test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class NAT44EDTestCase(VppTestCase):
  23
  24     nat_addr = '10.0.0.3'
  25
  26     tcp_port_in = 6303
  27     tcp_port_out = 6303
  28
  29     udp_port_in = 6304
  30     udp_port_out = 6304
  31
  32     icmp_id_in = 6305
  33     icmp_id_out = 6305
  34
  35     tcp_external_port = 80
  36
  37     max_sessions = 100
  38
  39     def setUp(self):
  40         super(NAT44EDTestCase, self).setUp()
  41         self.plugin_enable()
  42
  43     def tearDown(self):
  44         super(NAT44EDTestCase, self).tearDown()
  45         if not self.vpp_dead:
  46             self.plugin_disable()
  47
  48     def plugin_enable(self):
  49         self.vapi.nat44_ed_plugin_enable_disable(
  50             sessions=self.max_sessions, enable=1)
  51
  52     def plugin_disable(self):
  53         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  54
  55     @property
  56     def config_flags(self):
  57         return VppEnum.vl_api_nat_config_flags_t
  58
  59     @property
  60     def nat44_config_flags(self):
  61         return VppEnum.vl_api_nat44_config_flags_t
  62
  63     @property
  64     def syslog_severity(self):
  65         return VppEnum.vl_api_syslog_severity_t
  66
  67     @property
  68     def server_addr(self):
  69         return self.pg1.remote_hosts[0].ip4
  70
  71     @staticmethod
  72     def random_port():
  73         return randint(1025, 65535)
  74
  75     @staticmethod
  76     def proto2layer(proto):
  77         if proto == IP_PROTOS.tcp:
  78             return TCP
  79         elif proto == IP_PROTOS.udp:
  80             return UDP
  81         elif proto == IP_PROTOS.icmp:
  82             return ICMP
  83         else:
  84             raise Exception("Unsupported protocol")
  85
  86     @classmethod
  87     def create_and_add_ip4_table(cls, i, table_id=0):
  88         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  89         i.set_table_ip4(table_id)
  90
  91     @classmethod
  92     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  93         if table_id:
  94             cls.create_and_add_ip4_table(i, table_id)
  95
  96         i.admin_up()
  97         i.config_ip4()
  98         i.resolve_arp()
  99
 100         if hosts:
 101             i.generate_remote_hosts(hosts)
 102             i.configure_ipv4_neighbors()
 103
 104     @classmethod
 105     def nat_add_interface_address(cls, i):
 106         cls.vapi.nat44_add_del_interface_addr(
 107             sw_if_index=i.sw_if_index, is_add=1)
 108
 109     def nat_add_inside_interface(self, i):
 110         self.vapi.nat44_interface_add_del_feature(
 111             flags=self.config_flags.NAT_IS_INSIDE,
 112             sw_if_index=i.sw_if_index, is_add=1)
 113
 114     def nat_add_outside_interface(self, i):
 115         self.vapi.nat44_interface_add_del_feature(
 116             flags=self.config_flags.NAT_IS_OUTSIDE,
 117             sw_if_index=i.sw_if_index, is_add=1)
 118
 119     def nat_add_address(self, address, twice_nat=0,
 120                         vrf_id=0xFFFFFFFF, is_add=1):
 121         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 122         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 123                                               last_ip_address=address,
 124                                               vrf_id=vrf_id,
 125                                               is_add=is_add,
 126                                               flags=flags)
 127
 128     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 129                                local_port=0, external_port=0, vrf_id=0,
 130                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 131                                proto=0, tag="", flags=0):
 132
 133         if not (local_port and external_port):
 134             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 135
 136         self.vapi.nat44_add_del_static_mapping(
 137             is_add=is_add,
 138             local_ip_address=local_ip,
 139             external_ip_address=external_ip,
 140             external_sw_if_index=external_sw_if_index,
 141             local_port=local_port,
 142             external_port=external_port,
 143             vrf_id=vrf_id, protocol=proto,
 144             flags=flags,
 145             tag=tag)
 146
 147     @classmethod
 148     def setUpClass(cls):
 149         super(NAT44EDTestCase, cls).setUpClass()
 150
 151         cls.create_pg_interfaces(range(12))
 152         cls.interfaces = list(cls.pg_interfaces[:4])
 153
 154         cls.create_and_add_ip4_table(cls.pg2, 10)
 155
 156         for i in cls.interfaces:
 157             cls.configure_ip4_interface(i, hosts=3)
 158
 159         # test specific (test-multiple-vrf)
 160         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 161
 162         # test specific (test-one-armed-nat44-static)
 163         cls.pg4.generate_remote_hosts(2)
 164         cls.pg4.config_ip4()
 165         cls.vapi.sw_interface_add_del_address(
 166             sw_if_index=cls.pg4.sw_if_index,
 167             prefix="10.0.0.1/24")
 168         cls.pg4.admin_up()
 169         cls.pg4.resolve_arp()
 170         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 171         cls.pg4.resolve_arp()
 172
 173         # test specific interface (pg5)
 174         cls.pg5._local_ip4 = "10.1.1.1"
 175         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 176         cls.pg5.set_table_ip4(1)
 177         cls.pg5.config_ip4()
 178         cls.pg5.admin_up()
 179         cls.pg5.resolve_arp()
 180
 181         # test specific interface (pg6)
 182         cls.pg6._local_ip4 = "10.1.2.1"
 183         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 184         cls.pg6.set_table_ip4(1)
 185         cls.pg6.config_ip4()
 186         cls.pg6.admin_up()
 187         cls.pg6.resolve_arp()
 188
 189         rl = list()
 190
 191         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 192                              [VppRoutePath("0.0.0.0", 0xffffffff,
 193                                            nh_table_id=0)],
 194                              register=False, table_id=1))
 195         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 196                              [VppRoutePath(cls.pg1.local_ip4,
 197                                            cls.pg1.sw_if_index)],
 198                              register=False))
 199         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 200                              [VppRoutePath("0.0.0.0",
 201                                            cls.pg5.sw_if_index)],
 202                              register=False, table_id=1))
 203         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 204                              [VppRoutePath("0.0.0.0",
 205                                            cls.pg6.sw_if_index)],
 206                              register=False, table_id=1))
 207         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 208                              [VppRoutePath("0.0.0.0", 0xffffffff,
 209                                            nh_table_id=1)],
 210                              register=False, table_id=0))
 211
 212         for r in rl:
 213             r.add_vpp_config()
 214
 215     def get_err_counter(self, path):
 216         return self.statistics.get_err_counter(path)
 217
 218     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 219                           host_in_port, proto=IP_PROTOS.tcp,
 220                           ignore_port=False):
 221         layer = self.proto2layer(proto)
 222
 223         if proto == IP_PROTOS.tcp:
 224             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 225         else:
 226             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 227
 228         # send packet from host to server
 229         pkts = self.create_stream_frag(self.pg0,
 230                                        self.nat_addr,
 231                                        host_in_port,
 232                                        server_out_port,
 233                                        data,
 234                                        proto)
 235         self.pg0.add_stream(pkts)
 236         self.pg_enable_capture(self.pg_interfaces)
 237         self.pg_start()
 238         frags = self.pg0.get_capture(len(pkts))
 239         p = self.reass_frags_and_verify(frags,
 240                                         self.nat_addr,
 241                                         server_addr)
 242         if proto != IP_PROTOS.icmp:
 243             if not ignore_port:
 244                 self.assertNotEqual(p[layer].sport, host_in_port)
 245             self.assertEqual(p[layer].dport, server_in_port)
 246         else:
 247             if not ignore_port:
 248                 self.assertNotEqual(p[layer].id, host_in_port)
 249         self.assertEqual(data, p[Raw].load)
 250
 251     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 252                           ignore_port=False):
 253         layer = self.proto2layer(proto)
 254
 255         if proto == IP_PROTOS.tcp:
 256             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 257         else:
 258             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 259         self.port_in = self.random_port()
 260
 261         for i in range(2):
 262             # in2out
 263             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 264                                            self.port_in, 20, data, proto)
 265             pkts.reverse()
 266             self.pg0.add_stream(pkts)
 267             self.pg_enable_capture(self.pg_interfaces)
 268             self.pg_start()
 269             frags = self.pg1.get_capture(len(pkts))
 270             if not dont_translate:
 271                 p = self.reass_frags_and_verify(frags,
 272                                                 self.nat_addr,
 273                                                 self.pg1.remote_ip4)
 274             else:
 275                 p = self.reass_frags_and_verify(frags,
 276                                                 self.pg0.remote_ip4,
 277                                                 self.pg1.remote_ip4)
 278             if proto != IP_PROTOS.icmp:
 279                 if not dont_translate:
 280                     self.assertEqual(p[layer].dport, 20)
 281                     if not ignore_port:
 282                         self.assertNotEqual(p[layer].sport, self.port_in)
 283                 else:
 284                     self.assertEqual(p[layer].sport, self.port_in)
 285             else:
 286                 if not ignore_port:
 287                     if not dont_translate:
 288                         self.assertNotEqual(p[layer].id, self.port_in)
 289                     else:
 290                         self.assertEqual(p[layer].id, self.port_in)
 291             self.assertEqual(data, p[Raw].load)
 292
 293             # out2in
 294             if not dont_translate:
 295                 dst_addr = self.nat_addr
 296             else:
 297                 dst_addr = self.pg0.remote_ip4
 298             if proto != IP_PROTOS.icmp:
 299                 sport = 20
 300                 dport = p[layer].sport
 301             else:
 302                 sport = p[layer].id
 303                 dport = 0
 304             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 305                                            data, proto, echo_reply=True)
 306             pkts.reverse()
 307             self.pg1.add_stream(pkts)
 308             self.pg_enable_capture(self.pg_interfaces)
 309             self.logger.info(self.vapi.cli("show trace"))
 310             self.pg_start()
 311             frags = self.pg0.get_capture(len(pkts))
 312             p = self.reass_frags_and_verify(frags,
 313                                             self.pg1.remote_ip4,
 314                                             self.pg0.remote_ip4)
 315             if proto != IP_PROTOS.icmp:
 316                 self.assertEqual(p[layer].sport, 20)
 317                 self.assertEqual(p[layer].dport, self.port_in)
 318             else:
 319                 self.assertEqual(p[layer].id, self.port_in)
 320             self.assertEqual(data, p[Raw].load)
 321
 322     def reass_frags_and_verify(self, frags, src, dst):
 323         buffer = BytesIO()
 324         for p in frags:
 325             self.assertEqual(p[IP].src, src)
 326             self.assertEqual(p[IP].dst, dst)
 327             self.assert_ip_checksum_valid(p)
 328             buffer.seek(p[IP].frag * 8)
 329             buffer.write(bytes(p[IP].payload))
 330         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 331                 proto=frags[0][IP].proto)
 332         if ip.proto == IP_PROTOS.tcp:
 333             p = (ip / TCP(buffer.getvalue()))
 334             self.logger.debug(ppp("Reassembled:", p))
 335             self.assert_tcp_checksum_valid(p)
 336         elif ip.proto == IP_PROTOS.udp:
 337             p = (ip / UDP(buffer.getvalue()[:8]) /
 338                  Raw(buffer.getvalue()[8:]))
 339         elif ip.proto == IP_PROTOS.icmp:
 340             p = (ip / ICMP(buffer.getvalue()))
 341         return p
 342
 343     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 344                       ignore_port=False):
 345         layer = self.proto2layer(proto)
 346
 347         if proto == IP_PROTOS.tcp:
 348             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 349         else:
 350             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 351         self.port_in = self.random_port()
 352
 353         # in2out
 354         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 355                                        self.port_in, 20, data, proto)
 356         self.pg0.add_stream(pkts)
 357         self.pg_enable_capture(self.pg_interfaces)
 358         self.pg_start()
 359         frags = self.pg1.get_capture(len(pkts))
 360         if not dont_translate:
 361             p = self.reass_frags_and_verify(frags,
 362                                             self.nat_addr,
 363                                             self.pg1.remote_ip4)
 364         else:
 365             p = self.reass_frags_and_verify(frags,
 366                                             self.pg0.remote_ip4,
 367                                             self.pg1.remote_ip4)
 368         if proto != IP_PROTOS.icmp:
 369             if not dont_translate:
 370                 self.assertEqual(p[layer].dport, 20)
 371                 if not ignore_port:
 372                     self.assertNotEqual(p[layer].sport, self.port_in)
 373             else:
 374                 self.assertEqual(p[layer].sport, self.port_in)
 375         else:
 376             if not ignore_port:
 377                 if not dont_translate:
 378                     self.assertNotEqual(p[layer].id, self.port_in)
 379                 else:
 380                     self.assertEqual(p[layer].id, self.port_in)
 381         self.assertEqual(data, p[Raw].load)
 382
 383         # out2in
 384         if not dont_translate:
 385             dst_addr = self.nat_addr
 386         else:
 387             dst_addr = self.pg0.remote_ip4
 388         if proto != IP_PROTOS.icmp:
 389             sport = 20
 390             dport = p[layer].sport
 391         else:
 392             sport = p[layer].id
 393             dport = 0
 394         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 395                                        proto, echo_reply=True)
 396         self.pg1.add_stream(pkts)
 397         self.pg_enable_capture(self.pg_interfaces)
 398         self.pg_start()
 399         frags = self.pg0.get_capture(len(pkts))
 400         p = self.reass_frags_and_verify(frags,
 401                                         self.pg1.remote_ip4,
 402                                         self.pg0.remote_ip4)
 403         if proto != IP_PROTOS.icmp:
 404             self.assertEqual(p[layer].sport, 20)
 405             self.assertEqual(p[layer].dport, self.port_in)
 406         else:
 407             self.assertEqual(p[layer].id, self.port_in)
 408         self.assertEqual(data, p[Raw].load)
 409
 410     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 411                            dst_ip=None, ignore_port=False):
 412         if nat_ip is None:
 413             nat_ip = self.nat_addr
 414         for packet in capture:
 415             try:
 416                 self.assert_packet_checksums_valid(packet)
 417                 self.assertEqual(packet[IP].src, nat_ip)
 418                 if dst_ip is not None:
 419                     self.assertEqual(packet[IP].dst, dst_ip)
 420                 if packet.haslayer(TCP):
 421                     if not ignore_port:
 422                         if same_port:
 423                             self.assertEqual(
 424                                 packet[TCP].sport, self.tcp_port_in)
 425                         else:
 426                             self.assertNotEqual(
 427                                 packet[TCP].sport, self.tcp_port_in)
 428                     self.tcp_port_out = packet[TCP].sport
 429                     self.assert_packet_checksums_valid(packet)
 430                 elif packet.haslayer(UDP):
 431                     if not ignore_port:
 432                         if same_port:
 433                             self.assertEqual(
 434                                 packet[UDP].sport, self.udp_port_in)
 435                         else:
 436                             self.assertNotEqual(
 437                                 packet[UDP].sport, self.udp_port_in)
 438                     self.udp_port_out = packet[UDP].sport
 439                 else:
 440                     if not ignore_port:
 441                         if same_port:
 442                             self.assertEqual(
 443                                 packet[ICMP].id, self.icmp_id_in)
 444                         else:
 445                             self.assertNotEqual(
 446                                 packet[ICMP].id, self.icmp_id_in)
 447                     self.icmp_id_out = packet[ICMP].id
 448                     self.assert_packet_checksums_valid(packet)
 449             except:
 450                 self.logger.error(ppp("Unexpected or invalid packet "
 451                                       "(outside network):", packet))
 452                 raise
 453
 454     def verify_capture_in(self, capture, in_if):
 455         for packet in capture:
 456             try:
 457                 self.assert_packet_checksums_valid(packet)
 458                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 459                 if packet.haslayer(TCP):
 460                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 461                 elif packet.haslayer(UDP):
 462                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 463                 else:
 464                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 465             except:
 466                 self.logger.error(ppp("Unexpected or invalid packet "
 467                                       "(inside network):", packet))
 468                 raise
 469
 470     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 471         if dst_ip is None:
 472             dst_ip = out_if.remote_ip4
 473
 474         pkts = []
 475         # TCP
 476         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 477              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 478              TCP(sport=self.tcp_port_in, dport=20))
 479         pkts.extend([p, p])
 480
 481         # UDP
 482         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 483              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 484              UDP(sport=self.udp_port_in, dport=20))
 485         pkts.append(p)
 486
 487         # ICMP
 488         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 489              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 490              ICMP(id=self.icmp_id_in, type='echo-request'))
 491         pkts.append(p)
 492
 493         return pkts
 494
 495     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 496                           use_inside_ports=False):
 497         if dst_ip is None:
 498             dst_ip = self.nat_addr
 499         if not use_inside_ports:
