test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class NAT44EDTestCase(VppTestCase):
  23
  24     nat_addr = '10.0.0.3'
  25
  26     tcp_port_in = 6303
  27     tcp_port_out = 6303
  28
  29     udp_port_in = 6304
  30     udp_port_out = 6304
  31
  32     icmp_id_in = 6305
  33     icmp_id_out = 6305
  34
  35     tcp_external_port = 80
  36
  37     max_sessions = 100
  38
  39     def setUp(self):
  40         super(NAT44EDTestCase, self).setUp()
  41         self.plugin_enable()
  42
  43     def tearDown(self):
  44         super(NAT44EDTestCase, self).tearDown()
  45         if not self.vpp_dead:
  46             self.plugin_disable()
  47
  48     def plugin_enable(self):
  49         self.vapi.nat44_ed_plugin_enable_disable(
  50             sessions=self.max_sessions, enable=1)
  51
  52     def plugin_disable(self):
  53         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  54
  55     @property
  56     def config_flags(self):
  57         return VppEnum.vl_api_nat_config_flags_t
  58
  59     @property
  60     def nat44_config_flags(self):
  61         return VppEnum.vl_api_nat44_config_flags_t
  62
  63     @property
  64     def syslog_severity(self):
  65         return VppEnum.vl_api_syslog_severity_t
  66
  67     @property
  68     def server_addr(self):
  69         return self.pg1.remote_hosts[0].ip4
  70
  71     @staticmethod
  72     def random_port():
  73         return randint(1025, 65535)
  74
  75     @staticmethod
  76     def proto2layer(proto):
  77         if proto == IP_PROTOS.tcp:
  78             return TCP
  79         elif proto == IP_PROTOS.udp:
  80             return UDP
  81         elif proto == IP_PROTOS.icmp:
  82             return ICMP
  83         else:
  84             raise Exception("Unsupported protocol")
  85
  86     @classmethod
  87     def create_and_add_ip4_table(cls, i, table_id=0):
  88         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  89         i.set_table_ip4(table_id)
  90
  91     @classmethod
  92     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  93         if table_id:
  94             cls.create_and_add_ip4_table(i, table_id)
  95
  96         i.admin_up()
  97         i.config_ip4()
  98         i.resolve_arp()
  99
 100         if hosts:
 101             i.generate_remote_hosts(hosts)
 102             i.configure_ipv4_neighbors()
 103
 104     @classmethod
 105     def nat_add_interface_address(cls, i):
 106         cls.vapi.nat44_add_del_interface_addr(
 107             sw_if_index=i.sw_if_index, is_add=1)
 108
 109     def nat_add_inside_interface(self, i):
 110         self.vapi.nat44_interface_add_del_feature(
 111             flags=self.config_flags.NAT_IS_INSIDE,
 112             sw_if_index=i.sw_if_index, is_add=1)
 113
 114     def nat_add_outside_interface(self, i):
 115         self.vapi.nat44_interface_add_del_feature(
 116             flags=self.config_flags.NAT_IS_OUTSIDE,
 117             sw_if_index=i.sw_if_index, is_add=1)
 118
 119     def nat_add_address(self, address, twice_nat=0,
 120                         vrf_id=0xFFFFFFFF, is_add=1):
 121         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 122         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 123                                               last_ip_address=address,
 124                                               vrf_id=vrf_id,
 125                                               is_add=is_add,
 126                                               flags=flags)
 127
 128     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 129                                local_port=0, external_port=0, vrf_id=0,
 130                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 131                                proto=0, tag="", flags=0):
 132
 133         if not (local_port and external_port):
 134             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 135
 136         self.vapi.nat44_add_del_static_mapping(
 137             is_add=is_add,
 138             local_ip_address=local_ip,
 139             external_ip_address=external_ip,
 140             external_sw_if_index=external_sw_if_index,
 141             local_port=local_port,
 142             external_port=external_port,
 143             vrf_id=vrf_id, protocol=proto,
 144             flags=flags,
 145             tag=tag)
 146
 147     @classmethod
 148     def setUpClass(cls):
 149         super(NAT44EDTestCase, cls).setUpClass()
 150
 151         cls.create_pg_interfaces(range(12))
 152         cls.interfaces = list(cls.pg_interfaces[:4])
 153
 154         cls.create_and_add_ip4_table(cls.pg2, 10)
 155
 156         for i in cls.interfaces:
 157             cls.configure_ip4_interface(i, hosts=3)
 158
 159         # test specific (test-multiple-vrf)
 160         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 161
 162         # test specific (test-one-armed-nat44-static)
 163         cls.pg4.generate_remote_hosts(2)
 164         cls.pg4.config_ip4()
 165         cls.vapi.sw_interface_add_del_address(
 166             sw_if_index=cls.pg4.sw_if_index,
 167             prefix="10.0.0.1/24")
 168         cls.pg4.admin_up()
 169         cls.pg4.resolve_arp()
 170         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 171         cls.pg4.resolve_arp()
 172
 173         # test specific interface (pg5)
 174         cls.pg5._local_ip4 = "10.1.1.1"
 175         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 176         cls.pg5.set_table_ip4(1)
 177         cls.pg5.config_ip4()
 178         cls.pg5.admin_up()
 179         cls.pg5.resolve_arp()
 180
 181         # test specific interface (pg6)
 182         cls.pg6._local_ip4 = "10.1.2.1"
 183         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 184         cls.pg6.set_table_ip4(1)
 185         cls.pg6.config_ip4()
 186         cls.pg6.admin_up()
 187         cls.pg6.resolve_arp()
 188
 189         rl = list()
 190
 191         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 192                              [VppRoutePath("0.0.0.0", 0xffffffff,
 193                                            nh_table_id=0)],
 194                              register=False, table_id=1))
 195         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 196                              [VppRoutePath(cls.pg1.local_ip4,
 197                                            cls.pg1.sw_if_index)],
 198                              register=False))
 199         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 200                              [VppRoutePath("0.0.0.0",
 201                                            cls.pg5.sw_if_index)],
 202                              register=False, table_id=1))
 203         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 204                              [VppRoutePath("0.0.0.0",
 205                                            cls.pg6.sw_if_index)],
 206                              register=False, table_id=1))
 207         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 208                              [VppRoutePath("0.0.0.0", 0xffffffff,
 209                                            nh_table_id=1)],
 210                              register=False, table_id=0))
 211
 212         for r in rl:
 213             r.add_vpp_config()
 214
 215     def get_err_counter(self, path):
 216         return self.statistics.get_err_counter(path)
 217
 218     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 219                           host_in_port, proto=IP_PROTOS.tcp,
 220                           ignore_port=False):
 221         layer = self.proto2layer(proto)
 222
 223         if proto == IP_PROTOS.tcp:
 224             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 225         else:
 226             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 227
 228         # send packet from host to server
 229         pkts = self.create_stream_frag(self.pg0,
 230                                        self.nat_addr,
 231                                        host_in_port,
 232                                        server_out_port,
 233                                        data,
 234                                        proto)
 235         self.pg0.add_stream(pkts)
 236         self.pg_enable_capture(self.pg_interfaces)
 237         self.pg_start()
 238         frags = self.pg0.get_capture(len(pkts))
 239         p = self.reass_frags_and_verify(frags,
 240                                         self.nat_addr,
 241                                         server_addr)
 242         if proto != IP_PROTOS.icmp:
 243             if not ignore_port:
 244                 self.assertNotEqual(p[layer].sport, host_in_port)
 245             self.assertEqual(p[layer].dport, server_in_port)
 246         else:
 247             if not ignore_port:
 248                 self.assertNotEqual(p[layer].id, host_in_port)
 249         self.assertEqual(data, p[Raw].load)
 250
 251     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 252                           ignore_port=False):
 253         layer = self.proto2layer(proto)
 254
 255         if proto == IP_PROTOS.tcp:
 256             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 257         else:
 258             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 259         self.port_in = self.random_port()
 260
 261         for i in range(2):
 262             # in2out
 263             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 264                                            self.port_in, 20, data, proto)
 265             pkts.reverse()
 266             self.pg0.add_stream(pkts)
 267             self.pg_enable_capture(self.pg_interfaces)
 268             self.pg_start()
 269             frags = self.pg1.get_capture(len(pkts))
 270             if not dont_translate:
 271                 p = self.reass_frags_and_verify(frags,
 272                                                 self.nat_addr,
 273                                                 self.pg1.remote_ip4)
 274             else:
 275                 p = self.reass_frags_and_verify(frags,
 276                                                 self.pg0.remote_ip4,
 277                                                 self.pg1.remote_ip4)
 278             if proto != IP_PROTOS.icmp:
 279                 if not dont_translate:
 280                     self.assertEqual(p[layer].dport, 20)
 281                     if not ignore_port:
 282                         self.assertNotEqual(p[layer].sport, self.port_in)
 283                 else:
 284                     self.assertEqual(p[layer].sport, self.port_in)
 285             else:
 286                 if not ignore_port:
 287                     if not dont_translate:
 288                         self.assertNotEqual(p[layer].id, self.port_in)
 289                     else:
 290                         self.assertEqual(p[layer].id, self.port_in)
 291             self.assertEqual(data, p[Raw].load)
 292
 293             # out2in
 294             if not dont_translate:
 295                 dst_addr = self.nat_addr
 296             else:
 297                 dst_addr = self.pg0.remote_ip4
 298             if proto != IP_PROTOS.icmp:
 299                 sport = 20
 300                 dport = p[layer].sport
 301             else:
 302                 sport = p[layer].id
 303                 dport = 0
 304             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 305                                            data, proto, echo_reply=True)
 306             pkts.reverse()
 307             self.pg1.add_stream(pkts)
 308             self.pg_enable_capture(self.pg_interfaces)
 309             self.logger.info(self.vapi.cli("show trace"))
 310             self.pg_start()
 311             frags = self.pg0.get_capture(len(pkts))
 312             p = self.reass_frags_and_verify(frags,
 313                                             self.pg1.remote_ip4,
 314                                             self.pg0.remote_ip4)
 315             if proto != IP_PROTOS.icmp:
 316                 self.assertEqual(p[layer].sport, 20)
 317                 self.assertEqual(p[layer].dport, self.port_in)
 318             else:
 319                 self.assertEqual(p[layer].id, self.port_in)
 320             self.assertEqual(data, p[Raw].load)
 321
 322     def reass_frags_and_verify(self, frags, src, dst):
 323         buffer = BytesIO()
 324         for p in frags:
 325             self.assertEqual(p[IP].src, src)
 326             self.assertEqual(p[IP].dst, dst)
 327             self.assert_ip_checksum_valid(p)
 328             buffer.seek(p[IP].frag * 8)
 329             buffer.write(bytes(p[IP].payload))
 330         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 331                 proto=frags[0][IP].proto)
 332         if ip.proto == IP_PROTOS.tcp:
 333             p = (ip / TCP(buffer.getvalue()))
 334             self.logger.debug(ppp("Reassembled:", p))
 335             self.assert_tcp_checksum_valid(p)
 336         elif ip.proto == IP_PROTOS.udp:
 337             p = (ip / UDP(buffer.getvalue()[:8]) /
 338                  Raw(buffer.getvalue()[8:]))
 339         elif ip.proto == IP_PROTOS.icmp:
 340             p = (ip / ICMP(buffer.getvalue()))
 341         return p
 342
 343     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 344                       ignore_port=False):
 345         layer = self.proto2layer(proto)
 346
 347         if proto == IP_PROTOS.tcp:
 348             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 349         else:
 350             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 351         self.port_in = self.random_port()
 352
 353         # in2out
 354         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 355                                        self.port_in, 20, data, proto)
 356         self.pg0.add_stream(pkts)
 357         self.pg_enable_capture(self.pg_interfaces)
 358         self.pg_start()
 359         frags = self.pg1.get_capture(len(pkts))
 360         if not dont_translate:
 361             p = self.reass_frags_and_verify(frags,
 362                                             self.nat_addr,
 363                                             self.pg1.remote_ip4)
 364         else:
 365             p = self.reass_frags_and_verify(frags,
 366                                             self.pg0.remote_ip4,
 367                                             self.pg1.remote_ip4)
 368         if proto != IP_PROTOS.icmp:
 369             if not dont_translate:
 370                 self.assertEqual(p[layer].dport, 20)
 371                 if not ignore_port:
 372                     self.assertNotEqual(p[layer].sport, self.port_in)
 373             else:
 374                 self.assertEqual(p[layer].sport, self.port_in)
 375         else:
 376             if not ignore_port:
 377                 if not dont_translate:
 378                     self.assertNotEqual(p[layer].id, self.port_in)
 379                 else:
 380                     self.assertEqual(p[layer].id, self.port_in)
 381         self.assertEqual(data, p[Raw].load)
 382
 383         # out2in
 384         if not dont_translate:
 385             dst_addr = self.nat_addr
 386         else:
 387             dst_addr = self.pg0.remote_ip4
 388         if proto != IP_PROTOS.icmp:
 389             sport = 20
 390             dport = p[layer].sport
 391         else:
 392             sport = p[layer].id
 393             dport = 0
 394         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 395                                        proto, echo_reply=True)
 396         self.pg1.add_stream(pkts)
 397         self.pg_enable_capture(self.pg_interfaces)
 398         self.pg_start()
 399         frags = self.pg0.get_capture(len(pkts))
 400         p = self.reass_frags_and_verify(frags,
 401                                         self.pg1.remote_ip4,
 402                                         self.pg0.remote_ip4)
 403         if proto != IP_PROTOS.icmp:
 404             self.assertEqual(p[layer].sport, 20)
 405             self.assertEqual(p[layer].dport, self.port_in)
 406         else:
 407             self.assertEqual(p[layer].id, self.port_in)
 408         self.assertEqual(data, p[Raw].load)
 409
 410     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 411                            dst_ip=None, ignore_port=False):
 412         if nat_ip is None:
 413             nat_ip = self.nat_addr
 414         for packet in capture:
 415             try:
 416                 self.assert_packet_checksums_valid(packet)
 417                 self.assertEqual(packet[IP].src, nat_ip)
 418                 if dst_ip is not None:
 419                     self.assertEqual(packet[IP].dst, dst_ip)
 420                 if packet.haslayer(TCP):
 421                     if not ignore_port:
 422                         if same_port:
 423                             self.assertEqual(
 424                                 packet[TCP].sport, self.tcp_port_in)
 425                         else:
 426                             self.assertNotEqual(
 427                                 packet[TCP].sport, self.tcp_port_in)
 428                     self.tcp_port_out = packet[TCP].sport
 429                     self.assert_packet_checksums_valid(packet)
 430                 elif packet.haslayer(UDP):
 431                     if not ignore_port:
 432                         if same_port:
 433                             self.assertEqual(
 434                                 packet[UDP].sport, self.udp_port_in)
 435                         else:
 436                             self.assertNotEqual(
 437                                 packet[UDP].sport, self.udp_port_in)
 438                     self.udp_port_out = packet[UDP].sport
 439                 else:
 440                     if not ignore_port:
 441                         if same_port:
 442                             self.assertEqual(
 443                                 packet[ICMP].id, self.icmp_id_in)
 444                         else:
 445                             self.assertNotEqual(
 446                                 packet[ICMP].id, self.icmp_id_in)
 447                     self.icmp_id_out = packet[ICMP].id
 448                     self.assert_packet_checksums_valid(packet)
 449             except:
 450                 self.logger.error(ppp("Unexpected or invalid packet "
 451                                       "(outside network):", packet))
 452                 raise
 453
 454     def verify_capture_in(self, capture, in_if):
 455         for packet in capture:
 456             try:
 457                 self.assert_packet_checksums_valid(packet)
 458                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 459                 if packet.haslayer(TCP):
 460                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 461                 elif packet.haslayer(UDP):
 462                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 463                 else:
 464                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 465             except:
 466                 self.logger.error(ppp("Unexpected or invalid packet "
 467                                       "(inside network):", packet))
 468                 raise
 469
 470     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 471         if dst_ip is None:
 472             dst_ip = out_if.remote_ip4
 473
 474         pkts = []
 475         # TCP
 476         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 477              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 478              TCP(sport=self.tcp_port_in, dport=20))
 479         pkts.extend([p, p])
 480
 481         # UDP
 482         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 483              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 484              UDP(sport=self.udp_port_in, dport=20))
 485         pkts.append(p)
 486
 487         # ICMP
 488         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 489              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 490              ICMP(id=self.icmp_id_in, type='echo-request'))
 491         pkts.append(p)
 492
 493         return pkts
 494
 495     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 496                           use_inside_ports=False):
 497         if dst_ip is None:
 498             dst_ip = self.nat_addr
 499         if not use_inside_ports:
 500             tcp_port = self.tcp_port_out
 501             udp_port = self.udp_port_out
