test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class NAT44EDTestCase(VppTestCase):
  23
  24     nat_addr = '10.0.0.3'
  25
  26     tcp_port_in = 6303
  27     tcp_port_out = 6303
  28
  29     udp_port_in = 6304
  30     udp_port_out = 6304
  31
  32     icmp_id_in = 6305
  33     icmp_id_out = 6305
  34
  35     tcp_external_port = 80
  36
  37     max_sessions = 100
  38
  39     def setUp(self):
  40         super(NAT44EDTestCase, self).setUp()
  41         self.plugin_enable()
  42
  43     def tearDown(self):
  44         super(NAT44EDTestCase, self).tearDown()
  45         if not self.vpp_dead:
  46             self.plugin_disable()
  47
  48     def plugin_enable(self):
  49         self.vapi.nat44_ed_plugin_enable_disable(
  50             sessions=self.max_sessions, enable=1)
  51
  52     def plugin_disable(self):
  53         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  54
  55     @property
  56     def config_flags(self):
  57         return VppEnum.vl_api_nat_config_flags_t
  58
  59     @property
  60     def nat44_config_flags(self):
  61         return VppEnum.vl_api_nat44_config_flags_t
  62
  63     @property
  64     def syslog_severity(self):
  65         return VppEnum.vl_api_syslog_severity_t
  66
  67     @property
  68     def server_addr(self):
  69         return self.pg1.remote_hosts[0].ip4
  70
  71     @staticmethod
  72     def random_port():
  73         return randint(1025, 65535)
  74
  75     @staticmethod
  76     def proto2layer(proto):
  77         if proto == IP_PROTOS.tcp:
  78             return TCP
  79         elif proto == IP_PROTOS.udp:
  80             return UDP
  81         elif proto == IP_PROTOS.icmp:
  82             return ICMP
  83         else:
  84             raise Exception("Unsupported protocol")
  85
  86     @classmethod
  87     def create_and_add_ip4_table(cls, i, table_id=0):
  88         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  89         i.set_table_ip4(table_id)
  90
  91     @classmethod
  92     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  93         if table_id:
  94             cls.create_and_add_ip4_table(i, table_id)
  95
  96         i.admin_up()
  97         i.config_ip4()
  98         i.resolve_arp()
  99
 100         if hosts:
 101             i.generate_remote_hosts(hosts)
 102             i.configure_ipv4_neighbors()
 103
 104     @classmethod
 105     def nat_add_interface_address(cls, i):
 106         cls.vapi.nat44_add_del_interface_addr(
 107             sw_if_index=i.sw_if_index, is_add=1)
 108
 109     def nat_add_inside_interface(self, i):
 110         self.vapi.nat44_interface_add_del_feature(
 111             flags=self.config_flags.NAT_IS_INSIDE,
 112             sw_if_index=i.sw_if_index, is_add=1)
 113
 114     def nat_add_outside_interface(self, i):
 115         self.vapi.nat44_interface_add_del_feature(
 116             flags=self.config_flags.NAT_IS_OUTSIDE,
 117             sw_if_index=i.sw_if_index, is_add=1)
 118
 119     def nat_add_address(self, address, twice_nat=0,
 120                         vrf_id=0xFFFFFFFF, is_add=1):
 121         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 122         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 123                                               last_ip_address=address,
 124                                               vrf_id=vrf_id,
 125                                               is_add=is_add,
 126                                               flags=flags)
 127
 128     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 129                                local_port=0, external_port=0, vrf_id=0,
 130                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 131                                proto=0, tag="", flags=0):
 132
 133         if not (local_port and external_port):
 134             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 135
 136         self.vapi.nat44_add_del_static_mapping(
 137             is_add=is_add,
 138             local_ip_address=local_ip,
 139             external_ip_address=external_ip,
 140             external_sw_if_index=external_sw_if_index,
 141             local_port=local_port,
 142             external_port=external_port,
 143             vrf_id=vrf_id, protocol=proto,
 144             flags=flags,
 145             tag=tag)
 146
 147     @classmethod
 148     def setUpClass(cls):
 149         super(NAT44EDTestCase, cls).setUpClass()
 150
 151         cls.create_pg_interfaces(range(12))
 152         cls.interfaces = list(cls.pg_interfaces[:4])
 153
 154         cls.create_and_add_ip4_table(cls.pg2, 10)
 155
 156         for i in cls.interfaces:
 157             cls.configure_ip4_interface(i, hosts=3)
 158
 159         # test specific (test-multiple-vrf)
 160         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 161
 162         # test specific (test-one-armed-nat44-static)
 163         cls.pg4.generate_remote_hosts(2)
 164         cls.pg4.config_ip4()
 165         cls.vapi.sw_interface_add_del_address(
 166             sw_if_index=cls.pg4.sw_if_index,
 167             prefix="10.0.0.1/24")
 168         cls.pg4.admin_up()
 169         cls.pg4.resolve_arp()
 170         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 171         cls.pg4.resolve_arp()
 172
 173         # test specific interface (pg5)
 174         cls.pg5._local_ip4 = "10.1.1.1"
 175         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 176         cls.pg5.set_table_ip4(1)
 177         cls.pg5.config_ip4()
 178         cls.pg5.admin_up()
 179         cls.pg5.resolve_arp()
 180
 181         # test specific interface (pg6)
 182         cls.pg6._local_ip4 = "10.1.2.1"
 183         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 184         cls.pg6.set_table_ip4(1)
 185         cls.pg6.config_ip4()
 186         cls.pg6.admin_up()
 187         cls.pg6.resolve_arp()
 188
 189         rl = list()
 190
 191         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 192                              [VppRoutePath("0.0.0.0", 0xffffffff,
 193                                            nh_table_id=0)],
 194                              register=False, table_id=1))
 195         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 196                              [VppRoutePath(cls.pg1.local_ip4,
 197                                            cls.pg1.sw_if_index)],
 198                              register=False))
 199         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 200                              [VppRoutePath("0.0.0.0",
 201                                            cls.pg5.sw_if_index)],
 202                              register=False, table_id=1))
 203         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 204                              [VppRoutePath("0.0.0.0",
 205                                            cls.pg6.sw_if_index)],
 206                              register=False, table_id=1))
 207         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 208                              [VppRoutePath("0.0.0.0", 0xffffffff,
 209                                            nh_table_id=1)],
 210                              register=False, table_id=0))
 211
 212         for r in rl:
 213             r.add_vpp_config()
 214
 215     def get_err_counter(self, path):
 216         return self.statistics.get_err_counter(path)
 217
 218     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 219                           host_in_port, proto=IP_PROTOS.tcp,
 220                           ignore_port=False):
 221         layer = self.proto2layer(proto)
 222
 223         if proto == IP_PROTOS.tcp:
 224             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 225         else:
 226             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 227
 228         # send packet from host to server
 229         pkts = self.create_stream_frag(self.pg0,
 230                                        self.nat_addr,
 231                                        host_in_port,
 232                                        server_out_port,
 233                                        data,
 234                                        proto)
 235         self.pg0.add_stream(pkts)
 236         self.pg_enable_capture(self.pg_interfaces)
 237         self.pg_start()
 238         frags = self.pg0.get_capture(len(pkts))
 239         p = self.reass_frags_and_verify(frags,
 240                                         self.nat_addr,
 241                                         server_addr)
 242         if proto != IP_PROTOS.icmp:
 243             if not ignore_port:
 244                 self.assertNotEqual(p[layer].sport, host_in_port)
 245             self.assertEqual(p[layer].dport, server_in_port)
 246         else:
 247             if not ignore_port:
 248                 self.assertNotEqual(p[layer].id, host_in_port)
 249         self.assertEqual(data, p[Raw].load)
 250
 251     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 252                           ignore_port=False):
 253         layer = self.proto2layer(proto)
 254
 255         if proto == IP_PROTOS.tcp:
 256             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 257         else:
 258             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 259         self.port_in = self.random_port()
 260
 261         for i in range(2):
 262             # in2out
 263             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 264                                            self.port_in, 20, data, proto)
 265             pkts.reverse()
 266             self.pg0.add_stream(pkts)
 267             self.pg_enable_capture(self.pg_interfaces)
 268             self.pg_start()
 269             frags = self.pg1.get_capture(len(pkts))
 270             if not dont_translate:
 271                 p = self.reass_frags_and_verify(frags,
 272                                                 self.nat_addr,
 273                                                 self.pg1.remote_ip4)
 274             else:
 275                 p = self.reass_frags_and_verify(frags,
 276                                                 self.pg0.remote_ip4,
 277                                                 self.pg1.remote_ip4)
 278             if proto != IP_PROTOS.icmp:
 279                 if not dont_translate:
 280                     self.assertEqual(p[layer].dport, 20)
 281                     if not ignore_port:
 282                         self.assertNotEqual(p[layer].sport, self.port_in)
 283                 else:
 284                     self.assertEqual(p[layer].sport, self.port_in)
 285             else:
 286                 if not ignore_port:
 287                     if not dont_translate:
 288                         self.assertNotEqual(p[layer].id, self.port_in)
 289                     else:
 290                         self.assertEqual(p[layer].id, self.port_in)
 291             self.assertEqual(data, p[Raw].load)
 292
 293             # out2in
 294             if not dont_translate:
 295                 dst_addr = self.nat_addr
 296             else:
 297                 dst_addr = self.pg0.remote_ip4
 298             if proto != IP_PROTOS.icmp:
 299                 sport = 20
 300                 dport = p[layer].sport
 301             else:
 302                 sport = p[layer].id
 303                 dport = 0
 304             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 305                                            data, proto, echo_reply=True)
 306             pkts.reverse()
 307             self.pg1.add_stream(pkts)
 308             self.pg_enable_capture(self.pg_interfaces)
 309             self.logger.info(self.vapi.cli("show trace"))
 310             self.pg_start()
 311             frags = self.pg0.get_capture(len(pkts))
 312             p = self.reass_frags_and_verify(frags,
 313                                             self.pg1.remote_ip4,
 314                                             self.pg0.remote_ip4)
 315             if proto != IP_PROTOS.icmp:
 316                 self.assertEqual(p[layer].sport, 20)
 317                 self.assertEqual(p[layer].dport, self.port_in)
 318             else:
 319                 self.assertEqual(p[layer].id, self.port_in)
 320             self.assertEqual(data, p[Raw].load)
 321
 322     def reass_frags_and_verify(self, frags, src, dst):
 323         buffer = BytesIO()
 324         for p in frags:
 325             self.assertEqual(p[IP].src, src)
 326             self.assertEqual(p[IP].dst, dst)
 327             self.assert_ip_checksum_valid(p)
 328             buffer.seek(p[IP].frag * 8)
 329             buffer.write(bytes(p[IP].payload))
 330         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 331                 proto=frags[0][IP].proto)
 332         if ip.proto == IP_PROTOS.tcp:
 333             p = (ip / TCP(buffer.getvalue()))
 334             self.logger.debug(ppp("Reassembled:", p))
 335             self.assert_tcp_checksum_valid(p)
 336         elif ip.proto == IP_PROTOS.udp:
 337             p = (ip / UDP(buffer.getvalue()[:8]) /
 338                  Raw(buffer.getvalue()[8:]))
 339         elif ip.proto == IP_PROTOS.icmp:
 340             p = (ip / ICMP(buffer.getvalue()))
 341         return p
 342
 343     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 344                       ignore_port=False):
 345         layer = self.proto2layer(proto)
 346
 347         if proto == IP_PROTOS.tcp:
 348             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 349         else:
 350             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 351         self.port_in = self.random_port()
 352
 353         # in2out
 354         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 355                                        self.port_in, 20, data, proto)
 356         self.pg0.add_stream(pkts)
 357         self.pg_enable_capture(self.pg_interfaces)
 358         self.pg_start()
 359         frags = self.pg1.get_capture(len(pkts))
 360         if not dont_translate:
 361             p = self.reass_frags_and_verify(frags,
 362                                             self.nat_addr,
 363                                             self.pg1.remote_ip4)
 364         else:
 365             p = self.reass_frags_and_verify(frags,
 366                                             self.pg0.remote_ip4,
 367                                             self.pg1.remote_ip4)
 368         if proto != IP_PROTOS.icmp:
 369             if not dont_translate:
 370                 self.assertEqual(p[layer].dport, 20)
 371                 if not ignore_port:
 372                     self.assertNotEqual(p[layer].sport, self.port_in)
 373             else:
 374                 self.assertEqual(p[layer].sport, self.port_in)
 375         else:
 376             if not ignore_port:
 377                 if not dont_translate:
 378                     self.assertNotEqual(p[layer].id, self.port_in)
 379                 else:
 380                     self.assertEqual(p[layer].id, self.port_in)
 381         self.assertEqual(data, p[Raw].load)
 382
 383         # out2in
 384         if not dont_translate:
 385             dst_addr = self.nat_addr
 386         else:
 387             dst_addr = self.pg0.remote_ip4
 388         if proto != IP_PROTOS.icmp:
 389             sport = 20
 390             dport = p[layer].sport
 391         else:
 392             sport = p[layer].id
 393             dport = 0
 394         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 395                                        proto, echo_reply=True)
 396         self.pg1.add_stream(pkts)
 397         self.pg_enable_capture(self.pg_interfaces)
 398         self.pg_start()
 399         frags = self.pg0.get_capture(len(pkts))
 400         p = self.reass_frags_and_verify(frags,
 401                                         self.pg1.remote_ip4,
 402                                         self.pg0.remote_ip4)
 403         if proto != IP_PROTOS.icmp:
 404             self.assertEqual(p[layer].sport, 20)
 405             self.assertEqual(p[layer].dport, self.port_in)
 406         else:
 407             self.assertEqual(p[layer].id, self.port_in)
 408         self.assertEqual(data, p[Raw].load)
 409
 410     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 411                            dst_ip=None, ignore_port=False):
 412         if nat_ip is None:
 413             nat_ip = self.nat_addr
 414         for packet in capture:
 415             try:
 416                 self.assert_packet_checksums_valid(packet)
 417                 self.assertEqual(packet[IP].src, nat_ip)
 418                 if dst_ip is not None:
 419                     self.assertEqual(packet[IP].dst, dst_ip)
 420                 if packet.haslayer(TCP):
 421                     if not ignore_port:
 422                         if same_port:
 423                             self.assertEqual(
 424                                 packet[TCP].sport, self.tcp_port_in)
 425                         else:
 426                             self.assertNotEqual(
 427                                 packet[TCP].sport, self.tcp_port_in)
 428                     self.tcp_port_out = packet[TCP].sport
 429                     self.assert_packet_checksums_valid(packet)
 430                 elif packet.haslayer(UDP):
 431                     if not ignore_port:
 432                         if same_port:
 433                             self.assertEqual(
 434                                 packet[UDP].sport, self.udp_port_in)
 435                         else:
 436                             self.assertNotEqual(
 437                                 packet[UDP].sport, self.udp_port_in)
 438                     self.udp_port_out = packet[UDP].sport
 439                 else:
 440                     if not ignore_port:
 441                         if same_port:
 442                             self.assertEqual(
 443                                 packet[ICMP].id, self.icmp_id_in)
 444                         else:
 445                             self.assertNotEqual(
 446                                 packet[ICMP].id, self.icmp_id_in)
 447                     self.icmp_id_out = packet[ICMP].id
 448                     self.assert_packet_checksums_valid(packet)
 449             except:
 450                 self.logger.error(ppp("Unexpected or invalid packet "
 451                                       "(outside network):", packet))
 452                 raise
 453
 454     def verify_capture_in(self, capture, in_if):
 455         for packet in capture:
 456             try:
 457                 self.assert_packet_checksums_valid(packet)
 458                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 459                 if packet.haslayer(TCP):
 460                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 461                 elif packet.haslayer(UDP):
 462                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 463                 else:
 464                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 465             except:
 466                 self.logger.error(ppp("Unexpected or invalid packet "
 467                                       "(inside network):", packet))
 468                 raise
 469
 470     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 471         if dst_ip is None:
 472             dst_ip = out_if.remote_ip4
 473
 474         pkts = []
 475         # TCP
 476         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 477              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 478              TCP(sport=self.tcp_port_in, dport=20))
 479         pkts.extend([p, p])
 480
 481         # UDP
 482         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 483              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 484              UDP(sport=self.udp_port_in, dport=20))
 485         pkts.append(p)
 486
 487         # ICMP
 488         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 489              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 490              ICMP(id=self.icmp_id_in, type='echo-request'))
 491         pkts.append(p)
 492
 493         return pkts
 494
 495     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 496                           use_inside_ports=False):
 497         if dst_ip is None:
 498             dst_ip = self.nat_addr
 499         if not use_inside_ports:
 500             tcp_port = self.tcp_port_out
 501             udp_port = self.udp_port_out
 502             icmp_id = self.icmp_id_out
 503         else:
 504             tcp_port = self.tcp_port_in
 505             udp_port = self.udp_port_in