 500             tcp_port = self.tcp_port_out
 501             udp_port = self.udp_port_out
 502             icmp_id = self.icmp_id_out
 503         else:
 504             tcp_port = self.tcp_port_in
 505             udp_port = self.udp_port_in
 506             icmp_id = self.icmp_id_in
 507         pkts = []
 508         # TCP
 509         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 510              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 511              TCP(dport=tcp_port, sport=20))
 512         pkts.extend([p, p])
 513
 514         # UDP
 515         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 516              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 517              UDP(dport=udp_port, sport=20))
 518         pkts.append(p)
 519
 520         # ICMP
 521         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 522              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 523              ICMP(id=icmp_id, type='echo-reply'))
 524         pkts.append(p)
 525
 526         return pkts
 527
 528     def create_tcp_stream(self, in_if, out_if, count):
 529         pkts = []
 530         port = 6303
 531
 532         for i in range(count):
 533             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 534                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 535                  TCP(sport=port + i, dport=20))
 536             pkts.append(p)
 537
 538         return pkts
 539
 540     def create_stream_frag(self, src_if, dst, sport, dport, data,
 541                            proto=IP_PROTOS.tcp, echo_reply=False):
 542         if proto == IP_PROTOS.tcp:
 543             p = (IP(src=src_if.remote_ip4, dst=dst) /
 544                  TCP(sport=sport, dport=dport) /
 545                  Raw(data))
 546             p = p.__class__(scapy.compat.raw(p))
 547             chksum = p[TCP].chksum
 548             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 549         elif proto == IP_PROTOS.udp:
 550             proto_header = UDP(sport=sport, dport=dport)
 551         elif proto == IP_PROTOS.icmp:
 552             if not echo_reply:
 553                 proto_header = ICMP(id=sport, type='echo-request')
 554             else:
 555                 proto_header = ICMP(id=sport, type='echo-reply')
 556         else:
 557             raise Exception("Unsupported protocol")
 558         id = self.random_port()
 559         pkts = []
 560         if proto == IP_PROTOS.tcp:
 561             raw = Raw(data[0:4])
 562         else:
 563             raw = Raw(data[0:16])
 564         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 565              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 566              proto_header /
 567              raw)
 568         pkts.append(p)
 569         if proto == IP_PROTOS.tcp:
 570             raw = Raw(data[4:20])
 571         else:
 572             raw = Raw(data[16:32])
 573         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 574              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 575                 proto=proto) /
 576              raw)
 577         pkts.append(p)
 578         if proto == IP_PROTOS.tcp:
 579             raw = Raw(data[20:])
 580         else:
 581             raw = Raw(data[32:])
 582         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 583              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 584                 id=id) /
 585              raw)
 586         pkts.append(p)
 587         return pkts
 588
 589     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 590                                   proto=IP_PROTOS.tcp):
 591
 592         layer = self.proto2layer(proto)
 593
 594         if proto == IP_PROTOS.tcp:
 595             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 596         else:
 597             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 598         port_in = self.random_port()
 599
 600         for i in range(2):
 601             # out2in
 602             pkts = self.create_stream_frag(self.pg0, out_addr,
 603                                            port_in, out_port,
 604                                            data, proto)
 605             self.pg0.add_stream(pkts)
 606             self.pg_enable_capture(self.pg_interfaces)
 607             self.pg_start()
 608             frags = self.pg1.get_capture(len(pkts))
 609             p = self.reass_frags_and_verify(frags,
 610                                             self.pg0.remote_ip4,
 611                                             in_addr)
 612             if proto != IP_PROTOS.icmp:
 613                 self.assertEqual(p[layer].sport, port_in)
 614                 self.assertEqual(p[layer].dport, in_port)
 615             else:
 616                 self.assertEqual(p[layer].id, port_in)
 617             self.assertEqual(data, p[Raw].load)
 618
 619             # in2out
 620             if proto != IP_PROTOS.icmp:
 621                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 622                                                in_port,
 623                                                p[layer].sport, data, proto)
 624             else:
 625                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 626                                                p[layer].id, 0, data, proto,
 627                                                echo_reply=True)
 628             self.pg1.add_stream(pkts)
 629             self.pg_enable_capture(self.pg_interfaces)
 630             self.pg_start()
 631             frags = self.pg0.get_capture(len(pkts))
 632             p = self.reass_frags_and_verify(frags,
 633                                             out_addr,
 634                                             self.pg0.remote_ip4)
 635             if proto != IP_PROTOS.icmp:
 636                 self.assertEqual(p[layer].sport, out_port)
 637                 self.assertEqual(p[layer].dport, port_in)
 638             else:
 639                 self.assertEqual(p[layer].id, port_in)
 640             self.assertEqual(data, p[Raw].load)
 641
 642     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 643                                       out_port, proto=IP_PROTOS.tcp):
 644
 645         layer = self.proto2layer(proto)
 646
 647         if proto == IP_PROTOS.tcp:
 648             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 649         else:
 650             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 651         port_in = self.random_port()
 652
 653         for i in range(2):
 654             # out2in
 655             pkts = self.create_stream_frag(self.pg0, out_addr,
 656                                            port_in, out_port,
 657                                            data, proto)
 658             pkts.reverse()
 659             self.pg0.add_stream(pkts)
 660             self.pg_enable_capture(self.pg_interfaces)
 661             self.pg_start()
 662             frags = self.pg1.get_capture(len(pkts))
 663             p = self.reass_frags_and_verify(frags,
 664                                             self.pg0.remote_ip4,
 665                                             in_addr)
 666             if proto != IP_PROTOS.icmp:
 667                 self.assertEqual(p[layer].dport, in_port)
 668                 self.assertEqual(p[layer].sport, port_in)
 669                 self.assertEqual(p[layer].dport, in_port)
 670             else:
 671                 self.assertEqual(p[layer].id, port_in)
 672             self.assertEqual(data, p[Raw].load)
 673
 674             # in2out
 675             if proto != IP_PROTOS.icmp:
 676                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 677                                                in_port,
 678                                                p[layer].sport, data, proto)
 679             else:
 680                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 681                                                p[layer].id, 0, data, proto,
 682                                                echo_reply=True)
 683             pkts.reverse()
 684             self.pg1.add_stream(pkts)
 685             self.pg_enable_capture(self.pg_interfaces)
 686             self.pg_start()
 687             frags = self.pg0.get_capture(len(pkts))
 688             p = self.reass_frags_and_verify(frags,
 689                                             out_addr,
 690                                             self.pg0.remote_ip4)
 691             if proto != IP_PROTOS.icmp:
 692                 self.assertEqual(p[layer].sport, out_port)
 693                 self.assertEqual(p[layer].dport, port_in)
 694             else:
 695                 self.assertEqual(p[layer].id, port_in)
 696             self.assertEqual(data, p[Raw].load)
 697
 698     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 699         # SYN packet in->out
 700         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 701              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 702              TCP(sport=in_port, dport=ext_port, flags="S"))
 703         in_if.add_stream(p)
 704         self.pg_enable_capture(self.pg_interfaces)
 705         self.pg_start()
 706         capture = out_if.get_capture(1)
 707         p = capture[0]
 708         out_port = p[TCP].sport
 709
 710         # SYN + ACK packet out->in
 711         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 712              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 713              TCP(sport=ext_port, dport=out_port, flags="SA"))
 714         out_if.add_stream(p)
 715         self.pg_enable_capture(self.pg_interfaces)
 716         self.pg_start()
 717         in_if.get_capture(1)
 718
 719         # ACK packet in->out
 720         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 721              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 722              TCP(sport=in_port, dport=ext_port, flags="A"))
 723         in_if.add_stream(p)
 724         self.pg_enable_capture(self.pg_interfaces)
 725         self.pg_start()
 726         out_if.get_capture(1)
 727
 728         return out_port
 729
 730     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 731                          client_id=None):
 732         twice_nat_addr = '10.0.1.3'
 733
 734         port_in = 8080
 735         if lb:
 736             if not same_pg:
 737                 port_in1 = port_in
 738                 port_in2 = port_in
 739             else:
 740                 port_in1 = port_in + 1
 741                 port_in2 = port_in + 2
 742
 743         port_out = 80
 744         eh_port_out = 4567
 745
 746         server1 = self.pg0.remote_hosts[0]
 747         server2 = self.pg0.remote_hosts[1]
 748         if lb and same_pg:
 749             server2 = server1
 750         if not lb:
 751             server = server1
 752
 753         pg0 = self.pg0
 754         if same_pg:
 755             pg1 = self.pg0
 756         else:
 757             pg1 = self.pg1
 758
 759         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 760                         client_id == 1)
 761
 762         self.nat_add_address(self.nat_addr)
 763         self.nat_add_address(twice_nat_addr, twice_nat=1)
 764
 765         flags = 0
 766         if self_twice_nat:
 767             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 768         else:
 769             flags |= self.config_flags.NAT_IS_TWICE_NAT
 770
 771         if not lb:
 772             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 773                                         port_in, port_out,
 774                                         proto=IP_PROTOS.tcp,
 775                                         flags=flags)
 776         else:
 777             locals = [{'addr': server1.ip4,
 778                        'port': port_in1,
 779                        'probability': 50,
 780                        'vrf_id': 0},
 781                       {'addr': server2.ip4,
 782                        'port': port_in2,
 783                        'probability': 50,
 784                        'vrf_id': 0}]
 785             out_addr = self.nat_addr
 786
 787             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 788                                                       external_addr=out_addr,
 789                                                       external_port=port_out,
 790                                                       protocol=IP_PROTOS.tcp,
 791                                                       local_num=len(locals),
 792                                                       locals=locals)
 793         self.nat_add_inside_interface(pg0)
 794         self.nat_add_outside_interface(pg1)
 795
 796         if same_pg:
 797             if not lb:
 798                 client = server
 799             else:
 800                 assert client_id is not None
 801                 if client_id == 1:
 802                     client = self.pg0.remote_hosts[0]
 803                 elif client_id == 2:
 804                     client = self.pg0.remote_hosts[1]
 805         else:
 806             client = pg1.remote_hosts[0]
 807         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 808              IP(src=client.ip4, dst=self.nat_addr) /
 809              TCP(sport=eh_port_out, dport=port_out))
 810         pg1.add_stream(p)
 811         self.pg_enable_capture(self.pg_interfaces)
 812         self.pg_start()
 813         capture = pg0.get_capture(1)
 814         p = capture[0]
 815         try:
 816             ip = p[IP]
 817             tcp = p[TCP]
 818             if lb:
 819                 if ip.dst == server1.ip4:
 820                     server = server1
 821                     port_in = port_in1
 822                 else:
 823                     server = server2
 824                     port_in = port_in2
 825             self.assertEqual(ip.dst, server.ip4)
 826             if lb and same_pg:
 827                 self.assertIn(tcp.dport, [port_in1, port_in2])
 828             else:
 829                 self.assertEqual(tcp.dport, port_in)
 830             if eh_translate:
 831                 self.assertEqual(ip.src, twice_nat_addr)
 832                 self.assertNotEqual(tcp.sport, eh_port_out)
 833             else:
 834                 self.assertEqual(ip.src, client.ip4)
 835                 self.assertEqual(tcp.sport, eh_port_out)
 836             eh_addr_in = ip.src
 837             eh_port_in = tcp.sport
 838             saved_port_in = tcp.dport
 839             self.assert_packet_checksums_valid(p)
 840         except:
 841             self.logger.error(ppp("Unexpected or invalid packet:", p))
 842             raise
 843
 844         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 845              IP(src=server.ip4, dst=eh_addr_in) /
 846              TCP(sport=saved_port_in, dport=eh_port_in))
 847         pg0.add_stream(p)
 848         self.pg_enable_capture(self.pg_interfaces)
 849         self.pg_start()
 850         capture = pg1.get_capture(1)
 851         p = capture[0]
 852         try:
 853             ip = p[IP]
 854             tcp = p[TCP]
 855             self.assertEqual(ip.dst, client.ip4)
 856             self.assertEqual(ip.src, self.nat_addr)
 857             self.assertEqual(tcp.dport, eh_port_out)
 858             self.assertEqual(tcp.sport, port_out)
 859             self.assert_packet_checksums_valid(p)
 860         except:
 861             self.logger.error(ppp("Unexpected or invalid packet:", p))
 862             raise
 863
 864         if eh_translate:
 865             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 866             self.assertEqual(len(sessions), 1)
 867             self.assertTrue(sessions[0].flags &
 868                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 869             self.assertTrue(sessions[0].flags &
 870                             self.config_flags.NAT_IS_TWICE_NAT)
 871             self.logger.info(self.vapi.cli("show nat44 sessions"))
 872             self.vapi.nat44_del_session(
 873                 address=sessions[0].inside_ip_address,
 874                 port=sessions[0].inside_port,
 875                 protocol=sessions[0].protocol,
 876                 flags=(self.config_flags.NAT_IS_INSIDE |
 877                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 878                 ext_host_address=sessions[0].ext_host_nat_address,
 879                 ext_host_port=sessions[0].ext_host_nat_port)
 880             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 881             self.assertEqual(len(sessions), 0)
 882
 883     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 884         message = data.decode('utf-8')
 885         try:
 886             message = SyslogMessage.parse(message)
 887         except ParseError as e:
 888             self.logger.error(e)
 889             raise
 890         else:
 891             self.assertEqual(message.severity, SyslogSeverity.info)
 892             self.assertEqual(message.appname, 'NAT')
 893             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 894             sd_params = message.sd.get('nsess')
 895             self.assertTrue(sd_params is not None)
 896             if is_ip6:
 897                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 898                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 899             else:
 900                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 901                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 902                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 903             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 904             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 905             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 906             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 907             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 908             self.assertEqual(sd_params.get('SVLAN'), '0')
 909             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 910             self.assertEqual(sd_params.get('XDPORT'),
 911                              "%d" % self.tcp_external_port)
 912
 913
 914 class TestNAT44ED(NAT44EDTestCase):
 915     """ NAT44ED Test Case """
 916
 917     def test_users_dump(self):
 918         """ NAT44ED API test - nat44_user_dump """
 919
 920         self.nat_add_address(self.nat_addr)
 921         self.nat_add_inside_interface(self.pg0)
 922         self.nat_add_outside_interface(self.pg1)
 923
 924         self.vapi.nat44_forwarding_enable_disable(enable=1)
 925
 926         local_ip = self.pg0.remote_ip4
 927         external_ip = self.nat_addr
 928         self.nat_add_static_mapping(local_ip, external_ip)
 929
 930         users = self.vapi.nat44_user_dump()
 931         self.assertEqual(len(users), 0)
 932
 933         # in2out - static mapping match
 934
 935         pkts = self.create_stream_out(self.pg1)
 936         self.pg1.add_stream(pkts)
 937         self.pg_enable_capture(self.pg_interfaces)
 938         self.pg_start()
 939         capture = self.pg0.get_capture(len(pkts))
 940         self.verify_capture_in(capture, self.pg0)
 941
 942         pkts = self.create_stream_in(self.pg0, self.pg1)
 943         self.pg0.add_stream(pkts)
 944         self.pg_enable_capture(self.pg_interfaces)
 945         self.pg_start()
 946         capture = self.pg1.get_capture(len(pkts))
 947         self.verify_capture_out(capture, same_port=True)
 948
 949         users = self.vapi.nat44_user_dump()
 950         self.assertEqual(len(users), 1)
 951         static_user = users[0]
 952         self.assertEqual(static_user.nstaticsessions, 3)
 953         self.assertEqual(static_user.nsessions, 0)
 954
 955         # in2out - no static mapping match (forwarding test)
 956
 957         host0 = self.pg0.remote_hosts[0]
 958         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
 959         try:
 960             pkts = self.create_stream_out(self.pg1,
 961                                           dst_ip=self.pg0.remote_ip4,
 962                                           use_inside_ports=True)
 963             self.pg1.add_stream(pkts)
 964             self.pg_enable_capture(self.pg_interfaces)
 965             self.pg_start()
 966             capture = self.pg0.get_capture(len(pkts))
 967             self.verify_capture_in(capture, self.pg0)
