test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class TestNAT44ED(VppTestCase):
  23     """ NAT44ED Test Case """
  24
  25     nat_addr = '10.0.0.3'
  26
  27     tcp_port_in = 6303
  28     tcp_port_out = 6303
  29
  30     udp_port_in = 6304
  31     udp_port_out = 6304
  32
  33     icmp_id_in = 6305
  34     icmp_id_out = 6305
  35
  36     tcp_external_port = 80
  37
  38     max_sessions = 100
  39
  40     def setUp(self):
  41         super().setUp()
  42         self.plugin_enable()
  43
  44     def tearDown(self):
  45         super().tearDown()
  46         if not self.vpp_dead:
  47             self.plugin_disable()
  48
  49     def plugin_enable(self):
  50         self.vapi.nat44_ed_plugin_enable_disable(
  51             sessions=self.max_sessions, enable=1)
  52
  53     def plugin_disable(self):
  54         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  55
  56     @property
  57     def config_flags(self):
  58         return VppEnum.vl_api_nat_config_flags_t
  59
  60     @property
  61     def nat44_config_flags(self):
  62         return VppEnum.vl_api_nat44_config_flags_t
  63
  64     @property
  65     def syslog_severity(self):
  66         return VppEnum.vl_api_syslog_severity_t
  67
  68     @property
  69     def server_addr(self):
  70         return self.pg1.remote_hosts[0].ip4
  71
  72     @staticmethod
  73     def random_port():
  74         return randint(1025, 65535)
  75
  76     @staticmethod
  77     def proto2layer(proto):
  78         if proto == IP_PROTOS.tcp:
  79             return TCP
  80         elif proto == IP_PROTOS.udp:
  81             return UDP
  82         elif proto == IP_PROTOS.icmp:
  83             return ICMP
  84         else:
  85             raise Exception("Unsupported protocol")
  86
  87     @classmethod
  88     def create_and_add_ip4_table(cls, i, table_id=0):
  89         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  90         i.set_table_ip4(table_id)
  91
  92     @classmethod
  93     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  94         if table_id:
  95             cls.create_and_add_ip4_table(i, table_id)
  96
  97         i.admin_up()
  98         i.config_ip4()
  99         i.resolve_arp()
 100
 101         if hosts:
 102             i.generate_remote_hosts(hosts)
 103             i.configure_ipv4_neighbors()
 104
 105     @classmethod
 106     def nat_add_interface_address(cls, i):
 107         cls.vapi.nat44_add_del_interface_addr(
 108             sw_if_index=i.sw_if_index, is_add=1)
 109
 110     def nat_add_inside_interface(self, i):
 111         self.vapi.nat44_interface_add_del_feature(
 112             flags=self.config_flags.NAT_IS_INSIDE,
 113             sw_if_index=i.sw_if_index, is_add=1)
 114
 115     def nat_add_outside_interface(self, i):
 116         self.vapi.nat44_interface_add_del_feature(
 117             flags=self.config_flags.NAT_IS_OUTSIDE,
 118             sw_if_index=i.sw_if_index, is_add=1)
 119
 120     def nat_add_address(self, address, twice_nat=0,
 121                         vrf_id=0xFFFFFFFF, is_add=1):
 122         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 123         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 124                                               last_ip_address=address,
 125                                               vrf_id=vrf_id,
 126                                               is_add=is_add,
 127                                               flags=flags)
 128
 129     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 130                                local_port=0, external_port=0, vrf_id=0,
 131                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 132                                proto=0, tag="", flags=0):
 133
 134         if not (local_port and external_port):
 135             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 136
 137         self.vapi.nat44_add_del_static_mapping(
 138             is_add=is_add,
 139             local_ip_address=local_ip,
 140             external_ip_address=external_ip,
 141             external_sw_if_index=external_sw_if_index,
 142             local_port=local_port,
 143             external_port=external_port,
 144             vrf_id=vrf_id, protocol=proto,
 145             flags=flags,
 146             tag=tag)
 147
 148     @classmethod
 149     def setUpClass(cls):
 150         super().setUpClass()
 151
 152         cls.create_pg_interfaces(range(12))
 153         cls.interfaces = list(cls.pg_interfaces[:4])
 154
 155         cls.create_and_add_ip4_table(cls.pg2, 10)
 156
 157         for i in cls.interfaces:
 158             cls.configure_ip4_interface(i, hosts=3)
 159
 160         # test specific (test-multiple-vrf)
 161         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 162
 163         # test specific (test-one-armed-nat44-static)
 164         cls.pg4.generate_remote_hosts(2)
 165         cls.pg4.config_ip4()
 166         cls.vapi.sw_interface_add_del_address(
 167             sw_if_index=cls.pg4.sw_if_index,
 168             prefix="10.0.0.1/24")
 169         cls.pg4.admin_up()
 170         cls.pg4.resolve_arp()
 171         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 172         cls.pg4.resolve_arp()
 173
 174         # test specific interface (pg5)
 175         cls.pg5._local_ip4 = "10.1.1.1"
 176         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 177         cls.pg5.set_table_ip4(1)
 178         cls.pg5.config_ip4()
 179         cls.pg5.admin_up()
 180         cls.pg5.resolve_arp()
 181
 182         # test specific interface (pg6)
 183         cls.pg6._local_ip4 = "10.1.2.1"
 184         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 185         cls.pg6.set_table_ip4(1)
 186         cls.pg6.config_ip4()
 187         cls.pg6.admin_up()
 188         cls.pg6.resolve_arp()
 189
 190         rl = list()
 191
 192         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 193                              [VppRoutePath("0.0.0.0", 0xffffffff,
 194                                            nh_table_id=0)],
 195                              register=False, table_id=1))
 196         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 197                              [VppRoutePath(cls.pg1.local_ip4,
 198                                            cls.pg1.sw_if_index)],
 199                              register=False))
 200         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 201                              [VppRoutePath("0.0.0.0",
 202                                            cls.pg5.sw_if_index)],
 203                              register=False, table_id=1))
 204         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 205                              [VppRoutePath("0.0.0.0",
 206                                            cls.pg6.sw_if_index)],
 207                              register=False, table_id=1))
 208         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 209                              [VppRoutePath("0.0.0.0", 0xffffffff,
 210                                            nh_table_id=1)],
 211                              register=False, table_id=0))
 212
 213         for r in rl:
 214             r.add_vpp_config()
 215
 216     def get_err_counter(self, path):
 217         return self.statistics.get_err_counter(path)
 218
 219     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 220                           host_in_port, proto=IP_PROTOS.tcp,
 221                           ignore_port=False):
 222         layer = self.proto2layer(proto)
 223
 224         if proto == IP_PROTOS.tcp:
 225             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 226         else:
 227             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 228
 229         # send packet from host to server
 230         pkts = self.create_stream_frag(self.pg0,
 231                                        self.nat_addr,
 232                                        host_in_port,
 233                                        server_out_port,
 234                                        data,
 235                                        proto)
 236         self.pg0.add_stream(pkts)
 237         self.pg_enable_capture(self.pg_interfaces)
 238         self.pg_start()
 239         frags = self.pg0.get_capture(len(pkts))
 240         p = self.reass_frags_and_verify(frags,
 241                                         self.nat_addr,
 242                                         server_addr)
 243         if proto != IP_PROTOS.icmp:
 244             if not ignore_port:
 245                 self.assertNotEqual(p[layer].sport, host_in_port)
 246             self.assertEqual(p[layer].dport, server_in_port)
 247         else:
 248             if not ignore_port:
 249                 self.assertNotEqual(p[layer].id, host_in_port)
 250         self.assertEqual(data, p[Raw].load)
 251
 252     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 253                           ignore_port=False):
 254         layer = self.proto2layer(proto)
 255
 256         if proto == IP_PROTOS.tcp:
 257             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 258         else:
 259             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 260         self.port_in = self.random_port()
 261
 262         for i in range(2):
 263             # in2out
 264             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 265                                            self.port_in, 20, data, proto)
 266             pkts.reverse()
 267             self.pg0.add_stream(pkts)
 268             self.pg_enable_capture(self.pg_interfaces)
 269             self.pg_start()
 270             frags = self.pg1.get_capture(len(pkts))
 271             if not dont_translate:
 272                 p = self.reass_frags_and_verify(frags,
 273                                                 self.nat_addr,
 274                                                 self.pg1.remote_ip4)
 275             else:
 276                 p = self.reass_frags_and_verify(frags,
 277                                                 self.pg0.remote_ip4,
 278                                                 self.pg1.remote_ip4)
 279             if proto != IP_PROTOS.icmp:
 280                 if not dont_translate:
 281                     self.assertEqual(p[layer].dport, 20)
 282                     if not ignore_port:
 283                         self.assertNotEqual(p[layer].sport, self.port_in)
 284                 else:
 285                     self.assertEqual(p[layer].sport, self.port_in)
 286             else:
 287                 if not ignore_port:
 288                     if not dont_translate:
 289                         self.assertNotEqual(p[layer].id, self.port_in)
 290                     else:
 291                         self.assertEqual(p[layer].id, self.port_in)
 292             self.assertEqual(data, p[Raw].load)
 293
 294             # out2in
 295             if not dont_translate:
 296                 dst_addr = self.nat_addr
 297             else:
 298                 dst_addr = self.pg0.remote_ip4
 299             if proto != IP_PROTOS.icmp:
 300                 sport = 20
 301                 dport = p[layer].sport
 302             else:
 303                 sport = p[layer].id
 304                 dport = 0
 305             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 306                                            data, proto, echo_reply=True)
 307             pkts.reverse()
 308             self.pg1.add_stream(pkts)
 309             self.pg_enable_capture(self.pg_interfaces)
 310             self.logger.info(self.vapi.cli("show trace"))
 311             self.pg_start()
 312             frags = self.pg0.get_capture(len(pkts))
 313             p = self.reass_frags_and_verify(frags,
 314                                             self.pg1.remote_ip4,
 315                                             self.pg0.remote_ip4)
 316             if proto != IP_PROTOS.icmp:
 317                 self.assertEqual(p[layer].sport, 20)
 318                 self.assertEqual(p[layer].dport, self.port_in)
 319             else:
 320                 self.assertEqual(p[layer].id, self.port_in)
 321             self.assertEqual(data, p[Raw].load)
 322
 323     def reass_frags_and_verify(self, frags, src, dst):
 324         buffer = BytesIO()
 325         for p in frags:
 326             self.assertEqual(p[IP].src, src)
 327             self.assertEqual(p[IP].dst, dst)
 328             self.assert_ip_checksum_valid(p)
 329             buffer.seek(p[IP].frag * 8)
 330             buffer.write(bytes(p[IP].payload))
 331         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 332                 proto=frags[0][IP].proto)
 333         if ip.proto == IP_PROTOS.tcp:
 334             p = (ip / TCP(buffer.getvalue()))
 335             self.logger.debug(ppp("Reassembled:", p))
 336             self.assert_tcp_checksum_valid(p)
 337         elif ip.proto == IP_PROTOS.udp:
 338             p = (ip / UDP(buffer.getvalue()[:8]) /
 339                  Raw(buffer.getvalue()[8:]))
 340         elif ip.proto == IP_PROTOS.icmp:
 341             p = (ip / ICMP(buffer.getvalue()))
 342         return p
 343
 344     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 345                       ignore_port=False):
 346         layer = self.proto2layer(proto)
 347
 348         if proto == IP_PROTOS.tcp:
 349             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 350         else:
 351             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 352         self.port_in = self.random_port()
 353
 354         # in2out
 355         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 356                                        self.port_in, 20, data, proto)
 357         self.pg0.add_stream(pkts)
 358         self.pg_enable_capture(self.pg_interfaces)
 359         self.pg_start()
 360         frags = self.pg1.get_capture(len(pkts))
 361         if not dont_translate:
 362             p = self.reass_frags_and_verify(frags,
 363                                             self.nat_addr,
 364                                             self.pg1.remote_ip4)
 365         else:
 366             p = self.reass_frags_and_verify(frags,
 367                                             self.pg0.remote_ip4,
 368                                             self.pg1.remote_ip4)
 369         if proto != IP_PROTOS.icmp:
 370             if not dont_translate:
 371                 self.assertEqual(p[layer].dport, 20)
 372                 if not ignore_port:
 373                     self.assertNotEqual(p[layer].sport, self.port_in)
 374             else:
 375                 self.assertEqual(p[layer].sport, self.port_in)
 376         else:
 377             if not ignore_port:
 378                 if not dont_translate:
 379                     self.assertNotEqual(p[layer].id, self.port_in)
 380                 else:
 381                     self.assertEqual(p[layer].id, self.port_in)
 382         self.assertEqual(data, p[Raw].load)
 383
 384         # out2in
 385         if not dont_translate:
 386             dst_addr = self.nat_addr
 387         else:
 388             dst_addr = self.pg0.remote_ip4
 389         if proto != IP_PROTOS.icmp:
 390             sport = 20
 391             dport = p[layer].sport
 392         else:
 393             sport = p[layer].id
 394             dport = 0
 395         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 396                                        proto, echo_reply=True)
 397         self.pg1.add_stream(pkts)
 398         self.pg_enable_capture(self.pg_interfaces)
 399         self.pg_start()
 400         frags = self.pg0.get_capture(len(pkts))
 401         p = self.reass_frags_and_verify(frags,
 402                                         self.pg1.remote_ip4,
 403                                         self.pg0.remote_ip4)
 404         if proto != IP_PROTOS.icmp:
 405             self.assertEqual(p[layer].sport, 20)
 406             self.assertEqual(p[layer].dport, self.port_in)
 407         else:
 408             self.assertEqual(p[layer].id, self.port_in)
 409         self.assertEqual(data, p[Raw].load)
 410
 411     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 412                            dst_ip=None, ignore_port=False):
 413         if nat_ip is None:
 414             nat_ip = self.nat_addr
 415         for packet in capture:
 416             try:
 417                 self.assert_packet_checksums_valid(packet)
 418                 self.assertEqual(packet[IP].src, nat_ip)
 419                 if dst_ip is not None:
 420                     self.assertEqual(packet[IP].dst, dst_ip)
 421                 if packet.haslayer(TCP):
 422                     if not ignore_port:
 423                         if same_port:
 424                             self.assertEqual(
 425                                 packet[TCP].sport, self.tcp_port_in)
 426                         else:
 427                             self.assertNotEqual(
 428                                 packet[TCP].sport, self.tcp_port_in)
 429                     self.tcp_port_out = packet[TCP].sport
 430                     self.assert_packet_checksums_valid(packet)
 431                 elif packet.haslayer(UDP):
 432                     if not ignore_port:
 433                         if same_port:
 434                             self.assertEqual(
 435                                 packet[UDP].sport, self.udp_port_in)
 436                         else:
 437                             self.assertNotEqual(
 438                                 packet[UDP].sport, self.udp_port_in)
 439                     self.udp_port_out = packet[UDP].sport
 440                 else:
 441                     if not ignore_port:
 442                         if same_port:
 443                             self.assertEqual(
 444                                 packet[ICMP].id, self.icmp_id_in)
 445                         else:
 446                             self.assertNotEqual(
 447                                 packet[ICMP].id, self.icmp_id_in)
 448                     self.icmp_id_out = packet[ICMP].id
 449                     self.assert_packet_checksums_valid(packet)
 450             except:
 451                 self.logger.error(ppp("Unexpected or invalid packet "
 452                                       "(outside network):", packet))
 453                 raise
 454
 455     def verify_capture_in(self, capture, in_if):
 456         for packet in capture:
 457             try:
 458                 self.assert_packet_checksums_valid(packet)
 459                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 460                 if packet.haslayer(TCP):
 461                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 462                 elif packet.haslayer(UDP):
 463                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 464                 else:
 465                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 466             except:
 467                 self.logger.error(ppp("Unexpected or invalid packet "
 468                                       "(inside network):", packet))
 469                 raise
 470
 471     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 472         if dst_ip is None:
 473             dst_ip = out_if.remote_ip4
 474
 475         pkts = []
 476         # TCP
 477         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 478              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 479              TCP(sport=self.tcp_port_in, dport=20))
 480         pkts.extend([p, p])
 481
 482         # UDP
 483         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 484              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 485              UDP(sport=self.udp_port_in, dport=20))
 486         pkts.append(p)
 487
 488         # ICMP
 489         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 490              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 491              ICMP(id=self.icmp_id_in, type='echo-request'))
 492         pkts.append(p)
 493
 494         return pkts
 495
 496     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 497                           use_inside_ports=False):
 498         if dst_ip is None:
 499             dst_ip = self.nat_addr
 500         if not use_inside_ports:
 501             tcp_port = self.tcp_port_out
 502             udp_port = self.udp_port_out
 503             icmp_id = self.icmp_id_out
 504         else:
 505             tcp_port = self.tcp_port_in
 506             udp_port = self.udp_port_in
 507             icmp_id = self.icmp_id_in
 508         pkts = []
 509         # TCP
 510         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 511              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 512              TCP(dport=tcp_port, sport=20))
 513         pkts.extend([p, p])
 514
 515         # UDP
 516         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 517              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 518              UDP(dport=udp_port, sport=20))
 519         pkts.append(p)
