test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class NAT44EDTestCase(VppTestCase):
  23
  24     nat_addr = '10.0.0.3'
  25
  26     tcp_port_in = 6303
  27     tcp_port_out = 6303
  28
  29     udp_port_in = 6304
  30     udp_port_out = 6304
  31
  32     icmp_id_in = 6305
  33     icmp_id_out = 6305
  34
  35     tcp_external_port = 80
  36
  37     max_sessions = 100
  38
  39     def setUp(self):
  40         super(NAT44EDTestCase, self).setUp()
  41         self.plugin_enable()
  42
  43     def tearDown(self):
  44         super(NAT44EDTestCase, self).tearDown()
  45         if not self.vpp_dead:
  46             self.plugin_disable()
  47
  48     def plugin_enable(self):
  49         self.vapi.nat44_ed_plugin_enable_disable(
  50             sessions=self.max_sessions, enable=1)
  51
  52     def plugin_disable(self):
  53         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  54
  55     @property
  56     def config_flags(self):
  57         return VppEnum.vl_api_nat_config_flags_t
  58
  59     @property
  60     def nat44_config_flags(self):
  61         return VppEnum.vl_api_nat44_config_flags_t
  62
  63     @property
  64     def syslog_severity(self):
  65         return VppEnum.vl_api_syslog_severity_t
  66
  67     @property
  68     def server_addr(self):
  69         return self.pg1.remote_hosts[0].ip4
  70
  71     @staticmethod
  72     def random_port():
  73         return randint(1025, 65535)
  74
  75     @staticmethod
  76     def proto2layer(proto):
  77         if proto == IP_PROTOS.tcp:
  78             return TCP
  79         elif proto == IP_PROTOS.udp:
  80             return UDP
  81         elif proto == IP_PROTOS.icmp:
  82             return ICMP
  83         else:
  84             raise Exception("Unsupported protocol")
  85
  86     @classmethod
  87     def create_and_add_ip4_table(cls, i, table_id=0):
  88         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  89         i.set_table_ip4(table_id)
  90
  91     @classmethod
  92     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  93         if table_id:
  94             cls.create_and_add_ip4_table(i, table_id)
  95
  96         i.admin_up()
  97         i.config_ip4()
  98         i.resolve_arp()
  99
 100         if hosts:
 101             i.generate_remote_hosts(hosts)
 102             i.configure_ipv4_neighbors()
 103
 104     @classmethod
 105     def nat_add_interface_address(cls, i):
 106         cls.vapi.nat44_add_del_interface_addr(
 107             sw_if_index=i.sw_if_index, is_add=1)
 108
 109     def nat_add_inside_interface(self, i):
 110         self.vapi.nat44_interface_add_del_feature(
 111             flags=self.config_flags.NAT_IS_INSIDE,
 112             sw_if_index=i.sw_if_index, is_add=1)
 113
 114     def nat_add_outside_interface(self, i):
 115         self.vapi.nat44_interface_add_del_feature(
 116             flags=self.config_flags.NAT_IS_OUTSIDE,
 117             sw_if_index=i.sw_if_index, is_add=1)
 118
 119     def nat_add_address(self, address, twice_nat=0,
 120                         vrf_id=0xFFFFFFFF, is_add=1):
 121         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 122         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 123                                               last_ip_address=address,
 124                                               vrf_id=vrf_id,
 125                                               is_add=is_add,
 126                                               flags=flags)
 127
 128     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 129                                local_port=0, external_port=0, vrf_id=0,
 130                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 131                                proto=0, tag="", flags=0):
 132
 133         if not (local_port and external_port):
 134             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 135
 136         self.vapi.nat44_add_del_static_mapping(
 137             is_add=is_add,
 138             local_ip_address=local_ip,
 139             external_ip_address=external_ip,
 140             external_sw_if_index=external_sw_if_index,
 141             local_port=local_port,
 142             external_port=external_port,
 143             vrf_id=vrf_id, protocol=proto,
 144             flags=flags,
 145             tag=tag)
 146
 147     @classmethod
 148     def setUpClass(cls):
 149         super(NAT44EDTestCase, cls).setUpClass()
 150
 151         cls.create_pg_interfaces(range(12))
 152         cls.interfaces = list(cls.pg_interfaces[:4])
 153
 154         cls.create_and_add_ip4_table(cls.pg2, 10)
 155
 156         for i in cls.interfaces:
 157             cls.configure_ip4_interface(i, hosts=3)
 158
 159         # test specific (test-multiple-vrf)
 160         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 161
 162         # test specific (test-one-armed-nat44-static)
 163         cls.pg4.generate_remote_hosts(2)
 164         cls.pg4.config_ip4()
 165         cls.vapi.sw_interface_add_del_address(
 166             sw_if_index=cls.pg4.sw_if_index,
 167             prefix="10.0.0.1/24")
 168         cls.pg4.admin_up()
 169         cls.pg4.resolve_arp()
 170         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 171         cls.pg4.resolve_arp()
 172
 173         # test specific interface (pg5)
 174         cls.pg5._local_ip4 = "10.1.1.1"
 175         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 176         cls.pg5.set_table_ip4(1)
 177         cls.pg5.config_ip4()
 178         cls.pg5.admin_up()
 179         cls.pg5.resolve_arp()
 180
 181         # test specific interface (pg6)
 182         cls.pg6._local_ip4 = "10.1.2.1"
 183         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 184         cls.pg6.set_table_ip4(1)
 185         cls.pg6.config_ip4()
 186         cls.pg6.admin_up()
 187         cls.pg6.resolve_arp()
 188
 189         rl = list()
 190
 191         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 192                              [VppRoutePath("0.0.0.0", 0xffffffff,
 193                                            nh_table_id=0)],
 194                              register=False, table_id=1))
 195         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 196                              [VppRoutePath(cls.pg1.local_ip4,
 197                                            cls.pg1.sw_if_index)],
 198                              register=False))
 199         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 200                              [VppRoutePath("0.0.0.0",
 201                                            cls.pg5.sw_if_index)],
 202                              register=False, table_id=1))
 203         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 204                              [VppRoutePath("0.0.0.0",
 205                                            cls.pg6.sw_if_index)],
 206                              register=False, table_id=1))
 207         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 208                              [VppRoutePath("0.0.0.0", 0xffffffff,
 209                                            nh_table_id=1)],
 210                              register=False, table_id=0))
 211
 212         for r in rl:
 213             r.add_vpp_config()
 214
 215     def get_err_counter(self, path):
 216         return self.statistics.get_err_counter(path)
 217
 218     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 219                           host_in_port, proto=IP_PROTOS.tcp,
 220                           ignore_port=False):
 221         layer = self.proto2layer(proto)
 222
 223         if proto == IP_PROTOS.tcp:
 224             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 225         else:
 226             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 227
 228         # send packet from host to server
 229         pkts = self.create_stream_frag(self.pg0,
 230                                        self.nat_addr,
 231                                        host_in_port,
 232                                        server_out_port,
 233                                        data,
 234                                        proto)
 235         self.pg0.add_stream(pkts)
 236         self.pg_enable_capture(self.pg_interfaces)
 237         self.pg_start()
 238         frags = self.pg0.get_capture(len(pkts))
 239         p = self.reass_frags_and_verify(frags,
 240                                         self.nat_addr,
 241                                         server_addr)
 242         if proto != IP_PROTOS.icmp:
 243             if not ignore_port:
 244                 self.assertNotEqual(p[layer].sport, host_in_port)
 245             self.assertEqual(p[layer].dport, server_in_port)
 246         else:
 247             if not ignore_port:
 248                 self.assertNotEqual(p[layer].id, host_in_port)
 249         self.assertEqual(data, p[Raw].load)
 250
 251     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 252                           ignore_port=False):
 253         layer = self.proto2layer(proto)
 254
 255         if proto == IP_PROTOS.tcp:
 256             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 257         else:
 258             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 259         self.port_in = self.random_port()
 260
 261         for i in range(2):
 262             # in2out
 263             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 264                                            self.port_in, 20, data, proto)
 265             pkts.reverse()
 266             self.pg0.add_stream(pkts)
 267             self.pg_enable_capture(self.pg_interfaces)
 268             self.pg_start()
 269             frags = self.pg1.get_capture(len(pkts))
 270             if not dont_translate:
 271                 p = self.reass_frags_and_verify(frags,
 272                                                 self.nat_addr,
 273                                                 self.pg1.remote_ip4)
 274             else:
 275                 p = self.reass_frags_and_verify(frags,
 276                                                 self.pg0.remote_ip4,
 277                                                 self.pg1.remote_ip4)
 278             if proto != IP_PROTOS.icmp:
 279                 if not dont_translate:
 280                     self.assertEqual(p[layer].dport, 20)
 281                     if not ignore_port:
 282                         self.assertNotEqual(p[layer].sport, self.port_in)
 283                 else:
 284                     self.assertEqual(p[layer].sport, self.port_in)
 285             else:
 286                 if not ignore_port:
 287                     if not dont_translate:
 288                         self.assertNotEqual(p[layer].id, self.port_in)
 289                     else:
 290                         self.assertEqual(p[layer].id, self.port_in)
 291             self.assertEqual(data, p[Raw].load)
 292
 293             # out2in
 294             if not dont_translate:
 295                 dst_addr = self.nat_addr
 296             else:
 297                 dst_addr = self.pg0.remote_ip4
 298             if proto != IP_PROTOS.icmp:
 299                 sport = 20
 300                 dport = p[layer].sport
 301             else:
 302                 sport = p[layer].id
 303                 dport = 0
 304             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 305                                            data, proto, echo_reply=True)
 306             pkts.reverse()
 307             self.pg1.add_stream(pkts)
 308             self.pg_enable_capture(self.pg_interfaces)
 309             self.logger.info(self.vapi.cli("show trace"))
 310             self.pg_start()
 311             frags = self.pg0.get_capture(len(pkts))
 312             p = self.reass_frags_and_verify(frags,
 313                                             self.pg1.remote_ip4,
 314                                             self.pg0.remote_ip4)
 315             if proto != IP_PROTOS.icmp:
 316                 self.assertEqual(p[layer].sport, 20)
 317                 self.assertEqual(p[layer].dport, self.port_in)
 318             else:
 319                 self.assertEqual(p[layer].id, self.port_in)
 320             self.assertEqual(data, p[Raw].load)
 321
 322     def reass_frags_and_verify(self, frags, src, dst):
 323         buffer = BytesIO()
 324         for p in frags:
 325             self.assertEqual(p[IP].src, src)
 326             self.assertEqual(p[IP].dst, dst)
 327             self.assert_ip_checksum_valid(p)
 328             buffer.seek(p[IP].frag * 8)
 329             buffer.write(bytes(p[IP].payload))
 330         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 331                 proto=frags[0][IP].proto)
 332         if ip.proto == IP_PROTOS.tcp:
 333             p = (ip / TCP(buffer.getvalue()))
 334             self.logger.debug(ppp("Reassembled:", p))
 335             self.assert_tcp_checksum_valid(p)
 336         elif ip.proto == IP_PROTOS.udp:
 337             p = (ip / UDP(buffer.getvalue()[:8]) /
 338                  Raw(buffer.getvalue()[8:]))
 339         elif ip.proto == IP_PROTOS.icmp:
 340             p = (ip / ICMP(buffer.getvalue()))
 341         return p
 342
 343     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 344                       ignore_port=False):
 345         layer = self.proto2layer(proto)
 346
 347         if proto == IP_PROTOS.tcp:
 348             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 349         else:
 350             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 351         self.port_in = self.random_port()
 352
 353         # in2out
 354         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 355                                        self.port_in, 20, data, proto)
 356         self.pg0.add_stream(pkts)
 357         self.pg_enable_capture(self.pg_interfaces)
 358         self.pg_start()
 359         frags = self.pg1.get_capture(len(pkts))
 360         if not dont_translate:
 361             p = self.reass_frags_and_verify(frags,
 362                                             self.nat_addr,
 363                                             self.pg1.remote_ip4)
 364         else:
 365             p = self.reass_frags_and_verify(frags,
 366                                             self.pg0.remote_ip4,
 367                                             self.pg1.remote_ip4)
 368         if proto != IP_PROTOS.icmp:
 369             if not dont_translate:
 370                 self.assertEqual(p[layer].dport, 20)
 371                 if not ignore_port:
 372                     self.assertNotEqual(p[layer].sport, self.port_in)
 373             else:
 374                 self.assertEqual(p[layer].sport, self.port_in)
 375         else:
 376             if not ignore_port:
 377                 if not dont_translate:
 378                     self.assertNotEqual(p[layer].id, self.port_in)
 379                 else:
 380                     self.assertEqual(p[layer].id, self.port_in)
 381         self.assertEqual(data, p[Raw].load)
 382
 383         # out2in
 384         if not dont_translate:
 385             dst_addr = self.nat_addr
 386         else:
 387             dst_addr = self.pg0.remote_ip4
 388         if proto != IP_PROTOS.icmp:
 389             sport = 20
 390             dport = p[layer].sport
 391         else:
 392             sport = p[layer].id
 393             dport = 0
 394         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 395                                        proto, echo_reply=True)
 396         self.pg1.add_stream(pkts)
 397         self.pg_enable_capture(self.pg_interfaces)
 398         self.pg_start()
 399         frags = self.pg0.get_capture(len(pkts))
 400         p = self.reass_frags_and_verify(frags,
 401                                         self.pg1.remote_ip4,
 402                                         self.pg0.remote_ip4)
 403         if proto != IP_PROTOS.icmp:
 404             self.assertEqual(p[layer].sport, 20)
 405             self.assertEqual(p[layer].dport, self.port_in)
 406         else:
 407             self.assertEqual(p[layer].id, self.port_in)
 408         self.assertEqual(data, p[Raw].load)
 409
 410     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 411                            dst_ip=None, ignore_port=False):
 412         if nat_ip is None:
 413             nat_ip = self.nat_addr
 414         for packet in capture:
 415             try:
 416                 self.assert_packet_checksums_valid(packet)
 417                 self.assertEqual(packet[IP].src, nat_ip)
 418                 if dst_ip is not None:
 419                     self.assertEqual(packet[IP].dst, dst_ip)
 420                 if packet.haslayer(TCP):
 421                     if not ignore_port:
 422                         if same_port:
 423                             self.assertEqual(
 424                                 packet[TCP].sport, self.tcp_port_in)
 425                         else:
 426                             self.assertNotEqual(
 427                                 packet[TCP].sport, self.tcp_port_in)
 428                     self.tcp_port_out = packet[TCP].sport
 429                     self.assert_packet_checksums_valid(packet)
 430                 elif packet.haslayer(UDP):
 431                     if not ignore_port:
 432                         if same_port:
 433                             self.assertEqual(
 434                                 packet[UDP].sport, self.udp_port_in)
 435                         else:
 436                             self.assertNotEqual(
 437                                 packet[UDP].sport, self.udp_port_in)
 438                     self.udp_port_out = packet[UDP].sport
 439                 else:
 440                     if not ignore_port:
 441                         if same_port:
 442                             self.assertEqual(
 443                                 packet[ICMP].id, self.icmp_id_in)
 444                         else:
 445                             self.assertNotEqual(
 446                                 packet[ICMP].id, self.icmp_id_in)
 447                     self.icmp_id_out = packet[ICMP].id
 448                     self.assert_packet_checksums_valid(packet)
 449             except:
 450                 self.logger.error(ppp("Unexpected or invalid packet "
 451                                       "(outside network):", packet))
 452                 raise
 453
 454     def verify_capture_in(self, capture, in_if):
 455         for packet in capture:
 456             try:
 457                 self.assert_packet_checksums_valid(packet)
 458                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 459                 if packet.haslayer(TCP):
 460                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 461                 elif packet.haslayer(UDP):
 462                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 463                 else:
 464                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 465             except:
 466                 self.logger.error(ppp("Unexpected or invalid packet "
 467                                       "(inside network):", packet))
 468                 raise
 469
 470     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 471         if dst_ip is None:
 472             dst_ip = out_if.remote_ip4
 473
 474         pkts = []
 475         # TCP
 476         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 477              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 478              TCP(sport=self.tcp_port_in, dport=20))
 479         pkts.extend([p, p])
 480
 481         # UDP
 482         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 483              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 484              UDP(sport=self.udp_port_in, dport=20))
 485         pkts.append(p)
 486
 487         # ICMP
 488         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 489              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 490              ICMP(id=self.icmp_id_in, type='echo-request'))
 491         pkts.append(p)
 492
 493         return pkts
 494
 495     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 496                           use_inside_ports=False):
 497         if dst_ip is None:
 498             dst_ip = self.nat_addr
 499         if not use_inside_ports:
 500             tcp_port = self.tcp_port_out
 501             udp_port = self.udp_port_out
 502             icmp_id = self.icmp_id_out
 503         else:
 504             tcp_port = self.tcp_port_in
 505             udp_port = self.udp_port_in
 506             icmp_id = self.icmp_id_in