 968
 969             pkts = self.create_stream_in(self.pg0, self.pg1)
 970             self.pg0.add_stream(pkts)
 971             self.pg_enable_capture(self.pg_interfaces)
 972             self.pg_start()
 973             capture = self.pg1.get_capture(len(pkts))
 974             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
 975                                     same_port=True)
 976         finally:
 977             self.pg0.remote_hosts[0] = host0
 978
 979         users = self.vapi.nat44_user_dump()
 980         self.assertEqual(len(users), 2)
 981         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
 982             non_static_user = users[1]
 983             static_user = users[0]
 984         else:
 985             non_static_user = users[0]
 986             static_user = users[1]
 987         self.assertEqual(static_user.nstaticsessions, 3)
 988         self.assertEqual(static_user.nsessions, 0)
 989         self.assertEqual(non_static_user.nstaticsessions, 0)
 990         self.assertEqual(non_static_user.nsessions, 3)
 991
 992         users = self.vapi.nat44_user_dump()
 993         self.assertEqual(len(users), 2)
 994         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
 995             non_static_user = users[1]
 996             static_user = users[0]
 997         else:
 998             non_static_user = users[0]
 999             static_user = users[1]
1000         self.assertEqual(static_user.nstaticsessions, 3)
1001         self.assertEqual(static_user.nsessions, 0)
1002         self.assertEqual(non_static_user.nstaticsessions, 0)
1003         self.assertEqual(non_static_user.nsessions, 3)
1004
1005     def test_frag_out_of_order_do_not_translate(self):
1006         """ NAT44ED don't translate fragments arriving out of order """
1007         self.nat_add_inside_interface(self.pg0)
1008         self.nat_add_outside_interface(self.pg1)
1009         self.vapi.nat44_forwarding_enable_disable(enable=True)
1010         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1011
1012     def test_forwarding(self):
1013         """ NAT44ED forwarding test """
1014
1015         self.nat_add_inside_interface(self.pg0)
1016         self.nat_add_outside_interface(self.pg1)
1017         self.vapi.nat44_forwarding_enable_disable(enable=1)
1018
1019         real_ip = self.pg0.remote_ip4
1020         alias_ip = self.nat_addr
1021         flags = self.config_flags.NAT_IS_ADDR_ONLY
1022         self.vapi.nat44_add_del_static_mapping(is_add=1,
1023                                                local_ip_address=real_ip,
1024                                                external_ip_address=alias_ip,
1025                                                external_sw_if_index=0xFFFFFFFF,
1026                                                flags=flags)
1027
1028         try:
1029             # in2out - static mapping match
1030
1031             pkts = self.create_stream_out(self.pg1)
1032             self.pg1.add_stream(pkts)
1033             self.pg_enable_capture(self.pg_interfaces)
1034             self.pg_start()
1035             capture = self.pg0.get_capture(len(pkts))
1036             self.verify_capture_in(capture, self.pg0)
1037
1038             pkts = self.create_stream_in(self.pg0, self.pg1)
1039             self.pg0.add_stream(pkts)
1040             self.pg_enable_capture(self.pg_interfaces)
1041             self.pg_start()
1042             capture = self.pg1.get_capture(len(pkts))
1043             self.verify_capture_out(capture, same_port=True)
1044
1045             # in2out - no static mapping match
1046
1047             host0 = self.pg0.remote_hosts[0]
1048             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1049             try:
1050                 pkts = self.create_stream_out(self.pg1,
1051                                               dst_ip=self.pg0.remote_ip4,
1052                                               use_inside_ports=True)
1053                 self.pg1.add_stream(pkts)
1054                 self.pg_enable_capture(self.pg_interfaces)
1055                 self.pg_start()
1056                 capture = self.pg0.get_capture(len(pkts))
1057                 self.verify_capture_in(capture, self.pg0)
1058
1059                 pkts = self.create_stream_in(self.pg0, self.pg1)
1060                 self.pg0.add_stream(pkts)
1061                 self.pg_enable_capture(self.pg_interfaces)
1062                 self.pg_start()
1063                 capture = self.pg1.get_capture(len(pkts))
1064                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1065                                         same_port=True)
1066             finally:
1067                 self.pg0.remote_hosts[0] = host0
1068
1069             user = self.pg0.remote_hosts[1]
1070             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1071             self.assertEqual(len(sessions), 3)
1072             self.assertTrue(sessions[0].flags &
1073                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1074             self.vapi.nat44_del_session(
1075                 address=sessions[0].inside_ip_address,
1076                 port=sessions[0].inside_port,
1077                 protocol=sessions[0].protocol,
1078                 flags=(self.config_flags.NAT_IS_INSIDE |
1079                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1080                 ext_host_address=sessions[0].ext_host_address,
1081                 ext_host_port=sessions[0].ext_host_port)
1082             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1083             self.assertEqual(len(sessions), 2)
1084
1085         finally:
1086             self.vapi.nat44_forwarding_enable_disable(enable=0)
1087             flags = self.config_flags.NAT_IS_ADDR_ONLY
1088             self.vapi.nat44_add_del_static_mapping(
1089                 is_add=0,
1090                 local_ip_address=real_ip,
1091                 external_ip_address=alias_ip,
1092                 external_sw_if_index=0xFFFFFFFF,
1093                 flags=flags)
1094
1095     def test_output_feature_and_service2(self):
1096         """ NAT44ED interface output feature and service host direct access """
1097         self.vapi.nat44_forwarding_enable_disable(enable=1)
1098         self.nat_add_address(self.nat_addr)
1099
1100         self.vapi.nat44_interface_add_del_output_feature(
1101             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1102
1103         # session initiated from service host - translate
1104         pkts = self.create_stream_in(self.pg0, self.pg1)
1105         self.pg0.add_stream(pkts)
1106         self.pg_enable_capture(self.pg_interfaces)
1107         self.pg_start()
1108         capture = self.pg1.get_capture(len(pkts))
1109         self.verify_capture_out(capture, ignore_port=True)
1110
1111         pkts = self.create_stream_out(self.pg1)
1112         self.pg1.add_stream(pkts)
1113         self.pg_enable_capture(self.pg_interfaces)
1114         self.pg_start()
1115         capture = self.pg0.get_capture(len(pkts))
1116         self.verify_capture_in(capture, self.pg0)
1117
1118         # session initiated from remote host - do not translate
1119         tcp_port_in = self.tcp_port_in
1120         udp_port_in = self.udp_port_in
1121         icmp_id_in = self.icmp_id_in
1122
1123         self.tcp_port_in = 60303
1124         self.udp_port_in = 60304
1125         self.icmp_id_in = 60305
1126
1127         try:
1128             pkts = self.create_stream_out(self.pg1,
1129                                           self.pg0.remote_ip4,
1130                                           use_inside_ports=True)
1131             self.pg1.add_stream(pkts)
1132             self.pg_enable_capture(self.pg_interfaces)
1133             self.pg_start()
1134             capture = self.pg0.get_capture(len(pkts))
1135             self.verify_capture_in(capture, self.pg0)
1136
1137             pkts = self.create_stream_in(self.pg0, self.pg1)
1138             self.pg0.add_stream(pkts)
1139             self.pg_enable_capture(self.pg_interfaces)
1140             self.pg_start()
1141             capture = self.pg1.get_capture(len(pkts))
1142             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1143                                     same_port=True)
1144         finally:
1145             self.tcp_port_in = tcp_port_in
1146             self.udp_port_in = udp_port_in
1147             self.icmp_id_in = icmp_id_in
1148
1149     def test_twice_nat(self):
1150         """ NAT44ED Twice NAT """
1151         self.twice_nat_common()
1152
1153     def test_self_twice_nat_positive(self):
1154         """ NAT44ED Self Twice NAT (positive test) """
1155         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1156
1157     def test_self_twice_nat_lb_positive(self):
1158         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1159         """
1160         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1161                               client_id=1)
1162
1163     def test_twice_nat_lb(self):
1164         """ NAT44ED Twice NAT local service load balancing """
1165         self.twice_nat_common(lb=True)
1166
1167     def test_output_feature(self):
1168         """ NAT44ED interface output feature (in2out postrouting) """
1169         self.vapi.nat44_forwarding_enable_disable(enable=1)
1170         self.nat_add_address(self.nat_addr)
1171
1172         self.nat_add_outside_interface(self.pg0)
1173         self.vapi.nat44_interface_add_del_output_feature(
1174             sw_if_index=self.pg1.sw_if_index, is_add=1)
1175
1176         # in2out
1177         pkts = self.create_stream_in(self.pg0, self.pg1)
1178         self.pg0.add_stream(pkts)
1179         self.pg_enable_capture(self.pg_interfaces)
1180         self.pg_start()
1181         capture = self.pg1.get_capture(len(pkts))
1182         self.verify_capture_out(capture, ignore_port=True)
1183
1184         # out2in
1185         pkts = self.create_stream_out(self.pg1)
1186         self.pg1.add_stream(pkts)
1187         self.pg_enable_capture(self.pg_interfaces)
1188         self.pg_start()
1189         capture = self.pg0.get_capture(len(pkts))
1190         self.verify_capture_in(capture, self.pg0)
1191
1192     def test_static_with_port_out2(self):
1193         """ NAT44ED 1:1 NAPT asymmetrical rule """
1194
1195         external_port = 80
1196         local_port = 8080
1197
1198         self.vapi.nat44_forwarding_enable_disable(enable=1)
1199         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1200         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1201                                     local_port, external_port,
1202                                     proto=IP_PROTOS.tcp, flags=flags)
1203
1204         self.nat_add_inside_interface(self.pg0)
1205         self.nat_add_outside_interface(self.pg1)
1206
1207         # from client to service
1208         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1209              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1210              TCP(sport=12345, dport=external_port))
1211         self.pg1.add_stream(p)
1212         self.pg_enable_capture(self.pg_interfaces)
1213         self.pg_start()
1214         capture = self.pg0.get_capture(1)
1215         p = capture[0]
1216         try:
1217             ip = p[IP]
1218             tcp = p[TCP]
1219             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1220             self.assertEqual(tcp.dport, local_port)
1221             self.assert_packet_checksums_valid(p)
1222         except:
1223             self.logger.error(ppp("Unexpected or invalid packet:", p))
1224             raise
1225
1226         # ICMP error
1227         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1228              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1229              ICMP(type=11) / capture[0][IP])
1230         self.pg0.add_stream(p)
1231         self.pg_enable_capture(self.pg_interfaces)
1232         self.pg_start()
1233         capture = self.pg1.get_capture(1)
1234         p = capture[0]
1235         try:
1236             self.assertEqual(p[IP].src, self.nat_addr)
1237             inner = p[IPerror]
1238             self.assertEqual(inner.dst, self.nat_addr)
1239             self.assertEqual(inner[TCPerror].dport, external_port)
1240         except:
1241             self.logger.error(ppp("Unexpected or invalid packet:", p))
1242             raise
1243
1244         # from service back to client
1245         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1246              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1247              TCP(sport=local_port, dport=12345))
1248         self.pg0.add_stream(p)
1249         self.pg_enable_capture(self.pg_interfaces)
1250         self.pg_start()
1251         capture = self.pg1.get_capture(1)
1252         p = capture[0]
1253         try:
1254             ip = p[IP]
1255             tcp = p[TCP]
1256             self.assertEqual(ip.src, self.nat_addr)
1257             self.assertEqual(tcp.sport, external_port)
1258             self.assert_packet_checksums_valid(p)
1259         except:
1260             self.logger.error(ppp("Unexpected or invalid packet:", p))
1261             raise
1262
1263         # ICMP error
1264         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1265              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1266              ICMP(type=11) / capture[0][IP])
1267         self.pg1.add_stream(p)
1268         self.pg_enable_capture(self.pg_interfaces)
1269         self.pg_start()
1270         capture = self.pg0.get_capture(1)
1271         p = capture[0]
1272         try:
1273             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1274             inner = p[IPerror]
1275             self.assertEqual(inner.src, self.pg0.remote_ip4)
1276             self.assertEqual(inner[TCPerror].sport, local_port)
1277         except:
1278             self.logger.error(ppp("Unexpected or invalid packet:", p))
1279             raise
1280
1281         # from client to server (no translation)
1282         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1283              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1284              TCP(sport=12346, dport=local_port))
1285         self.pg1.add_stream(p)
1286         self.pg_enable_capture(self.pg_interfaces)
1287         self.pg_start()
1288         capture = self.pg0.get_capture(1)
1289         p = capture[0]
1290         try:
1291             ip = p[IP]
1292             tcp = p[TCP]
1293             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1294             self.assertEqual(tcp.dport, local_port)
1295             self.assert_packet_checksums_valid(p)
1296         except:
1297             self.logger.error(ppp("Unexpected or invalid packet:", p))
1298             raise
1299
1300         # from service back to client (no translation)
1301         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1302              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1303              TCP(sport=local_port, dport=12346))
1304         self.pg0.add_stream(p)
1305         self.pg_enable_capture(self.pg_interfaces)
1306         self.pg_start()
1307         capture = self.pg1.get_capture(1)
1308         p = capture[0]
1309         try:
1310             ip = p[IP]
1311             tcp = p[TCP]
1312             self.assertEqual(ip.src, self.pg0.remote_ip4)
1313             self.assertEqual(tcp.sport, local_port)
1314             self.assert_packet_checksums_valid(p)
1315         except:
1316             self.logger.error(ppp("Unexpected or invalid packet:", p))
1317             raise
1318
1319     def test_static_lb(self):
1320         """ NAT44ED local service load balancing """
1321         external_addr_n = self.nat_addr
1322         external_port = 80
1323         local_port = 8080
1324         server1 = self.pg0.remote_hosts[0]
1325         server2 = self.pg0.remote_hosts[1]
1326
1327         locals = [{'addr': server1.ip4,
1328                    'port': local_port,
1329                    'probability': 70,
1330                    'vrf_id': 0},
1331                   {'addr': server2.ip4,
1332                    'port': local_port,
1333                    'probability': 30,
1334                    'vrf_id': 0}]
1335
1336         self.nat_add_address(self.nat_addr)
1337         self.vapi.nat44_add_del_lb_static_mapping(
1338             is_add=1,
1339             external_addr=external_addr_n,
1340             external_port=external_port,
1341             protocol=IP_PROTOS.tcp,
1342             local_num=len(locals),
1343             locals=locals)
1344         flags = self.config_flags.NAT_IS_INSIDE
1345         self.vapi.nat44_interface_add_del_feature(
1346             sw_if_index=self.pg0.sw_if_index,
1347             flags=flags, is_add=1)
1348         self.vapi.nat44_interface_add_del_feature(
1349             sw_if_index=self.pg1.sw_if_index,
1350             is_add=1)
1351
1352         # from client to service
1353         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1354              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1355              TCP(sport=12345, dport=external_port))
1356         self.pg1.add_stream(p)
1357         self.pg_enable_capture(self.pg_interfaces)
1358         self.pg_start()
1359         capture = self.pg0.get_capture(1)
1360         p = capture[0]
1361         server = None
1362         try:
1363             ip = p[IP]
1364             tcp = p[TCP]
1365             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1366             if ip.dst == server1.ip4:
1367                 server = server1
1368             else:
1369                 server = server2
1370             self.assertEqual(tcp.dport, local_port)
1371             self.assert_packet_checksums_valid(p)
1372         except:
1373             self.logger.error(ppp("Unexpected or invalid packet:", p))
1374             raise
1375
1376         # from service back to client
1377         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1378              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1379              TCP(sport=local_port, dport=12345))
1380         self.pg0.add_stream(p)
1381         self.pg_enable_capture(self.pg_interfaces)
1382         self.pg_start()
1383         capture = self.pg1.get_capture(1)
1384         p = capture[0]
1385         try:
1386             ip = p[IP]
1387             tcp = p[TCP]
1388             self.assertEqual(ip.src, self.nat_addr)
1389             self.assertEqual(tcp.sport, external_port)
1390             self.assert_packet_checksums_valid(p)
1391         except:
1392             self.logger.error(ppp("Unexpected or invalid packet:", p))
1393             raise
1394
1395         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1396         self.assertEqual(len(sessions), 1)
1397         self.assertTrue(sessions[0].flags &
1398                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1399         self.vapi.nat44_del_session(
1400             address=sessions[0].inside_ip_address,
1401             port=sessions[0].inside_port,
1402             protocol=sessions[0].protocol,
1403             flags=(self.config_flags.NAT_IS_INSIDE |
1404                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1405             ext_host_address=sessions[0].ext_host_address,
1406             ext_host_port=sessions[0].ext_host_port)
1407         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1408         self.assertEqual(len(sessions), 0)
1409
1410     def test_static_lb_2(self):
1411         """ NAT44ED local service load balancing (asymmetrical rule) """
1412         external_addr = self.nat_addr
1413         external_port = 80
1414         local_port = 8080
1415         server1 = self.pg0.remote_hosts[0]
1416         server2 = self.pg0.remote_hosts[1]
1417
1418         locals = [{'addr': server1.ip4,
1419                    'port': local_port,
1420                    'probability': 70,
1421                    'vrf_id': 0},
1422                   {'addr': server2.ip4,
1423                    'port': local_port,
1424                    'probability': 30,
1425                    'vrf_id': 0}]
1426
1427         self.vapi.nat44_forwarding_enable_disable(enable=1)
1428         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1429         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1430                                                   external_addr=external_addr,
