test/test_nat44_ed.py

   1 #!/usr/bin/env python3
   2
   3 import unittest
   4 from io import BytesIO
   5 from random import randint, shuffle, choice
   6
   7 import scapy.compat
   8 from framework import VppTestCase, VppTestRunner
   9 from scapy.data import IP_PROTOS
  10 from scapy.layers.inet import IP, TCP, UDP, ICMP, GRE
  11 from scapy.layers.inet import IPerror, TCPerror
  12 from scapy.layers.l2 import Ether
  13 from scapy.packet import Raw
  14 from syslog_rfc5424_parser import SyslogMessage, ParseError
  15 from syslog_rfc5424_parser.constants import SyslogSeverity
  16 from util import ppp, ip4_range
  17 from vpp_acl import AclRule, VppAcl, VppAclInterface
  18 from vpp_ip_route import VppIpRoute, VppRoutePath
  19 from vpp_papi import VppEnum
  20
  21
  22 class TestNAT44ED(VppTestCase):
  23     """ NAT44ED Test Case """
  24
  25     nat_addr = '10.0.10.3'
  26
  27     tcp_port_in = 6303
  28     tcp_port_out = 6303
  29
  30     udp_port_in = 6304
  31     udp_port_out = 6304
  32
  33     icmp_id_in = 6305
  34     icmp_id_out = 6305
  35
  36     tcp_external_port = 80
  37
  38     max_sessions = 100
  39
  40     def setUp(self):
  41         super().setUp()
  42         self.plugin_enable()
  43
  44     def tearDown(self):
  45         super().tearDown()
  46         if not self.vpp_dead:
  47             self.plugin_disable()
  48
  49     def plugin_enable(self):
  50         self.vapi.nat44_ed_plugin_enable_disable(
  51             sessions=self.max_sessions, enable=1)
  52
  53     def plugin_disable(self):
  54         self.vapi.nat44_ed_plugin_enable_disable(enable=0)
  55
  56     @property
  57     def config_flags(self):
  58         return VppEnum.vl_api_nat_config_flags_t
  59
  60     @property
  61     def nat44_config_flags(self):
  62         return VppEnum.vl_api_nat44_config_flags_t
  63
  64     @property
  65     def syslog_severity(self):
  66         return VppEnum.vl_api_syslog_severity_t
  67
  68     @property
  69     def server_addr(self):
  70         return self.pg1.remote_hosts[0].ip4
  71
  72     @staticmethod
  73     def random_port():
  74         return randint(1025, 65535)
  75
  76     @staticmethod
  77     def proto2layer(proto):
  78         if proto == IP_PROTOS.tcp:
  79             return TCP
  80         elif proto == IP_PROTOS.udp:
  81             return UDP
  82         elif proto == IP_PROTOS.icmp:
  83             return ICMP
  84         else:
  85             raise Exception("Unsupported protocol")
  86
  87     @classmethod
  88     def create_and_add_ip4_table(cls, i, table_id=0):
  89         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': table_id})
  90         i.set_table_ip4(table_id)
  91
  92     @classmethod
  93     def configure_ip4_interface(cls, i, hosts=0, table_id=None):
  94         if table_id:
  95             cls.create_and_add_ip4_table(i, table_id)
  96
  97         i.admin_up()
  98         i.config_ip4()
  99         i.resolve_arp()
 100
 101         if hosts:
 102             i.generate_remote_hosts(hosts)
 103             i.configure_ipv4_neighbors()
 104
 105     @classmethod
 106     def nat_add_interface_address(cls, i):
 107         cls.vapi.nat44_add_del_interface_addr(
 108             sw_if_index=i.sw_if_index, is_add=1)
 109
 110     def nat_add_inside_interface(self, i):
 111         self.vapi.nat44_interface_add_del_feature(
 112             flags=self.config_flags.NAT_IS_INSIDE,
 113             sw_if_index=i.sw_if_index, is_add=1)
 114
 115     def nat_add_outside_interface(self, i):
 116         self.vapi.nat44_interface_add_del_feature(
 117             flags=self.config_flags.NAT_IS_OUTSIDE,
 118             sw_if_index=i.sw_if_index, is_add=1)
 119
 120     def nat_add_address(self, address, twice_nat=0,
 121                         vrf_id=0xFFFFFFFF, is_add=1):
 122         flags = self.config_flags.NAT_IS_TWICE_NAT if twice_nat else 0
 123         self.vapi.nat44_add_del_address_range(first_ip_address=address,
 124                                               last_ip_address=address,
 125                                               vrf_id=vrf_id,
 126                                               is_add=is_add,
 127                                               flags=flags)
 128
 129     def nat_add_static_mapping(self, local_ip, external_ip='0.0.0.0',
 130                                local_port=0, external_port=0, vrf_id=0,
 131                                is_add=1, external_sw_if_index=0xFFFFFFFF,
 132                                proto=0, tag="", flags=0):
 133
 134         if not (local_port and external_port):
 135             flags |= self.config_flags.NAT_IS_ADDR_ONLY
 136
 137         self.vapi.nat44_add_del_static_mapping(
 138             is_add=is_add,
 139             local_ip_address=local_ip,
 140             external_ip_address=external_ip,
 141             external_sw_if_index=external_sw_if_index,
 142             local_port=local_port,
 143             external_port=external_port,
 144             vrf_id=vrf_id, protocol=proto,
 145             flags=flags,
 146             tag=tag)
 147
 148     @classmethod
 149     def setUpClass(cls):
 150         super().setUpClass()
 151
 152         cls.create_pg_interfaces(range(12))
 153         cls.interfaces = list(cls.pg_interfaces[:4])
 154
 155         cls.create_and_add_ip4_table(cls.pg2, 10)
 156
 157         for i in cls.interfaces:
 158             cls.configure_ip4_interface(i, hosts=3)
 159
 160         # test specific (test-multiple-vrf)
 161         cls.vapi.ip_table_add_del(is_add=1, table={'table_id': 1})
 162
 163         # test specific (test-one-armed-nat44-static)
 164         cls.pg4.generate_remote_hosts(2)
 165         cls.pg4.config_ip4()
 166         cls.vapi.sw_interface_add_del_address(
 167             sw_if_index=cls.pg4.sw_if_index,
 168             prefix="10.0.0.1/24")
 169         cls.pg4.admin_up()
 170         cls.pg4.resolve_arp()
 171         cls.pg4._remote_hosts[1]._ip4 = cls.pg4._remote_hosts[0]._ip4
 172         cls.pg4.resolve_arp()
 173
 174         # test specific interface (pg5)
 175         cls.pg5._local_ip4 = "10.1.1.1"
 176         cls.pg5._remote_hosts[0]._ip4 = "10.1.1.2"
 177         cls.pg5.set_table_ip4(1)
 178         cls.pg5.config_ip4()
 179         cls.pg5.admin_up()
 180         cls.pg5.resolve_arp()
 181
 182         # test specific interface (pg6)
 183         cls.pg6._local_ip4 = "10.1.2.1"
 184         cls.pg6._remote_hosts[0]._ip4 = "10.1.2.2"
 185         cls.pg6.set_table_ip4(1)
 186         cls.pg6.config_ip4()
 187         cls.pg6.admin_up()
 188         cls.pg6.resolve_arp()
 189
 190         rl = list()
 191
 192         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 193                              [VppRoutePath("0.0.0.0", 0xffffffff,
 194                                            nh_table_id=0)],
 195                              register=False, table_id=1))
 196         rl.append(VppIpRoute(cls, "0.0.0.0", 0,
 197                              [VppRoutePath(cls.pg1.local_ip4,
 198                                            cls.pg1.sw_if_index)],
 199                              register=False))
 200         rl.append(VppIpRoute(cls, cls.pg5.remote_ip4, 32,
 201                              [VppRoutePath("0.0.0.0",
 202                                            cls.pg5.sw_if_index)],
 203                              register=False, table_id=1))
 204         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 32,
 205                              [VppRoutePath("0.0.0.0",
 206                                            cls.pg6.sw_if_index)],
 207                              register=False, table_id=1))
 208         rl.append(VppIpRoute(cls, cls.pg6.remote_ip4, 16,
 209                              [VppRoutePath("0.0.0.0", 0xffffffff,
 210                                            nh_table_id=1)],
 211                              register=False, table_id=0))
 212
 213         for r in rl:
 214             r.add_vpp_config()
 215
 216     def get_err_counter(self, path):
 217         return self.statistics.get_err_counter(path)
 218
 219     def reass_hairpinning(self, server_addr, server_in_port, server_out_port,
 220                           host_in_port, proto=IP_PROTOS.tcp,
 221                           ignore_port=False):
 222         layer = self.proto2layer(proto)
 223
 224         if proto == IP_PROTOS.tcp:
 225             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 226         else:
 227             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 228
 229         # send packet from host to server
 230         pkts = self.create_stream_frag(self.pg0,
 231                                        self.nat_addr,
 232                                        host_in_port,
 233                                        server_out_port,
 234                                        data,
 235                                        proto)
 236         self.pg0.add_stream(pkts)
 237         self.pg_enable_capture(self.pg_interfaces)
 238         self.pg_start()
 239         frags = self.pg0.get_capture(len(pkts))
 240         p = self.reass_frags_and_verify(frags,
 241                                         self.nat_addr,
 242                                         server_addr)
 243         if proto != IP_PROTOS.icmp:
 244             if not ignore_port:
 245                 self.assertNotEqual(p[layer].sport, host_in_port)
 246             self.assertEqual(p[layer].dport, server_in_port)
 247         else:
 248             if not ignore_port:
 249                 self.assertNotEqual(p[layer].id, host_in_port)
 250         self.assertEqual(data, p[Raw].load)
 251
 252     def frag_out_of_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 253                           ignore_port=False):
 254         layer = self.proto2layer(proto)
 255
 256         if proto == IP_PROTOS.tcp:
 257             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 258         else:
 259             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 260         self.port_in = self.random_port()
 261
 262         for i in range(2):
 263             # in2out
 264             pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 265                                            self.port_in, 20, data, proto)
 266             pkts.reverse()
 267             self.pg0.add_stream(pkts)
 268             self.pg_enable_capture(self.pg_interfaces)
 269             self.pg_start()
 270             frags = self.pg1.get_capture(len(pkts))
 271             if not dont_translate:
 272                 p = self.reass_frags_and_verify(frags,
 273                                                 self.nat_addr,
 274                                                 self.pg1.remote_ip4)
 275             else:
 276                 p = self.reass_frags_and_verify(frags,
 277                                                 self.pg0.remote_ip4,
 278                                                 self.pg1.remote_ip4)
 279             if proto != IP_PROTOS.icmp:
 280                 if not dont_translate:
 281                     self.assertEqual(p[layer].dport, 20)
 282                     if not ignore_port:
 283                         self.assertNotEqual(p[layer].sport, self.port_in)
 284                 else:
 285                     self.assertEqual(p[layer].sport, self.port_in)
 286             else:
 287                 if not ignore_port:
 288                     if not dont_translate:
 289                         self.assertNotEqual(p[layer].id, self.port_in)
 290                     else:
 291                         self.assertEqual(p[layer].id, self.port_in)
 292             self.assertEqual(data, p[Raw].load)
 293
 294             # out2in
 295             if not dont_translate:
 296                 dst_addr = self.nat_addr
 297             else:
 298                 dst_addr = self.pg0.remote_ip4
 299             if proto != IP_PROTOS.icmp:
 300                 sport = 20
 301                 dport = p[layer].sport
 302             else:
 303                 sport = p[layer].id
 304                 dport = 0
 305             pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport,
 306                                            data, proto, echo_reply=True)
 307             pkts.reverse()
 308             self.pg1.add_stream(pkts)
 309             self.pg_enable_capture(self.pg_interfaces)
 310             self.logger.info(self.vapi.cli("show trace"))
 311             self.pg_start()
 312             frags = self.pg0.get_capture(len(pkts))
 313             p = self.reass_frags_and_verify(frags,
 314                                             self.pg1.remote_ip4,
 315                                             self.pg0.remote_ip4)
 316             if proto != IP_PROTOS.icmp:
 317                 self.assertEqual(p[layer].sport, 20)
 318                 self.assertEqual(p[layer].dport, self.port_in)
 319             else:
 320                 self.assertEqual(p[layer].id, self.port_in)
 321             self.assertEqual(data, p[Raw].load)
 322
 323     def reass_frags_and_verify(self, frags, src, dst):
 324         buffer = BytesIO()
 325         for p in frags:
 326             self.assertEqual(p[IP].src, src)
 327             self.assertEqual(p[IP].dst, dst)
 328             self.assert_ip_checksum_valid(p)
 329             buffer.seek(p[IP].frag * 8)
 330             buffer.write(bytes(p[IP].payload))
 331         ip = IP(src=frags[0][IP].src, dst=frags[0][IP].dst,
 332                 proto=frags[0][IP].proto)
 333         if ip.proto == IP_PROTOS.tcp:
 334             p = (ip / TCP(buffer.getvalue()))
 335             self.logger.debug(ppp("Reassembled:", p))
 336             self.assert_tcp_checksum_valid(p)
 337         elif ip.proto == IP_PROTOS.udp:
 338             p = (ip / UDP(buffer.getvalue()[:8]) /
 339                  Raw(buffer.getvalue()[8:]))
 340         elif ip.proto == IP_PROTOS.icmp:
 341             p = (ip / ICMP(buffer.getvalue()))
 342         return p
 343
 344     def frag_in_order(self, proto=IP_PROTOS.tcp, dont_translate=False,
 345                       ignore_port=False):
 346         layer = self.proto2layer(proto)
 347
 348         if proto == IP_PROTOS.tcp:
 349             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 350         else:
 351             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 352         self.port_in = self.random_port()
 353
 354         # in2out
 355         pkts = self.create_stream_frag(self.pg0, self.pg1.remote_ip4,
 356                                        self.port_in, 20, data, proto)
 357         self.pg0.add_stream(pkts)
 358         self.pg_enable_capture(self.pg_interfaces)
 359         self.pg_start()
 360         frags = self.pg1.get_capture(len(pkts))
 361         if not dont_translate:
 362             p = self.reass_frags_and_verify(frags,
 363                                             self.nat_addr,
 364                                             self.pg1.remote_ip4)
 365         else:
 366             p = self.reass_frags_and_verify(frags,
 367                                             self.pg0.remote_ip4,
 368                                             self.pg1.remote_ip4)
 369         if proto != IP_PROTOS.icmp:
 370             if not dont_translate:
 371                 self.assertEqual(p[layer].dport, 20)
 372                 if not ignore_port:
 373                     self.assertNotEqual(p[layer].sport, self.port_in)
 374             else:
 375                 self.assertEqual(p[layer].sport, self.port_in)
 376         else:
 377             if not ignore_port:
 378                 if not dont_translate:
 379                     self.assertNotEqual(p[layer].id, self.port_in)
 380                 else:
 381                     self.assertEqual(p[layer].id, self.port_in)
 382         self.assertEqual(data, p[Raw].load)
 383
 384         # out2in
 385         if not dont_translate:
 386             dst_addr = self.nat_addr
 387         else:
 388             dst_addr = self.pg0.remote_ip4
 389         if proto != IP_PROTOS.icmp:
 390             sport = 20
 391             dport = p[layer].sport
