X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=test%2Ftest_nat44_ed.py;h=ee76ce845c686f8028d663dce775500b3b6bfbd8;hb=05b5a5b3b4b04823776feed6403b5a99b2e06d76;hp=2ce7f23dac90a027584ad3eeffd8864997cef27e;hpb=eddd8e3588561039985b27edf059db6033bfdfab;p=vpp.git diff --git a/test/test_nat44_ed.py b/test/test_nat44_ed.py index 2ce7f23dac9..ee76ce845c6 100644 --- a/test/test_nat44_ed.py +++ b/test/test_nat44_ed.py @@ -914,6 +914,41 @@ class NAT44EDTestCase(VppTestCase): class TestNAT44ED(NAT44EDTestCase): """ NAT44ED Test Case """ + def test_icmp_error(self): + """ NAT44ED test ICMP error message with inner header""" + + payload = "H" * 10 + + self.nat_add_address(self.nat_addr) + self.nat_add_inside_interface(self.pg0) + self.nat_add_outside_interface(self.pg1) + + # in2out (initiate connection) + p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / + IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) / + UDP(sport=21, dport=20) / payload) + + self.pg0.add_stream(p1) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(1)[0] + + # out2in (send error message) + p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) / + IP(src=self.pg1.remote_ip4, dst=self.nat_addr) / + ICMP(type='dest-unreach', code='port-unreachable') / + capture[IP:]) + + self.pg1.add_stream(p2) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + + capture = self.pg0.get_capture(1)[0] + + self.logger.info(ppp("p1 packet:", p1)) + self.logger.info(ppp("p2 packet:", p2)) + self.logger.info(ppp("capture packet:", capture)) + def test_users_dump(self): """ NAT44ED API test - nat44_user_dump """ @@ -1180,6 +1215,7 @@ class TestNAT44ED(NAT44EDTestCase): self.pg_start() capture = self.pg1.get_capture(len(pkts)) self.verify_capture_out(capture, ignore_port=True) + self.logger.debug(self.vapi.cli("show trace")) # out2in pkts = self.create_stream_out(self.pg1) @@ -1188,6 +1224,35 @@ class TestNAT44ED(NAT44EDTestCase): self.pg_start() capture = self.pg0.get_capture(len(pkts)) self.verify_capture_in(capture, self.pg0) + self.logger.debug(self.vapi.cli("show trace")) + + # in2out + pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2) + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg1.get_capture(len(pkts)) + self.verify_capture_out(capture, ignore_port=True) + self.logger.debug(self.vapi.cli("show trace")) + + # out2in + pkts = self.create_stream_out(self.pg1, ttl=2) + self.pg1.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg0.get_capture(len(pkts)) + self.verify_capture_in(capture, self.pg0) + self.logger.debug(self.vapi.cli("show trace")) + + # in2out + pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1) + self.pg0.add_stream(pkts) + self.pg_enable_capture(self.pg_interfaces) + self.pg_start() + capture = self.pg0.get_capture(len(pkts)) + for p in capture: + self.assertIn(ICMP, p) + self.assertEqual(p[ICMP].type, 11) # 11 == time-exceeded def test_static_with_port_out2(self): """ NAT44ED 1:1 NAPT asymmetrical rule """ @@ -1590,26 +1655,15 @@ class TestNAT44ED(NAT44EDTestCase): for p in capture: self.assertEqual(p[IP].dst, backend) - def test_multiple_vrf(self): - """ NAT44ED Multiple VRF setup """ + def test_multiple_vrf_1(self): + """ Multiple VRF - both client & service in VRF1 """ external_addr = '1.2.3.4' external_port = 80 local_port = 8080 port = 0 - self.vapi.nat44_forwarding_enable_disable(enable=1) - self.nat_add_address(self.nat_addr) flags = self.config_flags.NAT_IS_INSIDE - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - is_add=1) - self.vapi.nat44_interface_add_del_feature( - sw_if_index=self.pg0.sw_if_index, - is_add=1, flags=flags) - self.vapi.nat44_interface_add_del_output_feature( - sw_if_index=self.pg1.sw_if_index, - is_add=1) self.vapi.nat44_interface_add_del_feature( sw_if_index=self.pg5.sw_if_index, is_add=1) @@ -1623,17 +1677,7 @@ class TestNAT44ED(NAT44EDTestCase): self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr, local_port, external_port, vrf_id=1, proto=IP_PROTOS.tcp, flags=flags) - self.nat_add_static_mapping( - self.pg0.remote_ip4, - external_sw_if_index=self.pg0.sw_if_index, - local_port=local_port, - vrf_id=0, - external_port=external_port, - proto=IP_PROTOS.tcp, - flags=flags - ) - # from client to service (both VRF1) p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) / IP(src=self.pg6.remote_ip4, dst=external_addr) / TCP(sport=12345, dport=external_port)) @@ -1652,7 +1696,6 @@ class TestNAT44ED(NAT44EDTestCase): self.logger.error(ppp("Unexpected or invalid packet:", p)) raise - # from service back to client (both VRF1) p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) / IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) / TCP(sport=local_port, dport=12345)) @@ -1671,7 +1714,30 @@ class TestNAT44ED(NAT44EDTestCase): self.logger.error(ppp("Unexpected or invalid packet:", p)) raise - # dynamic NAT from VRF1 to VRF0 (output-feature) + def test_multiple_vrf_2(self): + """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """ + + external_addr = '1.2.3.4' + external_port = 80 + local_port = 8080 + port = 0 + + self.nat_add_address(self.nat_addr) + flags = self.config_flags.NAT_IS_INSIDE + self.vapi.nat44_interface_add_del_output_feature( + sw_if_index=self.pg1.