 507         pkts = []
 508         # TCP
 509         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 510              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 511              TCP(dport=tcp_port, sport=20))
 512         pkts.extend([p, p])
 513
 514         # UDP
 515         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 516              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 517              UDP(dport=udp_port, sport=20))
 518         pkts.append(p)
 519
 520         # ICMP
 521         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 522              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 523              ICMP(id=icmp_id, type='echo-reply'))
 524         pkts.append(p)
 525
 526         return pkts
 527
 528     def create_tcp_stream(self, in_if, out_if, count):
 529         pkts = []
 530         port = 6303
 531
 532         for i in range(count):
 533             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 534                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 535                  TCP(sport=port + i, dport=20))
 536             pkts.append(p)
 537
 538         return pkts
 539
 540     def create_stream_frag(self, src_if, dst, sport, dport, data,
 541                            proto=IP_PROTOS.tcp, echo_reply=False):
 542         if proto == IP_PROTOS.tcp:
 543             p = (IP(src=src_if.remote_ip4, dst=dst) /
 544                  TCP(sport=sport, dport=dport) /
 545                  Raw(data))
 546             p = p.__class__(scapy.compat.raw(p))
 547             chksum = p[TCP].chksum
 548             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 549         elif proto == IP_PROTOS.udp:
 550             proto_header = UDP(sport=sport, dport=dport)
 551         elif proto == IP_PROTOS.icmp:
 552             if not echo_reply:
 553                 proto_header = ICMP(id=sport, type='echo-request')
 554             else:
 555                 proto_header = ICMP(id=sport, type='echo-reply')
 556         else:
 557             raise Exception("Unsupported protocol")
 558         id = self.random_port()
 559         pkts = []
 560         if proto == IP_PROTOS.tcp:
 561             raw = Raw(data[0:4])
 562         else:
 563             raw = Raw(data[0:16])
 564         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 565              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 566              proto_header /
 567              raw)
 568         pkts.append(p)
 569         if proto == IP_PROTOS.tcp:
 570             raw = Raw(data[4:20])
 571         else:
 572             raw = Raw(data[16:32])
 573         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 574              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 575                 proto=proto) /
 576              raw)
 577         pkts.append(p)
 578         if proto == IP_PROTOS.tcp:
 579             raw = Raw(data[20:])
 580         else:
 581             raw = Raw(data[32:])
 582         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 583              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 584                 id=id) /
 585              raw)
 586         pkts.append(p)
 587         return pkts
 588
 589     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 590                                   proto=IP_PROTOS.tcp):
 591
 592         layer = self.proto2layer(proto)
 593
 594         if proto == IP_PROTOS.tcp:
 595             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 596         else:
 597             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 598         port_in = self.random_port()
 599
 600         for i in range(2):
 601             # out2in
 602             pkts = self.create_stream_frag(self.pg0, out_addr,
 603                                            port_in, out_port,
 604                                            data, proto)
 605             self.pg0.add_stream(pkts)
 606             self.pg_enable_capture(self.pg_interfaces)
 607             self.pg_start()
 608             frags = self.pg1.get_capture(len(pkts))
 609             p = self.reass_frags_and_verify(frags,
 610                                             self.pg0.remote_ip4,
 611                                             in_addr)
 612             if proto != IP_PROTOS.icmp:
 613                 self.assertEqual(p[layer].sport, port_in)
 614                 self.assertEqual(p[layer].dport, in_port)
 615             else:
 616                 self.assertEqual(p[layer].id, port_in)
 617             self.assertEqual(data, p[Raw].load)
 618
 619             # in2out
 620             if proto != IP_PROTOS.icmp:
 621                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 622                                                in_port,
 623                                                p[layer].sport, data, proto)
 624             else:
 625                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 626                                                p[layer].id, 0, data, proto,
 627                                                echo_reply=True)
 628             self.pg1.add_stream(pkts)
 629             self.pg_enable_capture(self.pg_interfaces)
 630             self.pg_start()
 631             frags = self.pg0.get_capture(len(pkts))
 632             p = self.reass_frags_and_verify(frags,
 633                                             out_addr,
 634                                             self.pg0.remote_ip4)
 635             if proto != IP_PROTOS.icmp:
 636                 self.assertEqual(p[layer].sport, out_port)
 637                 self.assertEqual(p[layer].dport, port_in)
 638             else:
 639                 self.assertEqual(p[layer].id, port_in)
 640             self.assertEqual(data, p[Raw].load)
 641
 642     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 643                                       out_port, proto=IP_PROTOS.tcp):
 644
 645         layer = self.proto2layer(proto)
 646
 647         if proto == IP_PROTOS.tcp:
 648             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 649         else:
 650             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 651         port_in = self.random_port()
 652
 653         for i in range(2):
 654             # out2in
 655             pkts = self.create_stream_frag(self.pg0, out_addr,
 656                                            port_in, out_port,
 657                                            data, proto)
 658             pkts.reverse()
 659             self.pg0.add_stream(pkts)
 660             self.pg_enable_capture(self.pg_interfaces)
 661             self.pg_start()
 662             frags = self.pg1.get_capture(len(pkts))
 663             p = self.reass_frags_and_verify(frags,
 664                                             self.pg0.remote_ip4,
 665                                             in_addr)
 666             if proto != IP_PROTOS.icmp:
 667                 self.assertEqual(p[layer].dport, in_port)
 668                 self.assertEqual(p[layer].sport, port_in)
 669                 self.assertEqual(p[layer].dport, in_port)
 670             else:
 671                 self.assertEqual(p[layer].id, port_in)
 672             self.assertEqual(data, p[Raw].load)
 673
 674             # in2out
 675             if proto != IP_PROTOS.icmp:
 676                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 677                                                in_port,
 678                                                p[layer].sport, data, proto)
 679             else:
 680                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 681                                                p[layer].id, 0, data, proto,
 682                                                echo_reply=True)
 683             pkts.reverse()
 684             self.pg1.add_stream(pkts)
 685             self.pg_enable_capture(self.pg_interfaces)
 686             self.pg_start()
 687             frags = self.pg0.get_capture(len(pkts))
 688             p = self.reass_frags_and_verify(frags,
 689                                             out_addr,
 690                                             self.pg0.remote_ip4)
 691             if proto != IP_PROTOS.icmp:
 692                 self.assertEqual(p[layer].sport, out_port)
 693                 self.assertEqual(p[layer].dport, port_in)
 694             else:
 695                 self.assertEqual(p[layer].id, port_in)
 696             self.assertEqual(data, p[Raw].load)
 697
 698     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 699         # SYN packet in->out
 700         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 701              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 702              TCP(sport=in_port, dport=ext_port, flags="S"))
 703         in_if.add_stream(p)
 704         self.pg_enable_capture(self.pg_interfaces)
 705         self.pg_start()
 706         capture = out_if.get_capture(1)
 707         p = capture[0]
 708         out_port = p[TCP].sport
 709
 710         # SYN + ACK packet out->in
 711         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 712              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 713              TCP(sport=ext_port, dport=out_port, flags="SA"))
 714         out_if.add_stream(p)
 715         self.pg_enable_capture(self.pg_interfaces)
 716         self.pg_start()
 717         in_if.get_capture(1)
 718
 719         # ACK packet in->out
 720         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 721              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 722              TCP(sport=in_port, dport=ext_port, flags="A"))
 723         in_if.add_stream(p)
 724         self.pg_enable_capture(self.pg_interfaces)
 725         self.pg_start()
 726         out_if.get_capture(1)
 727
 728         return out_port
 729
 730     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 731                          client_id=None):
 732         twice_nat_addr = '10.0.1.3'
 733
 734         port_in = 8080
 735         if lb:
 736             if not same_pg:
 737                 port_in1 = port_in
 738                 port_in2 = port_in
 739             else:
 740                 port_in1 = port_in + 1
 741                 port_in2 = port_in + 2
 742
 743         port_out = 80
 744         eh_port_out = 4567
 745
 746         server1 = self.pg0.remote_hosts[0]
 747         server2 = self.pg0.remote_hosts[1]
 748         if lb and same_pg:
 749             server2 = server1
 750         if not lb:
 751             server = server1
 752
 753         pg0 = self.pg0
 754         if same_pg:
 755             pg1 = self.pg0
 756         else:
 757             pg1 = self.pg1
 758
 759         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 760                         client_id == 1)
 761
 762         self.nat_add_address(self.nat_addr)
 763         self.nat_add_address(twice_nat_addr, twice_nat=1)
 764
 765         flags = 0
 766         if self_twice_nat:
 767             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 768         else:
 769             flags |= self.config_flags.NAT_IS_TWICE_NAT
 770
 771         if not lb:
 772             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 773                                         port_in, port_out,
 774                                         proto=IP_PROTOS.tcp,
 775                                         flags=flags)
 776         else:
 777             locals = [{'addr': server1.ip4,
 778                        'port': port_in1,
 779                        'probability': 50,
 780                        'vrf_id': 0},
 781                       {'addr': server2.ip4,
 782                        'port': port_in2,
 783                        'probability': 50,
 784                        'vrf_id': 0}]
 785             out_addr = self.nat_addr
 786
 787             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 788                                                       external_addr=out_addr,
 789                                                       external_port=port_out,
 790                                                       protocol=IP_PROTOS.tcp,
 791                                                       local_num=len(locals),
 792                                                       locals=locals)
 793         self.nat_add_inside_interface(pg0)
 794         self.nat_add_outside_interface(pg1)
 795
 796         if same_pg:
 797             if not lb:
 798                 client = server
 799             else:
 800                 assert client_id is not None
 801                 if client_id == 1:
 802                     client = self.pg0.remote_hosts[0]
 803                 elif client_id == 2:
 804                     client = self.pg0.remote_hosts[1]
 805         else:
 806             client = pg1.remote_hosts[0]
 807         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 808              IP(src=client.ip4, dst=self.nat_addr) /
 809              TCP(sport=eh_port_out, dport=port_out))
 810         pg1.add_stream(p)
 811         self.pg_enable_capture(self.pg_interfaces)
 812         self.pg_start()
 813         capture = pg0.get_capture(1)
 814         p = capture[0]
 815         try:
 816             ip = p[IP]
 817             tcp = p[TCP]
 818             if lb:
 819                 if ip.dst == server1.ip4:
 820                     server = server1
 821                     port_in = port_in1
 822                 else:
 823                     server = server2
 824                     port_in = port_in2
 825             self.assertEqual(ip.dst, server.ip4)
 826             if lb and same_pg:
 827                 self.assertIn(tcp.dport, [port_in1, port_in2])
 828             else:
 829                 self.assertEqual(tcp.dport, port_in)
 830             if eh_translate:
 831                 self.assertEqual(ip.src, twice_nat_addr)
 832                 self.assertNotEqual(tcp.sport, eh_port_out)
 833             else:
 834                 self.assertEqual(ip.src, client.ip4)
 835                 self.assertEqual(tcp.sport, eh_port_out)
 836             eh_addr_in = ip.src
 837             eh_port_in = tcp.sport
 838             saved_port_in = tcp.dport
 839             self.assert_packet_checksums_valid(p)
 840         except:
 841             self.logger.error(ppp("Unexpected or invalid packet:", p))
 842             raise
 843
 844         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 845              IP(src=server.ip4, dst=eh_addr_in) /
 846              TCP(sport=saved_port_in, dport=eh_port_in))
 847         pg0.add_stream(p)
 848         self.pg_enable_capture(self.pg_interfaces)
 849         self.pg_start()
 850         capture = pg1.get_capture(1)
 851         p = capture[0]
 852         try:
 853             ip = p[IP]
 854             tcp = p[TCP]
 855             self.assertEqual(ip.dst, client.ip4)
 856             self.assertEqual(ip.src, self.nat_addr)
 857             self.assertEqual(tcp.dport, eh_port_out)
 858             self.assertEqual(tcp.sport, port_out)
 859             self.assert_packet_checksums_valid(p)
 860         except:
 861             self.logger.error(ppp("Unexpected or invalid packet:", p))
 862             raise
 863
 864         if eh_translate:
 865             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 866             self.assertEqual(len(sessions), 1)
 867             self.assertTrue(sessions[0].flags &
 868                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 869             self.assertTrue(sessions[0].flags &
 870                             self.config_flags.NAT_IS_TWICE_NAT)
 871             self.logger.info(self.vapi.cli("show nat44 sessions"))
 872             self.vapi.nat44_del_session(
 873                 address=sessions[0].inside_ip_address,
 874                 port=sessions[0].inside_port,
 875                 protocol=sessions[0].protocol,
 876                 flags=(self.config_flags.NAT_IS_INSIDE |
 877                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 878                 ext_host_address=sessions[0].ext_host_nat_address,
 879                 ext_host_port=sessions[0].ext_host_nat_port)
 880             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 881             self.assertEqual(len(sessions), 0)
 882
 883     def verify_syslog_sess(self, data, is_add=True, is_ip6=False):
 884         message = data.decode('utf-8')
 885         try:
 886             message = SyslogMessage.parse(message)
 887         except ParseError as e:
 888             self.logger.error(e)
 889             raise
 890         else:
 891             self.assertEqual(message.severity, SyslogSeverity.info)
 892             self.assertEqual(message.appname, 'NAT')
 893             self.assertEqual(message.msgid, 'SADD' if is_add else 'SDEL')
 894             sd_params = message.sd.get('nsess')
 895             self.assertTrue(sd_params is not None)
 896             if is_ip6:
 897                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 898                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 899             else:
 900                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 901                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 902                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 903             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 904             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 905             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 906             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 907             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 908             self.assertEqual(sd_params.get('SVLAN'), '0')
 909             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 910             self.assertEqual(sd_params.get('XDPORT'),
 911                              "%d" % self.tcp_external_port)
 912
 913
 914 class TestNAT44ED(NAT44EDTestCase):
 915     """ NAT44ED Test Case """
 916
 917     def test_icmp_error(self):
 918         """ NAT44ED test ICMP error message with inner header"""
 919
 920         payload = "H" * 10
 921
 922         self.nat_add_address(self.nat_addr)
 923         self.nat_add_inside_interface(self.pg0)
 924         self.nat_add_outside_interface(self.pg1)
 925
 926         # in2out (initiate connection)
 927         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 928               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 929               UDP(sport=21, dport=20) / payload)
 930
 931         self.pg0.add_stream(p1)
 932         self.pg_enable_capture(self.pg_interfaces)
 933         self.pg_start()
 934         capture = self.pg1.get_capture(1)[0]
 935
 936         # out2in (send error message)
 937         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 938               IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
 939               ICMP(type='dest-unreach', code='port-unreachable') /
 940               capture[IP:])
 941
 942         self.pg1.add_stream(p2)
 943         self.pg_enable_capture(self.pg_interfaces)
 944         self.pg_start()
 945
 946         capture = self.pg0.get_capture(1)[0]
 947
 948         self.logger.info(ppp("p1 packet:", p1))
 949         self.logger.info(ppp("p2 packet:", p2))
 950         self.logger.info(ppp("capture packet:", capture))
 951
 952     def test_users_dump(self):
 953         """ NAT44ED API test - nat44_user_dump """
 954
 955         self.nat_add_address(self.nat_addr)
 956         self.nat_add_inside_interface(self.pg0)
 957         self.nat_add_outside_interface(self.pg1)
 958
 959         self.vapi.nat44_forwarding_enable_disable(enable=1)
 960
 961         local_ip = self.pg0.remote_ip4
 962         external_ip = self.nat_addr
 963         self.nat_add_static_mapping(local_ip, external_ip)
 964
 965         users = self.vapi.nat44_user_dump()
 966         self.assertEqual(len(users), 0)
 967
 968         # in2out - static mapping match
 969
 970         pkts = self.create_stream_out(self.pg1)
 971         self.pg1.add_stream(pkts)
 972         self.pg_enable_capture(self.pg_interfaces)
 973         self.pg_start()
 974         capture = self.pg0.get_capture(len(pkts))
 975         self.verify_capture_in(capture, self.pg0)
 976
 977         pkts = self.create_stream_in(self.pg0, self.pg1)
 978         self.pg0.add_stream(pkts)
 979         self.pg_enable_capture(self.pg_interfaces)
 980         self.pg_start()
 981         capture = self.pg1.get_capture(len(pkts))
 982         self.verify_capture_out(capture, same_port=True)
 983
 984         users = self.vapi.nat44_user_dump()