 392         else:
 393             sport = p[layer].id
 394             dport = 0
 395         pkts = self.create_stream_frag(self.pg1, dst_addr, sport, dport, data,
 396                                        proto, echo_reply=True)
 397         self.pg1.add_stream(pkts)
 398         self.pg_enable_capture(self.pg_interfaces)
 399         self.pg_start()
 400         frags = self.pg0.get_capture(len(pkts))
 401         p = self.reass_frags_and_verify(frags,
 402                                         self.pg1.remote_ip4,
 403                                         self.pg0.remote_ip4)
 404         if proto != IP_PROTOS.icmp:
 405             self.assertEqual(p[layer].sport, 20)
 406             self.assertEqual(p[layer].dport, self.port_in)
 407         else:
 408             self.assertEqual(p[layer].id, self.port_in)
 409         self.assertEqual(data, p[Raw].load)
 410
 411     def verify_capture_out(self, capture, nat_ip=None, same_port=False,
 412                            dst_ip=None, ignore_port=False):
 413         if nat_ip is None:
 414             nat_ip = self.nat_addr
 415         for packet in capture:
 416             try:
 417                 self.assert_packet_checksums_valid(packet)
 418                 self.assertEqual(packet[IP].src, nat_ip)
 419                 if dst_ip is not None:
 420                     self.assertEqual(packet[IP].dst, dst_ip)
 421                 if packet.haslayer(TCP):
 422                     if not ignore_port:
 423                         if same_port:
 424                             self.assertEqual(
 425                                 packet[TCP].sport, self.tcp_port_in)
 426                         else:
 427                             self.assertNotEqual(
 428                                 packet[TCP].sport, self.tcp_port_in)
 429                     self.tcp_port_out = packet[TCP].sport
 430                     self.assert_packet_checksums_valid(packet)
 431                 elif packet.haslayer(UDP):
 432                     if not ignore_port:
 433                         if same_port:
 434                             self.assertEqual(
 435                                 packet[UDP].sport, self.udp_port_in)
 436                         else:
 437                             self.assertNotEqual(
 438                                 packet[UDP].sport, self.udp_port_in)
 439                     self.udp_port_out = packet[UDP].sport
 440                 else:
 441                     if not ignore_port:
 442                         if same_port:
 443                             self.assertEqual(
 444                                 packet[ICMP].id, self.icmp_id_in)
 445                         else:
 446                             self.assertNotEqual(
 447                                 packet[ICMP].id, self.icmp_id_in)
 448                     self.icmp_id_out = packet[ICMP].id
 449                     self.assert_packet_checksums_valid(packet)
 450             except:
 451                 self.logger.error(ppp("Unexpected or invalid packet "
 452                                       "(outside network):", packet))
 453                 raise
 454
 455     def verify_capture_in(self, capture, in_if):
 456         for packet in capture:
 457             try:
 458                 self.assert_packet_checksums_valid(packet)
 459                 self.assertEqual(packet[IP].dst, in_if.remote_ip4)
 460                 if packet.haslayer(TCP):
 461                     self.assertEqual(packet[TCP].dport, self.tcp_port_in)
 462                 elif packet.haslayer(UDP):
 463                     self.assertEqual(packet[UDP].dport, self.udp_port_in)
 464                 else:
 465                     self.assertEqual(packet[ICMP].id, self.icmp_id_in)
 466             except:
 467                 self.logger.error(ppp("Unexpected or invalid packet "
 468                                       "(inside network):", packet))
 469                 raise
 470
 471     def create_stream_in(self, in_if, out_if, dst_ip=None, ttl=64):
 472         if dst_ip is None:
 473             dst_ip = out_if.remote_ip4
 474
 475         pkts = []
 476         # TCP
 477         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 478              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 479              TCP(sport=self.tcp_port_in, dport=20))
 480         pkts.extend([p, p])
 481
 482         # UDP
 483         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 484              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 485              UDP(sport=self.udp_port_in, dport=20))
 486         pkts.append(p)
 487
 488         # ICMP
 489         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 490              IP(src=in_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 491              ICMP(id=self.icmp_id_in, type='echo-request'))
 492         pkts.append(p)
 493
 494         return pkts
 495
 496     def create_stream_out(self, out_if, dst_ip=None, ttl=64,
 497                           use_inside_ports=False):
 498         if dst_ip is None:
 499             dst_ip = self.nat_addr
 500         if not use_inside_ports:
 501             tcp_port = self.tcp_port_out
 502             udp_port = self.udp_port_out
 503             icmp_id = self.icmp_id_out
 504         else:
 505             tcp_port = self.tcp_port_in
 506             udp_port = self.udp_port_in
 507             icmp_id = self.icmp_id_in
 508         pkts = []
 509         # TCP
 510         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 511              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 512              TCP(dport=tcp_port, sport=20))
 513         pkts.extend([p, p])
 514
 515         # UDP
 516         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 517              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 518              UDP(dport=udp_port, sport=20))
 519         pkts.append(p)
 520
 521         # ICMP
 522         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
 523              IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
 524              ICMP(id=icmp_id, type='echo-reply'))
 525         pkts.append(p)
 526
 527         return pkts
 528
 529     def create_tcp_stream(self, in_if, out_if, count):
 530         pkts = []
 531         port = 6303
 532
 533         for i in range(count):
 534             p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
 535                  IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=64) /
 536                  TCP(sport=port + i, dport=20))
 537             pkts.append(p)
 538
 539         return pkts
 540
 541     def create_stream_frag(self, src_if, dst, sport, dport, data,
 542                            proto=IP_PROTOS.tcp, echo_reply=False):
 543         if proto == IP_PROTOS.tcp:
 544             p = (IP(src=src_if.remote_ip4, dst=dst) /
 545                  TCP(sport=sport, dport=dport) /
 546                  Raw(data))
 547             p = p.__class__(scapy.compat.raw(p))
 548             chksum = p[TCP].chksum
 549             proto_header = TCP(sport=sport, dport=dport, chksum=chksum)
 550         elif proto == IP_PROTOS.udp:
 551             proto_header = UDP(sport=sport, dport=dport)
 552         elif proto == IP_PROTOS.icmp:
 553             if not echo_reply:
 554                 proto_header = ICMP(id=sport, type='echo-request')
 555             else:
 556                 proto_header = ICMP(id=sport, type='echo-reply')
 557         else:
 558             raise Exception("Unsupported protocol")
 559         id = self.random_port()
 560         pkts = []
 561         if proto == IP_PROTOS.tcp:
 562             raw = Raw(data[0:4])
 563         else:
 564             raw = Raw(data[0:16])
 565         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 566              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=0, id=id) /
 567              proto_header /
 568              raw)
 569         pkts.append(p)
 570         if proto == IP_PROTOS.tcp:
 571             raw = Raw(data[4:20])
 572         else:
 573             raw = Raw(data[16:32])
 574         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 575              IP(src=src_if.remote_ip4, dst=dst, flags="MF", frag=3, id=id,
 576                 proto=proto) /
 577              raw)
 578         pkts.append(p)
 579         if proto == IP_PROTOS.tcp:
 580             raw = Raw(data[20:])
 581         else:
 582             raw = Raw(data[32:])
 583         p = (Ether(src=src_if.remote_mac, dst=src_if.local_mac) /
 584              IP(src=src_if.remote_ip4, dst=dst, frag=5, proto=proto,
 585                 id=id) /
 586              raw)
 587         pkts.append(p)
 588         return pkts
 589
 590     def frag_in_order_in_plus_out(self, in_addr, out_addr, in_port, out_port,
 591                                   proto=IP_PROTOS.tcp):
 592
 593         layer = self.proto2layer(proto)
 594
 595         if proto == IP_PROTOS.tcp:
 596             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 597         else:
 598             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 599         port_in = self.random_port()
 600
 601         for i in range(2):
 602             # out2in
 603             pkts = self.create_stream_frag(self.pg0, out_addr,
 604                                            port_in, out_port,
 605                                            data, proto)
 606             self.pg0.add_stream(pkts)
 607             self.pg_enable_capture(self.pg_interfaces)
 608             self.pg_start()
 609             frags = self.pg1.get_capture(len(pkts))
 610             p = self.reass_frags_and_verify(frags,
 611                                             self.pg0.remote_ip4,
 612                                             in_addr)
 613             if proto != IP_PROTOS.icmp:
 614                 self.assertEqual(p[layer].sport, port_in)
 615                 self.assertEqual(p[layer].dport, in_port)
 616             else:
 617                 self.assertEqual(p[layer].id, port_in)
 618             self.assertEqual(data, p[Raw].load)
 619
 620             # in2out
 621             if proto != IP_PROTOS.icmp:
 622                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 623                                                in_port,
 624                                                p[layer].sport, data, proto)
 625             else:
 626                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 627                                                p[layer].id, 0, data, proto,
 628                                                echo_reply=True)
 629             self.pg1.add_stream(pkts)
 630             self.pg_enable_capture(self.pg_interfaces)
 631             self.pg_start()
 632             frags = self.pg0.get_capture(len(pkts))
 633             p = self.reass_frags_and_verify(frags,
 634                                             out_addr,
 635                                             self.pg0.remote_ip4)
 636             if proto != IP_PROTOS.icmp:
 637                 self.assertEqual(p[layer].sport, out_port)
 638                 self.assertEqual(p[layer].dport, port_in)
 639             else:
 640                 self.assertEqual(p[layer].id, port_in)
 641             self.assertEqual(data, p[Raw].load)
 642
 643     def frag_out_of_order_in_plus_out(self, in_addr, out_addr, in_port,
 644                                       out_port, proto=IP_PROTOS.tcp):
 645
 646         layer = self.proto2layer(proto)
 647
 648         if proto == IP_PROTOS.tcp:
 649             data = b"A" * 4 + b"B" * 16 + b"C" * 3
 650         else:
 651             data = b"A" * 16 + b"B" * 16 + b"C" * 3
 652         port_in = self.random_port()
 653
 654         for i in range(2):
 655             # out2in
 656             pkts = self.create_stream_frag(self.pg0, out_addr,
 657                                            port_in, out_port,
 658                                            data, proto)
 659             pkts.reverse()
 660             self.pg0.add_stream(pkts)
 661             self.pg_enable_capture(self.pg_interfaces)
 662             self.pg_start()
 663             frags = self.pg1.get_capture(len(pkts))
 664             p = self.reass_frags_and_verify(frags,
 665                                             self.pg0.remote_ip4,
 666                                             in_addr)
 667             if proto != IP_PROTOS.icmp:
 668                 self.assertEqual(p[layer].dport, in_port)
 669                 self.assertEqual(p[layer].sport, port_in)
 670                 self.assertEqual(p[layer].dport, in_port)
 671             else:
 672                 self.assertEqual(p[layer].id, port_in)
 673             self.assertEqual(data, p[Raw].load)
 674
 675             # in2out
 676             if proto != IP_PROTOS.icmp:
 677                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 678                                                in_port,
 679                                                p[layer].sport, data, proto)
 680             else:
 681                 pkts = self.create_stream_frag(self.pg1, self.pg0.remote_ip4,
 682                                                p[layer].id, 0, data, proto,
 683                                                echo_reply=True)
 684             pkts.reverse()
 685             self.pg1.add_stream(pkts)
 686             self.pg_enable_capture(self.pg_interfaces)
 687             self.pg_start()
 688             frags = self.pg0.get_capture(len(pkts))
 689             p = self.reass_frags_and_verify(frags,
 690                                             out_addr,
 691                                             self.pg0.remote_ip4)
 692             if proto != IP_PROTOS.icmp:
 693                 self.assertEqual(p[layer].sport, out_port)
 694                 self.assertEqual(p[layer].dport, port_in)
 695             else:
 696                 self.assertEqual(p[layer].id, port_in)
 697             self.assertEqual(data, p[Raw].load)
 698
 699     def init_tcp_session(self, in_if, out_if, in_port, ext_port):
 700         # SYN packet in->out
 701         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 702              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 703              TCP(sport=in_port, dport=ext_port, flags="S"))
 704         in_if.add_stream(p)
 705         self.pg_enable_capture(self.pg_interfaces)
 706         self.pg_start()
 707         capture = out_if.get_capture(1)
 708         p = capture[0]
 709         out_port = p[TCP].sport
 710
 711         # SYN + ACK packet out->in
 712         p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
 713              IP(src=out_if.remote_ip4, dst=self.nat_addr) /
 714              TCP(sport=ext_port, dport=out_port, flags="SA"))
 715         out_if.add_stream(p)
 716         self.pg_enable_capture(self.pg_interfaces)
 717         self.pg_start()
 718         in_if.get_capture(1)
 719
 720         # ACK packet in->out
 721         p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
 722              IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
 723              TCP(sport=in_port, dport=ext_port, flags="A"))
 724         in_if.add_stream(p)
 725         self.pg_enable_capture(self.pg_interfaces)
 726         self.pg_start()
 727         out_if.get_capture(1)
 728
 729         return out_port
 730
 731     def twice_nat_common(self, self_twice_nat=False, same_pg=False, lb=False,
 732                          client_id=None):
 733         twice_nat_addr = '10.0.1.3'
 734
 735         port_in = 8080
 736         if lb:
 737             if not same_pg:
 738                 port_in1 = port_in
 739                 port_in2 = port_in
 740             else:
 741                 port_in1 = port_in + 1
 742                 port_in2 = port_in + 2
 743
 744         port_out = 80
 745         eh_port_out = 4567
 746
 747         server1 = self.pg0.remote_hosts[0]
 748         server2 = self.pg0.remote_hosts[1]
 749         if lb and same_pg:
 750             server2 = server1
 751         if not lb:
 752             server = server1
 753
 754         pg0 = self.pg0
 755         if same_pg:
 756             pg1 = self.pg0
 757         else:
 758             pg1 = self.pg1
 759
 760         eh_translate = ((not self_twice_nat) or (not lb and same_pg) or
 761                         client_id == 1)
 762
 763         self.nat_add_address(self.nat_addr)
 764         self.nat_add_address(twice_nat_addr, twice_nat=1)
 765
 766         flags = 0
 767         if self_twice_nat:
 768             flags |= self.config_flags.NAT_IS_SELF_TWICE_NAT
 769         else:
 770             flags |= self.config_flags.NAT_IS_TWICE_NAT
 771
 772         if not lb:
 773             self.nat_add_static_mapping(pg0.remote_ip4, self.nat_addr,
 774                                         port_in, port_out,
 775                                         proto=IP_PROTOS.tcp,
 776                                         flags=flags)
 777         else:
 778             locals = [{'addr': server1.ip4,
 779                        'port': port_in1,
 780                        'probability': 50,
 781                        'vrf_id': 0},
 782                       {'addr': server2.ip4,
 783                        'port': port_in2,
 784                        'probability': 50,
 785                        'vrf_id': 0}]
 786             out_addr = self.nat_addr
 787
 788             self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
 789                                                       external_addr=out_addr,
 790                                                       external_port=port_out,
 791                                                       protocol=IP_PROTOS.tcp,
 792                                                       local_num=len(locals),
 793                                                       locals=locals)
 794         self.nat_add_inside_interface(pg0)
 795         self.nat_add_outside_interface(pg1)
 796
 797         if same_pg:
 798             if not lb:
 799                 client = server
 800             else:
 801                 assert client_id is not None
 802                 if client_id == 1:
 803                     client = self.pg0.remote_hosts[0]
 804                 elif client_id == 2:
 805                     client = self.pg0.remote_hosts[1]
 806         else:
 807             client = pg1.remote_hosts[0]
 808         p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
 809              IP(src=client.ip4, dst=self.nat_addr) /
 810              TCP(sport=eh_port_out, dport=port_out))
 811         pg1.add_stream(p)
 812         self.pg_enable_capture(self.pg_interfaces)
 813         self.pg_start()
 814         capture = pg0.get_capture(1)
 815         p = capture[0]
 816         try:
 817             ip = p[IP]
 818             tcp = p[TCP]
 819             if lb:
 820                 if ip.dst == server1.ip4:
 821                     server = server1
 822                     port_in = port_in1
 823                 else:
 824                     server = server2
 825                     port_in = port_in2
 826             self.assertEqual(ip.dst, server.ip4)
 827             if lb and same_pg:
 828                 self.assertIn(tcp.dport, [port_in1, port_in2])
 829             else:
 830                 self.assertEqual(tcp.dport, port_in)
 831             if eh_translate:
 832                 self.assertEqual(ip.src, twice_nat_addr)
 833                 self.assertNotEqual(tcp.sport, eh_port_out)
 834             else:
 835                 self.assertEqual(ip.src, client.ip4)
 836                 self.assertEqual(tcp.sport, eh_port_out)
 837             eh_addr_in = ip.src
 838             eh_port_in = tcp.sport
 839             saved_port_in = tcp.dport
 840             self.assert_packet_checksums_valid(p)
 841         except:
 842             self.logger.error(ppp("Unexpected or invalid packet:", p))
 843             raise
 844
 845         p = (Ether(src=server.mac, dst=pg0.local_mac) /
 846              IP(src=server.ip4, dst=eh_addr_in) /
 847              TCP(sport=saved_port_in, dport=eh_port_in))
 848         pg0.add_stream(p)
 849         self.pg_enable_capture(self.pg_interfaces)
 850         self.pg_start()
 851         capture = pg1.get_capture(1)
 852         p = capture[0]
 853         try:
 854             ip = p[IP]
 855             tcp = p[TCP]
 856             self.assertEqual(ip.dst, client.ip4)
 857             self.assertEqual(ip.src, self.nat_addr)
 858             self.assertEqual(tcp.dport, eh_port_out)
 859             self.assertEqual(tcp.sport, port_out)
 860             self.assert_packet_checksums_valid(p)
 861         except:
 862             self.logger.error(ppp("Unexpected or invalid packet:", p))
 863             raise
 864
 865         if eh_translate:
 866             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 867             self.assertEqual(len(sessions), 1)
 868             self.assertTrue(sessions[0].flags &
 869                             self.config_flags.NAT_IS_EXT_HOST_VALID)
 870             self.assertTrue(sessions[0].flags &
 871                             self.config_flags.NAT_IS_TWICE_NAT)
 872             self.logger.info(self.vapi.cli("show nat44 sessions"))
 873             self.vapi.nat44_del_session(
 874                 address=sessions[0].inside_ip_address,
 875                 port=sessions[0].inside_port,
 876                 protocol=sessions[0].protocol,
 877                 flags=(self.config_flags.NAT_IS_INSIDE |
 878                        self.config_flags.NAT_IS_EXT_HOST_VALID),
 879                 ext_host_address=sessions[0].ext_host_nat_address,
 880                 ext_host_port=sessions[0].ext_host_nat_port)
 881             sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
 882             self.assertEqual(len(sessions), 0)
 883
 884     def verify_syslog_sess(self, data, msgid, is_ip6=False):
 885         message = data.decode('utf-8')
 886         try:
 887             message = SyslogMessage.parse(message)
 888         except ParseError as e:
 889             self.logger.error(e)
 890             raise
 891         else:
 892             self.assertEqual(message.severity, SyslogSeverity.info)
 893             self.assertEqual(message.appname, 'NAT')
 894             self.assertEqual(message.msgid, msgid)
 895             sd_params = message.sd.get('nsess')
 896             self.assertTrue(sd_params is not None)
 897             if is_ip6:
 898                 self.assertEqual(sd_params.get('IATYP'), 'IPv6')
 899                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip6)
 900             else:
 901                 self.assertEqual(sd_params.get('IATYP'), 'IPv4')
 902                 self.assertEqual(sd_params.get('ISADDR'), self.pg0.remote_ip4)
 903                 self.assertTrue(sd_params.get('SSUBIX') is not None)
 904             self.assertEqual(sd_params.get('ISPORT'), "%d" % self.tcp_port_in)
 905             self.assertEqual(sd_params.get('XATYP'), 'IPv4')
 906             self.assertEqual(sd_params.get('XSADDR'), self.nat_addr)
 907             self.assertEqual(sd_params.get('XSPORT'), "%d" % self.tcp_port_out)
 908             self.assertEqual(sd_params.get('PROTO'), "%d" % IP_PROTOS.tcp)
 909             self.assertEqual(sd_params.get('SVLAN'), '0')
 910             self.assertEqual(sd_params.get('XDADDR'), self.pg1.remote_ip4)
 911             self.assertEqual(sd_params.get('XDPORT'),
 912                              "%d" % self.tcp_external_port)
 913
 914     def test_icmp_error(self):
 915         """ NAT44ED test ICMP error message with inner header"""
 916
 917         payload = "H" * 10
 918
 919         self.nat_add_address(self.nat_addr)
 920         self.nat_add_inside_interface(self.pg0)
 921         self.nat_add_outside_interface(self.pg1)
 922
 923         # in2out (initiate connection)
 924         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 925               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 926               UDP(sport=21, dport=20) / payload)
 927
 928         self.pg0.add_stream(p1)
 929         self.pg_enable_capture(self.pg_interfaces)
 930         self.pg_start()
 931         capture = self.pg1.get_capture(1)[0]
 932
 933         # out2in (send error message)
 934         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 935               IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
 936               ICMP(type='dest-unreach', code='port-unreachable') /
 937               capture[IP:])
 938
 939         self.pg1.add_stream(p2)
 940         self.pg_enable_capture(self.pg_interfaces)
 941         self.pg_start()
 942
 943         capture = self.pg0.get_capture(1)[0]
 944
 945         self.logger.info(ppp("p1 packet:", p1))
 946         self.logger.info(ppp("p2 packet:", p2))
 947         self.logger.info(ppp("capture packet:", capture))
 948
 949     def test_icmp_echo_reply_trailer(self):
 950         """ ICMP echo reply with ethernet trailer"""
 951
 952         self.nat_add_address(self.nat_addr)
 953         self.nat_add_inside_interface(self.pg0)
 954         self.nat_add_outside_interface(self.pg1)
 955
 956         # in2out
 957         p1 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
 958               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
 959               ICMP(type=8, id=0xabcd, seq=0))
 960
 961         self.pg0.add_stream(p1)
 962         self.pg_enable_capture(self.pg_interfaces)
 963         self.pg_start()
 964         c = self.pg1.get_capture(1)[0]
 965
 966         self.logger.debug(self.vapi.cli("show trace"))
 967
 968         # out2in
 969         p2 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
 970               IP(src=self.pg1.remote_ip4, dst=self.nat_addr, id=0xee59) /
 971               ICMP(type=0, id=c[ICMP].id, seq=0))
 972
 973         # force checksum calculation
 974         p2 = p2.__class__(bytes(p2))
 975
 976         self.logger.debug(ppp("Packet before modification:", p2))
 977
 978         # hex representation of vss monitoring ethernet trailer
 979         # this seems to be just added to end of packet without modifying
 980         # IP or ICMP lengths / checksums
 981         p2 = p2 / Raw("\x00\x00\x52\x54\x00\x46\xab\x04\x84\x18")
 982         # change it so that IP/ICMP is unaffected
 983         p2[IP].len = 28
 984
 985         self.logger.debug(ppp("Packet with added trailer:", p2))
 986
 987         self.pg1.add_stream(p2)
 988         self.pg_enable_capture(self.pg_interfaces)
 989         self.pg_start()
 990
 991         self.pg0.get_capture(1)
 992
 993     def test_users_dump(self):
 994         """ NAT44ED API test - nat44_user_dump """
 995
 996         self.nat_add_address(self.nat_addr)
 997         self.nat_add_inside_interface(self.pg0)
 998         self.nat_add_outside_interface(self.pg1)
 999
1000         self.vapi.nat44_forwarding_enable_disable(enable=1)
1001
1002         local_ip = self.pg0.remote_ip4
1003         external_ip = self.nat_addr
1004         self.nat_add_static_mapping(local_ip, external_ip)
1005
1006         users = self.vapi.nat44_user_dump()
1007         self.assertEqual(len(users), 0)
1008
1009         # in2out - static mapping match
1010
1011         pkts = self.create_stream_out(self.pg1)
1012         self.pg1.add_stream(pkts)
1013         self.pg_enable_capture(self.pg_interfaces)
1014         self.pg_start()
1015         capture = self.pg0.get_capture(len(pkts))
1016         self.verify_capture_in(capture, self.pg0)
1017
1018         pkts = self.create_stream_in(self.pg0, self.pg1)
1019         self.pg0.add_stream(pkts)
1020         self.pg_enable_capture(self.pg_interfaces)
1021         self.pg_start()
1022         capture = self.pg1.get_capture(len(pkts))
1023         self.verify_capture_out(capture, same_port=True)
1024
1025         users = self.vapi.nat44_user_dump()
1026         self.assertEqual(len(users), 1)
1027         static_user = users[0]
1028         self.assertEqual(static_user.nstaticsessions, 3)
1029         self.assertEqual(static_user.nsessions, 0)
1030
1031         # in2out - no static mapping match (forwarding test)
1032
1033         host0 = self.pg0.remote_hosts[0]
1034         self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1035         try:
1036             pkts = self.create_stream_out(self.pg1,
1037                                           dst_ip=self.pg0.remote_ip4,
1038                                           use_inside_ports=True)
1039             self.pg1.add_stream(pkts)
1040             self.pg_enable_capture(self.pg_interfaces)
1041             self.pg_start()
1042             capture = self.pg0.get_capture(len(pkts))
1043             self.verify_capture_in(capture, self.pg0)
1044
1045             pkts = self.create_stream_in(self.pg0, self.pg1)
1046             self.pg0.add_stream(pkts)
1047             self.pg_enable_capture(self.pg_interfaces)
1048             self.pg_start()
1049             capture = self.pg1.get_capture(len(pkts))
1050             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1051                                     same_port=True)
1052         finally:
1053             self.pg0.remote_hosts[0] = host0
1054
1055         users = self.vapi.nat44_user_dump()
1056         self.assertEqual(len(users), 2)
1057         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1058             non_static_user = users[1]
1059             static_user = users[0]
1060         else:
1061             non_static_user = users[0]
1062             static_user = users[1]
1063         self.assertEqual(static_user.nstaticsessions, 3)
1064         self.assertEqual(static_user.nsessions, 0)
1065         self.assertEqual(non_static_user.nstaticsessions, 0)
1066         self.assertEqual(non_static_user.nsessions, 3)
1067
1068         users = self.vapi.nat44_user_dump()
1069         self.assertEqual(len(users), 2)
1070         if str(users[0].ip_address) == self.pg0.remote_hosts[0].ip4:
1071             non_static_user = users[1]
1072             static_user = users[0]
1073         else:
1074             non_static_user = users[0]
1075             static_user = users[1]
1076         self.assertEqual(static_user.nstaticsessions, 3)
1077         self.assertEqual(static_user.nsessions, 0)
1078         self.assertEqual(non_static_user.nstaticsessions, 0)
1079         self.assertEqual(non_static_user.nsessions, 3)
1080
1081     def test_frag_out_of_order_do_not_translate(self):
1082         """ NAT44ED don't translate fragments arriving out of order """
1083         self.nat_add_inside_interface(self.pg0)
1084         self.nat_add_outside_interface(self.pg1)
1085         self.vapi.nat44_forwarding_enable_disable(enable=True)
1086         self.frag_out_of_order(proto=IP_PROTOS.tcp, dont_translate=True)
1087
1088     def test_forwarding(self):
1089         """ NAT44ED forwarding test """
1090
1091         self.nat_add_inside_interface(self.pg0)
1092         self.nat_add_outside_interface(self.pg1)
1093         self.vapi.nat44_forwarding_enable_disable(enable=1)
1094
1095         real_ip = self.pg0.remote_ip4
1096         alias_ip = self.nat_addr
1097         flags = self.config_flags.NAT_IS_ADDR_ONLY
1098         self.vapi.nat44_add_del_static_mapping(is_add=1,
1099                                                local_ip_address=real_ip,
1100                                                external_ip_address=alias_ip,
1101                                                external_sw_if_index=0xFFFFFFFF,
1102                                                flags=flags)
1103
1104         try:
1105             # in2out - static mapping match
1106
1107             pkts = self.create_stream_out(self.pg1)
1108             self.pg1.add_stream(pkts)
1109             self.pg_enable_capture(self.pg_interfaces)
1110             self.pg_start()
1111             capture = self.pg0.get_capture(len(pkts))
1112             self.verify_capture_in(capture, self.pg0)
1113
1114             pkts = self.create_stream_in(self.pg0, self.pg1)
1115             self.pg0.add_stream(pkts)
1116             self.pg_enable_capture(self.pg_interfaces)
1117             self.pg_start()
1118             capture = self.pg1.get_capture(len(pkts))
1119             self.verify_capture_out(capture, same_port=True)
1120
1121             # in2out - no static mapping match
