test/test_nat44_ed_output.py

   1 #!/usr/bin/env python3
   2 """NAT44 ED output-feature tests"""
   3
   4 import random
   5 import unittest
   6 from scapy.layers.inet import ICMP, Ether, IP, TCP
   7 from scapy.packet import Raw
   8 from scapy.data import IP_PROTOS
   9 from framework import VppTestCase, VppTestRunner
  10 from vpp_papi import VppEnum
  11
  12
  13 def get_nat44_ed_in2out_worker_index(ip, vpp_worker_count):
  14     if 0 == vpp_worker_count:
  15         return 0
  16     numeric = socket.inet_aton(ip)
  17     numeric = struct.unpack("!L", numeric)[0]
  18     numeric = socket.htonl(numeric)
  19     h = numeric + (numeric >> 8) + (numeric >> 16) + (numeric >> 24)
  20     return 1 + h % vpp_worker_count
  21
  22
  23 class TestNAT44EDOutput(VppTestCase):
  24     """ NAT44 ED output feature Test Case """
  25     max_sessions = 1024
  26
  27     @classmethod
  28     def setUpClass(cls):
  29         super().setUpClass()
  30         cls.create_pg_interfaces(range(2))
  31         cls.interfaces = list(cls.pg_interfaces)
  32
  33     @classmethod
  34     def tearDownClass(cls):
  35         super().tearDownClass()
  36
  37     def setUp(self):
  38         super().setUp()
  39         for i in self.interfaces:
  40             i.admin_up()
  41             i.config_ip4()
  42             i.resolve_arp()
  43         self.vapi.nat44_ed_plugin_enable_disable(sessions=self.max_sessions,
  44                                                  enable=1)
  45
  46     def tearDown(self):
  47         if not self.vpp_dead:
  48             self.logger.debug(self.vapi.cli("show nat44 sessions"))
  49         super().tearDown()
  50         if not self.vpp_dead:
  51             for i in self.pg_interfaces:
  52                 i.unconfig_ip4()
  53                 i.admin_down()
  54             self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  55
  56     def test_static_dynamic(self):
  57         """ Create static mapping which matches existing dynamic mapping """
  58
  59         old_timeouts = self.vapi.nat_get_timeouts()
  60         new_transitory = 2
  61         self.vapi.nat_set_timeouts(
  62             udp=old_timeouts.udp,
  63             tcp_established=old_timeouts.tcp_established,
  64             icmp=old_timeouts.icmp,
  65             tcp_transitory=new_transitory)
  66
  67         local_host = self.pg0.remote_ip4
  68         remote_host = self.pg1.remote_ip4
  69         nat_intf = self.pg1
  70         outside_addr = nat_intf.local_ip4
  71
  72         self.vapi.nat44_add_del_address_range(first_ip_address=outside_addr,
  73                                               last_ip_address=outside_addr,
  74                                               vrf_id=0xffffffff,
  75                                               is_add=1,
  76                                               flags=0)
  77         self.vapi.nat44_interface_add_del_feature(
  78             sw_if_index=self.pg0.sw_if_index,
  79             is_add=1)
  80         self.vapi.nat44_interface_add_del_feature(
  81             sw_if_index=self.pg0.sw_if_index,
  82             flags=VppEnum.vl_api_nat_config_flags_t.NAT_IS_INSIDE, is_add=1)
  83         self.vapi.nat44_interface_add_del_output_feature(
  84             is_add=1,
  85             sw_if_index=self.pg1.sw_if_index)
  86
  87         thread_index = get_nat44_ed_in2out_worker_index(
  88             local_host, self.vpp_worker_count)
  89         port_per_thread = int((0xffff-1024) / max(1, self.vpp_worker_count))
  90         local_sport = 1024 + random.randint(1, port_per_thread)
  91         if self.vpp_worker_count > 0:
  92             local_sport += port_per_thread * (thread_index - 1)
  93
  94         remote_dport = 10000
  95
  96         pg0 = self.pg0
  97         pg1 = self.pg1
  98
  99         # first setup a dynamic TCP session
 100
 101         # SYN packet in->out
 102         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 103              IP(src=local_host, dst=remote_host) /
 104              TCP(sport=local_sport, dport=remote_dport, flags="S"))
 105         p = self.send_and_expect(pg0, [p], pg1)[0]
 106
 107         self.assertEqual(p[IP].src, outside_addr)
 108         self.assertEqual(p[TCP].sport, local_sport)
 109         outside_port = p[TCP].sport
 110
 111         # SYN+ACK packet out->in
 112         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 113              IP(src=remote_host, dst=outside_addr) /
 114              TCP(sport=remote_dport, dport=outside_port, flags="SA"))
 115         self.send_and_expect(pg1, [p], pg0)
 116
 117         # ACK packet in->out
 118         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 119              IP(src=local_host, dst=remote_host) /