 502             icmp_id = self.icmp_id_out
 503         else:
 504             tcp_port = self.tcp_port_in
 505             udp_port = self.udp_port_in
 506             icmp_id = self.icmp_id_in
 507         pkts = []
 508         # TCP
 509         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 510              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 511              TCP(dport=tcp_port, sport=20))
 512         pkts.extend([p, p])
 513
 514         # UDP
 515         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 516              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 517              UDP(dport=udp_port, sport=20))
 518         pkts.append(p)
 519
 520         # ICMP
 521         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 522              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 523              ICMP(id=icmp_id, type='echo-reply'))
 524         pkts.append(p)
 525
 526         return pkts
 527
 528     def create_tcp_stream(self, in_if, out_if, count):
 529         pkts = []
 530         port = 6303
 531
 532         for i in range(count):
 533             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 534                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 535                  TCP(sport=port + i, dport=20))
 536             pkts.append(p)
 537
 538         return pkts
 539
 540     def create_stream_frag(self, src_if, dst, sport, dport, data,
 541                            proto=IP_PROTOS.tcp, echo_reply=False):
 542         if proto == IP_PROTOS.tcp:
 543             p = (IP(src=src_if.remote_ip4, dst=dst) /
 544                  TCP(sport=sport, dport=dport) /
 545                  Raw(data))
 546             p = p.__class__(scapy.compat.raw(p))
 547             chksum = p[TCP].chksum
 548             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 549         elif proto == IP_PROTOS.udp:
 550             proto_header = UDP(sport=sport, dport=dport)
 551         elif proto == IP_PROTOS.icmp:
 552             if not echo_reply:
 553                 proto_header = ICMP(id=sport, type='echo-request')
 554             else:
 555                 proto_header = ICMP(id=sport, type='echo-reply')
 556         else:
 557             raise Exception("Unsupported protocol")
 558         id = self.random_port()
 559         pkts = []
 560         if proto == IP_PROTOS.tcp:
 561             raw = Raw(data[0:4])
 562         else:
 563             raw = Raw(data[0:16])
 564         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 565              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 566              proto_header /
 567              raw)
 568         pkts.append(p)
 569         if proto == IP_PROTOS.tcp:
 570             raw = Raw(data[4:20])
 571         else:
 572             raw = Raw(data[16:32])
 573         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 574              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 575                 proto=proto) /
 576              raw)
 577         pkts.append(p)
 578         if proto == IP_PROTOS.tcp:
 579             raw = Raw(data[20:])
 580         else:
 581             raw = Raw(data[32:])
 582         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 583              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 584                 id=id) /
 585              raw)
 586         pkts.append(p)
 587         return pkts
 588
 589     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 590                                   proto=IP_PROTOS.tcp):
 591
 592         layer = self.proto2layer(proto)
 593
 594         if proto == IP_PROTOS.tcp:
 595             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 596         else:
 597             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 598         port_in = self.random_port()
 599
 600         for i in range(2):
 601             # out2in
 602             pkts = self.create_stream_frag(self.pg0, out_addr,
 603                                            port_in, out_port,
 604                                            data, proto)
 605             self.pg0.add_stream(pkts)
 606             self.pg_enable_capture(self.pg_interfaces)
 607             self.pg_start()
 608             frags = self.pg1.get_capture(len(pkts))
 609             p = self.reass_frags_and_verify(frags,
 610                                             self.pg0.remote_ip4,
 611                                             in_addr)
 612             if proto != IP_PROTOS.icmp:
 613                 self.assertEqual(p[layer].sport, port_in)
 614                 self.assertEqual(p[layer].dport, in_port)
 615             else:
 616                 self.assertEqual(p[layer].id, port_in)
 617             self.assertEqual(data, p[Raw].load)
 618
 619             # in2out
 620             if proto != IP_PROTOS.icmp:
 621                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 622                                                in_port,
 623                                                p[layer].sport, data, proto)
 624             else:
 625                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 626                                                p[layer].id, 0, data, proto,
 627                                                echo_reply=True)
 628             self.pg1.add_stream(pkts)
 629             self.pg_enable_capture(self.pg_interfaces)
 630             self.pg_start()
 631             frags = self.pg0.get_capture(len(pkts))
 632             p = self.reass_frags_and_verify(frags,
 633                                             out_addr,
 634                                             self.pg0.remote_ip4)
 635             if proto != IP_PROTOS.icmp:
 636                 self.assertEqual(p[layer].sport, out_port)
 637                 self.assertEqual(p[layer].dport, port_in)
 638             else:
 639                 self.assertEqual(p[layer].id, port_in)
 640             self.assertEqual(data, p[Raw].load)
 641
 642     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 643                                       out_port, proto=IP_PROTOS.tcp):
 644
 645         layer = self.proto2layer(proto)
 646
 647         if proto == IP_PROTOS.tcp:
 648             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 649         else:
 650             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 651         port_in = self.random_port()
 652
 653         for i in range(2):
 654             # out2in
 655             pkts = self.create_stream_frag(self.pg0, out_addr,
 656                                            port_in, out_port,
 657                                            data, proto)
 658             pkts.reverse()
 659             self.pg0.add_stream(pkts)
 660             self.pg_enable_capture(self.pg_interfaces)
 661             self.pg_start()
 662             frags = self.pg1.get_capture(len(pkts))
 663             p = self.reass_frags_and_verify(frags,
 664                                             self.pg0.remote_ip4,
 665                                             in_addr)
 666             if proto != IP_PROTOS.icmp:
 667                 self.assertEqual(p[layer].dport, in_port)
 668                 self.assertEqual(p[layer].sport, port_in)
 669                 self.assertEqual(p[layer].dport, in_port)
 670             else:
 671                 self.assertEqual(p[layer].id, port_in)
 672             self.assertEqual(data, p[Raw].load)
 673
 674             # in2out
 675             if proto != IP_PROTOS.icmp:
 676                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 677                                                in_port,
 678                                                p[layer].sport, data, proto)
 679             else:
 680                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 681                                                p[layer].id, 0, data, proto,
 682                                                echo_reply=True)
 683             pkts.reverse()
 684             self.pg1.add_stream(pkts)
 685             self.pg_enable_capture(self.pg_interfaces)
 686             self.pg_start()
 687             frags = self.pg0.get_capture(len(pkts))
 688             p = self.reass_frags_and_verify(frags,
 689                                             out_addr,
 690                                             self.pg0.remote_ip4)
 691             if proto != IP_PROTOS.icmp:
 692                 self.assertEqual(p[layer].sport, out_port)
 693                 self.assertEqual(p[layer].dport, port_in)
 694             else:
 695                 self.assertEqual(p[layer].id, port_in)
 696             self.assertEqual(data, p[Raw].load)
 697
 698     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 699         # SYN packet in->out
 700         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 701              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 702              TCP(sport=in_port, dport=ext_port, flags="S"))
 703         in_if.add_stream(p)
 704         self.pg_enable_capture(self.pg_interfaces)
 705         self.pg_start()
 706         capture = out_if.get_capture(1)
 707         p = capture[0]
 708         out_port = p[TCP].sport
 709
 710         # SYN + ACK packet out->in
 711         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 712              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 713              TCP(sport=ext_port, dport=out_port, flags="SA"))
 714         out_if.add_stream(p)
 715         self.pg_enable_capture(self.pg_interfaces)
 716         self.pg_start()
 717         in_if.get_capture(1)
 718
 719         # ACK packet in->out
 720         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 721              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 722              TCP(sport=in_port, dport=ext_port, flags="A"))
 723         in_if.add_stream(p)
 724         self.pg_enable_capture(self.pg_interfaces)
 725         self.pg_start()
 726         out_if.get_capture(1)
 727
 728         return out_port
 729
 730     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 731                          client_id=None):
 732         twice_nat_addr = '10.0.1.3'
 733
 734         port_in = 8080
 735         if lb:
 736             if not same_pg:
 737                 port_in1 = port_in
 738                 port_in2 = port_in
 739             else:
 740                 port_in1 = port_in + 1
 741                 port_in2 = port_in + 2
 742
 743         port_out = 80
 744         eh_port_out = 4567
 745
 746         server1 = self.pg0.remote_hosts[0]
 747         server2 = self.pg0.remote_hosts[1]
 748         if lb and same_pg:
 749             server2 = server1
 750         if not lb:
 751             server = server1
 752
 753         pg0 = self.pg0
 754         if same_pg:
 755             pg1 = self.pg0
 756         else:
 757             pg1 = self.pg1
 758
 759         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 760                         client_id == 1)
 761
 762         self.nat_add_address(self.nat_addr)
 763         self.nat_add_address(twice_nat_addr, twice_nat=1)
 764
 765         flags = 0
 766         if self_twice_nat:
 767             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 768         else:
 769             flags |= self.config_flags.NAT_IS_TWICE_NAT
 770
 771         if not lb:
 772             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 773                                         port_in, port_out,
 774                                         proto=IP_PROTOS.tcp,
 775                                         flags=flags)
 776         else:
 777             locals = [{'addr': server1.ip4,
 778                        'port': port_in1,
 779                        'probability': 50,
 780                        'vrf_id': 0},
 781                       {'addr': server2.ip4,
 782                        'port': port_in2,
 783                        'probability': 50,
 784                        'vrf_id': 0}]
 785             out_addr = self.nat_addr
 786
 787             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 788                                                       external_addr=out_addr,
 789                                                       external_port=port_out,
 790                                                       protocol=IP_PROTOS.tcp,
 791                                                       local_num=len(locals),
 792                                                       locals=locals)
 793         self.nat_add_inside_interface(pg0)
 794         self.nat_add_outside_interface(pg1)
 795
 796         if same_pg:
 797             if not lb:
 798                 client = server
 799             else:
 800                 assert client_id is not None
 801                 if client_id == 1:
 802                     client = self.pg0.remote_hosts[0]
 803                 elif client_id == 2:
 804                     client = self.pg0.remote_hosts[1]
 805         else:
 806             client = pg1.remote_hosts[0]
 807         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 808              IP(src=client.ip4, dst=self.nat_addr) /
 809              TCP(sport=eh_port_out, dport=port_out))
 810         pg1.add_stream(p)
 811         self.pg_enable_capture(self.pg_interfaces)
 812         self.pg_start()
 813         capture = pg0.get_capture(1)
 814         p = capture[0]
 815         try:
 816             ip = p[IP]
 817             tcp = p[TCP]
 818             if lb:
 819                 if ip.dst == server1.ip4:
 820                     server = server1
 821                     port_in = port_in1
 822                 else:
 823                     server = server2
 824                     port_in = port_in2
 825             self.assertEqual(ip.dst, server.ip4)
 826             if lb and same_pg:
 827                 self.assertIn(tcp.dport, [port_in1, port_in2])
 828             else:
 829                 self.assertEqual(tcp.dport, port_in)
 830             if eh_translate:
 831                 self.assertEqual(ip.src, twice_nat_addr)
 832                 self.assertNotEqual(tcp.sport, eh_port_out)
 833             else:
 834                 self.assertEqual(ip.src, client.ip4)
 835                 self.assertEqual(tcp.sport, eh_port_out)
 836             eh_addr_in = ip.src
 837             eh_port_in = tcp.sport
 838             saved_port_in = tcp.dport
 839             self.assert_packet_checksums_valid(p)
 840         except:
 841             self.logger.error(ppp("Unexpected or invalid packet:", p))
 842             raise
 843
 844         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 845              IP(src=server.ip4, dst=eh_addr_in) /
 846              TCP(sport=saved_port_in, dport=eh_port_in))
 847         pg0.add_stream(p)
 848         self.pg_enable_capture(self.pg_interfaces)
 849         self.pg_start()
 850         capture = pg1.get_capture(1)
 851         p = capture[0]
 852         try:
 853             ip = p[IP]
 854             tcp = p[TCP]
 855             self.assertEqual(ip.dst, client.ip4)
 856             self.assertEqual(ip.src, self.nat_addr)
 857             self.assertEqual(tcp.dport, eh_port_out)
 858             self.assertEqual(tcp.sport, port_out)
 859             self.assert_packet_checksums_valid(p)
 860         except:
 861             self.logger.error(ppp("Unexpected or invalid packet:", p))
 862             raise
 863
 864         if eh_translate:
 865             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 866             self.assertEqual(len(sessions), 1)
 867             self.assertTrue(sessions[0].flags &
 868                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 869             self.assertTrue(sessions[0].flags &
 870                             self.config_flags.NAT_IS_TWICE_NAT)
 871             self.logger.info(self.vapi.cli("show nat44 sessions"))
 872             self.vapi.nat44_del_session(
 873                 address=sessions[0].inside_ip_address,
 874                 port=sessions[0].inside_port,
 875                 protocol=sessions[0].protocol,
 876                 flags=(self.config_flags.NAT_IS_INSIDE |
 877                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 878                 ext_host_address=sessions[0].ext_host_nat_address,
 879                 ext_host_port=sessions[0].ext_host_nat_port)
 880             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 881             self.assertEqual(len(sessions), 0)
 882
 883     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 884         message = data.decode('utf-8')
 885         try:
 886             message = SyslogMessage.parse(message)
 887         except ParseError as e:
 888             self.logger.error(e)
 889             raise
 890         else:
 891             self.assertEqual(message.severity, SyslogSeverity.info)
 892             self.assertEqual(message.appname, 'NAT')
 893             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 894             sd_params = message.sd.get('nsess')
 895             self.assertTrue(sd_params is not None)
 896             if is_ip6:
 897                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 898                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 899             else:
 900                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 901                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 902                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 903             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 904             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 905             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 906             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 907             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 908             self.assertEqual(sd_params.get('SVLAN'), '0')
 909             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 910             self.assertEqual(sd_params.get('XDPORT'),
 911                              "%d" % self.tcp_external_port)
 912
 913
 914 class TestNAT44ED(NAT44EDTestCase):
 915     """ NAT44ED Test Case """
 916
 917     def test_users_dump(self):
 918         """ NAT44ED API test - nat44_user_dump """
 919
 920         self.nat_add_address(self.nat_addr)
 921         self.nat_add_inside_interface(self.pg0)
 922         self.nat_add_outside_interface(self.pg1)
 923
 924         self.vapi.nat44_forwarding_enable_disable(enable=1)
 925
 926         local_ip = self.pg0.remote_ip4
 927         external_ip = self.nat_addr
 928         self.nat_add_static_mapping(local_ip, external_ip)
 929
 930         users = self.vapi.nat44_user_dump()
 931         self.assertEqual(len(users), 0)
 932
 933         # in2out - static mapping match
 934
 935         pkts = self.create_stream_out(self.pg1)
 936         self.pg1.add_stream(pkts)
 937         self.pg_enable_capture(self.pg_interfaces)
 938         self.pg_start()
 939         capture = self.pg0.get_capture(len(pkts))
 940         self.verify_capture_in(capture, self.pg0)
 941
 942         pkts = self.create_stream_in(self.pg0, self.pg1)
 943         self.pg0.add_stream(pkts)
 944         self.pg_enable_capture(self.pg_interfaces)
 945         self.pg_start()
 946         capture = self.pg1.get_capture(len(pkts))
 947         self.verify_capture_out(capture, same_port=True)
 948
 949         users = self.vapi.nat44_user_dump()
 950         self.assertEqual(len(users), 1)
 951         static_user = users[0]
 952         self.assertEqual(static_user.nstaticsessions, 3)
 953         self.assertEqual(static_user.nsessions, 0)
 954
 955         # in2out - no static mapping match (forwarding test)
 956
 957         host0 = self.pg0.remote_hosts[0]
 958         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
 959         try:
 960             pkts = self.create_stream_out(self.pg1,
 961                                           dst_ip=self.pg0.remote_ip4,
 962                                           use_inside_ports=True)
 963             self.pg1.add_stream(pkts)
 964             self.pg_enable_capture(self.pg_interfaces)
 965             self.pg_start()
 966             capture = self.pg0.get_capture(len(pkts))
 967             self.verify_capture_in(capture, self.pg0)
 968
 969             pkts = self.create_stream_in(self.pg0, self.pg1)
 970             self.pg0.add_stream(pkts)