1431                                                   external_port=external_port,
1432                                                   protocol=IP_PROTOS.tcp,
1433                                                   local_num=len(locals),
1434                                                   locals=locals)
1435         flags = self.config_flags.NAT_IS_INSIDE
1436         self.vapi.nat44_interface_add_del_feature(
1437             sw_if_index=self.pg0.sw_if_index,
1438             flags=flags, is_add=1)
1439         self.vapi.nat44_interface_add_del_feature(
1440             sw_if_index=self.pg1.sw_if_index,
1441             is_add=1)
1442
1443         # from client to service
1444         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1445              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1446              TCP(sport=12345, dport=external_port))
1447         self.pg1.add_stream(p)
1448         self.pg_enable_capture(self.pg_interfaces)
1449         self.pg_start()
1450         capture = self.pg0.get_capture(1)
1451         p = capture[0]
1452         server = None
1453         try:
1454             ip = p[IP]
1455             tcp = p[TCP]
1456             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1457             if ip.dst == server1.ip4:
1458                 server = server1
1459             else:
1460                 server = server2
1461             self.assertEqual(tcp.dport, local_port)
1462             self.assert_packet_checksums_valid(p)
1463         except:
1464             self.logger.error(ppp("Unexpected or invalid packet:", p))
1465             raise
1466
1467         # from service back to client
1468         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1469              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1470              TCP(sport=local_port, dport=12345))
1471         self.pg0.add_stream(p)
1472         self.pg_enable_capture(self.pg_interfaces)
1473         self.pg_start()
1474         capture = self.pg1.get_capture(1)
1475         p = capture[0]
1476         try:
1477             ip = p[IP]
1478             tcp = p[TCP]
1479             self.assertEqual(ip.src, self.nat_addr)
1480             self.assertEqual(tcp.sport, external_port)
1481             self.assert_packet_checksums_valid(p)
1482         except:
1483             self.logger.error(ppp("Unexpected or invalid packet:", p))
1484             raise
1485
1486         # from client to server (no translation)
1487         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1488              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1489              TCP(sport=12346, dport=local_port))
1490         self.pg1.add_stream(p)
1491         self.pg_enable_capture(self.pg_interfaces)
1492         self.pg_start()
1493         capture = self.pg0.get_capture(1)
1494         p = capture[0]
1495         server = None
1496         try:
1497             ip = p[IP]
1498             tcp = p[TCP]
1499             self.assertEqual(ip.dst, server1.ip4)
1500             self.assertEqual(tcp.dport, local_port)
1501             self.assert_packet_checksums_valid(p)
1502         except:
1503             self.logger.error(ppp("Unexpected or invalid packet:", p))
1504             raise
1505
1506         # from service back to client (no translation)
1507         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1508              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1509              TCP(sport=local_port, dport=12346))
1510         self.pg0.add_stream(p)
1511         self.pg_enable_capture(self.pg_interfaces)
1512         self.pg_start()
1513         capture = self.pg1.get_capture(1)
1514         p = capture[0]
1515         try:
1516             ip = p[IP]
1517             tcp = p[TCP]
1518             self.assertEqual(ip.src, server1.ip4)
1519             self.assertEqual(tcp.sport, local_port)
1520             self.assert_packet_checksums_valid(p)
1521         except:
1522             self.logger.error(ppp("Unexpected or invalid packet:", p))
1523             raise
1524
1525     def test_lb_affinity(self):
1526         """ NAT44ED local service load balancing affinity """
1527         external_addr = self.nat_addr
1528         external_port = 80
1529         local_port = 8080
1530         server1 = self.pg0.remote_hosts[0]
1531         server2 = self.pg0.remote_hosts[1]
1532
1533         locals = [{'addr': server1.ip4,
1534                    'port': local_port,
1535                    'probability': 50,
1536                    'vrf_id': 0},
1537                   {'addr': server2.ip4,
1538                    'port': local_port,
1539                    'probability': 50,
1540                    'vrf_id': 0}]
1541
1542         self.nat_add_address(self.nat_addr)
1543         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1544                                                   external_addr=external_addr,
1545                                                   external_port=external_port,
1546                                                   protocol=IP_PROTOS.tcp,
1547                                                   affinity=10800,
1548                                                   local_num=len(locals),
1549                                                   locals=locals)
1550         flags = self.config_flags.NAT_IS_INSIDE
1551         self.vapi.nat44_interface_add_del_feature(
1552             sw_if_index=self.pg0.sw_if_index,
1553             flags=flags, is_add=1)
1554         self.vapi.nat44_interface_add_del_feature(
1555             sw_if_index=self.pg1.sw_if_index,
1556             is_add=1)
1557
1558         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1559              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1560              TCP(sport=1025, dport=external_port))
1561         self.pg1.add_stream(p)
1562         self.pg_enable_capture(self.pg_interfaces)
1563         self.pg_start()
1564         capture = self.pg0.get_capture(1)
1565         backend = capture[0][IP].dst
1566
1567         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1568         self.assertEqual(len(sessions), 1)
1569         self.assertTrue(sessions[0].flags &
1570                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1571         self.vapi.nat44_del_session(
1572             address=sessions[0].inside_ip_address,
1573             port=sessions[0].inside_port,
1574             protocol=sessions[0].protocol,
1575             flags=(self.config_flags.NAT_IS_INSIDE |
1576                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1577             ext_host_address=sessions[0].ext_host_address,
1578             ext_host_port=sessions[0].ext_host_port)
1579
1580         pkts = []
1581         for port in range(1030, 1100):
1582             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1583                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1584                  TCP(sport=port, dport=external_port))
1585             pkts.append(p)
1586         self.pg1.add_stream(pkts)
1587         self.pg_enable_capture(self.pg_interfaces)
1588         self.pg_start()
1589         capture = self.pg0.get_capture(len(pkts))
1590         for p in capture:
1591             self.assertEqual(p[IP].dst, backend)
1592
1593     def test_multiple_vrf_1(self):
1594         """ Multiple VRF - both client & service in VRF1 """
1595
1596         external_addr = '1.2.3.4'
1597         external_port = 80
1598         local_port = 8080
1599         port = 0
1600
1601         flags = self.config_flags.NAT_IS_INSIDE
1602         self.vapi.nat44_interface_add_del_feature(
1603             sw_if_index=self.pg5.sw_if_index,
1604             is_add=1)
1605         self.vapi.nat44_interface_add_del_feature(
1606             sw_if_index=self.pg5.sw_if_index,
1607             is_add=1, flags=flags)
1608         self.vapi.nat44_interface_add_del_feature(
1609             sw_if_index=self.pg6.sw_if_index,
1610             is_add=1)
1611         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1612         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1613                                     local_port, external_port, vrf_id=1,
1614                                     proto=IP_PROTOS.tcp, flags=flags)
1615
1616         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1617              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1618              TCP(sport=12345, dport=external_port))
1619         self.pg6.add_stream(p)
1620         self.pg_enable_capture(self.pg_interfaces)
1621         self.pg_start()
1622         capture = self.pg5.get_capture(1)
1623         p = capture[0]
1624         try:
1625             ip = p[IP]
1626             tcp = p[TCP]
1627             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1628             self.assertEqual(tcp.dport, local_port)
1629             self.assert_packet_checksums_valid(p)
1630         except:
1631             self.logger.error(ppp("Unexpected or invalid packet:", p))
1632             raise
1633
1634         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1635              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1636              TCP(sport=local_port, dport=12345))
1637         self.pg5.add_stream(p)
1638         self.pg_enable_capture(self.pg_interfaces)
1639         self.pg_start()
1640         capture = self.pg6.get_capture(1)
1641         p = capture[0]
1642         try:
1643             ip = p[IP]
1644             tcp = p[TCP]
1645             self.assertEqual(ip.src, external_addr)
1646             self.assertEqual(tcp.sport, external_port)
1647             self.assert_packet_checksums_valid(p)
1648         except:
1649             self.logger.error(ppp("Unexpected or invalid packet:", p))
1650             raise
1651
1652     def test_multiple_vrf_2(self):
1653         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1654
1655         external_addr = '1.2.3.4'
1656         external_port = 80
1657         local_port = 8080
1658         port = 0
1659
1660         self.nat_add_address(self.nat_addr)
1661         flags = self.config_flags.NAT_IS_INSIDE
1662         self.vapi.nat44_interface_add_del_output_feature(
1663             sw_if_index=self.pg1.sw_if_index,
1664             is_add=1)
1665         self.vapi.nat44_interface_add_del_feature(
1666             sw_if_index=self.pg5.sw_if_index,
1667             is_add=1)
1668         self.vapi.nat44_interface_add_del_feature(
1669             sw_if_index=self.pg5.sw_if_index,
1670             is_add=1, flags=flags)
1671         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1672         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1673                                     local_port, external_port, vrf_id=1,
1674                                     proto=IP_PROTOS.tcp, flags=flags)
1675
1676         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1677              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1678              TCP(sport=2345, dport=22))
1679         self.pg5.add_stream(p)
1680         self.pg_enable_capture(self.pg_interfaces)
1681         self.pg_start()
1682         capture = self.pg1.get_capture(1)
1683         p = capture[0]
1684         try:
1685             ip = p[IP]
1686             tcp = p[TCP]
1687             self.assertEqual(ip.src, self.nat_addr)
1688             self.assert_packet_checksums_valid(p)
1689             port = tcp.sport
1690         except:
1691             self.logger.error(ppp("Unexpected or invalid packet:", p))
1692             raise
1693
1694         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1695              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1696              TCP(sport=22, dport=port))
1697         self.pg1.add_stream(p)
1698         self.pg_enable_capture(self.pg_interfaces)
1699         self.pg_start()
1700         capture = self.pg5.get_capture(1)
1701         p = capture[0]
1702         try:
1703             ip = p[IP]
1704             tcp = p[TCP]
1705             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1706             self.assertEqual(tcp.dport, 2345)
1707             self.assert_packet_checksums_valid(p)
1708         except:
1709             self.logger.error(ppp("Unexpected or invalid packet:", p))
1710             raise
1711
1712     def test_multiple_vrf_3(self):
1713         """ Multiple VRF - client in VRF1, service in VRF0 """
1714
1715         external_addr = '1.2.3.4'
1716         external_port = 80
1717         local_port = 8080
1718         port = 0
1719
1720         flags = self.config_flags.NAT_IS_INSIDE
1721         self.vapi.nat44_interface_add_del_feature(
1722             sw_if_index=self.pg0.sw_if_index,
1723             is_add=1)
1724         self.vapi.nat44_interface_add_del_feature(
1725             sw_if_index=self.pg0.sw_if_index,
1726             is_add=1, flags=flags)
1727         self.vapi.nat44_interface_add_del_feature(
1728             sw_if_index=self.pg6.sw_if_index,
1729             is_add=1)
1730         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1731         self.nat_add_static_mapping(
1732             self.pg0.remote_ip4,
1733             external_sw_if_index=self.pg0.sw_if_index,
1734             local_port=local_port,
1735             vrf_id=0,
1736             external_port=external_port,
1737             proto=IP_PROTOS.tcp,
1738             flags=flags
1739         )
1740
1741         # from client VRF1 to service VRF0
1742         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1743              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1744              TCP(sport=12346, dport=external_port))
1745         self.pg6.add_stream(p)
1746         self.pg_enable_capture(self.pg_interfaces)
1747         self.pg_start()
1748         capture = self.pg0.get_capture(1)
1749         p = capture[0]
1750         try:
1751             ip = p[IP]
1752             tcp = p[TCP]
1753             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1754             self.assertEqual(tcp.dport, local_port)
1755             self.assert_packet_checksums_valid(p)
1756         except:
1757             self.logger.error(ppp("Unexpected or invalid packet:", p))
1758             raise
1759
1760         # from service VRF0 back to client VRF1
1761         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1762              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1763              TCP(sport=local_port, dport=12346))
1764         self.pg0.add_stream(p)
1765         self.pg_enable_capture(self.pg_interfaces)
1766         self.pg_start()
1767         capture = self.pg6.get_capture(1)
1768         p = capture[0]
1769         try:
1770             ip = p[IP]
1771             tcp = p[TCP]
1772             self.assertEqual(ip.src, self.pg0.local_ip4)
1773             self.assertEqual(tcp.sport, external_port)
1774             self.assert_packet_checksums_valid(p)
1775         except:
1776             self.logger.error(ppp("Unexpected or invalid packet:", p))
1777             raise
1778
1779     def test_multiple_vrf_4(self):
1780         """ Multiple VRF - client in VRF0, service in VRF1 """
1781
1782         external_addr = '1.2.3.4'
1783         external_port = 80
1784         local_port = 8080
1785         port = 0
1786
1787         flags = self.config_flags.NAT_IS_INSIDE
1788         self.vapi.nat44_interface_add_del_feature(
1789             sw_if_index=self.pg0.sw_if_index,
1790             is_add=1)
1791         self.vapi.nat44_interface_add_del_feature(
1792             sw_if_index=self.pg0.sw_if_index,
1793             is_add=1, flags=flags)
1794         self.vapi.nat44_interface_add_del_feature(
1795             sw_if_index=self.pg5.sw_if_index,
1796             is_add=1)
1797         self.vapi.nat44_interface_add_del_feature(
1798             sw_if_index=self.pg5.sw_if_index,
1799             is_add=1, flags=flags)
1800         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1801         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1802                                     local_port, external_port, vrf_id=1,
1803                                     proto=IP_PROTOS.tcp, flags=flags)
1804
1805         # from client VRF0 to service VRF1
1806         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1807              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1808              TCP(sport=12347, dport=external_port))
1809         self.pg0.add_stream(p)
1810         self.pg_enable_capture(self.pg_interfaces)
1811         self.pg_start()
1812         capture = self.pg5.get_capture(1)
1813         p = capture[0]
1814         try:
1815             ip = p[IP]
1816             tcp = p[TCP]
1817             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1818             self.assertEqual(tcp.dport, local_port)
1819             self.assert_packet_checksums_valid(p)
1820         except:
1821             self.logger.error(ppp("Unexpected or invalid packet:", p))
1822             raise
1823
1824         # from service VRF1 back to client VRF0
1825         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1826              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1827              TCP(sport=local_port, dport=12347))
1828         self.pg5.add_stream(p)
1829         self.pg_enable_capture(self.pg_interfaces)
1830         self.pg_start()
1831         capture = self.pg0.get_capture(1)
1832         p = capture[0]
1833         try:
1834             ip = p[IP]
1835             tcp = p[TCP]
1836             self.assertEqual(ip.src, external_addr)
1837             self.assertEqual(tcp.sport, external_port)
1838             self.assert_packet_checksums_valid(p)
1839         except:
1840             self.logger.error(ppp("Unexpected or invalid packet:", p))
1841             raise
1842
1843     def test_multiple_vrf_5(self):
1844         """ Multiple VRF - forwarding - no translation """
1845
1846         external_addr = '1.2.3.4'
1847         external_port = 80
1848         local_port = 8080
1849         port = 0
1850
1851         self.vapi.nat44_forwarding_enable_disable(enable=1)
1852         flags = self.config_flags.NAT_IS_INSIDE
1853         self.vapi.nat44_interface_add_del_feature(
1854             sw_if_index=self.pg0.sw_if_index,
1855             is_add=1)
1856         self.vapi.nat44_interface_add_del_feature(
1857             sw_if_index=self.pg0.sw_if_index,
1858             is_add=1, flags=flags)
1859         self.vapi.nat44_interface_add_del_feature(
1860             sw_if_index=self.pg5.sw_if_index,
1861             is_add=1)
1862         self.vapi.nat44_interface_add_del_feature(
1863             sw_if_index=self.pg5.sw_if_index,
1864             is_add=1, flags=flags)
1865         self.vapi.nat44_interface_add_del_feature(
1866             sw_if_index=self.pg6.sw_if_index,
1867             is_add=1)
1868         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1869         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1870                                     local_port, external_port, vrf_id=1,
1871                                     proto=IP_PROTOS.tcp, flags=flags)
1872         self.nat_add_static_mapping(
1873             self.pg0.remote_ip4,
1874             external_sw_if_index=self.pg0.sw_if_index,
1875             local_port=local_port,
1876             vrf_id=0,
1877             external_port=external_port,
1878             proto=IP_PROTOS.tcp,
1879             flags=flags
1880         )
1881
1882         # from client to server (both VRF1, no translation)
1883         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1884              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1885              TCP(sport=12348, dport=local_port))
1886         self.pg6.add_stream(p)
1887         self.pg_enable_capture(self.pg_interfaces)
1888         self.pg_start()
1889         capture = self.pg5.get_capture(1)
1890         p = capture[0]
1891         try:
1892             ip = p[IP]
1893             tcp = p[TCP]
1894             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1895             self.assertEqual(tcp.dport, local_port)
1896             self.assert_packet_checksums_valid(p)
1897         except:
1898             self.logger.error(ppp("Unexpected or invalid packet:", p))
1899             raise
1900
1901         # from server back to client (both VRF1, no translation)