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1, flags=flags) + flags = self.config_flags.NAT_IS_OUT2IN_ONLY + self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr, + local_port, external_port, vrf_id=1, + proto=IP_PROTOS.tcp, flags=flags) + p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) / IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) / TCP(sport=2345, dport=22)) @@ -1708,6 +1774,35 @@ class TestNAT44ED(NAT44EDTestCase): self.logger.error(ppp("Unexpected or invalid packet:", p)) raise + def test_multiple_vrf_3(self): + """ Multiple VRF - client in VRF1, service in VRF0 """ + + external_addr = '1.2.3.4' + external_port = 80 + local_port = 8080 + port = 0 + + flags = self.config_flags.NAT_IS_INSIDE + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, flags=flags) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg6.sw_if_index, + is_add=1) + flags = self.config_flags.NAT_IS_OUT2IN_ONLY + self.nat_add_static_mapping( + self.pg0.remote_ip4, + external_sw_if_index=self.pg0.sw_if_index, + local_port=local_port, + vrf_id=0, + external_port=external_port, + proto=IP_PROTOS.tcp, + flags=flags + ) + # from client VRF1 to service VRF0 p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) / IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) / @@ -1746,6 +1841,32 @@ class TestNAT44ED(NAT44EDTestCase): self.logger.error(ppp("Unexpected or invalid packet:", p)) raise + def test_multiple_vrf_4(self): + """ Multiple VRF - client in VRF0, service in VRF1 """ + + external_addr = '1.2.3.4' + external_port = 80 + local_port = 8080 + port = 0 + + flags = self.config_flags.NAT_IS_INSIDE + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, flags=flags) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1, flags=flags) + flags = self.config_flags.NAT_IS_OUT2IN_ONLY + self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr, + local_port, external_port, vrf_id=1, + proto=IP_PROTOS.tcp, flags=flags) + # from client VRF0 to service VRF1 p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) / IP(src=self.pg0.remote_ip4, dst=external_addr) / @@ -1784,6 +1905,45 @@ class TestNAT44ED(NAT44EDTestCase): self.logger.error(ppp("Unexpected or invalid packet:", p)) raise + def test_multiple_vrf_5(self): + """ Multiple VRF - forwarding - no translation """ + + external_addr = '1.2.3.4' + external_port = 80 + local_port = 8080 + port = 0 + + self.vapi.nat44_forwarding_enable_disable(enable=1) + flags = self.config_flags.NAT_IS_INSIDE + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg0.sw_if_index, + is_add=1, flags=flags) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg5.sw_if_index, + is_add=1, flags=flags) + self.vapi.nat44_interface_add_del_feature( + sw_if_index=self.pg6.sw_if_index, + is_add=1) + flags = self.config_flags.NAT_IS_OUT2IN_ONLY + self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr, + local_port, external_port, vrf_id=1, + proto=IP_PROTOS.tcp, flags=flags) + self.nat_add_static_mapping( + self.pg0.remote_ip4, + external_sw_if_index=self.pg0.sw_if_index, + local_port=local_port, + vrf_id=0, + external_port=external_port, + proto=IP_PROTOS.tcp, + flags=flags + ) + # from client to server (both VRF1, no translation) p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) / IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) / @@ -2912,11 +3072,7 @@ class TestNAT44EDMW(TestNAT44ED): self.nat_add_address(self.nat_addr) self.vapi.nat44_interface_add_del_output_feature( - sw_if_index=self.pg0.sw_if_index, - flags=self.config_flags.NAT_IS_INSIDE, is_add=1) - self.vapi.nat44_interface_add_del_output_feature( - sw_if_index=self.pg1.sw_if_index, - flags=self.config_flags.NAT_IS_OUTSIDE, is_add=1) + sw_if_index=self.pg1.sw_if_index, is_add=1) # First ensure that the NAT is working sans ACL @@ -3461,13 +3617,8 @@ class TestNAT44EDMW(TestNAT44ED): new_vrf_id = 22 self.nat_add_address(self.nat_addr) - flags = self.config_flags.NAT_IS_INSIDE self.vapi.nat44_interface_add_del_output_feature( - sw_if_index=self.pg7.sw_if_index, - flags=flags, is_add=1) - self.vapi.nat44_interface_add_del_output_feature( - sw_if_index=self.pg8.sw_if_index, - is_add=1) + sw_if_index=self.pg8.sw_if_index, is_add=1) try: self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)