 971             self.pg_enable_capture(self.pg_interfaces)
 972             self.pg_start()
 973             capture = self.pg1.get_capture(len(pkts))
 974             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
 975                                     same_port=True)
 976         finally:
 977             self.pg0.remote_hosts[0] = host0
 978
 979         users = self.vapi.nat44_user_dump()
 980         self.assertEqual(len(users), 2)
 981         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
 982             non_static_user = users[1]
 983             static_user = users[0]
 984         else:
 985             non_static_user = users[0]
 986             static_user = users[1]
 987         self.assertEqual(static_user.nstaticsessions, 3)
 988         self.assertEqual(static_user.nsessions, 0)
 989         self.assertEqual(non_static_user.nstaticsessions, 0)
 990         self.assertEqual(non_static_user.nsessions, 3)
 991
 992         users = self.vapi.nat44_user_dump()
 993         self.assertEqual(len(users), 2)
 994         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
 995             non_static_user = users[1]
 996             static_user = users[0]
 997         else:
 998             non_static_user = users[0]
 999             static_user = users[1]
1000         self.assertEqual(static_user.nstaticsessions, 3)
1001         self.assertEqual(static_user.nsessions, 0)
1002         self.assertEqual(non_static_user.nstaticsessions, 0)
1003         self.assertEqual(non_static_user.nsessions, 3)
1004
1005     def test_frag_out_of_order_do_not_translate(self):
1006         """ NAT44ED don't translate fragments arriving out of order """
1007         self.nat_add_inside_interface(self.pg0)
1008         self.nat_add_outside_interface(self.pg1)
1009         self.vapi.nat44_forwarding_enable_disable(enable=True)
1010         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1011
1012     def test_forwarding(self):
1013         """ NAT44ED forwarding test """
1014
1015         self.nat_add_inside_interface(self.pg0)
1016         self.nat_add_outside_interface(self.pg1)
1017         self.vapi.nat44_forwarding_enable_disable(enable=1)
1018
1019         real_ip = self.pg0.remote_ip4
1020         alias_ip = self.nat_addr
1021         flags = self.config_flags.NAT_IS_ADDR_ONLY
1022         self.vapi.nat44_add_del_static_mapping(is_add=1,
1023                                                local_ip_address=real_ip,
1024                                                external_ip_address=alias_ip,
1025                                                external_sw_if_index=0xFFFFFFFF,
1026                                                flags=flags)
1027
1028         try:
1029             # in2out - static mapping match
1030
1031             pkts = self.create_stream_out(self.pg1)
1032             self.pg1.add_stream(pkts)
1033             self.pg_enable_capture(self.pg_interfaces)
1034             self.pg_start()
1035             capture = self.pg0.get_capture(len(pkts))
1036             self.verify_capture_in(capture, self.pg0)
1037
1038             pkts = self.create_stream_in(self.pg0, self.pg1)
1039             self.pg0.add_stream(pkts)
1040             self.pg_enable_capture(self.pg_interfaces)
1041             self.pg_start()
1042             capture = self.pg1.get_capture(len(pkts))
1043             self.verify_capture_out(capture, same_port=True)
1044
1045             # in2out - no static mapping match
1046
1047             host0 = self.pg0.remote_hosts[0]
1048             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1049             try:
1050                 pkts = self.create_stream_out(self.pg1,
1051                                               dst_ip=self.pg0.remote_ip4,
1052                                               use_inside_ports=True)
1053                 self.pg1.add_stream(pkts)
1054                 self.pg_enable_capture(self.pg_interfaces)
1055                 self.pg_start()
1056                 capture = self.pg0.get_capture(len(pkts))
1057                 self.verify_capture_in(capture, self.pg0)
1058
1059                 pkts = self.create_stream_in(self.pg0, self.pg1)
1060                 self.pg0.add_stream(pkts)
1061                 self.pg_enable_capture(self.pg_interfaces)
1062                 self.pg_start()
1063                 capture = self.pg1.get_capture(len(pkts))
1064                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1065                                         same_port=True)
1066             finally:
1067                 self.pg0.remote_hosts[0] = host0
1068
1069             user = self.pg0.remote_hosts[1]
1070             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1071             self.assertEqual(len(sessions), 3)
1072             self.assertTrue(sessions[0].flags &
1073                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1074             self.vapi.nat44_del_session(
1075                 address=sessions[0].inside_ip_address,
1076                 port=sessions[0].inside_port,
1077                 protocol=sessions[0].protocol,
1078                 flags=(self.config_flags.NAT_IS_INSIDE |
1079                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1080                 ext_host_address=sessions[0].ext_host_address,
1081                 ext_host_port=sessions[0].ext_host_port)
1082             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1083             self.assertEqual(len(sessions), 2)
1084
1085         finally:
1086             self.vapi.nat44_forwarding_enable_disable(enable=0)
1087             flags = self.config_flags.NAT_IS_ADDR_ONLY
1088             self.vapi.nat44_add_del_static_mapping(
1089                 is_add=0,
1090                 local_ip_address=real_ip,
1091                 external_ip_address=alias_ip,
1092                 external_sw_if_index=0xFFFFFFFF,
1093                 flags=flags)
1094
1095     def test_output_feature_and_service2(self):
1096         """ NAT44ED interface output feature and service host direct access """
1097         self.vapi.nat44_forwarding_enable_disable(enable=1)
1098         self.nat_add_address(self.nat_addr)
1099
1100         self.vapi.nat44_interface_add_del_output_feature(
1101             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1102
1103         # session initiated from service host - translate
1104         pkts = self.create_stream_in(self.pg0, self.pg1)
1105         self.pg0.add_stream(pkts)
1106         self.pg_enable_capture(self.pg_interfaces)
1107         self.pg_start()
1108         capture = self.pg1.get_capture(len(pkts))
1109         self.verify_capture_out(capture, ignore_port=True)
1110
1111         pkts = self.create_stream_out(self.pg1)
1112         self.pg1.add_stream(pkts)
1113         self.pg_enable_capture(self.pg_interfaces)
1114         self.pg_start()
1115         capture = self.pg0.get_capture(len(pkts))
1116         self.verify_capture_in(capture, self.pg0)
1117
1118         # session initiated from remote host - do not translate
1119         tcp_port_in = self.tcp_port_in
1120         udp_port_in = self.udp_port_in
1121         icmp_id_in = self.icmp_id_in
1122
1123         self.tcp_port_in = 60303
1124         self.udp_port_in = 60304
1125         self.icmp_id_in = 60305
1126
1127         try:
1128             pkts = self.create_stream_out(self.pg1,
1129                                           self.pg0.remote_ip4,
1130                                           use_inside_ports=True)
1131             self.pg1.add_stream(pkts)
1132             self.pg_enable_capture(self.pg_interfaces)
1133             self.pg_start()
1134             capture = self.pg0.get_capture(len(pkts))
1135             self.verify_capture_in(capture, self.pg0)
1136
1137             pkts = self.create_stream_in(self.pg0, self.pg1)
1138             self.pg0.add_stream(pkts)
1139             self.pg_enable_capture(self.pg_interfaces)
1140             self.pg_start()
1141             capture = self.pg1.get_capture(len(pkts))
1142             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1143                                     same_port=True)
1144         finally:
1145             self.tcp_port_in = tcp_port_in
1146             self.udp_port_in = udp_port_in
1147             self.icmp_id_in = icmp_id_in
1148
1149     def test_twice_nat(self):
1150         """ NAT44ED Twice NAT """
1151         self.twice_nat_common()
1152
1153     def test_self_twice_nat_positive(self):
1154         """ NAT44ED Self Twice NAT (positive test) """
1155         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1156
1157     def test_self_twice_nat_lb_positive(self):
1158         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1159         """
1160         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1161                               client_id=1)
1162
1163     def test_twice_nat_lb(self):
1164         """ NAT44ED Twice NAT local service load balancing """
1165         self.twice_nat_common(lb=True)
1166
1167     def test_output_feature(self):
1168         """ NAT44ED interface output feature (in2out postrouting) """
1169         self.vapi.nat44_forwarding_enable_disable(enable=1)
1170         self.nat_add_address(self.nat_addr)
1171
1172         self.nat_add_outside_interface(self.pg0)
1173         self.vapi.nat44_interface_add_del_output_feature(
1174             sw_if_index=self.pg1.sw_if_index, is_add=1)
1175
1176         # in2out
1177         pkts = self.create_stream_in(self.pg0, self.pg1)
1178         self.pg0.add_stream(pkts)
1179         self.pg_enable_capture(self.pg_interfaces)
1180         self.pg_start()
1181         capture = self.pg1.get_capture(len(pkts))
1182         self.verify_capture_out(capture, ignore_port=True)
1183
1184         # out2in
1185         pkts = self.create_stream_out(self.pg1)
1186         self.pg1.add_stream(pkts)
1187         self.pg_enable_capture(self.pg_interfaces)
1188         self.pg_start()
1189         capture = self.pg0.get_capture(len(pkts))
1190         self.verify_capture_in(capture, self.pg0)
1191
1192         # in2out
1193         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1194         self.pg0.add_stream(pkts)
1195         self.pg_enable_capture(self.pg_interfaces)
1196         self.pg_start()
1197         capture = self.pg1.get_capture(len(pkts))
1198         self.verify_capture_out(capture, ignore_port=True)
1199
1200         # out2in
1201         pkts = self.create_stream_out(self.pg1, ttl=2)
1202         self.pg1.add_stream(pkts)
1203         self.pg_enable_capture(self.pg_interfaces)
1204         self.pg_start()
1205         capture = self.pg0.get_capture(len(pkts))
1206         self.verify_capture_in(capture, self.pg0)
1207
1208         # in2out
1209         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1210         self.pg0.add_stream(pkts)
1211         self.pg_enable_capture(self.pg_interfaces)
1212         self.pg_start()
1213         capture = self.pg0.get_capture(len(pkts))
1214         for p in capture:
1215             self.assertIn(ICMP, p)
1216             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1217
1218     def test_static_with_port_out2(self):
1219         """ NAT44ED 1:1 NAPT asymmetrical rule """
1220
1221         external_port = 80
1222         local_port = 8080
1223
1224         self.vapi.nat44_forwarding_enable_disable(enable=1)
1225         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1226         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1227                                     local_port, external_port,
1228                                     proto=IP_PROTOS.tcp, flags=flags)
1229
1230         self.nat_add_inside_interface(self.pg0)
1231         self.nat_add_outside_interface(self.pg1)
1232
1233         # from client to service
1234         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1235              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1236              TCP(sport=12345, dport=external_port))
1237         self.pg1.add_stream(p)
1238         self.pg_enable_capture(self.pg_interfaces)
1239         self.pg_start()
1240         capture = self.pg0.get_capture(1)
1241         p = capture[0]
1242         try:
1243             ip = p[IP]
1244             tcp = p[TCP]
1245             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1246             self.assertEqual(tcp.dport, local_port)
1247             self.assert_packet_checksums_valid(p)
1248         except:
1249             self.logger.error(ppp("Unexpected or invalid packet:", p))
1250             raise
1251
1252         # ICMP error
1253         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1254              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1255              ICMP(type=11) / capture[0][IP])
1256         self.pg0.add_stream(p)
1257         self.pg_enable_capture(self.pg_interfaces)
1258         self.pg_start()
1259         capture = self.pg1.get_capture(1)
1260         p = capture[0]
1261         try:
1262             self.assertEqual(p[IP].src, self.nat_addr)
1263             inner = p[IPerror]
1264             self.assertEqual(inner.dst, self.nat_addr)
1265             self.assertEqual(inner[TCPerror].dport, external_port)
1266         except:
1267             self.logger.error(ppp("Unexpected or invalid packet:", p))
1268             raise
1269
1270         # from service back to client
1271         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1272              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1273              TCP(sport=local_port, dport=12345))
1274         self.pg0.add_stream(p)
1275         self.pg_enable_capture(self.pg_interfaces)
1276         self.pg_start()
1277         capture = self.pg1.get_capture(1)
1278         p = capture[0]
1279         try:
1280             ip = p[IP]
1281             tcp = p[TCP]
1282             self.assertEqual(ip.src, self.nat_addr)
1283             self.assertEqual(tcp.sport, external_port)
1284             self.assert_packet_checksums_valid(p)
1285         except:
1286             self.logger.error(ppp("Unexpected or invalid packet:", p))
1287             raise
1288
1289         # ICMP error
1290         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1291              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1292              ICMP(type=11) / capture[0][IP])
1293         self.pg1.add_stream(p)
1294         self.pg_enable_capture(self.pg_interfaces)
1295         self.pg_start()
1296         capture = self.pg0.get_capture(1)
1297         p = capture[0]
1298         try:
1299             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1300             inner = p[IPerror]
1301             self.assertEqual(inner.src, self.pg0.remote_ip4)
1302             self.assertEqual(inner[TCPerror].sport, local_port)
1303         except:
1304             self.logger.error(ppp("Unexpected or invalid packet:", p))
1305             raise
1306
1307         # from client to server (no translation)
1308         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1309              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1310              TCP(sport=12346, dport=local_port))
1311         self.pg1.add_stream(p)
1312         self.pg_enable_capture(self.pg_interfaces)
1313         self.pg_start()
1314         capture = self.pg0.get_capture(1)
1315         p = capture[0]
1316         try:
1317             ip = p[IP]
1318             tcp = p[TCP]
1319             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1320             self.assertEqual(tcp.dport, local_port)
1321             self.assert_packet_checksums_valid(p)
1322         except:
1323             self.logger.error(ppp("Unexpected or invalid packet:", p))
1324             raise
1325
1326         # from service back to client (no translation)
1327         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1328              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1329              TCP(sport=local_port, dport=12346))
1330         self.pg0.add_stream(p)
1331         self.pg_enable_capture(self.pg_interfaces)
1332         self.pg_start()
1333         capture = self.pg1.get_capture(1)
1334         p = capture[0]
1335         try:
1336             ip = p[IP]
1337             tcp = p[TCP]
1338             self.assertEqual(ip.src, self.pg0.remote_ip4)
1339             self.assertEqual(tcp.sport, local_port)
1340             self.assert_packet_checksums_valid(p)
1341         except:
1342             self.logger.error(ppp("Unexpected or invalid packet:", p))
1343             raise
1344
1345     def test_static_lb(self):
1346         """ NAT44ED local service load balancing """
1347         external_addr_n = self.nat_addr
1348         external_port = 80
1349         local_port = 8080
1350         server1 = self.pg0.remote_hosts[0]
1351         server2 = self.pg0.remote_hosts[1]
1352
1353         locals = [{'addr': server1.ip4,
1354                    'port': local_port,
1355                    'probability': 70,
1356                    'vrf_id': 0},
1357                   {'addr': server2.ip4,
1358                    'port': local_port,
1359                    'probability': 30,
1360                    'vrf_id': 0}]
1361
1362         self.nat_add_address(self.nat_addr)
1363         self.vapi.nat44_add_del_lb_static_mapping(
1364             is_add=1,
1365             external_addr=external_addr_n,
1366             external_port=external_port,
1367             protocol=IP_PROTOS.tcp,
1368             local_num=len(locals),
1369             locals=locals)
1370         flags = self.config_flags.NAT_IS_INSIDE
1371         self.vapi.nat44_interface_add_del_feature(
1372             sw_if_index=self.pg0.sw_if_index,
1373             flags=flags, is_add=1)
1374         self.vapi.nat44_interface_add_del_feature(
1375             sw_if_index=self.pg1.sw_if_index,
1376             is_add=1)
1377
1378         # from client to service
1379         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1380              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1381              TCP(sport=12345, dport=external_port))
1382         self.pg1.add_stream(p)
1383         self.pg_enable_capture(self.pg_interfaces)
1384         self.pg_start()
1385         capture = self.pg0.get_capture(1)
1386         p = capture[0]
1387         server = None
1388         try:
1389             ip = p[IP]
1390             tcp = p[TCP]
1391             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1392             if ip.dst == server1.ip4:
1393                 server = server1
1394             else:
1395                 server = server2
1396             self.assertEqual(tcp.dport, local_port)
1397             self.assert_packet_checksums_valid(p)
1398         except:
1399             self.logger.error(ppp("Unexpected or invalid packet:", p))
1400             raise
1401
1402         # from service back to client
1403         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1404              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1405              TCP(sport=local_port, dport=12345))
1406         self.pg0.add_stream(p)
1407         self.pg_enable_capture(self.pg_interfaces)
1408         self.pg_start()
1409         capture = self.pg1.get_capture(1)
1410         p = capture[0]
1411         try:
1412             ip = p[IP]
1413             tcp = p[TCP]
1414             self.assertEqual(ip.src, self.nat_addr)
1415             self.assertEqual(tcp.sport, external_port)
1416             self.assert_packet_checksums_valid(p)
1417         except:
1418             self.logger.error(ppp("Unexpected or invalid packet:", p))
1419             raise
1420
1421         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1422         self.assertEqual(len(sessions), 1)
1423         self.assertTrue(sessions[0].flags &
1424                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1425         self.vapi.nat44_del_session(
1426             address=sessions[0].inside_ip_address,
1427             port=sessions[0].inside_port,
1428             protocol=sessions[0].protocol,
1429             flags=(self.config_flags.NAT_IS_INSIDE |
1430                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1431             ext_host_address=sessions[0].ext_host_address,
1432             ext_host_port=sessions[0].ext_host_port)
1433         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1434         self.assertEqual(len(sessions), 0)
1435
1436     def test_static_lb_2(self):
1437         """ NAT44ED local service load balancing (asymmetrical rule) """