 506             icmp_id = self.icmp_id_in
 507         pkts = []
 508         # TCP
 509         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 510              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 511              TCP(dport=tcp_port, sport=20))
 512         pkts.extend([p, p])
 513
 514         # UDP
 515         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 516              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 517              UDP(dport=udp_port, sport=20))
 518         pkts.append(p)
 519
 520         # ICMP
 521         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 522              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 523              ICMP(id=icmp_id, type='echo-reply'))
 524         pkts.append(p)
 525
 526         return pkts
 527
 528     def create_tcp_stream(self, in_if, out_if, count):
 529         pkts = []
 530         port = 6303
 531
 532         for i in range(count):
 533             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 534                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 535                  TCP(sport=port + i, dport=20))
 536             pkts.append(p)
 537
 538         return pkts
 539
 540     def create_stream_frag(self, src_if, dst, sport, dport, data,
 541                            proto=IP_PROTOS.tcp, echo_reply=False):
 542         if proto == IP_PROTOS.tcp:
 543             p = (IP(src=src_if.remote_ip4, dst=dst) /
 544                  TCP(sport=sport, dport=dport) /
 545                  Raw(data))
 546             p = p.__class__(scapy.compat.raw(p))
 547             chksum = p[TCP].chksum
 548             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 549         elif proto == IP_PROTOS.udp:
 550             proto_header = UDP(sport=sport, dport=dport)
 551         elif proto == IP_PROTOS.icmp:
 552             if not echo_reply:
 553                 proto_header = ICMP(id=sport, type='echo-request')
 554             else:
 555                 proto_header = ICMP(id=sport, type='echo-reply')
 556         else:
 557             raise Exception("Unsupported protocol")
 558         id = self.random_port()
 559         pkts = []
 560         if proto == IP_PROTOS.tcp:
 561             raw = Raw(data[0:4])
 562         else:
 563             raw = Raw(data[0:16])
 564         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 565              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 566              proto_header /
 567              raw)
 568         pkts.append(p)
 569         if proto == IP_PROTOS.tcp:
 570             raw = Raw(data[4:20])
 571         else:
 572             raw = Raw(data[16:32])
 573         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 574              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 575                 proto=proto) /
 576              raw)
 577         pkts.append(p)
 578         if proto == IP_PROTOS.tcp:
 579             raw = Raw(data[20:])
 580         else:
 581             raw = Raw(data[32:])
 582         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 583              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 584                 id=id) /
 585              raw)
 586         pkts.append(p)
 587         return pkts
 588
 589     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 590                                   proto=IP_PROTOS.tcp):
 591
 592         layer = self.proto2layer(proto)
 593
 594         if proto == IP_PROTOS.tcp:
 595             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 596         else:
 597             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 598         port_in = self.random_port()
 599
 600         for i in range(2):
 601             # out2in
 602             pkts = self.create_stream_frag(self.pg0, out_addr,
 603                                            port_in, out_port,
 604                                            data, proto)
 605             self.pg0.add_stream(pkts)
 606             self.pg_enable_capture(self.pg_interfaces)
 607             self.pg_start()
 608             frags = self.pg1.get_capture(len(pkts))
 609             p = self.reass_frags_and_verify(frags,
 610                                             self.pg0.remote_ip4,
 611                                             in_addr)
 612             if proto != IP_PROTOS.icmp:
 613                 self.assertEqual(p[layer].sport, port_in)
 614                 self.assertEqual(p[layer].dport, in_port)
 615             else:
 616                 self.assertEqual(p[layer].id, port_in)
 617             self.assertEqual(data, p[Raw].load)
 618
 619             # in2out
 620             if proto != IP_PROTOS.icmp:
 621                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 622                                                in_port,
 623                                                p[layer].sport, data, proto)
 624             else:
 625                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 626                                                p[layer].id, 0, data, proto,
 627                                                echo_reply=True)
 628             self.pg1.add_stream(pkts)
 629             self.pg_enable_capture(self.pg_interfaces)
 630             self.pg_start()
 631             frags = self.pg0.get_capture(len(pkts))
 632             p = self.reass_frags_and_verify(frags,
 633                                             out_addr,
 634                                             self.pg0.remote_ip4)
 635             if proto != IP_PROTOS.icmp:
 636                 self.assertEqual(p[layer].sport, out_port)
 637                 self.assertEqual(p[layer].dport, port_in)
 638             else:
 639                 self.assertEqual(p[layer].id, port_in)
 640             self.assertEqual(data, p[Raw].load)
 641
 642     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 643                                       out_port, proto=IP_PROTOS.tcp):
 644
 645         layer = self.proto2layer(proto)
 646
 647         if proto == IP_PROTOS.tcp:
 648             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 649         else:
 650             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 651         port_in = self.random_port()
 652
 653         for i in range(2):
 654             # out2in
 655             pkts = self.create_stream_frag(self.pg0, out_addr,
 656                                            port_in, out_port,
 657                                            data, proto)
 658             pkts.reverse()
 659             self.pg0.add_stream(pkts)
 660             self.pg_enable_capture(self.pg_interfaces)
 661             self.pg_start()
 662             frags = self.pg1.get_capture(len(pkts))
 663             p = self.reass_frags_and_verify(frags,
 664                                             self.pg0.remote_ip4,
 665                                             in_addr)
 666             if proto != IP_PROTOS.icmp:
 667                 self.assertEqual(p[layer].dport, in_port)
 668                 self.assertEqual(p[layer].sport, port_in)
 669                 self.assertEqual(p[layer].dport, in_port)
 670             else:
 671                 self.assertEqual(p[layer].id, port_in)
 672             self.assertEqual(data, p[Raw].load)
 673
 674             # in2out
 675             if proto != IP_PROTOS.icmp:
 676                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 677                                                in_port,
 678                                                p[layer].sport, data, proto)
 679             else:
 680                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 681                                                p[layer].id, 0, data, proto,
 682                                                echo_reply=True)
 683             pkts.reverse()
 684             self.pg1.add_stream(pkts)
 685             self.pg_enable_capture(self.pg_interfaces)
 686             self.pg_start()
 687             frags = self.pg0.get_capture(len(pkts))
 688             p = self.reass_frags_and_verify(frags,
 689                                             out_addr,
 690                                             self.pg0.remote_ip4)
 691             if proto != IP_PROTOS.icmp:
 692                 self.assertEqual(p[layer].sport, out_port)
 693                 self.assertEqual(p[layer].dport, port_in)
 694             else:
 695                 self.assertEqual(p[layer].id, port_in)
 696             self.assertEqual(data, p[Raw].load)
 697
 698     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 699         # SYN packet in->out
 700         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 701              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 702              TCP(sport=in_port, dport=ext_port, flags="S"))
 703         in_if.add_stream(p)
 704         self.pg_enable_capture(self.pg_interfaces)
 705         self.pg_start()
 706         capture = out_if.get_capture(1)
 707         p = capture[0]
 708         out_port = p[TCP].sport
 709
 710         # SYN + ACK packet out->in
 711         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 712              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 713              TCP(sport=ext_port, dport=out_port, flags="SA"))
 714         out_if.add_stream(p)
 715         self.pg_enable_capture(self.pg_interfaces)
 716         self.pg_start()
 717         in_if.get_capture(1)
 718
 719         # ACK packet in->out
 720         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 721              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 722              TCP(sport=in_port, dport=ext_port, flags="A"))
 723         in_if.add_stream(p)
 724         self.pg_enable_capture(self.pg_interfaces)
 725         self.pg_start()
 726         out_if.get_capture(1)
 727
 728         return out_port
 729
 730     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 731                          client_id=None):
 732         twice_nat_addr = '10.0.1.3'
 733
 734         port_in = 8080
 735         if lb:
 736             if not same_pg:
 737                 port_in1 = port_in
 738                 port_in2 = port_in
 739             else:
 740                 port_in1 = port_in + 1
 741                 port_in2 = port_in + 2
 742
 743         port_out = 80
 744         eh_port_out = 4567
 745
 746         server1 = self.pg0.remote_hosts[0]
 747         server2 = self.pg0.remote_hosts[1]
 748         if lb and same_pg:
 749             server2 = server1
 750         if not lb:
 751             server = server1
 752
 753         pg0 = self.pg0
 754         if same_pg:
 755             pg1 = self.pg0
 756         else:
 757             pg1 = self.pg1
 758
 759         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 760                         client_id == 1)
 761
 762         self.nat_add_address(self.nat_addr)
 763         self.nat_add_address(twice_nat_addr, twice_nat=1)
 764
 765         flags = 0
 766         if self_twice_nat:
 767             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 768         else:
 769             flags |= self.config_flags.NAT_IS_TWICE_NAT
 770
 771         if not lb:
 772             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 773                                         port_in, port_out,
 774                                         proto=IP_PROTOS.tcp,
 775                                         flags=flags)
 776         else:
 777             locals = [{'addr': server1.ip4,
 778                        'port': port_in1,
 779                        'probability': 50,
 780                        'vrf_id': 0},
 781                       {'addr': server2.ip4,
 782                        'port': port_in2,
 783                        'probability': 50,
 784                        'vrf_id': 0}]
 785             out_addr = self.nat_addr
 786
 787             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 788                                                       external_addr=out_addr,
 789                                                       external_port=port_out,
 790                                                       protocol=IP_PROTOS.tcp,
 791                                                       local_num=len(locals),
 792                                                       locals=locals)
 793         self.nat_add_inside_interface(pg0)
 794         self.nat_add_outside_interface(pg1)
 795
 796         if same_pg:
 797             if not lb:
 798                 client = server
 799             else:
 800                 assert client_id is not None
 801                 if client_id == 1:
 802                     client = self.pg0.remote_hosts[0]
 803                 elif client_id == 2:
 804                     client = self.pg0.remote_hosts[1]
 805         else:
 806             client = pg1.remote_hosts[0]
 807         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 808              IP(src=client.ip4, dst=self.nat_addr) /
 809              TCP(sport=eh_port_out, dport=port_out))
 810         pg1.add_stream(p)
 811         self.pg_enable_capture(self.pg_interfaces)
 812         self.pg_start()
 813         capture = pg0.get_capture(1)
 814         p = capture[0]
 815         try:
 816             ip = p[IP]
 817             tcp = p[TCP]
 818             if lb:
 819                 if ip.dst == server1.ip4:
 820                     server = server1
 821                     port_in = port_in1
 822                 else:
 823                     server = server2
 824                     port_in = port_in2
 825             self.assertEqual(ip.dst, server.ip4)
 826             if lb and same_pg:
 827                 self.assertIn(tcp.dport, [port_in1, port_in2])
 828             else:
 829                 self.assertEqual(tcp.dport, port_in)
 830             if eh_translate:
 831                 self.assertEqual(ip.src, twice_nat_addr)
 832                 self.assertNotEqual(tcp.sport, eh_port_out)
 833             else:
 834                 self.assertEqual(ip.src, client.ip4)
 835                 self.assertEqual(tcp.sport, eh_port_out)
 836             eh_addr_in = ip.src
 837             eh_port_in = tcp.sport
 838             saved_port_in = tcp.dport
 839             self.assert_packet_checksums_valid(p)
 840         except:
 841             self.logger.error(ppp("Unexpected or invalid packet:", p))
 842             raise
 843
 844         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 845              IP(src=server.ip4, dst=eh_addr_in) /
 846              TCP(sport=saved_port_in, dport=eh_port_in))
 847         pg0.add_stream(p)
 848         self.pg_enable_capture(self.pg_interfaces)
 849         self.pg_start()
 850         capture = pg1.get_capture(1)
 851         p = capture[0]
 852         try:
 853             ip = p[IP]
 854             tcp = p[TCP]
 855             self.assertEqual(ip.dst, client.ip4)
 856             self.assertEqual(ip.src, self.nat_addr)
 857             self.assertEqual(tcp.dport, eh_port_out)
 858             self.assertEqual(tcp.sport, port_out)
 859             self.assert_packet_checksums_valid(p)
 860         except:
 861             self.logger.error(ppp("Unexpected or invalid packet:", p))
 862             raise
 863
 864         if eh_translate:
 865             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 866             self.assertEqual(len(sessions), 1)
 867             self.assertTrue(sessions[0].flags &
 868                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 869             self.assertTrue(sessions[0].flags &
 870                             self.config_flags.NAT_IS_TWICE_NAT)
 871             self.logger.info(self.vapi.cli("show nat44 sessions"))
 872             self.vapi.nat44_del_session(
 873                 address=sessions[0].inside_ip_address,
 874                 port=sessions[0].inside_port,
 875                 protocol=sessions[0].protocol,
 876                 flags=(self.config_flags.NAT_IS_INSIDE |
 877                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 878                 ext_host_address=sessions[0].ext_host_nat_address,
 879                 ext_host_port=sessions[0].ext_host_nat_port)
 880             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 881             self.assertEqual(len(sessions), 0)
 882
 883     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 884         message = data.decode('utf-8')
 885         try:
 886             message = SyslogMessage.parse(message)
 887         except ParseError as e:
 888             self.logger.error(e)
 889             raise
 890         else:
 891             self.assertEqual(message.severity, SyslogSeverity.info)
 892             self.assertEqual(message.appname, 'NAT')
 893             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 894             sd_params = message.sd.get('nsess')
 895             self.assertTrue(sd_params is not None)
 896             if is_ip6:
 897                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 898                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 899             else:
 900                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 901                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 902                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 903             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 904             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 905             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 906             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 907             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 908             self.assertEqual(sd_params.get('SVLAN'), '0')
 909             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 910             self.assertEqual(sd_params.get('XDPORT'),
 911                              "%d" % self.tcp_external_port)
 912
 913
 914 class TestNAT44ED(NAT44EDTestCase):
 915     """ NAT44ED Test Case """
 916
 917     def test_icmp_error(self):
 918         """ NAT44ED test ICMP error message with inner header"""
 919
 920         payload = "H" * 10
 921
 922         self.nat_add_address(self.nat_addr)
 923         self.nat_add_inside_interface(self.pg0)
 924         self.nat_add_outside_interface(self.pg1)
 925
 926         # in2out (initiate connection)
 927         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 928               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 929               UDP(sport=21, dport=20) / payload)
 930
 931         self.pg0.add_stream(p1)
 932         self.pg_enable_capture(self.pg_interfaces)
 933         self.pg_start()
 934         capture = self.pg1.get_capture(1)[0]
 935
 936         # out2in (send error message)
 937         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 938               IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
 939               ICMP(type='dest-unreach', code='port-unreachable') /
 940               capture[IP:])
 941
 942         self.pg1.add_stream(p2)
 943         self.pg_enable_capture(self.pg_interfaces)
 944         self.pg_start()
 945
 946         capture = self.pg0.get_capture(1)[0]
 947
 948         self.logger.info(ppp("p1 packet:", p1))
 949         self.logger.info(ppp("p2 packet:", p2))
 950         self.logger.info(ppp("capture packet:", capture))
 951
 952     def test_users_dump(self):
 953         """ NAT44ED API test - nat44_user_dump """
 954
 955         self.nat_add_address(self.nat_addr)
 956         self.nat_add_inside_interface(self.pg0)
 957         self.nat_add_outside_interface(self.pg1)
 958
 959         self.vapi.nat44_forwarding_enable_disable(enable=1)
 960
 961         local_ip = self.pg0.remote_ip4
 962         external_ip = self.nat_addr
 963         self.nat_add_static_mapping(local_ip, external_ip)
 964
 965         users = self.vapi.nat44_user_dump()
 966         self.assertEqual(len(users), 0)
 967
 968         # in2out - static mapping match
 969
 970         pkts = self.create_stream_out(self.pg1)
 971         self.pg1.add_stream(pkts)
 972         self.pg_enable_capture(self.pg_interfaces)
 973         self.pg_start()
 974         capture = self.pg0.get_capture(len(pkts))
 975         self.verify_capture_in(capture, self.pg0)
 976
 977         pkts = self.create_stream_in(self.pg0, self.pg1)
 978         self.pg0.add_stream(pkts)
 979         self.pg_enable_capture(self.pg_interfaces)
 980         self.pg_start()
 981         capture = self.pg1.get_capture(len(pkts))
 982         self.verify_capture_out(capture, same_port=True)
 983