 520
 521         # ICMP
 522         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 523              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 524              ICMP(id=icmp_id, type='echo-reply'))
 525         pkts.append(p)
 526
 527         return pkts
 528
 529     def create_tcp_stream(self, in_if, out_if, count):
 530         pkts = []
 531         port = 6303
 532
 533         for i in range(count):
 534             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 535                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 536                  TCP(sport=port + i, dport=20))
 537             pkts.append(p)
 538
 539         return pkts
 540
 541     def create_stream_frag(self, src_if, dst, sport, dport, data,
 542                            proto=IP_PROTOS.tcp, echo_reply=False):
 543         if proto == IP_PROTOS.tcp:
 544             p = (IP(src=src_if.remote_ip4, dst=dst) /
 545                  TCP(sport=sport, dport=dport) /
 546                  Raw(data))
 547             p = p.__class__(scapy.compat.raw(p))
 548             chksum = p[TCP].chksum
 549             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 550         elif proto == IP_PROTOS.udp:
 551             proto_header = UDP(sport=sport, dport=dport)
 552         elif proto == IP_PROTOS.icmp:
 553             if not echo_reply:
 554                 proto_header = ICMP(id=sport, type='echo-request')
 555             else:
 556                 proto_header = ICMP(id=sport, type='echo-reply')
 557         else:
 558             raise Exception("Unsupported protocol")
 559         id = self.random_port()
 560         pkts = []
 561         if proto == IP_PROTOS.tcp:
 562             raw = Raw(data[0:4])
 563         else:
 564             raw = Raw(data[0:16])
 565         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 566              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 567              proto_header /
 568              raw)
 569         pkts.append(p)
 570         if proto == IP_PROTOS.tcp:
 571             raw = Raw(data[4:20])
 572         else:
 573             raw = Raw(data[16:32])
 574         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 575              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 576                 proto=proto) /
 577              raw)
 578         pkts.append(p)
 579         if proto == IP_PROTOS.tcp:
 580             raw = Raw(data[20:])
 581         else:
 582             raw = Raw(data[32:])
 583         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 584              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 585                 id=id) /
 586              raw)
 587         pkts.append(p)
 588         return pkts
 589
 590     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 591                                   proto=IP_PROTOS.tcp):
 592
 593         layer = self.proto2layer(proto)
 594
 595         if proto == IP_PROTOS.tcp:
 596             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 597         else:
 598             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 599         port_in = self.random_port()
 600
 601         for i in range(2):
 602             # out2in
 603             pkts = self.create_stream_frag(self.pg0, out_addr,
 604                                            port_in, out_port,
 605                                            data, proto)
 606             self.pg0.add_stream(pkts)
 607             self.pg_enable_capture(self.pg_interfaces)
 608             self.pg_start()
 609             frags = self.pg1.get_capture(len(pkts))
 610             p = self.reass_frags_and_verify(frags,
 611                                             self.pg0.remote_ip4,
 612                                             in_addr)
 613             if proto != IP_PROTOS.icmp:
 614                 self.assertEqual(p[layer].sport, port_in)
 615                 self.assertEqual(p[layer].dport, in_port)
 616             else:
 617                 self.assertEqual(p[layer].id, port_in)
 618             self.assertEqual(data, p[Raw].load)
 619
 620             # in2out
 621             if proto != IP_PROTOS.icmp:
 622                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 623                                                in_port,
 624                                                p[layer].sport, data, proto)
 625             else:
 626                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 627                                                p[layer].id, 0, data, proto,
 628                                                echo_reply=True)
 629             self.pg1.add_stream(pkts)
 630             self.pg_enable_capture(self.pg_interfaces)
 631             self.pg_start()
 632             frags = self.pg0.get_capture(len(pkts))
 633             p = self.reass_frags_and_verify(frags,
 634                                             out_addr,
 635                                             self.pg0.remote_ip4)
 636             if proto != IP_PROTOS.icmp:
 637                 self.assertEqual(p[layer].sport, out_port)
 638                 self.assertEqual(p[layer].dport, port_in)
 639             else:
 640                 self.assertEqual(p[layer].id, port_in)
 641             self.assertEqual(data, p[Raw].load)
 642
 643     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 644                                       out_port, proto=IP_PROTOS.tcp):
 645
 646         layer = self.proto2layer(proto)
 647
 648         if proto == IP_PROTOS.tcp:
 649             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 650         else:
 651             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 652         port_in = self.random_port()
 653
 654         for i in range(2):
 655             # out2in
 656             pkts = self.create_stream_frag(self.pg0, out_addr,
 657                                            port_in, out_port,
 658                                            data, proto)
 659             pkts.reverse()
 660             self.pg0.add_stream(pkts)
 661             self.pg_enable_capture(self.pg_interfaces)
 662             self.pg_start()
 663             frags = self.pg1.get_capture(len(pkts))
 664             p = self.reass_frags_and_verify(frags,
 665                                             self.pg0.remote_ip4,
 666                                             in_addr)
 667             if proto != IP_PROTOS.icmp:
 668                 self.assertEqual(p[layer].dport, in_port)
 669                 self.assertEqual(p[layer].sport, port_in)
 670                 self.assertEqual(p[layer].dport, in_port)
 671             else:
 672                 self.assertEqual(p[layer].id, port_in)
 673             self.assertEqual(data, p[Raw].load)
 674
 675             # in2out
 676             if proto != IP_PROTOS.icmp:
 677                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 678                                                in_port,
 679                                                p[layer].sport, data, proto)
 680             else:
 681                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 682                                                p[layer].id, 0, data, proto,
 683                                                echo_reply=True)
 684             pkts.reverse()
 685             self.pg1.add_stream(pkts)
 686             self.pg_enable_capture(self.pg_interfaces)
 687             self.pg_start()
 688             frags = self.pg0.get_capture(len(pkts))
 689             p = self.reass_frags_and_verify(frags,
 690                                             out_addr,
 691                                             self.pg0.remote_ip4)
 692             if proto != IP_PROTOS.icmp:
 693                 self.assertEqual(p[layer].sport, out_port)
 694                 self.assertEqual(p[layer].dport, port_in)
 695             else:
 696                 self.assertEqual(p[layer].id, port_in)
 697             self.assertEqual(data, p[Raw].load)
 698
 699     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 700         # SYN packet in->out
 701         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 702              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 703              TCP(sport=in_port, dport=ext_port, flags="S"))
 704         in_if.add_stream(p)
 705         self.pg_enable_capture(self.pg_interfaces)
 706         self.pg_start()
 707         capture = out_if.get_capture(1)
 708         p = capture[0]
 709         out_port = p[TCP].sport
 710
 711         # SYN + ACK packet out->in
 712         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 713              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 714              TCP(sport=ext_port, dport=out_port, flags="SA"))
 715         out_if.add_stream(p)
 716         self.pg_enable_capture(self.pg_interfaces)
 717         self.pg_start()
 718         in_if.get_capture(1)
 719
 720         # ACK packet in->out
 721         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 722              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 723              TCP(sport=in_port, dport=ext_port, flags="A"))
 724         in_if.add_stream(p)
 725         self.pg_enable_capture(self.pg_interfaces)
 726         self.pg_start()
 727         out_if.get_capture(1)
 728
 729         return out_port
 730
 731     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 732                          client_id=None):
 733         twice_nat_addr = '10.0.1.3'
 734
 735         port_in = 8080
 736         if lb:
 737             if not same_pg:
 738                 port_in1 = port_in
 739                 port_in2 = port_in
 740             else:
 741                 port_in1 = port_in + 1
 742                 port_in2 = port_in + 2
 743
 744         port_out = 80
 745         eh_port_out = 4567
 746
 747         server1 = self.pg0.remote_hosts[0]
 748         server2 = self.pg0.remote_hosts[1]
 749         if lb and same_pg:
 750             server2 = server1
 751         if not lb:
 752             server = server1
 753
 754         pg0 = self.pg0
 755         if same_pg:
 756             pg1 = self.pg0
 757         else:
 758             pg1 = self.pg1
 759
 760         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 761                         client_id == 1)
 762
 763         self.nat_add_address(self.nat_addr)
 764         self.nat_add_address(twice_nat_addr, twice_nat=1)
 765
 766         flags = 0
 767         if self_twice_nat:
 768             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 769         else:
 770             flags |= self.config_flags.NAT_IS_TWICE_NAT
 771
 772         if not lb:
 773             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 774                                         port_in, port_out,
 775                                         proto=IP_PROTOS.tcp,
 776                                         flags=flags)
 777         else:
 778             locals = [{'addr': server1.ip4,
 779                        'port': port_in1,
 780                        'probability': 50,
 781                        'vrf_id': 0},
 782                       {'addr': server2.ip4,
 783                        'port': port_in2,
 784                        'probability': 50,
 785                        'vrf_id': 0}]
 786             out_addr = self.nat_addr
 787
 788             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 789                                                       external_addr=out_addr,
 790                                                       external_port=port_out,
 791                                                       protocol=IP_PROTOS.tcp,
 792                                                       local_num=len(locals),
 793                                                       locals=locals)
 794         self.nat_add_inside_interface(pg0)
 795         self.nat_add_outside_interface(pg1)
 796
 797         if same_pg:
 798             if not lb:
 799                 client = server
 800             else:
 801                 assert client_id is not None
 802                 if client_id == 1:
 803                     client = self.pg0.remote_hosts[0]
 804                 elif client_id == 2:
 805                     client = self.pg0.remote_hosts[1]
 806         else:
 807             client = pg1.remote_hosts[0]
 808         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 809              IP(src=client.ip4, dst=self.nat_addr) /
 810              TCP(sport=eh_port_out, dport=port_out))
 811         pg1.add_stream(p)
 812         self.pg_enable_capture(self.pg_interfaces)
 813         self.pg_start()
 814         capture = pg0.get_capture(1)
 815         p = capture[0]
 816         try:
 817             ip = p[IP]
 818             tcp = p[TCP]
 819             if lb:
 820                 if ip.dst == server1.ip4:
 821                     server = server1
 822                     port_in = port_in1
 823                 else:
 824                     server = server2
 825                     port_in = port_in2
 826             self.assertEqual(ip.dst, server.ip4)
 827             if lb and same_pg:
 828                 self.assertIn(tcp.dport, [port_in1, port_in2])
 829             else:
 830                 self.assertEqual(tcp.dport, port_in)
 831             if eh_translate:
 832                 self.assertEqual(ip.src, twice_nat_addr)
 833                 self.assertNotEqual(tcp.sport, eh_port_out)
 834             else:
 835                 self.assertEqual(ip.src, client.ip4)
 836                 self.assertEqual(tcp.sport, eh_port_out)
 837             eh_addr_in = ip.src
 838             eh_port_in = tcp.sport
 839             saved_port_in = tcp.dport
 840             self.assert_packet_checksums_valid(p)
 841         except:
 842             self.logger.error(ppp("Unexpected or invalid packet:", p))
 843             raise
 844
 845         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 846              IP(src=server.ip4, dst=eh_addr_in) /
 847              TCP(sport=saved_port_in, dport=eh_port_in))
 848         pg0.add_stream(p)
 849         self.pg_enable_capture(self.pg_interfaces)
 850         self.pg_start()
 851         capture = pg1.get_capture(1)
 852         p = capture[0]
 853         try:
 854             ip = p[IP]
 855             tcp = p[TCP]
 856             self.assertEqual(ip.dst, client.ip4)
 857             self.assertEqual(ip.src, self.nat_addr)
 858             self.assertEqual(tcp.dport, eh_port_out)
 859             self.assertEqual(tcp.sport, port_out)
 860             self.assert_packet_checksums_valid(p)
 861         except:
 862             self.logger.error(ppp("Unexpected or invalid packet:", p))
 863             raise
 864
 865         if eh_translate:
 866             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 867             self.assertEqual(len(sessions), 1)
 868             self.assertTrue(sessions[0].flags &
 869                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 870             self.assertTrue(sessions[0].flags &
 871                             self.config_flags.NAT_IS_TWICE_NAT)
 872             self.logger.info(self.vapi.cli("show nat44 sessions"))
 873             self.vapi.nat44_del_session(
 874                 address=sessions[0].inside_ip_address,
 875                 port=sessions[0].inside_port,
 876                 protocol=sessions[0].protocol,
 877                 flags=(self.config_flags.NAT_IS_INSIDE |
 878                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 879                 ext_host_address=sessions[0].ext_host_nat_address,
 880                 ext_host_port=sessions[0].ext_host_nat_port)
 881             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 882             self.assertEqual(len(sessions), 0)
 883
 884     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 885         message = data.decode('utf-8')
 886         try:
 887             message = SyslogMessage.parse(message)
 888         except ParseError as e:
 889             self.logger.error(e)
 890             raise
 891         else:
 892             self.assertEqual(message.severity, SyslogSeverity.info)
 893             self.assertEqual(message.appname, 'NAT')
 894             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 895             sd_params = message.sd.get('nsess')
 896             self.assertTrue(sd_params is not None)
 897             if is_ip6:
 898                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 899                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 900             else:
 901                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 902                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 903                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 904             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 905             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 906             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 907             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 908             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 909             self.assertEqual(sd_params.get('SVLAN'), '0')
 910             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 911             self.assertEqual(sd_params.get('XDPORT'),
 912                              "%d" % self.tcp_external_port)
 913
 914     def test_icmp_error(self):
 915         """ NAT44ED test ICMP error message with inner header"""
 916
 917         payload = "H" * 10
 918
 919         self.nat_add_address(self.nat_addr)
 920         self.nat_add_inside_interface(self.pg0)
 921         self.nat_add_outside_interface(self.pg1)
 922
 923         # in2out (initiate connection)
 924         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 925               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 926               UDP(sport=21, dport=20) / payload)
 927
 928         self.pg0.add_stream(p1)
 929         self.pg_enable_capture(self.pg_interfaces)
 930         self.pg_start()
 931         capture = self.pg1.get_capture(1)[0]
 932
 933         # out2in (send error message)
 934         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 935               IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
 936               ICMP(type='dest-unreach', code='port-unreachable') /
 937               capture[IP:])
 938
 939         self.pg1.add_stream(p2)
 940         self.pg_enable_capture(self.pg_interfaces)
 941         self.pg_start()
 942
 943         capture = self.pg0.get_capture(1)[0]
 944
 945         self.logger.info(ppp("p1 packet:", p1))
 946         self.logger.info(ppp("p2 packet:", p2))
 947         self.logger.info(ppp("capture packet:", capture))
 948
 949     def test_icmp_echo_reply_trailer(self):
 950         """ ICMP echo reply with ethernet trailer"""
 951
 952         self.nat_add_address(self.nat_addr)
 953         self.nat_add_inside_interface(self.pg0)
 954         self.nat_add_outside_interface(self.pg1)
 955
 956         # in2out
 957         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 958               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 959               ICMP(type=8, id=0xabcd, seq=0))
 960
 961         self.pg0.add_stream(p1)
 962         self.pg_enable_capture(self.pg_interfaces)
 963         self.pg_start()
 964         c = self.pg1.get_capture(1)[0]
 965
 966         self.logger.debug(self.vapi.cli("show trace"))
 967
 968         # out2in
 969         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 970               IP(src=self.pg1.remote_ip4, dst=self.nat_addr, id=0xee59) /
 971               ICMP(type=0, id=c[ICMP].id, seq=0))
 972
 973         # force checksum calculation
 974         p2 = p2.__class__(bytes(p2))
 975
 976         self.logger.debug(ppp("Packet before modification:", p2))
 977
 978         # hex representation of vss monitoring ethernet trailer
 979         # this seems to be just added to end of packet without modifying
 980         # IP or ICMP lengths / checksums
 981         p2 = p2 / Raw("\x00\x00\x52\x54\x00\x46\xab\x04\x84\x18")
 982         # change it so that IP/ICMP is unaffected
 983         p2[IP].len = 28
 984
 985         self.logger.debug(ppp("Packet with added trailer:", p2))
 986
 987         self.pg1.add_stream(p2)
 988         self.pg_enable_capture(self.pg_interfaces)
 989         self.pg_start()
 990
 991         self.pg0.get_capture(1)
 992
 993     def test_users_dump(self):
 994         """ NAT44ED API test - nat44_user_dump """
 995
 996         self.nat_add_address(self.nat_addr)
 997         self.nat_add_inside_interface(self.pg0)
 998         self.nat_add_outside_interface(self.pg1)
 999
1000         self.vapi.nat44_forwarding_enable_disable(enable=1)
1001
1002         local_ip = self.pg0.remote_ip4
1003         external_ip = self.nat_addr
1004         self.nat_add_static_mapping(local_ip, external_ip)
1005
1006         users = self.vapi.nat44_user_dump()
1007         self.assertEqual(len(users), 0)
1008
1009         # in2out - static mapping match
1010