1438         external_addr = self.nat_addr
1439         external_port = 80
1440         local_port = 8080
1441         server1 = self.pg0.remote_hosts[0]
1442         server2 = self.pg0.remote_hosts[1]
1443
1444         locals = [{'addr': server1.ip4,
1445                    'port': local_port,
1446                    'probability': 70,
1447                    'vrf_id': 0},
1448                   {'addr': server2.ip4,
1449                    'port': local_port,
1450                    'probability': 30,
1451                    'vrf_id': 0}]
1452
1453         self.vapi.nat44_forwarding_enable_disable(enable=1)
1454         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1455         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1456                                                   external_addr=external_addr,
1457                                                   external_port=external_port,
1458                                                   protocol=IP_PROTOS.tcp,
1459                                                   local_num=len(locals),
1460                                                   locals=locals)
1461         flags = self.config_flags.NAT_IS_INSIDE
1462         self.vapi.nat44_interface_add_del_feature(
1463             sw_if_index=self.pg0.sw_if_index,
1464             flags=flags, is_add=1)
1465         self.vapi.nat44_interface_add_del_feature(
1466             sw_if_index=self.pg1.sw_if_index,
1467             is_add=1)
1468
1469         # from client to service
1470         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1471              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1472              TCP(sport=12345, dport=external_port))
1473         self.pg1.add_stream(p)
1474         self.pg_enable_capture(self.pg_interfaces)
1475         self.pg_start()
1476         capture = self.pg0.get_capture(1)
1477         p = capture[0]
1478         server = None
1479         try:
1480             ip = p[IP]
1481             tcp = p[TCP]
1482             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1483             if ip.dst == server1.ip4:
1484                 server = server1
1485             else:
1486                 server = server2
1487             self.assertEqual(tcp.dport, local_port)
1488             self.assert_packet_checksums_valid(p)
1489         except:
1490             self.logger.error(ppp("Unexpected or invalid packet:", p))
1491             raise
1492
1493         # from service back to client
1494         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1495              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1496              TCP(sport=local_port, dport=12345))
1497         self.pg0.add_stream(p)
1498         self.pg_enable_capture(self.pg_interfaces)
1499         self.pg_start()
1500         capture = self.pg1.get_capture(1)
1501         p = capture[0]
1502         try:
1503             ip = p[IP]
1504             tcp = p[TCP]
1505             self.assertEqual(ip.src, self.nat_addr)
1506             self.assertEqual(tcp.sport, external_port)
1507             self.assert_packet_checksums_valid(p)
1508         except:
1509             self.logger.error(ppp("Unexpected or invalid packet:", p))
1510             raise
1511
1512         # from client to server (no translation)
1513         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1514              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1515              TCP(sport=12346, dport=local_port))
1516         self.pg1.add_stream(p)
1517         self.pg_enable_capture(self.pg_interfaces)
1518         self.pg_start()
1519         capture = self.pg0.get_capture(1)
1520         p = capture[0]
1521         server = None
1522         try:
1523             ip = p[IP]
1524             tcp = p[TCP]
1525             self.assertEqual(ip.dst, server1.ip4)
1526             self.assertEqual(tcp.dport, local_port)
1527             self.assert_packet_checksums_valid(p)
1528         except:
1529             self.logger.error(ppp("Unexpected or invalid packet:", p))
1530             raise
1531
1532         # from service back to client (no translation)
1533         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1534              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1535              TCP(sport=local_port, dport=12346))
1536         self.pg0.add_stream(p)
1537         self.pg_enable_capture(self.pg_interfaces)
1538         self.pg_start()
1539         capture = self.pg1.get_capture(1)
1540         p = capture[0]
1541         try:
1542             ip = p[IP]
1543             tcp = p[TCP]
1544             self.assertEqual(ip.src, server1.ip4)
1545             self.assertEqual(tcp.sport, local_port)
1546             self.assert_packet_checksums_valid(p)
1547         except:
1548             self.logger.error(ppp("Unexpected or invalid packet:", p))
1549             raise
1550
1551     def test_lb_affinity(self):
1552         """ NAT44ED local service load balancing affinity """
1553         external_addr = self.nat_addr
1554         external_port = 80
1555         local_port = 8080
1556         server1 = self.pg0.remote_hosts[0]
1557         server2 = self.pg0.remote_hosts[1]
1558
1559         locals = [{'addr': server1.ip4,
1560                    'port': local_port,
1561                    'probability': 50,
1562                    'vrf_id': 0},
1563                   {'addr': server2.ip4,
1564                    'port': local_port,
1565                    'probability': 50,
1566                    'vrf_id': 0}]
1567
1568         self.nat_add_address(self.nat_addr)
1569         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1570                                                   external_addr=external_addr,
1571                                                   external_port=external_port,
1572                                                   protocol=IP_PROTOS.tcp,
1573                                                   affinity=10800,
1574                                                   local_num=len(locals),
1575                                                   locals=locals)
1576         flags = self.config_flags.NAT_IS_INSIDE
1577         self.vapi.nat44_interface_add_del_feature(
1578             sw_if_index=self.pg0.sw_if_index,
1579             flags=flags, is_add=1)
1580         self.vapi.nat44_interface_add_del_feature(
1581             sw_if_index=self.pg1.sw_if_index,
1582             is_add=1)
1583
1584         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1585              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1586              TCP(sport=1025, dport=external_port))
1587         self.pg1.add_stream(p)
1588         self.pg_enable_capture(self.pg_interfaces)
1589         self.pg_start()
1590         capture = self.pg0.get_capture(1)
1591         backend = capture[0][IP].dst
1592
1593         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1594         self.assertEqual(len(sessions), 1)
1595         self.assertTrue(sessions[0].flags &
1596                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1597         self.vapi.nat44_del_session(
1598             address=sessions[0].inside_ip_address,
1599             port=sessions[0].inside_port,
1600             protocol=sessions[0].protocol,
1601             flags=(self.config_flags.NAT_IS_INSIDE |
1602                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1603             ext_host_address=sessions[0].ext_host_address,
1604             ext_host_port=sessions[0].ext_host_port)
1605
1606         pkts = []
1607         for port in range(1030, 1100):
1608             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1609                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1610                  TCP(sport=port, dport=external_port))
1611             pkts.append(p)
1612         self.pg1.add_stream(pkts)
1613         self.pg_enable_capture(self.pg_interfaces)
1614         self.pg_start()
1615         capture = self.pg0.get_capture(len(pkts))
1616         for p in capture:
1617             self.assertEqual(p[IP].dst, backend)
1618
1619     def test_multiple_vrf_1(self):
1620         """ Multiple VRF - both client & service in VRF1 """
1621
1622         external_addr = '1.2.3.4'
1623         external_port = 80
1624         local_port = 8080
1625         port = 0
1626
1627         flags = self.config_flags.NAT_IS_INSIDE
1628         self.vapi.nat44_interface_add_del_feature(
1629             sw_if_index=self.pg5.sw_if_index,
1630             is_add=1)
1631         self.vapi.nat44_interface_add_del_feature(
1632             sw_if_index=self.pg5.sw_if_index,
1633             is_add=1, flags=flags)
1634         self.vapi.nat44_interface_add_del_feature(
1635             sw_if_index=self.pg6.sw_if_index,
1636             is_add=1)
1637         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1638         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1639                                     local_port, external_port, vrf_id=1,
1640                                     proto=IP_PROTOS.tcp, flags=flags)
1641
1642         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1643              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1644              TCP(sport=12345, dport=external_port))
1645         self.pg6.add_stream(p)
1646         self.pg_enable_capture(self.pg_interfaces)
1647         self.pg_start()
1648         capture = self.pg5.get_capture(1)
1649         p = capture[0]
1650         try:
1651             ip = p[IP]
1652             tcp = p[TCP]
1653             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1654             self.assertEqual(tcp.dport, local_port)
1655             self.assert_packet_checksums_valid(p)
1656         except:
1657             self.logger.error(ppp("Unexpected or invalid packet:", p))
1658             raise
1659
1660         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1661              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1662              TCP(sport=local_port, dport=12345))
1663         self.pg5.add_stream(p)
1664         self.pg_enable_capture(self.pg_interfaces)
1665         self.pg_start()
1666         capture = self.pg6.get_capture(1)
1667         p = capture[0]
1668         try:
1669             ip = p[IP]
1670             tcp = p[TCP]
1671             self.assertEqual(ip.src, external_addr)
1672             self.assertEqual(tcp.sport, external_port)
1673             self.assert_packet_checksums_valid(p)
1674         except:
1675             self.logger.error(ppp("Unexpected or invalid packet:", p))
1676             raise
1677
1678     def test_multiple_vrf_2(self):
1679         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1680
1681         external_addr = '1.2.3.4'
1682         external_port = 80
1683         local_port = 8080
1684         port = 0
1685
1686         self.nat_add_address(self.nat_addr)
1687         flags = self.config_flags.NAT_IS_INSIDE
1688         self.vapi.nat44_interface_add_del_output_feature(
1689             sw_if_index=self.pg1.sw_if_index,
1690             is_add=1)
1691         self.vapi.nat44_interface_add_del_feature(
1692             sw_if_index=self.pg5.sw_if_index,
1693             is_add=1)
1694         self.vapi.nat44_interface_add_del_feature(
1695             sw_if_index=self.pg5.sw_if_index,
1696             is_add=1, flags=flags)
1697         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1698         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1699                                     local_port, external_port, vrf_id=1,
1700                                     proto=IP_PROTOS.tcp, flags=flags)
1701
1702         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1703              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1704              TCP(sport=2345, dport=22))
1705         self.pg5.add_stream(p)
1706         self.pg_enable_capture(self.pg_interfaces)
1707         self.pg_start()
1708         capture = self.pg1.get_capture(1)
1709         p = capture[0]
1710         try:
1711             ip = p[IP]
1712             tcp = p[TCP]
1713             self.assertEqual(ip.src, self.nat_addr)
1714             self.assert_packet_checksums_valid(p)
1715             port = tcp.sport
1716         except:
1717             self.logger.error(ppp("Unexpected or invalid packet:", p))
1718             raise
1719
1720         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1721              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1722              TCP(sport=22, dport=port))
1723         self.pg1.add_stream(p)
1724         self.pg_enable_capture(self.pg_interfaces)
1725         self.pg_start()
1726         capture = self.pg5.get_capture(1)
1727         p = capture[0]
1728         try:
1729             ip = p[IP]
1730             tcp = p[TCP]
1731             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1732             self.assertEqual(tcp.dport, 2345)
1733             self.assert_packet_checksums_valid(p)
1734         except:
1735             self.logger.error(ppp("Unexpected or invalid packet:", p))
1736             raise
1737
1738     def test_multiple_vrf_3(self):
1739         """ Multiple VRF - client in VRF1, service in VRF0 """
1740
1741         external_addr = '1.2.3.4'
1742         external_port = 80
1743         local_port = 8080
1744         port = 0
1745
1746         flags = self.config_flags.NAT_IS_INSIDE
1747         self.vapi.nat44_interface_add_del_feature(
1748             sw_if_index=self.pg0.sw_if_index,
1749             is_add=1)
1750         self.vapi.nat44_interface_add_del_feature(
1751             sw_if_index=self.pg0.sw_if_index,
1752             is_add=1, flags=flags)
1753         self.vapi.nat44_interface_add_del_feature(
1754             sw_if_index=self.pg6.sw_if_index,
1755             is_add=1)
1756         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1757         self.nat_add_static_mapping(
1758             self.pg0.remote_ip4,
1759             external_sw_if_index=self.pg0.sw_if_index,
1760             local_port=local_port,
1761             vrf_id=0,
1762             external_port=external_port,
1763             proto=IP_PROTOS.tcp,
1764             flags=flags
1765         )
1766
1767         # from client VRF1 to service VRF0
1768         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1769              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1770              TCP(sport=12346, dport=external_port))
1771         self.pg6.add_stream(p)
1772         self.pg_enable_capture(self.pg_interfaces)
1773         self.pg_start()
1774         capture = self.pg0.get_capture(1)
1775         p = capture[0]
1776         try:
1777             ip = p[IP]
1778             tcp = p[TCP]
1779             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1780             self.assertEqual(tcp.dport, local_port)
1781             self.assert_packet_checksums_valid(p)
1782         except:
1783             self.logger.error(ppp("Unexpected or invalid packet:", p))
1784             raise
1785
1786         # from service VRF0 back to client VRF1
1787         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1788              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1789              TCP(sport=local_port, dport=12346))
1790         self.pg0.add_stream(p)
1791         self.pg_enable_capture(self.pg_interfaces)
1792         self.pg_start()
1793         capture = self.pg6.get_capture(1)
1794         p = capture[0]
1795         try:
1796             ip = p[IP]
1797             tcp = p[TCP]
1798             self.assertEqual(ip.src, self.pg0.local_ip4)
1799             self.assertEqual(tcp.sport, external_port)
1800             self.assert_packet_checksums_valid(p)
1801         except:
1802             self.logger.error(ppp("Unexpected or invalid packet:", p))
1803             raise
1804
1805     def test_multiple_vrf_4(self):
1806         """ Multiple VRF - client in VRF0, service in VRF1 """
1807
1808         external_addr = '1.2.3.4'
1809         external_port = 80
1810         local_port = 8080
1811         port = 0
1812
1813         flags = self.config_flags.NAT_IS_INSIDE
1814         self.vapi.nat44_interface_add_del_feature(
1815             sw_if_index=self.pg0.sw_if_index,
1816             is_add=1)
1817         self.vapi.nat44_interface_add_del_feature(
1818             sw_if_index=self.pg0.sw_if_index,
1819             is_add=1, flags=flags)
1820         self.vapi.nat44_interface_add_del_feature(
1821             sw_if_index=self.pg5.sw_if_index,
1822             is_add=1)
1823         self.vapi.nat44_interface_add_del_feature(
1824             sw_if_index=self.pg5.sw_if_index,
1825             is_add=1, flags=flags)
1826         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1827         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1828                                     local_port, external_port, vrf_id=1,
1829                                     proto=IP_PROTOS.tcp, flags=flags)
1830
1831         # from client VRF0 to service VRF1
1832         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1833              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1834              TCP(sport=12347, dport=external_port))
1835         self.pg0.add_stream(p)
1836         self.pg_enable_capture(self.pg_interfaces)
1837         self.pg_start()
1838         capture = self.pg5.get_capture(1)
1839         p = capture[0]
1840         try:
1841             ip = p[IP]
1842             tcp = p[TCP]
1843             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1844             self.assertEqual(tcp.dport, local_port)
1845             self.assert_packet_checksums_valid(p)
1846         except:
1847             self.logger.error(ppp("Unexpected or invalid packet:", p))
1848             raise
1849
1850         # from service VRF1 back to client VRF0
1851         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1852              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1853              TCP(sport=local_port, dport=12347))
1854         self.pg5.add_stream(p)
1855         self.pg_enable_capture(self.pg_interfaces)
1856         self.pg_start()
1857         capture = self.pg0.get_capture(1)
1858         p = capture[0]
1859         try:
1860             ip = p[IP]
1861             tcp = p[TCP]
1862             self.assertEqual(ip.src, external_addr)
1863             self.assertEqual(tcp.sport, external_port)
1864             self.assert_packet_checksums_valid(p)
1865         except:
1866             self.logger.error(ppp("Unexpected or invalid packet:", p))
1867             raise
1868
1869     def test_multiple_vrf_5(self):
1870         """ Multiple VRF - forwarding - no translation """
1871
1872         external_addr = '1.2.3.4'
1873         external_port = 80
1874         local_port = 8080
1875         port = 0
1876
1877         self.vapi.nat44_forwarding_enable_disable(enable=1)
1878         flags = self.config_flags.NAT_IS_INSIDE
1879         self.vapi.nat44_interface_add_del_feature(
1880             sw_if_index=self.pg0.sw_if_index,
1881             is_add=1)
1882         self.vapi.nat44_interface_add_del_feature(
1883             sw_if_index=self.pg0.sw_if_index,
1884             is_add=1, flags=flags)
1885         self.vapi.nat44_interface_add_del_feature(
1886             sw_if_index=self.pg5.sw_if_index,
1887             is_add=1)
1888         self.vapi.nat44_interface_add_del_feature(
1889             sw_if_index=self.pg5.sw_if_index,
1890             is_add=1, flags=flags)
1891         self.vapi.nat44_interface_add_del_feature(
1892             sw_if_index=self.pg6.sw_if_index,
1893             is_add=1)
1894         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1895         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1896                                     local_port, external_port, vrf_id=1,
1897                                     proto=IP_PROTOS.tcp, flags=flags)
1898         self.nat_add_static_mapping(
1899             self.pg0.remote_ip4,
1900             external_sw_if_index=self.pg0.sw_if_index,
1901             local_port=local_port,
1902             vrf_id=0,
1903             external_port=external_port,
1904             proto=IP_PROTOS.tcp,
1905             flags=flags
1906         )
1907
1908         # from client to server (both VRF1, no translation)
1909         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1910              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1911              TCP(sport=12348, dport=local_port))