1902         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1903              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1904              TCP(sport=local_port, dport=12348))
1905         self.pg5.add_stream(p)
1906         self.pg_enable_capture(self.pg_interfaces)
1907         self.pg_start()
1908         capture = self.pg6.get_capture(1)
1909         p = capture[0]
1910         try:
1911             ip = p[IP]
1912             tcp = p[TCP]
1913             self.assertEqual(ip.src, self.pg5.remote_ip4)
1914             self.assertEqual(tcp.sport, local_port)
1915             self.assert_packet_checksums_valid(p)
1916         except:
1917             self.logger.error(ppp("Unexpected or invalid packet:", p))
1918             raise
1919
1920         # from client VRF1 to server VRF0 (no translation)
1921         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1922              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1923              TCP(sport=local_port, dport=12349))
1924         self.pg0.add_stream(p)
1925         self.pg_enable_capture(self.pg_interfaces)
1926         self.pg_start()
1927         capture = self.pg6.get_capture(1)
1928         p = capture[0]
1929         try:
1930             ip = p[IP]
1931             tcp = p[TCP]
1932             self.assertEqual(ip.src, self.pg0.remote_ip4)
1933             self.assertEqual(tcp.sport, local_port)
1934             self.assert_packet_checksums_valid(p)
1935         except:
1936             self.logger.error(ppp("Unexpected or invalid packet:", p))
1937             raise
1938
1939         # from server VRF0 back to client VRF1 (no translation)
1940         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1941              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1942              TCP(sport=local_port, dport=12349))
1943         self.pg0.add_stream(p)
1944         self.pg_enable_capture(self.pg_interfaces)
1945         self.pg_start()
1946         capture = self.pg6.get_capture(1)
1947         p = capture[0]
1948         try:
1949             ip = p[IP]
1950             tcp = p[TCP]
1951             self.assertEqual(ip.src, self.pg0.remote_ip4)
1952             self.assertEqual(tcp.sport, local_port)
1953             self.assert_packet_checksums_valid(p)
1954         except:
1955             self.logger.error(ppp("Unexpected or invalid packet:", p))
1956             raise
1957
1958         # from client VRF0 to server VRF1 (no translation)
1959         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1960              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
1961              TCP(sport=12344, dport=local_port))
1962         self.pg0.add_stream(p)
1963         self.pg_enable_capture(self.pg_interfaces)
1964         self.pg_start()
1965         capture = self.pg5.get_capture(1)
1966         p = capture[0]
1967         try:
1968             ip = p[IP]
1969             tcp = p[TCP]
1970             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1971             self.assertEqual(tcp.dport, local_port)
1972             self.assert_packet_checksums_valid(p)
1973         except:
1974             self.logger.error(ppp("Unexpected or invalid packet:", p))
1975             raise
1976
1977         # from server VRF1 back to client VRF0 (no translation)
1978         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1979              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1980              TCP(sport=local_port, dport=12344))
1981         self.pg5.add_stream(p)
1982         self.pg_enable_capture(self.pg_interfaces)
1983         self.pg_start()
1984         capture = self.pg0.get_capture(1)
1985         p = capture[0]
1986         try:
1987             ip = p[IP]
1988             tcp = p[TCP]
1989             self.assertEqual(ip.src, self.pg5.remote_ip4)
1990             self.assertEqual(tcp.sport, local_port)
1991             self.assert_packet_checksums_valid(p)
1992         except:
1993             self.logger.error(ppp("Unexpected or invalid packet:", p))
1994             raise
1995
1996     def test_outside_address_distribution(self):
1997         """ Outside address distribution based on source address """
1998
1999         x = 100
2000         nat_addresses = []
2001
2002         for i in range(1, x):
2003             a = "10.0.0.%d" % i
2004             nat_addresses.append(a)
2005
2006         self.nat_add_inside_interface(self.pg0)
2007         self.nat_add_outside_interface(self.pg1)
2008
2009         self.vapi.nat44_add_del_address_range(
2010             first_ip_address=nat_addresses[0],
2011             last_ip_address=nat_addresses[-1],
2012             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2013
2014         self.pg0.generate_remote_hosts(x)
2015
2016         pkts = []
2017         for i in range(x):
2018             info = self.create_packet_info(self.pg0, self.pg1)
2019             payload = self.info_to_payload(info)
2020             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2021                  IP(src=self.pg0.remote_hosts[i].ip4,
2022                      dst=self.pg1.remote_ip4) /
2023                  UDP(sport=7000+i, dport=8000+i) /
2024                  Raw(payload))
2025             info.data = p
2026             pkts.append(p)
2027
2028         self.pg0.add_stream(pkts)
2029         self.pg_enable_capture(self.pg_interfaces)
2030         self.pg_start()
2031         recvd = self.pg1.get_capture(len(pkts))
2032         for p_recvd in recvd:
2033             payload_info = self.payload_to_info(p_recvd[Raw])
2034             packet_index = payload_info.index
2035             info = self._packet_infos[packet_index]
2036             self.assertTrue(info is not None)
2037             self.assertEqual(packet_index, info.index)
2038             p_sent = info.data
2039             packed = socket.inet_aton(p_sent[IP].src)
2040             numeric = struct.unpack("!L", packed)[0]
2041             numeric = socket.htonl(numeric)
2042             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2043             self.assertEqual(
2044                 a, p_recvd[IP].src,
2045                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2046                 % (p_sent[IP].src, p_recvd[IP].src, a))
2047
2048
2049 class TestNAT44EDMW(TestNAT44ED):
2050     """ NAT44ED MW Test Case """
2051     vpp_worker_count = 4
2052     max_sessions = 5000
2053
2054     @unittest.skip('MW fix required')
2055     def test_users_dump(self):
2056         """ NAT44ED API test - nat44_user_dump """
2057
2058     @unittest.skip('MW fix required')
2059     def test_frag_out_of_order_do_not_translate(self):
2060         """ NAT44ED don't translate fragments arriving out of order """
2061
2062     @unittest.skip('MW fix required')
2063     def test_forwarding(self):
2064         """ NAT44ED forwarding test """
2065
2066     @unittest.skip('MW fix required')
2067     def test_twice_nat(self):
2068         """ NAT44ED Twice NAT """
2069
2070     @unittest.skip('MW fix required')
2071     def test_twice_nat_lb(self):
2072         """ NAT44ED Twice NAT local service load balancing """
2073
2074     @unittest.skip('MW fix required')
2075     def test_output_feature(self):
2076         """ NAT44ED interface output feature (in2out postrouting) """
2077
2078     @unittest.skip('MW fix required')
2079     def test_static_with_port_out2(self):
2080         """ NAT44ED 1:1 NAPT asymmetrical rule """
2081
2082     @unittest.skip('MW fix required')
2083     def test_output_feature_and_service2(self):
2084         """ NAT44ED interface output feature and service host direct access """
2085
2086     @unittest.skip('MW fix required')
2087     def test_static_lb(self):
2088         """ NAT44ED local service load balancing """
2089
2090     @unittest.skip('MW fix required')
2091     def test_static_lb_2(self):
2092         """ NAT44ED local service load balancing (asymmetrical rule) """
2093
2094     @unittest.skip('MW fix required')
2095     def test_lb_affinity(self):
2096         """ NAT44ED local service load balancing affinity """
2097
2098     @unittest.skip('MW fix required')
2099     def test_multiple_vrf(self):
2100         """ NAT44ED Multiple VRF setup """
2101
2102     @unittest.skip('MW fix required')
2103     def test_self_twice_nat_positive(self):
2104         """ NAT44ED Self Twice NAT (positive test) """
2105
2106     @unittest.skip('MW fix required')
2107     def test_self_twice_nat_lb_positive(self):
2108         """ NAT44ED Self Twice NAT local service load balancing (positive test)
2109         """
2110
2111     def test_dynamic(self):
2112         """ NAT44ED dynamic translation test """
2113         pkt_count = 1500
2114         tcp_port_offset = 20
2115         udp_port_offset = 20
2116         icmp_id_offset = 20
2117
2118         self.nat_add_address(self.nat_addr)
2119         self.nat_add_inside_interface(self.pg0)
2120         self.nat_add_outside_interface(self.pg1)
2121
2122         # in2out
2123         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2124         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2125         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2126         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2127
2128         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2129
2130         for i in range(pkt_count):
2131             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2132                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2133                  TCP(sport=tcp_port_offset + i, dport=20))
2134             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2135
2136             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2137                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2138                  UDP(sport=udp_port_offset + i, dport=20))
2139             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2140
2141             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2142                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2143                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2144             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2145
2146         for i in range(0, self.vpp_worker_count):
2147             if len(i2o_pkts[i]) > 0:
2148                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2149
2150         self.pg_enable_capture(self.pg_interfaces)
2151         self.pg_start()
2152         capture = self.pg1.get_capture(pkt_count * 3)
2153
2154         if_idx = self.pg0.sw_if_index
2155         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2156         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2157         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2158         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2159
2160         self.assertEqual(
2161             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2162         self.assertEqual(
2163             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2164         self.assertEqual(
2165             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2166         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2167
2168         self.logger.info(self.vapi.cli("show trace"))
2169
2170         # out2in
2171         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2172         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2173         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2174         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2175
2176         recvd_tcp_ports = set()
2177         recvd_udp_ports = set()
2178         recvd_icmp_ids = set()
2179
2180         for p in capture:
2181             if TCP in p:
2182                 recvd_tcp_ports.add(p[TCP].sport)
2183             if UDP in p:
2184                 recvd_udp_ports.add(p[UDP].sport)
2185             if ICMP in p:
2186                 recvd_icmp_ids.add(p[ICMP].id)
2187
2188         recvd_tcp_ports = list(recvd_tcp_ports)
2189         recvd_udp_ports = list(recvd_udp_ports)
2190         recvd_icmp_ids = list(recvd_icmp_ids)
2191
2192         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2193         for i in range(pkt_count):
2194             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2195                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2196                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2197             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2198
2199             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2200                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2201                  UDP(dport=choice(recvd_udp_ports), sport=20))
2202             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2203
2204             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2205                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2206                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2207             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2208
2209         for i in range(0, self.vpp_worker_count):
2210             if len(o2i_pkts[i]) > 0:
2211                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2212
2213         self.pg_enable_capture(self.pg_interfaces)
2214         self.pg_start()
2215         capture = self.pg0.get_capture(pkt_count * 3)
2216         for packet in capture:
2217             try:
2218                 self.assert_packet_checksums_valid(packet)
2219                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2220                 if packet.haslayer(TCP):
2221                     self.assert_in_range(
2222                         packet[TCP].dport, tcp_port_offset,
2223                         tcp_port_offset + pkt_count, "dst TCP port")
2224                 elif packet.haslayer(UDP):
2225                     self.assert_in_range(
2226                         packet[UDP].dport, udp_port_offset,
2227                         udp_port_offset + pkt_count, "dst UDP port")
2228                 else:
2229                     self.assert_in_range(
2230                         packet[ICMP].id, icmp_id_offset,
2231                         icmp_id_offset + pkt_count, "ICMP id")
2232             except:
2233                 self.logger.error(ppp("Unexpected or invalid packet "
2234                                       "(inside network):", packet))
2235                 raise
2236
2237         if_idx = self.pg1.sw_if_index
2238         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2239         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2240         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2241         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2242
2243         self.assertEqual(
2244             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2245         self.assertEqual(
2246             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2247         self.assertEqual(
2248             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2249         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2250
2251         sc = self.statistics['/nat44-ed/total-sessions']
2252         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2253                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2254
2255     def test_frag_in_order(self):
2256         """ NAT44ED translate fragments arriving in order """
2257
2258         self.nat_add_address(self.nat_addr)
2259         self.nat_add_inside_interface(self.pg0)
2260         self.nat_add_outside_interface(self.pg1)
2261
2262         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2263         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2264         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2265
2266     def test_frag_in_order_do_not_translate(self):
2267         """ NAT44ED don't translate fragments arriving in order """
2268
2269         self.nat_add_address(self.nat_addr)
2270         self.nat_add_inside_interface(self.pg0)
2271         self.nat_add_outside_interface(self.pg1)
2272         self.vapi.nat44_forwarding_enable_disable(enable=True)
2273
2274         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2275
2276     def test_frag_out_of_order(self):
2277         """ NAT44ED translate fragments arriving out of order """
2278
2279         self.nat_add_address(self.nat_addr)
2280         self.nat_add_inside_interface(self.pg0)
2281         self.nat_add_outside_interface(self.pg1)
2282
2283         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2284         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2285         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2286
2287     def test_frag_in_order_in_plus_out(self):
2288         """ NAT44ED in+out interface fragments in order """
2289
2290         in_port = self.random_port()
2291         out_port = self.random_port()
2292
2293         self.nat_add_address(self.nat_addr)
2294         self.nat_add_inside_interface(self.pg0)
2295         self.nat_add_outside_interface(self.pg0)
2296         self.nat_add_inside_interface(self.pg1)
2297         self.nat_add_outside_interface(self.pg1)
2298
2299         # add static mappings for server
2300         self.nat_add_static_mapping(self.server_addr,
2301                                     self.nat_addr,
2302                                     in_port,
2303                                     out_port,
2304                                     proto=IP_PROTOS.tcp)
2305         self.nat_add_static_mapping(self.server_addr,
2306                                     self.nat_addr,
2307                                     in_port,
2308                                     out_port,
2309                                     proto=IP_PROTOS.udp)
2310         self.nat_add_static_mapping(self.server_addr,
2311                                     self.nat_addr,
2312                                     proto=IP_PROTOS.icmp)
2313
2314         # run tests for each protocol
2315         self.frag_in_order_in_plus_out(self.server_addr,
2316                                        self.nat_addr,
2317                                        in_port,
2318                                        out_port,
2319                                        IP_PROTOS.tcp)
2320         self.frag_in_order_in_plus_out(self.server_addr,
2321                                        self.nat_addr,
2322                                        in_port,
2323                                        out_port,
2324                                        IP_PROTOS.udp)
2325         self.frag_in_order_in_plus_out(self.server_addr,
2326                                        self.nat_addr,
2327                                        in_port,
2328                                        out_port,
2329                                        IP_PROTOS.icmp)
2330
2331     def test_frag_out_of_order_in_plus_out(self):
2332         """ NAT44ED in+out interface fragments out of order """
2333
2334         in_port = self.random_port()
2335         out_port = self.random_port()
2336
2337         self.nat_add_address(self.nat_addr)
2338         self.nat_add_inside_interface(self.pg0)
2339         self.nat_add_outside_interface(self.pg0)
2340         self.nat_add_inside_interface(self.pg1)
2341         self.nat_add_outside_interface(self.pg1)
2342
2343         # add static mappings for server
2344         self.nat_add_static_mapping(self.server_addr,
2345                                     self.nat_addr,
2346                                     in_port,
2347                                     out_port,
2348                                     proto=IP_PROTOS.tcp)
2349         self.nat_add_static_mapping(self.server_addr,
2350                                     self.nat_addr,
2351                                     in_port,
2352                                     out_port,
2353                                     proto=IP_PROTOS.udp)
2354         self.nat_add_static_mapping(self.server_addr,
2355                                     self.nat_addr,
2356                                     proto=IP_PROTOS.icmp)
2357
2358         # run tests for each protocol
2359         self.frag_out_of_order_in_plus_out(self.server_addr,
2360                                            self.nat_addr,
2361                                            in_port,
2362                                            out_port,
2363                                            IP_PROTOS.tcp)
2364         self.frag_out_of_order_in_plus_out(self.server_addr,