1011         pkts = self.create_stream_out(self.pg1)
1012         self.pg1.add_stream(pkts)
1013         self.pg_enable_capture(self.pg_interfaces)
1014         self.pg_start()
1015         capture = self.pg0.get_capture(len(pkts))
1016         self.verify_capture_in(capture, self.pg0)
1017
1018         pkts = self.create_stream_in(self.pg0, self.pg1)
1019         self.pg0.add_stream(pkts)
1020         self.pg_enable_capture(self.pg_interfaces)
1021         self.pg_start()
1022         capture = self.pg1.get_capture(len(pkts))
1023         self.verify_capture_out(capture, same_port=True)
1024
1025         users = self.vapi.nat44_user_dump()
1026         self.assertEqual(len(users), 1)
1027         static_user = users[0]
1028         self.assertEqual(static_user.nstaticsessions, 3)
1029         self.assertEqual(static_user.nsessions, 0)
1030
1031         # in2out - no static mapping match (forwarding test)
1032
1033         host0 = self.pg0.remote_hosts[0]
1034         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1035         try:
1036             pkts = self.create_stream_out(self.pg1,
1037                                           dst_ip=self.pg0.remote_ip4,
1038                                           use_inside_ports=True)
1039             self.pg1.add_stream(pkts)
1040             self.pg_enable_capture(self.pg_interfaces)
1041             self.pg_start()
1042             capture = self.pg0.get_capture(len(pkts))
1043             self.verify_capture_in(capture, self.pg0)
1044
1045             pkts = self.create_stream_in(self.pg0, self.pg1)
1046             self.pg0.add_stream(pkts)
1047             self.pg_enable_capture(self.pg_interfaces)
1048             self.pg_start()
1049             capture = self.pg1.get_capture(len(pkts))
1050             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1051                                     same_port=True)
1052         finally:
1053             self.pg0.remote_hosts[0] = host0
1054
1055         users = self.vapi.nat44_user_dump()
1056         self.assertEqual(len(users), 2)
1057         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1058             non_static_user = users[1]
1059             static_user = users[0]
1060         else:
1061             non_static_user = users[0]
1062             static_user = users[1]
1063         self.assertEqual(static_user.nstaticsessions, 3)
1064         self.assertEqual(static_user.nsessions, 0)
1065         self.assertEqual(non_static_user.nstaticsessions, 0)
1066         self.assertEqual(non_static_user.nsessions, 3)
1067
1068         users = self.vapi.nat44_user_dump()
1069         self.assertEqual(len(users), 2)
1070         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1071             non_static_user = users[1]
1072             static_user = users[0]
1073         else:
1074             non_static_user = users[0]
1075             static_user = users[1]
1076         self.assertEqual(static_user.nstaticsessions, 3)
1077         self.assertEqual(static_user.nsessions, 0)
1078         self.assertEqual(non_static_user.nstaticsessions, 0)
1079         self.assertEqual(non_static_user.nsessions, 3)
1080
1081     def test_frag_out_of_order_do_not_translate(self):
1082         """ NAT44ED don't translate fragments arriving out of order """
1083         self.nat_add_inside_interface(self.pg0)
1084         self.nat_add_outside_interface(self.pg1)
1085         self.vapi.nat44_forwarding_enable_disable(enable=True)
1086         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1087
1088     def test_forwarding(self):
1089         """ NAT44ED forwarding test """
1090
1091         self.nat_add_inside_interface(self.pg0)
1092         self.nat_add_outside_interface(self.pg1)
1093         self.vapi.nat44_forwarding_enable_disable(enable=1)
1094
1095         real_ip = self.pg0.remote_ip4
1096         alias_ip = self.nat_addr
1097         flags = self.config_flags.NAT_IS_ADDR_ONLY
1098         self.vapi.nat44_add_del_static_mapping(is_add=1,
1099                                                local_ip_address=real_ip,
1100                                                external_ip_address=alias_ip,
1101                                                external_sw_if_index=0xFFFFFFFF,
1102                                                flags=flags)
1103
1104         try:
1105             # in2out - static mapping match
1106
1107             pkts = self.create_stream_out(self.pg1)
1108             self.pg1.add_stream(pkts)
1109             self.pg_enable_capture(self.pg_interfaces)
1110             self.pg_start()
1111             capture = self.pg0.get_capture(len(pkts))
1112             self.verify_capture_in(capture, self.pg0)
1113
1114             pkts = self.create_stream_in(self.pg0, self.pg1)
1115             self.pg0.add_stream(pkts)
1116             self.pg_enable_capture(self.pg_interfaces)
1117             self.pg_start()
1118             capture = self.pg1.get_capture(len(pkts))
1119             self.verify_capture_out(capture, same_port=True)
1120
1121             # in2out - no static mapping match
1122
1123             host0 = self.pg0.remote_hosts[0]
1124             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1125             try:
1126                 pkts = self.create_stream_out(self.pg1,
1127                                               dst_ip=self.pg0.remote_ip4,
1128                                               use_inside_ports=True)
1129                 self.pg1.add_stream(pkts)
1130                 self.pg_enable_capture(self.pg_interfaces)
1131                 self.pg_start()
1132                 capture = self.pg0.get_capture(len(pkts))
1133                 self.verify_capture_in(capture, self.pg0)
1134
1135                 pkts = self.create_stream_in(self.pg0, self.pg1)
1136                 self.pg0.add_stream(pkts)
1137                 self.pg_enable_capture(self.pg_interfaces)
1138                 self.pg_start()
1139                 capture = self.pg1.get_capture(len(pkts))
1140                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1141                                         same_port=True)
1142             finally:
1143                 self.pg0.remote_hosts[0] = host0
1144
1145             user = self.pg0.remote_hosts[1]
1146             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1147             self.assertEqual(len(sessions), 3)
1148             self.assertTrue(sessions[0].flags &
1149                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1150             self.vapi.nat44_del_session(
1151                 address=sessions[0].inside_ip_address,
1152                 port=sessions[0].inside_port,
1153                 protocol=sessions[0].protocol,
1154                 flags=(self.config_flags.NAT_IS_INSIDE |
1155                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1156                 ext_host_address=sessions[0].ext_host_address,
1157                 ext_host_port=sessions[0].ext_host_port)
1158             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1159             self.assertEqual(len(sessions), 2)
1160
1161         finally:
1162             self.vapi.nat44_forwarding_enable_disable(enable=0)
1163             flags = self.config_flags.NAT_IS_ADDR_ONLY
1164             self.vapi.nat44_add_del_static_mapping(
1165                 is_add=0,
1166                 local_ip_address=real_ip,
1167                 external_ip_address=alias_ip,
1168                 external_sw_if_index=0xFFFFFFFF,
1169                 flags=flags)
1170
1171     def test_output_feature_and_service2(self):
1172         """ NAT44ED interface output feature and service host direct access """
1173         self.vapi.nat44_forwarding_enable_disable(enable=1)
1174         self.nat_add_address(self.nat_addr)
1175
1176         self.vapi.nat44_interface_add_del_output_feature(
1177             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1178
1179         # session initiated from service host - translate
1180         pkts = self.create_stream_in(self.pg0, self.pg1)
1181         self.pg0.add_stream(pkts)
1182         self.pg_enable_capture(self.pg_interfaces)
1183         self.pg_start()
1184         capture = self.pg1.get_capture(len(pkts))
1185         self.verify_capture_out(capture, ignore_port=True)
1186
1187         pkts = self.create_stream_out(self.pg1)
1188         self.pg1.add_stream(pkts)
1189         self.pg_enable_capture(self.pg_interfaces)
1190         self.pg_start()
1191         capture = self.pg0.get_capture(len(pkts))
1192         self.verify_capture_in(capture, self.pg0)
1193
1194         # session initiated from remote host - do not translate
1195         tcp_port_in = self.tcp_port_in
1196         udp_port_in = self.udp_port_in
1197         icmp_id_in = self.icmp_id_in
1198
1199         self.tcp_port_in = 60303
1200         self.udp_port_in = 60304
1201         self.icmp_id_in = 60305
1202
1203         try:
1204             pkts = self.create_stream_out(self.pg1,
1205                                           self.pg0.remote_ip4,
1206                                           use_inside_ports=True)
1207             self.pg1.add_stream(pkts)
1208             self.pg_enable_capture(self.pg_interfaces)
1209             self.pg_start()
1210             capture = self.pg0.get_capture(len(pkts))
1211             self.verify_capture_in(capture, self.pg0)
1212
1213             pkts = self.create_stream_in(self.pg0, self.pg1)
1214             self.pg0.add_stream(pkts)
1215             self.pg_enable_capture(self.pg_interfaces)
1216             self.pg_start()
1217             capture = self.pg1.get_capture(len(pkts))
1218             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1219                                     same_port=True)
1220         finally:
1221             self.tcp_port_in = tcp_port_in
1222             self.udp_port_in = udp_port_in
1223             self.icmp_id_in = icmp_id_in
1224
1225     def test_twice_nat(self):
1226         """ NAT44ED Twice NAT """
1227         self.twice_nat_common()
1228
1229     def test_self_twice_nat_positive(self):
1230         """ NAT44ED Self Twice NAT (positive test) """
1231         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1232
1233     def test_self_twice_nat_lb_positive(self):
1234         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1235         """
1236         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1237                               client_id=1)
1238
1239     def test_twice_nat_lb(self):
1240         """ NAT44ED Twice NAT local service load balancing """
1241         self.twice_nat_common(lb=True)
1242
1243     def test_output_feature(self):
1244         """ NAT44ED interface output feature (in2out postrouting) """
1245         self.vapi.nat44_forwarding_enable_disable(enable=1)
1246         self.nat_add_address(self.nat_addr)
1247
1248         self.nat_add_outside_interface(self.pg0)
1249         self.vapi.nat44_interface_add_del_output_feature(
1250             sw_if_index=self.pg1.sw_if_index, is_add=1)
1251
1252         # in2out
1253         pkts = self.create_stream_in(self.pg0, self.pg1)
1254         self.pg0.add_stream(pkts)
1255         self.pg_enable_capture(self.pg_interfaces)
1256         self.pg_start()
1257         capture = self.pg1.get_capture(len(pkts))
1258         self.verify_capture_out(capture, ignore_port=True)
1259         self.logger.debug(self.vapi.cli("show trace"))
1260
1261         # out2in
1262         pkts = self.create_stream_out(self.pg1)
1263         self.pg1.add_stream(pkts)
1264         self.pg_enable_capture(self.pg_interfaces)
1265         self.pg_start()
1266         capture = self.pg0.get_capture(len(pkts))
1267         self.verify_capture_in(capture, self.pg0)
1268         self.logger.debug(self.vapi.cli("show trace"))
1269
1270         # in2out
1271         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1272         self.pg0.add_stream(pkts)
1273         self.pg_enable_capture(self.pg_interfaces)
1274         self.pg_start()
1275         capture = self.pg1.get_capture(len(pkts))
1276         self.verify_capture_out(capture, ignore_port=True)
1277         self.logger.debug(self.vapi.cli("show trace"))
1278
1279         # out2in
1280         pkts = self.create_stream_out(self.pg1, ttl=2)
1281         self.pg1.add_stream(pkts)
1282         self.pg_enable_capture(self.pg_interfaces)
1283         self.pg_start()
1284         capture = self.pg0.get_capture(len(pkts))
1285         self.verify_capture_in(capture, self.pg0)
1286         self.logger.debug(self.vapi.cli("show trace"))
1287
1288         # in2out
1289         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1290         self.pg0.add_stream(pkts)
1291         self.pg_enable_capture(self.pg_interfaces)
1292         self.pg_start()
1293         capture = self.pg0.get_capture(len(pkts))
1294         for p in capture:
1295             self.assertIn(ICMP, p)
1296             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1297
1298     def test_static_with_port_out2(self):
1299         """ NAT44ED 1:1 NAPT asymmetrical rule """
1300
1301         external_port = 80
1302         local_port = 8080
1303
1304         self.vapi.nat44_forwarding_enable_disable(enable=1)
1305         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1306         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1307                                     local_port, external_port,
1308                                     proto=IP_PROTOS.tcp, flags=flags)
1309
1310         self.nat_add_inside_interface(self.pg0)
1311         self.nat_add_outside_interface(self.pg1)
1312
1313         # from client to service
1314         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1315              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1316              TCP(sport=12345, dport=external_port))
1317         self.pg1.add_stream(p)
1318         self.pg_enable_capture(self.pg_interfaces)
1319         self.pg_start()
1320         capture = self.pg0.get_capture(1)
1321         p = capture[0]
1322         try:
1323             ip = p[IP]
1324             tcp = p[TCP]
1325             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1326             self.assertEqual(tcp.dport, local_port)
1327             self.assert_packet_checksums_valid(p)
1328         except:
1329             self.logger.error(ppp("Unexpected or invalid packet:", p))
1330             raise
1331
1332         # ICMP error
1333         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1334              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1335              ICMP(type=11) / capture[0][IP])
1336         self.pg0.add_stream(p)
1337         self.pg_enable_capture(self.pg_interfaces)
1338         self.pg_start()
1339         capture = self.pg1.get_capture(1)
1340         p = capture[0]
1341         try:
1342             self.assertEqual(p[IP].src, self.nat_addr)
1343             inner = p[IPerror]
1344             self.assertEqual(inner.dst, self.nat_addr)
1345             self.assertEqual(inner[TCPerror].dport, external_port)
1346         except:
1347             self.logger.error(ppp("Unexpected or invalid packet:", p))
1348             raise
1349
1350         # from service back to client
1351         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1352              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1353              TCP(sport=local_port, dport=12345))
1354         self.pg0.add_stream(p)
1355         self.pg_enable_capture(self.pg_interfaces)
1356         self.pg_start()
1357         capture = self.pg1.get_capture(1)
1358         p = capture[0]
1359         try:
1360             ip = p[IP]
1361             tcp = p[TCP]
1362             self.assertEqual(ip.src, self.nat_addr)
1363             self.assertEqual(tcp.sport, external_port)
1364             self.assert_packet_checksums_valid(p)
1365         except:
1366             self.logger.error(ppp("Unexpected or invalid packet:", p))
1367             raise
1368
1369         # ICMP error
1370         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1371              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1372              ICMP(type=11) / capture[0][IP])
1373         self.pg1.add_stream(p)
1374         self.pg_enable_capture(self.pg_interfaces)
1375         self.pg_start()
1376         capture = self.pg0.get_capture(1)
1377         p = capture[0]
1378         try:
1379             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1380             inner = p[IPerror]
1381             self.assertEqual(inner.src, self.pg0.remote_ip4)
1382             self.assertEqual(inner[TCPerror].sport, local_port)
1383         except:
1384             self.logger.error(ppp("Unexpected or invalid packet:", p))
1385             raise
1386
1387         # from client to server (no translation)
1388         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1389              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1390              TCP(sport=12346, dport=local_port))
1391         self.pg1.add_stream(p)
1392         self.pg_enable_capture(self.pg_interfaces)
1393         self.pg_start()
1394         capture = self.pg0.get_capture(1)
1395         p = capture[0]
1396         try:
1397             ip = p[IP]
1398             tcp = p[TCP]
1399             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1400             self.assertEqual(tcp.dport, local_port)
1401             self.assert_packet_checksums_valid(p)
1402         except:
1403             self.logger.error(ppp("Unexpected or invalid packet:", p))
1404             raise
1405
1406         # from service back to client (no translation)
1407         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1408              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1409              TCP(sport=local_port, dport=12346))
1410         self.pg0.add_stream(p)
1411         self.pg_enable_capture(self.pg_interfaces)
1412         self.pg_start()
1413         capture = self.pg1.get_capture(1)
1414         p = capture[0]
1415         try:
1416             ip = p[IP]
1417             tcp = p[TCP]
1418             self.assertEqual(ip.src, self.pg0.remote_ip4)
1419             self.assertEqual(tcp.sport, local_port)
1420             self.assert_packet_checksums_valid(p)
1421         except:
1422             self.logger.error(ppp("Unexpected or invalid packet:", p))
1423             raise
1424
1425     def test_static_lb(self):
1426         """ NAT44ED local service load balancing """
1427         external_addr_n = self.nat_addr
1428         external_port = 80
1429         local_port = 8080
1430         server1 = self.pg0.remote_hosts[0]
1431         server2 = self.pg0.remote_hosts[1]
1432
1433         locals = [{'addr': server1.ip4,
1434                    'port': local_port,
1435                    'probability': 70,
1436                    'vrf_id': 0},
1437                   {'addr': server2.ip4,
1438                    'port': local_port,
1439                    'probability': 30,
1440                    'vrf_id': 0}]
1441
1442         self.nat_add_address(self.nat_addr)
1443         self.vapi.nat44_add_del_lb_static_mapping(
1444             is_add=1,
1445             external_addr=external_addr_n,
1446             external_port=external_port,
1447             protocol=IP_PROTOS.tcp,
1448             local_num=len(locals),
1449             locals=locals)
1450         flags = self.config_flags.NAT_IS_INSIDE
1451         self.vapi.nat44_interface_add_del_feature(
1452             sw_if_index=self.pg0.sw_if_index,
1453             flags=flags, is_add=1)
1454         self.vapi.nat44_interface_add_del_feature(
1455             sw_if_index=self.pg1.sw_if_index,
1456             is_add=1)
1457
1458         # from client to service
1459         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1460              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1461              TCP(sport=12345, dport=external_port))
1462         self.pg1.add_stream(p)
1463         self.pg_enable_capture(self.pg_interfaces)
1464         self.pg_start()
1465         capture = self.pg0.get_capture(1)
1466         p = capture[0]
1467         server = None
1468         try:
1469             ip = p[IP]
1470             tcp = p[TCP]
1471             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1472             if ip.dst == server1.ip4:
1473                 server = server1
1474             else:
1475                 server = server2
1476             self.assertEqual(tcp.dport, local_port)
1477             self.assert_packet_checksums_valid(p)
1478         except:
1479             self.logger.error(ppp("Unexpected or invalid packet:", p))
1480             raise
1481
1482         # from service back to client
1483         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1484              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1485              TCP(sport=local_port, dport=12345))
1486         self.pg0.add_stream(p)
1487         self.pg_enable_capture(self.pg_interfaces)
1488         self.pg_start()
1489         capture = self.pg1.get_capture(1)
1490         p = capture[0]
1491         try:
1492             ip = p[IP]
1493             tcp = p[TCP]
