capture, self.pg7)
3646
3647             if_idx = self.pg8.sw_if_index
3648             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3649             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3650             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3651             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3652             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3653             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3654             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3655             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3656
3657             sessions = self.statistics['/nat44-ed/total-sessions']
3658             self.assertEqual(sessions[:, 0].sum(), 3)
3659
3660         finally:
3661             self.pg7.unconfig()
3662             self.pg8.unconfig()
3663
3664             self.vapi.ip_table_add_del(is_add=0,
3665                                        table={'table_id': new_vrf_id})
3666
3667     def test_next_src_nat(self):
3668         """ NAT44ED On way back forward packet to nat44-in2out node. """
3669
3670         twice_nat_addr = '10.0.1.3'
3671         external_port = 80
3672         local_port = 8080
3673         post_twice_nat_port = 0
3674
3675         self.vapi.nat44_forwarding_enable_disable(enable=1)
3676         self.nat_add_address(twice_nat_addr, twice_nat=1)
3677         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3678                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3679         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3680                                     local_port, external_port,
3681                                     proto=IP_PROTOS.tcp, vrf_id=1,
3682                                     flags=flags)
3683         self.vapi.nat44_interface_add_del_feature(
3684             sw_if_index=self.pg6.sw_if_index,
3685             is_add=1)
3686
3687         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3688              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3689              TCP(sport=12345, dport=external_port))
3690         self.pg6.add_stream(p)
3691         self.pg_enable_capture(self.pg_interfaces)
3692         self.pg_start()
3693         capture = self.pg6.get_capture(1)
3694         p = capture[0]
3695         try:
3696             ip = p[IP]
3697             tcp = p[TCP]
3698             self.assertEqual(ip.src, twice_nat_addr)
3699             self.assertNotEqual(tcp.sport, 12345)
3700             post_twice_nat_port = tcp.sport
3701             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3702             self.assertEqual(tcp.dport, local_port)
3703             self.assert_packet_checksums_valid(p)
3704         except:
3705             self.logger.error(ppp("Unexpected or invalid packet:", p))
3706             raise
3707
3708         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3709              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3710              TCP(sport=local_port, dport=post_twice_nat_port))
3711         self.pg6.add_stream(p)
3712         self.pg_enable_capture(self.pg_interfaces)
3713         self.pg_start()
3714         capture = self.pg6.get_capture(1)
3715         p = capture[0]
3716         try:
3717             ip = p[IP]
3718             tcp = p[TCP]
3719             self.assertEqual(ip.src, self.pg1.remote_ip4)
3720             self.assertEqual(tcp.sport, external_port)
3721             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3722             self.assertEqual(tcp.dport, 12345)
3723             self.assert_packet_checksums_valid(p)
3724         except:
3725             self.logger.error(ppp("Unexpected or invalid packet:", p))
3726             raise
3727
3728     def test_one_armed_nat44_static(self):
3729         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3730
3731         remote_host = self.pg4.remote_hosts[0]
3732         local_host = self.pg4.remote_hosts[1]
3733         external_port = 80
3734         local_port = 8080
3735         eh_port_in = 0
3736
3737         self.vapi.nat44_forwarding_enable_disable(enable=1)
3738         self.nat_add_address(self.nat_addr, twice_nat=1)
3739         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3740                  self.config_flags.NAT_IS_TWICE_NAT)
3741         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3742                                     local_port, external_port,
3743                                     proto=IP_PROTOS.tcp, flags=flags)
3744         flags = self.config_flags.NAT_IS_INSIDE
3745         self.vapi.nat44_interface_add_del_feature(
3746             sw_if_index=self.pg4.sw_if_index,
3747             is_add=1)
3748         self.vapi.nat44_interface_add_del_feature(
3749             sw_if_index=self.pg4.sw_if_index,
3750             flags=flags, is_add=1)
3751
3752         # from client to service
3753         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3754              IP(src=remote_host.ip4, dst=self.nat_addr) /
3755              TCP(sport=12345, dport=external_port))
3756         self.pg4.add_stream(p)
3757         self.pg_enable_capture(self.pg_interfaces)
3758         self.pg_start()
3759         capture = self.pg4.get_capture(1)
3760         p = capture[0]
3761         try:
3762             ip = p[IP]
3763             tcp = p[TCP]
3764             self.assertEqual(ip.dst, local_host.ip4)
3765             self.assertEqual(ip.src, self.nat_addr)
3766             self.assertEqual(tcp.dport, local_port)
3767             self.assertNotEqual(tcp.sport, 12345)
3768             eh_port_in = tcp.sport
3769             self.assert_packet_checksums_valid(p)
3770         except:
3771             self.logger.error(ppp("Unexpected or invalid packet:", p))
3772             raise
3773
3774         # from service back to client
3775         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3776              IP(src=local_host.ip4, dst=self.nat_addr) /
3777              TCP(sport=local_port, dport=eh_port_in))
3778         self.pg4.add_stream(p)
3779         self.pg_enable_capture(self.pg_interfaces)
3780         self.pg_start()
3781         capture = self.pg4.get_capture(1)
3782         p = capture[0]
3783         try:
3784             ip = p[IP]
3785             tcp = p[TCP]
3786             self.assertEqual(ip.src, self.nat_addr)
3787             self.assertEqual(ip.dst, remote_host.ip4)
3788             self.assertEqual(tcp.sport, external_port)
3789             self.assertEqual(tcp.dport, 12345)
3790             self.assert_packet_checksums_valid(p)
3791         except:
3792             self.logger.error(ppp("Unexpected or invalid packet:", p))
3793             raise
3794
3795     def test_icmp_error_fwd_outbound(self):
3796         """ NAT44ED ICMP error outbound with forwarding enabled """
3797
3798         # Ensure that an outbound ICMP error message is properly associated
3799         # with the inbound forward bypass session it is related to.
3800         payload = "H" * 10
3801
3802         self.nat_add_address(self.nat_addr)
3803         self.nat_add_inside_interface(self.pg0)
3804         self.nat_add_outside_interface(self.pg1)
3805
3806         # enable forwarding and initiate connection out2in
3807         self.vapi.nat44_forwarding_enable_disable(enable=1)
3808         p1 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3809               IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
3810               UDP(sport=21, dport=20) / payload)
3811
3812         self.pg1.add_stream(p1)
3813         self.pg_enable_capture(self.pg_interfaces)
3814         self.pg_start()
3815         capture = self.pg0.get_capture(1)[0]
3816
3817         self.logger.info(self.vapi.cli("show nat44 sessions"))
3818
3819         # reply with ICMP error message in2out
3820         # We cannot reliably retrieve forward bypass sessions via the API.
3821         # session dumps for a user will only look on the worker that the
3822         # user is supposed to be mapped to in2out. The forward bypass session
3823         # is not necessarily created on that worker.
3824         p2 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3825               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3826               ICMP(type='dest-unreach', code='port-unreachable') /
3827               capture[IP:])
3828
3829         self.pg0.add_stream(p2)
3830         self.pg_enable_capture(self.pg_interfaces)
3831         self.pg_start()
3832         capture = self.pg1.get_capture(1)[0]
3833
3834         self.logger.info(self.vapi.cli("show nat44 sessions"))
3835
3836         self.logger.info(ppp("p1 packet:", p1))
3837         self.logger.info(ppp("p2 packet:", p2))
3838         self.logger.info(ppp("capture packet:", capture))
3839
3840
3841 if __name__ == '__main__':
3842     unittest.main(testRunner=VppTestRunner)