1912         self.pg6.add_stream(p)
1913         self.pg_enable_capture(self.pg_interfaces)
1914         self.pg_start()
1915         capture = self.pg5.get_capture(1)
1916         p = capture[0]
1917         try:
1918             ip = p[IP]
1919             tcp = p[TCP]
1920             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1921             self.assertEqual(tcp.dport, local_port)
1922             self.assert_packet_checksums_valid(p)
1923         except:
1924             self.logger.error(ppp("Unexpected or invalid packet:", p))
1925             raise
1926
1927         # from server back to client (both VRF1, no translation)
1928         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1929              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1930              TCP(sport=local_port, dport=12348))
1931         self.pg5.add_stream(p)
1932         self.pg_enable_capture(self.pg_interfaces)
1933         self.pg_start()
1934         capture = self.pg6.get_capture(1)
1935         p = capture[0]
1936         try:
1937             ip = p[IP]
1938             tcp = p[TCP]
1939             self.assertEqual(ip.src, self.pg5.remote_ip4)
1940             self.assertEqual(tcp.sport, local_port)
1941             self.assert_packet_checksums_valid(p)
1942         except:
1943             self.logger.error(ppp("Unexpected or invalid packet:", p))
1944             raise
1945
1946         # from client VRF1 to server VRF0 (no translation)
1947         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1948              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1949              TCP(sport=local_port, dport=12349))
1950         self.pg0.add_stream(p)
1951         self.pg_enable_capture(self.pg_interfaces)
1952         self.pg_start()
1953         capture = self.pg6.get_capture(1)
1954         p = capture[0]
1955         try:
1956             ip = p[IP]
1957             tcp = p[TCP]
1958             self.assertEqual(ip.src, self.pg0.remote_ip4)
1959             self.assertEqual(tcp.sport, local_port)
1960             self.assert_packet_checksums_valid(p)
1961         except:
1962             self.logger.error(ppp("Unexpected or invalid packet:", p))
1963             raise
1964
1965         # from server VRF0 back to client VRF1 (no translation)
1966         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1967              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1968              TCP(sport=local_port, dport=12349))
1969         self.pg0.add_stream(p)
1970         self.pg_enable_capture(self.pg_interfaces)
1971         self.pg_start()
1972         capture = self.pg6.get_capture(1)
1973         p = capture[0]
1974         try:
1975             ip = p[IP]
1976             tcp = p[TCP]
1977             self.assertEqual(ip.src, self.pg0.remote_ip4)
1978             self.assertEqual(tcp.sport, local_port)
1979             self.assert_packet_checksums_valid(p)
1980         except:
1981             self.logger.error(ppp("Unexpected or invalid packet:", p))
1982             raise
1983
1984         # from client VRF0 to server VRF1 (no translation)
1985         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1986              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
1987              TCP(sport=12344, dport=local_port))
1988         self.pg0.add_stream(p)
1989         self.pg_enable_capture(self.pg_interfaces)
1990         self.pg_start()
1991         capture = self.pg5.get_capture(1)
1992         p = capture[0]
1993         try:
1994             ip = p[IP]
1995             tcp = p[TCP]
1996             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1997             self.assertEqual(tcp.dport, local_port)
1998             self.assert_packet_checksums_valid(p)
1999         except:
2000             self.logger.error(ppp("Unexpected or invalid packet:", p))
2001             raise
2002
2003         # from server VRF1 back to client VRF0 (no translation)
2004         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2005              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2006              TCP(sport=local_port, dport=12344))
2007         self.pg5.add_stream(p)
2008         self.pg_enable_capture(self.pg_interfaces)
2009         self.pg_start()
2010         capture = self.pg0.get_capture(1)
2011         p = capture[0]
2012         try:
2013             ip = p[IP]
2014             tcp = p[TCP]
2015             self.assertEqual(ip.src, self.pg5.remote_ip4)
2016             self.assertEqual(tcp.sport, local_port)
2017             self.assert_packet_checksums_valid(p)
2018         except:
2019             self.logger.error(ppp("Unexpected or invalid packet:", p))
2020             raise
2021
2022     def test_outside_address_distribution(self):
2023         """ Outside address distribution based on source address """
2024
2025         x = 100
2026         nat_addresses = []
2027
2028         for i in range(1, x):
2029             a = "10.0.0.%d" % i
2030             nat_addresses.append(a)
2031
2032         self.nat_add_inside_interface(self.pg0)
2033         self.nat_add_outside_interface(self.pg1)
2034
2035         self.vapi.nat44_add_del_address_range(
2036             first_ip_address=nat_addresses[0],
2037             last_ip_address=nat_addresses[-1],
2038             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2039
2040         self.pg0.generate_remote_hosts(x)
2041
2042         pkts = []
2043         for i in range(x):
2044             info = self.create_packet_info(self.pg0, self.pg1)
2045             payload = self.info_to_payload(info)
2046             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2047                  IP(src=self.pg0.remote_hosts[i].ip4,
2048                      dst=self.pg1.remote_ip4) /
2049                  UDP(sport=7000+i, dport=8000+i) /
2050                  Raw(payload))
2051             info.data = p
2052             pkts.append(p)
2053
2054         self.pg0.add_stream(pkts)
2055         self.pg_enable_capture(self.pg_interfaces)
2056         self.pg_start()
2057         recvd = self.pg1.get_capture(len(pkts))
2058         for p_recvd in recvd:
2059             payload_info = self.payload_to_info(p_recvd[Raw])
2060             packet_index = payload_info.index
2061             info = self._packet_infos[packet_index]
2062             self.assertTrue(info is not None)
2063             self.assertEqual(packet_index, info.index)
2064             p_sent = info.data
2065             packed = socket.inet_aton(p_sent[IP].src)
2066             numeric = struct.unpack("!L", packed)[0]
2067             numeric = socket.htonl(numeric)
2068             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2069             self.assertEqual(
2070                 a, p_recvd[IP].src,
2071                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2072                 % (p_sent[IP].src, p_recvd[IP].src, a))
2073
2074
2075 class TestNAT44EDMW(TestNAT44ED):
2076     """ NAT44ED MW Test Case """
2077     vpp_worker_count = 4
2078     max_sessions = 5000
2079
2080     @unittest.skip('MW fix required')
2081     def test_users_dump(self):
2082         """ NAT44ED API test - nat44_user_dump """
2083
2084     @unittest.skip('MW fix required')
2085     def test_frag_out_of_order_do_not_translate(self):
2086         """ NAT44ED don't translate fragments arriving out of order """
2087
2088     @unittest.skip('MW fix required')
2089     def test_forwarding(self):
2090         """ NAT44ED forwarding test """
2091
2092     @unittest.skip('MW fix required')
2093     def test_twice_nat(self):
2094         """ NAT44ED Twice NAT """
2095
2096     @unittest.skip('MW fix required')
2097     def test_twice_nat_lb(self):
2098         """ NAT44ED Twice NAT local service load balancing """
2099
2100     @unittest.skip('MW fix required')
2101     def test_output_feature(self):
2102         """ NAT44ED interface output feature (in2out postrouting) """
2103
2104     @unittest.skip('MW fix required')
2105     def test_static_with_port_out2(self):
2106         """ NAT44ED 1:1 NAPT asymmetrical rule """
2107
2108     @unittest.skip('MW fix required')
2109     def test_output_feature_and_service2(self):
2110         """ NAT44ED interface output feature and service host direct access """
2111
2112     @unittest.skip('MW fix required')
2113     def test_static_lb(self):
2114         """ NAT44ED local service load balancing """
2115
2116     @unittest.skip('MW fix required')
2117     def test_static_lb_2(self):
2118         """ NAT44ED local service load balancing (asymmetrical rule) """
2119
2120     @unittest.skip('MW fix required')
2121     def test_lb_affinity(self):
2122         """ NAT44ED local service load balancing affinity """
2123
2124     @unittest.skip('MW fix required')
2125     def test_multiple_vrf(self):
2126         """ NAT44ED Multiple VRF setup """
2127
2128     @unittest.skip('MW fix required')
2129     def test_self_twice_nat_positive(self):
2130         """ NAT44ED Self Twice NAT (positive test) """
2131
2132     @unittest.skip('MW fix required')
2133     def test_self_twice_nat_lb_positive(self):
2134         """ NAT44ED Self Twice NAT local service load balancing (positive test)
2135         """
2136
2137     def test_dynamic(self):
2138         """ NAT44ED dynamic translation test """
2139         pkt_count = 1500
2140         tcp_port_offset = 20
2141         udp_port_offset = 20
2142         icmp_id_offset = 20
2143
2144         self.nat_add_address(self.nat_addr)
2145         self.nat_add_inside_interface(self.pg0)
2146         self.nat_add_outside_interface(self.pg1)
2147
2148         # in2out
2149         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2150         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2151         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2152         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2153
2154         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2155
2156         for i in range(pkt_count):
2157             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2158                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2159                  TCP(sport=tcp_port_offset + i, dport=20))
2160             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2161
2162             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2163                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2164                  UDP(sport=udp_port_offset + i, dport=20))
2165             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2166
2167             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2168                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2169                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2170             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2171
2172         for i in range(0, self.vpp_worker_count):
2173             if len(i2o_pkts[i]) > 0:
2174                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2175
2176         self.pg_enable_capture(self.pg_interfaces)
2177         self.pg_start()
2178         capture = self.pg1.get_capture(pkt_count * 3)
2179
2180         if_idx = self.pg0.sw_if_index
2181         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2182         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2183         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2184         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2185
2186         self.assertEqual(
2187             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2188         self.assertEqual(
2189             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2190         self.assertEqual(
2191             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2192         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2193
2194         self.logger.info(self.vapi.cli("show trace"))
2195
2196         # out2in
2197         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2198         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2199         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2200         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2201
2202         recvd_tcp_ports = set()
2203         recvd_udp_ports = set()
2204         recvd_icmp_ids = set()
2205
2206         for p in capture:
2207             if TCP in p:
2208                 recvd_tcp_ports.add(p[TCP].sport)
2209             if UDP in p:
2210                 recvd_udp_ports.add(p[UDP].sport)
2211             if ICMP in p:
2212                 recvd_icmp_ids.add(p[ICMP].id)
2213
2214         recvd_tcp_ports = list(recvd_tcp_ports)
2215         recvd_udp_ports = list(recvd_udp_ports)
2216         recvd_icmp_ids = list(recvd_icmp_ids)
2217
2218         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2219         for i in range(pkt_count):
2220             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2221                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2222                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2223             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2224
2225             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2226                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2227                  UDP(dport=choice(recvd_udp_ports), sport=20))
2228             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2229
2230             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2231                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2232                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2233             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2234
2235         for i in range(0, self.vpp_worker_count):
2236             if len(o2i_pkts[i]) > 0:
2237                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2238
2239         self.pg_enable_capture(self.pg_interfaces)
2240         self.pg_start()
2241         capture = self.pg0.get_capture(pkt_count * 3)
2242         for packet in capture:
2243             try:
2244                 self.assert_packet_checksums_valid(packet)
2245                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2246                 if packet.haslayer(TCP):
2247                     self.assert_in_range(
2248                         packet[TCP].dport, tcp_port_offset,
2249                         tcp_port_offset + pkt_count, "dst TCP port")
2250                 elif packet.haslayer(UDP):
2251                     self.assert_in_range(
2252                         packet[UDP].dport, udp_port_offset,
2253                         udp_port_offset + pkt_count, "dst UDP port")
2254                 else:
2255                     self.assert_in_range(
2256                         packet[ICMP].id, icmp_id_offset,
2257                         icmp_id_offset + pkt_count, "ICMP id")
2258             except:
2259                 self.logger.error(ppp("Unexpected or invalid packet "
2260                                       "(inside network):", packet))
2261                 raise
2262
2263         if_idx = self.pg1.sw_if_index
2264         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2265         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2266         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2267         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2268
2269         self.assertEqual(
2270             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2271         self.assertEqual(
2272             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2273         self.assertEqual(
2274             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2275         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2276
2277         sc = self.statistics['/nat44-ed/total-sessions']
2278         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2279                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2280
2281     def test_frag_in_order(self):
2282         """ NAT44ED translate fragments arriving in order """
2283
2284         self.nat_add_address(self.nat_addr)
2285         self.nat_add_inside_interface(self.pg0)
2286         self.nat_add_outside_interface(self.pg1)
2287
2288         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2289         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2290         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2291
2292     def test_frag_in_order_do_not_translate(self):
2293         """ NAT44ED don't translate fragments arriving in order """
2294
2295         self.nat_add_address(self.nat_addr)
2296         self.nat_add_inside_interface(self.pg0)
2297         self.nat_add_outside_interface(self.pg1)
2298         self.vapi.nat44_forwarding_enable_disable(enable=True)
2299
2300         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2301
2302     def test_frag_out_of_order(self):
2303         """ NAT44ED translate fragments arriving out of order """
2304
2305         self.nat_add_address(self.nat_addr)
2306         self.nat_add_inside_interface(self.pg0)
2307         self.nat_add_outside_interface(self.pg1)
2308
2309         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2310         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2311         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2312
2313     def test_frag_in_order_in_plus_out(self):
2314         """ NAT44ED in+out interface fragments in order """
2315
2316         in_port = self.random_port()
2317         out_port = self.random_port()
2318
2319         self.nat_add_address(self.nat_addr)
2320         self.nat_add_inside_interface(self.pg0)
2321         self.nat_add_outside_interface(self.pg0)
2322         self.nat_add_inside_interface(self.pg1)
2323         self.nat_add_outside_interface(self.pg1)
2324
2325         # add static mappings for server
2326         self.nat_add_static_mapping(self.server_addr,
2327                                     self.nat_addr,
2328                                     in_port,
2329                                     out_port,
2330                                     proto=IP_PROTOS.tcp)
2331         self.nat_add_static_mapping(self.server_addr,
2332                                     self.nat_addr,
2333                                     in_port,
2334                                     out_port,
2335                                     proto=IP_PROTOS.udp)
2336         self.nat_add_static_mapping(self.server_addr,
2337                                     self.nat_addr,
2338                                     proto=IP_PROTOS.icmp)
2339
2340         # run tests for each protocol
2341         self.frag_in_order_in_plus_out(self.server_addr,
2342                                        self.nat_addr,
2343                                        in_port,
2344                                        out_port,
2345                                        IP_PROTOS.tcp)
2346         self.frag_in_order_in_plus_out(self.server_addr,
2347                                        self.nat_addr,
2348                                        in_port,
2349                                        out_port,
2350                                        IP_PROTOS.udp)
2351         self.frag_in_order_in_plus_out(self.server_addr,
2352                                        self.nat_addr,
2353                                        in_port,
2354                                        out_port,
2355                                        IP_PROTOS.icmp)
2356
2357     def test_frag_out_of_order_in_plus_out(self):
2358         """ NAT44ED in+out interface fragments out of order """
2359
2360         in_port = self.random_port()
2361         out_port = self.random_port()
2362
2363         self.nat_add_address(self.nat_addr)
2364         self.nat_add_inside_interface(self.pg0)
2365         self.nat_add_outside_interface(self.pg0)
2366         self.nat_add_inside_interface(self.pg1)
2367         self.nat_add_outside_interface(self.pg1)
2368
2369         # add static mappings for server
2370         self.nat_add_static_mapping(self.server_addr,
2371                                     self.nat_addr,
2372                                     in_port,
2373                                     out_port,
2374                                     proto=IP_PROTOS.tcp)
2375         self.nat_add_static_mapping(self.server_addr,
2376                                     self.nat_addr,
2377                                     in_port,