 984         users = self.vapi.nat44_user_dump()
 985         self.assertEqual(len(users), 1)
 986         static_user = users[0]
 987         self.assertEqual(static_user.nstaticsessions, 3)
 988         self.assertEqual(static_user.nsessions, 0)
 989
 990         # in2out - no static mapping match (forwarding test)
 991
 992         host0 = self.pg0.remote_hosts[0]
 993         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
 994         try:
 995             pkts = self.create_stream_out(self.pg1,
 996                                           dst_ip=self.pg0.remote_ip4,
 997                                           use_inside_ports=True)
 998             self.pg1.add_stream(pkts)
 999             self.pg_enable_capture(self.pg_interfaces)
1000             self.pg_start()
1001             capture = self.pg0.get_capture(len(pkts))
1002             self.verify_capture_in(capture, self.pg0)
1003
1004             pkts = self.create_stream_in(self.pg0, self.pg1)
1005             self.pg0.add_stream(pkts)
1006             self.pg_enable_capture(self.pg_interfaces)
1007             self.pg_start()
1008             capture = self.pg1.get_capture(len(pkts))
1009             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1010                                     same_port=True)
1011         finally:
1012             self.pg0.remote_hosts[0] = host0
1013
1014         users = self.vapi.nat44_user_dump()
1015         self.assertEqual(len(users), 2)
1016         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1017             non_static_user = users[1]
1018             static_user = users[0]
1019         else:
1020             non_static_user = users[0]
1021             static_user = users[1]
1022         self.assertEqual(static_user.nstaticsessions, 3)
1023         self.assertEqual(static_user.nsessions, 0)
1024         self.assertEqual(non_static_user.nstaticsessions, 0)
1025         self.assertEqual(non_static_user.nsessions, 3)
1026
1027         users = self.vapi.nat44_user_dump()
1028         self.assertEqual(len(users), 2)
1029         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1030             non_static_user = users[1]
1031             static_user = users[0]
1032         else:
1033             non_static_user = users[0]
1034             static_user = users[1]
1035         self.assertEqual(static_user.nstaticsessions, 3)
1036         self.assertEqual(static_user.nsessions, 0)
1037         self.assertEqual(non_static_user.nstaticsessions, 0)
1038         self.assertEqual(non_static_user.nsessions, 3)
1039
1040     def test_frag_out_of_order_do_not_translate(self):
1041         """ NAT44ED don't translate fragments arriving out of order """
1042         self.nat_add_inside_interface(self.pg0)
1043         self.nat_add_outside_interface(self.pg1)
1044         self.vapi.nat44_forwarding_enable_disable(enable=True)
1045         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1046
1047     def test_forwarding(self):
1048         """ NAT44ED forwarding test """
1049
1050         self.nat_add_inside_interface(self.pg0)
1051         self.nat_add_outside_interface(self.pg1)
1052         self.vapi.nat44_forwarding_enable_disable(enable=1)
1053
1054         real_ip = self.pg0.remote_ip4
1055         alias_ip = self.nat_addr
1056         flags = self.config_flags.NAT_IS_ADDR_ONLY
1057         self.vapi.nat44_add_del_static_mapping(is_add=1,
1058                                                local_ip_address=real_ip,
1059                                                external_ip_address=alias_ip,
1060                                                external_sw_if_index=0xFFFFFFFF,
1061                                                flags=flags)
1062
1063         try:
1064             # in2out - static mapping match
1065
1066             pkts = self.create_stream_out(self.pg1)
1067             self.pg1.add_stream(pkts)
1068             self.pg_enable_capture(self.pg_interfaces)
1069             self.pg_start()
1070             capture = self.pg0.get_capture(len(pkts))
1071             self.verify_capture_in(capture, self.pg0)
1072
1073             pkts = self.create_stream_in(self.pg0, self.pg1)
1074             self.pg0.add_stream(pkts)
1075             self.pg_enable_capture(self.pg_interfaces)
1076             self.pg_start()
1077             capture = self.pg1.get_capture(len(pkts))
1078             self.verify_capture_out(capture, same_port=True)
1079
1080             # in2out - no static mapping match
1081
1082             host0 = self.pg0.remote_hosts[0]
1083             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1084             try:
1085                 pkts = self.create_stream_out(self.pg1,
1086                                               dst_ip=self.pg0.remote_ip4,
1087                                               use_inside_ports=True)
1088                 self.pg1.add_stream(pkts)
1089                 self.pg_enable_capture(self.pg_interfaces)
1090                 self.pg_start()
1091                 capture = self.pg0.get_capture(len(pkts))
1092                 self.verify_capture_in(capture, self.pg0)
1093
1094                 pkts = self.create_stream_in(self.pg0, self.pg1)
1095                 self.pg0.add_stream(pkts)
1096                 self.pg_enable_capture(self.pg_interfaces)
1097                 self.pg_start()
1098                 capture = self.pg1.get_capture(len(pkts))
1099                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1100                                         same_port=True)
1101             finally:
1102                 self.pg0.remote_hosts[0] = host0
1103
1104             user = self.pg0.remote_hosts[1]
1105             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1106             self.assertEqual(len(sessions), 3)
1107             self.assertTrue(sessions[0].flags &
1108                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1109             self.vapi.nat44_del_session(
1110                 address=sessions[0].inside_ip_address,
1111                 port=sessions[0].inside_port,
1112                 protocol=sessions[0].protocol,
1113                 flags=(self.config_flags.NAT_IS_INSIDE |
1114                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1115                 ext_host_address=sessions[0].ext_host_address,
1116                 ext_host_port=sessions[0].ext_host_port)
1117             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1118             self.assertEqual(len(sessions), 2)
1119
1120         finally:
1121             self.vapi.nat44_forwarding_enable_disable(enable=0)
1122             flags = self.config_flags.NAT_IS_ADDR_ONLY
1123             self.vapi.nat44_add_del_static_mapping(
1124                 is_add=0,
1125                 local_ip_address=real_ip,
1126                 external_ip_address=alias_ip,
1127                 external_sw_if_index=0xFFFFFFFF,
1128                 flags=flags)
1129
1130     def test_output_feature_and_service2(self):
1131         """ NAT44ED interface output feature and service host direct access """
1132         self.vapi.nat44_forwarding_enable_disable(enable=1)
1133         self.nat_add_address(self.nat_addr)
1134
1135         self.vapi.nat44_interface_add_del_output_feature(
1136             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1137
1138         # session initiated from service host - translate
1139         pkts = self.create_stream_in(self.pg0, self.pg1)
1140         self.pg0.add_stream(pkts)
1141         self.pg_enable_capture(self.pg_interfaces)
1142         self.pg_start()
1143         capture = self.pg1.get_capture(len(pkts))
1144         self.verify_capture_out(capture, ignore_port=True)
1145
1146         pkts = self.create_stream_out(self.pg1)
1147         self.pg1.add_stream(pkts)
1148         self.pg_enable_capture(self.pg_interfaces)
1149         self.pg_start()
1150         capture = self.pg0.get_capture(len(pkts))
1151         self.verify_capture_in(capture, self.pg0)
1152
1153         # session initiated from remote host - do not translate
1154         tcp_port_in = self.tcp_port_in
1155         udp_port_in = self.udp_port_in
1156         icmp_id_in = self.icmp_id_in
1157
1158         self.tcp_port_in = 60303
1159         self.udp_port_in = 60304
1160         self.icmp_id_in = 60305
1161
1162         try:
1163             pkts = self.create_stream_out(self.pg1,
1164                                           self.pg0.remote_ip4,
1165                                           use_inside_ports=True)
1166             self.pg1.add_stream(pkts)
1167             self.pg_enable_capture(self.pg_interfaces)
1168             self.pg_start()
1169             capture = self.pg0.get_capture(len(pkts))
1170             self.verify_capture_in(capture, self.pg0)
1171
1172             pkts = self.create_stream_in(self.pg0, self.pg1)
1173             self.pg0.add_stream(pkts)
1174             self.pg_enable_capture(self.pg_interfaces)
1175             self.pg_start()
1176             capture = self.pg1.get_capture(len(pkts))
1177             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1178                                     same_port=True)
1179         finally:
1180             self.tcp_port_in = tcp_port_in
1181             self.udp_port_in = udp_port_in
1182             self.icmp_id_in = icmp_id_in
1183
1184     def test_twice_nat(self):
1185         """ NAT44ED Twice NAT """
1186         self.twice_nat_common()
1187
1188     def test_self_twice_nat_positive(self):
1189         """ NAT44ED Self Twice NAT (positive test) """
1190         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1191
1192     def test_self_twice_nat_lb_positive(self):
1193         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1194         """
1195         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1196                               client_id=1)
1197
1198     def test_twice_nat_lb(self):
1199         """ NAT44ED Twice NAT local service load balancing """
1200         self.twice_nat_common(lb=True)
1201
1202     def test_output_feature(self):
1203         """ NAT44ED interface output feature (in2out postrouting) """
1204         self.vapi.nat44_forwarding_enable_disable(enable=1)
1205         self.nat_add_address(self.nat_addr)
1206
1207         self.nat_add_outside_interface(self.pg0)
1208         self.vapi.nat44_interface_add_del_output_feature(
1209             sw_if_index=self.pg1.sw_if_index, is_add=1)
1210
1211         # in2out
1212         pkts = self.create_stream_in(self.pg0, self.pg1)
1213         self.pg0.add_stream(pkts)
1214         self.pg_enable_capture(self.pg_interfaces)
1215         self.pg_start()
1216         capture = self.pg1.get_capture(len(pkts))
1217         self.verify_capture_out(capture, ignore_port=True)
1218
1219         # out2in
1220         pkts = self.create_stream_out(self.pg1)
1221         self.pg1.add_stream(pkts)
1222         self.pg_enable_capture(self.pg_interfaces)
1223         self.pg_start()
1224         capture = self.pg0.get_capture(len(pkts))
1225         self.verify_capture_in(capture, self.pg0)
1226
1227         # in2out
1228         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1229         self.pg0.add_stream(pkts)
1230         self.pg_enable_capture(self.pg_interfaces)
1231         self.pg_start()
1232         capture = self.pg1.get_capture(len(pkts))
1233         self.verify_capture_out(capture, ignore_port=True)
1234
1235         # out2in
1236         pkts = self.create_stream_out(self.pg1, ttl=2)
1237         self.pg1.add_stream(pkts)
1238         self.pg_enable_capture(self.pg_interfaces)
1239         self.pg_start()
1240         capture = self.pg0.get_capture(len(pkts))
1241         self.verify_capture_in(capture, self.pg0)
1242
1243         # in2out
1244         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1245         self.pg0.add_stream(pkts)
1246         self.pg_enable_capture(self.pg_interfaces)
1247         self.pg_start()
1248         capture = self.pg0.get_capture(len(pkts))
1249         for p in capture:
1250             self.assertIn(ICMP, p)
1251             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1252
1253     def test_static_with_port_out2(self):
1254         """ NAT44ED 1:1 NAPT asymmetrical rule """
1255
1256         external_port = 80
1257         local_port = 8080
1258
1259         self.vapi.nat44_forwarding_enable_disable(enable=1)
1260         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1261         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1262                                     local_port, external_port,
1263                                     proto=IP_PROTOS.tcp, flags=flags)
1264
1265         self.nat_add_inside_interface(self.pg0)
1266         self.nat_add_outside_interface(self.pg1)
1267
1268         # from client to service
1269         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1270              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1271              TCP(sport=12345, dport=external_port))
1272         self.pg1.add_stream(p)
1273         self.pg_enable_capture(self.pg_interfaces)
1274         self.pg_start()
1275         capture = self.pg0.get_capture(1)
1276         p = capture[0]
1277         try:
1278             ip = p[IP]
1279             tcp = p[TCP]
1280             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1281             self.assertEqual(tcp.dport, local_port)
1282             self.assert_packet_checksums_valid(p)
1283         except:
1284             self.logger.error(ppp("Unexpected or invalid packet:", p))
1285             raise
1286
1287         # ICMP error
1288         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1289              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1290              ICMP(type=11) / capture[0][IP])
1291         self.pg0.add_stream(p)
1292         self.pg_enable_capture(self.pg_interfaces)
1293         self.pg_start()
1294         capture = self.pg1.get_capture(1)
1295         p = capture[0]
1296         try:
1297             self.assertEqual(p[IP].src, self.nat_addr)
1298             inner = p[IPerror]
1299             self.assertEqual(inner.dst, self.nat_addr)
1300             self.assertEqual(inner[TCPerror].dport, external_port)
1301         except:
1302             self.logger.error(ppp("Unexpected or invalid packet:", p))
1303             raise
1304
1305         # from service back to client
1306         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1307              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1308              TCP(sport=local_port, dport=12345))
1309         self.pg0.add_stream(p)
1310         self.pg_enable_capture(self.pg_interfaces)
1311         self.pg_start()
1312         capture = self.pg1.get_capture(1)
1313         p = capture[0]
1314         try:
1315             ip = p[IP]
1316             tcp = p[TCP]
1317             self.assertEqual(ip.src, self.nat_addr)
1318             self.assertEqual(tcp.sport, external_port)
1319             self.assert_packet_checksums_valid(p)
1320         except:
1321             self.logger.error(ppp("Unexpected or invalid packet:", p))
1322             raise
1323
1324         # ICMP error
1325         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1326              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1327              ICMP(type=11) / capture[0][IP])
1328         self.pg1.add_stream(p)
1329         self.pg_enable_capture(self.pg_interfaces)
1330         self.pg_start()
1331         capture = self.pg0.get_capture(1)
1332         p = capture[0]
1333         try:
1334             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1335             inner = p[IPerror]
1336             self.assertEqual(inner.src, self.pg0.remote_ip4)
1337             self.assertEqual(inner[TCPerror].sport, local_port)
1338         except:
1339             self.logger.error(ppp("Unexpected or invalid packet:", p))
1340             raise
1341
1342         # from client to server (no translation)
1343         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1344              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1345              TCP(sport=12346, dport=local_port))
1346         self.pg1.add_stream(p)
1347         self.pg_enable_capture(self.pg_interfaces)
1348         self.pg_start()
1349         capture = self.pg0.get_capture(1)
1350         p = capture[0]
1351         try:
1352             ip = p[IP]
1353             tcp = p[TCP]
1354             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1355             self.assertEqual(tcp.dport, local_port)
1356             self.assert_packet_checksums_valid(p)
1357         except:
1358             self.logger.error(ppp("Unexpected or invalid packet:", p))
1359             raise
1360
1361         # from service back to client (no translation)
1362         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1363              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1364              TCP(sport=local_port, dport=12346))
1365         self.pg0.add_stream(p)
1366         self.pg_enable_capture(self.pg_interfaces)
1367         self.pg_start()
1368         capture = self.pg1.get_capture(1)
1369         p = capture[0]
1370         try:
1371             ip = p[IP]
1372             tcp = p[TCP]
1373             self.assertEqual(ip.src, self.pg0.remote_ip4)
1374             self.assertEqual(tcp.sport, local_port)
1375             self.assert_packet_checksums_valid(p)
1376         except:
1377             self.logger.error(ppp("Unexpected or invalid packet:", p))
1378             raise
1379
1380     def test_static_lb(self):
1381         """ NAT44ED local service load balancing """
1382         external_addr_n = self.nat_addr
1383         external_port = 80
1384         local_port = 8080
1385         server1 = self.pg0.remote_hosts[0]
1386         server2 = self.pg0.remote_hosts[1]
1387
1388         locals = [{'addr': server1.ip4,
1389                    'port': local_port,
1390                    'probability': 70,
1391                    'vrf_id': 0},
1392                   {'addr': server2.ip4,
1393                    'port': local_port,
1394                    'probability': 30,
1395                    'vrf_id': 0}]
1396
1397         self.nat_add_address(self.nat_addr)
1398         self.vapi.nat44_add_del_lb_static_mapping(
1399             is_add=1,
1400             external_addr=external_addr_n,
1401             external_port=external_port,
1402             protocol=IP_PROTOS.tcp,
1403             local_num=len(locals),
1404             locals=locals)
1405         flags = self.config_flags.NAT_IS_INSIDE
1406         self.vapi.nat44_interface_add_del_feature(
1407             sw_if_index=self.pg0.sw_if_index,
1408             flags=flags, is_add=1)
1409         self.vapi.nat44_interface_add_del_feature(
1410             sw_if_index=self.pg1.sw_if_index,
1411             is_add=1)
1412
1413         # from client to service
1414         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1415              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1416              TCP(sport=12345, dport=external_port))
1417         self.pg1.add_stream(p)
1418         self.pg_enable_capture(self.pg_interfaces)
1419         self.pg_start()
1420         capture = self.pg0.get_capture(1)
1421         p = capture[0]
1422         server = None
1423         try:
1424             ip = p[IP]
1425             tcp = p[TCP]
1426             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1427             if ip.dst == server1.ip4:
1428                 server = server1
1429             else:
1430                 server = server2
1431             self.assertEqual(tcp.dport, local_port)
1432             self.assert_packet_checksums_valid(p)
1433         except:
1434             self.logger.error(ppp("Unexpected or invalid packet:", p))
1435             raise
1436
1437         # from service back to client
1438         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1439              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1440              TCP(sport=local_port, dport=12345))
1441         self.pg0.add_stream(p)
1442         self.pg_enable_capture(self.pg_interfaces)
1443         self.pg_start()
1444         capture = self.pg1.get_capture(1)
1445         p = capture[0]
1446         try:
1447             ip = p[IP]
1448             tcp = p[TCP]
1449             self.assertEqual(ip.src, self.nat_addr)
1450             self.assertEqual(tcp.sport, external_port)
1451             self.assert_packet_checksums_valid(p)
1452         except:
1453             self.logger.error(ppp("Unexpected or invalid packet:", p))
1454             raise
1455