1494             self.assertEqual(ip.src, self.nat_addr)
1495             self.assertEqual(tcp.sport, external_port)
1496             self.assert_packet_checksums_valid(p)
1497         except:
1498             self.logger.error(ppp("Unexpected or invalid packet:", p))
1499             raise
1500
1501         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1502         self.assertEqual(len(sessions), 1)
1503         self.assertTrue(sessions[0].flags &
1504                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1505         self.vapi.nat44_del_session(
1506             address=sessions[0].inside_ip_address,
1507             port=sessions[0].inside_port,
1508             protocol=sessions[0].protocol,
1509             flags=(self.config_flags.NAT_IS_INSIDE |
1510                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1511             ext_host_address=sessions[0].ext_host_address,
1512             ext_host_port=sessions[0].ext_host_port)
1513         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1514         self.assertEqual(len(sessions), 0)
1515
1516     def test_static_lb_2(self):
1517         """ NAT44ED local service load balancing (asymmetrical rule) """
1518         external_addr = self.nat_addr
1519         external_port = 80
1520         local_port = 8080
1521         server1 = self.pg0.remote_hosts[0]
1522         server2 = self.pg0.remote_hosts[1]
1523
1524         locals = [{'addr': server1.ip4,
1525                    'port': local_port,
1526                    'probability': 70,
1527                    'vrf_id': 0},
1528                   {'addr': server2.ip4,
1529                    'port': local_port,
1530                    'probability': 30,
1531                    'vrf_id': 0}]
1532
1533         self.vapi.nat44_forwarding_enable_disable(enable=1)
1534         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1535         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1536                                                   external_addr=external_addr,
1537                                                   external_port=external_port,
1538                                                   protocol=IP_PROTOS.tcp,
1539                                                   local_num=len(locals),
1540                                                   locals=locals)
1541         flags = self.config_flags.NAT_IS_INSIDE
1542         self.vapi.nat44_interface_add_del_feature(
1543             sw_if_index=self.pg0.sw_if_index,
1544             flags=flags, is_add=1)
1545         self.vapi.nat44_interface_add_del_feature(
1546             sw_if_index=self.pg1.sw_if_index,
1547             is_add=1)
1548
1549         # from client to service
1550         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1551              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1552              TCP(sport=12345, dport=external_port))
1553         self.pg1.add_stream(p)
1554         self.pg_enable_capture(self.pg_interfaces)
1555         self.pg_start()
1556         capture = self.pg0.get_capture(1)
1557         p = capture[0]
1558         server = None
1559         try:
1560             ip = p[IP]
1561             tcp = p[TCP]
1562             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1563             if ip.dst == server1.ip4:
1564                 server = server1
1565             else:
1566                 server = server2
1567             self.assertEqual(tcp.dport, local_port)
1568             self.assert_packet_checksums_valid(p)
1569         except:
1570             self.logger.error(ppp("Unexpected or invalid packet:", p))
1571             raise
1572
1573         # from service back to client
1574         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1575              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1576              TCP(sport=local_port, dport=12345))
1577         self.pg0.add_stream(p)
1578         self.pg_enable_capture(self.pg_interfaces)
1579         self.pg_start()
1580         capture = self.pg1.get_capture(1)
1581         p = capture[0]
1582         try:
1583             ip = p[IP]
1584             tcp = p[TCP]
1585             self.assertEqual(ip.src, self.nat_addr)
1586             self.assertEqual(tcp.sport, external_port)
1587             self.assert_packet_checksums_valid(p)
1588         except:
1589             self.logger.error(ppp("Unexpected or invalid packet:", p))
1590             raise
1591
1592         # from client to server (no translation)
1593         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1594              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1595              TCP(sport=12346, dport=local_port))
1596         self.pg1.add_stream(p)
1597         self.pg_enable_capture(self.pg_interfaces)
1598         self.pg_start()
1599         capture = self.pg0.get_capture(1)
1600         p = capture[0]
1601         server = None
1602         try:
1603             ip = p[IP]
1604             tcp = p[TCP]
1605             self.assertEqual(ip.dst, server1.ip4)
1606             self.assertEqual(tcp.dport, local_port)
1607             self.assert_packet_checksums_valid(p)
1608         except:
1609             self.logger.error(ppp("Unexpected or invalid packet:", p))
1610             raise
1611
1612         # from service back to client (no translation)
1613         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1614              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1615              TCP(sport=local_port, dport=12346))
1616         self.pg0.add_stream(p)
1617         self.pg_enable_capture(self.pg_interfaces)
1618         self.pg_start()
1619         capture = self.pg1.get_capture(1)
1620         p = capture[0]
1621         try:
1622             ip = p[IP]
1623             tcp = p[TCP]
1624             self.assertEqual(ip.src, server1.ip4)
1625             self.assertEqual(tcp.sport, local_port)
1626             self.assert_packet_checksums_valid(p)
1627         except:
1628             self.logger.error(ppp("Unexpected or invalid packet:", p))
1629             raise
1630
1631     def test_lb_affinity(self):
1632         """ NAT44ED local service load balancing affinity """
1633         external_addr = self.nat_addr
1634         external_port = 80
1635         local_port = 8080
1636         server1 = self.pg0.remote_hosts[0]
1637         server2 = self.pg0.remote_hosts[1]
1638
1639         locals = [{'addr': server1.ip4,
1640                    'port': local_port,
1641                    'probability': 50,
1642                    'vrf_id': 0},
1643                   {'addr': server2.ip4,
1644                    'port': local_port,
1645                    'probability': 50,
1646                    'vrf_id': 0}]
1647
1648         self.nat_add_address(self.nat_addr)
1649         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1650                                                   external_addr=external_addr,
1651                                                   external_port=external_port,
1652                                                   protocol=IP_PROTOS.tcp,
1653                                                   affinity=10800,
1654                                                   local_num=len(locals),
1655                                                   locals=locals)
1656         flags = self.config_flags.NAT_IS_INSIDE
1657         self.vapi.nat44_interface_add_del_feature(
1658             sw_if_index=self.pg0.sw_if_index,
1659             flags=flags, is_add=1)
1660         self.vapi.nat44_interface_add_del_feature(
1661             sw_if_index=self.pg1.sw_if_index,
1662             is_add=1)
1663
1664         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1665              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1666              TCP(sport=1025, dport=external_port))
1667         self.pg1.add_stream(p)
1668         self.pg_enable_capture(self.pg_interfaces)
1669         self.pg_start()
1670         capture = self.pg0.get_capture(1)
1671         backend = capture[0][IP].dst
1672
1673         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1674         self.assertEqual(len(sessions), 1)
1675         self.assertTrue(sessions[0].flags &
1676                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1677         self.vapi.nat44_del_session(
1678             address=sessions[0].inside_ip_address,
1679             port=sessions[0].inside_port,
1680             protocol=sessions[0].protocol,
1681             flags=(self.config_flags.NAT_IS_INSIDE |
1682                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1683             ext_host_address=sessions[0].ext_host_address,
1684             ext_host_port=sessions[0].ext_host_port)
1685
1686         pkts = []
1687         for port in range(1030, 1100):
1688             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1689                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1690                  TCP(sport=port, dport=external_port))
1691             pkts.append(p)
1692         self.pg1.add_stream(pkts)
1693         self.pg_enable_capture(self.pg_interfaces)
1694         self.pg_start()
1695         capture = self.pg0.get_capture(len(pkts))
1696         for p in capture:
1697             self.assertEqual(p[IP].dst, backend)
1698
1699     def test_multiple_vrf_1(self):
1700         """ Multiple VRF - both client & service in VRF1 """
1701
1702         external_addr = '1.2.3.4'
1703         external_port = 80
1704         local_port = 8080
1705         port = 0
1706
1707         flags = self.config_flags.NAT_IS_INSIDE
1708         self.vapi.nat44_interface_add_del_feature(
1709             sw_if_index=self.pg5.sw_if_index,
1710             is_add=1)
1711         self.vapi.nat44_interface_add_del_feature(
1712             sw_if_index=self.pg5.sw_if_index,
1713             is_add=1, flags=flags)
1714         self.vapi.nat44_interface_add_del_feature(
1715             sw_if_index=self.pg6.sw_if_index,
1716             is_add=1)
1717         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1718         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1719                                     local_port, external_port, vrf_id=1,
1720                                     proto=IP_PROTOS.tcp, flags=flags)
1721
1722         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1723              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1724              TCP(sport=12345, dport=external_port))
1725         self.pg6.add_stream(p)
1726         self.pg_enable_capture(self.pg_interfaces)
1727         self.pg_start()
1728         capture = self.pg5.get_capture(1)
1729         p = capture[0]
1730         try:
1731             ip = p[IP]
1732             tcp = p[TCP]
1733             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1734             self.assertEqual(tcp.dport, local_port)
1735             self.assert_packet_checksums_valid(p)
1736         except:
1737             self.logger.error(ppp("Unexpected or invalid packet:", p))
1738             raise
1739
1740         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1741              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1742              TCP(sport=local_port, dport=12345))
1743         self.pg5.add_stream(p)
1744         self.pg_enable_capture(self.pg_interfaces)
1745         self.pg_start()
1746         capture = self.pg6.get_capture(1)
1747         p = capture[0]
1748         try:
1749             ip = p[IP]
1750             tcp = p[TCP]
1751             self.assertEqual(ip.src, external_addr)
1752             self.assertEqual(tcp.sport, external_port)
1753             self.assert_packet_checksums_valid(p)
1754         except:
1755             self.logger.error(ppp("Unexpected or invalid packet:", p))
1756             raise
1757
1758     def test_multiple_vrf_2(self):
1759         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1760
1761         external_addr = '1.2.3.4'
1762         external_port = 80
1763         local_port = 8080
1764         port = 0
1765
1766         self.nat_add_address(self.nat_addr)
1767         flags = self.config_flags.NAT_IS_INSIDE
1768         self.vapi.nat44_interface_add_del_output_feature(
1769             sw_if_index=self.pg1.sw_if_index,
1770             is_add=1)
1771         self.vapi.nat44_interface_add_del_feature(
1772             sw_if_index=self.pg5.sw_if_index,
1773             is_add=1)
1774         self.vapi.nat44_interface_add_del_feature(
1775             sw_if_index=self.pg5.sw_if_index,
1776             is_add=1, flags=flags)
1777         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1778         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1779                                     local_port, external_port, vrf_id=1,
1780                                     proto=IP_PROTOS.tcp, flags=flags)
1781
1782         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1783              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1784              TCP(sport=2345, dport=22))
1785         self.pg5.add_stream(p)
1786         self.pg_enable_capture(self.pg_interfaces)
1787         self.pg_start()
1788         capture = self.pg1.get_capture(1)
1789         p = capture[0]
1790         try:
1791             ip = p[IP]
1792             tcp = p[TCP]
1793             self.assertEqual(ip.src, self.nat_addr)
1794             self.assert_packet_checksums_valid(p)
1795             port = tcp.sport
1796         except:
1797             self.logger.error(ppp("Unexpected or invalid packet:", p))
1798             raise
1799
1800         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1801              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1802              TCP(sport=22, dport=port))
1803         self.pg1.add_stream(p)
1804         self.pg_enable_capture(self.pg_interfaces)
1805         self.pg_start()
1806         capture = self.pg5.get_capture(1)
1807         p = capture[0]
1808         try:
1809             ip = p[IP]
1810             tcp = p[TCP]
1811             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1812             self.assertEqual(tcp.dport, 2345)
1813             self.assert_packet_checksums_valid(p)
1814         except:
1815             self.logger.error(ppp("Unexpected or invalid packet:", p))
1816             raise
1817
1818     def test_multiple_vrf_3(self):
1819         """ Multiple VRF - client in VRF1, service in VRF0 """
1820
1821         external_addr = '1.2.3.4'
1822         external_port = 80
1823         local_port = 8080
1824         port = 0
1825
1826         flags = self.config_flags.NAT_IS_INSIDE
1827         self.vapi.nat44_interface_add_del_feature(
1828             sw_if_index=self.pg0.sw_if_index,
1829             is_add=1)
1830         self.vapi.nat44_interface_add_del_feature(
1831             sw_if_index=self.pg0.sw_if_index,
1832             is_add=1, flags=flags)
1833         self.vapi.nat44_interface_add_del_feature(
1834             sw_if_index=self.pg6.sw_if_index,
1835             is_add=1)
1836         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1837         self.nat_add_static_mapping(
1838             self.pg0.remote_ip4,
1839             external_sw_if_index=self.pg0.sw_if_index,
1840             local_port=local_port,
1841             vrf_id=0,
1842             external_port=external_port,
1843             proto=IP_PROTOS.tcp,
1844             flags=flags
1845         )
1846
1847         # from client VRF1 to service VRF0
1848         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1849              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1850              TCP(sport=12346, dport=external_port))
1851         self.pg6.add_stream(p)
1852         self.pg_enable_capture(self.pg_interfaces)
1853         self.pg_start()
1854         capture = self.pg0.get_capture(1)
1855         p = capture[0]
1856         try:
1857             ip = p[IP]
1858             tcp = p[TCP]
1859             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1860             self.assertEqual(tcp.dport, local_port)
1861             self.assert_packet_checksums_valid(p)
1862         except:
1863             self.logger.error(ppp("Unexpected or invalid packet:", p))
1864             raise
1865
1866         # from service VRF0 back to client VRF1
1867         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1868              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1869              TCP(sport=local_port, dport=12346))
1870         self.pg0.add_stream(p)
1871         self.pg_enable_capture(self.pg_interfaces)
1872         self.pg_start()
1873         capture = self.pg6.get_capture(1)
1874         p = capture[0]
1875         try:
1876             ip = p[IP]
1877             tcp = p[TCP]
1878             self.assertEqual(ip.src, self.pg0.local_ip4)
1879             self.assertEqual(tcp.sport, external_port)
1880             self.assert_packet_checksums_valid(p)
1881         except:
1882             self.logger.error(ppp("Unexpected or invalid packet:", p))
1883             raise
1884
1885     def test_multiple_vrf_4(self):
1886         """ Multiple VRF - client in VRF0, service in VRF1 """
1887
1888         external_addr = '1.2.3.4'
1889         external_port = 80
1890         local_port = 8080
1891         port = 0
1892
1893         flags = self.config_flags.NAT_IS_INSIDE
1894         self.vapi.nat44_interface_add_del_feature(
1895             sw_if_index=self.pg0.sw_if_index,
1896             is_add=1)
1897         self.vapi.nat44_interface_add_del_feature(
1898             sw_if_index=self.pg0.sw_if_index,
1899             is_add=1, flags=flags)
1900         self.vapi.nat44_interface_add_del_feature(
1901             sw_if_index=self.pg5.sw_if_index,
1902             is_add=1)
1903         self.vapi.nat44_interface_add_del_feature(
1904             sw_if_index=self.pg5.sw_if_index,
1905             is_add=1, flags=flags)
1906         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1907         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1908                                     local_port, external_port, vrf_id=1,
1909                                     proto=IP_PROTOS.tcp, flags=flags)
1910
1911         # from client VRF0 to service VRF1
1912         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1913              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1914              TCP(sport=12347, dport=external_port))
1915         self.pg0.add_stream(p)
1916         self.pg_enable_capture(self.pg_interfaces)
1917         self.pg_start()
1918         capture = self.pg5.get_capture(1)
1919         p = capture[0]
1920         try:
1921             ip = p[IP]
1922             tcp = p[TCP]
1923             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1924             self.assertEqual(tcp.dport, local_port)
1925             self.assert_packet_checksums_valid(p)
1926         except:
1927             self.logger.error(ppp("Unexpected or invalid packet:", p))
1928             raise
1929
1930         # from service VRF1 back to client VRF0
1931         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1932              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1933              TCP(sport=local_port, dport=12347))
1934         self.pg5.add_stream(p)
1935         self.pg_enable_capture(self.pg_interfaces)
1936         self.pg_start()
1937         capture = self.pg0.get_capture(1)
1938         p = capture[0]
1939         try:
1940             ip = p[IP]
1941             tcp = p[TCP]
1942             self.assertEqual(ip.src, external_addr)
1943             self.assertEqual(tcp.sport, external_port)
1944             self.assert_packet_checksums_valid(p)
1945         except:
1946             self.logger.error(ppp("Unexpected or invalid packet:", p))
1947             raise
1948
1949     def test_multiple_vrf_5(self):
1950         """ Multiple VRF - forwarding - no translation """
1951
1952         external_addr = '1.2.3.4'
1953         external_port = 80
1954         local_port = 8080
1955         port = 0
1956
1957         self.vapi.nat44_forwarding_enable_disable(enable=1)
1958         flags = self.config_flags.NAT_IS_INSIDE
1959         self.vapi.nat44_interface_add_del_feature(
1960             sw_if_index=self.pg0.sw_if_index,
1961             is_add=1)
1962         self.vapi.nat44_interface_add_del_feature(
1963             sw_if_index=self.pg0.sw_if_index,
1964             is_add=1, flags=flags)
1965         self.vapi.nat44_interface_add_del_feature(
1966             sw_if_index=self.pg5.sw_if_index,
1967             is_add=1)
1968         self.vapi.nat44_interface_add_del_feature(
1969             sw_if_index=self.pg5.sw_if_index,
1970             is_add=1, flags=flags)
1971         self.vapi.nat44_interface_add_del_feature(
1972             sw_if_index=self.pg6.sw_if_index,
1973             is_add=1)
1974         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1975         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1976                                     local_port, external_port, vrf_id=1,
1977                                     proto=IP_PROTOS.tcp, flags=flags)