1122
1123             host0 = self.pg0.remote_hosts[0]
1124             self.pg0.remote_hosts[0] = self.pg0.remote_hosts[1]
1125             try:
1126                 pkts = self.create_stream_out(self.pg1,
1127                                               dst_ip=self.pg0.remote_ip4,
1128                                               use_inside_ports=True)
1129                 self.pg1.add_stream(pkts)
1130                 self.pg_enable_capture(self.pg_interfaces)
1131                 self.pg_start()
1132                 capture = self.pg0.get_capture(len(pkts))
1133                 self.verify_capture_in(capture, self.pg0)
1134
1135                 pkts = self.create_stream_in(self.pg0, self.pg1)
1136                 self.pg0.add_stream(pkts)
1137                 self.pg_enable_capture(self.pg_interfaces)
1138                 self.pg_start()
1139                 capture = self.pg1.get_capture(len(pkts))
1140                 self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1141                                         same_port=True)
1142             finally:
1143                 self.pg0.remote_hosts[0] = host0
1144
1145             user = self.pg0.remote_hosts[1]
1146             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1147             self.assertEqual(len(sessions), 3)
1148             self.assertTrue(sessions[0].flags &
1149                             self.config_flags.NAT_IS_EXT_HOST_VALID)
1150             self.vapi.nat44_del_session(
1151                 address=sessions[0].inside_ip_address,
1152                 port=sessions[0].inside_port,
1153                 protocol=sessions[0].protocol,
1154                 flags=(self.config_flags.NAT_IS_INSIDE |
1155                        self.config_flags.NAT_IS_EXT_HOST_VALID),
1156                 ext_host_address=sessions[0].ext_host_address,
1157                 ext_host_port=sessions[0].ext_host_port)
1158             sessions = self.vapi.nat44_user_session_dump(user.ip4, 0)
1159             self.assertEqual(len(sessions), 2)
1160
1161         finally:
1162             self.vapi.nat44_forwarding_enable_disable(enable=0)
1163             flags = self.config_flags.NAT_IS_ADDR_ONLY
1164             self.vapi.nat44_add_del_static_mapping(
1165                 is_add=0,
1166                 local_ip_address=real_ip,
1167                 external_ip_address=alias_ip,
1168                 external_sw_if_index=0xFFFFFFFF,
1169                 flags=flags)
1170
1171     def test_output_feature_and_service2(self):
1172         """ NAT44ED interface output feature and service host direct access """
1173         self.vapi.nat44_forwarding_enable_disable(enable=1)
1174         self.nat_add_address(self.nat_addr)
1175
1176         self.vapi.nat44_interface_add_del_output_feature(
1177             sw_if_index=self.pg1.sw_if_index, is_add=1,)
1178
1179         # session initiated from service host - translate
1180         pkts = self.create_stream_in(self.pg0, self.pg1)
1181         self.pg0.add_stream(pkts)
1182         self.pg_enable_capture(self.pg_interfaces)
1183         self.pg_start()
1184         capture = self.pg1.get_capture(len(pkts))
1185         self.verify_capture_out(capture, ignore_port=True)
1186
1187         pkts = self.create_stream_out(self.pg1)
1188         self.pg1.add_stream(pkts)
1189         self.pg_enable_capture(self.pg_interfaces)
1190         self.pg_start()
1191         capture = self.pg0.get_capture(len(pkts))
1192         self.verify_capture_in(capture, self.pg0)
1193
1194         # session initiated from remote host - do not translate
1195         tcp_port_in = self.tcp_port_in
1196         udp_port_in = self.udp_port_in
1197         icmp_id_in = self.icmp_id_in
1198
1199         self.tcp_port_in = 60303
1200         self.udp_port_in = 60304
1201         self.icmp_id_in = 60305
1202
1203         try:
1204             pkts = self.create_stream_out(self.pg1,
1205                                           self.pg0.remote_ip4,
1206                                           use_inside_ports=True)
1207             self.pg1.add_stream(pkts)
1208             self.pg_enable_capture(self.pg_interfaces)
1209             self.pg_start()
1210             capture = self.pg0.get_capture(len(pkts))
1211             self.verify_capture_in(capture, self.pg0)
1212
1213             pkts = self.create_stream_in(self.pg0, self.pg1)
1214             self.pg0.add_stream(pkts)
1215             self.pg_enable_capture(self.pg_interfaces)
1216             self.pg_start()
1217             capture = self.pg1.get_capture(len(pkts))
1218             self.verify_capture_out(capture, nat_ip=self.pg0.remote_ip4,
1219                                     same_port=True)
1220         finally:
1221             self.tcp_port_in = tcp_port_in
1222             self.udp_port_in = udp_port_in
1223             self.icmp_id_in = icmp_id_in
1224
1225     def test_twice_nat(self):
1226         """ NAT44ED Twice NAT """
1227         self.twice_nat_common()
1228
1229     def test_self_twice_nat_positive(self):
1230         """ NAT44ED Self Twice NAT (positive test) """
1231         self.twice_nat_common(self_twice_nat=True, same_pg=True)
1232
1233     def test_self_twice_nat_lb_positive(self):
1234         """ NAT44ED Self Twice NAT local service load balancing (positive test)
1235         """
1236         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
1237                               client_id=1)
1238
1239     def test_twice_nat_lb(self):
1240         """ NAT44ED Twice NAT local service load balancing """
1241         self.twice_nat_common(lb=True)
1242
1243     def test_output_feature(self):
1244         """ NAT44ED interface output feature (in2out postrouting) """
1245         self.vapi.nat44_forwarding_enable_disable(enable=1)
1246         self.nat_add_address(self.nat_addr)
1247
1248         self.nat_add_outside_interface(self.pg0)
1249         self.vapi.nat44_interface_add_del_output_feature(
1250             sw_if_index=self.pg1.sw_if_index, is_add=1)
1251
1252         # in2out
1253         pkts = self.create_stream_in(self.pg0, self.pg1)
1254         self.pg0.add_stream(pkts)
1255         self.pg_enable_capture(self.pg_interfaces)
1256         self.pg_start()
1257         capture = self.pg1.get_capture(len(pkts))
1258         self.verify_capture_out(capture, ignore_port=True)
1259         self.logger.debug(self.vapi.cli("show trace"))
1260
1261         # out2in
1262         pkts = self.create_stream_out(self.pg1)
1263         self.pg1.add_stream(pkts)
1264         self.pg_enable_capture(self.pg_interfaces)
1265         self.pg_start()
1266         capture = self.pg0.get_capture(len(pkts))
1267         self.verify_capture_in(capture, self.pg0)
1268         self.logger.debug(self.vapi.cli("show trace"))
1269
1270         # in2out
1271         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
1272         self.pg0.add_stream(pkts)
1273         self.pg_enable_capture(self.pg_interfaces)
1274         self.pg_start()
1275         capture = self.pg1.get_capture(len(pkts))
1276         self.verify_capture_out(capture, ignore_port=True)
1277         self.logger.debug(self.vapi.cli("show trace"))
1278
1279         # out2in
1280         pkts = self.create_stream_out(self.pg1, ttl=2)
1281         self.pg1.add_stream(pkts)
1282         self.pg_enable_capture(self.pg_interfaces)
1283         self.pg_start()
1284         capture = self.pg0.get_capture(len(pkts))
1285         self.verify_capture_in(capture, self.pg0)
1286         self.logger.debug(self.vapi.cli("show trace"))
1287
1288         # in2out
1289         pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
1290         self.pg0.add_stream(pkts)
1291         self.pg_enable_capture(self.pg_interfaces)
1292         self.pg_start()
1293         capture = self.pg0.get_capture(len(pkts))
1294         for p in capture:
1295             self.assertIn(ICMP, p)
1296             self.assertEqual(p[ICMP].type, 11)  # 11 == time-exceeded
1297
1298     def test_static_with_port_out2(self):
1299         """ NAT44ED 1:1 NAPT asymmetrical rule """
1300
1301         external_port = 80
1302         local_port = 8080
1303
1304         self.vapi.nat44_forwarding_enable_disable(enable=1)
1305         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1306         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
1307                                     local_port, external_port,
1308                                     proto=IP_PROTOS.tcp, flags=flags)
1309
1310         self.nat_add_inside_interface(self.pg0)
1311         self.nat_add_outside_interface(self.pg1)
1312
1313         # from client to service
1314         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1315              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1316              TCP(sport=12345, dport=external_port))
1317         self.pg1.add_stream(p)
1318         self.pg_enable_capture(self.pg_interfaces)
1319         self.pg_start()
1320         capture = self.pg0.get_capture(1)
1321         p = capture[0]
1322         try:
1323             ip = p[IP]
1324             tcp = p[TCP]
1325             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1326             self.assertEqual(tcp.dport, local_port)
1327             self.assert_packet_checksums_valid(p)
1328         except:
1329             self.logger.error(ppp("Unexpected or invalid packet:", p))
1330             raise
1331
1332         # ICMP error
1333         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
1334              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1335              ICMP(type=11) / capture[0][IP])
1336         self.pg0.add_stream(p)
1337         self.pg_enable_capture(self.pg_interfaces)
1338         self.pg_start()
1339         capture = self.pg1.get_capture(1)
1340         p = capture[0]
1341         try:
1342             self.assertEqual(p[IP].src, self.nat_addr)
1343             inner = p[IPerror]
1344             self.assertEqual(inner.dst, self.nat_addr)
1345             self.assertEqual(inner[TCPerror].dport, external_port)
1346         except:
1347             self.logger.error(ppp("Unexpected or invalid packet:", p))
1348             raise
1349
1350         # from service back to client
1351         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1352              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1353              TCP(sport=local_port, dport=12345))
1354         self.pg0.add_stream(p)
1355         self.pg_enable_capture(self.pg_interfaces)
1356         self.pg_start()
1357         capture = self.pg1.get_capture(1)
1358         p = capture[0]
1359         try:
1360             ip = p[IP]
1361             tcp = p[TCP]
1362             self.assertEqual(ip.src, self.nat_addr)
1363             self.assertEqual(tcp.sport, external_port)
1364             self.assert_packet_checksums_valid(p)
1365         except:
1366             self.logger.error(ppp("Unexpected or invalid packet:", p))
1367             raise
1368
1369         # ICMP error
1370         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1371              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1372              ICMP(type=11) / capture[0][IP])
1373         self.pg1.add_stream(p)
1374         self.pg_enable_capture(self.pg_interfaces)
1375         self.pg_start()
1376         capture = self.pg0.get_capture(1)
1377         p = capture[0]
1378         try:
1379             self.assertEqual(p[IP].dst, self.pg0.remote_ip4)
1380             inner = p[IPerror]
1381             self.assertEqual(inner.src, self.pg0.remote_ip4)
1382             self.assertEqual(inner[TCPerror].sport, local_port)
1383         except:
1384             self.logger.error(ppp("Unexpected or invalid packet:", p))
1385             raise
1386
1387         # from client to server (no translation)
1388         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1389              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
1390              TCP(sport=12346, dport=local_port))
1391         self.pg1.add_stream(p)
1392         self.pg_enable_capture(self.pg_interfaces)
1393         self.pg_start()
1394         capture = self.pg0.get_capture(1)
1395         p = capture[0]
1396         try:
1397             ip = p[IP]
1398             tcp = p[TCP]
1399             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1400             self.assertEqual(tcp.dport, local_port)
1401             self.assert_packet_checksums_valid(p)
1402         except:
1403             self.logger.error(ppp("Unexpected or invalid packet:", p))
1404             raise
1405
1406         # from service back to client (no translation)
1407         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1408              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
1409              TCP(sport=local_port, dport=12346))
1410         self.pg0.add_stream(p)
1411         self.pg_enable_capture(self.pg_interfaces)
1412         self.pg_start()
1413         capture = self.pg1.get_capture(1)
1414         p = capture[0]
1415         try:
1416             ip = p[IP]
1417             tcp = p[TCP]
1418             self.assertEqual(ip.src, self.pg0.remote_ip4)
1419             self.assertEqual(tcp.sport, local_port)
1420             self.assert_packet_checksums_valid(p)
1421         except:
1422             self.logger.error(ppp("Unexpected or invalid packet:", p))
1423             raise
1424
1425     def test_static_lb(self):
1426         """ NAT44ED local service load balancing """
1427         external_addr_n = self.nat_addr
1428         external_port = 80
1429         local_port = 8080
1430         server1 = self.pg0.remote_hosts[0]
1431         server2 = self.pg0.remote_hosts[1]
1432
1433         locals = [{'addr': server1.ip4,
1434                    'port': local_port,
1435                    'probability': 70,
1436                    'vrf_id': 0},
1437                   {'addr': server2.ip4,
1438                    'port': local_port,
1439                    'probability': 30,
1440                    'vrf_id': 0}]
1441
1442         self.nat_add_address(self.nat_addr)
1443         self.vapi.nat44_add_del_lb_static_mapping(
1444             is_add=1,
1445             external_addr=external_addr_n,
1446             external_port=external_port,
1447             protocol=IP_PROTOS.tcp,
1448             local_num=len(locals),
1449             locals=locals)
1450         flags = self.config_flags.NAT_IS_INSIDE
1451         self.vapi.nat44_interface_add_del_feature(
1452             sw_if_index=self.pg0.sw_if_index,
1453             flags=flags, is_add=1)
1454         self.vapi.nat44_interface_add_del_feature(
1455             sw_if_index=self.pg1.sw_if_index,
1456             is_add=1)
1457
1458         # from client to service
1459         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1460              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1461              TCP(sport=12345, dport=external_port))
1462         self.pg1.add_stream(p)
1463         self.pg_enable_capture(self.pg_interfaces)
1464         self.pg_start()
1465         capture = self.pg0.get_capture(1)
1466         p = capture[0]
1467         server = None
1468         try:
1469             ip = p[IP]
1470             tcp = p[TCP]
1471             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1472             if ip.dst == server1.ip4:
1473                 server = server1
1474             else:
1475                 server = server2
1476             self.assertEqual(tcp.dport, local_port)
1477             self.assert_packet_checksums_valid(p)
1478         except:
1479             self.logger.error(ppp("Unexpected or invalid packet:", p))
1480             raise
1481
1482         # from service back to client
1483         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1484              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1485              TCP(sport=local_port, dport=12345))
1486         self.pg0.add_stream(p)
1487         self.pg_enable_capture(self.pg_interfaces)
1488         self.pg_start()
1489         capture = self.pg1.get_capture(1)
1490         p = capture[0]
1491         try:
1492             ip = p[IP]
1493             tcp = p[TCP]