1456         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1457         self.assertEqual(len(sessions), 1)
1458         self.assertTrue(sessions[0].flags &
1459                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1460         self.vapi.nat44_del_session(
1461             address=sessions[0].inside_ip_address,
1462             port=sessions[0].inside_port,
1463             protocol=sessions[0].protocol,
1464             flags=(self.config_flags.NAT_IS_INSIDE |
1465                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1466             ext_host_address=sessions[0].ext_host_address,
1467             ext_host_port=sessions[0].ext_host_port)
1468         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1469         self.assertEqual(len(sessions), 0)
1470
1471     def test_static_lb_2(self):
1472         """ NAT44ED local service load balancing (asymmetrical rule) """
1473         external_addr = self.nat_addr
1474         external_port = 80
1475         local_port = 8080
1476         server1 = self.pg0.remote_hosts[0]
1477         server2 = self.pg0.remote_hosts[1]
1478
1479         locals = [{'addr': server1.ip4,
1480                    'port': local_port,
1481                    'probability': 70,
1482                    'vrf_id': 0},
1483                   {'addr': server2.ip4,
1484                    'port': local_port,
1485                    'probability': 30,
1486                    'vrf_id': 0}]
1487
1488         self.vapi.nat44_forwarding_enable_disable(enable=1)
1489         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1490         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1491                                                   external_addr=external_addr,
1492                                                   external_port=external_port,
1493                                                   protocol=IP_PROTOS.tcp,
1494                                                   local_num=len(locals),
1495                                                   locals=locals)
1496         flags = self.config_flags.NAT_IS_INSIDE
1497         self.vapi.nat44_interface_add_del_feature(
1498             sw_if_index=self.pg0.sw_if_index,
1499             flags=flags, is_add=1)
1500         self.vapi.nat44_interface_add_del_feature(
1501             sw_if_index=self.pg1.sw_if_index,
1502             is_add=1)
1503
1504         # from client to service
1505         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1506              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1507              TCP(sport=12345, dport=external_port))
1508         self.pg1.add_stream(p)
1509         self.pg_enable_capture(self.pg_interfaces)
1510         self.pg_start()
1511         capture = self.pg0.get_capture(1)
1512         p = capture[0]
1513         server = None
1514         try:
1515             ip = p[IP]
1516             tcp = p[TCP]
1517             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1518             if ip.dst == server1.ip4:
1519                 server = server1
1520             else:
1521                 server = server2
1522             self.assertEqual(tcp.dport, local_port)
1523             self.assert_packet_checksums_valid(p)
1524         except:
1525             self.logger.error(ppp("Unexpected or invalid packet:", p))
1526             raise
1527
1528         # from service back to client
1529         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1530              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1531              TCP(sport=local_port, dport=12345))
1532         self.pg0.add_stream(p)
1533         self.pg_enable_capture(self.pg_interfaces)
1534         self.pg_start()
1535         capture = self.pg1.get_capture(1)
1536         p = capture[0]
1537         try:
1538             ip = p[IP]
1539             tcp = p[TCP]
1540             self.assertEqual(ip.src, self.nat_addr)
1541             self.assertEqual(tcp.sport, external_port)
1542             self.assert_packet_checksums_valid(p)
1543         except:
1544             self.logger.error(ppp("Unexpected or invalid packet:", p))
1545             raise
1546
1547         # from client to server (no translation)
1548         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1549              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1550              TCP(sport=12346, dport=local_port))
1551         self.pg1.add_stream(p)
1552         self.pg_enable_capture(self.pg_interfaces)
1553         self.pg_start()
1554         capture = self.pg0.get_capture(1)
1555         p = capture[0]
1556         server = None
1557         try:
1558             ip = p[IP]
1559             tcp = p[TCP]
1560             self.assertEqual(ip.dst, server1.ip4)
1561             self.assertEqual(tcp.dport, local_port)
1562             self.assert_packet_checksums_valid(p)
1563         except:
1564             self.logger.error(ppp("Unexpected or invalid packet:", p))
1565             raise
1566
1567         # from service back to client (no translation)
1568         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1569              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1570              TCP(sport=local_port, dport=12346))
1571         self.pg0.add_stream(p)
1572         self.pg_enable_capture(self.pg_interfaces)
1573         self.pg_start()
1574         capture = self.pg1.get_capture(1)
1575         p = capture[0]
1576         try:
1577             ip = p[IP]
1578             tcp = p[TCP]
1579             self.assertEqual(ip.src, server1.ip4)
1580             self.assertEqual(tcp.sport, local_port)
1581             self.assert_packet_checksums_valid(p)
1582         except:
1583             self.logger.error(ppp("Unexpected or invalid packet:", p))
1584             raise
1585
1586     def test_lb_affinity(self):
1587         """ NAT44ED local service load balancing affinity """
1588         external_addr = self.nat_addr
1589         external_port = 80
1590         local_port = 8080
1591         server1 = self.pg0.remote_hosts[0]
1592         server2 = self.pg0.remote_hosts[1]
1593
1594         locals = [{'addr': server1.ip4,
1595                    'port': local_port,
1596                    'probability': 50,
1597                    'vrf_id': 0},
1598                   {'addr': server2.ip4,
1599                    'port': local_port,
1600                    'probability': 50,
1601                    'vrf_id': 0}]
1602
1603         self.nat_add_address(self.nat_addr)
1604         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1605                                                   external_addr=external_addr,
1606                                                   external_port=external_port,
1607                                                   protocol=IP_PROTOS.tcp,
1608                                                   affinity=10800,
1609                                                   local_num=len(locals),
1610                                                   locals=locals)
1611         flags = self.config_flags.NAT_IS_INSIDE
1612         self.vapi.nat44_interface_add_del_feature(
1613             sw_if_index=self.pg0.sw_if_index,
1614             flags=flags, is_add=1)
1615         self.vapi.nat44_interface_add_del_feature(
1616             sw_if_index=self.pg1.sw_if_index,
1617             is_add=1)
1618
1619         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1620              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1621              TCP(sport=1025, dport=external_port))
1622         self.pg1.add_stream(p)
1623         self.pg_enable_capture(self.pg_interfaces)
1624         self.pg_start()
1625         capture = self.pg0.get_capture(1)
1626         backend = capture[0][IP].dst
1627
1628         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1629         self.assertEqual(len(sessions), 1)
1630         self.assertTrue(sessions[0].flags &
1631                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1632         self.vapi.nat44_del_session(
1633             address=sessions[0].inside_ip_address,
1634             port=sessions[0].inside_port,
1635             protocol=sessions[0].protocol,
1636             flags=(self.config_flags.NAT_IS_INSIDE |
1637                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1638             ext_host_address=sessions[0].ext_host_address,
1639             ext_host_port=sessions[0].ext_host_port)
1640
1641         pkts = []
1642         for port in range(1030, 1100):
1643             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1644                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1645                  TCP(sport=port, dport=external_port))
1646             pkts.append(p)
1647         self.pg1.add_stream(pkts)
1648         self.pg_enable_capture(self.pg_interfaces)
1649         self.pg_start()
1650         capture = self.pg0.get_capture(len(pkts))
1651         for p in capture:
1652             self.assertEqual(p[IP].dst, backend)
1653
1654     def test_multiple_vrf_1(self):
1655         """ Multiple VRF - both client & service in VRF1 """
1656
1657         external_addr = '1.2.3.4'
1658         external_port = 80
1659         local_port = 8080
1660         port = 0
1661
1662         flags = self.config_flags.NAT_IS_INSIDE
1663         self.vapi.nat44_interface_add_del_feature(
1664             sw_if_index=self.pg5.sw_if_index,
1665             is_add=1)
1666         self.vapi.nat44_interface_add_del_feature(
1667             sw_if_index=self.pg5.sw_if_index,
1668             is_add=1, flags=flags)
1669         self.vapi.nat44_interface_add_del_feature(
1670             sw_if_index=self.pg6.sw_if_index,
1671             is_add=1)
1672         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1673         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1674                                     local_port, external_port, vrf_id=1,
1675                                     proto=IP_PROTOS.tcp, flags=flags)
1676
1677         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1678              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1679              TCP(sport=12345, dport=external_port))
1680         self.pg6.add_stream(p)
1681         self.pg_enable_capture(self.pg_interfaces)
1682         self.pg_start()
1683         capture = self.pg5.get_capture(1)
1684         p = capture[0]
1685         try:
1686             ip = p[IP]
1687             tcp = p[TCP]
1688             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1689             self.assertEqual(tcp.dport, local_port)
1690             self.assert_packet_checksums_valid(p)
1691         except:
1692             self.logger.error(ppp("Unexpected or invalid packet:", p))
1693             raise
1694
1695         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1696              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1697              TCP(sport=local_port, dport=12345))
1698         self.pg5.add_stream(p)
1699         self.pg_enable_capture(self.pg_interfaces)
1700         self.pg_start()
1701         capture = self.pg6.get_capture(1)
1702         p = capture[0]
1703         try:
1704             ip = p[IP]
1705             tcp = p[TCP]
1706             self.assertEqual(ip.src, external_addr)
1707             self.assertEqual(tcp.sport, external_port)
1708             self.assert_packet_checksums_valid(p)
1709         except:
1710             self.logger.error(ppp("Unexpected or invalid packet:", p))
1711             raise
1712
1713     def test_multiple_vrf_2(self):
1714         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1715
1716         external_addr = '1.2.3.4'
1717         external_port = 80
1718         local_port = 8080
1719         port = 0
1720
1721         self.nat_add_address(self.nat_addr)
1722         flags = self.config_flags.NAT_IS_INSIDE
1723         self.vapi.nat44_interface_add_del_output_feature(
1724             sw_if_index=self.pg1.sw_if_index,
1725             is_add=1)
1726         self.vapi.nat44_interface_add_del_feature(
1727             sw_if_index=self.pg5.sw_if_index,
1728             is_add=1)
1729         self.vapi.nat44_interface_add_del_feature(
1730             sw_if_index=self.pg5.sw_if_index,
1731             is_add=1, flags=flags)
1732         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1733         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1734                                     local_port, external_port, vrf_id=1,
1735                                     proto=IP_PROTOS.tcp, flags=flags)
1736
1737         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1738              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1739              TCP(sport=2345, dport=22))
1740         self.pg5.add_stream(p)
1741         self.pg_enable_capture(self.pg_interfaces)
1742         self.pg_start()
1743         capture = self.pg1.get_capture(1)
1744         p = capture[0]
1745         try:
1746             ip = p[IP]
1747             tcp = p[TCP]
1748             self.assertEqual(ip.src, self.nat_addr)
1749             self.assert_packet_checksums_valid(p)
1750             port = tcp.sport
1751         except:
1752             self.logger.error(ppp("Unexpected or invalid packet:", p))
1753             raise
1754
1755         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1756              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1757              TCP(sport=22, dport=port))
1758         self.pg1.add_stream(p)
1759         self.pg_enable_capture(self.pg_interfaces)
1760         self.pg_start()
1761         capture = self.pg5.get_capture(1)
1762         p = capture[0]
1763         try:
1764             ip = p[IP]
1765             tcp = p[TCP]
1766             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1767             self.assertEqual(tcp.dport, 2345)
1768             self.assert_packet_checksums_valid(p)
1769         except:
1770             self.logger.error(ppp("Unexpected or invalid packet:", p))
1771             raise
1772
1773     def test_multiple_vrf_3(self):
1774         """ Multiple VRF - client in VRF1, service in VRF0 """
1775
1776         external_addr = '1.2.3.4'
1777         external_port = 80
1778         local_port = 8080
1779         port = 0
1780
1781         flags = self.config_flags.NAT_IS_INSIDE
1782         self.vapi.nat44_interface_add_del_feature(
1783             sw_if_index=self.pg0.sw_if_index,
1784             is_add=1)
1785         self.vapi.nat44_interface_add_del_feature(
1786             sw_if_index=self.pg0.sw_if_index,
1787             is_add=1, flags=flags)
1788         self.vapi.nat44_interface_add_del_feature(
1789             sw_if_index=self.pg6.sw_if_index,
1790             is_add=1)
1791         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1792         self.nat_add_static_mapping(
1793             self.pg0.remote_ip4,
1794             external_sw_if_index=self.pg0.sw_if_index,
1795             local_port=local_port,
1796             vrf_id=0,
1797             external_port=external_port,
1798             proto=IP_PROTOS.tcp,
1799             flags=flags
1800         )
1801
1802         # from client VRF1 to service VRF0
1803         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1804              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1805              TCP(sport=12346, dport=external_port))
1806         self.pg6.add_stream(p)
1807         self.pg_enable_capture(self.pg_interfaces)
1808         self.pg_start()
1809         capture = self.pg0.get_capture(1)
1810         p = capture[0]
1811         try:
1812             ip = p[IP]
1813             tcp = p[TCP]
1814             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1815             self.assertEqual(tcp.dport, local_port)
1816             self.assert_packet_checksums_valid(p)
1817         except:
1818             self.logger.error(ppp("Unexpected or invalid packet:", p))
1819             raise
1820
1821         # from service VRF0 back to client VRF1
1822         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1823              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1824              TCP(sport=local_port, dport=12346))
1825         self.pg0.add_stream(p)
1826         self.pg_enable_capture(self.pg_interfaces)
1827         self.pg_start()
1828         capture = self.pg6.get_capture(1)
1829         p = capture[0]
1830         try:
1831             ip = p[IP]
1832             tcp = p[TCP]
1833             self.assertEqual(ip.src, self.pg0.local_ip4)
1834             self.assertEqual(tcp.sport, external_port)
1835             self.assert_packet_checksums_valid(p)
1836         except:
1837             self.logger.error(ppp("Unexpected or invalid packet:", p))
1838             raise
1839
1840     def test_multiple_vrf_4(self):
1841         """ Multiple VRF - client in VRF0, service in VRF1 """
1842
1843         external_addr = '1.2.3.4'
1844         external_port = 80
1845         local_port = 8080
1846         port = 0
1847
1848         flags = self.config_flags.NAT_IS_INSIDE
1849         self.vapi.nat44_interface_add_del_feature(
1850             sw_if_index=self.pg0.sw_if_index,
1851             is_add=1)
1852         self.vapi.nat44_interface_add_del_feature(
1853             sw_if_index=self.pg0.sw_if_index,
1854             is_add=1, flags=flags)
1855         self.vapi.nat44_interface_add_del_feature(
1856             sw_if_index=self.pg5.sw_if_index,
1857             is_add=1)
1858         self.vapi.nat44_interface_add_del_feature(
1859             sw_if_index=self.pg5.sw_if_index,
1860             is_add=1, flags=flags)
1861         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1862         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1863                                     local_port, external_port, vrf_id=1,
1864                                     proto=IP_PROTOS.tcp, flags=flags)
1865
1866         # from client VRF0 to service VRF1
1867         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1868              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1869              TCP(sport=12347, dport=external_port))
1870         self.pg0.add_stream(p)
1871         self.pg_enable_capture(self.pg_interfaces)
1872         self.pg_start()
1873         capture = self.pg5.get_capture(1)
1874         p = capture[0]
1875         try:
1876             ip = p[IP]
1877             tcp = p[TCP]
1878             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1879             self.assertEqual(tcp.dport, local_port)
1880             self.assert_packet_checksums_valid(p)
1881         except:
1882             self.logger.error(ppp("Unexpected or invalid packet:", p))
1883             raise
1884
1885         # from service VRF1 back to client VRF0
1886         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1887              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1888              TCP(sport=local_port, dport=12347))
1889         self.pg5.add_stream(p)
1890         self.pg_enable_capture(self.pg_interfaces)
1891         self.pg_start()
1892         capture = self.pg0.get_capture(1)
1893         p = capture[0]
1894         try:
1895             ip = p[IP]
1896             tcp = p[TCP]
1897             self.assertEqual(ip.src, external_addr)
1898             self.assertEqual(tcp.sport, external_port)
1899             self.assert_packet_checksums_valid(p)
1900         except:
1901             self.logger.error(ppp("Unexpected or invalid packet:", p))
1902             raise
1903
1904     def test_multiple_vrf_5(self):
1905         """ Multiple VRF - forwarding - no translation """
1906
1907         external_addr = '1.2.3.4'
1908         external_port = 80
1909         local_port = 8080
1910         port = 0
1911
1912         self.vapi.nat44_forwarding_enable_disable(enable=1)
1913         flags = self.config_flags.NAT_IS_INSIDE
1914         self.vapi.nat44_interface_add_del_feature(
1915             sw_if_index=self.pg0.sw_if_index,
1916             is_add=1)
1917         self.vapi.nat44_interface_add_del_feature(
1918             sw_if_index=self.pg0.sw_if_index,
1919             is_add=1, flags=flags)
1920         self.vapi.nat44_interface_add_del_feature(
1921             sw_if_index=self.pg5.sw_if_index,
1922             is_add=1)
1923         self.vapi.nat44_interface_add_del_feature(
1924             sw_if_index=self.pg5.sw_if_index,
1925             is_add=1, flags=flags)
1926         self.vapi.nat44_interface_add_del_feature(
1927             sw_if_index=self.pg6.sw_if_index,
1928             is_add=1)
1929         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1930         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1931                                     local_port, external_port, vrf_id=1,