 985         self.assertEqual(len(users), 1)
 986         static_user = users[0]
 987         self.assertEqual(static_user.nstaticsessions, 3)
 988         self.assertEqual(static_user.nsessions, 0)
 989
 990         # in2out - no static mapping match (forwarding test)
 991
 992         host0 = self.pg0.remote_hosts[0]
 993         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
 994         try:
 995             pkts = self.create_stream_out(self.pg1,
 996                                           dst_ip=self.pg0.remote_ip4,
 997                                           use_inside_ports=True)
 998             self.pg1.add_stream(pkts)
 999             self.pg_enable_capture(self.pg_interfaces)
1000             self.pg_start()
1001             capture = self.pg0.get_capture(len(pkts))
1002             self.verify_capture_in(capture, self.pg0)
1003
1004             pkts = self.create_stream_in(self.pg0, self.pg1)
1005             self.pg0.add_stream(pkts)
1006             self.pg_enable_capture(self.pg_interfaces)
1007             self.pg_start()
1008             capture = self.pg1.get_capture(len(pkts))
1009             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1010                                     same_port=True)
1011         finally:
1012             self.pg0.remote_hosts[0] = host0
1013
1014         users = self.vapi.nat44_user_dump()
1015         self.assertEqual(len(users), 2)
1016         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1017             non_static_user = users[1]
1018             static_user = users[0]
1019         else:
1020             non_static_user = users[0]
1021             static_user = users[1]
1022         self.assertEqual(static_user.nstaticsessions, 3)
1023         self.assertEqual(static_user.nsessions, 0)
1024         self.assertEqual(non_static_user.nstaticsessions, 0)
1025         self.assertEqual(non_static_user.nsessions, 3)
1026
1027         users = self.vapi.nat44_user_dump()
1028         self.assertEqual(len(users), 2)
1029         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1030             non_static_user = users[1]
1031             static_user = users[0]
1032         else:
1033             non_static_user = users[0]
1034             static_user = users[1]
1035         self.assertEqual(static_user.nstaticsessions, 3)
1036         self.assertEqual(static_user.nsessions, 0)
1037         self.assertEqual(non_static_user.nstaticsessions, 0)
1038         self.assertEqual(non_static_user.nsessions, 3)
1039
1040     def test_frag_out_of_order_do_not_translate(self):
1041         """ NAT44ED don't translate fragments arriving out of order """
1042         self.nat_add_inside_interface(self.pg0)
1043         self.nat_add_outside_interface(self.pg1)
1044         self.vapi.nat44_forwarding_enable_disable(enable=True)
1045         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1046
1047     def test_forwarding(self):
1048         """ NAT44ED forwarding test """
1049
1050         self.nat_add_inside_interface(self.pg0)
1051         self.nat_add_outside_interface(self.pg1)
1052         self.vapi.nat44_forwarding_enable_disable(enable=1)
1053
1054         real_ip = self.pg0.remote_ip4
1055         alias_ip = self.nat_addr
1056         flags = self.config_flags.NAT_IS_ADDR_ONLY
1057         self.vapi.nat44_add_del_static_mapping(is_add=1,
1058                                                local_ip_address=real_ip,
1059                                                external_ip_address=alias_ip,
1060                                                external_sw_if_index=0xFFFFFFFF,
1061                                                flags=flags)
1062
1063         try:
1064             # in2out - static mapping match
1065
1066             pkts = self.create_stream_out(self.pg1)
1067             self.pg1.add_stream(pkts)
1068             self.pg_enable_capture(self.pg_interfaces)
1069             self.pg_start()
1070             capture = self.pg0.get_capture(len(pkts))
1071             self.verify_capture_in(capture, self.pg0)
1072
1073             pkts = self.create_stream_in(self.pg0, self.pg1)
1074             self.pg0.add_stream(pkts)
1075             self.pg_enable_capture(self.pg_interfaces)
1076             self.pg_start()
1077             capture = self.pg1.get_capture(len(pkts))
1078             self.verify_capture_out(capture, same_port=True)
1079
1080             # in2out - no static mapping match
1081
1082             host0 = self.pg0.remote_hosts[0]
1083             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1084             try:
1085                 pkts = self.create_stream_out(self.pg1,
1086                                               dst_ip=self.pg0.remote_ip4,
1087                                               use_inside_ports=True)
1088                 self.pg1.add_stream(pkts)
1089                 self.pg_enable_capture(self.pg_interfaces)
1090                 self.pg_start()
1091                 capture = self.pg0.get_capture(len(pkts))
1092                 self.verify_capture_in(capture, self.pg0)
1093
1094                 pkts = self.create_stream_in(self.pg0, self.pg1)
1095                 self.pg0.add_stream(pkts)
1096                 self.pg_enable_capture(self.pg_interfaces)
1097                 self.pg_start()
1098                 capture = self.pg1.get_capture(len(pkts))
1099                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1100                                         same_port=True)
1101             finally:
1102                 self.pg0.remote_hosts[0] = host0
1103
1104             user = self.pg0.remote_hosts[1]
1105             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1106             self.assertEqual(len(sessions), 3)
1107             self.assertTrue(sessions[0].flags &
1108                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1109             self.vapi.nat44_del_session(
1110                 address=sessions[0].inside_ip_address,
1111                 port=sessions[0].inside_port,
1112                 protocol=sessions[0].protocol,
1113                 flags=(self.config_flags.NAT_IS_INSIDE |
1114                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1115                 ext_host_address=sessions[0].ext_host_address,
1116                 ext_host_port=sessions[0].ext_host_port)
1117             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1118             self.assertEqual(len(sessions), 2)
1119
1120         finally:
1121             self.vapi.nat44_forwarding_enable_disable(enable=0)
1122             flags = self.config_flags.NAT_IS_ADDR_ONLY
1123             self.vapi.nat44_add_del_static_mapping(
1124                 is_add=0,
1125                 local_ip_address=real_ip,
1126                 external_ip_address=alias_ip,
1127                 external_sw_if_index=0xFFFFFFFF,
1128                 flags=flags)
1129
1130     def test_output_feature_and_service2(self):
1131         """ NAT44ED interface output feature and service host direct access """
1132         self.vapi.nat44_forwarding_enable_disable(enable=1)
1133         self.nat_add_address(self.nat_addr)
1134
1135         self.vapi.nat44_interface_add_del_output_feature(
1136             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1137
1138         # session initiated from service host - translate
1139         pkts = self.create_stream_in(self.pg0, self.pg1)
1140         self.pg0.add_stream(pkts)
1141         self.pg_enable_capture(self.pg_interfaces)
1142         self.pg_start()
1143         capture = self.pg1.get_capture(len(pkts))
1144         self.verify_capture_out(capture, ignore_port=True)
1145
1146         pkts = self.create_stream_out(self.pg1)
1147         self.pg1.add_stream(pkts)
1148         self.pg_enable_capture(self.pg_interfaces)
1149         self.pg_start()
1150         capture = self.pg0.get_capture(len(pkts))
1151         self.verify_capture_in(capture, self.pg0)
1152
1153         # session initiated from remote host - do not translate
1154         tcp_port_in = self.tcp_port_in
1155         udp_port_in = self.udp_port_in
1156         icmp_id_in = self.icmp_id_in
1157
1158         self.tcp_port_in = 60303
1159         self.udp_port_in = 60304
1160         self.icmp_id_in = 60305
1161
1162         try:
1163             pkts = self.create_stream_out(self.pg1,
1164                                           self.pg0.remote_ip4,
1165                                           use_inside_ports=True)
1166             self.pg1.add_stream(pkts)
1167             self.pg_enable_capture(self.pg_interfaces)
1168             self.pg_start()
1169             capture = self.pg0.get_capture(len(pkts))
1170             self.verify_capture_in(capture, self.pg0)
1171
1172             pkts = self.create_stream_in(self.pg0, self.pg1)
1173             self.pg0.add_stream(pkts)
1174             self.pg_enable_capture(self.pg_interfaces)
1175             self.pg_start()
1176             capture = self.pg1.get_capture(len(pkts))
1177             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1178                                     same_port=True)
1179         finally:
1180             self.tcp_port_in = tcp_port_in
1181             self.udp_port_in = udp_port_in
1182             self.icmp_id_in = icmp_id_in
1183
1184     def test_twice_nat(self):
1185         """ NAT44ED Twice NAT """
1186         self.twice_nat_common()
1187
1188     def test_self_twice_nat_positive(self):
1189         """ NAT44ED Self Twice NAT (positive test) """
1190         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1191
1192     def test_self_twice_nat_lb_positive(self):
1193         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1194         """
1195         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1196                               client_id=1)
1197
1198     def test_twice_nat_lb(self):
1199         """ NAT44ED Twice NAT local service load balancing """
1200         self.twice_nat_common(lb=True)
1201
1202     def test_output_feature(self):
1203         """ NAT44ED interface output feature (in2out postrouting) """
1204         self.vapi.nat44_forwarding_enable_disable(enable=1)
1205         self.nat_add_address(self.nat_addr)
1206
1207         self.nat_add_outside_interface(self.pg0)
1208         self.vapi.nat44_interface_add_del_output_feature(
1209             sw_if_index=self.pg1.sw_if_index, is_add=1)
1210
1211         # in2out
1212         pkts = self.create_stream_in(self.pg0, self.pg1)
1213         self.pg0.add_stream(pkts)
1214         self.pg_enable_capture(self.pg_interfaces)
1215         self.pg_start()
1216         capture = self.pg1.get_capture(len(pkts))
1217         self.verify_capture_out(capture, ignore_port=True)
1218         self.logger.debug(self.vapi.cli("show trace"))
1219
1220         # out2in
1221         pkts = self.create_stream_out(self.pg1)
1222         self.pg1.add_stream(pkts)
1223         self.pg_enable_capture(self.pg_interfaces)
1224         self.pg_start()
1225         capture = self.pg0.get_capture(len(pkts))
1226         self.verify_capture_in(capture, self.pg0)
1227         self.logger.debug(self.vapi.cli("show trace"))
1228
1229         # in2out
1230         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1231         self.pg0.add_stream(pkts)
1232         self.pg_enable_capture(self.pg_interfaces)
1233         self.pg_start()
1234         capture = self.pg1.get_capture(len(pkts))
1235         self.verify_capture_out(capture, ignore_port=True)
1236         self.logger.debug(self.vapi.cli("show trace"))
1237
1238         # out2in
1239         pkts = self.create_stream_out(self.pg1, ttl=2)
1240         self.pg1.add_stream(pkts)
1241         self.pg_enable_capture(self.pg_interfaces)
1242         self.pg_start()
1243         capture = self.pg0.get_capture(len(pkts))
1244         self.verify_capture_in(capture, self.pg0)
1245         self.logger.debug(self.vapi.cli("show trace"))
1246
1247         # in2out
1248         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1249         self.pg0.add_stream(pkts)
1250         self.pg_enable_capture(self.pg_interfaces)
1251         self.pg_start()
1252         capture = self.pg0.get_capture(len(pkts))
1253         for p in capture:
1254             self.assertIn(ICMP, p)
1255             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1256
1257     def test_static_with_port_out2(self):
1258         """ NAT44ED 1:1 NAPT asymmetrical rule """
1259
1260         external_port = 80
1261         local_port = 8080
1262
1263         self.vapi.nat44_forwarding_enable_disable(enable=1)
1264         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1265         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1266                                     local_port, external_port,
1267                                     proto=IP_PROTOS.tcp, flags=flags)
1268
1269         self.nat_add_inside_interface(self.pg0)
1270         self.nat_add_outside_interface(self.pg1)
1271
1272         # from client to service
1273         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1274              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1275              TCP(sport=12345, dport=external_port))
1276         self.pg1.add_stream(p)
1277         self.pg_enable_capture(self.pg_interfaces)
1278         self.pg_start()
1279         capture = self.pg0.get_capture(1)
1280         p = capture[0]
1281         try:
1282             ip = p[IP]
1283             tcp = p[TCP]
1284             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1285             self.assertEqual(tcp.dport, local_port)
1286             self.assert_packet_checksums_valid(p)
1287         except:
1288             self.logger.error(ppp("Unexpected or invalid packet:", p))
1289             raise
1290
1291         # ICMP error
1292         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1293              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1294              ICMP(type=11) / capture[0][IP])
1295         self.pg0.add_stream(p)
1296         self.pg_enable_capture(self.pg_interfaces)
1297         self.pg_start()
1298         capture = self.pg1.get_capture(1)
1299         p = capture[0]
1300         try:
1301             self.assertEqual(p[IP].src, self.nat_addr)
1302             inner = p[IPerror]
1303             self.assertEqual(inner.dst, self.nat_addr)
1304             self.assertEqual(inner[TCPerror].dport, external_port)
1305         except:
1306             self.logger.error(ppp("Unexpected or invalid packet:", p))
1307             raise
1308
1309         # from service back to client
1310         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1311              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1312              TCP(sport=local_port, dport=12345))
1313         self.pg0.add_stream(p)
1314         self.pg_enable_capture(self.pg_interfaces)
1315         self.pg_start()
1316         capture = self.pg1.get_capture(1)
1317         p = capture[0]
1318         try:
1319             ip = p[IP]
1320             tcp = p[TCP]
1321             self.assertEqual(ip.src, self.nat_addr)
1322             self.assertEqual(tcp.sport, external_port)
1323             self.assert_packet_checksums_valid(p)
1324         except:
1325             self.logger.error(ppp("Unexpected or invalid packet:", p))
1326             raise
1327
1328         # ICMP error
1329         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1330              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1331              ICMP(type=11) / capture[0][IP])
1332         self.pg1.add_stream(p)
1333         self.pg_enable_capture(self.pg_interfaces)
1334         self.pg_start()
1335         capture = self.pg0.get_capture(1)
1336         p = capture[0]
1337         try:
1338             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1339             inner = p[IPerror]
1340             self.assertEqual(inner.src, self.pg0.remote_ip4)
1341             self.assertEqual(inner[TCPerror].sport, local_port)
1342         except:
1343             self.logger.error(ppp("Unexpected or invalid packet:", p))
1344             raise
1345
1346         # from client to server (no translation)
1347         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1348              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1349              TCP(sport=12346, dport=local_port))
1350         self.pg1.add_stream(p)
1351         self.pg_enable_capture(self.pg_interfaces)
1352         self.pg_start()
1353         capture = self.pg0.get_capture(1)
1354         p = capture[0]
1355         try:
1356             ip = p[IP]
1357             tcp = p[TCP]
1358             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1359             self.assertEqual(tcp.dport, local_port)
1360             self.assert_packet_checksums_valid(p)
1361         except:
1362             self.logger.error(ppp("Unexpected or invalid packet:", p))
1363             raise
1364
1365         # from service back to client (no translation)
1366         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1367              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1368              TCP(sport=local_port, dport=12346))
1369         self.pg0.add_stream(p)
1370         self.pg_enable_capture(self.pg_interfaces)
1371         self.pg_start()
1372         capture = self.pg1.get_capture(1)
1373         p = capture[0]
1374         try:
1375             ip = p[IP]
1376             tcp = p[TCP]
1377             self.assertEqual(ip.src, self.pg0.remote_ip4)
1378             self.assertEqual(tcp.sport, local_port)
1379             self.assert_packet_checksums_valid(p)
1380         except:
1381             self.logger.error(ppp("Unexpected or invalid packet:", p))
1382             raise
1383
1384     def test_static_lb(self):
1385         """ NAT44ED local service load balancing """
1386         external_addr_n = self.nat_addr
1387         external_port = 80
1388         local_port = 8080
1389         server1 = self.pg0.remote_hosts[0]
1390         server2 = self.pg0.remote_hosts[1]
1391
1392         locals = [{'addr': server1.ip4,
1393                    'port': local_port,
1394                    'probability': 70,
1395                    'vrf_id': 0},
1396                   {'addr': server2.ip4,
1397                    'port': local_port,
1398                    'probability': 30,
1399                    'vrf_id': 0}]
1400
1401         self.nat_add_address(self.nat_addr)
1402         self.vapi.nat44_add_del_lb_static_mapping(
1403             is_add=1,
1404             external_addr=external_addr_n,
1405             external_port=external_port,
1406             protocol=IP_PROTOS.tcp,
1407             local_num=len(locals),
1408             locals=locals)
1409         flags = self.config_flags.NAT_IS_INSIDE
1410         self.vapi.nat44_interface_add_del_feature(
1411             sw_if_index=self.pg0.sw_if_index,
1412             flags=flags, is_add=1)
1413         self.vapi.nat44_interface_add_del_feature(
1414             sw_if_index=self.pg1.sw_if_index,
1415             is_add=1)
1416
1417         # from client to service
1418         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1419              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1420              TCP(sport=12345, dport=external_port))
1421         self.pg1.add_stream(p)
1422         self.pg_enable_capture(self.pg_interfaces)
1423         self.pg_start()
1424         capture = self.pg0.get_capture(1)
1425         p = capture[0]
1426         server = None
1427         try:
1428             ip = p[IP]
1429             tcp = p[TCP]
1430             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1431             if ip.dst == server1.ip4:
1432                 server = server1
1433             else:
1434                 server = server2
1435             self.assertEqual(tcp.dport, local_port)
1436             self.assert_packet_checksums_valid(p)
1437         except:
1438             self.logger.error(ppp("Unexpected or invalid packet:", p))
1439             raise
1440
1441         # from service back to client
1442         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1443              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1444              TCP(sport=local_port, dport=12345))
1445         self.pg0.add_stream(p)
1446         self.pg_enable_capture(self.pg_interfaces)
1447         self.pg_start()
1448         capture = self.pg1.get_capture(1)
1449         p = capture[0]
1450         try:
1451             ip = p[IP]
1452             tcp = p[TCP]
1453             self.assertEqual(ip.src, self.nat_addr)
1454             self.assertEqual(tcp.sport, external_port)
1455             self.assert_packet_checksums_valid(p)
1456         except:
1457             self.logger.error(ppp("Unexpected or invalid packet:", p))
1458             raise
1459
1460         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1461         self.assertEqual(len(sessions), 1)
1462         self.assertTrue(sessions[0].flags &
1463                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1464         self.vapi.nat44_del_session(
1465             address=sessions[0].inside_ip_address,
1466             port=sessions[0].inside_port,
1467             protocol=sessions[0].protocol,
1468             flags=(self.config_flags.NAT_IS_INSIDE |
1469                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1470             ext_host_address=sessions[0].ext_host_address,
1471             ext_host_port=sessions[0].ext_host_port)
1472         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1473         self.assertEqual(len(sessions), 0)
1474
1475     def test_static_lb_2(self):
1476         """ NAT44ED local service load balancing (asymmetrical rule) """
1477         external_addr = self.nat_addr
1478         external_port = 80
1479         local_port = 8080
1480         server1 = self.pg0.remote_hosts[0]
1481         server2 = self.pg0.remote_hosts[1]
1482
1483         locals = [{'addr': server1.ip4,
1484                    'port': local_port,
1485                    'probability': 70,
1486                    'vrf_id': 0},
1487                   {'addr': server2.ip4,
1488                    'port': local_port,
1489                    'probability': 30,
1490                    'vrf_id': 0}]
1491
1492         self.vapi.nat44_forwarding_enable_disable(enable=1)
1493         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1494         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1495                                                   external_addr=external_addr,
1496                                                   external_port=external_port,
1497                                                   protocol=IP_PROTOS.tcp,
1498                                                   local_num=len(locals),
1499                                                   locals=locals)
1500         flags = self.config_flags.NAT_IS_INSIDE
1501         self.vapi.nat44_interface_add_del_feature(
1502             sw_if_index=self.pg0.sw_if_index,
1503             flags=flags, is_add=1)
1504         self.vapi.nat44_interface_add_del_feature(
1505             sw_if_index=self.pg1.sw_if_index,
1506             is_add=1)
1507
1508         # from client to service
1509         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1510              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1511              TCP(sport=12345, dport=external_port))
1512         self.pg1.add_stream(p)
1513         self.pg_enable_capture(self.pg_interfaces)
1514         self.pg_start()
1515         capture = self.pg0.get_capture(1)
1516         p = capture[0]
1517         server = None
1518         try:
1519             ip = p[IP]
1520             tcp = p[TCP]
1521             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1522             if ip.dst == server1.ip4:
1523                 server = server1
1524             else:
1525                 server = server2
1526             self.assertEqual(tcp.dport, local_port)
1527             self.assert_packet_checksums_valid(p)
1528         except:
1529             self.logger.error(ppp("Unexpected or invalid packet:", p))
1530             raise
1531
1532         # from service back to client
1533         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1534              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1535              TCP(sport=local_port, dport=12345))
1536         self.pg0.add_stream(p)
1537         self.pg_enable_capture(self.pg_interfaces)
1538         self.pg_start()
1539         capture = self.pg1.get_capture(1)
1540         p = capture[0]
1541         try:
1542             ip = p[IP]
1543             tcp = p[TCP]
1544             self.assertEqual(ip.src, self.nat_addr)
1545             self.assertEqual(tcp.sport, external_port)
1546             self.assert_packet_checksums_valid(p)
1547         except:
1548             self.logger.error(ppp("Unexpected or invalid packet:", p))
1549             raise
1550
1551         # from client to server (no translation)
1552         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1553              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1554              TCP(sport=12346, dport=local_port))
1555         self.pg1.add_stream(p)
1556         self.pg_enable_capture(self.pg_interfaces)
1557         self.pg_start()
1558         capture = self.pg0.get_capture(1)
1559         p = capture[0]
1560         server = None
1561         try:
1562             ip = p[IP]
1563             tcp = p[TCP]
1564             self.assertEqual(ip.dst, server1.ip4)
1565             self.assertEqual(tcp.dport, local_port)
1566             self.assert_packet_checksums_valid(p)
1567         except:
1568             self.logger.error(ppp("Unexpected or invalid packet:", p))
1569             raise
1570
1571         # from service back to client (no translation)
1572         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1573              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1574              TCP(sport=local_port, dport=12346))
1575         self.pg0.add_stream(p)
1576         self.pg_enable_capture(self.pg_interfaces)
1577         self.pg_start()
1578         capture = self.pg1.get_capture(1)
1579         p = capture[0]
1580         try:
1581             ip = p[IP]
1582             tcp = p[TCP]
1583             self.assertEqual(ip.src, server1.ip4)
1584             self.assertEqual(tcp.sport, local_port)
1585             self.assert_packet_checksums_valid(p)
1586         except:
1587             self.logger.error(ppp("Unexpected or invalid packet:", p))
1588             raise
1589
1590     def test_lb_affinity(self):
1591         """ NAT44ED local service load balancing affinity """
1592         external_addr = self.nat_addr
1593         external_port = 80
1594         local_port = 8080
1595         server1 = self.pg0.remote_hosts[0]
1596         server2 = self.pg0.remote_hosts[1]
1597
1598         locals = [{'addr': server1.ip4,
1599                    'port': local_port,
1600                    'probability': 50,
1601                    'vrf_id': 0},
1602                   {'addr': server2.ip4,
1603                    'port': local_port,
1604                    'probability': 50,
1605                    'vrf_id': 0}]
1606
1607         self.nat_add_address(self.nat_addr)
1608         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1609                                                   external_addr=external_addr,
1610                                                   external_port=external_port,
1611                                                   protocol=IP_PROTOS.tcp,
1612                                                   affinity=10800,
1613                                                   local_num=len(locals),
1614                                                   locals=locals)
1615         flags = self.config_flags.NAT_IS_INSIDE
1616         self.vapi.nat44_interface_add_del_feature(
1617             sw_if_index=self.pg0.sw_if_index,
1618             flags=flags, is_add=1)
1619         self.vapi.nat44_interface_add_del_feature(
1620             sw_if_index=self.pg1.sw_if_index,
1621             is_add=1)
1622
1623         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1624              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1625              TCP(sport=1025, dport=external_port))
1626         self.pg1.add_stream(p)
1627         self.pg_enable_capture(self.pg_interfaces)
1628         self.pg_start()
1629         capture = self.pg0.get_capture(1)
1630         backend = capture[0][IP].dst
1631
1632         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1633         self.assertEqual(len(sessions), 1)
1634         self.assertTrue(sessions[0].flags &
1635                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1636         self.vapi.nat44_del_session(
1637             address=sessions[0].inside_ip_address,
1638             port=sessions[0].inside_port,
1639             protocol=sessions[0].protocol,
1640             flags=(self.config_flags.NAT_IS_INSIDE |
1641                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1642             ext_host_address=sessions[0].ext_host_address,
1643             ext_host_port=sessions[0].ext_host_port)
1644
1645         pkts = []
1646         for port in range(1030, 1100):
1647             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1648                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1649                  TCP(sport=port, dport=external_port))
1650             pkts.append(p)
1651         self.pg1.add_stream(pkts)
1652         self.pg_enable_capture(self.pg_interfaces)
1653         self.pg_start()
1654         capture = self.pg0.get_capture(len(pkts))
1655         for p in capture:
1656             self.assertEqual(p[IP].dst, backend)
1657
1658     def test_multiple_vrf_1(self):
1659         """ Multiple VRF - both client & service in VRF1 """
1660
1661         external_addr = '1.2.3.4'
1662         external_port = 80
1663         local_port = 8080
1664         port = 0
1665
1666         flags = self.config_flags.NAT_IS_INSIDE
1667         self.vapi.nat44_interface_add_del_feature(
1668             sw_if_index=self.pg5.sw_if_index,
1669             is_add=1)
1670         self.vapi.nat44_interface_add_del_feature(
1671             sw_if_index=self.pg5.sw_if_index,
1672             is_add=1, flags=flags)
1673         self.vapi.nat44_interface_add_del_feature(
1674             sw_if_index=self.pg6.sw_if_index,
1675             is_add=1)
1676         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1677         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1678                                     local_port, external_port, vrf_id=1,
1679                                     proto=IP_PROTOS.tcp, flags=flags)
1680
1681         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1682              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1683              TCP(sport=12345, dport=external_port))
1684         self.pg6.add_stream(p)
1685         self.pg_enable_capture(self.pg_interfaces)
1686         self.pg_start()
1687         capture = self.pg5.get_capture(1)
1688         p = capture[0]
1689         try:
1690             ip = p[IP]
1691             tcp = p[TCP]
1692             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1693             self.assertEqual(tcp.dport, local_port)
1694             self.assert_packet_checksums_valid(p)
1695         except:
1696             self.logger.error(ppp("Unexpected or invalid packet:", p))
1697             raise
1698
1699         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1700              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1701              TCP(sport=local_port, dport=12345))
1702         self.pg5.add_stream(p)
1703         self.pg_enable_capture(self.pg_interfaces)
1704         self.pg_start()
1705         capture = self.pg6.get_capture(1)
1706         p = capture[0]
1707         try:
1708             ip = p[IP]
1709             tcp = p[TCP]
1710             self.assertEqual(ip.src, external_addr)
1711             self.assertEqual(tcp.sport, external_port)
1712             self.assert_packet_checksums_valid(p)
1713         except:
1714             self.logger.error(ppp("Unexpected or invalid packet:", p))
1715             raise
1716
1717     def test_multiple_vrf_2(self):
1718         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1719
1720         external_addr = '1.2.3.4'
1721         external_port = 80
1722         local_port = 8080
1723         port = 0
1724
1725         self.nat_add_address(self.nat_addr)
1726         flags = self.config_flags.NAT_IS_INSIDE
1727         self.vapi.nat44_interface_add_del_output_feature(
1728             sw_if_index=self.pg1.sw_if_index,
1729             is_add=1)
1730         self.vapi.nat44_interface_add_del_feature(
1731             sw_if_index=self.pg5.sw_if_index,
1732             is_add=1)
1733         self.vapi.nat44_interface_add_del_feature(
1734             sw_if_index=self.pg5.sw_if_index,
1735             is_add=1, flags=flags)
1736         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1737         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1738                                     local_port, external_port, vrf_id=1,
1739                                     proto=IP_PROTOS.tcp, flags=flags)
1740
1741         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1742              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1743              TCP(sport=2345, dport=22))
1744         self.pg5.add_stream(p)
1745         self.pg_enable_capture(self.pg_interfaces)
1746         self.pg_start()
1747         capture = self.pg1.get_capture(1)
1748         p = capture[0]
1749         try:
1750             ip = p[IP]
1751             tcp = p[TCP]
1752             self.assertEqual(ip.src, self.nat_addr)
1753             self.assert_packet_checksums_valid(p)
1754             port = tcp.sport
1755         except:
1756             self.logger.error(ppp("Unexpected or invalid packet:", p))
1757             raise
1758
1759         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1760              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1761              TCP(sport=22, dport=port))
1762         self.pg1.add_stream(p)
1763         self.pg_enable_capture(self.pg_interfaces)
1764         self.pg_start()
1765         capture = self.pg5.get_capture(1)
1766         p = capture[0]
1767         try:
1768             ip = p[IP]
1769             tcp = p[TCP]
1770             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1771             self.assertEqual(tcp.dport, 2345)
1772             self.assert_packet_checksums_valid(p)
1773         except:
1774             self.logger.error(ppp("Unexpected or invalid packet:", p))
1775             raise
1776
1777     def test_multiple_vrf_3(self):
1778         """ Multiple VRF - client in VRF1, service in VRF0 """
1779
1780         external_addr = '1.2.3.4'
1781         external_port = 80
1782         local_port = 8080
1783         port = 0
1784
1785         flags = self.config_flags.NAT_IS_INSIDE
1786         self.vapi.nat44_interface_add_del_feature(
1787             sw_if_index=self.pg0.sw_if_index,
1788             is_add=1)
1789         self.vapi.nat44_interface_add_del_feature(
1790             sw_if_index=self.pg0.sw_if_index,
1791             is_add=1, flags=flags)
1792         self.vapi.nat44_interface_add_del_feature(
1793             sw_if_index=self.pg6.sw_if_index,
1794             is_add=1)
1795         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1796         self.nat_add_static_mapping(
1797             self.pg0.remote_ip4,
1798             external_sw_if_index=self.pg0.sw_if_index,
1799             local_port=local_port,
1800             vrf_id=0,
1801             external_port=external_port,
1802             proto=IP_PROTOS.tcp,
1803             flags=flags
1804         )
1805
1806         # from client VRF1 to service VRF0
1807         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1808              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1809              TCP(sport=12346, dport=external_port))
1810         self.pg6.add_stream(p)
1811         self.pg_enable_capture(self.pg_interfaces)
1812         self.pg_start()
1813         capture = self.pg0.get_capture(1)
1814         p = capture[0]
1815         try:
1816             ip = p[IP]
1817             tcp = p[TCP]
1818             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1819             self.assertEqual(tcp.dport, local_port)
1820             self.assert_packet_checksums_valid(p)
1821         except:
1822             self.logger.error(ppp("Unexpected or invalid packet:", p))
1823             raise
1824
1825         # from service VRF0 back to client VRF1
1826         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1827              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1828              TCP(sport=local_port, dport=12346))
1829         self.pg0.add_stream(p)
1830         self.pg_enable_capture(self.pg_interfaces)
1831         self.pg_start()
1832         capture = self.pg6.get_capture(1)
1833         p = capture[0]
1834         try:
1835             ip = p[IP]
1836             tcp = p[TCP]
1837             self.assertEqual(ip.src, self.pg0.local_ip4)
1838             self.assertEqual(tcp.sport, external_port)
1839             self.assert_packet_checksums_valid(p)
1840         except:
1841             self.logger.error(ppp("Unexpected or invalid packet:", p))
1842             raise
1843
1844     def test_multiple_vrf_4(self):
1845         """ Multiple VRF - client in VRF0, service in VRF1 """
1846
1847         external_addr = '1.2.3.4'
1848         external_port = 80
1849         local_port = 8080
1850         port = 0
1851
1852         flags = self.config_flags.NAT_IS_INSIDE
1853         self.vapi.nat44_interface_add_del_feature(
1854             sw_if_index=self.pg0.sw_if_index,
1855             is_add=1)
1856         self.vapi.nat44_interface_add_del_feature(
1857             sw_if_index=self.pg0.sw_if_index,
1858             is_add=1, flags=flags)
1859         self.vapi.nat44_interface_add_del_feature(
1860             sw_if_index=self.pg5.sw_if_index,
1861             is_add=1)
1862         self.vapi.nat44_interface_add_del_feature(
1863             sw_if_index=self.pg5.sw_if_index,
1864             is_add=1, flags=flags)
1865         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1866         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1867                                     local_port, external_port, vrf_id=1,
1868                                     proto=IP_PROTOS.tcp, flags=flags)
1869
1870         # from client VRF0 to service VRF1
1871         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1872              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1873              TCP(sport=12347, dport=external_port))
1874         self.pg0.add_stream(p)
1875         self.pg_enable_capture(self.pg_interfaces)
1876         self.pg_start()
1877         capture = self.pg5.get_capture(1)
1878         p = capture[0]
1879         try:
1880             ip = p[IP]
1881             tcp = p[TCP]
1882             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1883             self.assertEqual(tcp.dport, local_port)
1884             self.assert_packet_checksums_valid(p)
1885         except:
1886             self.logger.error(ppp("Unexpected or invalid packet:", p))
1887             raise
1888
1889         # from service VRF1 back to client VRF0
1890         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1891              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1892              TCP(sport=local_port, dport=12347))
1893         self.pg5.add_stream(p)
1894         self.pg_enable_capture(self.pg_interfaces)
1895         self.pg_start()
1896         capture = self.pg0.get_capture(1)
1897         p = capture[0]
1898         try:
1899             ip = p[IP]
1900             tcp = p[TCP]
1901             self.assertEqual(ip.src, external_addr)
1902             self.assertEqual(tcp.sport, external_port)
1903             self.assert_packet_checksums_valid(p)
1904         except:
1905             self.logger.error(ppp("Unexpected or invalid packet:", p))
1906             raise
1907
1908     def test_multiple_vrf_5(self):
1909         """ Multiple VRF - forwarding - no translation """
1910
1911         external_addr = '1.2.3.4'
1912         external_port = 80
1913         local_port = 8080
1914         port = 0
1915
1916         self.vapi.nat44_forwarding_enable_disable(enable=1)
1917         flags = self.config_flags.NAT_IS_INSIDE
1918         self.vapi.nat44_interface_add_del_feature(
1919             sw_if_index=self.pg0.sw_if_index,
1920             is_add=1)
1921         self.vapi.nat44_interface_add_del_feature(
1922             sw_if_index=self.pg0.sw_if_index,
1923             is_add=1, flags=flags)
1924         self.vapi.nat44_interface_add_del_feature(
1925             sw_if_index=self.pg5.sw_if_index,
1926             is_add=1)
1927         self.vapi.nat44_interface_add_del_feature(
1928             sw_if_index=self.pg5.sw_if_index,
1929             is_add=1, flags=flags)
1930         self.vapi.nat44_interface_add_del_feature(
1931             sw_if_index=self.pg6.sw_if_index,
1932             is_add=1)