1978         self.nat_add_static_mapping(
1979             self.pg0.remote_ip4,
1980             external_sw_if_index=self.pg0.sw_if_index,
1981             local_port=local_port,
1982             vrf_id=0,
1983             external_port=external_port,
1984             proto=IP_PROTOS.tcp,
1985             flags=flags
1986         )
1987
1988         # from client to server (both VRF1, no translation)
1989         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1990              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1991              TCP(sport=12348, dport=local_port))
1992         self.pg6.add_stream(p)
1993         self.pg_enable_capture(self.pg_interfaces)
1994         self.pg_start()
1995         capture = self.pg5.get_capture(1)
1996         p = capture[0]
1997         try:
1998             ip = p[IP]
1999             tcp = p[TCP]
2000             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2001             self.assertEqual(tcp.dport, local_port)
2002             self.assert_packet_checksums_valid(p)
2003         except:
2004             self.logger.error(ppp("Unexpected or invalid packet:", p))
2005             raise
2006
2007         # from server back to client (both VRF1, no translation)
2008         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2009              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
2010              TCP(sport=local_port, dport=12348))
2011         self.pg5.add_stream(p)
2012         self.pg_enable_capture(self.pg_interfaces)
2013         self.pg_start()
2014         capture = self.pg6.get_capture(1)
2015         p = capture[0]
2016         try:
2017             ip = p[IP]
2018             tcp = p[TCP]
2019             self.assertEqual(ip.src, self.pg5.remote_ip4)
2020             self.assertEqual(tcp.sport, local_port)
2021             self.assert_packet_checksums_valid(p)
2022         except:
2023             self.logger.error(ppp("Unexpected or invalid packet:", p))
2024             raise
2025
2026         # from client VRF1 to server VRF0 (no translation)
2027         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2028              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2029              TCP(sport=local_port, dport=12349))
2030         self.pg0.add_stream(p)
2031         self.pg_enable_capture(self.pg_interfaces)
2032         self.pg_start()
2033         capture = self.pg6.get_capture(1)
2034         p = capture[0]
2035         try:
2036             ip = p[IP]
2037             tcp = p[TCP]
2038             self.assertEqual(ip.src, self.pg0.remote_ip4)
2039             self.assertEqual(tcp.sport, local_port)
2040             self.assert_packet_checksums_valid(p)
2041         except:
2042             self.logger.error(ppp("Unexpected or invalid packet:", p))
2043             raise
2044
2045         # from server VRF0 back to client VRF1 (no translation)
2046         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2047              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2048              TCP(sport=local_port, dport=12349))
2049         self.pg0.add_stream(p)
2050         self.pg_enable_capture(self.pg_interfaces)
2051         self.pg_start()
2052         capture = self.pg6.get_capture(1)
2053         p = capture[0]
2054         try:
2055             ip = p[IP]
2056             tcp = p[TCP]
2057             self.assertEqual(ip.src, self.pg0.remote_ip4)
2058             self.assertEqual(tcp.sport, local_port)
2059             self.assert_packet_checksums_valid(p)
2060         except:
2061             self.logger.error(ppp("Unexpected or invalid packet:", p))
2062             raise
2063
2064         # from client VRF0 to server VRF1 (no translation)
2065         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2066              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
2067              TCP(sport=12344, dport=local_port))
2068         self.pg0.add_stream(p)
2069         self.pg_enable_capture(self.pg_interfaces)
2070         self.pg_start()
2071         capture = self.pg5.get_capture(1)
2072         p = capture[0]
2073         try:
2074             ip = p[IP]
2075             tcp = p[TCP]
2076             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2077             self.assertEqual(tcp.dport, local_port)
2078             self.assert_packet_checksums_valid(p)
2079         except:
2080             self.logger.error(ppp("Unexpected or invalid packet:", p))
2081             raise
2082
2083         # from server VRF1 back to client VRF0 (no translation)
2084         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2085              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2086              TCP(sport=local_port, dport=12344))
2087         self.pg5.add_stream(p)
2088         self.pg_enable_capture(self.pg_interfaces)
2089         self.pg_start()
2090         capture = self.pg0.get_capture(1)
2091         p = capture[0]
2092         try:
2093             ip = p[IP]
2094             tcp = p[TCP]
2095             self.assertEqual(ip.src, self.pg5.remote_ip4)
2096             self.assertEqual(tcp.sport, local_port)
2097             self.assert_packet_checksums_valid(p)
2098         except:
2099             self.logger.error(ppp("Unexpected or invalid packet:", p))
2100             raise
2101
2102     def test_outside_address_distribution(self):
2103         """ Outside address distribution based on source address """
2104
2105         x = 100
2106         nat_addresses = []
2107
2108         for i in range(1, x):
2109             a = "10.0.0.%d" % i
2110             nat_addresses.append(a)
2111
2112         self.nat_add_inside_interface(self.pg0)
2113         self.nat_add_outside_interface(self.pg1)
2114
2115         self.vapi.nat44_add_del_address_range(
2116             first_ip_address=nat_addresses[0],
2117             last_ip_address=nat_addresses[-1],
2118             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2119
2120         self.pg0.generate_remote_hosts(x)
2121
2122         pkts = []
2123         for i in range(x):
2124             info = self.create_packet_info(self.pg0, self.pg1)
2125             payload = self.info_to_payload(info)
2126             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2127                  IP(src=self.pg0.remote_hosts[i].ip4,
2128                      dst=self.pg1.remote_ip4) /
2129                  UDP(sport=7000+i, dport=8000+i) /
2130                  Raw(payload))
2131             info.data = p
2132             pkts.append(p)
2133
2134         self.pg0.add_stream(pkts)
2135         self.pg_enable_capture(self.pg_interfaces)
2136         self.pg_start()
2137         recvd = self.pg1.get_capture(len(pkts))
2138         for p_recvd in recvd:
2139             payload_info = self.payload_to_info(p_recvd[Raw])
2140             packet_index = payload_info.index
2141             info = self._packet_infos[packet_index]
2142             self.assertTrue(info is not None)
2143             self.assertEqual(packet_index, info.index)
2144             p_sent = info.data
2145             packed = socket.inet_aton(p_sent[IP].src)
2146             numeric = struct.unpack("!L", packed)[0]
2147             numeric = socket.htonl(numeric)
2148             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2149             self.assertEqual(
2150                 a, p_recvd[IP].src,
2151                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2152                 % (p_sent[IP].src, p_recvd[IP].src, a))
2153
2154
2155 class TestNAT44EDMW(TestNAT44ED):
2156     """ NAT44ED MW Test Case """
2157     vpp_worker_count = 4
2158     max_sessions = 5000
2159
2160     @unittest.skip('MW fix required')
2161     def test_users_dump(self):
2162         """ NAT44ED API test - nat44_user_dump """
2163
2164     @unittest.skip('MW fix required')
2165     def test_frag_out_of_order_do_not_translate(self):
2166         """ NAT44ED don't translate fragments arriving out of order """
2167
2168     @unittest.skip('MW fix required')
2169     def test_forwarding(self):
2170         """ NAT44ED forwarding test """
2171
2172     @unittest.skip('MW fix required')
2173     def test_twice_nat(self):
2174         """ NAT44ED Twice NAT """
2175
2176     @unittest.skip('MW fix required')
2177     def test_twice_nat_lb(self):
2178         """ NAT44ED Twice NAT local service load balancing """
2179
2180     @unittest.skip('MW fix required')
2181     def test_output_feature(self):
2182         """ NAT44ED interface output feature (in2out postrouting) """
2183
2184     @unittest.skip('MW fix required')
2185     def test_static_with_port_out2(self):
2186         """ NAT44ED 1:1 NAPT asymmetrical rule """
2187
2188     @unittest.skip('MW fix required')
2189     def test_output_feature_and_service2(self):
2190         """ NAT44ED interface output feature and service host direct access """
2191
2192     @unittest.skip('MW fix required')
2193     def test_static_lb(self):
2194         """ NAT44ED local service load balancing """
2195
2196     @unittest.skip('MW fix required')
2197     def test_static_lb_2(self):
2198         """ NAT44ED local service load balancing (asymmetrical rule) """
2199
2200     @unittest.skip('MW fix required')
2201     def test_lb_affinity(self):
2202         """ NAT44ED local service load balancing affinity """
2203
2204     @unittest.skip('MW fix required')
2205     def test_multiple_vrf(self):
2206         """ NAT44ED Multiple VRF setup """
2207
2208     @unittest.skip('MW fix required')
2209     def test_self_twice_nat_positive(self):
2210         """ NAT44ED Self Twice NAT (positive test) """
2211
2212     @unittest.skip('MW fix required')
2213     def test_self_twice_nat_lb_positive(self):
2214         """ NAT44ED Self Twice NAT local service load balancing (positive test)
2215         """
2216
2217     def test_dynamic(self):
2218         """ NAT44ED dynamic translation test """
2219         pkt_count = 1500
2220         tcp_port_offset = 20
2221         udp_port_offset = 20
2222         icmp_id_offset = 20
2223
2224         self.nat_add_address(self.nat_addr)
2225         self.nat_add_inside_interface(self.pg0)
2226         self.nat_add_outside_interface(self.pg1)
2227
2228         # in2out
2229         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2230         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2231         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2232         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2233
2234         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2235
2236         for i in range(pkt_count):
2237             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2238                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2239                  TCP(sport=tcp_port_offset + i, dport=20))
2240             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2241
2242             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2243                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2244                  UDP(sport=udp_port_offset + i, dport=20))
2245             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2246
2247             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2248                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2249                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2250             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2251
2252         for i in range(0, self.vpp_worker_count):
2253             if len(i2o_pkts[i]) > 0:
2254                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2255
2256         self.pg_enable_capture(self.pg_interfaces)
2257         self.pg_start()
2258         capture = self.pg1.get_capture(pkt_count * 3, timeout=5)
2259
2260         if_idx = self.pg0.sw_if_index
2261         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2262         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2263         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2264         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2265
2266         self.assertEqual(
2267             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2268         self.assertEqual(
2269             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2270         self.assertEqual(
2271             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2272         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2273
2274         self.logger.info(self.vapi.cli("show trace"))
2275
2276         # out2in
2277         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2278         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2279         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2280         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2281
2282         recvd_tcp_ports = set()
2283         recvd_udp_ports = set()
2284         recvd_icmp_ids = set()
2285
2286         for p in capture:
2287             if TCP in p:
2288                 recvd_tcp_ports.add(p[TCP].sport)
2289             if UDP in p:
2290                 recvd_udp_ports.add(p[UDP].sport)
2291             if ICMP in p:
2292                 recvd_icmp_ids.add(p[ICMP].id)
2293
2294         recvd_tcp_ports = list(recvd_tcp_ports)
2295         recvd_udp_ports = list(recvd_udp_ports)
2296         recvd_icmp_ids = list(recvd_icmp_ids)
2297
2298         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2299         for i in range(pkt_count):
2300             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2301                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2302                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2303             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2304
2305             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2306                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2307                  UDP(dport=choice(recvd_udp_ports), sport=20))
2308             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2309
2310             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2311                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2312                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2313             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2314
2315         for i in range(0, self.vpp_worker_count):
2316             if len(o2i_pkts[i]) > 0:
2317                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2318
2319         self.pg_enable_capture(self.pg_interfaces)
2320         self.pg_start()
2321         capture = self.pg0.get_capture(pkt_count * 3)
2322         for packet in capture:
2323             try:
2324                 self.assert_packet_checksums_valid(packet)
2325                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2326                 if packet.haslayer(TCP):
2327                     self.assert_in_range(
2328                         packet[TCP].dport, tcp_port_offset,
2329                         tcp_port_offset + pkt_count, "dst TCP port")
2330                 elif packet.haslayer(UDP):
2331                     self.assert_in_range(
2332                         packet[UDP].dport, udp_port_offset,
2333                         udp_port_offset + pkt_count, "dst UDP port")
2334                 else:
2335                     self.assert_in_range(
2336                         packet[ICMP].id, icmp_id_offset,
2337                         icmp_id_offset + pkt_count, "ICMP id")
2338             except:
2339                 self.logger.error(ppp("Unexpected or invalid packet "
2340                                       "(inside network):", packet))
2341                 raise
2342
2343         if_idx = self.pg1.sw_if_index
2344         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2345         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2346         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2347         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2348
2349         self.assertEqual(
2350             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2351         self.assertEqual(
2352             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2353         self.assertEqual(
2354             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2355         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2356
2357         sc = self.statistics['/nat44-ed/total-sessions']
2358         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2359                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2360
2361     def test_frag_in_order(self):
2362         """ NAT44ED translate fragments arriving in order """
2363
2364         self.nat_add_address(self.nat_addr)
2365         self.nat_add_inside_interface(self.pg0)
2366         self.nat_add_outside_interface(self.pg1)
2367
2368         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2369         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2370         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2371
2372     def test_frag_in_order_do_not_translate(self):
2373         """ NAT44ED don't translate fragments arriving in order """
2374
2375         self.nat_add_address(self.nat_addr)
2376         self.nat_add_inside_interface(self.pg0)
2377         self.nat_add_outside_interface(self.pg1)
2378         self.vapi.nat44_forwarding_enable_disable(enable=True)
2379
2380         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2381
2382     def test_frag_out_of_order(self):
2383         """ NAT44ED translate fragments arriving out of order """
2384
2385         self.nat_add_address(self.nat_addr)
2386         self.nat_add_inside_interface(self.pg0)
2387         self.nat_add_outside_interface(self.pg1)
2388
2389         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2390         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2391         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2392
2393     def test_frag_in_order_in_plus_out(self):
2394         """ NAT44ED in+out interface fragments in order """
2395
2396         in_port = self.random_port()
2397         out_port = self.random_port()
2398
2399         self.nat_add_address(self.nat_addr)
2400         self.nat_add_inside_interface(self.pg0)
2401         self.nat_add_outside_interface(self.pg0)
2402         self.nat_add_inside_interface(self.pg1)
2403         self.nat_add_outside_interface(self.pg1)
2404
2405         # add static mappings for server
2406         self.nat_add_static_mapping(self.server_addr,
2407                                     self.nat_addr,
2408                                     in_port,
2409                                     out_port,
2410                                     proto=IP_PROTOS.tcp)
2411         self.nat_add_static_mapping(self.server_addr,
2412                                     self.nat_addr,
2413                                     in_port,
2414                                     out_port,
2415                                     proto=IP_PROTOS.udp)
2416         self.nat_add_static_mapping(self.server_addr,
2417                                     self.nat_addr,
2418                                     proto=IP_PROTOS.icmp)
2419
2420         # run tests for each protocol
2421         self.frag_in_order_in_plus_out(self.server_addr,
2422                                        self.nat_addr,
2423                                        in_port,
2424                                        out_port,
2425                                        IP_PROTOS.tcp)
2426         self.frag_in_order_in_plus_out(self.server_addr,
2427                                        self.nat_addr,
2428                                        in_port,
2429                                        out_port,
2430                                        IP_PROTOS.udp)
2431         self.frag_in_order_in_plus_out(self.server_addr,
2432                                        self.nat_addr,
2433                                        in_port,
2434                                        out_port,
2435                                        IP_PROTOS.icmp)
2436
2437     def test_frag_out_of_order_in_plus_out(self):
2438         """ NAT44ED in+out interface fragments out of order """
2439
2440         in_port = self.random_port()
2441         out_port = self.random_port()
2442
2443         self.nat_add_address(self.nat_addr)
2444         self.nat_add_inside_interface(self.pg0)
2445         self.nat_add_outside_interface(self.pg0)
2446         self.nat_add_inside_interface(self.pg1)
2447         self.nat_add_outside_interface(self.pg1)
2448
2449         # add static mappings for server
2450         self.nat_add_static_mapping(self.server_addr,
2451                                     self.nat_addr,
2452                                     in_port,
2453                                     out_port,
2454                                     proto=IP_PROTOS.tcp)
2455         self.nat_add_static_mapping(self.server_addr,
2456                                     self.nat_addr,
2457                                     in_port,
2458                                     out_port,
2459                                     proto=IP_PROTOS.udp)