1494             self.assertEqual(ip.src, self.nat_addr)
1495             self.assertEqual(tcp.sport, external_port)
1496             self.assert_packet_checksums_valid(p)
1497         except:
1498             self.logger.error(ppp("Unexpected or invalid packet:", p))
1499             raise
1500
1501         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1502         self.assertEqual(len(sessions), 1)
1503         self.assertTrue(sessions[0].flags &
1504                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1505         self.vapi.nat44_del_session(
1506             address=sessions[0].inside_ip_address,
1507             port=sessions[0].inside_port,
1508             protocol=sessions[0].protocol,
1509             flags=(self.config_flags.NAT_IS_INSIDE |
1510                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1511             ext_host_address=sessions[0].ext_host_address,
1512             ext_host_port=sessions[0].ext_host_port)
1513         sessions = self.vapi.nat44_user_session_dump(server.ip4, 0)
1514         self.assertEqual(len(sessions), 0)
1515
1516     def test_static_lb_2(self):
1517         """ NAT44ED local service load balancing (asymmetrical rule) """
1518         external_addr = self.nat_addr
1519         external_port = 80
1520         local_port = 8080
1521         server1 = self.pg0.remote_hosts[0]
1522         server2 = self.pg0.remote_hosts[1]
1523
1524         locals = [{'addr': server1.ip4,
1525                    'port': local_port,
1526                    'probability': 70,
1527                    'vrf_id': 0},
1528                   {'addr': server2.ip4,
1529                    'port': local_port,
1530                    'probability': 30,
1531                    'vrf_id': 0}]
1532
1533         self.vapi.nat44_forwarding_enable_disable(enable=1)
1534         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1535         self.vapi.nat44_add_del_lb_static_mapping(is_add=1, flags=flags,
1536                                                   external_addr=external_addr,
1537                                                   external_port=external_port,
1538                                                   protocol=IP_PROTOS.tcp,
1539                                                   local_num=len(locals),
1540                                                   locals=locals)
1541         flags = self.config_flags.NAT_IS_INSIDE
1542         self.vapi.nat44_interface_add_del_feature(
1543             sw_if_index=self.pg0.sw_if_index,
1544             flags=flags, is_add=1)
1545         self.vapi.nat44_interface_add_del_feature(
1546             sw_if_index=self.pg1.sw_if_index,
1547             is_add=1)
1548
1549         # from client to service
1550         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1551              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1552              TCP(sport=12345, dport=external_port))
1553         self.pg1.add_stream(p)
1554         self.pg_enable_capture(self.pg_interfaces)
1555         self.pg_start()
1556         capture = self.pg0.get_capture(1)
1557         p = capture[0]
1558         server = None
1559         try:
1560             ip = p[IP]
1561             tcp = p[TCP]
1562             self.assertIn(ip.dst, [server1.ip4, server2.ip4])
1563             if ip.dst == server1.ip4:
1564                 server = server1
1565             else:
1566                 server = server2
1567             self.assertEqual(tcp.dport, local_port)
1568             self.assert_packet_checksums_valid(p)
1569         except:
1570             self.logger.error(ppp("Unexpected or invalid packet:", p))
1571             raise
1572
1573         # from service back to client
1574         p = (Ether(src=server.mac, dst=self.pg0.local_mac) /
1575              IP(src=server.ip4, dst=self.pg1.remote_ip4) /
1576              TCP(sport=local_port, dport=12345))
1577         self.pg0.add_stream(p)
1578         self.pg_enable_capture(self.pg_interfaces)
1579         self.pg_start()
1580         capture = self.pg1.get_capture(1)
1581         p = capture[0]
1582         try:
1583             ip = p[IP]
1584             tcp = p[TCP]
1585             self.assertEqual(ip.src, self.nat_addr)
1586             self.assertEqual(tcp.sport, external_port)
1587             self.assert_packet_checksums_valid(p)
1588         except:
1589             self.logger.error(ppp("Unexpected or invalid packet:", p))
1590             raise
1591
1592         # from client to server (no translation)
1593         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1594              IP(src=self.pg1.remote_ip4, dst=server1.ip4) /
1595              TCP(sport=12346, dport=local_port))
1596         self.pg1.add_stream(p)
1597         self.pg_enable_capture(self.pg_interfaces)
1598         self.pg_start()
1599         capture = self.pg0.get_capture(1)
1600         p = capture[0]
1601         server = None
1602         try:
1603             ip = p[IP]
1604             tcp = p[TCP]
1605             self.assertEqual(ip.dst, server1.ip4)
1606             self.assertEqual(tcp.dport, local_port)
1607             self.assert_packet_checksums_valid(p)
1608         except:
1609             self.logger.error(ppp("Unexpected or invalid packet:", p))
1610             raise
1611
1612         # from service back to client (no translation)
1613         p = (Ether(src=server1.mac, dst=self.pg0.local_mac) /
1614              IP(src=server1.ip4, dst=self.pg1.remote_ip4) /
1615              TCP(sport=local_port, dport=12346))
1616         self.pg0.add_stream(p)
1617         self.pg_enable_capture(self.pg_interfaces)
1618         self.pg_start()
1619         capture = self.pg1.get_capture(1)
1620         p = capture[0]
1621         try:
1622             ip = p[IP]
1623             tcp = p[TCP]
1624             self.assertEqual(ip.src, server1.ip4)
1625             self.assertEqual(tcp.sport, local_port)
1626             self.assert_packet_checksums_valid(p)
1627         except:
1628             self.logger.error(ppp("Unexpected or invalid packet:", p))
1629             raise
1630
1631     def test_lb_affinity(self):
1632         """ NAT44ED local service load balancing affinity """
1633         external_addr = self.nat_addr
1634         external_port = 80
1635         local_port = 8080
1636         server1 = self.pg0.remote_hosts[0]
1637         server2 = self.pg0.remote_hosts[1]
1638
1639         locals = [{'addr': server1.ip4,
1640                    'port': local_port,
1641                    'probability': 50,
1642                    'vrf_id': 0},
1643                   {'addr': server2.ip4,
1644                    'port': local_port,
1645                    'probability': 50,
1646                    'vrf_id': 0}]
1647
1648         self.nat_add_address(self.nat_addr)
1649         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
1650                                                   external_addr=external_addr,
1651                                                   external_port=external_port,
1652                                                   protocol=IP_PROTOS.tcp,
1653                                                   affinity=10800,
1654                                                   local_num=len(locals),
1655                                                   locals=locals)
1656         flags = self.config_flags.NAT_IS_INSIDE
1657         self.vapi.nat44_interface_add_del_feature(
1658             sw_if_index=self.pg0.sw_if_index,
1659             flags=flags, is_add=1)
1660         self.vapi.nat44_interface_add_del_feature(
1661             sw_if_index=self.pg1.sw_if_index,
1662             is_add=1)
1663
1664         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1665              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1666              TCP(sport=1025, dport=external_port))
1667         self.pg1.add_stream(p)
1668         self.pg_enable_capture(self.pg_interfaces)
1669         self.pg_start()
1670         capture = self.pg0.get_capture(1)
1671         backend = capture[0][IP].dst
1672
1673         sessions = self.vapi.nat44_user_session_dump(backend, 0)
1674         self.assertEqual(len(sessions), 1)
1675         self.assertTrue(sessions[0].flags &
1676                         self.config_flags.NAT_IS_EXT_HOST_VALID)
1677         self.vapi.nat44_del_session(
1678             address=sessions[0].inside_ip_address,
1679             port=sessions[0].inside_port,
1680             protocol=sessions[0].protocol,
1681             flags=(self.config_flags.NAT_IS_INSIDE |
1682                    self.config_flags.NAT_IS_EXT_HOST_VALID),
1683             ext_host_address=sessions[0].ext_host_address,
1684             ext_host_port=sessions[0].ext_host_port)
1685
1686         pkts = []
1687         for port in range(1030, 1100):
1688             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
1689                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1690                  TCP(sport=port, dport=external_port))
1691             pkts.append(p)
1692         self.pg1.add_stream(pkts)
1693         self.pg_enable_capture(self.pg_interfaces)
1694         self.pg_start()
1695         capture = self.pg0.get_capture(len(pkts))
1696         for p in capture:
1697             self.assertEqual(p[IP].dst, backend)
1698
1699     def test_multiple_vrf_1(self):
1700         """ Multiple VRF - both client & service in VRF1 """
1701
1702         external_addr = '1.2.3.4'
1703         external_port = 80
1704         local_port = 8080
1705         port = 0
1706
1707         flags = self.config_flags.NAT_IS_INSIDE
1708         self.vapi.nat44_interface_add_del_feature(
1709             sw_if_index=self.pg5.sw_if_index,
1710             is_add=1)
1711         self.vapi.nat44_interface_add_del_feature(
1712             sw_if_index=self.pg5.sw_if_index,
1713             is_add=1, flags=flags)
1714         self.vapi.nat44_interface_add_del_feature(
1715             sw_if_index=self.pg6.sw_if_index,
1716             is_add=1)
1717         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1718         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1719                                     local_port, external_port, vrf_id=1,
1720                                     proto=IP_PROTOS.tcp, flags=flags)
1721
1722         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1723              IP(src=self.pg6.remote_ip4, dst=external_addr) /
1724              TCP(sport=12345, dport=external_port))
1725         self.pg6.add_stream(p)
1726         self.pg_enable_capture(self.pg_interfaces)
1727         self.pg_start()
1728         capture = self.pg5.get_capture(1)
1729         p = capture[0]
1730         try:
1731             ip = p[IP]
1732             tcp = p[TCP]
1733             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1734             self.assertEqual(tcp.dport, local_port)
1735             self.assert_packet_checksums_valid(p)
1736         except:
1737             self.logger.error(ppp("Unexpected or invalid packet:", p))
1738             raise
1739
1740         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1741              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
1742              TCP(sport=local_port, dport=12345))
1743         self.pg5.add_stream(p)
1744         self.pg_enable_capture(self.pg_interfaces)
1745         self.pg_start()
1746         capture = self.pg6.get_capture(1)
1747         p = capture[0]
1748         try:
1749             ip = p[IP]
1750             tcp = p[TCP]
1751             self.assertEqual(ip.src, external_addr)
1752             self.assertEqual(tcp.sport, external_port)
1753             self.assert_packet_checksums_valid(p)
1754         except:
1755             self.logger.error(ppp("Unexpected or invalid packet:", p))
1756             raise
1757
1758     def test_multiple_vrf_2(self):
1759         """ Multiple VRF - dynamic NAT from VRF1 to VRF0 (output-feature) """
1760
1761         external_addr = '1.2.3.4'
1762         external_port = 80
1763         local_port = 8080
1764         port = 0
1765
1766         self.nat_add_address(self.nat_addr)
1767         flags = self.config_flags.NAT_IS_INSIDE
1768         self.vapi.nat44_interface_add_del_output_feature(
1769             sw_if_index=self.pg1.sw_if_index,
1770             is_add=1)
1771         self.vapi.nat44_interface_add_del_feature(
1772             sw_if_index=self.pg5.sw_if_index,
1773             is_add=1)
1774         self.vapi.nat44_interface_add_del_feature(
1775             sw_if_index=self.pg5.sw_if_index,
1776             is_add=1, flags=flags)
1777         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1778         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1779                                     local_port, external_port, vrf_id=1,
1780                                     proto=IP_PROTOS.tcp, flags=flags)
1781
1782         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1783              IP(src=self.pg5.remote_ip4, dst=self.pg1.remote_ip4) /
1784              TCP(sport=2345, dport=22))
1785         self.pg5.add_stream(p)
1786         self.pg_enable_capture(self.pg_interfaces)
1787         self.pg_start()
1788         capture = self.pg1.get_capture(1)
1789         p = capture[0]
1790         try:
1791             ip = p[IP]
1792             tcp = p[TCP]
1793             self.assertEqual(ip.src, self.nat_addr)
1794             self.assert_packet_checksums_valid(p)
1795             port = tcp.sport
1796         except:
1797             self.logger.error(ppp("Unexpected or invalid packet:", p))
1798             raise
1799
1800         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
1801              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
1802              TCP(sport=22, dport=port))
1803         self.pg1.add_stream(p)
1804         self.pg_enable_capture(self.pg_interfaces)
1805         self.pg_start()
1806         capture = self.pg5.get_capture(1)
1807         p = capture[0]
1808         try:
1809             ip = p[IP]
1810             tcp = p[TCP]
1811             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1812             self.assertEqual(tcp.dport, 2345)
1813             self.assert_packet_checksums_valid(p)
1814         except:
1815             self.logger.error(ppp("Unexpected or invalid packet:", p))
1816             raise
1817
1818     def test_multiple_vrf_3(self):
1819         """ Multiple VRF - client in VRF1, service in VRF0 """
1820
1821         external_addr = '1.2.3.4'
1822         external_port = 80
1823         local_port = 8080
1824         port = 0
1825
1826         flags = self.config_flags.NAT_IS_INSIDE
1827         self.vapi.nat44_interface_add_del_feature(
1828             sw_if_index=self.pg0.sw_if_index,
1829             is_add=1)
1830         self.vapi.nat44_interface_add_del_feature(
1831             sw_if_index=self.pg0.sw_if_index,
1832             is_add=1, flags=flags)
1833         self.vapi.nat44_interface_add_del_feature(
1834             sw_if_index=self.pg6.sw_if_index,
1835             is_add=1)
1836         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1837         self.nat_add_static_mapping(
1838             self.pg0.remote_ip4,
1839             external_sw_if_index=self.pg0.sw_if_index,
1840             local_port=local_port,
1841             vrf_id=0,
1842             external_port=external_port,
1843             proto=IP_PROTOS.tcp,
1844             flags=flags
1845         )
1846
1847         # from client VRF1 to service VRF0
1848         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1849              IP(src=self.pg6.remote_ip4, dst=self.pg0.local_ip4) /
1850              TCP(sport=12346, dport=external_port))
1851         self.pg6.add_stream(p)
1852         self.pg_enable_capture(self.pg_interfaces)
1853         self.pg_start()
1854         capture = self.pg0.get_capture(1)
1855         p = capture[0]
1856         try:
1857             ip = p[IP]
1858             tcp = p[TCP]
1859             self.assertEqual(ip.dst, self.pg0.remote_ip4)
1860             self.assertEqual(tcp.dport, local_port)
1861             self.assert_packet_checksums_valid(p)
1862         except:
1863             self.logger.error(ppp("Unexpected or invalid packet:", p))
1864             raise
1865
1866         # from service VRF0 back to client VRF1
1867         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1868              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
1869              TCP(sport=local_port, dport=12346))
1870         self.pg0.add_stream(p)
1871         self.pg_enable_capture(self.pg_interfaces)
1872         self.pg_start()
1873         capture = self.pg6.get_capture(1)
1874         p = capture[0]
1875         try:
1876             ip = p[IP]
1877             tcp = p[TCP]
1878             self.assertEqual(ip.src, self.pg0.local_ip4)
1879             self.assertEqual(tcp.sport, external_port)
1880             self.assert_packet_checksums_valid(p)
1881         except:
1882             self.logger.error(ppp("Unexpected or invalid packet:", p))
1883             raise
1884
1885     def test_multiple_vrf_4(self):
1886         """ Multiple VRF - client in VRF0, service in VRF1 """
1887
1888         external_addr = '1.2.3.4'
1889         external_port = 80
1890         local_port = 8080
1891         port = 0
1892
1893         flags = self.config_flags.NAT_IS_INSIDE
1894         self.vapi.nat44_interface_add_del_feature(
1895             sw_if_index=self.pg0.sw_if_index,
1896             is_add=1)
1897         self.vapi.nat44_interface_add_del_feature(
1898             sw_if_index=self.pg0.sw_if_index,
1899             is_add=1, flags=flags)
1900         self.vapi.nat44_interface_add_del_feature(
1901             sw_if_index=self.pg5.sw_if_index,
1902             is_add=1)
1903         self.vapi.nat44_interface_add_del_feature(
1904             sw_if_index=self.pg5.sw_if_index,
1905             is_add=1, flags=flags)
1906         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1907         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1908                                     local_port, external_port, vrf_id=1,
1909                                     proto=IP_PROTOS.tcp, flags=flags)
1910
1911         # from client VRF0 to service VRF1
1912         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
1913              IP(src=self.pg0.remote_ip4, dst=external_addr) /
1914              TCP(sport=12347, dport=external_port))
1915         self.pg0.add_stream(p)
1916         self.pg_enable_capture(self.pg_interfaces)
1917         self.pg_start()
1918         capture = self.pg5.get_capture(1)
1919         p = capture[0]
1920         try:
1921             ip = p[IP]
1922             tcp = p[TCP]
1923             self.assertEqual(ip.dst, self.pg5.remote_ip4)
1924             self.assertEqual(tcp.dport, local_port)
1925             self.assert_packet_checksums_valid(p)
1926         except:
1927             self.logger.error(ppp("Unexpected or invalid packet:", p))
1928             raise
1929
1930         # from service VRF1 back to client VRF0
1931         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
1932              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
1933              TCP(sport=local_port, dport=12347))
1934         self.pg5.add_stream(p)
1935         self.pg_enable_capture(self.pg_interfaces)
1936         self.pg_start()
1937         capture = self.pg0.get_capture(1)
1938         p = capture[0]
1939         try:
1940             ip = p[IP]
1941             tcp = p[TCP]
1942             self.assertEqual(ip.src, external_addr)
1943             self.assertEqual(tcp.sport, external_port)
1944             self.assert_packet_checksums_valid(p)
1945         except:
1946             self.logger.error(ppp("Unexpected or invalid packet:", p))
1947             raise
1948
1949     def test_multiple_vrf_5(self):
1950         """ Multiple VRF - forwarding - no translation """
1951
1952         external_addr = '1.2.3.4'
1953         external_port = 80
1954         local_port = 8080
1955         port = 0
1956
1957         self.vapi.nat44_forwarding_enable_disable(enable=1)
1958         flags = self.config_flags.NAT_IS_INSIDE
1959         self.vapi.nat44_interface_add_del_feature(
1960             sw_if_index=self.pg0.sw_if_index,
1961             is_add=1)
1962         self.vapi.nat44_interface_add_del_feature(
1963             sw_if_index=self.pg0.sw_if_index,
1964             is_add=1, flags=flags)
1965         self.vapi.nat44_interface_add_del_feature(
1966             sw_if_index=self.pg5.sw_if_index,
1967             is_add=1)
1968         self.vapi.nat44_interface_add_del_feature(
1969             sw_if_index=self.pg5.sw_if_index,
1970             is_add=1, flags=flags)
1971         self.vapi.nat44_interface_add_del_feature(
1972             sw_if_index=self.pg6.sw_if_index,
1973             is_add=1)
1974         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
1975         self.nat_add_static_mapping(self.pg5.remote_ip4, external_addr,
1976                                     local_port, external_port, vrf_id=1,
1977                                     proto=IP_PROTOS.tcp, flags=flags)
1978         self.nat_add_static_mapping(
1979             self.pg0.remote_ip4,
1980             external_sw_if_index=self.pg0.sw_if_index,
1981             local_port=local_port,
1982             vrf_id=0,
1983             external_port=external_port,
1984             proto=IP_PROTOS.tcp,
1985             flags=flags
1986         )
1987
1988         # from client to server (both VRF1, no translation)
1989         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
1990              IP(src=self.pg6.remote_ip4, dst=self.pg5.remote_ip4) /
1991              TCP(sport=12348, dport=local_port))
1992         self.pg6.add_stream(p)
1993         self.pg_enable_capture(self.pg_interfaces)
1994         self.pg_start()
1995         capture = self.pg5.get_capture(1)
1996         p = capture[0]
1997         try:
1998             ip = p[IP]
1999             tcp = p[TCP]
2000             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2001             self.assertEqual(tcp.dport, local_port)
2002             self.assert_packet_checksums_valid(p)
2003         except:
2004             self.logger.error(ppp("Unexpected or invalid packet:", p))
2005             raise
2006
2007         # from server back to client (both VRF1, no translation)
2008         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2009              IP(src=self.pg5.remote_ip4, dst=self.pg6.remote_ip4) /
2010              TCP(sport=local_port, dport=12348))
2011         self.pg5.add_stream(p)
2012         self.pg_enable_capture(self.pg_interfaces)
2013         self.pg_start()
2014         capture = self.pg6.get_capture(1)
2015         p = capture[0]
2016         try:
2017             ip = p[IP]
2018             tcp = p[TCP]
2019             self.assertEqual(ip.src, self.pg5.remote_ip4)
2020             self.assertEqual(tcp.sport, local_port)
2021             self.assert_packet_checksums_valid(p)
2022         except:
2023             self.logger.error(ppp("Unexpected or invalid packet:", p))
2024             raise
2025
2026         # from client VRF1 to server VRF0 (no translation)
2027         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2028              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2029              TCP(sport=local_port, dport=12349))
2030         self.pg0.add_stream(p)
2031         self.pg_enable_capture(self.pg_interfaces)
2032         self.pg_start()
2033         capture = self.pg6.get_capture(1)
2034         p = capture[0]
2035         try:
2036             ip = p[IP]
2037             tcp = p[TCP]
2038             self.assertEqual(ip.src, self.pg0.remote_ip4)
2039             self.assertEqual(tcp.sport, local_port)
2040             self.assert_packet_checksums_valid(p)
2041         except:
2042             self.logger.error(ppp("Unexpected or invalid packet:", p))
2043             raise
2044
2045         # from server VRF0 back to client VRF1 (no translation)
2046         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2047              IP(src=self.pg0.remote_ip4, dst=self.pg6.remote_ip4) /
2048              TCP(sport=local_port, dport=12349))
2049         self.pg0.add_stream(p)
2050         self.pg_enable_capture(self.pg_interfaces)
2051         self.pg_start()
2052         capture = self.pg6.get_capture(1)
2053         p = capture[0]
2054         try:
2055             ip = p[IP]
2056             tcp = p[TCP]
2057             self.assertEqual(ip.src, self.pg0.remote_ip4)
2058             self.assertEqual(tcp.sport, local_port)
2059             self.assert_packet_checksums_valid(p)
2060         except:
2061             self.logger.error(ppp("Unexpected or invalid packet:", p))
2062             raise
2063
2064         # from client VRF0 to server VRF1 (no translation)
2065         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2066              IP(src=self.pg0.remote_ip4, dst=self.pg5.remote_ip4) /
2067              TCP(sport=12344, dport=local_port))
2068         self.pg0.add_stream(p)
2069         self.pg_enable_capture(self.pg_interfaces)
2070         self.pg_start()
2071         capture = self.pg5.get_capture(1)
2072         p = capture[0]
2073         try:
2074             ip = p[IP]
2075             tcp = p[TCP]
2076             self.assertEqual(ip.dst, self.pg5.remote_ip4)
2077             self.assertEqual(tcp.dport, local_port)
2078             self.assert_packet_checksums_valid(p)
2079         except:
2080             self.logger.error(ppp("Unexpected or invalid packet:", p))
2081             raise
2082
2083         # from server VRF1 back to client VRF0 (no translation)
2084         p = (Ether(src=self.pg5.remote_mac, dst=self.pg5.local_mac) /
2085              IP(src=self.pg5.remote_ip4, dst=self.pg0.remote_ip4) /
2086              TCP(sport=local_port, dport=12344))
2087         self.pg5.add_stream(p)
2088         self.pg_enable_capture(self.pg_interfaces)
2089         self.pg_start()
2090         capture = self.pg0.get_capture(1)
2091         p = capture[0]
2092         try:
2093             ip = p[IP]
2094             tcp = p[TCP]
2095             self.assertEqual(ip.src, self.pg5.remote_ip4)
2096             self.assertEqual(tcp.sport, local_port)
2097             self.assert_packet_checksums_valid(p)
2098         except:
2099             self.logger.error(ppp("Unexpected or invalid packet:", p))
2100             raise
2101
2102     def test_outside_address_distribution(self):
2103         """ Outside address distribution based on source address """
2104
2105         x = 100
2106         nat_addresses = []
2107
2108         for i in range(1, x):
2109             a = "10.0.0.%d" % i
2110             nat_addresses.append(a)
2111
2112         self.nat_add_inside_interface(self.pg0)
2113         self.nat_add_outside_interface(self.pg1)
2114
2115         self.vapi.nat44_add_del_address_range(
2116             first_ip_address=nat_addresses[0],
2117             last_ip_address=nat_addresses[-1],
2118             vrf_id=0xFFFFFFFF, is_add=1, flags=0)
2119
2120         self.pg0.generate_remote_hosts(x)
2121
2122         pkts = []
2123         for i in range(x):
2124             info = self.create_packet_info(self.pg0, self.pg1)
2125             payload = self.info_to_payload(info)
2126             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2127                  IP(src=self.pg0.remote_hosts[i].ip4,
2128                      dst=self.pg1.remote_ip4) /
2129                  UDP(sport=7000+i, dport=8000+i) /
2130                  Raw(payload))
2131             info.data = p
2132             pkts.append(p)
2133
2134         self.pg0.add_stream(pkts)
2135         self.pg_enable_capture(self.pg_interfaces)
2136         self.pg_start()
2137         recvd = self.pg1.get_capture(len(pkts))
2138         for p_recvd in recvd:
2139             payload_info = self.payload_to_info(p_recvd[Raw])
2140             packet_index = payload_info.index
2141             info = self._packet_infos[packet_index]
2142             self.assertTrue(info is not None)
2143             self.assertEqual(packet_index, info.index)
2144             p_sent = info.data
2145             packed = socket.inet_aton(p_sent[IP].src)
2146             numeric = struct.unpack("!L", packed)[0]
2147             numeric = socket.htonl(numeric)
2148             a = nat_addresses[(numeric-1) % len(nat_addresses)]
2149             self.assertEqual(
2150                 a, p_recvd[IP].src,
2151                 "Invalid packet (src IP %s translated to %s, but expected %s)"
2152                 % (p_sent[IP].src, p_recvd[IP].src, a))
2153
2154
2155 class TestNAT44EDMW(TestNAT44ED):
2156     """ NAT44ED MW Test Case """
2157     vpp_worker_count = 4
2158     max_sessions = 5000
2159
2160     def test_dynamic(self):
2161         """ NAT44ED dynamic translation test """
2162         pkt_count = 1500
2163         tcp_port_offset = 20
2164         udp_port_offset = 20
2165         icmp_id_offset = 20
2166
2167         self.nat_add_address(self.nat_addr)
2168         self.nat_add_inside_interface(self.pg0)
2169         self.nat_add_outside_interface(self.pg1)
2170
2171         # in2out
2172         tc1 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2173         uc1 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2174         ic1 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2175         dc1 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2176
2177         i2o_pkts = [[] for x in range(0, self.vpp_worker_count)]
2178
2179         for i in range(pkt_count):
2180             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2181                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2182                  TCP(sport=tcp_port_offset + i, dport=20))
2183             i2o_pkts[p[TCP].sport % self.vpp_worker_count].append(p)
2184
2185             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2186                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2187                  UDP(sport=udp_port_offset + i, dport=20))
2188             i2o_pkts[p[UDP].sport % self.vpp_worker_count].append(p)
2189
2190             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2191                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2192                  ICMP(id=icmp_id_offset + i, type='echo-request'))
2193             i2o_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2194
2195         for i in range(0, self.vpp_worker_count):
2196             if len(i2o_pkts[i]) > 0:
2197                 self.pg0.add_stream(i2o_pkts[i], worker=i)
2198
2199         self.pg_enable_capture(self.pg_interfaces)
2200         self.pg_start()
2201         capture = self.pg1.get_capture(pkt_count * 3, timeout=5)
2202
2203         if_idx = self.pg0.sw_if_index
2204         tc2 = self.statistics['/nat44-ed/in2out/slowpath/tcp']
2205         uc2 = self.statistics['/nat44-ed/in2out/slowpath/udp']
2206         ic2 = self.statistics['/nat44-ed/in2out/slowpath/icmp']
2207         dc2 = self.statistics['/nat44-ed/in2out/slowpath/drops']
2208
2209         self.assertEqual(
2210             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2211         self.assertEqual(
2212             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2213         self.assertEqual(
2214             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2215         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2216
2217         self.logger.info(self.vapi.cli("show trace"))
2218
2219         # out2in
2220         tc1 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2221         uc1 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2222         ic1 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2223         dc1 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2224
2225         recvd_tcp_ports = set()
2226         recvd_udp_ports = set()
2227         recvd_icmp_ids = set()
2228
2229         for p in capture:
2230             if TCP in p:
2231                 recvd_tcp_ports.add(p[TCP].sport)
2232             if UDP in p:
2233                 recvd_udp_ports.add(p[UDP].sport)
2234             if ICMP in p:
2235                 recvd_icmp_ids.add(p[ICMP].id)
2236
2237         recvd_tcp_ports = list(recvd_tcp_ports)
2238         recvd_udp_ports = list(recvd_udp_ports)