2378                                     out_port,
2379                                     proto=IP_PROTOS.udp)
2380         self.nat_add_static_mapping(self.server_addr,
2381                                     self.nat_addr,
2382                                     proto=IP_PROTOS.icmp)
2383
2384         # run tests for each protocol
2385         self.frag_out_of_order_in_plus_out(self.server_addr,
2386                                            self.nat_addr,
2387                                            in_port,
2388                                            out_port,
2389                                            IP_PROTOS.tcp)
2390         self.frag_out_of_order_in_plus_out(self.server_addr,
2391                                            self.nat_addr,
2392                                            in_port,
2393                                            out_port,
2394                                            IP_PROTOS.udp)
2395         self.frag_out_of_order_in_plus_out(self.server_addr,
2396                                            self.nat_addr,
2397                                            in_port,
2398                                            out_port,
2399                                            IP_PROTOS.icmp)
2400
2401     def test_reass_hairpinning(self):
2402         """ NAT44ED fragments hairpinning """
2403
2404         server_addr = self.pg0.remote_hosts[1].ip4
2405
2406         host_in_port = self.random_port()
2407         server_in_port = self.random_port()
2408         server_out_port = self.random_port()
2409
2410         self.nat_add_address(self.nat_addr)
2411         self.nat_add_inside_interface(self.pg0)
2412         self.nat_add_outside_interface(self.pg1)
2413
2414         # add static mapping for server
2415         self.nat_add_static_mapping(server_addr, self.nat_addr,
2416                                     server_in_port, server_out_port,
2417                                     proto=IP_PROTOS.tcp)
2418         self.nat_add_static_mapping(server_addr, self.nat_addr,
2419                                     server_in_port, server_out_port,
2420                                     proto=IP_PROTOS.udp)
2421         self.nat_add_static_mapping(server_addr, self.nat_addr)
2422
2423         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2424                                host_in_port, proto=IP_PROTOS.tcp,
2425                                ignore_port=True)
2426         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2427                                host_in_port, proto=IP_PROTOS.udp,
2428                                ignore_port=True)
2429         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2430                                host_in_port, proto=IP_PROTOS.icmp,
2431                                ignore_port=True)
2432
2433     def test_session_limit_per_vrf(self):
2434         """ NAT44ED per vrf session limit """
2435
2436         inside = self.pg0
2437         inside_vrf10 = self.pg2
2438         outside = self.pg1
2439
2440         limit = 5
2441
2442         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2443         # non existing vrf_id makes process core dump
2444         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2445
2446         self.nat_add_inside_interface(inside)
2447         self.nat_add_inside_interface(inside_vrf10)
2448         self.nat_add_outside_interface(outside)
2449
2450         # vrf independent
2451         self.nat_add_interface_address(outside)
2452
2453         # BUG: causing core dump - when bad vrf_id is specified
2454         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2455
2456         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2457         inside_vrf10.add_stream(stream)
2458
2459         self.pg_enable_capture(self.pg_interfaces)
2460         self.pg_start()
2461
2462         capture = outside.get_capture(limit)
2463
2464         stream = self.create_tcp_stream(inside, outside, limit * 2)
2465         inside.add_stream(stream)
2466
2467         self.pg_enable_capture(self.pg_interfaces)
2468         self.pg_start()
2469
2470         capture = outside.get_capture(len(stream))
2471
2472     def test_show_max_translations(self):
2473         """ NAT44ED API test - max translations per thread """
2474         nat_config = self.vapi.nat_show_config_2()
2475         self.assertEqual(self.max_sessions,
2476                          nat_config.max_translations_per_thread)
2477
2478     def test_lru_cleanup(self):
2479         """ NAT44ED LRU cleanup algorithm """
2480
2481         self.nat_add_address(self.nat_addr)
2482         self.nat_add_inside_interface(self.pg0)
2483         self.nat_add_outside_interface(self.pg1)
2484
2485         self.vapi.nat_set_timeouts(
2486             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2487
2488         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2489         pkts = []
2490         for i in range(0, self.max_sessions - 1):
2491             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2492                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2493                  UDP(sport=7000+i, dport=80))
2494             pkts.append(p)
2495
2496         self.pg0.add_stream(pkts)
2497         self.pg_enable_capture(self.pg_interfaces)
2498         self.pg_start()
2499         self.pg1.get_capture(len(pkts))
2500         self.sleep(1.5, "wait for timeouts")
2501
2502         pkts = []
2503         for i in range(0, self.max_sessions - 1):
2504             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2505                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2506                  ICMP(id=8000+i, type='echo-request'))
2507             pkts.append(p)
2508
2509         self.pg0.add_stream(pkts)
2510         self.pg_enable_capture(self.pg_interfaces)
2511         self.pg_start()
2512         self.pg1.get_capture(len(pkts))
2513
2514     def test_session_rst_timeout(self):
2515         """ NAT44ED session RST timeouts """
2516
2517         self.nat_add_address(self.nat_addr)
2518         self.nat_add_inside_interface(self.pg0)
2519         self.nat_add_outside_interface(self.pg1)
2520
2521         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2522                                    tcp_transitory=5, icmp=60)
2523
2524         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2525                               self.tcp_external_port)
2526         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2527              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2528              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2529                  flags="R"))
2530         self.pg0.add_stream(p)
2531         self.pg_enable_capture(self.pg_interfaces)
2532         self.pg_start()
2533         self.pg1.get_capture(1)
2534
2535         self.sleep(6)
2536
2537         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2538              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2539              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2540                  flags="S"))
2541         self.pg0.add_stream(p)
2542         self.pg_enable_capture(self.pg_interfaces)
2543         self.pg_start()
2544         self.pg1.get_capture(1)
2545
2546     def test_dynamic_out_of_ports(self):
2547         """ NAT44ED dynamic translation test: out of ports """
2548
2549         self.nat_add_inside_interface(self.pg0)
2550         self.nat_add_outside_interface(self.pg1)
2551
2552         # in2out and no NAT addresses added
2553         err_old = self.statistics.get_err_counter(
2554             '/err/nat44-ed-in2out-slowpath/out of ports')
2555
2556         pkts = self.create_stream_in(self.pg0, self.pg1)
2557         self.pg0.add_stream(pkts)
2558         self.pg_enable_capture(self.pg_interfaces)
2559         self.pg_start()
2560         self.pg1.get_capture(0, timeout=1)
2561
2562         err_new = self.statistics.get_err_counter(
2563             '/err/nat44-ed-in2out-slowpath/out of ports')
2564
2565         self.assertEqual(err_new - err_old, len(pkts))
2566
2567         # in2out after NAT addresses added
2568         self.nat_add_address(self.nat_addr)
2569
2570         err_old = self.statistics.get_err_counter(
2571             '/err/nat44-ed-in2out-slowpath/out of ports')
2572
2573         pkts = self.create_stream_in(self.pg0, self.pg1)
2574         self.pg0.add_stream(pkts)
2575         self.pg_enable_capture(self.pg_interfaces)
2576         self.pg_start()
2577         capture = self.pg1.get_capture(len(pkts))
2578         self.verify_capture_out(capture, ignore_port=True)
2579
2580         err_new = self.statistics.get_err_counter(
2581             '/err/nat44-ed-in2out-slowpath/out of ports')
2582
2583         self.assertEqual(err_new, err_old)
2584
2585     def test_unknown_proto(self):
2586         """ NAT44ED translate packet with unknown protocol """
2587
2588         self.nat_add_address(self.nat_addr)
2589         self.nat_add_inside_interface(self.pg0)
2590         self.nat_add_outside_interface(self.pg1)
2591
2592         # in2out
2593         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2594              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2595              TCP(sport=self.tcp_port_in, dport=20))
2596         self.pg0.add_stream(p)
2597         self.pg_enable_capture(self.pg_interfaces)
2598         self.pg_start()
2599         p = self.pg1.get_capture(1)
2600
2601         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2602              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2603              GRE() /
2604              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2605              TCP(sport=1234, dport=1234))
2606         self.pg0.add_stream(p)
2607         self.pg_enable_capture(self.pg_interfaces)
2608         self.pg_start()
2609         p = self.pg1.get_capture(1)
2610         packet = p[0]
2611         try:
2612             self.assertEqual(packet[IP].src, self.nat_addr)
2613             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2614             self.assertEqual(packet.haslayer(GRE), 1)
2615             self.assert_packet_checksums_valid(packet)
2616         except:
2617             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2618             raise
2619
2620         # out2in
2621         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2622              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2623              GRE() /
2624              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2625              TCP(sport=1234, dport=1234))
2626         self.pg1.add_stream(p)
2627         self.pg_enable_capture(self.pg_interfaces)
2628         self.pg_start()
2629         p = self.pg0.get_capture(1)
2630         packet = p[0]
2631         try:
2632             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2633             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2634             self.assertEqual(packet.haslayer(GRE), 1)
2635             self.assert_packet_checksums_valid(packet)
2636         except:
2637             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2638             raise
2639
2640     def test_hairpinning_unknown_proto(self):
2641         """ NAT44ED translate packet with unknown protocol - hairpinning """
2642         host = self.pg0.remote_hosts[0]
2643         server = self.pg0.remote_hosts[1]
2644         host_in_port = 1234
2645         server_out_port = 8765
2646         server_nat_ip = "10.0.0.11"
2647
2648         self.nat_add_address(self.nat_addr)
2649         self.nat_add_inside_interface(self.pg0)
2650         self.nat_add_outside_interface(self.pg1)
2651
2652         # add static mapping for server
2653         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2654
2655         # host to server
2656         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2657              IP(src=host.ip4, dst=server_nat_ip) /
2658              TCP(sport=host_in_port, dport=server_out_port))
2659         self.pg0.add_stream(p)
2660         self.pg_enable_capture(self.pg_interfaces)
2661         self.pg_start()
2662         self.pg0.get_capture(1)
2663
2664         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2665              IP(src=host.ip4, dst=server_nat_ip) /
2666              GRE() /
2667              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2668              TCP(sport=1234, dport=1234))
2669         self.pg0.add_stream(p)
2670         self.pg_enable_capture(self.pg_interfaces)
2671         self.pg_start()
2672         p = self.pg0.get_capture(1)
2673         packet = p[0]
2674         try:
2675             self.assertEqual(packet[IP].src, self.nat_addr)
2676             self.assertEqual(packet[IP].dst, server.ip4)
2677             self.assertEqual(packet.haslayer(GRE), 1)
2678             self.assert_packet_checksums_valid(packet)
2679         except:
2680             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2681             raise
2682
2683         # server to host
2684         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2685              IP(src=server.ip4, dst=self.nat_addr) /
2686              GRE() /
2687              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2688              TCP(sport=1234, dport=1234))
2689         self.pg0.add_stream(p)
2690         self.pg_enable_capture(self.pg_interfaces)
2691         self.pg_start()
2692         p = self.pg0.get_capture(1)
2693         packet = p[0]
2694         try:
2695             self.assertEqual(packet[IP].src, server_nat_ip)
2696             self.assertEqual(packet[IP].dst, host.ip4)
2697             self.assertEqual(packet.haslayer(GRE), 1)
2698             self.assert_packet_checksums_valid(packet)
2699         except:
2700             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2701             raise
2702
2703     def test_output_feature_and_service(self):
2704         """ NAT44ED interface output feature and services """
2705         external_addr = '1.2.3.4'
2706         external_port = 80
2707         local_port = 8080
2708
2709         self.vapi.nat44_forwarding_enable_disable(enable=1)
2710         self.nat_add_address(self.nat_addr)
2711         flags = self.config_flags.NAT_IS_ADDR_ONLY
2712         self.vapi.nat44_add_del_identity_mapping(
2713             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2714             flags=flags, is_add=1)
2715         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2716         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2717                                     local_port, external_port,
2718                                     proto=IP_PROTOS.tcp, flags=flags)
2719
2720         self.nat_add_inside_interface(self.pg0)
2721         self.nat_add_outside_interface(self.pg0)
2722         self.vapi.nat44_interface_add_del_output_feature(
2723             sw_if_index=self.pg1.sw_if_index, is_add=1)
2724
2725         # from client to service
2726         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2727              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2728              TCP(sport=12345, dport=external_port))
2729         self.pg1.add_stream(p)
2730         self.pg_enable_capture(self.pg_interfaces)
2731         self.pg_start()
2732         capture = self.pg0.get_capture(1)
2733         p = capture[0]
2734         try:
2735             ip = p[IP]
2736             tcp = p[TCP]
2737             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2738             self.assertEqual(tcp.dport, local_port)
2739             self.assert_packet_checksums_valid(p)
2740         except:
2741             self.logger.error(ppp("Unexpected or invalid packet:", p))
2742             raise
2743
2744         # from service back to client
2745         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2746              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2747              TCP(sport=local_port, dport=12345))
2748         self.pg0.add_stream(p)
2749         self.pg_enable_capture(self.pg_interfaces)
2750         self.pg_start()
2751         capture = self.pg1.get_capture(1)
2752         p = capture[0]
2753         try:
2754             ip = p[IP]
2755             tcp = p[TCP]
2756             self.assertEqual(ip.src, external_addr)
2757             self.assertEqual(tcp.sport, external_port)
2758             self.assert_packet_checksums_valid(p)
2759         except:
2760             self.logger.error(ppp("Unexpected or invalid packet:", p))
2761             raise
2762
2763         # from local network host to external network
2764         pkts = self.create_stream_in(self.pg0, self.pg1)
2765         self.pg0.add_stream(pkts)
2766         self.pg_enable_capture(self.pg_interfaces)
2767         self.pg_start()
2768         capture = self.pg1.get_capture(len(pkts))
2769         self.verify_capture_out(capture, ignore_port=True)
2770         pkts = self.create_stream_in(self.pg0, self.pg1)
2771         self.pg0.add_stream(pkts)
2772         self.pg_enable_capture(self.pg_interfaces)
2773         self.pg_start()
2774         capture = self.pg1.get_capture(len(pkts))
2775         self.verify_capture_out(capture, ignore_port=True)
2776
2777         # from external network back to local network host
2778         pkts = self.create_stream_out(self.pg1)
2779         self.pg1.add_stream(pkts)
2780         self.pg_enable_capture(self.pg_interfaces)
2781         self.pg_start()
2782         capture = self.pg0.get_capture(len(pkts))
2783         self.verify_capture_in(capture, self.pg0)
2784
2785     def test_output_feature_and_service3(self):
2786         """ NAT44ED interface output feature and DST NAT """
2787         external_addr = '1.2.3.4'
2788         external_port = 80
2789         local_port = 8080
2790
2791         self.vapi.nat44_forwarding_enable_disable(enable=1)
2792         self.nat_add_address(self.nat_addr)
2793         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2794         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2795                                     local_port, external_port,
2796                                     proto=IP_PROTOS.tcp, flags=flags)
2797
2798         self.nat_add_inside_interface(self.pg0)
2799         self.nat_add_outside_interface(self.pg0)
2800         self.vapi.nat44_interface_add_del_output_feature(
2801             sw_if_index=self.pg1.sw_if_index, is_add=1)
2802
2803         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2804              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2805              TCP(sport=12345, dport=external_port))
2806         self.pg0.add_stream(p)
2807         self.pg_enable_capture(self.pg_interfaces)
2808         self.pg_start()
2809         capture = self.pg1.get_capture(1)
2810         p = capture[0]
2811         try:
2812             ip = p[IP]
2813             tcp = p[TCP]
2814             self.assertEqual(ip.src, self.pg0.remote_ip4)
2815             self.assertEqual(tcp.sport, 12345)
2816             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2817             self.assertEqual(tcp.dport, local_port)
2818             self.assert_packet_checksums_valid(p)
2819         except:
2820             self.logger.error(ppp("Unexpected or invalid packet:", p))
2821             raise
2822
2823         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2824              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2825              TCP(sport=local_port, dport=12345))
2826         self.pg1.add_stream(p)
2827         self.pg_enable_capture(self.pg_interfaces)
2828         self.pg_start()
2829         capture = self.pg0.get_capture(1)
2830         p = capture[0]
2831         try:
2832             ip = p[IP]
2833             tcp = p[TCP]
2834             self.assertEqual(ip.src, external_addr)
2835             self.assertEqual(tcp.sport, external_port)
2836             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2837             self.assertEqual(tcp.dport, 12345)
2838             self.assert_packet_checksums_valid(p)
2839         except:
2840             self.logger.error(ppp("Unexpected or invalid packet:", p))
2841             raise
2842
2843     def test_self_twice_nat_lb_negative(self):
2844         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2845         """
2846         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2847                               client_id=2)
2848
2849     def test_self_twice_nat_negative(self):
2850         """ NAT44ED Self Twice NAT (negative test) """