2460         self.nat_add_static_mapping(self.server_addr,
2461                                     self.nat_addr,
2462                                     proto=IP_PROTOS.icmp)
2463
2464         # run tests for each protocol
2465         self.frag_out_of_order_in_plus_out(self.server_addr,
2466                                            self.nat_addr,
2467                                            in_port,
2468                                            out_port,
2469                                            IP_PROTOS.tcp)
2470         self.frag_out_of_order_in_plus_out(self.server_addr,
2471                                            self.nat_addr,
2472                                            in_port,
2473                                            out_port,
2474                                            IP_PROTOS.udp)
2475         self.frag_out_of_order_in_plus_out(self.server_addr,
2476                                            self.nat_addr,
2477                                            in_port,
2478                                            out_port,
2479                                            IP_PROTOS.icmp)
2480
2481     def test_reass_hairpinning(self):
2482         """ NAT44ED fragments hairpinning """
2483
2484         server_addr = self.pg0.remote_hosts[1].ip4
2485
2486         host_in_port = self.random_port()
2487         server_in_port = self.random_port()
2488         server_out_port = self.random_port()
2489
2490         self.nat_add_address(self.nat_addr)
2491         self.nat_add_inside_interface(self.pg0)
2492         self.nat_add_outside_interface(self.pg1)
2493
2494         # add static mapping for server
2495         self.nat_add_static_mapping(server_addr, self.nat_addr,
2496                                     server_in_port, server_out_port,
2497                                     proto=IP_PROTOS.tcp)
2498         self.nat_add_static_mapping(server_addr, self.nat_addr,
2499                                     server_in_port, server_out_port,
2500                                     proto=IP_PROTOS.udp)
2501         self.nat_add_static_mapping(server_addr, self.nat_addr)
2502
2503         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2504                                host_in_port, proto=IP_PROTOS.tcp,
2505                                ignore_port=True)
2506         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2507                                host_in_port, proto=IP_PROTOS.udp,
2508                                ignore_port=True)
2509         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2510                                host_in_port, proto=IP_PROTOS.icmp,
2511                                ignore_port=True)
2512
2513     def test_session_limit_per_vrf(self):
2514         """ NAT44ED per vrf session limit """
2515
2516         inside = self.pg0
2517         inside_vrf10 = self.pg2
2518         outside = self.pg1
2519
2520         limit = 5
2521
2522         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2523         # non existing vrf_id makes process core dump
2524         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2525
2526         self.nat_add_inside_interface(inside)
2527         self.nat_add_inside_interface(inside_vrf10)
2528         self.nat_add_outside_interface(outside)
2529
2530         # vrf independent
2531         self.nat_add_interface_address(outside)
2532
2533         # BUG: causing core dump - when bad vrf_id is specified
2534         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2535
2536         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2537         inside_vrf10.add_stream(stream)
2538
2539         self.pg_enable_capture(self.pg_interfaces)
2540         self.pg_start()
2541
2542         capture = outside.get_capture(limit)
2543
2544         stream = self.create_tcp_stream(inside, outside, limit * 2)
2545         inside.add_stream(stream)
2546
2547         self.pg_enable_capture(self.pg_interfaces)
2548         self.pg_start()
2549
2550         capture = outside.get_capture(len(stream))
2551
2552     def test_show_max_translations(self):
2553         """ NAT44ED API test - max translations per thread """
2554         nat_config = self.vapi.nat_show_config_2()
2555         self.assertEqual(self.max_sessions,
2556                          nat_config.max_translations_per_thread)
2557
2558     def test_lru_cleanup(self):
2559         """ NAT44ED LRU cleanup algorithm """
2560
2561         self.nat_add_address(self.nat_addr)
2562         self.nat_add_inside_interface(self.pg0)
2563         self.nat_add_outside_interface(self.pg1)
2564
2565         self.vapi.nat_set_timeouts(
2566             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2567
2568         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2569         pkts = []
2570         for i in range(0, self.max_sessions - 1):
2571             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2572                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2573                  UDP(sport=7000+i, dport=80))
2574             pkts.append(p)
2575
2576         self.pg0.add_stream(pkts)
2577         self.pg_enable_capture(self.pg_interfaces)
2578         self.pg_start()
2579         self.pg1.get_capture(len(pkts))
2580         self.sleep(1.5, "wait for timeouts")
2581
2582         pkts = []
2583         for i in range(0, self.max_sessions - 1):
2584             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2585                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2586                  ICMP(id=8000+i, type='echo-request'))
2587             pkts.append(p)
2588
2589         self.pg0.add_stream(pkts)
2590         self.pg_enable_capture(self.pg_interfaces)
2591         self.pg_start()
2592         self.pg1.get_capture(len(pkts))
2593
2594     def test_session_rst_timeout(self):
2595         """ NAT44ED session RST timeouts """
2596
2597         self.nat_add_address(self.nat_addr)
2598         self.nat_add_inside_interface(self.pg0)
2599         self.nat_add_outside_interface(self.pg1)
2600
2601         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2602                                    tcp_transitory=5, icmp=60)
2603
2604         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2605                               self.tcp_external_port)
2606         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2607              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2608              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2609                  flags="R"))
2610         self.pg0.add_stream(p)
2611         self.pg_enable_capture(self.pg_interfaces)
2612         self.pg_start()
2613         self.pg1.get_capture(1)
2614
2615         self.sleep(6)
2616
2617         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2618              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2619              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2620                  flags="S"))
2621         self.pg0.add_stream(p)
2622         self.pg_enable_capture(self.pg_interfaces)
2623         self.pg_start()
2624         self.pg1.get_capture(1)
2625
2626     def test_dynamic_out_of_ports(self):
2627         """ NAT44ED dynamic translation test: out of ports """
2628
2629         self.nat_add_inside_interface(self.pg0)
2630         self.nat_add_outside_interface(self.pg1)
2631
2632         # in2out and no NAT addresses added
2633         err_old = self.statistics.get_err_counter(
2634             '/err/nat44-ed-in2out-slowpath/out of ports')
2635
2636         pkts = self.create_stream_in(self.pg0, self.pg1)
2637         self.pg0.add_stream(pkts)
2638         self.pg_enable_capture(self.pg_interfaces)
2639         self.pg_start()
2640         self.pg1.get_capture(0, timeout=1)
2641
2642         err_new = self.statistics.get_err_counter(
2643             '/err/nat44-ed-in2out-slowpath/out of ports')
2644
2645         self.assertEqual(err_new - err_old, len(pkts))
2646
2647         # in2out after NAT addresses added
2648         self.nat_add_address(self.nat_addr)
2649
2650         err_old = self.statistics.get_err_counter(
2651             '/err/nat44-ed-in2out-slowpath/out of ports')
2652
2653         pkts = self.create_stream_in(self.pg0, self.pg1)
2654         self.pg0.add_stream(pkts)
2655         self.pg_enable_capture(self.pg_interfaces)
2656         self.pg_start()
2657         capture = self.pg1.get_capture(len(pkts))
2658         self.verify_capture_out(capture, ignore_port=True)
2659
2660         err_new = self.statistics.get_err_counter(
2661             '/err/nat44-ed-in2out-slowpath/out of ports')
2662
2663         self.assertEqual(err_new, err_old)
2664
2665     def test_unknown_proto(self):
2666         """ NAT44ED translate packet with unknown protocol """
2667
2668         self.nat_add_address(self.nat_addr)
2669         self.nat_add_inside_interface(self.pg0)
2670         self.nat_add_outside_interface(self.pg1)
2671
2672         # in2out
2673         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2674              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2675              TCP(sport=self.tcp_port_in, dport=20))
2676         self.pg0.add_stream(p)
2677         self.pg_enable_capture(self.pg_interfaces)
2678         self.pg_start()
2679         p = self.pg1.get_capture(1)
2680
2681         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2682              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2683              GRE() /
2684              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2685              TCP(sport=1234, dport=1234))
2686         self.pg0.add_stream(p)
2687         self.pg_enable_capture(self.pg_interfaces)
2688         self.pg_start()
2689         p = self.pg1.get_capture(1)
2690         packet = p[0]
2691         try:
2692             self.assertEqual(packet[IP].src, self.nat_addr)
2693             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2694             self.assertEqual(packet.haslayer(GRE), 1)
2695             self.assert_packet_checksums_valid(packet)
2696         except:
2697             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2698             raise
2699
2700         # out2in
2701         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2702              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2703              GRE() /
2704              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2705              TCP(sport=1234, dport=1234))
2706         self.pg1.add_stream(p)
2707         self.pg_enable_capture(self.pg_interfaces)
2708         self.pg_start()
2709         p = self.pg0.get_capture(1)
2710         packet = p[0]
2711         try:
2712             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2713             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2714             self.assertEqual(packet.haslayer(GRE), 1)
2715             self.assert_packet_checksums_valid(packet)
2716         except:
2717             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2718             raise
2719
2720     def test_hairpinning_unknown_proto(self):
2721         """ NAT44ED translate packet with unknown protocol - hairpinning """
2722         host = self.pg0.remote_hosts[0]
2723         server = self.pg0.remote_hosts[1]
2724         host_in_port = 1234
2725         server_out_port = 8765
2726         server_nat_ip = "10.0.0.11"
2727
2728         self.nat_add_address(self.nat_addr)
2729         self.nat_add_inside_interface(self.pg0)
2730         self.nat_add_outside_interface(self.pg1)
2731
2732         # add static mapping for server
2733         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2734
2735         # host to server
2736         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2737              IP(src=host.ip4, dst=server_nat_ip) /
2738              TCP(sport=host_in_port, dport=server_out_port))
2739         self.pg0.add_stream(p)
2740         self.pg_enable_capture(self.pg_interfaces)
2741         self.pg_start()
2742         self.pg0.get_capture(1)
2743
2744         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2745              IP(src=host.ip4, dst=server_nat_ip) /
2746              GRE() /
2747              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2748              TCP(sport=1234, dport=1234))
2749         self.pg0.add_stream(p)
2750         self.pg_enable_capture(self.pg_interfaces)
2751         self.pg_start()
2752         p = self.pg0.get_capture(1)
2753         packet = p[0]
2754         try:
2755             self.assertEqual(packet[IP].src, self.nat_addr)
2756             self.assertEqual(packet[IP].dst, server.ip4)
2757             self.assertEqual(packet.haslayer(GRE), 1)
2758             self.assert_packet_checksums_valid(packet)
2759         except:
2760             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2761             raise
2762
2763         # server to host
2764         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2765              IP(src=server.ip4, dst=self.nat_addr) /
2766              GRE() /
2767              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2768              TCP(sport=1234, dport=1234))
2769         self.pg0.add_stream(p)
2770         self.pg_enable_capture(self.pg_interfaces)
2771         self.pg_start()
2772         p = self.pg0.get_capture(1)
2773         packet = p[0]
2774         try:
2775             self.assertEqual(packet[IP].src, server_nat_ip)
2776             self.assertEqual(packet[IP].dst, host.ip4)
2777             self.assertEqual(packet.haslayer(GRE), 1)
2778             self.assert_packet_checksums_valid(packet)
2779         except:
2780             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2781             raise
2782
2783     def test_output_feature_and_service(self):
2784         """ NAT44ED interface output feature and services """
2785         external_addr = '1.2.3.4'
2786         external_port = 80
2787         local_port = 8080
2788
2789         self.vapi.nat44_forwarding_enable_disable(enable=1)
2790         self.nat_add_address(self.nat_addr)
2791         flags = self.config_flags.NAT_IS_ADDR_ONLY
2792         self.vapi.nat44_add_del_identity_mapping(
2793             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2794             flags=flags, is_add=1)
2795         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2796         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2797                                     local_port, external_port,
2798                                     proto=IP_PROTOS.tcp, flags=flags)
2799
2800         self.nat_add_inside_interface(self.pg0)
2801         self.nat_add_outside_interface(self.pg0)
2802         self.vapi.nat44_interface_add_del_output_feature(
2803             sw_if_index=self.pg1.sw_if_index, is_add=1)
2804
2805         # from client to service
2806         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2807              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2808              TCP(sport=12345, dport=external_port))
2809         self.pg1.add_stream(p)
2810         self.pg_enable_capture(self.pg_interfaces)
2811         self.pg_start()
2812         capture = self.pg0.get_capture(1)
2813         p = capture[0]
2814         try:
2815             ip = p[IP]
2816             tcp = p[TCP]
2817             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2818             self.assertEqual(tcp.dport, local_port)
2819             self.assert_packet_checksums_valid(p)
2820         except:
2821             self.logger.error(ppp("Unexpected or invalid packet:", p))
2822             raise
2823
2824         # from service back to client
2825         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2826              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2827              TCP(sport=local_port, dport=12345))
2828         self.pg0.add_stream(p)
2829         self.pg_enable_capture(self.pg_interfaces)
2830         self.pg_start()
2831         capture = self.pg1.get_capture(1)
2832         p = capture[0]
2833         try:
2834             ip = p[IP]
2835             tcp = p[TCP]
2836             self.assertEqual(ip.src, external_addr)
2837             self.assertEqual(tcp.sport, external_port)
2838             self.assert_packet_checksums_valid(p)
2839         except:
2840             self.logger.error(ppp("Unexpected or invalid packet:", p))
2841             raise
2842
2843         # from local network host to external network
2844         pkts = self.create_stream_in(self.pg0, self.pg1)
2845         self.pg0.add_stream(pkts)
2846         self.pg_enable_capture(self.pg_interfaces)
2847         self.pg_start()
2848         capture = self.pg1.get_capture(len(pkts))
2849         self.verify_capture_out(capture, ignore_port=True)
2850         pkts = self.create_stream_in(self.pg0, self.pg1)
2851         self.pg0.add_stream(pkts)
2852         self.pg_enable_capture(self.pg_interfaces)
2853         self.pg_start()
2854         capture = self.pg1.get_capture(len(pkts))
2855         self.verify_capture_out(capture, ignore_port=True)
2856
2857         # from external network back to local network host
2858         pkts = self.create_stream_out(self.pg1)
2859         self.pg1.add_stream(pkts)
2860         self.pg_enable_capture(self.pg_interfaces)
2861         self.pg_start()
2862         capture = self.pg0.get_capture(len(pkts))
2863         self.verify_capture_in(capture, self.pg0)
2864
2865     def test_output_feature_and_service3(self):
2866         """ NAT44ED interface output feature and DST NAT """
2867         external_addr = '1.2.3.4'
2868         external_port = 80
2869         local_port = 8080
2870
2871         self.vapi.nat44_forwarding_enable_disable(enable=1)
2872         self.nat_add_address(self.nat_addr)
2873         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2874         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2875                                     local_port, external_port,
2876                                     proto=IP_PROTOS.tcp, flags=flags)
2877
2878         self.nat_add_inside_interface(self.pg0)
2879         self.nat_add_outside_interface(self.pg0)
2880         self.vapi.nat44_interface_add_del_output_feature(
2881             sw_if_index=self.pg1.sw_if_index, is_add=1)
2882
2883         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2884              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2885              TCP(sport=12345, dport=external_port))
2886         self.pg0.add_stream(p)
2887         self.pg_enable_capture(self.pg_interfaces)
2888         self.pg_start()
2889         capture = self.pg1.get_capture(1)
2890         p = capture[0]
2891         try:
2892             ip = p[IP]
2893             tcp = p[TCP]
2894             self.assertEqual(ip.src, self.pg0.remote_ip4)
2895             self.assertEqual(tcp.sport, 12345)
2896             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2897             self.assertEqual(tcp.dport, local_port)
2898             self.assert_packet_checksums_valid(p)
2899         except:
2900             self.logger.error(ppp("Unexpected or invalid packet:", p))
2901             raise
2902
2903         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2904              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2905              TCP(sport=local_port, dport=12345))
2906         self.pg1.add_stream(p)
2907         self.pg_enable_capture(self.pg_interfaces)
2908         self.pg_start()
2909         capture = self.pg0.get_capture(1)
2910         p = capture[0]
2911         try:
2912             ip = p[IP]
2913             tcp = p[TCP]
2914             self.assertEqual(ip.src, external_addr)
2915             self.assertEqual(tcp.sport, external_port)
2916             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2917             self.assertEqual(tcp.dport, 12345)
2918             self.assert_packet_checksums_valid(p)
2919         except:
2920             self.logger.error(ppp("Unexpected or invalid packet:", p))
2921             raise
2922
2923     def test_self_twice_nat_lb_negative(self):
2924         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2925         """
2926         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2927                               client_id=2)
2928
2929     def test_self_twice_nat_negative(self):
2930         """ NAT44ED Self Twice NAT (negative test) """
2931         self.twice_nat_common(self_twice_nat=True)
2932
2933     def test_static_lb_multi_clients(self):
2934         """ NAT44ED local service load balancing - multiple clients"""
2935
2936         external_addr = self.nat_addr
2937         external_port = 80
2938         local_port = 8080
2939         server1 = self.pg0.remote_hosts[0]
2940         server2 = self.pg0.remote_hosts[1]
2941         server3 = self.pg0.remote_hosts[2]
2942
2943         locals = [{'addr': server1.ip4,
2944                    'port': local_port,
2945                    'probability': 90,
2946                    'vrf_id': 0},
2947                   {'addr': server2.ip4,
2948                    'port': local_port,
2949                    'probability': 10,