1933         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1934         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1935                                     local_port, external_port, vrf_id=1,
1936                                     proto=IP_PROTOS.tcp, flags=flags)
1937         self.nat_add_static_mapping(
1938             self.pg0.remote_ip4,
1939             external_sw_if_index=self.pg0.sw_if_index,
1940             local_port=local_port,
1941             vrf_id=0,
1942             external_port=external_port,
1943             proto=IP_PROTOS.tcp,
1944             flags=flags
1945         )
1946
1947         # from client to server (both VRF1, no translation)
1948         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1949              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1950              TCP(sport=12348, dport=local_port))
1951         self.pg6.add_stream(p)
1952         self.pg_enable_capture(self.pg_interfaces)
1953         self.pg_start()
1954         capture = self.pg5.get_capture(1)
1955         p = capture[0]
1956         try:
1957             ip = p[IP]
1958             tcp = p[TCP]
1959             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1960             self.assertEqual(tcp.dport, local_port)
1961             self.assert_packet_checksums_valid(p)
1962         except:
1963             self.logger.error(ppp("Unexpected or invalid packet:", p))
1964             raise
1965
1966         # from server back to client (both VRF1, no translation)
1967         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1968              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1969              TCP(sport=local_port, dport=12348))
1970         self.pg5.add_stream(p)
1971         self.pg_enable_capture(self.pg_interfaces)
1972         self.pg_start()
1973         capture = self.pg6.get_capture(1)
1974         p = capture[0]
1975         try:
1976             ip = p[IP]
1977             tcp = p[TCP]
1978             self.assertEqual(ip.src, self.pg5.remote_ip4)
1979             self.assertEqual(tcp.sport, local_port)
1980             self.assert_packet_checksums_valid(p)
1981         except:
1982             self.logger.error(ppp("Unexpected or invalid packet:", p))
1983             raise
1984
1985         # from client VRF1 to server VRF0 (no translation)
1986         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1987              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1988              TCP(sport=local_port, dport=12349))
1989         self.pg0.add_stream(p)
1990         self.pg_enable_capture(self.pg_interfaces)
1991         self.pg_start()
1992         capture = self.pg6.get_capture(1)
1993         p = capture[0]
1994         try:
1995             ip = p[IP]
1996             tcp = p[TCP]
1997             self.assertEqual(ip.src, self.pg0.remote_ip4)
1998             self.assertEqual(tcp.sport, local_port)
1999             self.assert_packet_checksums_valid(p)
2000         except:
2001             self.logger.error(ppp("Unexpected or invalid packet:", p))
2002             raise
2003
2004         # from server VRF0 back to client VRF1 (no translation)
2005         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2006              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2007              TCP(sport=local_port, dport=12349))
2008         self.pg0.add_stream(p)
2009         self.pg_enable_capture(self.pg_interfaces)
2010         self.pg_start()
2011         capture = self.pg6.get_capture(1)
2012         p = capture[0]
2013         try:
2014             ip = p[IP]
2015             tcp = p[TCP]
2016             self.assertEqual(ip.src, self.pg0.remote_ip4)
2017             self.assertEqual(tcp.sport, local_port)
2018             self.assert_packet_checksums_valid(p)
2019         except:
2020             self.logger.error(ppp("Unexpected or invalid packet:", p))
2021             raise
2022
2023         # from client VRF0 to server VRF1 (no translation)
2024         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2025              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
2026              TCP(sport=12344, dport=local_port))
2027         self.pg0.add_stream(p)
2028         self.pg_enable_capture(self.pg_interfaces)
2029         self.pg_start()
2030         capture = self.pg5.get_capture(1)
2031         p = capture[0]
2032         try:
2033             ip = p[IP]
2034             tcp = p[TCP]
2035             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2036             self.assertEqual(tcp.dport, local_port)
2037             self.assert_packet_checksums_valid(p)
2038         except:
2039             self.logger.error(ppp("Unexpected or invalid packet:", p))
2040             raise
2041
2042         # from server VRF1 back to client VRF0 (no translation)
2043         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2044              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2045              TCP(sport=local_port, dport=12344))
2046         self.pg5.add_stream(p)
2047         self.pg_enable_capture(self.pg_interfaces)
2048         self.pg_start()
2049         capture = self.pg0.get_capture(1)
2050         p = capture[0]
2051         try:
2052             ip = p[IP]
2053             tcp = p[TCP]
2054             self.assertEqual(ip.src, self.pg5.remote_ip4)
2055             self.assertEqual(tcp.sport, local_port)
2056             self.assert_packet_checksums_valid(p)
2057         except:
2058             self.logger.error(ppp("Unexpected or invalid packet:", p))
2059             raise
2060
2061     def test_outside_address_distribution(self):
2062         """ Outside address distribution based on source address """
2063
2064         x = 100
2065         nat_addresses = []
2066
2067         for i in range(1, x):
2068             a = "10.0.0.%d" % i
2069             nat_addresses.append(a)
2070
2071         self.nat_add_inside_interface(self.pg0)
2072         self.nat_add_outside_interface(self.pg1)
2073
2074         self.vapi.nat44_add_del_address_range(
2075             first_ip_address=nat_addresses[0],
2076             last_ip_address=nat_addresses[-1],
2077             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2078
2079         self.pg0.generate_remote_hosts(x)
2080
2081         pkts = []
2082         for i in range(x):
2083             info = self.create_packet_info(self.pg0, self.pg1)
2084             payload = self.info_to_payload(info)
2085             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2086                  IP(src=self.pg0.remote_hosts[i].ip4,
2087                      dst=self.pg1.remote_ip4) /
2088                  UDP(sport=7000+i, dport=8000+i) /
2089                  Raw(payload))
2090             info.data = p
2091             pkts.append(p)
2092
2093         self.pg0.add_stream(pkts)
2094         self.pg_enable_capture(self.pg_interfaces)
2095         self.pg_start()
2096         recvd = self.pg1.get_capture(len(pkts))
2097         for p_recvd in recvd:
2098             payload_info = self.payload_to_info(p_recvd[Raw])
2099             packet_index = payload_info.index
2100             info = self._packet_infos[packet_index]
2101             self.assertTrue(info is not None)
2102             self.assertEqual(packet_index, info.index)
2103             p_sent = info.data
2104             packed = socket.inet_aton(p_sent[IP].src)
2105             numeric = struct.unpack("!L", packed)[0]
2106             numeric = socket.htonl(numeric)
2107             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2108             self.assertEqual(
2109                 a, p_recvd[IP].src,
2110                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2111                 % (p_sent[IP].src, p_recvd[IP].src, a))
2112
2113
2114 class TestNAT44EDMW(TestNAT44ED):
2115     """ NAT44ED MW Test Case """
2116     vpp_worker_count = 4
2117     max_sessions = 5000
2118
2119     @unittest.skip('MW fix required')
2120     def test_users_dump(self):
2121         """ NAT44ED API test - nat44_user_dump """
2122
2123     @unittest.skip('MW fix required')
2124     def test_frag_out_of_order_do_not_translate(self):
2125         """ NAT44ED don't translate fragments arriving out of order """
2126
2127     @unittest.skip('MW fix required')
2128     def test_forwarding(self):
2129         """ NAT44ED forwarding test """
2130
2131     @unittest.skip('MW fix required')
2132     def test_twice_nat(self):
2133         """ NAT44ED Twice NAT """
2134
2135     @unittest.skip('MW fix required')
2136     def test_twice_nat_lb(self):
2137         """ NAT44ED Twice NAT local service load balancing """
2138
2139     @unittest.skip('MW fix required')
2140     def test_output_feature(self):
2141         """ NAT44ED interface output feature (in2out postrouting) """
2142
2143     @unittest.skip('MW fix required')
2144     def test_static_with_port_out2(self):
2145         """ NAT44ED 1:1 NAPT asymmetrical rule """
2146
2147     @unittest.skip('MW fix required')
2148     def test_output_feature_and_service2(self):
2149         """ NAT44ED interface output feature and service host direct access """
2150
2151     @unittest.skip('MW fix required')
2152     def test_static_lb(self):
2153         """ NAT44ED local service load balancing """
2154
2155     @unittest.skip('MW fix required')
2156     def test_static_lb_2(self):
2157         """ NAT44ED local service load balancing (asymmetrical rule) """
2158
2159     @unittest.skip('MW fix required')
2160     def test_lb_affinity(self):
2161         """ NAT44ED local service load balancing affinity """
2162
2163     @unittest.skip('MW fix required')
2164     def test_multiple_vrf(self):
2165         """ NAT44ED Multiple VRF setup """
2166
2167     @unittest.skip('MW fix required')
2168     def test_self_twice_nat_positive(self):
2169         """ NAT44ED Self Twice NAT (positive test) """
2170
2171     @unittest.skip('MW fix required')
2172     def test_self_twice_nat_lb_positive(self):
2173         """ NAT44ED Self Twice NAT local service load balancing (positive test)
2174         """
2175
2176     def test_dynamic(self):
2177         """ NAT44ED dynamic translation test """
2178         pkt_count = 1500
2179         tcp_port_offset = 20
2180         udp_port_offset = 20
2181         icmp_id_offset = 20
2182
2183         self.nat_add_address(self.nat_addr)
2184         self.nat_add_inside_interface(self.pg0)
2185         self.nat_add_outside_interface(self.pg1)
2186
2187         # in2out
2188         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2189         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2190         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2191         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2192
2193         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2194
2195         for i in range(pkt_count):
2196             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2197                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2198                  TCP(sport=tcp_port_offset + i, dport=20))
2199             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2200
2201             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2202                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2203                  UDP(sport=udp_port_offset + i, dport=20))
2204             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2205
2206             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2207                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2208                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2209             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2210
2211         for i in range(0, self.vpp_worker_count):
2212             if len(i2o_pkts[i]) > 0:
2213                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2214
2215         self.pg_enable_capture(self.pg_interfaces)
2216         self.pg_start()
2217         capture = self.pg1.get_capture(pkt_count * 3)
2218
2219         if_idx = self.pg0.sw_if_index
2220         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2221         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2222         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2223         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2224
2225         self.assertEqual(
2226             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2227         self.assertEqual(
2228             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2229         self.assertEqual(
2230             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2231         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2232
2233         self.logger.info(self.vapi.cli("show trace"))
2234
2235         # out2in
2236         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2237         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2238         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2239         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2240
2241         recvd_tcp_ports = set()
2242         recvd_udp_ports = set()
2243         recvd_icmp_ids = set()
2244
2245         for p in capture:
2246             if TCP in p:
2247                 recvd_tcp_ports.add(p[TCP].sport)
2248             if UDP in p:
2249                 recvd_udp_ports.add(p[UDP].sport)
2250             if ICMP in p:
2251                 recvd_icmp_ids.add(p[ICMP].id)
2252
2253         recvd_tcp_ports = list(recvd_tcp_ports)
2254         recvd_udp_ports = list(recvd_udp_ports)
2255         recvd_icmp_ids = list(recvd_icmp_ids)
2256
2257         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2258         for i in range(pkt_count):
2259             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2260                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2261                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2262             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2263
2264             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2265                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2266                  UDP(dport=choice(recvd_udp_ports), sport=20))
2267             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2268
2269             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2270                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2271                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2272             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2273
2274         for i in range(0, self.vpp_worker_count):
2275             if len(o2i_pkts[i]) > 0:
2276                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2277
2278         self.pg_enable_capture(self.pg_interfaces)
2279         self.pg_start()
2280         capture = self.pg0.get_capture(pkt_count * 3)
2281         for packet in capture:
2282             try:
2283                 self.assert_packet_checksums_valid(packet)
2284                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2285                 if packet.haslayer(TCP):
2286                     self.assert_in_range(
2287                         packet[TCP].dport, tcp_port_offset,
2288                         tcp_port_offset + pkt_count, "dst TCP port")
2289                 elif packet.haslayer(UDP):
2290                     self.assert_in_range(
2291                         packet[UDP].dport, udp_port_offset,
2292                         udp_port_offset + pkt_count, "dst UDP port")
2293                 else:
2294                     self.assert_in_range(
2295                         packet[ICMP].id, icmp_id_offset,
2296                         icmp_id_offset + pkt_count, "ICMP id")
2297             except:
2298                 self.logger.error(ppp("Unexpected or invalid packet "
2299                                       "(inside network):", packet))
2300                 raise
2301
2302         if_idx = self.pg1.sw_if_index
2303         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2304         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2305         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2306         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2307
2308         self.assertEqual(
2309             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2310         self.assertEqual(
2311             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2312         self.assertEqual(
2313             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2314         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2315
2316         sc = self.statistics['/nat44-ed/total-sessions']
2317         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2318                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2319
2320     def test_frag_in_order(self):
2321         """ NAT44ED translate fragments arriving in order """
2322
2323         self.nat_add_address(self.nat_addr)
2324         self.nat_add_inside_interface(self.pg0)
2325         self.nat_add_outside_interface(self.pg1)
2326
2327         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2328         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2329         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2330
2331     def test_frag_in_order_do_not_translate(self):
2332         """ NAT44ED don't translate fragments arriving in order """
2333
2334         self.nat_add_address(self.nat_addr)
2335         self.nat_add_inside_interface(self.pg0)
2336         self.nat_add_outside_interface(self.pg1)
2337         self.vapi.nat44_forwarding_enable_disable(enable=True)
2338
2339         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2340
2341     def test_frag_out_of_order(self):
2342         """ NAT44ED translate fragments arriving out of order """
2343
2344         self.nat_add_address(self.nat_addr)
2345         self.nat_add_inside_interface(self.pg0)
2346         self.nat_add_outside_interface(self.pg1)
2347
2348         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2349         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2350         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2351
2352     def test_frag_in_order_in_plus_out(self):
2353         """ NAT44ED in+out interface fragments in order """
2354
2355         in_port = self.random_port()
2356         out_port = self.random_port()
2357
2358         self.nat_add_address(self.nat_addr)
2359         self.nat_add_inside_interface(self.pg0)
2360         self.nat_add_outside_interface(self.pg0)
2361         self.nat_add_inside_interface(self.pg1)
2362         self.nat_add_outside_interface(self.pg1)
2363
2364         # add static mappings for server
2365         self.nat_add_static_mapping(self.server_addr,
2366                                     self.nat_addr,
2367                                     in_port,
2368                                     out_port,
2369                                     proto=IP_PROTOS.tcp)
2370         self.nat_add_static_mapping(self.server_addr,
2371                                     self.nat_addr,
2372                                     in_port,
2373                                     out_port,
2374                                     proto=IP_PROTOS.udp)
2375         self.nat_add_static_mapping(self.server_addr,
2376                                     self.nat_addr,
2377                                     proto=IP_PROTOS.icmp)
2378
2379         # run tests for each protocol
2380         self.frag_in_order_in_plus_out(self.server_addr,
2381                                        self.nat_addr,
2382                                        in_port,
2383                                        out_port,
2384                                        IP_PROTOS.tcp)
2385         self.frag_in_order_in_plus_out(self.server_addr,
2386                                        self.nat_addr,
2387                                        in_port,
2388                                        out_port,
2389                                        IP_PROTOS.udp)
2390         self.frag_in_order_in_plus_out(self.server_addr,
2391                                        self.nat_addr,
2392                                        in_port,
2393                                        out_port,
2394                                        IP_PROTOS.icmp)
2395
2396     def test_frag_out_of_order_in_plus_out(self):
2397         """ NAT44ED in+out interface fragments out of order """
2398
2399         in_port = self.random_port()
2400         out_port = self.random_port()
2401
2402         self.nat_add_address(self.nat_addr)
2403         self.nat_add_inside_interface(self.pg0)
2404         self.nat_add_outside_interface(self.pg0)