2851         self.twice_nat_common(self_twice_nat=True)
2852
2853     def test_static_lb_multi_clients(self):
2854         """ NAT44ED local service load balancing - multiple clients"""
2855
2856         external_addr = self.nat_addr
2857         external_port = 80
2858         local_port = 8080
2859         server1 = self.pg0.remote_hosts[0]
2860         server2 = self.pg0.remote_hosts[1]
2861         server3 = self.pg0.remote_hosts[2]
2862
2863         locals = [{'addr': server1.ip4,
2864                    'port': local_port,
2865                    'probability': 90,
2866                    'vrf_id': 0},
2867                   {'addr': server2.ip4,
2868                    'port': local_port,
2869                    'probability': 10,
2870                    'vrf_id': 0}]
2871
2872         flags = self.config_flags.NAT_IS_INSIDE
2873         self.vapi.nat44_interface_add_del_feature(
2874             sw_if_index=self.pg0.sw_if_index,
2875             flags=flags, is_add=1)
2876         self.vapi.nat44_interface_add_del_feature(
2877             sw_if_index=self.pg1.sw_if_index,
2878             is_add=1)
2879
2880         self.nat_add_address(self.nat_addr)
2881         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2882                                                   external_addr=external_addr,
2883                                                   external_port=external_port,
2884                                                   protocol=IP_PROTOS.tcp,
2885                                                   local_num=len(locals),
2886                                                   locals=locals)
2887
2888         server1_n = 0
2889         server2_n = 0
2890         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2891         pkts = []
2892         for client in clients:
2893             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2894                  IP(src=client, dst=self.nat_addr) /
2895                  TCP(sport=12345, dport=external_port))
2896             pkts.append(p)
2897         self.pg1.add_stream(pkts)
2898         self.pg_enable_capture(self.pg_interfaces)
2899         self.pg_start()
2900         capture = self.pg0.get_capture(len(pkts))
2901         for p in capture:
2902             if p[IP].dst == server1.ip4:
2903                 server1_n += 1
2904             else:
2905                 server2_n += 1
2906         self.assertGreaterEqual(server1_n, server2_n)
2907
2908         local = {
2909             'addr': server3.ip4,
2910             'port': local_port,
2911             'probability': 20,
2912             'vrf_id': 0
2913         }
2914
2915         # add new back-end
2916         self.vapi.nat44_lb_static_mapping_add_del_local(
2917             is_add=1,
2918             external_addr=external_addr,
2919             external_port=external_port,
2920             local=local,
2921             protocol=IP_PROTOS.tcp)
2922         server1_n = 0
2923         server2_n = 0
2924         server3_n = 0
2925         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2926         pkts = []
2927         for client in clients:
2928             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2929                  IP(src=client, dst=self.nat_addr) /
2930                  TCP(sport=12346, dport=external_port))
2931             pkts.append(p)
2932         self.assertGreater(len(pkts), 0)
2933         self.pg1.add_stream(pkts)
2934         self.pg_enable_capture(self.pg_interfaces)
2935         self.pg_start()
2936         capture = self.pg0.get_capture(len(pkts))
2937         for p in capture:
2938             if p[IP].dst == server1.ip4:
2939                 server1_n += 1
2940             elif p[IP].dst == server2.ip4:
2941                 server2_n += 1
2942             else:
2943                 server3_n += 1
2944         self.assertGreater(server1_n, 0)
2945         self.assertGreater(server2_n, 0)
2946         self.assertGreater(server3_n, 0)
2947
2948         local = {
2949             'addr': server2.ip4,
2950             'port': local_port,
2951             'probability': 10,
2952             'vrf_id': 0
2953         }
2954
2955         # remove one back-end
2956         self.vapi.nat44_lb_static_mapping_add_del_local(
2957             is_add=0,
2958             external_addr=external_addr,
2959             external_port=external_port,
2960             local=local,
2961             protocol=IP_PROTOS.tcp)
2962         server1_n = 0
2963         server2_n = 0
2964         server3_n = 0
2965         self.pg1.add_stream(pkts)
2966         self.pg_enable_capture(self.pg_interfaces)
2967         self.pg_start()
2968         capture = self.pg0.get_capture(len(pkts))
2969         for p in capture:
2970             if p[IP].dst == server1.ip4:
2971                 server1_n += 1
2972             elif p[IP].dst == server2.ip4:
2973                 server2_n += 1
2974             else:
2975                 server3_n += 1
2976         self.assertGreater(server1_n, 0)
2977         self.assertEqual(server2_n, 0)
2978         self.assertGreater(server3_n, 0)
2979
2980     def test_syslog_sess(self):
2981         """ NAT44ED Test syslog session creation and deletion """
2982         self.vapi.syslog_set_filter(
2983             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
2984         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
2985
2986         self.nat_add_address(self.nat_addr)
2987         self.nat_add_inside_interface(self.pg0)
2988         self.nat_add_outside_interface(self.pg1)
2989
2990         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2991              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2992              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
2993         self.pg0.add_stream(p)
2994         self.pg_enable_capture(self.pg_interfaces)
2995         self.pg_start()
2996         capture = self.pg1.get_capture(1)
2997         self.tcp_port_out = capture[0][TCP].sport
2998         capture = self.pg3.get_capture(1)
2999         self.verify_syslog_sess(capture[0][Raw].load)
3000
3001         self.pg_enable_capture(self.pg_interfaces)
3002         self.pg_start()
3003         self.nat_add_address(self.nat_addr, is_add=0)
3004         capture = self.pg3.get_capture(1)
3005         self.verify_syslog_sess(capture[0][Raw].load, False)
3006
3007     def test_twice_nat_interface_addr(self):
3008         """ NAT44ED Acquire twice NAT addresses from interface """
3009         flags = self.config_flags.NAT_IS_TWICE_NAT
3010         self.vapi.nat44_add_del_interface_addr(
3011             sw_if_index=self.pg11.sw_if_index,
3012             flags=flags, is_add=1)
3013
3014         # no address in NAT pool
3015         adresses = self.vapi.nat44_address_dump()
3016         self.assertEqual(0, len(adresses))
3017
3018         # configure interface address and check NAT address pool
3019         self.pg11.config_ip4()
3020         adresses = self.vapi.nat44_address_dump()
3021         self.assertEqual(1, len(adresses))
3022         self.assertEqual(str(adresses[0].ip_address),
3023                          self.pg11.local_ip4)
3024         self.assertEqual(adresses[0].flags, flags)
3025
3026         # remove interface address and check NAT address pool
3027         self.pg11.unconfig_ip4()
3028         adresses = self.vapi.nat44_address_dump()
3029         self.assertEqual(0, len(adresses))
3030
3031     def test_output_feature_stateful_acl(self):
3032         """ NAT44ED output feature works with stateful ACL """
3033
3034         self.nat_add_address(self.nat_addr)
3035         self.vapi.nat44_interface_add_del_output_feature(
3036             sw_if_index=self.pg1.sw_if_index, is_add=1)
3037
3038         # First ensure that the NAT is working sans ACL
3039
3040         # send packets out2in, no sessions yet so packets should drop
3041         pkts_out2in = self.create_stream_out(self.pg1)
3042         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3043
3044         # send packets into inside intf, ensure received via outside intf
3045         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3046         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3047                                        len(pkts_in2out))
3048         self.verify_capture_out(capture, ignore_port=True)
3049
3050         # send out2in again, with sessions created it should work now
3051         pkts_out2in = self.create_stream_out(self.pg1)
3052         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3053                                        len(pkts_out2in))
3054         self.verify_capture_in(capture, self.pg0)
3055
3056         # Create an ACL blocking everything
3057         out2in_deny_rule = AclRule(is_permit=0)
3058         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3059         out2in_acl.add_vpp_config()
3060
3061         # create an ACL to permit/reflect everything
3062         in2out_reflect_rule = AclRule(is_permit=2)
3063         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3064         in2out_acl.add_vpp_config()
3065
3066         # apply as input acl on interface and confirm it blocks everything
3067         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3068                                  n_input=1, acls=[out2in_acl])
3069         acl_if.add_vpp_config()
3070         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3071
3072         # apply output acl
3073         acl_if.acls = [out2in_acl, in2out_acl]
3074         acl_if.add_vpp_config()
3075         # send in2out to generate ACL state (NAT state was created earlier)
3076         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3077                                        len(pkts_in2out))
3078         self.verify_capture_out(capture, ignore_port=True)
3079
3080         # send out2in again. ACL state exists so it should work now.
3081         # TCP packets with the syn flag set also need the ack flag
3082         for p in pkts_out2in:
3083             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3084                 p[TCP].flags |= 0x10
3085         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3086                                        len(pkts_out2in))
3087         self.verify_capture_in(capture, self.pg0)
3088         self.logger.info(self.vapi.cli("show trace"))
3089
3090     def test_tcp_close(self):
3091         """ NAT44ED Close TCP session from inside network - output feature """
3092         old_timeouts = self.vapi.nat_get_timeouts()
3093         new_transitory = 2
3094         self.vapi.nat_set_timeouts(
3095             udp=old_timeouts.udp,
3096             tcp_established=old_timeouts.tcp_established,
3097             icmp=old_timeouts.icmp,
3098             tcp_transitory=new_transitory)
3099
3100         self.vapi.nat44_forwarding_enable_disable(enable=1)
3101         self.nat_add_address(self.pg1.local_ip4)
3102         twice_nat_addr = '10.0.1.3'
3103         service_ip = '192.168.16.150'
3104         self.nat_add_address(twice_nat_addr, twice_nat=1)
3105
3106         flags = self.config_flags.NAT_IS_INSIDE
3107         self.vapi.nat44_interface_add_del_feature(
3108             sw_if_index=self.pg0.sw_if_index,
3109             is_add=1)
3110         self.vapi.nat44_interface_add_del_feature(
3111             sw_if_index=self.pg0.sw_if_index,
3112             flags=flags, is_add=1)
3113         self.vapi.nat44_interface_add_del_output_feature(
3114             is_add=1,
3115             sw_if_index=self.pg1.sw_if_index)
3116
3117         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3118                  self.config_flags.NAT_IS_TWICE_NAT)
3119         self.nat_add_static_mapping(self.pg0.remote_ip4,
3120                                     service_ip, 80, 80,
3121                                     proto=IP_PROTOS.tcp,
3122                                     flags=flags)
3123         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3124         start_sessnum = len(sessions)
3125
3126         # SYN packet out->in
3127         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3128              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3129              TCP(sport=33898, dport=80, flags="S"))
3130         self.pg1.add_stream(p)
3131         self.pg_enable_capture(self.pg_interfaces)
3132         self.pg_start()
3133         capture = self.pg0.get_capture(1)
3134         p = capture[0]
3135         tcp_port = p[TCP].sport
3136
3137         # SYN + ACK packet in->out
3138         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3139              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3140              TCP(sport=80, dport=tcp_port, flags="SA"))
3141         self.pg0.add_stream(p)
3142         self.pg_enable_capture(self.pg_interfaces)
3143         self.pg_start()
3144         self.pg1.get_capture(1)
3145
3146         # ACK packet out->in
3147         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3148              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3149              TCP(sport=33898, dport=80, flags="A"))
3150         self.pg1.add_stream(p)
3151         self.pg_enable_capture(self.pg_interfaces)
3152         self.pg_start()
3153         self.pg0.get_capture(1)
3154
3155         # FIN packet in -> out
3156         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3157              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3158              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3159         self.pg0.add_stream(p)
3160         self.pg_enable_capture(self.pg_interfaces)
3161         self.pg_start()
3162         self.pg1.get_capture(1)
3163
3164         # FIN+ACK packet out -> in
3165         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3166              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3167              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3168         self.pg1.add_stream(p)
3169         self.pg_enable_capture(self.pg_interfaces)
3170         self.pg_start()
3171         self.pg0.get_capture(1)
3172
3173         # ACK packet in -> out
3174         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3175              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3176              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3177         self.pg0.add_stream(p)
3178         self.pg_enable_capture(self.pg_interfaces)
3179         self.pg_start()
3180         self.pg1.get_capture(1)
3181
3182         # session now in transitory timeout
3183         # try SYN packet out->in - should be dropped
3184         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3185              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3186              TCP(sport=33898, dport=80, flags="S"))
3187         self.pg1.add_stream(p)
3188         self.pg_enable_capture(self.pg_interfaces)
3189         self.pg_start()
3190
3191         self.sleep(new_transitory, "wait for transitory timeout")
3192         self.pg0.assert_nothing_captured(0)
3193
3194         # session should still exist
3195         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3196         self.assertEqual(len(sessions) - start_sessnum, 1)
3197
3198         # send FIN+ACK packet out -> in - will cause session to be wiped
3199         # but won't create a new session
3200         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3201              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3202              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3203         self.pg1.add_stream(p)
3204         self.pg_enable_capture(self.pg_interfaces)
3205         self.pg_start()
3206
3207         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3208         self.assertEqual(len(sessions) - start_sessnum, 0)
3209         self.pg0.assert_nothing_captured(0)
3210
3211     def test_tcp_session_close_in(self):
3212         """ NAT44ED Close TCP session from inside network """
3213
3214         in_port = self.tcp_port_in
3215         out_port = 10505
3216         ext_port = self.tcp_external_port
3217
3218         self.nat_add_address(self.nat_addr)
3219         self.nat_add_inside_interface(self.pg0)
3220         self.nat_add_outside_interface(self.pg1)
3221         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3222                                     in_port, out_port, proto=IP_PROTOS.tcp,
3223                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3224
3225         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3226         session_n = len(sessions)
3227
3228         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3229                                    tcp_transitory=2, icmp=5)
3230
3231         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3232
3233         # FIN packet in -> out
3234         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3235              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3236              TCP(sport=in_port, dport=ext_port,
3237                  flags="FA", seq=100, ack=300))
3238         self.pg0.add_stream(p)
3239         self.pg_enable_capture(self.pg_interfaces)
3240         self.pg_start()
3241         self.pg1.get_capture(1)
3242
3243         pkts = []
3244
3245         # ACK packet out -> in
3246         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3247              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3248              TCP(sport=ext_port, dport=out_port,
3249                  flags="A", seq=300, ack=101))
3250         pkts.append(p)
3251
3252         # FIN packet out -> in
3253         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3254              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3255              TCP(sport=ext_port, dport=out_port,
3256                  flags="FA", seq=300, ack=101))
3257         pkts.append(p)
3258
3259         self.pg1.add_stream(pkts)
3260         self.pg_enable_capture(self.pg_interfaces)
3261         self.pg_start()
3262         self.pg0.get_capture(2)
3263
3264         # ACK packet in -> out
3265         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3266              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3267              TCP(sport=in_port, dport=ext_port,
3268                  flags="A", seq=101, ack=301))
3269         self.pg0.add_stream(p)
3270         self.pg_enable_capture(self.pg_interfaces)
3271         self.pg_start()
3272         self.pg1.get_capture(1)
3273
3274         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3275         self.assertEqual(len(sessions) - session_n, 1)
3276
3277         out2in_drops = self.get_err_counter(
3278             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3279         in2out_drops = self.get_err_counter(
3280             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3281
3282         # extra FIN packet out -> in - this should be dropped
3283         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3284              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3285              TCP(sport=ext_port, dport=out_port,
3286                  flags="FA", seq=300, ack=101))
3287
3288         self.pg1.add_stream(p)
3289         self.pg_enable_capture(self.pg_interfaces)
3290         self.pg_start()
3291         self.pg0.assert_nothing_captured()
3292
3293         # extra ACK packet in -> out - this should be dropped
3294         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3295              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3296              TCP(sport=in_port, dport=ext_port,
3297                  flags="A", seq=101, ack=301))
3298         self.pg0.add_stream(p)
3299         self.pg_enable_capture(self.pg_interfaces)
3300         self.pg_start()
3301         self.pg1.assert_nothing_captured()
3302
3303         stats = self.get_err_counter(
3304             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3305         self.assertEqual(stats - out2in_drops, 1)
3306         stats = self.get_err_counter(
3307             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3308         self.assertEqual(stats - in2out_drops, 1)
3309
3310         self.sleep(3)
3311         # extra ACK packet in -> out - this will cause session to be wiped
3312         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3313              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3314              TCP(sport=in_port, dport=ext_port,
3315                  flags="A", seq=101, ack=301))
3316         self.pg0.add_stream(p)
3317         self.pg_enable_capture(self.pg_interfaces)