2950                    'vrf_id': 0}]
2951
2952         flags = self.config_flags.NAT_IS_INSIDE
2953         self.vapi.nat44_interface_add_del_feature(
2954             sw_if_index=self.pg0.sw_if_index,
2955             flags=flags, is_add=1)
2956         self.vapi.nat44_interface_add_del_feature(
2957             sw_if_index=self.pg1.sw_if_index,
2958             is_add=1)
2959
2960         self.nat_add_address(self.nat_addr)
2961         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2962                                                   external_addr=external_addr,
2963                                                   external_port=external_port,
2964                                                   protocol=IP_PROTOS.tcp,
2965                                                   local_num=len(locals),
2966                                                   locals=locals)
2967
2968         server1_n = 0
2969         server2_n = 0
2970         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2971         pkts = []
2972         for client in clients:
2973             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2974                  IP(src=client, dst=self.nat_addr) /
2975                  TCP(sport=12345, dport=external_port))
2976             pkts.append(p)
2977         self.pg1.add_stream(pkts)
2978         self.pg_enable_capture(self.pg_interfaces)
2979         self.pg_start()
2980         capture = self.pg0.get_capture(len(pkts))
2981         for p in capture:
2982             if p[IP].dst == server1.ip4:
2983                 server1_n += 1
2984             else:
2985                 server2_n += 1
2986         self.assertGreaterEqual(server1_n, server2_n)
2987
2988         local = {
2989             'addr': server3.ip4,
2990             'port': local_port,
2991             'probability': 20,
2992             'vrf_id': 0
2993         }
2994
2995         # add new back-end
2996         self.vapi.nat44_lb_static_mapping_add_del_local(
2997             is_add=1,
2998             external_addr=external_addr,
2999             external_port=external_port,
3000             local=local,
3001             protocol=IP_PROTOS.tcp)
3002         server1_n = 0
3003         server2_n = 0
3004         server3_n = 0
3005         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
3006         pkts = []
3007         for client in clients:
3008             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3009                  IP(src=client, dst=self.nat_addr) /
3010                  TCP(sport=12346, dport=external_port))
3011             pkts.append(p)
3012         self.assertGreater(len(pkts), 0)
3013         self.pg1.add_stream(pkts)
3014         self.pg_enable_capture(self.pg_interfaces)
3015         self.pg_start()
3016         capture = self.pg0.get_capture(len(pkts))
3017         for p in capture:
3018             if p[IP].dst == server1.ip4:
3019                 server1_n += 1
3020             elif p[IP].dst == server2.ip4:
3021                 server2_n += 1
3022             else:
3023                 server3_n += 1
3024         self.assertGreater(server1_n, 0)
3025         self.assertGreater(server2_n, 0)
3026         self.assertGreater(server3_n, 0)
3027
3028         local = {
3029             'addr': server2.ip4,
3030             'port': local_port,
3031             'probability': 10,
3032             'vrf_id': 0
3033         }
3034
3035         # remove one back-end
3036         self.vapi.nat44_lb_static_mapping_add_del_local(
3037             is_add=0,
3038             external_addr=external_addr,
3039             external_port=external_port,
3040             local=local,
3041             protocol=IP_PROTOS.tcp)
3042         server1_n = 0
3043         server2_n = 0
3044         server3_n = 0
3045         self.pg1.add_stream(pkts)
3046         self.pg_enable_capture(self.pg_interfaces)
3047         self.pg_start()
3048         capture = self.pg0.get_capture(len(pkts))
3049         for p in capture:
3050             if p[IP].dst == server1.ip4:
3051                 server1_n += 1
3052             elif p[IP].dst == server2.ip4:
3053                 server2_n += 1
3054             else:
3055                 server3_n += 1
3056         self.assertGreater(server1_n, 0)
3057         self.assertEqual(server2_n, 0)
3058         self.assertGreater(server3_n, 0)
3059
3060     def test_syslog_sess(self):
3061         """ NAT44ED Test syslog session creation and deletion """
3062         self.vapi.syslog_set_filter(
3063             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3064         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3065
3066         self.nat_add_address(self.nat_addr)
3067         self.nat_add_inside_interface(self.pg0)
3068         self.nat_add_outside_interface(self.pg1)
3069
3070         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3071              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3072              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3073         self.pg0.add_stream(p)
3074         self.pg_enable_capture(self.pg_interfaces)
3075         self.pg_start()
3076         capture = self.pg1.get_capture(1)
3077         self.tcp_port_out = capture[0][TCP].sport
3078         capture = self.pg3.get_capture(1)
3079         self.verify_syslog_sess(capture[0][Raw].load)
3080
3081         self.pg_enable_capture(self.pg_interfaces)
3082         self.pg_start()
3083         self.nat_add_address(self.nat_addr, is_add=0)
3084         capture = self.pg3.get_capture(1)
3085         self.verify_syslog_sess(capture[0][Raw].load, False)
3086
3087     def test_twice_nat_interface_addr(self):
3088         """ NAT44ED Acquire twice NAT addresses from interface """
3089         flags = self.config_flags.NAT_IS_TWICE_NAT
3090         self.vapi.nat44_add_del_interface_addr(
3091             sw_if_index=self.pg11.sw_if_index,
3092             flags=flags, is_add=1)
3093
3094         # no address in NAT pool
3095         adresses = self.vapi.nat44_address_dump()
3096         self.assertEqual(0, len(adresses))
3097
3098         # configure interface address and check NAT address pool
3099         self.pg11.config_ip4()
3100         adresses = self.vapi.nat44_address_dump()
3101         self.assertEqual(1, len(adresses))
3102         self.assertEqual(str(adresses[0].ip_address),
3103                          self.pg11.local_ip4)
3104         self.assertEqual(adresses[0].flags, flags)
3105
3106         # remove interface address and check NAT address pool
3107         self.pg11.unconfig_ip4()
3108         adresses = self.vapi.nat44_address_dump()
3109         self.assertEqual(0, len(adresses))
3110
3111     def test_output_feature_stateful_acl(self):
3112         """ NAT44ED output feature works with stateful ACL """
3113
3114         self.nat_add_address(self.nat_addr)
3115         self.vapi.nat44_interface_add_del_output_feature(
3116             sw_if_index=self.pg1.sw_if_index, is_add=1)
3117
3118         # First ensure that the NAT is working sans ACL
3119
3120         # send packets out2in, no sessions yet so packets should drop
3121         pkts_out2in = self.create_stream_out(self.pg1)
3122         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3123
3124         # send packets into inside intf, ensure received via outside intf
3125         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3126         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3127                                        len(pkts_in2out))
3128         self.verify_capture_out(capture, ignore_port=True)
3129
3130         # send out2in again, with sessions created it should work now
3131         pkts_out2in = self.create_stream_out(self.pg1)
3132         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3133                                        len(pkts_out2in))
3134         self.verify_capture_in(capture, self.pg0)
3135
3136         # Create an ACL blocking everything
3137         out2in_deny_rule = AclRule(is_permit=0)
3138         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3139         out2in_acl.add_vpp_config()
3140
3141         # create an ACL to permit/reflect everything
3142         in2out_reflect_rule = AclRule(is_permit=2)
3143         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3144         in2out_acl.add_vpp_config()
3145
3146         # apply as input acl on interface and confirm it blocks everything
3147         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3148                                  n_input=1, acls=[out2in_acl])
3149         acl_if.add_vpp_config()
3150         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3151
3152         # apply output acl
3153         acl_if.acls = [out2in_acl, in2out_acl]
3154         acl_if.add_vpp_config()
3155         # send in2out to generate ACL state (NAT state was created earlier)
3156         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3157                                        len(pkts_in2out))
3158         self.verify_capture_out(capture, ignore_port=True)
3159
3160         # send out2in again. ACL state exists so it should work now.
3161         # TCP packets with the syn flag set also need the ack flag
3162         for p in pkts_out2in:
3163             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3164                 p[TCP].flags |= 0x10
3165         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3166                                        len(pkts_out2in))
3167         self.verify_capture_in(capture, self.pg0)
3168         self.logger.info(self.vapi.cli("show trace"))
3169
3170     def test_tcp_close(self):
3171         """ NAT44ED Close TCP session from inside network - output feature """
3172         old_timeouts = self.vapi.nat_get_timeouts()
3173         new_transitory = 2
3174         self.vapi.nat_set_timeouts(
3175             udp=old_timeouts.udp,
3176             tcp_established=old_timeouts.tcp_established,
3177             icmp=old_timeouts.icmp,
3178             tcp_transitory=new_transitory)
3179
3180         self.vapi.nat44_forwarding_enable_disable(enable=1)
3181         self.nat_add_address(self.pg1.local_ip4)
3182         twice_nat_addr = '10.0.1.3'
3183         service_ip = '192.168.16.150'
3184         self.nat_add_address(twice_nat_addr, twice_nat=1)
3185
3186         flags = self.config_flags.NAT_IS_INSIDE
3187         self.vapi.nat44_interface_add_del_feature(
3188             sw_if_index=self.pg0.sw_if_index,
3189             is_add=1)
3190         self.vapi.nat44_interface_add_del_feature(
3191             sw_if_index=self.pg0.sw_if_index,
3192             flags=flags, is_add=1)
3193         self.vapi.nat44_interface_add_del_output_feature(
3194             is_add=1,
3195             sw_if_index=self.pg1.sw_if_index)
3196
3197         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3198                  self.config_flags.NAT_IS_TWICE_NAT)
3199         self.nat_add_static_mapping(self.pg0.remote_ip4,
3200                                     service_ip, 80, 80,
3201                                     proto=IP_PROTOS.tcp,
3202                                     flags=flags)
3203         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3204         start_sessnum = len(sessions)
3205
3206         # SYN packet out->in
3207         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3208              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3209              TCP(sport=33898, dport=80, flags="S"))
3210         self.pg1.add_stream(p)
3211         self.pg_enable_capture(self.pg_interfaces)
3212         self.pg_start()
3213         capture = self.pg0.get_capture(1)
3214         p = capture[0]
3215         tcp_port = p[TCP].sport
3216
3217         # SYN + ACK packet in->out
3218         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3219              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3220              TCP(sport=80, dport=tcp_port, flags="SA"))
3221         self.pg0.add_stream(p)
3222         self.pg_enable_capture(self.pg_interfaces)
3223         self.pg_start()
3224         self.pg1.get_capture(1)
3225
3226         # ACK packet out->in
3227         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3228              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3229              TCP(sport=33898, dport=80, flags="A"))
3230         self.pg1.add_stream(p)
3231         self.pg_enable_capture(self.pg_interfaces)
3232         self.pg_start()
3233         self.pg0.get_capture(1)
3234
3235         # FIN packet in -> out
3236         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3237              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3238              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3239         self.pg0.add_stream(p)
3240         self.pg_enable_capture(self.pg_interfaces)
3241         self.pg_start()
3242         self.pg1.get_capture(1)
3243
3244         # FIN+ACK packet out -> in
3245         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3246              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3247              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3248         self.pg1.add_stream(p)
3249         self.pg_enable_capture(self.pg_interfaces)
3250         self.pg_start()
3251         self.pg0.get_capture(1)
3252
3253         # ACK packet in -> out
3254         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3255              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3256              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3257         self.pg0.add_stream(p)
3258         self.pg_enable_capture(self.pg_interfaces)
3259         self.pg_start()
3260         self.pg1.get_capture(1)
3261
3262         # session now in transitory timeout
3263         # try SYN packet out->in - should be dropped
3264         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3265              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3266              TCP(sport=33898, dport=80, flags="S"))
3267         self.pg1.add_stream(p)
3268         self.pg_enable_capture(self.pg_interfaces)
3269         self.pg_start()
3270
3271         self.sleep(new_transitory, "wait for transitory timeout")
3272         self.pg0.assert_nothing_captured(0)
3273
3274         # session should still exist
3275         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3276         self.assertEqual(len(sessions) - start_sessnum, 1)
3277
3278         # send FIN+ACK packet out -> in - will cause session to be wiped
3279         # but won't create a new session
3280         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3281              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3282              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3283         self.pg1.add_stream(p)
3284         self.pg_enable_capture(self.pg_interfaces)
3285         self.pg_start()
3286
3287         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3288         self.assertEqual(len(sessions) - start_sessnum, 0)
3289         self.pg0.assert_nothing_captured(0)
3290
3291     def test_tcp_session_close_in(self):
3292         """ NAT44ED Close TCP session from inside network """
3293
3294         in_port = self.tcp_port_in
3295         out_port = 10505
3296         ext_port = self.tcp_external_port
3297
3298         self.nat_add_address(self.nat_addr)
3299         self.nat_add_inside_interface(self.pg0)
3300         self.nat_add_outside_interface(self.pg1)
3301         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3302                                     in_port, out_port, proto=IP_PROTOS.tcp,
3303                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3304
3305         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3306         session_n = len(sessions)
3307
3308         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3309                                    tcp_transitory=2, icmp=5)
3310
3311         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3312
3313         # FIN packet in -> out
3314         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3315              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3316              TCP(sport=in_port, dport=ext_port,
3317                  flags="FA", seq=100, ack=300))
3318         self.pg0.add_stream(p)
3319         self.pg_enable_capture(self.pg_interfaces)
3320         self.pg_start()
3321         self.pg1.get_capture(1)
3322
3323         pkts = []
3324
3325         # ACK packet out -> in
3326         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3327              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3328              TCP(sport=ext_port, dport=out_port,
3329                  flags="A", seq=300, ack=101))
3330         pkts.append(p)
3331
3332         # FIN packet out -> in
3333         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3334              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3335              TCP(sport=ext_port, dport=out_port,
3336                  flags="FA", seq=300, ack=101))
3337         pkts.append(p)
3338
3339         self.pg1.add_stream(pkts)
3340         self.pg_enable_capture(self.pg_interfaces)
3341         self.pg_start()
3342         self.pg0.get_capture(2)
3343
3344         # ACK packet in -> out
3345         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3346              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3347              TCP(sport=in_port, dport=ext_port,
3348                  flags="A", seq=101, ack=301))
3349         self.pg0.add_stream(p)
3350         self.pg_enable_capture(self.pg_interfaces)
3351         self.pg_start()
3352         self.pg1.get_capture(1)
3353
3354         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3355         self.assertEqual(len(sessions) - session_n, 1)
3356
3357         out2in_drops = self.get_err_counter(
3358             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3359         in2out_drops = self.get_err_counter(
3360             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3361
3362         # extra FIN packet out -> in - this should be dropped
3363         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3364              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3365              TCP(sport=ext_port, dport=out_port,
3366                  flags="FA", seq=300, ack=101))
3367
3368         self.pg1.add_stream(p)
3369         self.pg_enable_capture(self.pg_interfaces)
3370         self.pg_start()
3371         self.pg0.assert_nothing_captured()
3372
3373         # extra ACK packet in -> out - this should be dropped
3374         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3375              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3376              TCP(sport=in_port, dport=ext_port,
3377                  flags="A", seq=101, ack=301))
3378         self.pg0.add_stream(p)
3379         self.pg_enable_capture(self.pg_interfaces)
3380         self.pg_start()
3381         self.pg1.assert_nothing_captured()
3382
3383         stats = self.get_err_counter(
3384             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3385         self.assertEqual(stats - out2in_drops, 1)
3386         stats = self.get_err_counter(
3387             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3388         self.assertEqual(stats - in2out_drops, 1)
3389
3390         self.sleep(3)
3391         # extra ACK packet in -> out - this will cause session to be wiped
3392         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3393              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3394              TCP(sport=in_port, dport=ext_port,
3395                  flags="A", seq=101, ack=301))
3396         self.pg0.add_stream(p)
3397         self.pg_enable_capture(self.pg_interfaces)
3398         self.pg_start()
3399         self.pg1.assert_nothing_captured()
3400         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3401         self.assertEqual(len(sessions) - session_n, 0)
3402
3403     def test_tcp_session_close_out(self):
3404         """ NAT44ED Close TCP session from outside network """
3405
3406         in_port = self.tcp_port_in
3407         out_port = 10505
3408         ext_port = self.tcp_external_port
3409
3410         self.nat_add_address(self.nat_addr)
3411         self.nat_add_inside_interface(self.pg0)
3412         self.nat_add_outside_interface(self.pg1)
3413         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3414                                     in_port, out_port, proto=IP_PROTOS.tcp,
3415                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3416
3417         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3418         session_n = len(sessions)
3419
3420         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3421                                    tcp_transitory=2, icmp=5)
3422
3423         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3424
3425         # FIN packet out -> in
3426         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3427              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3428              TCP(sport=ext_port, dport=out_port,
3429                  flags="FA", seq=100, ack=300))