2405         self.nat_add_inside_interface(self.pg1)
2406         self.nat_add_outside_interface(self.pg1)
2407
2408         # add static mappings for server
2409         self.nat_add_static_mapping(self.server_addr,
2410                                     self.nat_addr,
2411                                     in_port,
2412                                     out_port,
2413                                     proto=IP_PROTOS.tcp)
2414         self.nat_add_static_mapping(self.server_addr,
2415                                     self.nat_addr,
2416                                     in_port,
2417                                     out_port,
2418                                     proto=IP_PROTOS.udp)
2419         self.nat_add_static_mapping(self.server_addr,
2420                                     self.nat_addr,
2421                                     proto=IP_PROTOS.icmp)
2422
2423         # run tests for each protocol
2424         self.frag_out_of_order_in_plus_out(self.server_addr,
2425                                            self.nat_addr,
2426                                            in_port,
2427                                            out_port,
2428                                            IP_PROTOS.tcp)
2429         self.frag_out_of_order_in_plus_out(self.server_addr,
2430                                            self.nat_addr,
2431                                            in_port,
2432                                            out_port,
2433                                            IP_PROTOS.udp)
2434         self.frag_out_of_order_in_plus_out(self.server_addr,
2435                                            self.nat_addr,
2436                                            in_port,
2437                                            out_port,
2438                                            IP_PROTOS.icmp)
2439
2440     def test_reass_hairpinning(self):
2441         """ NAT44ED fragments hairpinning """
2442
2443         server_addr = self.pg0.remote_hosts[1].ip4
2444
2445         host_in_port = self.random_port()
2446         server_in_port = self.random_port()
2447         server_out_port = self.random_port()
2448
2449         self.nat_add_address(self.nat_addr)
2450         self.nat_add_inside_interface(self.pg0)
2451         self.nat_add_outside_interface(self.pg1)
2452
2453         # add static mapping for server
2454         self.nat_add_static_mapping(server_addr, self.nat_addr,
2455                                     server_in_port, server_out_port,
2456                                     proto=IP_PROTOS.tcp)
2457         self.nat_add_static_mapping(server_addr, self.nat_addr,
2458                                     server_in_port, server_out_port,
2459                                     proto=IP_PROTOS.udp)
2460         self.nat_add_static_mapping(server_addr, self.nat_addr)
2461
2462         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2463                                host_in_port, proto=IP_PROTOS.tcp,
2464                                ignore_port=True)
2465         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2466                                host_in_port, proto=IP_PROTOS.udp,
2467                                ignore_port=True)
2468         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2469                                host_in_port, proto=IP_PROTOS.icmp,
2470                                ignore_port=True)
2471
2472     def test_session_limit_per_vrf(self):
2473         """ NAT44ED per vrf session limit """
2474
2475         inside = self.pg0
2476         inside_vrf10 = self.pg2
2477         outside = self.pg1
2478
2479         limit = 5
2480
2481         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2482         # non existing vrf_id makes process core dump
2483         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2484
2485         self.nat_add_inside_interface(inside)
2486         self.nat_add_inside_interface(inside_vrf10)
2487         self.nat_add_outside_interface(outside)
2488
2489         # vrf independent
2490         self.nat_add_interface_address(outside)
2491
2492         # BUG: causing core dump - when bad vrf_id is specified
2493         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2494
2495         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2496         inside_vrf10.add_stream(stream)
2497
2498         self.pg_enable_capture(self.pg_interfaces)
2499         self.pg_start()
2500
2501         capture = outside.get_capture(limit)
2502
2503         stream = self.create_tcp_stream(inside, outside, limit * 2)
2504         inside.add_stream(stream)
2505
2506         self.pg_enable_capture(self.pg_interfaces)
2507         self.pg_start()
2508
2509         capture = outside.get_capture(len(stream))
2510
2511     def test_show_max_translations(self):
2512         """ NAT44ED API test - max translations per thread """
2513         nat_config = self.vapi.nat_show_config_2()
2514         self.assertEqual(self.max_sessions,
2515                          nat_config.max_translations_per_thread)
2516
2517     def test_lru_cleanup(self):
2518         """ NAT44ED LRU cleanup algorithm """
2519
2520         self.nat_add_address(self.nat_addr)
2521         self.nat_add_inside_interface(self.pg0)
2522         self.nat_add_outside_interface(self.pg1)
2523
2524         self.vapi.nat_set_timeouts(
2525             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2526
2527         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2528         pkts = []
2529         for i in range(0, self.max_sessions - 1):
2530             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2531                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2532                  UDP(sport=7000+i, dport=80))
2533             pkts.append(p)
2534
2535         self.pg0.add_stream(pkts)
2536         self.pg_enable_capture(self.pg_interfaces)
2537         self.pg_start()
2538         self.pg1.get_capture(len(pkts))
2539         self.sleep(1.5, "wait for timeouts")
2540
2541         pkts = []
2542         for i in range(0, self.max_sessions - 1):
2543             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2544                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2545                  ICMP(id=8000+i, type='echo-request'))
2546             pkts.append(p)
2547
2548         self.pg0.add_stream(pkts)
2549         self.pg_enable_capture(self.pg_interfaces)
2550         self.pg_start()
2551         self.pg1.get_capture(len(pkts))
2552
2553     def test_session_rst_timeout(self):
2554         """ NAT44ED session RST timeouts """
2555
2556         self.nat_add_address(self.nat_addr)
2557         self.nat_add_inside_interface(self.pg0)
2558         self.nat_add_outside_interface(self.pg1)
2559
2560         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2561                                    tcp_transitory=5, icmp=60)
2562
2563         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2564                               self.tcp_external_port)
2565         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2566              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2567              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2568                  flags="R"))
2569         self.pg0.add_stream(p)
2570         self.pg_enable_capture(self.pg_interfaces)
2571         self.pg_start()
2572         self.pg1.get_capture(1)
2573
2574         self.sleep(6)
2575
2576         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2577              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2578              TCP(sport=self.tcp_port_in + 1, dport=self.tcp_external_port + 1,
2579                  flags="S"))
2580         self.pg0.add_stream(p)
2581         self.pg_enable_capture(self.pg_interfaces)
2582         self.pg_start()
2583         self.pg1.get_capture(1)
2584
2585     def test_dynamic_out_of_ports(self):
2586         """ NAT44ED dynamic translation test: out of ports """
2587
2588         self.nat_add_inside_interface(self.pg0)
2589         self.nat_add_outside_interface(self.pg1)
2590
2591         # in2out and no NAT addresses added
2592         err_old = self.statistics.get_err_counter(
2593             '/err/nat44-ed-in2out-slowpath/out of ports')
2594
2595         pkts = self.create_stream_in(self.pg0, self.pg1)
2596         self.pg0.add_stream(pkts)
2597         self.pg_enable_capture(self.pg_interfaces)
2598         self.pg_start()
2599         self.pg1.get_capture(0, timeout=1)
2600
2601         err_new = self.statistics.get_err_counter(
2602             '/err/nat44-ed-in2out-slowpath/out of ports')
2603
2604         self.assertEqual(err_new - err_old, len(pkts))
2605
2606         # in2out after NAT addresses added
2607         self.nat_add_address(self.nat_addr)
2608
2609         err_old = self.statistics.get_err_counter(
2610             '/err/nat44-ed-in2out-slowpath/out of ports')
2611
2612         pkts = self.create_stream_in(self.pg0, self.pg1)
2613         self.pg0.add_stream(pkts)
2614         self.pg_enable_capture(self.pg_interfaces)
2615         self.pg_start()
2616         capture = self.pg1.get_capture(len(pkts))
2617         self.verify_capture_out(capture, ignore_port=True)
2618
2619         err_new = self.statistics.get_err_counter(
2620             '/err/nat44-ed-in2out-slowpath/out of ports')
2621
2622         self.assertEqual(err_new, err_old)
2623
2624     def test_unknown_proto(self):
2625         """ NAT44ED translate packet with unknown protocol """
2626
2627         self.nat_add_address(self.nat_addr)
2628         self.nat_add_inside_interface(self.pg0)
2629         self.nat_add_outside_interface(self.pg1)
2630
2631         # in2out
2632         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2633              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2634              TCP(sport=self.tcp_port_in, dport=20))
2635         self.pg0.add_stream(p)
2636         self.pg_enable_capture(self.pg_interfaces)
2637         self.pg_start()
2638         p = self.pg1.get_capture(1)
2639
2640         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2641              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2642              GRE() /
2643              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2644              TCP(sport=1234, dport=1234))
2645         self.pg0.add_stream(p)
2646         self.pg_enable_capture(self.pg_interfaces)
2647         self.pg_start()
2648         p = self.pg1.get_capture(1)
2649         packet = p[0]
2650         try:
2651             self.assertEqual(packet[IP].src, self.nat_addr)
2652             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2653             self.assertEqual(packet.haslayer(GRE), 1)
2654             self.assert_packet_checksums_valid(packet)
2655         except:
2656             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2657             raise
2658
2659         # out2in
2660         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2661              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2662              GRE() /
2663              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2664              TCP(sport=1234, dport=1234))
2665         self.pg1.add_stream(p)
2666         self.pg_enable_capture(self.pg_interfaces)
2667         self.pg_start()
2668         p = self.pg0.get_capture(1)
2669         packet = p[0]
2670         try:
2671             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2672             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2673             self.assertEqual(packet.haslayer(GRE), 1)
2674             self.assert_packet_checksums_valid(packet)
2675         except:
2676             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2677             raise
2678
2679     def test_hairpinning_unknown_proto(self):
2680         """ NAT44ED translate packet with unknown protocol - hairpinning """
2681         host = self.pg0.remote_hosts[0]
2682         server = self.pg0.remote_hosts[1]
2683         host_in_port = 1234
2684         server_out_port = 8765
2685         server_nat_ip = "10.0.0.11"
2686
2687         self.nat_add_address(self.nat_addr)
2688         self.nat_add_inside_interface(self.pg0)
2689         self.nat_add_outside_interface(self.pg1)
2690
2691         # add static mapping for server
2692         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2693
2694         # host to server
2695         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2696              IP(src=host.ip4, dst=server_nat_ip) /
2697              TCP(sport=host_in_port, dport=server_out_port))
2698         self.pg0.add_stream(p)
2699         self.pg_enable_capture(self.pg_interfaces)
2700         self.pg_start()
2701         self.pg0.get_capture(1)
2702
2703         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2704              IP(src=host.ip4, dst=server_nat_ip) /
2705              GRE() /
2706              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2707              TCP(sport=1234, dport=1234))
2708         self.pg0.add_stream(p)
2709         self.pg_enable_capture(self.pg_interfaces)
2710         self.pg_start()
2711         p = self.pg0.get_capture(1)
2712         packet = p[0]
2713         try:
2714             self.assertEqual(packet[IP].src, self.nat_addr)
2715             self.assertEqual(packet[IP].dst, server.ip4)
2716             self.assertEqual(packet.haslayer(GRE), 1)
2717             self.assert_packet_checksums_valid(packet)
2718         except:
2719             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2720             raise
2721
2722         # server to host
2723         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2724              IP(src=server.ip4, dst=self.nat_addr) /
2725              GRE() /
2726              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2727              TCP(sport=1234, dport=1234))
2728         self.pg0.add_stream(p)
2729         self.pg_enable_capture(self.pg_interfaces)
2730         self.pg_start()
2731         p = self.pg0.get_capture(1)
2732         packet = p[0]
2733         try:
2734             self.assertEqual(packet[IP].src, server_nat_ip)
2735             self.assertEqual(packet[IP].dst, host.ip4)
2736             self.assertEqual(packet.haslayer(GRE), 1)
2737             self.assert_packet_checksums_valid(packet)
2738         except:
2739             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2740             raise
2741
2742     def test_output_feature_and_service(self):
2743         """ NAT44ED interface output feature and services """
2744         external_addr = '1.2.3.4'
2745         external_port = 80
2746         local_port = 8080
2747
2748         self.vapi.nat44_forwarding_enable_disable(enable=1)
2749         self.nat_add_address(self.nat_addr)
2750         flags = self.config_flags.NAT_IS_ADDR_ONLY
2751         self.vapi.nat44_add_del_identity_mapping(
2752             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2753             flags=flags, is_add=1)
2754         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2755         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2756                                     local_port, external_port,
2757                                     proto=IP_PROTOS.tcp, flags=flags)
2758
2759         self.nat_add_inside_interface(self.pg0)
2760         self.nat_add_outside_interface(self.pg0)
2761         self.vapi.nat44_interface_add_del_output_feature(
2762             sw_if_index=self.pg1.sw_if_index, is_add=1)
2763
2764         # from client to service
2765         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2766              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2767              TCP(sport=12345, dport=external_port))
2768         self.pg1.add_stream(p)
2769         self.pg_enable_capture(self.pg_interfaces)
2770         self.pg_start()
2771         capture = self.pg0.get_capture(1)
2772         p = capture[0]
2773         try:
2774             ip = p[IP]
2775             tcp = p[TCP]
2776             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2777             self.assertEqual(tcp.dport, local_port)
2778             self.assert_packet_checksums_valid(p)
2779         except:
2780             self.logger.error(ppp("Unexpected or invalid packet:", p))
2781             raise
2782
2783         # from service back to client
2784         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2785              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2786              TCP(sport=local_port, dport=12345))
2787         self.pg0.add_stream(p)
2788         self.pg_enable_capture(self.pg_interfaces)
2789         self.pg_start()
2790         capture = self.pg1.get_capture(1)
2791         p = capture[0]
2792         try:
2793             ip = p[IP]
2794             tcp = p[TCP]
2795             self.assertEqual(ip.src, external_addr)
2796             self.assertEqual(tcp.sport, external_port)
2797             self.assert_packet_checksums_valid(p)
2798         except:
2799             self.logger.error(ppp("Unexpected or invalid packet:", p))
2800             raise
2801
2802         # from local network host to external network
2803         pkts = self.create_stream_in(self.pg0, self.pg1)
2804         self.pg0.add_stream(pkts)
2805         self.pg_enable_capture(self.pg_interfaces)
2806         self.pg_start()
2807         capture = self.pg1.get_capture(len(pkts))
2808         self.verify_capture_out(capture, ignore_port=True)
2809         pkts = self.create_stream_in(self.pg0, self.pg1)
2810         self.pg0.add_stream(pkts)
2811         self.pg_enable_capture(self.pg_interfaces)
2812         self.pg_start()
2813         capture = self.pg1.get_capture(len(pkts))
2814         self.verify_capture_out(capture, ignore_port=True)
2815
2816         # from external network back to local network host
2817         pkts = self.create_stream_out(self.pg1)
2818         self.pg1.add_stream(pkts)
2819         self.pg_enable_capture(self.pg_interfaces)
2820         self.pg_start()
2821         capture = self.pg0.get_capture(len(pkts))
2822         self.verify_capture_in(capture, self.pg0)
2823
2824     def test_output_feature_and_service3(self):
2825         """ NAT44ED interface output feature and DST NAT """
2826         external_addr = '1.2.3.4'
2827         external_port = 80
2828         local_port = 8080
2829
2830         self.vapi.nat44_forwarding_enable_disable(enable=1)
2831         self.nat_add_address(self.nat_addr)
2832         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2833         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2834                                     local_port, external_port,
2835                                     proto=IP_PROTOS.tcp, flags=flags)
2836
2837         self.nat_add_inside_interface(self.pg0)
2838         self.nat_add_outside_interface(self.pg0)
2839         self.vapi.nat44_interface_add_del_output_feature(
2840             sw_if_index=self.pg1.sw_if_index, is_add=1)
2841
2842         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2843              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2844              TCP(sport=12345, dport=external_port))
2845         self.pg0.add_stream(p)
2846         self.pg_enable_capture(self.pg_interfaces)
2847         self.pg_start()
2848         capture = self.pg1.get_capture(1)
2849         p = capture[0]
2850         try:
2851             ip = p[IP]
2852             tcp = p[TCP]
2853             self.assertEqual(ip.src, self.pg0.remote_ip4)
2854             self.assertEqual(tcp.sport, 12345)
2855             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2856             self.assertEqual(tcp.dport, local_port)
2857             self.assert_packet_checksums_valid(p)
2858         except:
2859             self.logger.error(ppp("Unexpected or invalid packet:", p))
2860             raise
2861
2862         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2863              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2864              TCP(sport=local_port, dport=12345))
2865         self.pg1.add_stream(p)
2866         self.pg_enable_capture(self.pg_interfaces)
2867         self.pg_start()
2868         capture = self.pg0.get_capture(1)
2869         p = capture[0]
2870         try:
2871             ip = p[IP]
2872             tcp = p[TCP]
2873             self.assertEqual(ip.src, external_addr)
2874             self.assertEqual(tcp.sport, external_port)
2875             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2876             self.assertEqual(tcp.dport, 12345)
2877             self.assert_packet_checksums_valid(p)
2878         except:
2879             self.logger.error(ppp("Unexpected or invalid packet:", p))