2239         recvd_icmp_ids = list(recvd_icmp_ids)
2240
2241         o2i_pkts = [[] for x in range(0, self.vpp_worker_count)]
2242         for i in range(pkt_count):
2243             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2244                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2245                  TCP(dport=choice(recvd_tcp_ports), sport=20))
2246             o2i_pkts[p[TCP].dport % self.vpp_worker_count].append(p)
2247
2248             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2249                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2250                  UDP(dport=choice(recvd_udp_ports), sport=20))
2251             o2i_pkts[p[UDP].dport % self.vpp_worker_count].append(p)
2252
2253             p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2254                  IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2255                  ICMP(id=choice(recvd_icmp_ids), type='echo-reply'))
2256             o2i_pkts[p[ICMP].id % self.vpp_worker_count].append(p)
2257
2258         for i in range(0, self.vpp_worker_count):
2259             if len(o2i_pkts[i]) > 0:
2260                 self.pg1.add_stream(o2i_pkts[i], worker=i)
2261
2262         self.pg_enable_capture(self.pg_interfaces)
2263         self.pg_start()
2264         capture = self.pg0.get_capture(pkt_count * 3)
2265         for packet in capture:
2266             try:
2267                 self.assert_packet_checksums_valid(packet)
2268                 self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2269                 if packet.haslayer(TCP):
2270                     self.assert_in_range(
2271                         packet[TCP].dport, tcp_port_offset,
2272                         tcp_port_offset + pkt_count, "dst TCP port")
2273                 elif packet.haslayer(UDP):
2274                     self.assert_in_range(
2275                         packet[UDP].dport, udp_port_offset,
2276                         udp_port_offset + pkt_count, "dst UDP port")
2277                 else:
2278                     self.assert_in_range(
2279                         packet[ICMP].id, icmp_id_offset,
2280                         icmp_id_offset + pkt_count, "ICMP id")
2281             except:
2282                 self.logger.error(ppp("Unexpected or invalid packet "
2283                                       "(inside network):", packet))
2284                 raise
2285
2286         if_idx = self.pg1.sw_if_index
2287         tc2 = self.statistics['/nat44-ed/out2in/fastpath/tcp']
2288         uc2 = self.statistics['/nat44-ed/out2in/fastpath/udp']
2289         ic2 = self.statistics['/nat44-ed/out2in/fastpath/icmp']
2290         dc2 = self.statistics['/nat44-ed/out2in/fastpath/drops']
2291
2292         self.assertEqual(
2293             tc2[:, if_idx].sum() - tc1[:, if_idx].sum(), pkt_count)
2294         self.assertEqual(
2295             uc2[:, if_idx].sum() - uc1[:, if_idx].sum(), pkt_count)
2296         self.assertEqual(
2297             ic2[:, if_idx].sum() - ic1[:, if_idx].sum(), pkt_count)
2298         self.assertEqual(dc2[:, if_idx].sum() - dc1[:, if_idx].sum(), 0)
2299
2300         sc = self.statistics['/nat44-ed/total-sessions']
2301         self.assertEqual(sc[:, 0].sum(), len(recvd_tcp_ports) +
2302                          len(recvd_udp_ports) + len(recvd_icmp_ids))
2303
2304     def test_frag_in_order(self):
2305         """ NAT44ED translate fragments arriving in order """
2306
2307         self.nat_add_address(self.nat_addr)
2308         self.nat_add_inside_interface(self.pg0)
2309         self.nat_add_outside_interface(self.pg1)
2310
2311         self.frag_in_order(proto=IP_PROTOS.tcp, ignore_port=True)
2312         self.frag_in_order(proto=IP_PROTOS.udp, ignore_port=True)
2313         self.frag_in_order(proto=IP_PROTOS.icmp, ignore_port=True)
2314
2315     def test_frag_in_order_do_not_translate(self):
2316         """ NAT44ED don't translate fragments arriving in order """
2317
2318         self.nat_add_address(self.nat_addr)
2319         self.nat_add_inside_interface(self.pg0)
2320         self.nat_add_outside_interface(self.pg1)
2321         self.vapi.nat44_forwarding_enable_disable(enable=True)
2322
2323         self.frag_in_order(proto=IP_PROTOS.tcp, dont_translate=True)
2324
2325     def test_frag_out_of_order(self):
2326         """ NAT44ED translate fragments arriving out of order """
2327
2328         self.nat_add_address(self.nat_addr)
2329         self.nat_add_inside_interface(self.pg0)
2330         self.nat_add_outside_interface(self.pg1)
2331
2332         self.frag_out_of_order(proto=IP_PROTOS.tcp, ignore_port=True)
2333         self.frag_out_of_order(proto=IP_PROTOS.udp, ignore_port=True)
2334         self.frag_out_of_order(proto=IP_PROTOS.icmp, ignore_port=True)
2335
2336     def test_frag_in_order_in_plus_out(self):
2337         """ NAT44ED in+out interface fragments in order """
2338
2339         in_port = self.random_port()
2340         out_port = self.random_port()
2341
2342         self.nat_add_address(self.nat_addr)
2343         self.nat_add_inside_interface(self.pg0)
2344         self.nat_add_outside_interface(self.pg0)
2345         self.nat_add_inside_interface(self.pg1)
2346         self.nat_add_outside_interface(self.pg1)
2347
2348         # add static mappings for server
2349         self.nat_add_static_mapping(self.server_addr,
2350                                     self.nat_addr,
2351                                     in_port,
2352                                     out_port,
2353                                     proto=IP_PROTOS.tcp)
2354         self.nat_add_static_mapping(self.server_addr,
2355                                     self.nat_addr,
2356                                     in_port,
2357                                     out_port,
2358                                     proto=IP_PROTOS.udp)
2359         self.nat_add_static_mapping(self.server_addr,
2360                                     self.nat_addr,
2361                                     proto=IP_PROTOS.icmp)
2362
2363         # run tests for each protocol
2364         self.frag_in_order_in_plus_out(self.server_addr,
2365                                        self.nat_addr,
2366                                        in_port,
2367                                        out_port,
2368                                        IP_PROTOS.tcp)
2369         self.frag_in_order_in_plus_out(self.server_addr,
2370                                        self.nat_addr,
2371                                        in_port,
2372                                        out_port,
2373                                        IP_PROTOS.udp)
2374         self.frag_in_order_in_plus_out(self.server_addr,
2375                                        self.nat_addr,
2376                                        in_port,
2377                                        out_port,
2378                                        IP_PROTOS.icmp)
2379
2380     def test_frag_out_of_order_in_plus_out(self):
2381         """ NAT44ED in+out interface fragments out of order """
2382
2383         in_port = self.random_port()
2384         out_port = self.random_port()
2385
2386         self.nat_add_address(self.nat_addr)
2387         self.nat_add_inside_interface(self.pg0)
2388         self.nat_add_outside_interface(self.pg0)
2389         self.nat_add_inside_interface(self.pg1)
2390         self.nat_add_outside_interface(self.pg1)
2391
2392         # add static mappings for server
2393         self.nat_add_static_mapping(self.server_addr,
2394                                     self.nat_addr,
2395                                     in_port,
2396                                     out_port,
2397                                     proto=IP_PROTOS.tcp)
2398         self.nat_add_static_mapping(self.server_addr,
2399                                     self.nat_addr,
2400                                     in_port,
2401                                     out_port,
2402                                     proto=IP_PROTOS.udp)
2403         self.nat_add_static_mapping(self.server_addr,
2404                                     self.nat_addr,
2405                                     proto=IP_PROTOS.icmp)
2406
2407         # run tests for each protocol
2408         self.frag_out_of_order_in_plus_out(self.server_addr,
2409                                            self.nat_addr,
2410                                            in_port,
2411                                            out_port,
2412                                            IP_PROTOS.tcp)
2413         self.frag_out_of_order_in_plus_out(self.server_addr,
2414                                            self.nat_addr,
2415                                            in_port,
2416                                            out_port,
2417                                            IP_PROTOS.udp)
2418         self.frag_out_of_order_in_plus_out(self.server_addr,
2419                                            self.nat_addr,
2420                                            in_port,
2421                                            out_port,
2422                                            IP_PROTOS.icmp)
2423
2424     def test_reass_hairpinning(self):
2425         """ NAT44ED fragments hairpinning """
2426
2427         server_addr = self.pg0.remote_hosts[1].ip4
2428
2429         host_in_port = self.random_port()
2430         server_in_port = self.random_port()
2431         server_out_port = self.random_port()
2432
2433         self.nat_add_address(self.nat_addr)
2434         self.nat_add_inside_interface(self.pg0)
2435         self.nat_add_outside_interface(self.pg1)
2436
2437         # add static mapping for server
2438         self.nat_add_static_mapping(server_addr, self.nat_addr,
2439                                     server_in_port, server_out_port,
2440                                     proto=IP_PROTOS.tcp)
2441         self.nat_add_static_mapping(server_addr, self.nat_addr,
2442                                     server_in_port, server_out_port,
2443                                     proto=IP_PROTOS.udp)
2444         self.nat_add_static_mapping(server_addr, self.nat_addr)
2445
2446         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2447                                host_in_port, proto=IP_PROTOS.tcp,
2448                                ignore_port=True)
2449         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2450                                host_in_port, proto=IP_PROTOS.udp,
2451                                ignore_port=True)
2452         self.reass_hairpinning(server_addr, server_in_port, server_out_port,
2453                                host_in_port, proto=IP_PROTOS.icmp,
2454                                ignore_port=True)
2455
2456     def test_session_limit_per_vrf(self):
2457         """ NAT44ED per vrf session limit """
2458
2459         inside = self.pg0
2460         inside_vrf10 = self.pg2
2461         outside = self.pg1
2462
2463         limit = 5
2464
2465         # 2 interfaces pg0, pg1 (vrf10, limit 1 tcp session)
2466         # non existing vrf_id makes process core dump
2467         self.vapi.nat44_set_session_limit(session_limit=limit, vrf_id=10)
2468
2469         self.nat_add_inside_interface(inside)
2470         self.nat_add_inside_interface(inside_vrf10)
2471         self.nat_add_outside_interface(outside)
2472
2473         # vrf independent
2474         self.nat_add_interface_address(outside)
2475
2476         # BUG: causing core dump - when bad vrf_id is specified
2477         # self.nat_add_address(outside.local_ip4, vrf_id=20)
2478
2479         stream = self.create_tcp_stream(inside_vrf10, outside, limit * 2)
2480         inside_vrf10.add_stream(stream)
2481
2482         self.pg_enable_capture(self.pg_interfaces)
2483         self.pg_start()
2484
2485         capture = outside.get_capture(limit)
2486
2487         stream = self.create_tcp_stream(inside, outside, limit * 2)
2488         inside.add_stream(stream)
2489
2490         self.pg_enable_capture(self.pg_interfaces)
2491         self.pg_start()
2492
2493         capture = outside.get_capture(len(stream))
2494
2495     def test_show_max_translations(self):
2496         """ NAT44ED API test - max translations per thread """
2497         nat_config = self.vapi.nat_show_config_2()
2498         self.assertEqual(self.max_sessions,
2499                          nat_config.max_translations_per_thread)
2500
2501     def test_lru_cleanup(self):
2502         """ NAT44ED LRU cleanup algorithm """
2503
2504         self.nat_add_address(self.nat_addr)
2505         self.nat_add_inside_interface(self.pg0)
2506         self.nat_add_outside_interface(self.pg1)
2507
2508         self.vapi.nat_set_timeouts(
2509             udp=1, tcp_established=7440, tcp_transitory=30, icmp=1)
2510
2511         tcp_port_out = self.init_tcp_session(self.pg0, self.pg1, 2000, 80)
2512         pkts = []
2513         for i in range(0, self.max_sessions - 1):
2514             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2515                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2516                  UDP(sport=7000+i, dport=80))
2517             pkts.append(p)
2518
2519         self.pg0.add_stream(pkts)
2520         self.pg_enable_capture(self.pg_interfaces)
2521         self.pg_start()
2522         self.pg1.get_capture(len(pkts))
2523         self.virtual_sleep(1.5, "wait for timeouts")
2524
2525         pkts = []
2526         for i in range(0, self.max_sessions - 1):
2527             p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2528                  IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4, ttl=64) /
2529                  ICMP(id=8000+i, type='echo-request'))
2530             pkts.append(p)
2531
2532         self.pg0.add_stream(pkts)
2533         self.pg_enable_capture(self.pg_interfaces)
2534         self.pg_start()
2535         self.pg1.get_capture(len(pkts))
2536
2537     def test_session_rst_timeout(self):
2538         """ NAT44ED session RST timeouts """
2539
2540         self.nat_add_address(self.nat_addr)
2541         self.nat_add_inside_interface(self.pg0)
2542         self.nat_add_outside_interface(self.pg1)
2543
2544         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2545                                    tcp_transitory=5, icmp=60)
2546
2547         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2548                               self.tcp_external_port)
2549         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2550              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2551              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2552                  flags="R"))
2553         self.send_and_expect(self.pg0, p, self.pg1)
2554
2555         self.virtual_sleep(6)
2556
2557         # The session is already closed
2558         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2559              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2560              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2561                  flags="P"))
2562         self.send_and_assert_no_replies(self.pg0, p, self.pg1)
2563
2564         # The session can be re-opened
2565         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2566              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2567              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2568                  flags="S"))
2569         self.send_and_expect(self.pg0, p, self.pg1)
2570
2571     def test_session_rst_established_timeout(self):
2572         """ NAT44ED session RST timeouts """
2573
2574         self.nat_add_address(self.nat_addr)
2575         self.nat_add_inside_interface(self.pg0)
2576         self.nat_add_outside_interface(self.pg1)
2577
2578         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
2579                                    tcp_transitory=5, icmp=60)
2580
2581         self.init_tcp_session(self.pg0, self.pg1, self.tcp_port_in,
2582                               self.tcp_external_port)
2583
2584         # Wait at least the transitory time, the session is in established
2585         # state anyway. RST followed by a data packet should keep it
2586         # established.