 120              TCP(sport=local_sport, dport=remote_dport, flags="A"))
 121         self.send_and_expect(pg0, [p], pg1)
 122
 123         # now we have a session up, create a conflicting static mapping
 124         self.vapi.nat44_add_del_static_mapping(
 125             is_add=1,
 126             local_ip_address=local_host,
 127             external_ip_address=outside_addr,
 128             external_sw_if_index=0xffffffff,
 129             local_port=local_sport,
 130             external_port=outside_port,
 131             protocol=IP_PROTOS.tcp,
 132             flags=VppEnum.vl_api_nat_config_flags_t.NAT_IS_OUT2IN_ONLY)
 133
 134         sessions = self.vapi.nat44_user_session_dump(local_host, 0)
 135         self.assertEqual(1, len(sessions))
 136
 137         # now send some more data over existing session - it should pass
 138
 139         # in->out
 140         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 141              IP(src=local_host, dst=remote_host) /
 142              TCP(sport=local_sport, dport=remote_dport) /
 143              Raw("zippity zap"))
 144         self.send_and_expect(pg0, [p], pg1)
 145
 146         # out->in
 147         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 148              IP(src=remote_host, dst=outside_addr) /
 149              TCP(sport=remote_dport, dport=outside_port) /
 150              Raw("flippity flop"))
 151         self.send_and_expect(pg1, [p], pg0)
 152
 153         # now close the session
 154
 155         # FIN packet in -> out
 156         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 157              IP(src=local_host, dst=remote_host) /
 158              TCP(sport=local_sport, dport=remote_dport, flags="FA", seq=100,
 159                  ack=300))
 160         self.send_and_expect(pg0, [p], pg1)
 161
 162         # FIN+ACK packet out -> in
 163         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 164              IP(src=remote_host, dst=outside_addr) /
 165              TCP(sport=remote_dport, dport=outside_port, flags="FA", seq=300,
 166                  ack=101))
 167         self.send_and_expect(pg1, [p], pg0)
 168
 169         # ACK packet in -> out
 170         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 171              IP(src=local_host, dst=remote_host) /
 172              TCP(sport=local_sport, dport=remote_dport, flags="A", seq=101,
 173                  ack=301))
 174         self.send_and_expect(pg0, [p], pg1)
 175
 176         # session now in transitory timeout
 177         # try SYN packet in->out - should be dropped
 178         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 179              IP(src=local_host, dst=remote_host) /
 180              TCP(sport=local_sport, dport=remote_dport, flags="S"))
 181         pg0.add_stream(p)
 182         self.pg_enable_capture()
 183         self.pg_start()
 184
 185         self.sleep(new_transitory, "wait for transitory timeout")
 186         pg0.assert_nothing_captured(0)
 187
 188         # session should still exist
 189         sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
 190         self.assertEqual(1, len(sessions))
 191
 192         # send FIN+ACK packet in->out - will cause session to be wiped
 193         # but won't create a new session
 194         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 195              IP(src=local_host, dst=remote_host) /
 196              TCP(sport=local_sport, dport=remote_dport, flags="FA", seq=300,
 197                  ack=101))
 198         pg1.add_stream(p)
 199         self.pg_enable_capture()
 200         self.pg_start()
 201         pg0.assert_nothing_captured(0)
 202
 203         sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
 204         self.assertEqual(0, len(sessions))
 205
 206         # create a new session and make sure the outside port is remapped
 207         # SYN packet in->out
 208
 209         p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
 210              IP(src=local_host, dst=remote_host) /
 211              TCP(sport=local_sport, dport=remote_dport, flags="S"))
 212         p = self.send_and_expect(pg0, [p], pg1)[0]
 213
 214         self.assertEqual(p[IP].src, outside_addr)
 215         self.assertNotEqual(p[TCP].sport, local_sport)
 216
 217         # make sure static mapping works and creates a new session
 218         # SYN packet out->in
 219         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 220              IP(src=remote_host, dst=outside_addr) /
 221              TCP(sport=remote_dport, dport=outside_port, flags="S"))
 222         self.send_and_expect(pg1, [p], pg0)
 223
 224         sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
 225         self.assertEqual(2, len(sessions))
 226
 227
 228 if __name__ == '__main__':
 229     unittest.main(testRunner=VppTestRunner)