1932                                     proto=IP_PROTOS.tcp, flags=flags)
1933         self.nat_add_static_mapping(
1934             self.pg0.remote_ip4,
1935             external_sw_if_index=self.pg0.sw_if_index,
1936             local_port=local_port,
1937             vrf_id=0,
1938             external_port=external_port,
1939             proto=IP_PROTOS.tcp,
1940             flags=flags
1941         )
1942
1943         # from client to server (both VRF1, no translation)
1944         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1945              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1946              TCP(sport=12348, dport=local_port))
1947         self.pg6.add_stream(p)
1948         self.pg_enable_capture(self.pg_interfaces)
1949         self.pg_start()
1950         capture = self.pg5.get_capture(1)
1951         p = capture[0]
1952         try:
1953             ip = p[IP]
1954             tcp = p[TCP]
1955             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1956             self.assertEqual(tcp.dport, local_port)
1957             self.assert_packet_checksums_valid(p)
1958         except:
1959             self.logger.error(ppp("Unexpected or invalid packet:", p))
1960             raise
1961
1962         # from server back to client (both VRF1, no translation)
1963         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1964              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1965              TCP(sport=local_port, dport=12348))
1966         self.pg5.add_stream(p)
1967         self.pg_enable_capture(self.pg_interfaces)
1968         self.pg_start()
1969         capture = self.pg6.get_capture(1)
1970         p = capture[0]
1971         try:
1972             ip = p[IP]
1973             tcp = p[TCP]
1974             self.assertEqual(ip.src, self.pg5.remote_ip4)
1975             self.assertEqual(tcp.sport, local_port)
1976             self.assert_packet_checksums_valid(p)
1977         except:
1978             self.logger.error(ppp("Unexpected or invalid packet:", p))
1979             raise
1980
1981         # from client VRF1 to server VRF0 (no translation)
1982         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1983              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1984              TCP(sport=local_port, dport=12349))
1985         self.pg0.add_stream(p)
1986         self.pg_enable_capture(self.pg_interfaces)
1987         self.pg_start()
1988         capture = self.pg6.get_capture(1)
1989         p = capture[0]
1990         try:
1991             ip = p[IP]
1992             tcp = p[TCP]
1993             self.assertEqual(ip.src, self.pg0.remote_ip4)
1994             self.assertEqual(tcp.sport, local_port)
1995             self.assert_packet_checksums_valid(p)
1996         except:
1997             self.logger.error(ppp("Unexpected or invalid packet:", p))
1998             raise
1999
2000         # from server VRF0 back to client VRF1 (no translation)
2001         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2002              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2003              TCP(sport=local_port, dport=12349))
2004         self.pg0.add_stream(p)
2005         self.pg_enable_capture(self.pg_interfaces)
2006         self.pg_start()
2007         capture = self.pg6.get_capture(1)
2008         p = capture[0]
2009         try:
2010             ip = p[IP]
2011             tcp = p[TCP]
2012             self.assertEqual(ip.src, self.pg0.remote_ip4)
2013             self.assertEqual(tcp.sport, local_port)
2014             self.assert_packet_checksums_valid(p)
2015         except:
2016             self.logger.error(ppp("Unexpected or invalid packet:", p))
2017             raise
2018
2019         # from client VRF0 to server VRF1 (no translation)
2020         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2021              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
2022              TCP(sport=12344, dport=local_port))
2023         self.pg0.add_stream(p)
2024         self.pg_enable_capture(self.pg_interfaces)
2025         self.pg_start()
2026         capture = self.pg5.get_capture(1)
2027         p = capture[0]
2028         try:
2029             ip = p[IP]
2030             tcp = p[TCP]
2031             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2032             self.assertEqual(tcp.dport, local_port)
2033             self.assert_packet_checksums_valid(p)
2034         except:
2035             self.logger.error(ppp("Unexpected or invalid packet:", p))
2036             raise
2037
2038         # from server VRF1 back to client VRF0 (no translation)
2039         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2040              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2041              TCP(sport=local_port, dport=12344))
2042         self.pg5.add_stream(p)
2043         self.pg_enable_capture(self.pg_interfaces)
2044         self.pg_start()
2045         capture = self.pg0.get_capture(1)
2046         p = capture[0]
2047         try:
2048             ip = p[IP]
2049             tcp = p[TCP]
2050             self.assertEqual(ip.src, self.pg5.remote_ip4)
2051             self.assertEqual(tcp.sport, local_port)
2052             self.assert_packet_checksums_valid(p)
2053         except:
2054             self.logger.error(ppp("Unexpected or invalid packet:", p))
2055             raise
2056
2057     def test_outside_address_distribution(self):
2058         """ Outside address distribution based on source address """
2059
2060         x = 100
2061         nat_addresses = []
2062
2063         for i in range(1, x):
2064             a = "10.0.0.%d" % i
2065             nat_addresses.append(a)
2066
2067         self.nat_add_inside_interface(self.pg0)
2068         self.nat_add_outside_interface(self.pg1)
2069
2070         self.vapi.nat44_add_del_address_range(
2071             first_ip_address=nat_addresses[0],
2072             last_ip_address=nat_addresses[-1],
2073             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2074
2075         self.pg0.generate_remote_hosts(x)
2076
2077         pkts = []
2078         for i in range(x):
2079             info = self.create_packet_info(self.pg0, self.pg1)
2080             payload = self.info_to_payload(info)
2081             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2082                  IP(src=self.pg0.remote_hosts[i].ip4,
2083                      dst=self.pg1.remote_ip4) /
2084                  UDP(sport=7000+i, dport=8000+i) /
2085                  Raw(payload))
2086             info.data = p
2087             pkts.append(p)
2088
2089         self.pg0.add_stream(pkts)
2090         self.pg_enable_capture(self.pg_interfaces)
2091         self.pg_start()
2092         recvd = self.pg1.get_capture(len(pkts))
2093         for p_recvd in recvd:
2094             payload_info = self.payload_to_info(p_recvd[Raw])
2095             packet_index = payload_info.index
2096             info = self._packet_infos[packet_index]
2097             self.assertTrue(info is not None)
2098             self.assertEqual(packet_index, info.index)
2099             p_sent = info.data
2100             packed = socket.inet_aton(p_sent[IP].src)
2101             numeric = struct.unpack("!L", packed)[0]
2102             numeric = socket.htonl(numeric)
2103             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2104             self.assertEqual(
2105                 a, p_recvd[IP].src,
2106                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2107                 % (p_sent[IP].src, p_recvd[IP].src, a))
2108
2109
2110 class TestNAT44EDMW(TestNAT44ED):
2111     """ NAT44ED MW Test Case """
2112     vpp_worker_count = 4
2113     max_sessions = 5000
2114
2115     @unittest.skip('MW fix required')
2116     def test_users_dump(self):
2117         """ NAT44ED API test - nat44_user_dump """
2118
2119     @unittest.skip('MW fix required')
2120     def test_frag_out_of_order_do_not_translate(self):
2121         """ NAT44ED don't translate fragments arriving out of order """
2122
2123     @unittest.skip('MW fix required')
2124     def test_forwarding(self):
2125         """ NAT44ED forwarding test """
2126
2127     @unittest.skip('MW fix required')
2128     def test_twice_nat(self):
2129         """ NAT44ED Twice NAT """
2130
2131     @unittest.skip('MW fix required')
2132     def test_twice_nat_lb(self):
2133         """ NAT44ED Twice NAT local service load balancing """
2134
2135     @unittest.skip('MW fix required')
2136     def test_output_feature(self):
2137         """ NAT44ED interface output feature (in2out postrouting) """
2138
2139     @unittest.skip('MW fix required')
2140     def test_static_with_port_out2(self):
2141         """ NAT44ED 1:1 NAPT asymmetrical rule """
2142
2143     @unittest.skip('MW fix required')
2144     def test_output_feature_and_service2(self):
2145         """ NAT44ED interface output feature and service host direct access """
2146
2147     @unittest.skip('MW fix required')
2148     def test_static_lb(self):
2149         """ NAT44ED local service load balancing """
2150
2151     @unittest.skip('MW fix required')
2152     def test_static_lb_2(self):
2153         """ NAT44ED local service load balancing (asymmetrical rule) """
2154
2155     @unittest.skip('MW fix required')
2156     def test_lb_affinity(self):
2157         """ NAT44ED local service load balancing affinity """
2158
2159     @unittest.skip('MW fix required')
2160     def test_multiple_vrf(self):
2161         """ NAT44ED Multiple VRF setup """
2162
2163     @unittest.skip('MW fix required')
2164     def test_self_twice_nat_positive(self):
2165         """ NAT44ED Self Twice NAT (positive test) """
2166
2167     @unittest.skip('MW fix required')
2168     def test_self_twice_nat_lb_positive(self):
2169         """ NAT44ED Self Twice NAT local service load balancing (positive test)
2170         """
2171
2172     def test_dynamic(self):
2173         """ NAT44ED dynamic translation test """
2174         pkt_count = 1500
2175         tcp_port_offset = 20
2176         udp_port_offset = 20
2177         icmp_id_offset = 20
2178
2179         self.nat_add_address(self.nat_addr)
2180         self.nat_add_inside_interface(self.pg0)
2181         self.nat_add_outside_interface(self.pg1)
2182
2183         # in2out
2184         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2185         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2186         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2187         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2188
2189         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2190
2191         for i in range(pkt_count):
2192             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2193                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2194                  TCP(sport=tcp_port_offset + i, dport=20))
2195             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2196
2197             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2198                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2199                  UDP(sport=udp_port_offset + i, dport=20))
2200             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2201
2202             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2203                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2204                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2205             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2206
2207         for i in range(0, self.vpp_worker_count):
2208             if len(i2o_pkts[i]) > 0:
2209                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2210
2211         self.pg_enable_capture(self.pg_interfaces)
2212         self.pg_start()
2213         capture = self.pg1.get_capture(pkt_count * 3)
2214
2215         if_idx = self.pg0.sw_if_index
2216         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2217         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2218         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2219         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2220
2221         self.assertEqual(
2222             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2223         self.assertEqual(
2224             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2225         self.assertEqual(
2226             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2227         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2228
2229         self.logger.info(self.vapi.cli("show trace"))
2230
2231         # out2in
2232         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2233         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2234         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2235         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2236
2237         recvd_tcp_ports = set()
2238         recvd_udp_ports = set()
2239         recvd_icmp_ids = set()
2240
2241         for p in capture:
2242             if TCP in p:
2243                 recvd_tcp_ports.add(p[TCP].sport)
2244             if UDP in p:
2245                 recvd_udp_ports.add(p[UDP].sport)
2246             if ICMP in p:
2247                 recvd_icmp_ids.add(p[ICMP].id)
2248
2249         recvd_tcp_ports = list(recvd_tcp_ports)
2250         recvd_udp_ports = list(recvd_udp_ports)
2251         recvd_icmp_ids = list(recvd_icmp_ids)
2252
2253         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2254         for i in range(pkt_count):
2255             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2256                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2257                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2258             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2259
2260             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2261                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2262                  UDP(dport=choice(recvd_udp_ports), sport=20))
2263             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2264
2265             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2266                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2267                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2268             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2269
2270         for i in range(0, self.vpp_worker_count):
2271             if len(o2i_pkts[i]) > 0:
2272                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2273
2274         self.pg_enable_capture(self.pg_interfaces)
2275         self.pg_start()
2276         capture = self.pg0.get_capture(pkt_count * 3)
2277         for packet in capture:
2278             try:
2279                 self.assert_packet_checksums_valid(packet)
2280                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2281                 if packet.haslayer(TCP):
2282                     self.assert_in_range(
2283                         packet[TCP].dport, tcp_port_offset,
2284                         tcp_port_offset + pkt_count, "dst TCP port")
2285                 elif packet.haslayer(UDP):
2286                     self.assert_in_range(
2287                         packet[UDP].dport, udp_port_offset,
2288                         udp_port_offset + pkt_count, "dst UDP port")
2289                 else:
2290                     self.assert_in_range(
2291                         packet[ICMP].id, icmp_id_offset,
2292                         icmp_id_offset + pkt_count, "ICMP id")
2293             except:
2294                 self.logger.error(ppp("Unexpected or invalid packet "
2295                                       "(inside network):", packet))
2296                 raise
2297
2298         if_idx = self.pg1.sw_if_index
2299         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2300         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2301         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2302         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2303
2304         self.assertEqual(
2305             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2306         self.assertEqual(
2307             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2308         self.assertEqual(
2309             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2310         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2311
2312         sc = self.statistics['/nat44-ed/total-sessions']
2313         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2314                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2315
2316     def test_frag_in_order(self):
2317         """ NAT44ED translate fragments arriving in order """
2318
2319         self.nat_add_address(self.nat_addr)
2320         self.nat_add_inside_interface(self.pg0)
2321         self.nat_add_outside_interface(self.pg1)
2322
2323         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2324         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2325         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2326
2327     def test_frag_in_order_do_not_translate(self):
2328         """ NAT44ED don't translate fragments arriving in order """
2329
2330         self.nat_add_address(self.nat_addr)
2331         self.nat_add_inside_interface(self.pg0)
2332         self.nat_add_outside_interface(self.pg1)
2333         self.vapi.nat44_forwarding_enable_disable(enable=True)
2334
2335         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2336
2337     def test_frag_out_of_order(self):
2338         """ NAT44ED translate fragments arriving out of order """
2339
2340         self.nat_add_address(self.nat_addr)
2341         self.nat_add_inside_interface(self.pg0)
2342         self.nat_add_outside_interface(self.pg1)
2343
2344         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2345         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2346         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2347
2348     def test_frag_in_order_in_plus_out(self):
2349         """ NAT44ED in+out interface fragments in order """
2350
2351         in_port = self.random_port()
2352         out_port = self.random_port()
2353
2354         self.nat_add_address(self.nat_addr)
2355         self.nat_add_inside_interface(self.pg0)
2356         self.nat_add_outside_interface(self.pg0)
2357         self.nat_add_inside_interface(self.pg1)
2358         self.nat_add_outside_interface(self.pg1)
2359
2360         # add static mappings for server
2361         self.nat_add_static_mapping(self.server_addr,
2362                                     self.nat_addr,
2363                                     in_port,
2364                                     out_port,
2365                                     proto=IP_PROTOS.tcp)
2366         self.nat_add_static_mapping(self.server_addr,
2367                                     self.nat_addr,
2368                                     in_port,
2369                                     out_port,
2370                                     proto=IP_PROTOS.udp)
2371         self.nat_add_static_mapping(self.server_addr,
2372                                     self.nat_addr,
2373                                     proto=IP_PROTOS.icmp)
2374
2375         # run tests for each protocol
2376         self.frag_in_order_in_plus_out(self.server_addr,
2377                                        self.nat_addr,
2378                                        in_port,
2379                                        out_port,
2380                                        IP_PROTOS.tcp)
2381         self.frag_in_order_in_plus_out(self.server_addr,
2382                                        self.nat_addr,
2383                                        in_port,
2384                                        out_port,
2385                                        IP_PROTOS.udp)
2386         self.frag_in_order_in_plus_out(self.server_addr,
2387                                        self.nat_addr,
2388                                        in_port,
2389                                        out_port,
2390                                        IP_PROTOS.icmp)
2391
2392     def test_frag_out_of_order_in_plus_out(self):
2393         """ NAT44ED in+out interface fragments out of order """
2394
2395         in_port = self.random_port()
2396         out_port = self.random_port()
2397
2398         self.nat_add_address(self.nat_addr)
2399         self.nat_add_inside_interface(self.pg0)
2400         self.nat_add_outside_interface(self.pg0)
2401         self.nat_add_inside_interface(self.pg1)
2402         self.nat_add_outside_interface(self.pg1)