2365                                            self.nat_addr,
2366                                            in_port,
2367                                            out_port,
2368                                            IP_PROTOS.udp)
2369         self.frag_out_of_order_in_plus_out(self.server_addr,
2370                                            self.nat_addr,
2371                                            in_port,
2372                                            out_port,
2373                                            IP_PROTOS.icmp)
2374
2375     def test_reass_hairpinning(self):
2376         """ NAT44ED fragments hairpinning """
2377
2378         server_addr = self.pg0.remote_hosts[1].ip4
2379
2380         host_in_port = self.random_port()
2381         server_in_port = self.random_port()
2382         server_out_port = self.random_port()
2383
2384         self.nat_add_address(self.nat_addr)
2385         self.nat_add_inside_interface(self.pg0)
2386         self.nat_add_outside_interface(self.pg1)
2387
2388         # add static mapping for server
2389         self.nat_add_static_mapping(server_addr, self.nat_addr,
2390                                     server_in_port, server_out_port,
2391                                     proto=IP_PROTOS.tcp)
2392         self.nat_add_static_mapping(server_addr, self.nat_addr,
2393                                     server_in_port, server_out_port,
2394                                     proto=IP_PROTOS.udp)
2395         self.nat_add_static_mapping(server_addr, self.nat_addr)
2396
2397         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2398                                host_in_port, proto=IP_PROTOS.tcp,
2399                                ignore_port=True)
2400         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2401                                host_in_port, proto=IP_PROTOS.udp,
2402                                ignore_port=True)
2403         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2404                                host_in_port, proto=IP_PROTOS.icmp,
2405                                ignore_port=True)
2406
2407     def test_session_limit_per_vrf(self):
2408         """ NAT44ED per vrf session limit """
2409
2410         inside = self.pg0
2411         inside_vrf10 = self.pg2
2412         outside = self.pg1
2413
2414         limit = 5
2415
2416         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2417         # non existing vrf_id makes process core dump
2418         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2419
2420         self.nat_add_inside_interface(inside)
2421         self.nat_add_inside_interface(inside_vrf10)
2422         self.nat_add_outside_interface(outside)
2423
2424         # vrf independent
2425         self.nat_add_interface_address(outside)
2426
2427         # BUG: causing core dump - when bad vrf_id is specified
2428         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2429
2430         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2431         inside_vrf10.add_stream(stream)
2432
2433         self.pg_enable_capture(self.pg_interfaces)
2434         self.pg_start()
2435
2436         capture = outside.get_capture(limit)
2437
2438         stream = self.create_tcp_stream(inside, outside, limit * 2)
2439         inside.add_stream(stream)
2440
2441         self.pg_enable_capture(self.pg_interfaces)
2442         self.pg_start()
2443
2444         capture = outside.get_capture(len(stream))
2445
2446     def test_show_max_translations(self):
2447         """ NAT44ED API test - max translations per thread """
2448         nat_config = self.vapi.nat_show_config_2()
2449         self.assertEqual(self.max_sessions,
2450                          nat_config.max_translations_per_thread)
2451
2452     def test_lru_cleanup(self):
2453         """ NAT44ED LRU cleanup algorithm """
2454
2455         self.nat_add_address(self.nat_addr)
2456         self.nat_add_inside_interface(self.pg0)
2457         self.nat_add_outside_interface(self.pg1)
2458
2459         self.vapi.nat_set_timeouts(
2460             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2461
2462         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2463         pkts = []
2464         for i in range(0, self.max_sessions - 1):
2465             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2466                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2467                  UDP(sport=7000+i, dport=80))
2468             pkts.append(p)
2469
2470         self.pg0.add_stream(pkts)
2471         self.pg_enable_capture(self.pg_interfaces)
2472         self.pg_start()
2473         self.pg1.get_capture(len(pkts))
2474         self.sleep(1.5, "wait for timeouts")
2475
2476         pkts = []
2477         for i in range(0, self.max_sessions - 1):
2478             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2479                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2480                  ICMP(id=8000+i, type='echo-request'))
2481             pkts.append(p)
2482
2483         self.pg0.add_stream(pkts)
2484         self.pg_enable_capture(self.pg_interfaces)
2485         self.pg_start()
2486         self.pg1.get_capture(len(pkts))
2487
2488     def test_session_rst_timeout(self):
2489         """ NAT44ED session RST timeouts """
2490
2491         self.nat_add_address(self.nat_addr)
2492         self.nat_add_inside_interface(self.pg0)
2493         self.nat_add_outside_interface(self.pg1)
2494
2495         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2496                                    tcp_transitory=5, icmp=60)
2497
2498         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2499                               self.tcp_external_port)
2500         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2501              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2502              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2503                  flags="R"))
2504         self.pg0.add_stream(p)
2505         self.pg_enable_capture(self.pg_interfaces)
2506         self.pg_start()
2507         self.pg1.get_capture(1)
2508
2509         self.sleep(6)
2510
2511         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2512              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2513              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2514                  flags="S"))
2515         self.pg0.add_stream(p)
2516         self.pg_enable_capture(self.pg_interfaces)
2517         self.pg_start()
2518         self.pg1.get_capture(1)
2519
2520     def test_dynamic_out_of_ports(self):
2521         """ NAT44ED dynamic translation test: out of ports """
2522
2523         self.nat_add_inside_interface(self.pg0)
2524         self.nat_add_outside_interface(self.pg1)
2525
2526         # in2out and no NAT addresses added
2527         err_old = self.statistics.get_err_counter(
2528             '/err/nat44-ed-in2out-slowpath/out of ports')
2529
2530         pkts = self.create_stream_in(self.pg0, self.pg1)
2531         self.pg0.add_stream(pkts)
2532         self.pg_enable_capture(self.pg_interfaces)
2533         self.pg_start()
2534         self.pg1.get_capture(0, timeout=1)
2535
2536         err_new = self.statistics.get_err_counter(
2537             '/err/nat44-ed-in2out-slowpath/out of ports')
2538
2539         self.assertEqual(err_new - err_old, len(pkts))
2540
2541         # in2out after NAT addresses added
2542         self.nat_add_address(self.nat_addr)
2543
2544         err_old = self.statistics.get_err_counter(
2545             '/err/nat44-ed-in2out-slowpath/out of ports')
2546
2547         pkts = self.create_stream_in(self.pg0, self.pg1)
2548         self.pg0.add_stream(pkts)
2549         self.pg_enable_capture(self.pg_interfaces)
2550         self.pg_start()
2551         capture = self.pg1.get_capture(len(pkts))
2552         self.verify_capture_out(capture, ignore_port=True)
2553
2554         err_new = self.statistics.get_err_counter(
2555             '/err/nat44-ed-in2out-slowpath/out of ports')
2556
2557         self.assertEqual(err_new, err_old)
2558
2559     def test_unknown_proto(self):
2560         """ NAT44ED translate packet with unknown protocol """
2561
2562         self.nat_add_address(self.nat_addr)
2563         self.nat_add_inside_interface(self.pg0)
2564         self.nat_add_outside_interface(self.pg1)
2565
2566         # in2out
2567         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2568              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2569              TCP(sport=self.tcp_port_in, dport=20))
2570         self.pg0.add_stream(p)
2571         self.pg_enable_capture(self.pg_interfaces)
2572         self.pg_start()
2573         p = self.pg1.get_capture(1)
2574
2575         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2576              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2577              GRE() /
2578              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2579              TCP(sport=1234, dport=1234))
2580         self.pg0.add_stream(p)
2581         self.pg_enable_capture(self.pg_interfaces)
2582         self.pg_start()
2583         p = self.pg1.get_capture(1)
2584         packet = p[0]
2585         try:
2586             self.assertEqual(packet[IP].src, self.nat_addr)
2587             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2588             self.assertEqual(packet.haslayer(GRE), 1)
2589             self.assert_packet_checksums_valid(packet)
2590         except:
2591             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2592             raise
2593
2594         # out2in
2595         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2596              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2597              GRE() /
2598              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2599              TCP(sport=1234, dport=1234))
2600         self.pg1.add_stream(p)
2601         self.pg_enable_capture(self.pg_interfaces)
2602         self.pg_start()
2603         p = self.pg0.get_capture(1)
2604         packet = p[0]
2605         try:
2606             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2607             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2608             self.assertEqual(packet.haslayer(GRE), 1)
2609             self.assert_packet_checksums_valid(packet)
2610         except:
2611             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2612             raise
2613
2614     def test_hairpinning_unknown_proto(self):
2615         """ NAT44ED translate packet with unknown protocol - hairpinning """
2616         host = self.pg0.remote_hosts[0]
2617         server = self.pg0.remote_hosts[1]
2618         host_in_port = 1234
2619         server_out_port = 8765
2620         server_nat_ip = "10.0.0.11"
2621
2622         self.nat_add_address(self.nat_addr)
2623         self.nat_add_inside_interface(self.pg0)
2624         self.nat_add_outside_interface(self.pg1)
2625
2626         # add static mapping for server
2627         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2628
2629         # host to server
2630         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2631              IP(src=host.ip4, dst=server_nat_ip) /
2632              TCP(sport=host_in_port, dport=server_out_port))
2633         self.pg0.add_stream(p)
2634         self.pg_enable_capture(self.pg_interfaces)
2635         self.pg_start()
2636         self.pg0.get_capture(1)
2637
2638         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2639              IP(src=host.ip4, dst=server_nat_ip) /
2640              GRE() /
2641              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2642              TCP(sport=1234, dport=1234))
2643         self.pg0.add_stream(p)
2644         self.pg_enable_capture(self.pg_interfaces)
2645         self.pg_start()
2646         p = self.pg0.get_capture(1)
2647         packet = p[0]
2648         try:
2649             self.assertEqual(packet[IP].src, self.nat_addr)
2650             self.assertEqual(packet[IP].dst, server.ip4)
2651             self.assertEqual(packet.haslayer(GRE), 1)
2652             self.assert_packet_checksums_valid(packet)
2653         except:
2654             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2655             raise
2656
2657         # server to host
2658         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2659              IP(src=server.ip4, dst=self.nat_addr) /
2660              GRE() /
2661              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2662              TCP(sport=1234, dport=1234))
2663         self.pg0.add_stream(p)
2664         self.pg_enable_capture(self.pg_interfaces)
2665         self.pg_start()
2666         p = self.pg0.get_capture(1)
2667         packet = p[0]
2668         try:
2669             self.assertEqual(packet[IP].src, server_nat_ip)
2670             self.assertEqual(packet[IP].dst, host.ip4)
2671             self.assertEqual(packet.haslayer(GRE), 1)
2672             self.assert_packet_checksums_valid(packet)
2673         except:
2674             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2675             raise
2676
2677     def test_output_feature_and_service(self):
2678         """ NAT44ED interface output feature and services """
2679         external_addr = '1.2.3.4'
2680         external_port = 80
2681         local_port = 8080
2682
2683         self.vapi.nat44_forwarding_enable_disable(enable=1)
2684         self.nat_add_address(self.nat_addr)
2685         flags = self.config_flags.NAT_IS_ADDR_ONLY
2686         self.vapi.nat44_add_del_identity_mapping(
2687             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2688             flags=flags, is_add=1)
2689         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2690         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2691                                     local_port, external_port,
2692                                     proto=IP_PROTOS.tcp, flags=flags)
2693
2694         self.nat_add_inside_interface(self.pg0)
2695         self.nat_add_outside_interface(self.pg0)
2696         self.vapi.nat44_interface_add_del_output_feature(
2697             sw_if_index=self.pg1.sw_if_index, is_add=1)
2698
2699         # from client to service
2700         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2701              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2702              TCP(sport=12345, dport=external_port))
2703         self.pg1.add_stream(p)
2704         self.pg_enable_capture(self.pg_interfaces)
2705         self.pg_start()
2706         capture = self.pg0.get_capture(1)
2707         p = capture[0]
2708         try:
2709             ip = p[IP]
2710             tcp = p[TCP]
2711             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2712             self.assertEqual(tcp.dport, local_port)
2713             self.assert_packet_checksums_valid(p)
2714         except:
2715             self.logger.error(ppp("Unexpected or invalid packet:", p))
2716             raise
2717
2718         # from service back to client
2719         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2720              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2721              TCP(sport=local_port, dport=12345))
2722         self.pg0.add_stream(p)
2723         self.pg_enable_capture(self.pg_interfaces)
2724         self.pg_start()
2725         capture = self.pg1.get_capture(1)
2726         p = capture[0]
2727         try:
2728             ip = p[IP]
2729             tcp = p[TCP]
2730             self.assertEqual(ip.src, external_addr)
2731             self.assertEqual(tcp.sport, external_port)
2732             self.assert_packet_checksums_valid(p)
2733         except:
2734             self.logger.error(ppp("Unexpected or invalid packet:", p))
2735             raise
2736
2737         # from local network host to external network
2738         pkts = self.create_stream_in(self.pg0, self.pg1)
2739         self.pg0.add_stream(pkts)
2740         self.pg_enable_capture(self.pg_interfaces)
2741         self.pg_start()
2742         capture = self.pg1.get_capture(len(pkts))
2743         self.verify_capture_out(capture, ignore_port=True)
2744         pkts = self.create_stream_in(self.pg0, self.pg1)
2745         self.pg0.add_stream(pkts)
2746         self.pg_enable_capture(self.pg_interfaces)
2747         self.pg_start()
2748         capture = self.pg1.get_capture(len(pkts))
2749         self.verify_capture_out(capture, ignore_port=True)
2750
2751         # from external network back to local network host
2752         pkts = self.create_stream_out(self.pg1)
2753         self.pg1.add_stream(pkts)
2754         self.pg_enable_capture(self.pg_interfaces)
2755         self.pg_start()
2756         capture = self.pg0.get_capture(len(pkts))
2757         self.verify_capture_in(capture, self.pg0)
2758
2759     def test_output_feature_and_service3(self):
2760         """ NAT44ED interface output feature and DST NAT """
2761         external_addr = '1.2.3.4'
2762         external_port = 80
2763         local_port = 8080
2764
2765         self.vapi.nat44_forwarding_enable_disable(enable=1)
2766         self.nat_add_address(self.nat_addr)
2767         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2768         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2769                                     local_port, external_port,
2770                                     proto=IP_PROTOS.tcp, flags=flags)
2771
2772         self.nat_add_inside_interface(self.pg0)
2773         self.nat_add_outside_interface(self.pg0)
2774         self.vapi.nat44_interface_add_del_output_feature(
2775             sw_if_index=self.pg1.sw_if_index, is_add=1)
2776
2777         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2778              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2779              TCP(sport=12345, dport=external_port))
2780         self.pg0.add_stream(p)
2781         self.pg_enable_capture(self.pg_interfaces)
2782         self.pg_start()
2783         capture = self.pg1.get_capture(1)
2784         p = capture[0]
2785         try:
2786             ip = p[IP]
2787             tcp = p[TCP]
2788             self.assertEqual(ip.src, self.pg0.remote_ip4)
2789             self.assertEqual(tcp.sport, 12345)
2790             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2791             self.assertEqual(tcp.dport, local_port)
2792             self.assert_packet_checksums_valid(p)
2793         except:
2794             self.logger.error(ppp("Unexpected or invalid packet:", p))
2795             raise
2796
2797         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2798              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2799              TCP(sport=local_port, dport=12345))
2800         self.pg1.add_stream(p)
2801         self.pg_enable_capture(self.pg_interfaces)
2802         self.pg_start()
2803         capture = self.pg0.get_capture(1)
2804         p = capture[0]
2805         try:
2806             ip = p[IP]
2807             tcp = p[TCP]
2808             self.assertEqual(ip.src, external_addr)
2809             self.assertEqual(tcp.sport, external_port)
2810             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2811             self.assertEqual(tcp.dport, 12345)
2812             self.assert_packet_checksums_valid(p)
2813         except:
2814             self.logger.error(ppp("Unexpected or invalid packet:", p))
2815             raise
2816
2817     def test_self_twice_nat_lb_negative(self):
2818         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2819         """
2820         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2821                               client_id=2)
2822
2823     def test_self_twice_nat_negative(self):
2824         """ NAT44ED Self Twice NAT (negative test) """
2825         self.twice_nat_common(self_twice_nat=True)
2826
2827     def test_static_lb_multi_clients(self):
2828         """ NAT44ED local service load balancing - multiple clients"""
2829
2830         external_addr = self.nat_addr
2831         external_port = 80
2832         local_port = 8080
2833         server1 = self.pg0.remote_hosts[0]
2834         server2 = self.pg0.remote_hosts[1]
2835         server3 = self.pg0.remote_hosts[2]
2836
2837         locals = [{'addr': server1.ip4,
2838                    'port': local_port,
2839                    'probability': 90,
2840                    'vrf_id': 0},