3430         self.pg1.add_stream(p)
3431         self.pg_enable_capture(self.pg_interfaces)
3432         self.pg_start()
3433         self.pg0.get_capture(1)
3434
3435         # FIN+ACK packet in -> out
3436         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3437              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3438              TCP(sport=in_port, dport=ext_port,
3439                  flags="FA", seq=300, ack=101))
3440
3441         self.pg0.add_stream(p)
3442         self.pg_enable_capture(self.pg_interfaces)
3443         self.pg_start()
3444         self.pg1.get_capture(1)
3445
3446         # ACK packet out -> in
3447         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3448              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3449              TCP(sport=ext_port, dport=out_port,
3450                  flags="A", seq=101, ack=301))
3451         self.pg1.add_stream(p)
3452         self.pg_enable_capture(self.pg_interfaces)
3453         self.pg_start()
3454         self.pg0.get_capture(1)
3455
3456         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3457         self.assertEqual(len(sessions) - session_n, 1)
3458
3459         out2in_drops = self.get_err_counter(
3460             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3461         in2out_drops = self.get_err_counter(
3462             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3463
3464         # extra FIN packet out -> in - this should be dropped
3465         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3466              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3467              TCP(sport=ext_port, dport=out_port,
3468                  flags="FA", seq=300, ack=101))
3469
3470         self.pg1.add_stream(p)
3471         self.pg_enable_capture(self.pg_interfaces)
3472         self.pg_start()
3473         self.pg0.assert_nothing_captured()
3474
3475         # extra ACK packet in -> out - this should be dropped
3476         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3477              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3478              TCP(sport=in_port, dport=ext_port,
3479                  flags="A", seq=101, ack=301))
3480         self.pg0.add_stream(p)
3481         self.pg_enable_capture(self.pg_interfaces)
3482         self.pg_start()
3483         self.pg1.assert_nothing_captured()
3484
3485         stats = self.get_err_counter(
3486             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3487         self.assertEqual(stats - out2in_drops, 1)
3488         stats = self.get_err_counter(
3489             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3490         self.assertEqual(stats - in2out_drops, 1)
3491
3492         self.sleep(3)
3493         # extra ACK packet in -> out - this will cause session to be wiped
3494         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3495              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3496              TCP(sport=in_port, dport=ext_port,
3497                  flags="A", seq=101, ack=301))
3498         self.pg0.add_stream(p)
3499         self.pg_enable_capture(self.pg_interfaces)
3500         self.pg_start()
3501         self.pg1.assert_nothing_captured()
3502         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3503         self.assertEqual(len(sessions) - session_n, 0)
3504
3505     def test_tcp_session_close_simultaneous(self):
3506         """ NAT44ED Close TCP session from inside network """
3507
3508         in_port = self.tcp_port_in
3509         ext_port = 10505
3510
3511         self.nat_add_address(self.nat_addr)
3512         self.nat_add_inside_interface(self.pg0)
3513         self.nat_add_outside_interface(self.pg1)
3514         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3515                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3516                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3517
3518         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3519         session_n = len(sessions)
3520
3521         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3522                                    tcp_transitory=2, icmp=5)
3523
3524         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3525
3526         # FIN packet in -> out
3527         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3528              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3529              TCP(sport=in_port, dport=ext_port,
3530                  flags="FA", seq=100, ack=300))
3531         self.pg0.add_stream(p)
3532         self.pg_enable_capture(self.pg_interfaces)
3533         self.pg_start()
3534         self.pg1.get_capture(1)
3535
3536         # FIN packet out -> in
3537         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3538              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3539              TCP(sport=ext_port, dport=out_port,
3540                  flags="FA", seq=300, ack=100))
3541         self.pg1.add_stream(p)
3542         self.pg_enable_capture(self.pg_interfaces)
3543         self.pg_start()
3544         self.pg0.get_capture(1)
3545
3546         # ACK packet in -> out
3547         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3548              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3549              TCP(sport=in_port, dport=ext_port,
3550                  flags="A", seq=101, ack=301))
3551         self.pg0.add_stream(p)
3552         self.pg_enable_capture(self.pg_interfaces)
3553         self.pg_start()
3554         self.pg1.get_capture(1)
3555
3556         # ACK packet out -> in
3557         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3558              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3559              TCP(sport=ext_port, dport=out_port,
3560                  flags="A", seq=301, ack=101))
3561         self.pg1.add_stream(p)
3562         self.pg_enable_capture(self.pg_interfaces)
3563         self.pg_start()
3564         self.pg0.get_capture(1)
3565
3566         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3567         self.assertEqual(len(sessions) - session_n, 1)
3568
3569         out2in_drops = self.get_err_counter(
3570             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3571         in2out_drops = self.get_err_counter(
3572             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3573
3574         # extra FIN packet out -> in - this should be dropped
3575         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3576              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3577              TCP(sport=ext_port, dport=out_port,
3578                  flags="FA", seq=300, ack=101))
3579
3580         self.pg1.add_stream(p)
3581         self.pg_enable_capture(self.pg_interfaces)
3582         self.pg_start()
3583         self.pg0.assert_nothing_captured()
3584
3585         # extra ACK packet in -> out - this should be dropped
3586         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3587              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3588              TCP(sport=in_port, dport=ext_port,
3589                  flags="A", seq=101, ack=301))
3590         self.pg0.add_stream(p)
3591         self.pg_enable_capture(self.pg_interfaces)
3592         self.pg_start()
3593         self.pg1.assert_nothing_captured()
3594
3595         stats = self.get_err_counter(
3596             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3597         self.assertEqual(stats - out2in_drops, 1)
3598         stats = self.get_err_counter(
3599             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3600         self.assertEqual(stats - in2out_drops, 1)
3601
3602         self.sleep(3)
3603         # extra ACK packet in -> out - this will cause session to be wiped
3604         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3605              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3606              TCP(sport=in_port, dport=ext_port,
3607                  flags="A", seq=101, ack=301))
3608         self.pg0.add_stream(p)
3609         self.pg_enable_capture(self.pg_interfaces)
3610         self.pg_start()
3611         self.pg1.assert_nothing_captured()
3612         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3613         self.assertEqual(len(sessions) - session_n, 0)
3614
3615     def test_dynamic_vrf(self):
3616         """ NAT44ED dynamic translation test: different VRF"""
3617
3618         vrf_id_in = 33
3619         vrf_id_out = 34
3620
3621         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3622
3623         try:
3624             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3625             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3626
3627             self.nat_add_inside_interface(self.pg7)
3628             self.nat_add_outside_interface(self.pg8)
3629
3630             # just basic stuff nothing special
3631             pkts = self.create_stream_in(self.pg7, self.pg8)
3632             self.pg7.add_stream(pkts)
3633             self.pg_enable_capture(self.pg_interfaces)
3634             self.pg_start()
3635             capture = self.pg8.get_capture(len(pkts))
3636             self.verify_capture_out(capture, ignore_port=True)
3637
3638             pkts = self.create_stream_out(self.pg8)
3639             self.pg8.add_stream(pkts)
3640             self.pg_enable_capture(self.pg_interfaces)
3641             self.pg_start()
3642             capture = self.pg7.get_capture(len(pkts))
3643             self.verify_capture_in(capture, self.pg7)
3644
3645         finally:
3646             self.pg7.unconfig()
3647             self.pg8.unconfig()
3648
3649             self.vapi.ip_table_add_del(is_add=0,
3650                                        table={'table_id': vrf_id_in})
3651             self.vapi.ip_table_add_del(is_add=0,
3652                                        table={'table_id': vrf_id_out})
3653
3654     def test_dynamic_output_feature_vrf(self):
3655         """ NAT44ED dynamic translation test: output-feature, VRF"""
3656
3657         # other then default (0)
3658         new_vrf_id = 22
3659
3660         self.nat_add_address(self.nat_addr)
3661         self.vapi.nat44_interface_add_del_output_feature(
3662             sw_if_index=self.pg8.sw_if_index, is_add=1)
3663
3664         try:
3665             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3666             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3667
3668             # in2out
3669             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3670             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3671             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3672             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3673
3674             pkts = self.create_stream_in(self.pg7, self.pg8)
3675             self.pg7.add_stream(pkts)
3676             self.pg_enable_capture(self.pg_interfaces)
3677             self.pg_start()
3678             capture = self.pg8.get_capture(len(pkts))
3679             self.verify_capture_out(capture, ignore_port=True)
3680
3681             if_idx = self.pg8.sw_if_index
3682             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3683             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3684             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3685             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3686             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3687             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3688             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3689             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3690
3691             # out2in
3692             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3693             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3694             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3695             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3696
3697             pkts = self.create_stream_out(self.pg8)
3698             self.pg8.add_stream(pkts)
3699             self.pg_enable_capture(self.pg_interfaces)
3700             self.pg_start()
3701             capture = self.pg7.get_capture(len(pkts))
3702             self.verify_capture_in(capture, self.pg7)
3703
3704             if_idx = self.pg8.sw_if_index
3705             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3706             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3707             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3708             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3709             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3710             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3711             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3712             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3713
3714             sessions = self.statistics['/nat44-ed/total-sessions']
3715             self.assertEqual(sessions[:, 0].sum(), 3)
3716
3717         finally:
3718             self.pg7.unconfig()
3719             self.pg8.unconfig()
3720
3721             self.vapi.ip_table_add_del(is_add=0,
3722                                        table={'table_id': new_vrf_id})
3723
3724     def test_next_src_nat(self):
3725         """ NAT44ED On way back forward packet to nat44-in2out node. """
3726
3727         twice_nat_addr = '10.0.1.3'
3728         external_port = 80
3729         local_port = 8080
3730         post_twice_nat_port = 0
3731
3732         self.vapi.nat44_forwarding_enable_disable(enable=1)
3733         self.nat_add_address(twice_nat_addr, twice_nat=1)
3734         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3735                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3736         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3737                                     local_port, external_port,
3738                                     proto=IP_PROTOS.tcp, vrf_id=1,
3739                                     flags=flags)
3740         self.vapi.nat44_interface_add_del_feature(
3741             sw_if_index=self.pg6.sw_if_index,
3742             is_add=1)
3743
3744         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3745              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3746              TCP(sport=12345, dport=external_port))
3747         self.pg6.add_stream(p)
3748         self.pg_enable_capture(self.pg_interfaces)
3749         self.pg_start()
3750         capture = self.pg6.get_capture(1)
3751         p = capture[0]
3752         try:
3753             ip = p[IP]
3754             tcp = p[TCP]
3755             self.assertEqual(ip.src, twice_nat_addr)
3756             self.assertNotEqual(tcp.sport, 12345)
3757             post_twice_nat_port = tcp.sport
3758             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3759             self.assertEqual(tcp.dport, local_port)
3760             self.assert_packet_checksums_valid(p)
3761         except:
3762             self.logger.error(ppp("Unexpected or invalid packet:", p))
3763             raise
3764
3765         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3766              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3767              TCP(sport=local_port, dport=post_twice_nat_port))
3768         self.pg6.add_stream(p)
3769         self.pg_enable_capture(self.pg_interfaces)
3770         self.pg_start()
3771         capture = self.pg6.get_capture(1)
3772         p = capture[0]
3773         try:
3774             ip = p[IP]
3775             tcp = p[TCP]
3776             self.assertEqual(ip.src, self.pg1.remote_ip4)
3777             self.assertEqual(tcp.sport, external_port)
3778             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3779             self.assertEqual(tcp.dport, 12345)
3780             self.assert_packet_checksums_valid(p)
3781         except:
3782             self.logger.error(ppp("Unexpected or invalid packet:", p))
3783             raise
3784
3785     def test_one_armed_nat44_static(self):
3786         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3787
3788         remote_host = self.pg4.remote_hosts[0]
3789         local_host = self.pg4.remote_hosts[1]
3790         external_port = 80
3791         local_port = 8080
3792         eh_port_in = 0
3793
3794         self.vapi.nat44_forwarding_enable_disable(enable=1)
3795         self.nat_add_address(self.nat_addr, twice_nat=1)
3796         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3797                  self.config_flags.NAT_IS_TWICE_NAT)
3798         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3799                                     local_port, external_port,
3800                                     proto=IP_PROTOS.tcp, flags=flags)
3801         flags = self.config_flags.NAT_IS_INSIDE
3802         self.vapi.nat44_interface_add_del_feature(
3803             sw_if_index=self.pg4.sw_if_index,
3804             is_add=1)
3805         self.vapi.nat44_interface_add_del_feature(
3806             sw_if_index=self.pg4.sw_if_index,
3807             flags=flags, is_add=1)
3808
3809         # from client to service
3810         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3811              IP(src=remote_host.ip4, dst=self.nat_addr) /
3812              TCP(sport=12345, dport=external_port))
3813         self.pg4.add_stream(p)
3814         self.pg_enable_capture(self.pg_interfaces)
3815         self.pg_start()
3816         capture = self.pg4.get_capture(1)
3817         p = capture[0]
3818         try:
3819             ip = p[IP]
3820             tcp = p[TCP]
3821             self.assertEqual(ip.dst, local_host.ip4)
3822             self.assertEqual(ip.src, self.nat_addr)
3823             self.assertEqual(tcp.dport, local_port)
3824             self.assertNotEqual(tcp.sport, 12345)
3825             eh_port_in = tcp.sport
3826             self.assert_packet_checksums_valid(p)
3827         except:
3828             self.logger.error(ppp("Unexpected or invalid packet:", p))
3829             raise
3830
3831         # from service back to client
3832         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3833              IP(src=local_host.ip4, dst=self.nat_addr) /
3834              TCP(sport=local_port, dport=eh_port_in))
3835         self.pg4.add_stream(p)
3836         self.pg_enable_capture(self.pg_interfaces)
3837         self.pg_start()
3838         capture = self.pg4.get_capture(1)
3839         p = capture[0]
3840         try:
3841             ip = p[IP]
3842             tcp = p[TCP]
3843             self.assertEqual(ip.src, self.nat_addr)
3844             self.assertEqual(ip.dst, remote_host.ip4)
3845             self.assertEqual(tcp.sport, external_port)
3846             self.assertEqual(tcp.dport, 12345)
3847             self.assert_packet_checksums_valid(p)
3848         except:
3849             self.logger.error(ppp("Unexpected or invalid packet:", p))
3850             raise
3851
3852     def test_icmp_error_fwd_outbound(self):
3853         """ NAT44ED ICMP error outbound with forwarding enabled """
3854
3855         # Ensure that an outbound ICMP error message is properly associated
3856         # with the inbound forward bypass session it is related to.
3857         payload = "H" * 10
3858
3859         self.nat_add_address(self.nat_addr)
3860         self.nat_add_inside_interface(self.pg0)
3861         self.nat_add_outside_interface(self.pg1)
3862
3863         # enable forwarding and initiate connection out2in
3864         self.vapi.nat44_forwarding_enable_disable(enable=1)
3865         p1 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3866               IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
3867               UDP(sport=21, dport=20) / payload)
3868
3869         self.pg1.add_stream(p1)
3870         self.pg_enable_capture(self.pg_interfaces)
3871         self.pg_start()
3872         capture = self.pg0.get_capture(1)[0]
3873
3874         self.logger.info(self.vapi.cli("show nat44 sessions"))
3875
3876         # reply with ICMP error message in2out
3877         # We cannot reliably retrieve forward bypass sessions via the API.
3878         # session dumps for a user will only look on the worker that the
3879         # user is supposed to be mapped to in2out. The forward bypass session
3880         # is not necessarily created on that worker.
3881         p2 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3882               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3883               ICMP(type='dest-unreach', code='port-unreachable') /
3884               capture[IP:])
3885
3886         self.pg0.add_stream(p2)
3887         self.pg_enable_capture(self.pg_interfaces)
3888         self.pg_start()
3889         capture = self.pg1.get_capture(1)[0]
3890
3891         self.logger.info(self.vapi.cli("show nat44 sessions"))
3892
3893         self.logger.info(ppp("p1 packet:", p1))
3894         self.logger.info(ppp("p2 packet:", p2))
3895         self.logger.info(ppp("capture packet:", capture))
3896
3897
3898 if __name__ == '__main__':
3899     unittest.main(testRunner=VppTestRunner)