2403
2404         # add static mappings for server
2405         self.nat_add_static_mapping(self.server_addr,
2406                                     self.nat_addr,
2407                                     in_port,
2408                                     out_port,
2409                                     proto=IP_PROTOS.tcp)
2410         self.nat_add_static_mapping(self.server_addr,
2411                                     self.nat_addr,
2412                                     in_port,
2413                                     out_port,
2414                                     proto=IP_PROTOS.udp)
2415         self.nat_add_static_mapping(self.server_addr,
2416                                     self.nat_addr,
2417                                     proto=IP_PROTOS.icmp)
2418
2419         # run tests for each protocol
2420         self.frag_out_of_order_in_plus_out(self.server_addr,
2421                                            self.nat_addr,
2422                                            in_port,
2423                                            out_port,
2424                                            IP_PROTOS.tcp)
2425         self.frag_out_of_order_in_plus_out(self.server_addr,
2426                                            self.nat_addr,
2427                                            in_port,
2428                                            out_port,
2429                                            IP_PROTOS.udp)
2430         self.frag_out_of_order_in_plus_out(self.server_addr,
2431                                            self.nat_addr,
2432                                            in_port,
2433                                            out_port,
2434                                            IP_PROTOS.icmp)
2435
2436     def test_reass_hairpinning(self):
2437         """ NAT44ED fragments hairpinning """
2438
2439         server_addr = self.pg0.remote_hosts[1].ip4
2440
2441         host_in_port = self.random_port()
2442         server_in_port = self.random_port()
2443         server_out_port = self.random_port()
2444
2445         self.nat_add_address(self.nat_addr)
2446         self.nat_add_inside_interface(self.pg0)
2447         self.nat_add_outside_interface(self.pg1)
2448
2449         # add static mapping for server
2450         self.nat_add_static_mapping(server_addr, self.nat_addr,
2451                                     server_in_port, server_out_port,
2452                                     proto=IP_PROTOS.tcp)
2453         self.nat_add_static_mapping(server_addr, self.nat_addr,
2454                                     server_in_port, server_out_port,
2455                                     proto=IP_PROTOS.udp)
2456         self.nat_add_static_mapping(server_addr, self.nat_addr)
2457
2458         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2459                                host_in_port, proto=IP_PROTOS.tcp,
2460                                ignore_port=True)
2461         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2462                                host_in_port, proto=IP_PROTOS.udp,
2463                                ignore_port=True)
2464         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2465                                host_in_port, proto=IP_PROTOS.icmp,
2466                                ignore_port=True)
2467
2468     def test_session_limit_per_vrf(self):
2469         """ NAT44ED per vrf session limit """
2470
2471         inside = self.pg0
2472         inside_vrf10 = self.pg2
2473         outside = self.pg1
2474
2475         limit = 5
2476
2477         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2478         # non existing vrf_id makes process core dump
2479         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2480
2481         self.nat_add_inside_interface(inside)
2482         self.nat_add_inside_interface(inside_vrf10)
2483         self.nat_add_outside_interface(outside)
2484
2485         # vrf independent
2486         self.nat_add_interface_address(outside)
2487
2488         # BUG: causing core dump - when bad vrf_id is specified
2489         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2490
2491         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2492         inside_vrf10.add_stream(stream)
2493
2494         self.pg_enable_capture(self.pg_interfaces)
2495         self.pg_start()
2496
2497         capture = outside.get_capture(limit)
2498
2499         stream = self.create_tcp_stream(inside, outside, limit * 2)
2500         inside.add_stream(stream)
2501
2502         self.pg_enable_capture(self.pg_interfaces)
2503         self.pg_start()
2504
2505         capture = outside.get_capture(len(stream))
2506
2507     def test_show_max_translations(self):
2508         """ NAT44ED API test - max translations per thread """
2509         nat_config = self.vapi.nat_show_config_2()
2510         self.assertEqual(self.max_sessions,
2511                          nat_config.max_translations_per_thread)
2512
2513     def test_lru_cleanup(self):
2514         """ NAT44ED LRU cleanup algorithm """
2515
2516         self.nat_add_address(self.nat_addr)
2517         self.nat_add_inside_interface(self.pg0)
2518         self.nat_add_outside_interface(self.pg1)
2519
2520         self.vapi.nat_set_timeouts(
2521             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2522
2523         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2524         pkts = []
2525         for i in range(0, self.max_sessions - 1):
2526             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2527                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2528                  UDP(sport=7000+i, dport=80))
2529             pkts.append(p)
2530
2531         self.pg0.add_stream(pkts)
2532         self.pg_enable_capture(self.pg_interfaces)
2533         self.pg_start()
2534         self.pg1.get_capture(len(pkts))
2535         self.sleep(1.5, "wait for timeouts")
2536
2537         pkts = []
2538         for i in range(0, self.max_sessions - 1):
2539             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2540                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2541                  ICMP(id=8000+i, type='echo-request'))
2542             pkts.append(p)
2543
2544         self.pg0.add_stream(pkts)
2545         self.pg_enable_capture(self.pg_interfaces)
2546         self.pg_start()
2547         self.pg1.get_capture(len(pkts))
2548
2549     def test_session_rst_timeout(self):
2550         """ NAT44ED session RST timeouts """
2551
2552         self.nat_add_address(self.nat_addr)
2553         self.nat_add_inside_interface(self.pg0)
2554         self.nat_add_outside_interface(self.pg1)
2555
2556         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2557                                    tcp_transitory=5, icmp=60)
2558
2559         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2560                               self.tcp_external_port)
2561         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2562              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2563              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2564                  flags="R"))
2565         self.pg0.add_stream(p)
2566         self.pg_enable_capture(self.pg_interfaces)
2567         self.pg_start()
2568         self.pg1.get_capture(1)
2569
2570         self.sleep(6)
2571
2572         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2573              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2574              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2575                  flags="S"))
2576         self.pg0.add_stream(p)
2577         self.pg_enable_capture(self.pg_interfaces)
2578         self.pg_start()
2579         self.pg1.get_capture(1)
2580
2581     def test_dynamic_out_of_ports(self):
2582         """ NAT44ED dynamic translation test: out of ports """
2583
2584         self.nat_add_inside_interface(self.pg0)
2585         self.nat_add_outside_interface(self.pg1)
2586
2587         # in2out and no NAT addresses added
2588         err_old = self.statistics.get_err_counter(
2589             '/err/nat44-ed-in2out-slowpath/out of ports')
2590
2591         pkts = self.create_stream_in(self.pg0, self.pg1)
2592         self.pg0.add_stream(pkts)
2593         self.pg_enable_capture(self.pg_interfaces)
2594         self.pg_start()
2595         self.pg1.get_capture(0, timeout=1)
2596
2597         err_new = self.statistics.get_err_counter(
2598             '/err/nat44-ed-in2out-slowpath/out of ports')
2599
2600         self.assertEqual(err_new - err_old, len(pkts))
2601
2602         # in2out after NAT addresses added
2603         self.nat_add_address(self.nat_addr)
2604
2605         err_old = self.statistics.get_err_counter(
2606             '/err/nat44-ed-in2out-slowpath/out of ports')
2607
2608         pkts = self.create_stream_in(self.pg0, self.pg1)
2609         self.pg0.add_stream(pkts)
2610         self.pg_enable_capture(self.pg_interfaces)
2611         self.pg_start()
2612         capture = self.pg1.get_capture(len(pkts))
2613         self.verify_capture_out(capture, ignore_port=True)
2614
2615         err_new = self.statistics.get_err_counter(
2616             '/err/nat44-ed-in2out-slowpath/out of ports')
2617
2618         self.assertEqual(err_new, err_old)
2619
2620     def test_unknown_proto(self):
2621         """ NAT44ED translate packet with unknown protocol """
2622
2623         self.nat_add_address(self.nat_addr)
2624         self.nat_add_inside_interface(self.pg0)
2625         self.nat_add_outside_interface(self.pg1)
2626
2627         # in2out
2628         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2629              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2630              TCP(sport=self.tcp_port_in, dport=20))
2631         self.pg0.add_stream(p)
2632         self.pg_enable_capture(self.pg_interfaces)
2633         self.pg_start()
2634         p = self.pg1.get_capture(1)
2635
2636         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2637              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2638              GRE() /
2639              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2640              TCP(sport=1234, dport=1234))
2641         self.pg0.add_stream(p)
2642         self.pg_enable_capture(self.pg_interfaces)
2643         self.pg_start()
2644         p = self.pg1.get_capture(1)
2645         packet = p[0]
2646         try:
2647             self.assertEqual(packet[IP].src, self.nat_addr)
2648             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2649             self.assertEqual(packet.haslayer(GRE), 1)
2650             self.assert_packet_checksums_valid(packet)
2651         except:
2652             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2653             raise
2654
2655         # out2in
2656         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2657              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2658              GRE() /
2659              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2660              TCP(sport=1234, dport=1234))
2661         self.pg1.add_stream(p)
2662         self.pg_enable_capture(self.pg_interfaces)
2663         self.pg_start()
2664         p = self.pg0.get_capture(1)
2665         packet = p[0]
2666         try:
2667             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2668             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2669             self.assertEqual(packet.haslayer(GRE), 1)
2670             self.assert_packet_checksums_valid(packet)
2671         except:
2672             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2673             raise
2674
2675     def test_hairpinning_unknown_proto(self):
2676         """ NAT44ED translate packet with unknown protocol - hairpinning """
2677         host = self.pg0.remote_hosts[0]
2678         server = self.pg0.remote_hosts[1]
2679         host_in_port = 1234
2680         server_out_port = 8765
2681         server_nat_ip = "10.0.0.11"
2682
2683         self.nat_add_address(self.nat_addr)
2684         self.nat_add_inside_interface(self.pg0)
2685         self.nat_add_outside_interface(self.pg1)
2686
2687         # add static mapping for server
2688         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2689
2690         # host to server
2691         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2692              IP(src=host.ip4, dst=server_nat_ip) /
2693              TCP(sport=host_in_port, dport=server_out_port))
2694         self.pg0.add_stream(p)
2695         self.pg_enable_capture(self.pg_interfaces)
2696         self.pg_start()
2697         self.pg0.get_capture(1)
2698
2699         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2700              IP(src=host.ip4, dst=server_nat_ip) /
2701              GRE() /
2702              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2703              TCP(sport=1234, dport=1234))
2704         self.pg0.add_stream(p)
2705         self.pg_enable_capture(self.pg_interfaces)
2706         self.pg_start()
2707         p = self.pg0.get_capture(1)
2708         packet = p[0]
2709         try:
2710             self.assertEqual(packet[IP].src, self.nat_addr)
2711             self.assertEqual(packet[IP].dst, server.ip4)
2712             self.assertEqual(packet.haslayer(GRE), 1)
2713             self.assert_packet_checksums_valid(packet)
2714         except:
2715             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2716             raise
2717
2718         # server to host
2719         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2720              IP(src=server.ip4, dst=self.nat_addr) /
2721              GRE() /
2722              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2723              TCP(sport=1234, dport=1234))
2724         self.pg0.add_stream(p)
2725         self.pg_enable_capture(self.pg_interfaces)
2726         self.pg_start()
2727         p = self.pg0.get_capture(1)
2728         packet = p[0]
2729         try:
2730             self.assertEqual(packet[IP].src, server_nat_ip)
2731             self.assertEqual(packet[IP].dst, host.ip4)
2732             self.assertEqual(packet.haslayer(GRE), 1)
2733             self.assert_packet_checksums_valid(packet)
2734         except:
2735             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2736             raise
2737
2738     def test_output_feature_and_service(self):
2739         """ NAT44ED interface output feature and services """
2740         external_addr = '1.2.3.4'
2741         external_port = 80
2742         local_port = 8080
2743
2744         self.vapi.nat44_forwarding_enable_disable(enable=1)
2745         self.nat_add_address(self.nat_addr)
2746         flags = self.config_flags.NAT_IS_ADDR_ONLY
2747         self.vapi.nat44_add_del_identity_mapping(
2748             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2749             flags=flags, is_add=1)
2750         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2751         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2752                                     local_port, external_port,
2753                                     proto=IP_PROTOS.tcp, flags=flags)
2754
2755         self.nat_add_inside_interface(self.pg0)
2756         self.nat_add_outside_interface(self.pg0)
2757         self.vapi.nat44_interface_add_del_output_feature(
2758             sw_if_index=self.pg1.sw_if_index, is_add=1)
2759
2760         # from client to service
2761         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2762              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2763              TCP(sport=12345, dport=external_port))
2764         self.pg1.add_stream(p)
2765         self.pg_enable_capture(self.pg_interfaces)
2766         self.pg_start()
2767         capture = self.pg0.get_capture(1)
2768         p = capture[0]
2769         try:
2770             ip = p[IP]
2771             tcp = p[TCP]
2772             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2773             self.assertEqual(tcp.dport, local_port)
2774             self.assert_packet_checksums_valid(p)
2775         except:
2776             self.logger.error(ppp("Unexpected or invalid packet:", p))
2777             raise
2778
2779         # from service back to client
2780         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2781              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2782              TCP(sport=local_port, dport=12345))
2783         self.pg0.add_stream(p)
2784         self.pg_enable_capture(self.pg_interfaces)
2785         self.pg_start()
2786         capture = self.pg1.get_capture(1)
2787         p = capture[0]
2788         try:
2789             ip = p[IP]
2790             tcp = p[TCP]
2791             self.assertEqual(ip.src, external_addr)
2792             self.assertEqual(tcp.sport, external_port)
2793             self.assert_packet_checksums_valid(p)
2794         except:
2795             self.logger.error(ppp("Unexpected or invalid packet:", p))
2796             raise
2797
2798         # from local network host to external network
2799         pkts = self.create_stream_in(self.pg0, self.pg1)
2800         self.pg0.add_stream(pkts)
2801         self.pg_enable_capture(self.pg_interfaces)
2802         self.pg_start()
2803         capture = self.pg1.get_capture(len(pkts))
2804         self.verify_capture_out(capture, ignore_port=True)
2805         pkts = self.create_stream_in(self.pg0, self.pg1)
2806         self.pg0.add_stream(pkts)
2807         self.pg_enable_capture(self.pg_interfaces)
2808         self.pg_start()
2809         capture = self.pg1.get_capture(len(pkts))
2810         self.verify_capture_out(capture, ignore_port=True)
2811
2812         # from external network back to local network host
2813         pkts = self.create_stream_out(self.pg1)
2814         self.pg1.add_stream(pkts)
2815         self.pg_enable_capture(self.pg_interfaces)
2816         self.pg_start()
2817         capture = self.pg0.get_capture(len(pkts))
2818         self.verify_capture_in(capture, self.pg0)
2819
2820     def test_output_feature_and_service3(self):
2821         """ NAT44ED interface output feature and DST NAT """
2822         external_addr = '1.2.3.4'
2823         external_port = 80
2824         local_port = 8080
2825
2826         self.vapi.nat44_forwarding_enable_disable(enable=1)
2827         self.nat_add_address(self.nat_addr)
2828         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2829         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2830                                     local_port, external_port,
2831                                     proto=IP_PROTOS.tcp, flags=flags)
2832
2833         self.nat_add_inside_interface(self.pg0)
2834         self.nat_add_outside_interface(self.pg0)
2835         self.vapi.nat44_interface_add_del_output_feature(
2836             sw_if_index=self.pg1.sw_if_index, is_add=1)
2837
2838         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2839              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2840              TCP(sport=12345, dport=external_port))
2841         self.pg0.add_stream(p)
2842         self.pg_enable_capture(self.pg_interfaces)
2843         self.pg_start()
2844         capture = self.pg1.get_capture(1)
2845         p = capture[0]
2846         try:
2847             ip = p[IP]
2848             tcp = p[TCP]
2849             self.assertEqual(ip.src, self.pg0.remote_ip4)
2850             self.assertEqual(tcp.sport, 12345)
2851             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2852             self.assertEqual(tcp.dport, local_port)
2853             self.assert_packet_checksums_valid(p)
2854         except:
2855             self.logger.error(ppp("Unexpected or invalid packet:", p))
2856             raise
2857
2858         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2859              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2860              TCP(sport=local_port, dport=12345))
2861         self.pg1.add_stream(p)
2862         self.pg_enable_capture(self.pg_interfaces)
2863         self.pg_start()
2864         capture = self.pg0.get_capture(1)
2865         p = capture[0]
2866         try:
2867             ip = p[IP]
2868             tcp = p[TCP]
2869             self.assertEqual(ip.src, external_addr)
2870             self.assertEqual(tcp.sport, external_port)
2871             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2872             self.assertEqual(tcp.dport, 12345)
2873             self.assert_packet_checksums_valid(p)
2874         except:
2875             self.logger.error(ppp("Unexpected or invalid packet:", p))
2876             raise
2877