3318         self.pg_start()
3319         self.pg1.assert_nothing_captured()
3320         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3321         self.assertEqual(len(sessions) - session_n, 0)
3322
3323     def test_tcp_session_close_out(self):
3324         """ NAT44ED Close TCP session from outside network """
3325
3326         in_port = self.tcp_port_in
3327         out_port = 10505
3328         ext_port = self.tcp_external_port
3329
3330         self.nat_add_address(self.nat_addr)
3331         self.nat_add_inside_interface(self.pg0)
3332         self.nat_add_outside_interface(self.pg1)
3333         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3334                                     in_port, out_port, proto=IP_PROTOS.tcp,
3335                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3336
3337         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3338         session_n = len(sessions)
3339
3340         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3341                                    tcp_transitory=2, icmp=5)
3342
3343         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3344
3345         # FIN packet out -> in
3346         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3347              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3348              TCP(sport=ext_port, dport=out_port,
3349                  flags="FA", seq=100, ack=300))
3350         self.pg1.add_stream(p)
3351         self.pg_enable_capture(self.pg_interfaces)
3352         self.pg_start()
3353         self.pg0.get_capture(1)
3354
3355         # FIN+ACK packet in -> out
3356         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3357              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3358              TCP(sport=in_port, dport=ext_port,
3359                  flags="FA", seq=300, ack=101))
3360
3361         self.pg0.add_stream(p)
3362         self.pg_enable_capture(self.pg_interfaces)
3363         self.pg_start()
3364         self.pg1.get_capture(1)
3365
3366         # ACK packet out -> in
3367         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3368              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3369              TCP(sport=ext_port, dport=out_port,
3370                  flags="A", seq=101, ack=301))
3371         self.pg1.add_stream(p)
3372         self.pg_enable_capture(self.pg_interfaces)
3373         self.pg_start()
3374         self.pg0.get_capture(1)
3375
3376         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3377         self.assertEqual(len(sessions) - session_n, 1)
3378
3379         out2in_drops = self.get_err_counter(
3380             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3381         in2out_drops = self.get_err_counter(
3382             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3383
3384         # extra FIN packet out -> in - this should be dropped
3385         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3386              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3387              TCP(sport=ext_port, dport=out_port,
3388                  flags="FA", seq=300, ack=101))
3389
3390         self.pg1.add_stream(p)
3391         self.pg_enable_capture(self.pg_interfaces)
3392         self.pg_start()
3393         self.pg0.assert_nothing_captured()
3394
3395         # extra ACK packet in -> out - this should be dropped
3396         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3397              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3398              TCP(sport=in_port, dport=ext_port,
3399                  flags="A", seq=101, ack=301))
3400         self.pg0.add_stream(p)
3401         self.pg_enable_capture(self.pg_interfaces)
3402         self.pg_start()
3403         self.pg1.assert_nothing_captured()
3404
3405         stats = self.get_err_counter(
3406             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3407         self.assertEqual(stats - out2in_drops, 1)
3408         stats = self.get_err_counter(
3409             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3410         self.assertEqual(stats - in2out_drops, 1)
3411
3412         self.sleep(3)
3413         # extra ACK packet in -> out - this will cause session to be wiped
3414         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3415              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3416              TCP(sport=in_port, dport=ext_port,
3417                  flags="A", seq=101, ack=301))
3418         self.pg0.add_stream(p)
3419         self.pg_enable_capture(self.pg_interfaces)
3420         self.pg_start()
3421         self.pg1.assert_nothing_captured()
3422         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3423         self.assertEqual(len(sessions) - session_n, 0)
3424
3425     def test_tcp_session_close_simultaneous(self):
3426         """ NAT44ED Close TCP session from inside network """
3427
3428         in_port = self.tcp_port_in
3429         ext_port = 10505
3430
3431         self.nat_add_address(self.nat_addr)
3432         self.nat_add_inside_interface(self.pg0)
3433         self.nat_add_outside_interface(self.pg1)
3434         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3435                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3436                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3437
3438         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3439         session_n = len(sessions)
3440
3441         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3442                                    tcp_transitory=2, icmp=5)
3443
3444         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3445
3446         # FIN packet in -> out
3447         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3448              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3449              TCP(sport=in_port, dport=ext_port,
3450                  flags="FA", seq=100, ack=300))
3451         self.pg0.add_stream(p)
3452         self.pg_enable_capture(self.pg_interfaces)
3453         self.pg_start()
3454         self.pg1.get_capture(1)
3455
3456         # FIN packet out -> in
3457         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3458              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3459              TCP(sport=ext_port, dport=out_port,
3460                  flags="FA", seq=300, ack=100))
3461         self.pg1.add_stream(p)
3462         self.pg_enable_capture(self.pg_interfaces)
3463         self.pg_start()
3464         self.pg0.get_capture(1)
3465
3466         # ACK packet in -> out
3467         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3468              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3469              TCP(sport=in_port, dport=ext_port,
3470                  flags="A", seq=101, ack=301))
3471         self.pg0.add_stream(p)
3472         self.pg_enable_capture(self.pg_interfaces)
3473         self.pg_start()
3474         self.pg1.get_capture(1)
3475
3476         # ACK packet out -> in
3477         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3478              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3479              TCP(sport=ext_port, dport=out_port,
3480                  flags="A", seq=301, ack=101))
3481         self.pg1.add_stream(p)
3482         self.pg_enable_capture(self.pg_interfaces)
3483         self.pg_start()
3484         self.pg0.get_capture(1)
3485
3486         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3487         self.assertEqual(len(sessions) - session_n, 1)
3488
3489         out2in_drops = self.get_err_counter(
3490             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3491         in2out_drops = self.get_err_counter(
3492             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3493
3494         # extra FIN packet out -> in - this should be dropped
3495         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3496              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3497              TCP(sport=ext_port, dport=out_port,
3498                  flags="FA", seq=300, ack=101))
3499
3500         self.pg1.add_stream(p)
3501         self.pg_enable_capture(self.pg_interfaces)
3502         self.pg_start()
3503         self.pg0.assert_nothing_captured()
3504
3505         # extra ACK packet in -> out - this should be dropped
3506         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3507              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3508              TCP(sport=in_port, dport=ext_port,
3509                  flags="A", seq=101, ack=301))
3510         self.pg0.add_stream(p)
3511         self.pg_enable_capture(self.pg_interfaces)
3512         self.pg_start()
3513         self.pg1.assert_nothing_captured()
3514
3515         stats = self.get_err_counter(
3516             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3517         self.assertEqual(stats - out2in_drops, 1)
3518         stats = self.get_err_counter(
3519             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3520         self.assertEqual(stats - in2out_drops, 1)
3521
3522         self.sleep(3)
3523         # extra ACK packet in -> out - this will cause session to be wiped
3524         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3525              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3526              TCP(sport=in_port, dport=ext_port,
3527                  flags="A", seq=101, ack=301))
3528         self.pg0.add_stream(p)
3529         self.pg_enable_capture(self.pg_interfaces)
3530         self.pg_start()
3531         self.pg1.assert_nothing_captured()
3532         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3533         self.assertEqual(len(sessions) - session_n, 0)
3534
3535     def test_dynamic_vrf(self):
3536         """ NAT44ED dynamic translation test: different VRF"""
3537
3538         vrf_id_in = 33
3539         vrf_id_out = 34
3540
3541         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3542
3543         try:
3544             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3545             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3546
3547             self.nat_add_inside_interface(self.pg7)
3548             self.nat_add_outside_interface(self.pg8)
3549
3550             # just basic stuff nothing special
3551             pkts = self.create_stream_in(self.pg7, self.pg8)
3552             self.pg7.add_stream(pkts)
3553             self.pg_enable_capture(self.pg_interfaces)
3554             self.pg_start()
3555             capture = self.pg8.get_capture(len(pkts))
3556             self.verify_capture_out(capture, ignore_port=True)
3557
3558             pkts = self.create_stream_out(self.pg8)
3559             self.pg8.add_stream(pkts)
3560             self.pg_enable_capture(self.pg_interfaces)
3561             self.pg_start()
3562             capture = self.pg7.get_capture(len(pkts))
3563             self.verify_capture_in(capture, self.pg7)
3564
3565         finally:
3566             self.pg7.unconfig()
3567             self.pg8.unconfig()
3568
3569             self.vapi.ip_table_add_del(is_add=0,
3570                                        table={'table_id': vrf_id_in})
3571             self.vapi.ip_table_add_del(is_add=0,
3572                                        table={'table_id': vrf_id_out})
3573
3574     def test_dynamic_output_feature_vrf(self):
3575         """ NAT44ED dynamic translation test: output-feature, VRF"""
3576
3577         # other then default (0)
3578         new_vrf_id = 22
3579
3580         self.nat_add_address(self.nat_addr)
3581         self.vapi.nat44_interface_add_del_output_feature(
3582             sw_if_index=self.pg8.sw_if_index, is_add=1)
3583
3584         try:
3585             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3586             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3587
3588             # in2out
3589             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3590             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3591             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3592             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3593
3594             pkts = self.create_stream_in(self.pg7, self.pg8)
3595             self.pg7.add_stream(pkts)
3596             self.pg_enable_capture(self.pg_interfaces)
3597             self.pg_start()
3598             capture = self.pg8.get_capture(len(pkts))
3599             self.verify_capture_out(capture, ignore_port=True)
3600
3601             if_idx = self.pg7.sw_if_index
3602             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3603             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3604             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3605             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3606             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3607             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3608             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3609             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3610
3611             # out2in
3612             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3613             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3614             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3615             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3616
3617             pkts = self.create_stream_out(self.pg8)
3618             self.pg8.add_stream(pkts)
3619             self.pg_enable_capture(self.pg_interfaces)
3620             self.pg_start()
3621             capture = self.pg7.get_capture(len(pkts))
3622             self.verify_capture_in(capture, self.pg7)
3623
3624             if_idx = self.pg8.sw_if_index
3625             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3626             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3627             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3628             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3629             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3630             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3631             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3632             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3633
3634             sessions = self.statistics['/nat44-ed/total-sessions']
3635             self.assertEqual(sessions[:, 0].sum(), 3)
3636
3637         finally:
3638             self.pg7.unconfig()
3639             self.pg8.unconfig()
3640
3641             self.vapi.ip_table_add_del(is_add=0,
3642                                        table={'table_id': new_vrf_id})
3643
3644     def test_next_src_nat(self):
3645         """ NAT44ED On way back forward packet to nat44-in2out node. """
3646
3647         twice_nat_addr = '10.0.1.3'
3648         external_port = 80
3649         local_port = 8080
3650         post_twice_nat_port = 0
3651
3652         self.vapi.nat44_forwarding_enable_disable(enable=1)
3653         self.nat_add_address(twice_nat_addr, twice_nat=1)
3654         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3655                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3656         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3657                                     local_port, external_port,
3658                                     proto=IP_PROTOS.tcp, vrf_id=1,
3659                                     flags=flags)
3660         self.vapi.nat44_interface_add_del_feature(
3661             sw_if_index=self.pg6.sw_if_index,
3662             is_add=1)
3663
3664         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3665              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3666              TCP(sport=12345, dport=external_port))
3667         self.pg6.add_stream(p)
3668         self.pg_enable_capture(self.pg_interfaces)
3669         self.pg_start()
3670         capture = self.pg6.get_capture(1)
3671         p = capture[0]
3672         try:
3673             ip = p[IP]
3674             tcp = p[TCP]
3675             self.assertEqual(ip.src, twice_nat_addr)
3676             self.assertNotEqual(tcp.sport, 12345)
3677             post_twice_nat_port = tcp.sport
3678             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3679             self.assertEqual(tcp.dport, local_port)
3680             self.assert_packet_checksums_valid(p)
3681         except:
3682             self.logger.error(ppp("Unexpected or invalid packet:", p))
3683             raise
3684
3685         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3686              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3687              TCP(sport=local_port, dport=post_twice_nat_port))
3688         self.pg6.add_stream(p)
3689         self.pg_enable_capture(self.pg_interfaces)
3690         self.pg_start()
3691         capture = self.pg6.get_capture(1)
3692         p = capture[0]
3693         try:
3694             ip = p[IP]
3695             tcp = p[TCP]
3696             self.assertEqual(ip.src, self.pg1.remote_ip4)
3697             self.assertEqual(tcp.sport, external_port)
3698             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3699             self.assertEqual(tcp.dport, 12345)
3700             self.assert_packet_checksums_valid(p)
3701         except:
3702             self.logger.error(ppp("Unexpected or invalid packet:", p))
3703             raise
3704
3705     def test_one_armed_nat44_static(self):
3706         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3707
3708         remote_host = self.pg4.remote_hosts[0]
3709         local_host = self.pg4.remote_hosts[1]
3710         external_port = 80
3711         local_port = 8080
3712         eh_port_in = 0
3713
3714         self.vapi.nat44_forwarding_enable_disable(enable=1)
3715         self.nat_add_address(self.nat_addr, twice_nat=1)
3716         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3717                  self.config_flags.NAT_IS_TWICE_NAT)
3718         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3719                                     local_port, external_port,
3720                                     proto=IP_PROTOS.tcp, flags=flags)
3721         flags = self.config_flags.NAT_IS_INSIDE
3722         self.vapi.nat44_interface_add_del_feature(
3723             sw_if_index=self.pg4.sw_if_index,
3724             is_add=1)
3725         self.vapi.nat44_interface_add_del_feature(
3726             sw_if_index=self.pg4.sw_if_index,
3727             flags=flags, is_add=1)
3728
3729         # from client to service
3730         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3731              IP(src=remote_host.ip4, dst=self.nat_addr) /
3732              TCP(sport=12345, dport=external_port))
3733         self.pg4.add_stream(p)
3734         self.pg_enable_capture(self.pg_interfaces)
3735         self.pg_start()
3736         capture = self.pg4.get_capture(1)
3737         p = capture[0]
3738         try:
3739             ip = p[IP]
3740             tcp = p[TCP]
3741             self.assertEqual(ip.dst, local_host.ip4)
3742             self.assertEqual(ip.src, self.nat_addr)
3743             self.assertEqual(tcp.dport, local_port)
3744             self.assertNotEqual(tcp.sport, 12345)
3745             eh_port_in = tcp.sport
3746             self.assert_packet_checksums_valid(p)
3747         except:
3748             self.logger.error(ppp("Unexpected or invalid packet:", p))
3749             raise
3750
3751         # from service back to client
3752         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3753              IP(src=local_host.ip4, dst=self.nat_addr) /
3754              TCP(sport=local_port, dport=eh_port_in))
3755         self.pg4.add_stream(p)
3756         self.pg_enable_capture(self.pg_interfaces)
3757         self.pg_start()
3758         capture = self.pg4.get_capture(1)
3759         p = capture[0]
3760         try:
3761             ip = p[IP]
3762             tcp = p[TCP]
3763             self.assertEqual(ip.src, self.nat_addr)
3764             self.assertEqual(ip.dst, remote_host.ip4)
3765             self.assertEqual(tcp.sport, external_port)
3766             self.assertEqual(tcp.dport, 12345)
3767             self.assert_packet_checksums_valid(p)
3768         except:
3769             self.logger.error(ppp("Unexpected or invalid packet:", p))
3770             raise
3771
3772
3773 if __name__ == '__main__':
3774     unittest.main(testRunner=VppTestRunner)