2880             raise
2881
2882     def test_self_twice_nat_lb_negative(self):
2883         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2884         """
2885         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2886                               client_id=2)
2887
2888     def test_self_twice_nat_negative(self):
2889         """ NAT44ED Self Twice NAT (negative test) """
2890         self.twice_nat_common(self_twice_nat=True)
2891
2892     def test_static_lb_multi_clients(self):
2893         """ NAT44ED local service load balancing - multiple clients"""
2894
2895         external_addr = self.nat_addr
2896         external_port = 80
2897         local_port = 8080
2898         server1 = self.pg0.remote_hosts[0]
2899         server2 = self.pg0.remote_hosts[1]
2900         server3 = self.pg0.remote_hosts[2]
2901
2902         locals = [{'addr': server1.ip4,
2903                    'port': local_port,
2904                    'probability': 90,
2905                    'vrf_id': 0},
2906                   {'addr': server2.ip4,
2907                    'port': local_port,
2908                    'probability': 10,
2909                    'vrf_id': 0}]
2910
2911         flags = self.config_flags.NAT_IS_INSIDE
2912         self.vapi.nat44_interface_add_del_feature(
2913             sw_if_index=self.pg0.sw_if_index,
2914             flags=flags, is_add=1)
2915         self.vapi.nat44_interface_add_del_feature(
2916             sw_if_index=self.pg1.sw_if_index,
2917             is_add=1)
2918
2919         self.nat_add_address(self.nat_addr)
2920         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2921                                                   external_addr=external_addr,
2922                                                   external_port=external_port,
2923                                                   protocol=IP_PROTOS.tcp,
2924                                                   local_num=len(locals),
2925                                                   locals=locals)
2926
2927         server1_n = 0
2928         server2_n = 0
2929         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2930         pkts = []
2931         for client in clients:
2932             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2933                  IP(src=client, dst=self.nat_addr) /
2934                  TCP(sport=12345, dport=external_port))
2935             pkts.append(p)
2936         self.pg1.add_stream(pkts)
2937         self.pg_enable_capture(self.pg_interfaces)
2938         self.pg_start()
2939         capture = self.pg0.get_capture(len(pkts))
2940         for p in capture:
2941             if p[IP].dst == server1.ip4:
2942                 server1_n += 1
2943             else:
2944                 server2_n += 1
2945         self.assertGreaterEqual(server1_n, server2_n)
2946
2947         local = {
2948             'addr': server3.ip4,
2949             'port': local_port,
2950             'probability': 20,
2951             'vrf_id': 0
2952         }
2953
2954         # add new back-end
2955         self.vapi.nat44_lb_static_mapping_add_del_local(
2956             is_add=1,
2957             external_addr=external_addr,
2958             external_port=external_port,
2959             local=local,
2960             protocol=IP_PROTOS.tcp)
2961         server1_n = 0
2962         server2_n = 0
2963         server3_n = 0
2964         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2965         pkts = []
2966         for client in clients:
2967             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2968                  IP(src=client, dst=self.nat_addr) /
2969                  TCP(sport=12346, dport=external_port))
2970             pkts.append(p)
2971         self.assertGreater(len(pkts), 0)
2972         self.pg1.add_stream(pkts)
2973         self.pg_enable_capture(self.pg_interfaces)
2974         self.pg_start()
2975         capture = self.pg0.get_capture(len(pkts))
2976         for p in capture:
2977             if p[IP].dst == server1.ip4:
2978                 server1_n += 1
2979             elif p[IP].dst == server2.ip4:
2980                 server2_n += 1
2981             else:
2982                 server3_n += 1
2983         self.assertGreater(server1_n, 0)
2984         self.assertGreater(server2_n, 0)
2985         self.assertGreater(server3_n, 0)
2986
2987         local = {
2988             'addr': server2.ip4,
2989             'port': local_port,
2990             'probability': 10,
2991             'vrf_id': 0
2992         }
2993
2994         # remove one back-end
2995         self.vapi.nat44_lb_static_mapping_add_del_local(
2996             is_add=0,
2997             external_addr=external_addr,
2998             external_port=external_port,
2999             local=local,
3000             protocol=IP_PROTOS.tcp)
3001         server1_n = 0
3002         server2_n = 0
3003         server3_n = 0
3004         self.pg1.add_stream(pkts)
3005         self.pg_enable_capture(self.pg_interfaces)
3006         self.pg_start()
3007         capture = self.pg0.get_capture(len(pkts))
3008         for p in capture:
3009             if p[IP].dst == server1.ip4:
3010                 server1_n += 1
3011             elif p[IP].dst == server2.ip4:
3012                 server2_n += 1
3013             else:
3014                 server3_n += 1
3015         self.assertGreater(server1_n, 0)
3016         self.assertEqual(server2_n, 0)
3017         self.assertGreater(server3_n, 0)
3018
3019     def test_syslog_sess(self):
3020         """ NAT44ED Test syslog session creation and deletion """
3021         self.vapi.syslog_set_filter(
3022             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3023         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3024
3025         self.nat_add_address(self.nat_addr)
3026         self.nat_add_inside_interface(self.pg0)
3027         self.nat_add_outside_interface(self.pg1)
3028
3029         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3030              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3031              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3032         self.pg0.add_stream(p)
3033         self.pg_enable_capture(self.pg_interfaces)
3034         self.pg_start()
3035         capture = self.pg1.get_capture(1)
3036         self.tcp_port_out = capture[0][TCP].sport
3037         capture = self.pg3.get_capture(1)
3038         self.verify_syslog_sess(capture[0][Raw].load)
3039
3040         self.pg_enable_capture(self.pg_interfaces)
3041         self.pg_start()
3042         self.nat_add_address(self.nat_addr, is_add=0)
3043         capture = self.pg3.get_capture(1)
3044         self.verify_syslog_sess(capture[0][Raw].load, False)
3045
3046     def test_twice_nat_interface_addr(self):
3047         """ NAT44ED Acquire twice NAT addresses from interface """
3048         flags = self.config_flags.NAT_IS_TWICE_NAT
3049         self.vapi.nat44_add_del_interface_addr(
3050             sw_if_index=self.pg11.sw_if_index,
3051             flags=flags, is_add=1)
3052
3053         # no address in NAT pool
3054         adresses = self.vapi.nat44_address_dump()
3055         self.assertEqual(0, len(adresses))
3056
3057         # configure interface address and check NAT address pool
3058         self.pg11.config_ip4()
3059         adresses = self.vapi.nat44_address_dump()
3060         self.assertEqual(1, len(adresses))
3061         self.assertEqual(str(adresses[0].ip_address),
3062                          self.pg11.local_ip4)
3063         self.assertEqual(adresses[0].flags, flags)
3064
3065         # remove interface address and check NAT address pool
3066         self.pg11.unconfig_ip4()
3067         adresses = self.vapi.nat44_address_dump()
3068         self.assertEqual(0, len(adresses))
3069
3070     def test_output_feature_stateful_acl(self):
3071         """ NAT44ED output feature works with stateful ACL """
3072
3073         self.nat_add_address(self.nat_addr)
3074         self.vapi.nat44_interface_add_del_output_feature(
3075             sw_if_index=self.pg1.sw_if_index, is_add=1)
3076
3077         # First ensure that the NAT is working sans ACL
3078
3079         # send packets out2in, no sessions yet so packets should drop
3080         pkts_out2in = self.create_stream_out(self.pg1)
3081         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3082
3083         # send packets into inside intf, ensure received via outside intf
3084         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3085         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3086                                        len(pkts_in2out))
3087         self.verify_capture_out(capture, ignore_port=True)
3088
3089         # send out2in again, with sessions created it should work now
3090         pkts_out2in = self.create_stream_out(self.pg1)
3091         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3092                                        len(pkts_out2in))
3093         self.verify_capture_in(capture, self.pg0)
3094
3095         # Create an ACL blocking everything
3096         out2in_deny_rule = AclRule(is_permit=0)
3097         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3098         out2in_acl.add_vpp_config()
3099
3100         # create an ACL to permit/reflect everything
3101         in2out_reflect_rule = AclRule(is_permit=2)
3102         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3103         in2out_acl.add_vpp_config()
3104
3105         # apply as input acl on interface and confirm it blocks everything
3106         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3107                                  n_input=1, acls=[out2in_acl])
3108         acl_if.add_vpp_config()
3109         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3110
3111         # apply output acl
3112         acl_if.acls = [out2in_acl, in2out_acl]
3113         acl_if.add_vpp_config()
3114         # send in2out to generate ACL state (NAT state was created earlier)
3115         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3116                                        len(pkts_in2out))
3117         self.verify_capture_out(capture, ignore_port=True)
3118
3119         # send out2in again. ACL state exists so it should work now.
3120         # TCP packets with the syn flag set also need the ack flag
3121         for p in pkts_out2in:
3122             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3123                 p[TCP].flags |= 0x10
3124         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3125                                        len(pkts_out2in))
3126         self.verify_capture_in(capture, self.pg0)
3127         self.logger.info(self.vapi.cli("show trace"))
3128
3129     def test_tcp_close(self):
3130         """ NAT44ED Close TCP session from inside network - output feature """
3131         old_timeouts = self.vapi.nat_get_timeouts()
3132         new_transitory = 2
3133         self.vapi.nat_set_timeouts(
3134             udp=old_timeouts.udp,
3135             tcp_established=old_timeouts.tcp_established,
3136             icmp=old_timeouts.icmp,
3137             tcp_transitory=new_transitory)
3138
3139         self.vapi.nat44_forwarding_enable_disable(enable=1)
3140         self.nat_add_address(self.pg1.local_ip4)
3141         twice_nat_addr = '10.0.1.3'
3142         service_ip = '192.168.16.150'
3143         self.nat_add_address(twice_nat_addr, twice_nat=1)
3144
3145         flags = self.config_flags.NAT_IS_INSIDE
3146         self.vapi.nat44_interface_add_del_feature(
3147             sw_if_index=self.pg0.sw_if_index,
3148             is_add=1)
3149         self.vapi.nat44_interface_add_del_feature(
3150             sw_if_index=self.pg0.sw_if_index,
3151             flags=flags, is_add=1)
3152         self.vapi.nat44_interface_add_del_output_feature(
3153             is_add=1,
3154             sw_if_index=self.pg1.sw_if_index)
3155
3156         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3157                  self.config_flags.NAT_IS_TWICE_NAT)
3158         self.nat_add_static_mapping(self.pg0.remote_ip4,
3159                                     service_ip, 80, 80,
3160                                     proto=IP_PROTOS.tcp,
3161                                     flags=flags)
3162         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3163         start_sessnum = len(sessions)
3164
3165         # SYN packet out->in
3166         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3167              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3168              TCP(sport=33898, dport=80, flags="S"))
3169         self.pg1.add_stream(p)
3170         self.pg_enable_capture(self.pg_interfaces)
3171         self.pg_start()
3172         capture = self.pg0.get_capture(1)
3173         p = capture[0]
3174         tcp_port = p[TCP].sport
3175
3176         # SYN + ACK packet in->out
3177         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3178              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3179              TCP(sport=80, dport=tcp_port, flags="SA"))
3180         self.pg0.add_stream(p)
3181         self.pg_enable_capture(self.pg_interfaces)
3182         self.pg_start()
3183         self.pg1.get_capture(1)
3184
3185         # ACK packet out->in
3186         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3187              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3188              TCP(sport=33898, dport=80, flags="A"))
3189         self.pg1.add_stream(p)
3190         self.pg_enable_capture(self.pg_interfaces)
3191         self.pg_start()
3192         self.pg0.get_capture(1)
3193
3194         # FIN packet in -> out
3195         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3196              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3197              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3198         self.pg0.add_stream(p)
3199         self.pg_enable_capture(self.pg_interfaces)
3200         self.pg_start()
3201         self.pg1.get_capture(1)
3202
3203         # FIN+ACK packet out -> in
3204         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3205              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3206              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3207         self.pg1.add_stream(p)
3208         self.pg_enable_capture(self.pg_interfaces)
3209         self.pg_start()
3210         self.pg0.get_capture(1)
3211
3212         # ACK packet in -> out
3213         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3214              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3215              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3216         self.pg0.add_stream(p)
3217         self.pg_enable_capture(self.pg_interfaces)
3218         self.pg_start()
3219         self.pg1.get_capture(1)
3220
3221         # session now in transitory timeout
3222         # try SYN packet out->in - should be dropped
3223         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3224              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3225              TCP(sport=33898, dport=80, flags="S"))
3226         self.pg1.add_stream(p)
3227         self.pg_enable_capture(self.pg_interfaces)
3228         self.pg_start()
3229
3230         self.sleep(new_transitory, "wait for transitory timeout")
3231         self.pg0.assert_nothing_captured(0)
3232
3233         # session should still exist
3234         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3235         self.assertEqual(len(sessions) - start_sessnum, 1)
3236
3237         # send FIN+ACK packet out -> in - will cause session to be wiped
3238         # but won't create a new session
3239         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3240              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3241              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3242         self.pg1.add_stream(p)
3243         self.pg_enable_capture(self.pg_interfaces)
3244         self.pg_start()
3245
3246         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3247         self.assertEqual(len(sessions) - start_sessnum, 0)
3248         self.pg0.assert_nothing_captured(0)
3249
3250     def test_tcp_session_close_in(self):
3251         """ NAT44ED Close TCP session from inside network """
3252
3253         in_port = self.tcp_port_in
3254         out_port = 10505
3255         ext_port = self.tcp_external_port
3256
3257         self.nat_add_address(self.nat_addr)
3258         self.nat_add_inside_interface(self.pg0)
3259         self.nat_add_outside_interface(self.pg1)
3260         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3261                                     in_port, out_port, proto=IP_PROTOS.tcp,
3262                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3263
3264         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3265         session_n = len(sessions)
3266
3267         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3268                                    tcp_transitory=2, icmp=5)
3269
3270         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3271
3272         # FIN packet in -> out
3273         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3274              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3275              TCP(sport=in_port, dport=ext_port,
3276                  flags="FA", seq=100, ack=300))
3277         self.pg0.add_stream(p)
3278         self.pg_enable_capture(self.pg_interfaces)
3279         self.pg_start()
3280         self.pg1.get_capture(1)
3281
3282         pkts = []
3283
3284         # ACK packet out -> in
3285         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3286              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3287              TCP(sport=ext_port, dport=out_port,
3288                  flags="A", seq=300, ack=101))
3289         pkts.append(p)
3290
3291         # FIN packet out -> in
3292         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3293              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3294              TCP(sport=ext_port, dport=out_port,
3295                  flags="FA", seq=300, ack=101))
3296         pkts.append(p)
3297
3298         self.pg1.add_stream(pkts)
3299         self.pg_enable_capture(self.pg_interfaces)
3300         self.pg_start()
3301         self.pg0.get_capture(2)
3302
3303         # ACK packet in -> out
3304         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3305              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3306              TCP(sport=in_port, dport=ext_port,
3307                  flags="A", seq=101, ack=301))
3308         self.pg0.add_stream(p)
3309         self.pg_enable_capture(self.pg_interfaces)
3310         self.pg_start()
3311         self.pg1.get_capture(1)
3312
3313         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3314         self.assertEqual(len(sessions) - session_n, 1)
3315
3316         out2in_drops = self.get_err_counter(
3317             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3318         in2out_drops = self.get_err_counter(
3319             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3320
3321         # extra FIN packet out -> in - this should be dropped
3322         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3323              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3324              TCP(sport=ext_port, dport=out_port,
3325                  flags="FA", seq=300, ack=101))
3326
3327         self.pg1.add_stream(p)
3328         self.pg_enable_capture(self.pg_interfaces)
3329         self.pg_start()
3330         self.pg0.assert_nothing_captured()
3331
3332         # extra ACK packet in -> out - this should be dropped
3333         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3334              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3335              TCP(sport=in_port, dport=ext_port,
3336                  flags="A", seq=101, ack=301))
3337         self.pg0.add_stream(p)
3338         self.pg_enable_capture(self.pg_interfaces)
3339         self.pg_start()
3340         self.pg1.assert_nothing_captured()
3341
3342         stats = self.get_err_counter(
3343             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3344         self.assertEqual(stats - out2in_drops, 1)
3345         stats = self.get_err_counter(
3346             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3347         self.assertEqual(stats - in2out_drops, 1)
3348
3349         self.sleep(3)
3350         # extra ACK packet in -> out - this will cause session to be wiped
3351         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3352              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3353              TCP(sport=in_port, dport=ext_port,