2878     def test_self_twice_nat_lb_negative(self):
2879         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2880         """
2881         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2882                               client_id=2)
2883
2884     def test_self_twice_nat_negative(self):
2885         """ NAT44ED Self Twice NAT (negative test) """
2886         self.twice_nat_common(self_twice_nat=True)
2887
2888     def test_static_lb_multi_clients(self):
2889         """ NAT44ED local service load balancing - multiple clients"""
2890
2891         external_addr = self.nat_addr
2892         external_port = 80
2893         local_port = 8080
2894         server1 = self.pg0.remote_hosts[0]
2895         server2 = self.pg0.remote_hosts[1]
2896         server3 = self.pg0.remote_hosts[2]
2897
2898         locals = [{'addr': server1.ip4,
2899                    'port': local_port,
2900                    'probability': 90,
2901                    'vrf_id': 0},
2902                   {'addr': server2.ip4,
2903                    'port': local_port,
2904                    'probability': 10,
2905                    'vrf_id': 0}]
2906
2907         flags = self.config_flags.NAT_IS_INSIDE
2908         self.vapi.nat44_interface_add_del_feature(
2909             sw_if_index=self.pg0.sw_if_index,
2910             flags=flags, is_add=1)
2911         self.vapi.nat44_interface_add_del_feature(
2912             sw_if_index=self.pg1.sw_if_index,
2913             is_add=1)
2914
2915         self.nat_add_address(self.nat_addr)
2916         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2917                                                   external_addr=external_addr,
2918                                                   external_port=external_port,
2919                                                   protocol=IP_PROTOS.tcp,
2920                                                   local_num=len(locals),
2921                                                   locals=locals)
2922
2923         server1_n = 0
2924         server2_n = 0
2925         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2926         pkts = []
2927         for client in clients:
2928             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2929                  IP(src=client, dst=self.nat_addr) /
2930                  TCP(sport=12345, dport=external_port))
2931             pkts.append(p)
2932         self.pg1.add_stream(pkts)
2933         self.pg_enable_capture(self.pg_interfaces)
2934         self.pg_start()
2935         capture = self.pg0.get_capture(len(pkts))
2936         for p in capture:
2937             if p[IP].dst == server1.ip4:
2938                 server1_n += 1
2939             else:
2940                 server2_n += 1
2941         self.assertGreaterEqual(server1_n, server2_n)
2942
2943         local = {
2944             'addr': server3.ip4,
2945             'port': local_port,
2946             'probability': 20,
2947             'vrf_id': 0
2948         }
2949
2950         # add new back-end
2951         self.vapi.nat44_lb_static_mapping_add_del_local(
2952             is_add=1,
2953             external_addr=external_addr,
2954             external_port=external_port,
2955             local=local,
2956             protocol=IP_PROTOS.tcp)
2957         server1_n = 0
2958         server2_n = 0
2959         server3_n = 0
2960         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2961         pkts = []
2962         for client in clients:
2963             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2964                  IP(src=client, dst=self.nat_addr) /
2965                  TCP(sport=12346, dport=external_port))
2966             pkts.append(p)
2967         self.assertGreater(len(pkts), 0)
2968         self.pg1.add_stream(pkts)
2969         self.pg_enable_capture(self.pg_interfaces)
2970         self.pg_start()
2971         capture = self.pg0.get_capture(len(pkts))
2972         for p in capture:
2973             if p[IP].dst == server1.ip4:
2974                 server1_n += 1
2975             elif p[IP].dst == server2.ip4:
2976                 server2_n += 1
2977             else:
2978                 server3_n += 1
2979         self.assertGreater(server1_n, 0)
2980         self.assertGreater(server2_n, 0)
2981         self.assertGreater(server3_n, 0)
2982
2983         local = {
2984             'addr': server2.ip4,
2985             'port': local_port,
2986             'probability': 10,
2987             'vrf_id': 0
2988         }
2989
2990         # remove one back-end
2991         self.vapi.nat44_lb_static_mapping_add_del_local(
2992             is_add=0,
2993             external_addr=external_addr,
2994             external_port=external_port,
2995             local=local,
2996             protocol=IP_PROTOS.tcp)
2997         server1_n = 0
2998         server2_n = 0
2999         server3_n = 0
3000         self.pg1.add_stream(pkts)
3001         self.pg_enable_capture(self.pg_interfaces)
3002         self.pg_start()
3003         capture = self.pg0.get_capture(len(pkts))
3004         for p in capture:
3005             if p[IP].dst == server1.ip4:
3006                 server1_n += 1
3007             elif p[IP].dst == server2.ip4:
3008                 server2_n += 1
3009             else:
3010                 server3_n += 1
3011         self.assertGreater(server1_n, 0)
3012         self.assertEqual(server2_n, 0)
3013         self.assertGreater(server3_n, 0)
3014
3015     def test_syslog_sess(self):
3016         """ NAT44ED Test syslog session creation and deletion """
3017         self.vapi.syslog_set_filter(
3018             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3019         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3020
3021         self.nat_add_address(self.nat_addr)
3022         self.nat_add_inside_interface(self.pg0)
3023         self.nat_add_outside_interface(self.pg1)
3024
3025         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3026              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3027              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3028         self.pg0.add_stream(p)
3029         self.pg_enable_capture(self.pg_interfaces)
3030         self.pg_start()
3031         capture = self.pg1.get_capture(1)
3032         self.tcp_port_out = capture[0][TCP].sport
3033         capture = self.pg3.get_capture(1)
3034         self.verify_syslog_sess(capture[0][Raw].load)
3035
3036         self.pg_enable_capture(self.pg_interfaces)
3037         self.pg_start()
3038         self.nat_add_address(self.nat_addr, is_add=0)
3039         capture = self.pg3.get_capture(1)
3040         self.verify_syslog_sess(capture[0][Raw].load, False)
3041
3042     def test_twice_nat_interface_addr(self):
3043         """ NAT44ED Acquire twice NAT addresses from interface """
3044         flags = self.config_flags.NAT_IS_TWICE_NAT
3045         self.vapi.nat44_add_del_interface_addr(
3046             sw_if_index=self.pg11.sw_if_index,
3047             flags=flags, is_add=1)
3048
3049         # no address in NAT pool
3050         adresses = self.vapi.nat44_address_dump()
3051         self.assertEqual(0, len(adresses))
3052
3053         # configure interface address and check NAT address pool
3054         self.pg11.config_ip4()
3055         adresses = self.vapi.nat44_address_dump()
3056         self.assertEqual(1, len(adresses))
3057         self.assertEqual(str(adresses[0].ip_address),
3058                          self.pg11.local_ip4)
3059         self.assertEqual(adresses[0].flags, flags)
3060
3061         # remove interface address and check NAT address pool
3062         self.pg11.unconfig_ip4()
3063         adresses = self.vapi.nat44_address_dump()
3064         self.assertEqual(0, len(adresses))
3065
3066     def test_output_feature_stateful_acl(self):
3067         """ NAT44ED output feature works with stateful ACL """
3068
3069         self.nat_add_address(self.nat_addr)
3070         self.vapi.nat44_interface_add_del_output_feature(
3071             sw_if_index=self.pg1.sw_if_index, is_add=1)
3072
3073         # First ensure that the NAT is working sans ACL
3074
3075         # send packets out2in, no sessions yet so packets should drop
3076         pkts_out2in = self.create_stream_out(self.pg1)
3077         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3078
3079         # send packets into inside intf, ensure received via outside intf
3080         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3081         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3082                                        len(pkts_in2out))
3083         self.verify_capture_out(capture, ignore_port=True)
3084
3085         # send out2in again, with sessions created it should work now
3086         pkts_out2in = self.create_stream_out(self.pg1)
3087         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3088                                        len(pkts_out2in))
3089         self.verify_capture_in(capture, self.pg0)
3090
3091         # Create an ACL blocking everything
3092         out2in_deny_rule = AclRule(is_permit=0)
3093         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3094         out2in_acl.add_vpp_config()
3095
3096         # create an ACL to permit/reflect everything
3097         in2out_reflect_rule = AclRule(is_permit=2)
3098         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3099         in2out_acl.add_vpp_config()
3100
3101         # apply as input acl on interface and confirm it blocks everything
3102         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3103                                  n_input=1, acls=[out2in_acl])
3104         acl_if.add_vpp_config()
3105         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3106
3107         # apply output acl
3108         acl_if.acls = [out2in_acl, in2out_acl]
3109         acl_if.add_vpp_config()
3110         # send in2out to generate ACL state (NAT state was created earlier)
3111         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3112                                        len(pkts_in2out))
3113         self.verify_capture_out(capture, ignore_port=True)
3114
3115         # send out2in again. ACL state exists so it should work now.
3116         # TCP packets with the syn flag set also need the ack flag
3117         for p in pkts_out2in:
3118             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3119                 p[TCP].flags |= 0x10
3120         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3121                                        len(pkts_out2in))
3122         self.verify_capture_in(capture, self.pg0)
3123         self.logger.info(self.vapi.cli("show trace"))
3124
3125     def test_tcp_close(self):
3126         """ NAT44ED Close TCP session from inside network - output feature """
3127         old_timeouts = self.vapi.nat_get_timeouts()
3128         new_transitory = 2
3129         self.vapi.nat_set_timeouts(
3130             udp=old_timeouts.udp,
3131             tcp_established=old_timeouts.tcp_established,
3132             icmp=old_timeouts.icmp,
3133             tcp_transitory=new_transitory)
3134
3135         self.vapi.nat44_forwarding_enable_disable(enable=1)
3136         self.nat_add_address(self.pg1.local_ip4)
3137         twice_nat_addr = '10.0.1.3'
3138         service_ip = '192.168.16.150'
3139         self.nat_add_address(twice_nat_addr, twice_nat=1)
3140
3141         flags = self.config_flags.NAT_IS_INSIDE
3142         self.vapi.nat44_interface_add_del_feature(
3143             sw_if_index=self.pg0.sw_if_index,
3144             is_add=1)
3145         self.vapi.nat44_interface_add_del_feature(
3146             sw_if_index=self.pg0.sw_if_index,
3147             flags=flags, is_add=1)
3148         self.vapi.nat44_interface_add_del_output_feature(
3149             is_add=1,
3150             sw_if_index=self.pg1.sw_if_index)
3151
3152         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3153                  self.config_flags.NAT_IS_TWICE_NAT)
3154         self.nat_add_static_mapping(self.pg0.remote_ip4,
3155                                     service_ip, 80, 80,
3156                                     proto=IP_PROTOS.tcp,
3157                                     flags=flags)
3158         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3159         start_sessnum = len(sessions)
3160
3161         # SYN packet out->in
3162         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3163              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3164              TCP(sport=33898, dport=80, flags="S"))
3165         self.pg1.add_stream(p)
3166         self.pg_enable_capture(self.pg_interfaces)
3167         self.pg_start()
3168         capture = self.pg0.get_capture(1)
3169         p = capture[0]
3170         tcp_port = p[TCP].sport
3171
3172         # SYN + ACK packet in->out
3173         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3174              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3175              TCP(sport=80, dport=tcp_port, flags="SA"))
3176         self.pg0.add_stream(p)
3177         self.pg_enable_capture(self.pg_interfaces)
3178         self.pg_start()
3179         self.pg1.get_capture(1)
3180
3181         # ACK packet out->in
3182         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3183              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3184              TCP(sport=33898, dport=80, flags="A"))
3185         self.pg1.add_stream(p)
3186         self.pg_enable_capture(self.pg_interfaces)
3187         self.pg_start()
3188         self.pg0.get_capture(1)
3189
3190         # FIN packet in -> out
3191         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3192              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3193              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3194         self.pg0.add_stream(p)
3195         self.pg_enable_capture(self.pg_interfaces)
3196         self.pg_start()
3197         self.pg1.get_capture(1)
3198
3199         # FIN+ACK packet out -> in
3200         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3201              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3202              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3203         self.pg1.add_stream(p)
3204         self.pg_enable_capture(self.pg_interfaces)
3205         self.pg_start()
3206         self.pg0.get_capture(1)
3207
3208         # ACK packet in -> out
3209         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3210              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3211              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3212         self.pg0.add_stream(p)
3213         self.pg_enable_capture(self.pg_interfaces)
3214         self.pg_start()
3215         self.pg1.get_capture(1)
3216
3217         # session now in transitory timeout
3218         # try SYN packet out->in - should be dropped
3219         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3220              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3221              TCP(sport=33898, dport=80, flags="S"))
3222         self.pg1.add_stream(p)
3223         self.pg_enable_capture(self.pg_interfaces)
3224         self.pg_start()
3225
3226         self.sleep(new_transitory, "wait for transitory timeout")
3227         self.pg0.assert_nothing_captured(0)
3228
3229         # session should still exist
3230         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3231         self.assertEqual(len(sessions) - start_sessnum, 1)
3232
3233         # send FIN+ACK packet out -> in - will cause session to be wiped
3234         # but won't create a new session
3235         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3236              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3237              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3238         self.pg1.add_stream(p)
3239         self.pg_enable_capture(self.pg_interfaces)
3240         self.pg_start()
3241
3242         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3243         self.assertEqual(len(sessions) - start_sessnum, 0)
3244         self.pg0.assert_nothing_captured(0)
3245
3246     def test_tcp_session_close_in(self):
3247         """ NAT44ED Close TCP session from inside network """
3248
3249         in_port = self.tcp_port_in
3250         out_port = 10505
3251         ext_port = self.tcp_external_port
3252
3253         self.nat_add_address(self.nat_addr)
3254         self.nat_add_inside_interface(self.pg0)
3255         self.nat_add_outside_interface(self.pg1)
3256         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3257                                     in_port, out_port, proto=IP_PROTOS.tcp,
3258                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3259
3260         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3261         session_n = len(sessions)
3262
3263         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3264                                    tcp_transitory=2, icmp=5)
3265
3266         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3267
3268         # FIN packet in -> out
3269         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3270              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3271              TCP(sport=in_port, dport=ext_port,
3272                  flags="FA", seq=100, ack=300))
3273         self.pg0.add_stream(p)
3274         self.pg_enable_capture(self.pg_interfaces)
3275         self.pg_start()
3276         self.pg1.get_capture(1)
3277
3278         pkts = []
3279
3280         # ACK packet out -> in
3281         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3282              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3283              TCP(sport=ext_port, dport=out_port,
3284                  flags="A", seq=300, ack=101))
3285         pkts.append(p)
3286
3287         # FIN packet out -> in
3288         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3289              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3290              TCP(sport=ext_port, dport=out_port,
3291                  flags="FA", seq=300, ack=101))
3292         pkts.append(p)
3293
3294         self.pg1.add_stream(pkts)
3295         self.pg_enable_capture(self.pg_interfaces)
3296         self.pg_start()
3297         self.pg0.get_capture(2)
3298
3299         # ACK packet in -> out
3300         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3301              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3302              TCP(sport=in_port, dport=ext_port,
3303                  flags="A", seq=101, ack=301))
3304         self.pg0.add_stream(p)
3305         self.pg_enable_capture(self.pg_interfaces)
3306         self.pg_start()
3307         self.pg1.get_capture(1)
3308
3309         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3310         self.assertEqual(len(sessions) - session_n, 1)
3311
3312         out2in_drops = self.get_err_counter(
3313             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3314         in2out_drops = self.get_err_counter(
3315             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3316
3317         # extra FIN packet out -> in - this should be dropped
3318         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3319              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3320              TCP(sport=ext_port, dport=out_port,
3321                  flags="FA", seq=300, ack=101))
3322
3323         self.pg1.add_stream(p)
3324         self.pg_enable_capture(self.pg_interfaces)
3325         self.pg_start()
3326         self.pg0.assert_nothing_captured()
3327
3328         # extra ACK packet in -> out - this should be dropped
3329         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3330              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3331              TCP(sport=in_port, dport=ext_port,
3332                  flags="A", seq=101, ack=301))
3333         self.pg0.add_stream(p)
3334         self.pg_enable_capture(self.pg_interfaces)
3335         self.pg_start()
3336         self.pg1.assert_nothing_captured()
3337
3338         stats = self.get_err_counter(
3339             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3340         self.assertEqual(stats - out2in_drops, 1)
3341         stats = self.get_err_counter(
3342             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3343         self.assertEqual(stats - in2out_drops, 1)
3344
3345         self.sleep(3)
3346         # extra ACK packet in -> out - this will cause session to be wiped
3347         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3348              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3349              TCP(sport=in_port, dport=ext_port,