2841                   {'addr': server2.ip4,
2842                    'port': local_port,
2843                    'probability': 10,
2844                    'vrf_id': 0}]
2845
2846         flags = self.config_flags.NAT_IS_INSIDE
2847         self.vapi.nat44_interface_add_del_feature(
2848             sw_if_index=self.pg0.sw_if_index,
2849             flags=flags, is_add=1)
2850         self.vapi.nat44_interface_add_del_feature(
2851             sw_if_index=self.pg1.sw_if_index,
2852             is_add=1)
2853
2854         self.nat_add_address(self.nat_addr)
2855         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2856                                                   external_addr=external_addr,
2857                                                   external_port=external_port,
2858                                                   protocol=IP_PROTOS.tcp,
2859                                                   local_num=len(locals),
2860                                                   locals=locals)
2861
2862         server1_n = 0
2863         server2_n = 0
2864         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2865         pkts = []
2866         for client in clients:
2867             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2868                  IP(src=client, dst=self.nat_addr) /
2869                  TCP(sport=12345, dport=external_port))
2870             pkts.append(p)
2871         self.pg1.add_stream(pkts)
2872         self.pg_enable_capture(self.pg_interfaces)
2873         self.pg_start()
2874         capture = self.pg0.get_capture(len(pkts))
2875         for p in capture:
2876             if p[IP].dst == server1.ip4:
2877                 server1_n += 1
2878             else:
2879                 server2_n += 1
2880         self.assertGreaterEqual(server1_n, server2_n)
2881
2882         local = {
2883             'addr': server3.ip4,
2884             'port': local_port,
2885             'probability': 20,
2886             'vrf_id': 0
2887         }
2888
2889         # add new back-end
2890         self.vapi.nat44_lb_static_mapping_add_del_local(
2891             is_add=1,
2892             external_addr=external_addr,
2893             external_port=external_port,
2894             local=local,
2895             protocol=IP_PROTOS.tcp)
2896         server1_n = 0
2897         server2_n = 0
2898         server3_n = 0
2899         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2900         pkts = []
2901         for client in clients:
2902             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2903                  IP(src=client, dst=self.nat_addr) /
2904                  TCP(sport=12346, dport=external_port))
2905             pkts.append(p)
2906         self.assertGreater(len(pkts), 0)
2907         self.pg1.add_stream(pkts)
2908         self.pg_enable_capture(self.pg_interfaces)
2909         self.pg_start()
2910         capture = self.pg0.get_capture(len(pkts))
2911         for p in capture:
2912             if p[IP].dst == server1.ip4:
2913                 server1_n += 1
2914             elif p[IP].dst == server2.ip4:
2915                 server2_n += 1
2916             else:
2917                 server3_n += 1
2918         self.assertGreater(server1_n, 0)
2919         self.assertGreater(server2_n, 0)
2920         self.assertGreater(server3_n, 0)
2921
2922         local = {
2923             'addr': server2.ip4,
2924             'port': local_port,
2925             'probability': 10,
2926             'vrf_id': 0
2927         }
2928
2929         # remove one back-end
2930         self.vapi.nat44_lb_static_mapping_add_del_local(
2931             is_add=0,
2932             external_addr=external_addr,
2933             external_port=external_port,
2934             local=local,
2935             protocol=IP_PROTOS.tcp)
2936         server1_n = 0
2937         server2_n = 0
2938         server3_n = 0
2939         self.pg1.add_stream(pkts)
2940         self.pg_enable_capture(self.pg_interfaces)
2941         self.pg_start()
2942         capture = self.pg0.get_capture(len(pkts))
2943         for p in capture:
2944             if p[IP].dst == server1.ip4:
2945                 server1_n += 1
2946             elif p[IP].dst == server2.ip4:
2947                 server2_n += 1
2948             else:
2949                 server3_n += 1
2950         self.assertGreater(server1_n, 0)
2951         self.assertEqual(server2_n, 0)
2952         self.assertGreater(server3_n, 0)
2953
2954     def test_syslog_sess(self):
2955         """ NAT44ED Test syslog session creation and deletion """
2956         self.vapi.syslog_set_filter(
2957             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
2958         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
2959
2960         self.nat_add_address(self.nat_addr)
2961         self.nat_add_inside_interface(self.pg0)
2962         self.nat_add_outside_interface(self.pg1)
2963
2964         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2965              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2966              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
2967         self.pg0.add_stream(p)
2968         self.pg_enable_capture(self.pg_interfaces)
2969         self.pg_start()
2970         capture = self.pg1.get_capture(1)
2971         self.tcp_port_out = capture[0][TCP].sport
2972         capture = self.pg3.get_capture(1)
2973         self.verify_syslog_sess(capture[0][Raw].load)
2974
2975         self.pg_enable_capture(self.pg_interfaces)
2976         self.pg_start()
2977         self.nat_add_address(self.nat_addr, is_add=0)
2978         capture = self.pg3.get_capture(1)
2979         self.verify_syslog_sess(capture[0][Raw].load, False)
2980
2981     def test_twice_nat_interface_addr(self):
2982         """ NAT44ED Acquire twice NAT addresses from interface """
2983         flags = self.config_flags.NAT_IS_TWICE_NAT
2984         self.vapi.nat44_add_del_interface_addr(
2985             sw_if_index=self.pg11.sw_if_index,
2986             flags=flags, is_add=1)
2987
2988         # no address in NAT pool
2989         adresses = self.vapi.nat44_address_dump()
2990         self.assertEqual(0, len(adresses))
2991
2992         # configure interface address and check NAT address pool
2993         self.pg11.config_ip4()
2994         adresses = self.vapi.nat44_address_dump()
2995         self.assertEqual(1, len(adresses))
2996         self.assertEqual(str(adresses[0].ip_address),
2997                          self.pg11.local_ip4)
2998         self.assertEqual(adresses[0].flags, flags)
2999
3000         # remove interface address and check NAT address pool
3001         self.pg11.unconfig_ip4()
3002         adresses = self.vapi.nat44_address_dump()
3003         self.assertEqual(0, len(adresses))
3004
3005     def test_output_feature_stateful_acl(self):
3006         """ NAT44ED output feature works with stateful ACL """
3007
3008         self.nat_add_address(self.nat_addr)
3009         self.vapi.nat44_interface_add_del_output_feature(
3010             sw_if_index=self.pg0.sw_if_index,
3011             flags=self.config_flags.NAT_IS_INSIDE, is_add=1)
3012         self.vapi.nat44_interface_add_del_output_feature(
3013             sw_if_index=self.pg1.sw_if_index,
3014             flags=self.config_flags.NAT_IS_OUTSIDE, is_add=1)
3015
3016         # First ensure that the NAT is working sans ACL
3017
3018         # send packets out2in, no sessions yet so packets should drop
3019         pkts_out2in = self.create_stream_out(self.pg1)
3020         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3021
3022         # send packets into inside intf, ensure received via outside intf
3023         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3024         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3025                                        len(pkts_in2out))
3026         self.verify_capture_out(capture, ignore_port=True)
3027
3028         # send out2in again, with sessions created it should work now
3029         pkts_out2in = self.create_stream_out(self.pg1)
3030         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3031                                        len(pkts_out2in))
3032         self.verify_capture_in(capture, self.pg0)
3033
3034         # Create an ACL blocking everything
3035         out2in_deny_rule = AclRule(is_permit=0)
3036         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3037         out2in_acl.add_vpp_config()
3038
3039         # create an ACL to permit/reflect everything
3040         in2out_reflect_rule = AclRule(is_permit=2)
3041         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3042         in2out_acl.add_vpp_config()
3043
3044         # apply as input acl on interface and confirm it blocks everything
3045         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3046                                  n_input=1, acls=[out2in_acl])
3047         acl_if.add_vpp_config()
3048         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3049
3050         # apply output acl
3051         acl_if.acls = [out2in_acl, in2out_acl]
3052         acl_if.add_vpp_config()
3053         # send in2out to generate ACL state (NAT state was created earlier)
3054         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3055                                        len(pkts_in2out))
3056         self.verify_capture_out(capture, ignore_port=True)
3057
3058         # send out2in again. ACL state exists so it should work now.
3059         # TCP packets with the syn flag set also need the ack flag
3060         for p in pkts_out2in:
3061             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3062                 p[TCP].flags |= 0x10
3063         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3064                                        len(pkts_out2in))
3065         self.verify_capture_in(capture, self.pg0)
3066         self.logger.info(self.vapi.cli("show trace"))
3067
3068     def test_tcp_close(self):
3069         """ NAT44ED Close TCP session from inside network - output feature """
3070         old_timeouts = self.vapi.nat_get_timeouts()
3071         new_transitory = 2
3072         self.vapi.nat_set_timeouts(
3073             udp=old_timeouts.udp,
3074             tcp_established=old_timeouts.tcp_established,
3075             icmp=old_timeouts.icmp,
3076             tcp_transitory=new_transitory)
3077
3078         self.vapi.nat44_forwarding_enable_disable(enable=1)
3079         self.nat_add_address(self.pg1.local_ip4)
3080         twice_nat_addr = '10.0.1.3'
3081         service_ip = '192.168.16.150'
3082         self.nat_add_address(twice_nat_addr, twice_nat=1)
3083
3084         flags = self.config_flags.NAT_IS_INSIDE
3085         self.vapi.nat44_interface_add_del_feature(
3086             sw_if_index=self.pg0.sw_if_index,
3087             is_add=1)
3088         self.vapi.nat44_interface_add_del_feature(
3089             sw_if_index=self.pg0.sw_if_index,
3090             flags=flags, is_add=1)
3091         self.vapi.nat44_interface_add_del_output_feature(
3092             is_add=1,
3093             sw_if_index=self.pg1.sw_if_index)
3094
3095         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3096                  self.config_flags.NAT_IS_TWICE_NAT)
3097         self.nat_add_static_mapping(self.pg0.remote_ip4,
3098                                     service_ip, 80, 80,
3099                                     proto=IP_PROTOS.tcp,
3100                                     flags=flags)
3101         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3102         start_sessnum = len(sessions)
3103
3104         # SYN packet out->in
3105         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3106              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3107              TCP(sport=33898, dport=80, flags="S"))
3108         self.pg1.add_stream(p)
3109         self.pg_enable_capture(self.pg_interfaces)
3110         self.pg_start()
3111         capture = self.pg0.get_capture(1)
3112         p = capture[0]
3113         tcp_port = p[TCP].sport
3114
3115         # SYN + ACK packet in->out
3116         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3117              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3118              TCP(sport=80, dport=tcp_port, flags="SA"))
3119         self.pg0.add_stream(p)
3120         self.pg_enable_capture(self.pg_interfaces)
3121         self.pg_start()
3122         self.pg1.get_capture(1)
3123
3124         # ACK packet out->in
3125         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3126              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3127              TCP(sport=33898, dport=80, flags="A"))
3128         self.pg1.add_stream(p)
3129         self.pg_enable_capture(self.pg_interfaces)
3130         self.pg_start()
3131         self.pg0.get_capture(1)
3132
3133         # FIN packet in -> out
3134         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3135              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3136              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3137         self.pg0.add_stream(p)
3138         self.pg_enable_capture(self.pg_interfaces)
3139         self.pg_start()
3140         self.pg1.get_capture(1)
3141
3142         # FIN+ACK packet out -> in
3143         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3144              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3145              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3146         self.pg1.add_stream(p)
3147         self.pg_enable_capture(self.pg_interfaces)
3148         self.pg_start()
3149         self.pg0.get_capture(1)
3150
3151         # ACK packet in -> out
3152         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3153              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3154              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3155         self.pg0.add_stream(p)
3156         self.pg_enable_capture(self.pg_interfaces)
3157         self.pg_start()
3158         self.pg1.get_capture(1)
3159
3160         # session now in transitory timeout
3161         # try SYN packet out->in - should be dropped
3162         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3163              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3164              TCP(sport=33898, dport=80, flags="S"))
3165         self.pg1.add_stream(p)
3166         self.pg_enable_capture(self.pg_interfaces)
3167         self.pg_start()
3168
3169         self.sleep(new_transitory, "wait for transitory timeout")
3170         self.pg0.assert_nothing_captured(0)
3171
3172         # session should still exist
3173         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3174         self.assertEqual(len(sessions) - start_sessnum, 1)
3175
3176         # send FIN+ACK packet out -> in - will cause session to be wiped
3177         # but won't create a new session
3178         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3179              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3180              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3181         self.pg1.add_stream(p)
3182         self.pg_enable_capture(self.pg_interfaces)
3183         self.pg_start()
3184
3185         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3186         self.assertEqual(len(sessions) - start_sessnum, 0)
3187         self.pg0.assert_nothing_captured(0)
3188
3189     def test_tcp_session_close_in(self):
3190         """ NAT44ED Close TCP session from inside network """
3191
3192         in_port = self.tcp_port_in
3193         out_port = 10505
3194         ext_port = self.tcp_external_port
3195
3196         self.nat_add_address(self.nat_addr)
3197         self.nat_add_inside_interface(self.pg0)
3198         self.nat_add_outside_interface(self.pg1)
3199         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3200                                     in_port, out_port, proto=IP_PROTOS.tcp,
3201                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3202
3203         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3204         session_n = len(sessions)
3205
3206         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3207                                    tcp_transitory=2, icmp=5)
3208
3209         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3210
3211         # FIN packet in -> out
3212         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3213              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3214              TCP(sport=in_port, dport=ext_port,
3215                  flags="FA", seq=100, ack=300))
3216         self.pg0.add_stream(p)
3217         self.pg_enable_capture(self.pg_interfaces)
3218         self.pg_start()
3219         self.pg1.get_capture(1)
3220
3221         pkts = []
3222
3223         # ACK packet out -> in
3224         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3225              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3226              TCP(sport=ext_port, dport=out_port,
3227                  flags="A", seq=300, ack=101))
3228         pkts.append(p)
3229
3230         # FIN packet out -> in
3231         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3232              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3233              TCP(sport=ext_port, dport=out_port,
3234                  flags="FA", seq=300, ack=101))
3235         pkts.append(p)
3236
3237         self.pg1.add_stream(pkts)
3238         self.pg_enable_capture(self.pg_interfaces)
3239         self.pg_start()
3240         self.pg0.get_capture(2)
3241
3242         # ACK packet in -> out
3243         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3244              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3245              TCP(sport=in_port, dport=ext_port,
3246                  flags="A", seq=101, ack=301))
3247         self.pg0.add_stream(p)
3248         self.pg_enable_capture(self.pg_interfaces)
3249         self.pg_start()
3250         self.pg1.get_capture(1)
3251
3252         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3253         self.assertEqual(len(sessions) - session_n, 1)
3254
3255         out2in_drops = self.get_err_counter(
3256             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3257         in2out_drops = self.get_err_counter(
3258             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3259
3260         # extra FIN packet out -> in - this should be dropped
3261         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3262              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3263              TCP(sport=ext_port, dport=out_port,
3264                  flags="FA", seq=300, ack=101))
3265
3266         self.pg1.add_stream(p)
3267         self.pg_enable_capture(self.pg_interfaces)
3268         self.pg_start()
3269         self.pg0.assert_nothing_captured()
3270
3271         # extra ACK packet in -> out - this should be dropped
3272         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3273              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3274              TCP(sport=in_port, dport=ext_port,
3275                  flags="A", seq=101, ack=301))
3276         self.pg0.add_stream(p)
3277         self.pg_enable_capture(self.pg_interfaces)
3278         self.pg_start()
3279         self.pg1.assert_nothing_captured()
3280
3281         stats = self.get_err_counter(
3282             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3283         self.assertEqual(stats - out2in_drops, 1)
3284         stats = self.get_err_counter(
3285             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3286         self.assertEqual(stats - in2out_drops, 1)
3287
3288         self.sleep(3)
3289         # extra ACK packet in -> out - this will cause session to be wiped
3290         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3291              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3292              TCP(sport=in_port, dport=ext_port,
3293                  flags="A", seq=101, ack=301))
3294         self.pg0.add_stream(p)
3295         self.pg_enable_capture(self.pg_interfaces)
3296         self.pg_start()
3297         self.pg1.assert_nothing_captured()
3298         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3299         self.assertEqual(len(sessions) - session_n, 0)
3300
3301     def test_tcp_session_close_out(self):