3354                  flags="A", seq=101, ack=301))
3355         self.pg0.add_stream(p)
3356         self.pg_enable_capture(self.pg_interfaces)
3357         self.pg_start()
3358         self.pg1.assert_nothing_captured()
3359         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3360         self.assertEqual(len(sessions) - session_n, 0)
3361
3362     def test_tcp_session_close_out(self):
3363         """ NAT44ED Close TCP session from outside network """
3364
3365         in_port = self.tcp_port_in
3366         out_port = 10505
3367         ext_port = self.tcp_external_port
3368
3369         self.nat_add_address(self.nat_addr)
3370         self.nat_add_inside_interface(self.pg0)
3371         self.nat_add_outside_interface(self.pg1)
3372         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3373                                     in_port, out_port, proto=IP_PROTOS.tcp,
3374                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3375
3376         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3377         session_n = len(sessions)
3378
3379         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3380                                    tcp_transitory=2, icmp=5)
3381
3382         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3383
3384         # FIN packet out -> in
3385         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3386              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3387              TCP(sport=ext_port, dport=out_port,
3388                  flags="FA", seq=100, ack=300))
3389         self.pg1.add_stream(p)
3390         self.pg_enable_capture(self.pg_interfaces)
3391         self.pg_start()
3392         self.pg0.get_capture(1)
3393
3394         # FIN+ACK packet in -> out
3395         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3396              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3397              TCP(sport=in_port, dport=ext_port,
3398                  flags="FA", seq=300, ack=101))
3399
3400         self.pg0.add_stream(p)
3401         self.pg_enable_capture(self.pg_interfaces)
3402         self.pg_start()
3403         self.pg1.get_capture(1)
3404
3405         # ACK packet out -> in
3406         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3407              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3408              TCP(sport=ext_port, dport=out_port,
3409                  flags="A", seq=101, ack=301))
3410         self.pg1.add_stream(p)
3411         self.pg_enable_capture(self.pg_interfaces)
3412         self.pg_start()
3413         self.pg0.get_capture(1)
3414
3415         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3416         self.assertEqual(len(sessions) - session_n, 1)
3417
3418         out2in_drops = self.get_err_counter(
3419             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3420         in2out_drops = self.get_err_counter(
3421             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3422
3423         # extra FIN packet out -> in - this should be dropped
3424         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3425              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3426              TCP(sport=ext_port, dport=out_port,
3427                  flags="FA", seq=300, ack=101))
3428
3429         self.pg1.add_stream(p)
3430         self.pg_enable_capture(self.pg_interfaces)
3431         self.pg_start()
3432         self.pg0.assert_nothing_captured()
3433
3434         # extra ACK packet in -> out - this should be dropped
3435         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3436              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3437              TCP(sport=in_port, dport=ext_port,
3438                  flags="A", seq=101, ack=301))
3439         self.pg0.add_stream(p)
3440         self.pg_enable_capture(self.pg_interfaces)
3441         self.pg_start()
3442         self.pg1.assert_nothing_captured()
3443
3444         stats = self.get_err_counter(
3445             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3446         self.assertEqual(stats - out2in_drops, 1)
3447         stats = self.get_err_counter(
3448             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3449         self.assertEqual(stats - in2out_drops, 1)
3450
3451         self.sleep(3)
3452         # extra ACK packet in -> out - this will cause session to be wiped
3453         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3454              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3455              TCP(sport=in_port, dport=ext_port,
3456                  flags="A", seq=101, ack=301))
3457         self.pg0.add_stream(p)
3458         self.pg_enable_capture(self.pg_interfaces)
3459         self.pg_start()
3460         self.pg1.assert_nothing_captured()
3461         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3462         self.assertEqual(len(sessions) - session_n, 0)
3463
3464     def test_tcp_session_close_simultaneous(self):
3465         """ NAT44ED Close TCP session from inside network """
3466
3467         in_port = self.tcp_port_in
3468         ext_port = 10505
3469
3470         self.nat_add_address(self.nat_addr)
3471         self.nat_add_inside_interface(self.pg0)
3472         self.nat_add_outside_interface(self.pg1)
3473         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3474                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3475                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3476
3477         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3478         session_n = len(sessions)
3479
3480         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3481                                    tcp_transitory=2, icmp=5)
3482
3483         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3484
3485         # FIN packet in -> out
3486         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3487              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3488              TCP(sport=in_port, dport=ext_port,
3489                  flags="FA", seq=100, ack=300))
3490         self.pg0.add_stream(p)
3491         self.pg_enable_capture(self.pg_interfaces)
3492         self.pg_start()
3493         self.pg1.get_capture(1)
3494
3495         # FIN packet out -> in
3496         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3497              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3498              TCP(sport=ext_port, dport=out_port,
3499                  flags="FA", seq=300, ack=100))
3500         self.pg1.add_stream(p)
3501         self.pg_enable_capture(self.pg_interfaces)
3502         self.pg_start()
3503         self.pg0.get_capture(1)
3504
3505         # ACK packet in -> out
3506         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3507              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3508              TCP(sport=in_port, dport=ext_port,
3509                  flags="A", seq=101, ack=301))
3510         self.pg0.add_stream(p)
3511         self.pg_enable_capture(self.pg_interfaces)
3512         self.pg_start()
3513         self.pg1.get_capture(1)
3514
3515         # ACK packet out -> in
3516         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3517              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3518              TCP(sport=ext_port, dport=out_port,
3519                  flags="A", seq=301, ack=101))
3520         self.pg1.add_stream(p)
3521         self.pg_enable_capture(self.pg_interfaces)
3522         self.pg_start()
3523         self.pg0.get_capture(1)
3524
3525         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3526         self.assertEqual(len(sessions) - session_n, 1)
3527
3528         out2in_drops = self.get_err_counter(
3529             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3530         in2out_drops = self.get_err_counter(
3531             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3532
3533         # extra FIN packet out -> in - this should be dropped
3534         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3535              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3536              TCP(sport=ext_port, dport=out_port,
3537                  flags="FA", seq=300, ack=101))
3538
3539         self.pg1.add_stream(p)
3540         self.pg_enable_capture(self.pg_interfaces)
3541         self.pg_start()
3542         self.pg0.assert_nothing_captured()
3543
3544         # extra ACK packet in -> out - this should be dropped
3545         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3546              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3547              TCP(sport=in_port, dport=ext_port,
3548                  flags="A", seq=101, ack=301))
3549         self.pg0.add_stream(p)
3550         self.pg_enable_capture(self.pg_interfaces)
3551         self.pg_start()
3552         self.pg1.assert_nothing_captured()
3553
3554         stats = self.get_err_counter(
3555             '/err/nat44-ed-out2in/drops due to TCP in transitory timeout')
3556         self.assertEqual(stats - out2in_drops, 1)
3557         stats = self.get_err_counter(
3558             '/err/nat44-ed-in2out/drops due to TCP in transitory timeout')
3559         self.assertEqual(stats - in2out_drops, 1)
3560
3561         self.sleep(3)
3562         # extra ACK packet in -> out - this will cause session to be wiped
3563         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3564              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3565              TCP(sport=in_port, dport=ext_port,
3566                  flags="A", seq=101, ack=301))
3567         self.pg0.add_stream(p)
3568         self.pg_enable_capture(self.pg_interfaces)
3569         self.pg_start()
3570         self.pg1.assert_nothing_captured()
3571         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3572         self.assertEqual(len(sessions) - session_n, 0)
3573
3574     def test_dynamic_vrf(self):
3575         """ NAT44ED dynamic translation test: different VRF"""
3576
3577         vrf_id_in = 33
3578         vrf_id_out = 34
3579
3580         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3581
3582         try:
3583             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3584             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3585
3586             self.nat_add_inside_interface(self.pg7)
3587             self.nat_add_outside_interface(self.pg8)
3588
3589             # just basic stuff nothing special
3590             pkts = self.create_stream_in(self.pg7, self.pg8)
3591             self.pg7.add_stream(pkts)
3592             self.pg_enable_capture(self.pg_interfaces)
3593             self.pg_start()
3594             capture = self.pg8.get_capture(len(pkts))
3595             self.verify_capture_out(capture, ignore_port=True)
3596
3597             pkts = self.create_stream_out(self.pg8)
3598             self.pg8.add_stream(pkts)
3599             self.pg_enable_capture(self.pg_interfaces)
3600             self.pg_start()
3601             capture = self.pg7.get_capture(len(pkts))
3602             self.verify_capture_in(capture, self.pg7)
3603
3604         finally:
3605             self.pg7.unconfig()
3606             self.pg8.unconfig()
3607
3608             self.vapi.ip_table_add_del(is_add=0,
3609                                        table={'table_id': vrf_id_in})
3610             self.vapi.ip_table_add_del(is_add=0,
3611                                        table={'table_id': vrf_id_out})
3612
3613     def test_dynamic_output_feature_vrf(self):
3614         """ NAT44ED dynamic translation test: output-feature, VRF"""
3615
3616         # other then default (0)
3617         new_vrf_id = 22
3618
3619         self.nat_add_address(self.nat_addr)
3620         self.vapi.nat44_interface_add_del_output_feature(
3621             sw_if_index=self.pg8.sw_if_index, is_add=1)
3622
3623         try:
3624             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3625             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3626
3627             # in2out
3628             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3629             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3630             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3631             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3632
3633             pkts = self.create_stream_in(self.pg7, self.pg8)
3634             self.pg7.add_stream(pkts)
3635             self.pg_enable_capture(self.pg_interfaces)
3636             self.pg_start()
3637             capture = self.pg8.get_capture(len(pkts))
3638             self.verify_capture_out(capture, ignore_port=True)
3639
3640             if_idx = self.pg7.sw_if_index
3641             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3642             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3643             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3644             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3645             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3646             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3647             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3648             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3649
3650             # out2in
3651             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3652             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3653             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3654             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3655
3656             pkts = self.create_stream_out(self.pg8)
3657             self.pg8.add_stream(pkts)
3658             self.pg_enable_capture(self.pg_interfaces)
3659             self.pg_start()
3660             capture = self.pg7.get_capture(len(pkts))
3661             self.verify_capture_in(capture, self.pg7)
3662
3663             if_idx = self.pg8.sw_if_index
3664             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3665             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3666             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3667             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3668             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3669             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3670             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3671             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3672
3673             sessions = self.statistics['/nat44-ed/total-sessions']
3674             self.assertEqual(sessions[:, 0].sum(), 3)
3675
3676         finally:
3677             self.pg7.unconfig()
3678             self.pg8.unconfig()
3679
3680             self.vapi.ip_table_add_del(is_add=0,
3681                                        table={'table_id': new_vrf_id})
3682
3683     def test_next_src_nat(self):
3684         """ NAT44ED On way back forward packet to nat44-in2out node. """
3685
3686         twice_nat_addr = '10.0.1.3'
3687         external_port = 80
3688         local_port = 8080
3689         post_twice_nat_port = 0
3690
3691         self.vapi.nat44_forwarding_enable_disable(enable=1)
3692         self.nat_add_address(twice_nat_addr, twice_nat=1)
3693         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3694                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3695         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3696                                     local_port, external_port,
3697                                     proto=IP_PROTOS.tcp, vrf_id=1,
3698                                     flags=flags)
3699         self.vapi.nat44_interface_add_del_feature(
3700             sw_if_index=self.pg6.sw_if_index,
3701             is_add=1)
3702
3703         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3704              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3705              TCP(sport=12345, dport=external_port))
3706         self.pg6.add_stream(p)
3707         self.pg_enable_capture(self.pg_interfaces)
3708         self.pg_start()
3709         capture = self.pg6.get_capture(1)
3710         p = capture[0]
3711         try:
3712             ip = p[IP]
3713             tcp = p[TCP]
3714             self.assertEqual(ip.src, twice_nat_addr)
3715             self.assertNotEqual(tcp.sport, 12345)
3716             post_twice_nat_port = tcp.sport
3717             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3718             self.assertEqual(tcp.dport, local_port)
3719             self.assert_packet_checksums_valid(p)
3720         except:
3721             self.logger.error(ppp("Unexpected or invalid packet:", p))
3722             raise
3723
3724         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3725              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3726              TCP(sport=local_port, dport=post_twice_nat_port))
3727         self.pg6.add_stream(p)
3728         self.pg_enable_capture(self.pg_interfaces)
3729         self.pg_start()
3730         capture = self.pg6.get_capture(1)
3731         p = capture[0]
3732         try:
3733             ip = p[IP]
3734             tcp = p[TCP]
3735             self.assertEqual(ip.src, self.pg1.remote_ip4)
3736             self.assertEqual(tcp.sport, external_port)
3737             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3738             self.assertEqual(tcp.dport, 12345)
3739             self.assert_packet_checksums_valid(p)
3740         except:
3741             self.logger.error(ppp("Unexpected or invalid packet:", p))
3742             raise
3743
3744     def test_one_armed_nat44_static(self):
3745         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3746
3747         remote_host = self.pg4.remote_hosts[0]
3748         local_host = self.pg4.remote_hosts[1]
3749         external_port = 80
3750         local_port = 8080
3751         eh_port_in = 0
3752
3753         self.vapi.nat44_forwarding_enable_disable(enable=1)
3754         self.nat_add_address(self.nat_addr, twice_nat=1)
3755         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3756                  self.config_flags.NAT_IS_TWICE_NAT)
3757         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3758                                     local_port, external_port,
3759                                     proto=IP_PROTOS.tcp, flags=flags)
3760         flags = self.config_flags.NAT_IS_INSIDE
3761         self.vapi.nat44_interface_add_del_feature(
3762             sw_if_index=self.pg4.sw_if_index,
3763             is_add=1)
3764         self.vapi.nat44_interface_add_del_feature(
3765             sw_if_index=self.pg4.sw_if_index,
3766             flags=flags, is_add=1)
3767
3768         # from client to service
3769         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3770              IP(src=remote_host.ip4, dst=self.nat_addr) /
3771              TCP(sport=12345, dport=external_port))
3772         self.pg4.add_stream(p)
3773         self.pg_enable_capture(self.pg_interfaces)
3774         self.pg_start()
3775         capture = self.pg4.get_capture(1)
3776         p = capture[0]
3777         try:
3778             ip = p[IP]
3779             tcp = p[TCP]
3780             self.assertEqual(ip.dst, local_host.ip4)
3781             self.assertEqual(ip.src, self.nat_addr)
3782             self.assertEqual(tcp.dport, local_port)
3783             self.assertNotEqual(tcp.sport, 12345)
3784             eh_port_in = tcp.sport
3785             self.assert_packet_checksums_valid(p)
3786         except:
3787             self.logger.error(ppp("Unexpected or invalid packet:", p))
3788             raise
3789
3790         # from service back to client
3791         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3792              IP(src=local_host.ip4, dst=self.nat_addr) /
3793              TCP(sport=local_port, dport=eh_port_in))
3794         self.pg4.add_stream(p)
3795         self.pg_enable_capture(self.pg_interfaces)
3796         self.pg_start()
3797         capture = self.pg4.get_capture(1)
3798         p = capture[0]
3799         try:
3800             ip = p[IP]
3801             tcp = p[TCP]
3802             self.assertEqual(ip.src, self.nat_addr)
3803             self.assertEqual(ip.dst, remote_host.ip4)
3804             self.assertEqual(tcp.sport, external_port)
3805             self.assertEqual(tcp.dport, 12345)
3806             self.assert_packet_checksums_valid(p)
3807         except:
3808             self.logger.error(ppp("Unexpected or invalid packet:", p))
3809             raise
3810
3811
3812 if __name__ == '__main__':
3813     unittest.main(testRunner=VppTestRunner)