3350                  flags="A", seq=101, ack=301))
3351         self.pg0.add_stream(p)
3352         self.pg_enable_capture(self.pg_interfaces)
3353         self.pg_start()
3354         self.pg1.assert_nothing_captured()
3355         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3356         self.assertEqual(len(sessions) - session_n, 0)
3357
3358     def test_tcp_session_close_out(self):
3359         """ NAT44ED Close TCP session from outside network """
3360
3361         in_port = self.tcp_port_in
3362         out_port = 10505
3363         ext_port = self.tcp_external_port
3364
3365         self.nat_add_address(self.nat_addr)
3366         self.nat_add_inside_interface(self.pg0)
3367         self.nat_add_outside_interface(self.pg1)
3368         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3369                                     in_port, out_port, proto=IP_PROTOS.tcp,
3370                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3371
3372         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3373         session_n = len(sessions)
3374
3375         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3376                                    tcp_transitory=2, icmp=5)
3377
3378         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3379
3380         # FIN packet out -> in
3381         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3382              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3383              TCP(sport=ext_port, dport=out_port,
3384                  flags="FA", seq=100, ack=300))
3385         self.pg1.add_stream(p)
3386         self.pg_enable_capture(self.pg_interfaces)
3387         self.pg_start()
3388         self.pg0.get_capture(1)
3389
3390         # FIN+ACK packet in -> out
3391         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3392              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3393              TCP(sport=in_port, dport=ext_port,
3394                  flags="FA", seq=300, ack=101))
3395
3396         self.pg0.add_stream(p)
3397         self.pg_enable_capture(self.pg_interfaces)
3398         self.pg_start()
3399         self.pg1.get_capture(1)
3400
3401         # ACK packet out -> in
3402         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3403              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3404              TCP(sport=ext_port, dport=out_port,
3405                  flags="A", seq=101, ack=301))
3406         self.pg1.add_stream(p)
3407         self.pg_enable_capture(self.pg_interfaces)
3408         self.pg_start()
3409         self.pg0.get_capture(1)
3410
3411         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3412         self.assertEqual(len(sessions) - session_n, 1)
3413
3414         out2in_drops = self.get_err_counter(
3415             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3416         in2out_drops = self.get_err_counter(
3417             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3418
3419         # extra FIN packet out -> in - this should be dropped
3420         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3421              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3422              TCP(sport=ext_port, dport=out_port,
3423                  flags="FA", seq=300, ack=101))
3424
3425         self.pg1.add_stream(p)
3426         self.pg_enable_capture(self.pg_interfaces)
3427         self.pg_start()
3428         self.pg0.assert_nothing_captured()
3429
3430         # extra ACK packet in -> out - this should be dropped
3431         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3432              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3433              TCP(sport=in_port, dport=ext_port,
3434                  flags="A", seq=101, ack=301))
3435         self.pg0.add_stream(p)
3436         self.pg_enable_capture(self.pg_interfaces)
3437         self.pg_start()
3438         self.pg1.assert_nothing_captured()
3439
3440         stats = self.get_err_counter(
3441             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3442         self.assertEqual(stats - out2in_drops, 1)
3443         stats = self.get_err_counter(
3444             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3445         self.assertEqual(stats - in2out_drops, 1)
3446
3447         self.sleep(3)
3448         # extra ACK packet in -> out - this will cause session to be wiped
3449         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3450              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3451              TCP(sport=in_port, dport=ext_port,
3452                  flags="A", seq=101, ack=301))
3453         self.pg0.add_stream(p)
3454         self.pg_enable_capture(self.pg_interfaces)
3455         self.pg_start()
3456         self.pg1.assert_nothing_captured()
3457         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3458         self.assertEqual(len(sessions) - session_n, 0)
3459
3460     def test_tcp_session_close_simultaneous(self):
3461         """ NAT44ED Close TCP session from inside network """
3462
3463         in_port = self.tcp_port_in
3464         ext_port = 10505
3465
3466         self.nat_add_address(self.nat_addr)
3467         self.nat_add_inside_interface(self.pg0)
3468         self.nat_add_outside_interface(self.pg1)
3469         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3470                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3471                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3472
3473         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3474         session_n = len(sessions)
3475
3476         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3477                                    tcp_transitory=2, icmp=5)
3478
3479         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3480
3481         # FIN packet in -> out
3482         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3483              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3484              TCP(sport=in_port, dport=ext_port,
3485                  flags="FA", seq=100, ack=300))
3486         self.pg0.add_stream(p)
3487         self.pg_enable_capture(self.pg_interfaces)
3488         self.pg_start()
3489         self.pg1.get_capture(1)
3490
3491         # FIN packet out -> in
3492         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3493              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3494              TCP(sport=ext_port, dport=out_port,
3495                  flags="FA", seq=300, ack=100))
3496         self.pg1.add_stream(p)
3497         self.pg_enable_capture(self.pg_interfaces)
3498         self.pg_start()
3499         self.pg0.get_capture(1)
3500
3501         # ACK packet in -> out
3502         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3503              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3504              TCP(sport=in_port, dport=ext_port,
3505                  flags="A", seq=101, ack=301))
3506         self.pg0.add_stream(p)
3507         self.pg_enable_capture(self.pg_interfaces)
3508         self.pg_start()
3509         self.pg1.get_capture(1)
3510
3511         # ACK packet out -> in
3512         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3513              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3514              TCP(sport=ext_port, dport=out_port,
3515                  flags="A", seq=301, ack=101))
3516         self.pg1.add_stream(p)
3517         self.pg_enable_capture(self.pg_interfaces)
3518         self.pg_start()
3519         self.pg0.get_capture(1)
3520
3521         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3522         self.assertEqual(len(sessions) - session_n, 1)
3523
3524         out2in_drops = self.get_err_counter(
3525             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3526         in2out_drops = self.get_err_counter(
3527             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3528
3529         # extra FIN packet out -> in - this should be dropped
3530         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3531              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3532              TCP(sport=ext_port, dport=out_port,
3533                  flags="FA", seq=300, ack=101))
3534
3535         self.pg1.add_stream(p)
3536         self.pg_enable_capture(self.pg_interfaces)
3537         self.pg_start()
3538         self.pg0.assert_nothing_captured()
3539
3540         # extra ACK packet in -> out - this should be dropped
3541         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3542              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3543              TCP(sport=in_port, dport=ext_port,
3544                  flags="A", seq=101, ack=301))
3545         self.pg0.add_stream(p)
3546         self.pg_enable_capture(self.pg_interfaces)
3547         self.pg_start()
3548         self.pg1.assert_nothing_captured()
3549
3550         stats = self.get_err_counter(
3551             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3552         self.assertEqual(stats - out2in_drops, 1)
3553         stats = self.get_err_counter(
3554             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3555         self.assertEqual(stats - in2out_drops, 1)
3556
3557         self.sleep(3)
3558         # extra ACK packet in -> out - this will cause session to be wiped
3559         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3560              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3561              TCP(sport=in_port, dport=ext_port,
3562                  flags="A", seq=101, ack=301))
3563         self.pg0.add_stream(p)
3564         self.pg_enable_capture(self.pg_interfaces)
3565         self.pg_start()
3566         self.pg1.assert_nothing_captured()
3567         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3568         self.assertEqual(len(sessions) - session_n, 0)
3569
3570     def test_dynamic_vrf(self):
3571         """ NAT44ED dynamic translation test: different VRF"""
3572
3573         vrf_id_in = 33
3574         vrf_id_out = 34
3575
3576         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3577
3578         try:
3579             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3580             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3581
3582             self.nat_add_inside_interface(self.pg7)
3583             self.nat_add_outside_interface(self.pg8)
3584
3585             # just basic stuff nothing special
3586             pkts = self.create_stream_in(self.pg7, self.pg8)
3587             self.pg7.add_stream(pkts)
3588             self.pg_enable_capture(self.pg_interfaces)
3589             self.pg_start()
3590             capture = self.pg8.get_capture(len(pkts))
3591             self.verify_capture_out(capture, ignore_port=True)
3592
3593             pkts = self.create_stream_out(self.pg8)
3594             self.pg8.add_stream(pkts)
3595             self.pg_enable_capture(self.pg_interfaces)
3596             self.pg_start()
3597             capture = self.pg7.get_capture(len(pkts))
3598             self.verify_capture_in(capture, self.pg7)
3599
3600         finally:
3601             self.pg7.unconfig()
3602             self.pg8.unconfig()
3603
3604             self.vapi.ip_table_add_del(is_add=0,
3605                                        table={'table_id': vrf_id_in})
3606             self.vapi.ip_table_add_del(is_add=0,
3607                                        table={'table_id': vrf_id_out})
3608
3609     def test_dynamic_output_feature_vrf(self):
3610         """ NAT44ED dynamic translation test: output-feature, VRF"""
3611
3612         # other then default (0)
3613         new_vrf_id = 22
3614
3615         self.nat_add_address(self.nat_addr)
3616         self.vapi.nat44_interface_add_del_output_feature(
3617             sw_if_index=self.pg8.sw_if_index, is_add=1)
3618
3619         try:
3620             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3621             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3622
3623             # in2out
3624             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3625             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3626             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3627             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3628
3629             pkts = self.create_stream_in(self.pg7, self.pg8)
3630             self.pg7.add_stream(pkts)
3631             self.pg_enable_capture(self.pg_interfaces)
3632             self.pg_start()
3633             capture = self.pg8.get_capture(len(pkts))
3634             self.verify_capture_out(capture, ignore_port=True)
3635
3636             if_idx = self.pg7.sw_if_index
3637             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3638             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3639             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3640             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3641             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3642             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3643             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3644             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3645
3646             # out2in
3647             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3648             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3649             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3650             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3651
3652             pkts = self.create_stream_out(self.pg8)
3653             self.pg8.add_stream(pkts)
3654             self.pg_enable_capture(self.pg_interfaces)
3655             self.pg_start()
3656             capture = self.pg7.get_capture(len(pkts))
3657             self.verify_capture_in(capture, self.pg7)
3658
3659             if_idx = self.pg8.sw_if_index
3660             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3661             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3662             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3663             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3664             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3665             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3666             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3667             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3668
3669             sessions = self.statistics['/nat44-ed/total-sessions']
3670             self.assertEqual(sessions[:, 0].sum(), 3)
3671
3672         finally:
3673             self.pg7.unconfig()
3674             self.pg8.unconfig()
3675
3676             self.vapi.ip_table_add_del(is_add=0,
3677                                        table={'table_id': new_vrf_id})
3678
3679     def test_next_src_nat(self):
3680         """ NAT44ED On way back forward packet to nat44-in2out node. """
3681
3682         twice_nat_addr = '10.0.1.3'
3683         external_port = 80
3684         local_port = 8080
3685         post_twice_nat_port = 0
3686
3687         self.vapi.nat44_forwarding_enable_disable(enable=1)
3688         self.nat_add_address(twice_nat_addr, twice_nat=1)
3689         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3690                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3691         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3692                                     local_port, external_port,
3693                                     proto=IP_PROTOS.tcp, vrf_id=1,
3694                                     flags=flags)
3695         self.vapi.nat44_interface_add_del_feature(
3696             sw_if_index=self.pg6.sw_if_index,
3697             is_add=1)
3698
3699         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3700              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3701              TCP(sport=12345, dport=external_port))
3702         self.pg6.add_stream(p)
3703         self.pg_enable_capture(self.pg_interfaces)
3704         self.pg_start()
3705         capture = self.pg6.get_capture(1)
3706         p = capture[0]
3707         try:
3708             ip = p[IP]
3709             tcp = p[TCP]
3710             self.assertEqual(ip.src, twice_nat_addr)
3711             self.assertNotEqual(tcp.sport, 12345)
3712             post_twice_nat_port = tcp.sport
3713             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3714             self.assertEqual(tcp.dport, local_port)
3715             self.assert_packet_checksums_valid(p)
3716         except:
3717             self.logger.error(ppp("Unexpected or invalid packet:", p))
3718             raise
3719
3720         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3721              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3722              TCP(sport=local_port, dport=post_twice_nat_port))
3723         self.pg6.add_stream(p)
3724         self.pg_enable_capture(self.pg_interfaces)
3725         self.pg_start()
3726         capture = self.pg6.get_capture(1)
3727         p = capture[0]
3728         try:
3729             ip = p[IP]
3730             tcp = p[TCP]
3731             self.assertEqual(ip.src, self.pg1.remote_ip4)
3732             self.assertEqual(tcp.sport, external_port)
3733             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3734             self.assertEqual(tcp.dport, 12345)
3735             self.assert_packet_checksums_valid(p)
3736         except:
3737             self.logger.error(ppp("Unexpected or invalid packet:", p))
3738             raise
3739
3740     def test_one_armed_nat44_static(self):
3741         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3742
3743         remote_host = self.pg4.remote_hosts[0]
3744         local_host = self.pg4.remote_hosts[1]
3745         external_port = 80
3746         local_port = 8080
3747         eh_port_in = 0
3748
3749         self.vapi.nat44_forwarding_enable_disable(enable=1)
3750         self.nat_add_address(self.nat_addr, twice_nat=1)
3751         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3752                  self.config_flags.NAT_IS_TWICE_NAT)
3753         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3754                                     local_port, external_port,
3755                                     proto=IP_PROTOS.tcp, flags=flags)
3756         flags = self.config_flags.NAT_IS_INSIDE
3757         self.vapi.nat44_interface_add_del_feature(
3758             sw_if_index=self.pg4.sw_if_index,
3759             is_add=1)
3760         self.vapi.nat44_interface_add_del_feature(
3761             sw_if_index=self.pg4.sw_if_index,
3762             flags=flags, is_add=1)
3763
3764         # from client to service
3765         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3766              IP(src=remote_host.ip4, dst=self.nat_addr) /
3767              TCP(sport=12345, dport=external_port))
3768         self.pg4.add_stream(p)
3769         self.pg_enable_capture(self.pg_interfaces)
3770         self.pg_start()
3771         capture = self.pg4.get_capture(1)
3772         p = capture[0]
3773         try:
3774             ip = p[IP]
3775             tcp = p[TCP]
3776             self.assertEqual(ip.dst, local_host.ip4)
3777             self.assertEqual(ip.src, self.nat_addr)
3778             self.assertEqual(tcp.dport, local_port)
3779             self.assertNotEqual(tcp.sport, 12345)
3780             eh_port_in = tcp.sport
3781             self.assert_packet_checksums_valid(p)
3782         except:
3783             self.logger.error(ppp("Unexpected or invalid packet:", p))
3784             raise
3785
3786         # from service back to client
3787         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3788              IP(src=local_host.ip4, dst=self.nat_addr) /
3789              TCP(sport=local_port, dport=eh_port_in))
3790         self.pg4.add_stream(p)
3791         self.pg_enable_capture(self.pg_interfaces)
3792         self.pg_start()
3793         capture = self.pg4.get_capture(1)
3794         p = capture[0]
3795         try:
3796             ip = p[IP]
3797             tcp = p[TCP]
3798             self.assertEqual(ip.src, self.nat_addr)
3799             self.assertEqual(ip.dst, remote_host.ip4)
3800             self.assertEqual(tcp.sport, external_port)
3801             self.assertEqual(tcp.dport, 12345)
3802             self.assert_packet_checksums_valid(p)
3803         except:
3804             self.logger.error(ppp("Unexpected or invalid packet:", p))
3805             raise
3806
3807
3808 if __name__ == '__main__':
3809     unittest.main(testRunner=VppTestRunner)