3302         """ NAT44ED Close TCP session from outside network """
3303
3304         in_port = self.tcp_port_in
3305         out_port = 10505
3306         ext_port = self.tcp_external_port
3307
3308         self.nat_add_address(self.nat_addr)
3309         self.nat_add_inside_interface(self.pg0)
3310         self.nat_add_outside_interface(self.pg1)
3311         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3312                                     in_port, out_port, proto=IP_PROTOS.tcp,
3313                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3314
3315         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3316         session_n = len(sessions)
3317
3318         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3319                                    tcp_transitory=2, icmp=5)
3320
3321         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3322
3323         # FIN packet out -> in
3324         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3325              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3326              TCP(sport=ext_port, dport=out_port,
3327                  flags="FA", seq=100, ack=300))
3328         self.pg1.add_stream(p)
3329         self.pg_enable_capture(self.pg_interfaces)
3330         self.pg_start()
3331         self.pg0.get_capture(1)
3332
3333         # FIN+ACK packet in -> out
3334         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3335              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3336              TCP(sport=in_port, dport=ext_port,
3337                  flags="FA", seq=300, ack=101))
3338
3339         self.pg0.add_stream(p)
3340         self.pg_enable_capture(self.pg_interfaces)
3341         self.pg_start()
3342         self.pg1.get_capture(1)
3343
3344         # ACK packet out -> in
3345         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3346              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3347              TCP(sport=ext_port, dport=out_port,
3348                  flags="A", seq=101, ack=301))
3349         self.pg1.add_stream(p)
3350         self.pg_enable_capture(self.pg_interfaces)
3351         self.pg_start()
3352         self.pg0.get_capture(1)
3353
3354         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3355         self.assertEqual(len(sessions) - session_n, 1)
3356
3357         out2in_drops = self.get_err_counter(
3358             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3359         in2out_drops = self.get_err_counter(
3360             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3361
3362         # extra FIN packet out -> in - this should be dropped
3363         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3364              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3365              TCP(sport=ext_port, dport=out_port,
3366                  flags="FA", seq=300, ack=101))
3367
3368         self.pg1.add_stream(p)
3369         self.pg_enable_capture(self.pg_interfaces)
3370         self.pg_start()
3371         self.pg0.assert_nothing_captured()
3372
3373         # extra ACK packet in -> out - this should be dropped
3374         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3375              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3376              TCP(sport=in_port, dport=ext_port,
3377                  flags="A", seq=101, ack=301))
3378         self.pg0.add_stream(p)
3379         self.pg_enable_capture(self.pg_interfaces)
3380         self.pg_start()
3381         self.pg1.assert_nothing_captured()
3382
3383         stats = self.get_err_counter(
3384             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3385         self.assertEqual(stats - out2in_drops, 1)
3386         stats = self.get_err_counter(
3387             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3388         self.assertEqual(stats - in2out_drops, 1)
3389
3390         self.sleep(3)
3391         # extra ACK packet in -> out - this will cause session to be wiped
3392         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3393              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3394              TCP(sport=in_port, dport=ext_port,
3395                  flags="A", seq=101, ack=301))
3396         self.pg0.add_stream(p)
3397         self.pg_enable_capture(self.pg_interfaces)
3398         self.pg_start()
3399         self.pg1.assert_nothing_captured()
3400         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3401         self.assertEqual(len(sessions) - session_n, 0)
3402
3403     def test_tcp_session_close_simultaneous(self):
3404         """ NAT44ED Close TCP session from inside network """
3405
3406         in_port = self.tcp_port_in
3407         ext_port = 10505
3408
3409         self.nat_add_address(self.nat_addr)
3410         self.nat_add_inside_interface(self.pg0)
3411         self.nat_add_outside_interface(self.pg1)
3412         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3413                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3414                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3415
3416         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3417         session_n = len(sessions)
3418
3419         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3420                                    tcp_transitory=2, icmp=5)
3421
3422         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3423
3424         # FIN packet in -> out
3425         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3426              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3427              TCP(sport=in_port, dport=ext_port,
3428                  flags="FA", seq=100, ack=300))
3429         self.pg0.add_stream(p)
3430         self.pg_enable_capture(self.pg_interfaces)
3431         self.pg_start()
3432         self.pg1.get_capture(1)
3433
3434         # FIN packet out -> in
3435         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3436              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3437              TCP(sport=ext_port, dport=out_port,
3438                  flags="FA", seq=300, ack=100))
3439         self.pg1.add_stream(p)
3440         self.pg_enable_capture(self.pg_interfaces)
3441         self.pg_start()
3442         self.pg0.get_capture(1)
3443
3444         # ACK packet in -> out
3445         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3446              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3447              TCP(sport=in_port, dport=ext_port,
3448                  flags="A", seq=101, ack=301))
3449         self.pg0.add_stream(p)
3450         self.pg_enable_capture(self.pg_interfaces)
3451         self.pg_start()
3452         self.pg1.get_capture(1)
3453
3454         # ACK packet out -> in
3455         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3456              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3457              TCP(sport=ext_port, dport=out_port,
3458                  flags="A", seq=301, ack=101))
3459         self.pg1.add_stream(p)
3460         self.pg_enable_capture(self.pg_interfaces)
3461         self.pg_start()
3462         self.pg0.get_capture(1)
3463
3464         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3465         self.assertEqual(len(sessions) - session_n, 1)
3466
3467         out2in_drops = self.get_err_counter(
3468             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3469         in2out_drops = self.get_err_counter(
3470             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3471
3472         # extra FIN packet out -> in - this should be dropped
3473         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3474              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3475              TCP(sport=ext_port, dport=out_port,
3476                  flags="FA", seq=300, ack=101))
3477
3478         self.pg1.add_stream(p)
3479         self.pg_enable_capture(self.pg_interfaces)
3480         self.pg_start()
3481         self.pg0.assert_nothing_captured()
3482
3483         # extra ACK packet in -> out - this should be dropped
3484         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3485              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3486              TCP(sport=in_port, dport=ext_port,
3487                  flags="A", seq=101, ack=301))
3488         self.pg0.add_stream(p)
3489         self.pg_enable_capture(self.pg_interfaces)
3490         self.pg_start()
3491         self.pg1.assert_nothing_captured()
3492
3493         stats = self.get_err_counter(
3494             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3495         self.assertEqual(stats - out2in_drops, 1)
3496         stats = self.get_err_counter(
3497             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3498         self.assertEqual(stats - in2out_drops, 1)
3499
3500         self.sleep(3)
3501         # extra ACK packet in -> out - this will cause session to be wiped
3502         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3503              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3504              TCP(sport=in_port, dport=ext_port,
3505                  flags="A", seq=101, ack=301))
3506         self.pg0.add_stream(p)
3507         self.pg_enable_capture(self.pg_interfaces)
3508         self.pg_start()
3509         self.pg1.assert_nothing_captured()
3510         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3511         self.assertEqual(len(sessions) - session_n, 0)
3512
3513     def test_dynamic_vrf(self):
3514         """ NAT44ED dynamic translation test: different VRF"""
3515
3516         vrf_id_in = 33
3517         vrf_id_out = 34
3518
3519         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3520
3521         try:
3522             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3523             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3524
3525             self.nat_add_inside_interface(self.pg7)
3526             self.nat_add_outside_interface(self.pg8)
3527
3528             # just basic stuff nothing special
3529             pkts = self.create_stream_in(self.pg7, self.pg8)
3530             self.pg7.add_stream(pkts)
3531             self.pg_enable_capture(self.pg_interfaces)
3532             self.pg_start()
3533             capture = self.pg8.get_capture(len(pkts))
3534             self.verify_capture_out(capture, ignore_port=True)
3535
3536             pkts = self.create_stream_out(self.pg8)
3537             self.pg8.add_stream(pkts)
3538             self.pg_enable_capture(self.pg_interfaces)
3539             self.pg_start()
3540             capture = self.pg7.get_capture(len(pkts))
3541             self.verify_capture_in(capture, self.pg7)
3542
3543         finally:
3544             self.pg7.unconfig()
3545             self.pg8.unconfig()
3546
3547             self.vapi.ip_table_add_del(is_add=0,
3548                                        table={'table_id': vrf_id_in})
3549             self.vapi.ip_table_add_del(is_add=0,
3550                                        table={'table_id': vrf_id_out})
3551
3552     def test_dynamic_output_feature_vrf(self):
3553         """ NAT44ED dynamic translation test: output-feature, VRF"""
3554
3555         # other then default (0)
3556         new_vrf_id = 22
3557
3558         self.nat_add_address(self.nat_addr)
3559         flags = self.config_flags.NAT_IS_INSIDE
3560         self.vapi.nat44_interface_add_del_output_feature(
3561             sw_if_index=self.pg7.sw_if_index,
3562             flags=flags, is_add=1)
3563         self.vapi.nat44_interface_add_del_output_feature(
3564             sw_if_index=self.pg8.sw_if_index,
3565             is_add=1)
3566
3567         try:
3568             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3569             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3570
3571             # in2out
3572             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3573             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3574             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3575             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3576
3577             pkts = self.create_stream_in(self.pg7, self.pg8)
3578             self.pg7.add_stream(pkts)
3579             self.pg_enable_capture(self.pg_interfaces)
3580             self.pg_start()
3581             capture = self.pg8.get_capture(len(pkts))
3582             self.verify_capture_out(capture, ignore_port=True)
3583
3584             if_idx = self.pg7.sw_if_index
3585             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3586             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3587             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3588             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3589             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3590             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3591             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3592             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3593
3594             # out2in
3595             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3596             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3597             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3598             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3599
3600             pkts = self.create_stream_out(self.pg8)
3601             self.pg8.add_stream(pkts)
3602             self.pg_enable_capture(self.pg_interfaces)
3603             self.pg_start()
3604             capture = self.pg7.get_capture(len(pkts))
3605             self.verify_capture_in(capture, self.pg7)
3606
3607             if_idx = self.pg8.sw_if_index
3608             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3609             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3610             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3611             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3612             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3613             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3614             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3615             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3616
3617             sessions = self.statistics['/nat44-ed/total-sessions']
3618             self.assertEqual(sessions[:, 0].sum(), 3)
3619
3620         finally:
3621             self.pg7.unconfig()
3622             self.pg8.unconfig()
3623
3624             self.vapi.ip_table_add_del(is_add=0,
3625                                        table={'table_id': new_vrf_id})
3626
3627     def test_next_src_nat(self):
3628         """ NAT44ED On way back forward packet to nat44-in2out node. """
3629
3630         twice_nat_addr = '10.0.1.3'
3631         external_port = 80
3632         local_port = 8080
3633         post_twice_nat_port = 0
3634
3635         self.vapi.nat44_forwarding_enable_disable(enable=1)
3636         self.nat_add_address(twice_nat_addr, twice_nat=1)
3637         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3638                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3639         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3640                                     local_port, external_port,
3641                                     proto=IP_PROTOS.tcp, vrf_id=1,
3642                                     flags=flags)
3643         self.vapi.nat44_interface_add_del_feature(
3644             sw_if_index=self.pg6.sw_if_index,
3645             is_add=1)
3646
3647         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3648              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3649              TCP(sport=12345, dport=external_port))
3650         self.pg6.add_stream(p)
3651         self.pg_enable_capture(self.pg_interfaces)
3652         self.pg_start()
3653         capture = self.pg6.get_capture(1)
3654         p = capture[0]
3655         try:
3656             ip = p[IP]
3657             tcp = p[TCP]
3658             self.assertEqual(ip.src, twice_nat_addr)
3659             self.assertNotEqual(tcp.sport, 12345)
3660             post_twice_nat_port = tcp.sport
3661             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3662             self.assertEqual(tcp.dport, local_port)
3663             self.assert_packet_checksums_valid(p)
3664         except:
3665             self.logger.error(ppp("Unexpected or invalid packet:", p))
3666             raise
3667
3668         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3669              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3670              TCP(sport=local_port, dport=post_twice_nat_port))
3671         self.pg6.add_stream(p)
3672         self.pg_enable_capture(self.pg_interfaces)
3673         self.pg_start()
3674         capture = self.pg6.get_capture(1)
3675         p = capture[0]
3676         try:
3677             ip = p[IP]
3678             tcp = p[TCP]
3679             self.assertEqual(ip.src, self.pg1.remote_ip4)
3680             self.assertEqual(tcp.sport, external_port)
3681             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3682             self.assertEqual(tcp.dport, 12345)
3683             self.assert_packet_checksums_valid(p)
3684         except:
3685             self.logger.error(ppp("Unexpected or invalid packet:", p))
3686             raise
3687
3688     def test_one_armed_nat44_static(self):
3689         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3690
3691         remote_host = self.pg4.remote_hosts[0]
3692         local_host = self.pg4.remote_hosts[1]
3693         external_port = 80
3694         local_port = 8080
3695         eh_port_in = 0
3696
3697         self.vapi.nat44_forwarding_enable_disable(enable=1)
3698         self.nat_add_address(self.nat_addr, twice_nat=1)
3699         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3700                  self.config_flags.NAT_IS_TWICE_NAT)
3701         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3702                                     local_port, external_port,
3703                                     proto=IP_PROTOS.tcp, flags=flags)
3704         flags = self.config_flags.NAT_IS_INSIDE
3705         self.vapi.nat44_interface_add_del_feature(
3706             sw_if_index=self.pg4.sw_if_index,
3707             is_add=1)
3708         self.vapi.nat44_interface_add_del_feature(
3709             sw_if_index=self.pg4.sw_if_index,
3710             flags=flags, is_add=1)
3711
3712         # from client to service
3713         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3714              IP(src=remote_host.ip4, dst=self.nat_addr) /
3715              TCP(sport=12345, dport=external_port))
3716         self.pg4.add_stream(p)
3717         self.pg_enable_capture(self.pg_interfaces)
3718         self.pg_start()
3719         capture = self.pg4.get_capture(1)
3720         p = capture[0]
3721         try:
3722             ip = p[IP]
3723             tcp = p[TCP]
3724             self.assertEqual(ip.dst, local_host.ip4)
3725             self.assertEqual(ip.src, self.nat_addr)
3726             self.assertEqual(tcp.dport, local_port)
3727             self.assertNotEqual(tcp.sport, 12345)
3728             eh_port_in = tcp.sport
3729             self.assert_packet_checksums_valid(p)
3730         except:
3731             self.logger.error(ppp("Unexpected or invalid packet:", p))
3732             raise
3733
3734         # from service back to client
3735         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3736              IP(src=local_host.ip4, dst=self.nat_addr) /
3737              TCP(sport=local_port, dport=eh_port_in))
3738         self.pg4.add_stream(p)
3739         self.pg_enable_capture(self.pg_interfaces)
3740         self.pg_start()
3741         capture = self.pg4.get_capture(1)
3742         p = capture[0]
3743         try:
3744             ip = p[IP]
3745             tcp = p[TCP]
3746             self.assertEqual(ip.src, self.nat_addr)
3747             self.assertEqual(ip.dst, remote_host.ip4)
3748             self.assertEqual(tcp.sport, external_port)
3749             self.assertEqual(tcp.dport, 12345)
3750             self.assert_packet_checksums_valid(p)
3751         except:
3752             self.logger.error(ppp("Unexpected or invalid packet:", p))
3753             raise
3754
3755
3756 if __name__ == '__main__':
3757     unittest.main(testRunner=VppTestRunner)