2587         self.virtual_sleep(6)
2588         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2589              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2590              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2591                  flags="R"))
2592         self.send_and_expect(self.pg0, p, self.pg1)
2593
2594         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2595              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2596              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2597                  flags="P"))
2598         self.send_and_expect(self.pg0, p, self.pg1)
2599
2600         # State is established, session should be still open after 6 seconds
2601         self.virtual_sleep(6)
2602
2603         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2604              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2605              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2606                  flags="R"))
2607         self.send_and_expect(self.pg0, p, self.pg1)
2608
2609         # State is transitory, session should be closed after 6 seconds
2610         self.virtual_sleep(6)
2611
2612         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2613              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2614              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
2615                  flags="P"))
2616         self.send_and_assert_no_replies(self.pg0, p, self.pg1)
2617
2618     def test_dynamic_out_of_ports(self):
2619         """ NAT44ED dynamic translation test: out of ports """
2620
2621         self.nat_add_inside_interface(self.pg0)
2622         self.nat_add_outside_interface(self.pg1)
2623
2624         # in2out and no NAT addresses added
2625         err_old = self.statistics.get_err_counter(
2626             '/err/nat44-ed-in2out-slowpath/out of ports')
2627
2628         pkts = self.create_stream_in(self.pg0, self.pg1)
2629         self.pg0.add_stream(pkts)
2630         self.pg_enable_capture(self.pg_interfaces)
2631         self.pg_start()
2632         self.pg1.get_capture(0, timeout=1)
2633
2634         err_new = self.statistics.get_err_counter(
2635             '/err/nat44-ed-in2out-slowpath/out of ports')
2636
2637         self.assertEqual(err_new - err_old, len(pkts))
2638
2639         # in2out after NAT addresses added
2640         self.nat_add_address(self.nat_addr)
2641
2642         err_old = self.statistics.get_err_counter(
2643             '/err/nat44-ed-in2out-slowpath/out of ports')
2644
2645         pkts = self.create_stream_in(self.pg0, self.pg1)
2646         self.pg0.add_stream(pkts)
2647         self.pg_enable_capture(self.pg_interfaces)
2648         self.pg_start()
2649         capture = self.pg1.get_capture(len(pkts))
2650         self.verify_capture_out(capture, ignore_port=True)
2651
2652         err_new = self.statistics.get_err_counter(
2653             '/err/nat44-ed-in2out-slowpath/out of ports')
2654
2655         self.assertEqual(err_new, err_old)
2656
2657     def test_unknown_proto(self):
2658         """ NAT44ED translate packet with unknown protocol """
2659
2660         self.nat_add_address(self.nat_addr)
2661         self.nat_add_inside_interface(self.pg0)
2662         self.nat_add_outside_interface(self.pg1)
2663
2664         # in2out
2665         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2666              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2667              TCP(sport=self.tcp_port_in, dport=20))
2668         self.pg0.add_stream(p)
2669         self.pg_enable_capture(self.pg_interfaces)
2670         self.pg_start()
2671         p = self.pg1.get_capture(1)
2672
2673         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
2674              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2675              GRE() /
2676              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2677              TCP(sport=1234, dport=1234))
2678         self.pg0.add_stream(p)
2679         self.pg_enable_capture(self.pg_interfaces)
2680         self.pg_start()
2681         p = self.pg1.get_capture(1)
2682         packet = p[0]
2683         try:
2684             self.assertEqual(packet[IP].src, self.nat_addr)
2685             self.assertEqual(packet[IP].dst, self.pg1.remote_ip4)
2686             self.assertEqual(packet.haslayer(GRE), 1)
2687             self.assert_packet_checksums_valid(packet)
2688         except:
2689             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2690             raise
2691
2692         # out2in
2693         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
2694              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
2695              GRE() /
2696              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2697              TCP(sport=1234, dport=1234))
2698         self.pg1.add_stream(p)
2699         self.pg_enable_capture(self.pg_interfaces)
2700         self.pg_start()
2701         p = self.pg0.get_capture(1)
2702         packet = p[0]
2703         try:
2704             self.assertEqual(packet[IP].src, self.pg1.remote_ip4)
2705             self.assertEqual(packet[IP].dst, self.pg0.remote_ip4)
2706             self.assertEqual(packet.haslayer(GRE), 1)
2707             self.assert_packet_checksums_valid(packet)
2708         except:
2709             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2710             raise
2711
2712     def test_hairpinning_unknown_proto(self):
2713         """ NAT44ED translate packet with unknown protocol - hairpinning """
2714         host = self.pg0.remote_hosts[0]
2715         server = self.pg0.remote_hosts[1]
2716         host_in_port = 1234
2717         server_out_port = 8765
2718         server_nat_ip = "10.0.0.11"
2719
2720         self.nat_add_address(self.nat_addr)
2721         self.nat_add_inside_interface(self.pg0)
2722         self.nat_add_outside_interface(self.pg1)
2723
2724         # add static mapping for server
2725         self.nat_add_static_mapping(server.ip4, server_nat_ip)
2726
2727         # host to server
2728         p = (Ether(src=host.mac, dst=self.pg0.local_mac) /
2729              IP(src=host.ip4, dst=server_nat_ip) /
2730              TCP(sport=host_in_port, dport=server_out_port))
2731         self.pg0.add_stream(p)
2732         self.pg_enable_capture(self.pg_interfaces)
2733         self.pg_start()
2734         self.pg0.get_capture(1)
2735
2736         p = (Ether(dst=self.pg0.local_mac, src=host.mac) /
2737              IP(src=host.ip4, dst=server_nat_ip) /
2738              GRE() /
2739              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2740              TCP(sport=1234, dport=1234))
2741         self.pg0.add_stream(p)
2742         self.pg_enable_capture(self.pg_interfaces)
2743         self.pg_start()
2744         p = self.pg0.get_capture(1)
2745         packet = p[0]
2746         try:
2747             self.assertEqual(packet[IP].src, self.nat_addr)
2748             self.assertEqual(packet[IP].dst, server.ip4)
2749             self.assertEqual(packet.haslayer(GRE), 1)
2750             self.assert_packet_checksums_valid(packet)
2751         except:
2752             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2753             raise
2754
2755         # server to host
2756         p = (Ether(dst=self.pg0.local_mac, src=server.mac) /
2757              IP(src=server.ip4, dst=self.nat_addr) /
2758              GRE() /
2759              IP(src=self.pg2.remote_ip4, dst=self.pg2.remote_ip4) /
2760              TCP(sport=1234, dport=1234))
2761         self.pg0.add_stream(p)
2762         self.pg_enable_capture(self.pg_interfaces)
2763         self.pg_start()
2764         p = self.pg0.get_capture(1)
2765         packet = p[0]
2766         try:
2767             self.assertEqual(packet[IP].src, server_nat_ip)
2768             self.assertEqual(packet[IP].dst, host.ip4)
2769             self.assertEqual(packet.haslayer(GRE), 1)
2770             self.assert_packet_checksums_valid(packet)
2771         except:
2772             self.logger.error(ppp("Unexpected or invalid packet:", packet))
2773             raise
2774
2775     def test_output_feature_and_service(self):
2776         """ NAT44ED interface output feature and services """
2777         external_addr = '1.2.3.4'
2778         external_port = 80
2779         local_port = 8080
2780
2781         self.vapi.nat44_forwarding_enable_disable(enable=1)
2782         self.nat_add_address(self.nat_addr)
2783         flags = self.config_flags.NAT_IS_ADDR_ONLY
2784         self.vapi.nat44_add_del_identity_mapping(
2785             ip_address=self.pg1.remote_ip4, sw_if_index=0xFFFFFFFF,
2786             flags=flags, is_add=1)
2787         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2788         self.nat_add_static_mapping(self.pg0.remote_ip4, external_addr,
2789                                     local_port, external_port,
2790                                     proto=IP_PROTOS.tcp, flags=flags)
2791
2792         self.nat_add_inside_interface(self.pg0)
2793         self.nat_add_outside_interface(self.pg0)
2794         self.vapi.nat44_ed_add_del_output_interface(
2795             sw_if_index=self.pg1.sw_if_index, is_add=1)
2796
2797         # from client to service
2798         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2799              IP(src=self.pg1.remote_ip4, dst=external_addr) /
2800              TCP(sport=12345, dport=external_port))
2801         self.pg1.add_stream(p)
2802         self.pg_enable_capture(self.pg_interfaces)
2803         self.pg_start()
2804         capture = self.pg0.get_capture(1)
2805         p = capture[0]
2806         try:
2807             ip = p[IP]
2808             tcp = p[TCP]
2809             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2810             self.assertEqual(tcp.dport, local_port)
2811             self.assert_packet_checksums_valid(p)
2812         except:
2813             self.logger.error(ppp("Unexpected or invalid packet:", p))
2814             raise
2815
2816         # from service back to client
2817         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2818              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
2819              TCP(sport=local_port, dport=12345))
2820         self.pg0.add_stream(p)
2821         self.pg_enable_capture(self.pg_interfaces)
2822         self.pg_start()
2823         capture = self.pg1.get_capture(1)
2824         p = capture[0]
2825         try:
2826             ip = p[IP]
2827             tcp = p[TCP]
2828             self.assertEqual(ip.src, external_addr)
2829             self.assertEqual(tcp.sport, external_port)
2830             self.assert_packet_checksums_valid(p)
2831         except:
2832             self.logger.error(ppp("Unexpected or invalid packet:", p))
2833             raise
2834
2835         # from local network host to external network
2836         pkts = self.create_stream_in(self.pg0, self.pg1)
2837         self.pg0.add_stream(pkts)
2838         self.pg_enable_capture(self.pg_interfaces)
2839         self.pg_start()
2840         capture = self.pg1.get_capture(len(pkts))
2841         self.verify_capture_out(capture, ignore_port=True)
2842         pkts = self.create_stream_in(self.pg0, self.pg1)
2843         self.pg0.add_stream(pkts)
2844         self.pg_enable_capture(self.pg_interfaces)
2845         self.pg_start()
2846         capture = self.pg1.get_capture(len(pkts))
2847         self.verify_capture_out(capture, ignore_port=True)
2848
2849         # from external network back to local network host
2850         pkts = self.create_stream_out(self.pg1)
2851         self.pg1.add_stream(pkts)
2852         self.pg_enable_capture(self.pg_interfaces)
2853         self.pg_start()
2854         capture = self.pg0.get_capture(len(pkts))
2855         self.verify_capture_in(capture, self.pg0)
2856
2857     def test_output_feature_and_service3(self):
2858         """ NAT44ED interface output feature and DST NAT """
2859         external_addr = '1.2.3.4'
2860         external_port = 80
2861         local_port = 8080
2862
2863         self.vapi.nat44_forwarding_enable_disable(enable=1)
2864         self.nat_add_address(self.nat_addr)
2865         flags = self.config_flags.NAT_IS_OUT2IN_ONLY
2866         self.nat_add_static_mapping(self.pg1.remote_ip4, external_addr,
2867                                     local_port, external_port,
2868                                     proto=IP_PROTOS.tcp, flags=flags)
2869
2870         self.nat_add_inside_interface(self.pg0)
2871         self.nat_add_outside_interface(self.pg0)
2872         self.vapi.nat44_ed_add_del_output_interface(
2873             sw_if_index=self.pg1.sw_if_index, is_add=1)
2874
2875         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
2876              IP(src=self.pg0.remote_ip4, dst=external_addr) /
2877              TCP(sport=12345, dport=external_port))
2878         self.pg0.add_stream(p)
2879         self.pg_enable_capture(self.pg_interfaces)
2880         self.pg_start()
2881         capture = self.pg1.get_capture(1)
2882         p = capture[0]
2883         try:
2884             ip = p[IP]
2885             tcp = p[TCP]
2886             self.assertEqual(ip.src, self.pg0.remote_ip4)
2887             self.assertEqual(tcp.sport, 12345)
2888             self.assertEqual(ip.dst, self.pg1.remote_ip4)
2889             self.assertEqual(tcp.dport, local_port)
2890             self.assert_packet_checksums_valid(p)
2891         except:
2892             self.logger.error(ppp("Unexpected or invalid packet:", p))
2893             raise
2894
2895         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2896              IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
2897              TCP(sport=local_port, dport=12345))
2898         self.pg1.add_stream(p)
2899         self.pg_enable_capture(self.pg_interfaces)
2900         self.pg_start()
2901         capture = self.pg0.get_capture(1)
2902         p = capture[0]
2903         try:
2904             ip = p[IP]
2905             tcp = p[TCP]
2906             self.assertEqual(ip.src, external_addr)
2907             self.assertEqual(tcp.sport, external_port)
2908             self.assertEqual(ip.dst, self.pg0.remote_ip4)
2909             self.assertEqual(tcp.dport, 12345)
2910             self.assert_packet_checksums_valid(p)
2911         except:
2912             self.logger.error(ppp("Unexpected or invalid packet:", p))
2913             raise
2914
2915     def test_self_twice_nat_lb_negative(self):
2916         """ NAT44ED Self Twice NAT local service load balancing (negative test)
2917         """
2918         self.twice_nat_common(lb=True, self_twice_nat=True, same_pg=True,
2919                               client_id=2)
2920
2921     def test_self_twice_nat_negative(self):
2922         """ NAT44ED Self Twice NAT (negative test) """
2923         self.twice_nat_common(self_twice_nat=True)
2924
2925     def test_static_lb_multi_clients(self):
2926         """ NAT44ED local service load balancing - multiple clients"""
2927
2928         external_addr = self.nat_addr
2929         external_port = 80
2930         local_port = 8080
2931         server1 = self.pg0.remote_hosts[0]
2932         server2 = self.pg0.remote_hosts[1]
2933         server3 = self.pg0.remote_hosts[2]
2934
2935         locals = [{'addr': server1.ip4,
2936                    'port': local_port,
2937                    'probability': 90,
2938                    'vrf_id': 0},
2939                   {'addr': server2.ip4,
2940                    'port': local_port,
2941                    'probability': 10,
2942                    'vrf_id': 0}]
2943
2944         flags = self.config_flags.NAT_IS_INSIDE
2945         self.vapi.nat44_interface_add_del_feature(
2946             sw_if_index=self.pg0.sw_if_index,
2947             flags=flags, is_add=1)
2948         self.vapi.nat44_interface_add_del_feature(
2949             sw_if_index=self.pg1.sw_if_index,
2950             is_add=1)
2951
2952         self.nat_add_address(self.nat_addr)
2953         self.vapi.nat44_add_del_lb_static_mapping(is_add=1,
2954                                                   external_addr=external_addr,
2955                                                   external_port=external_port,
2956                                                   protocol=IP_PROTOS.tcp,
2957                                                   local_num=len(locals),
2958                                                   locals=locals)
2959
2960         server1_n = 0
2961         server2_n = 0
2962         clients = ip4_range(self.pg1.remote_ip4, 10, 50)
2963         pkts = []
2964         for client in clients:
2965             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
2966                  IP(src=client, dst=self.nat_addr) /
2967                  TCP(sport=12345, dport=external_port))
2968             pkts.append(p)
2969         self.pg1.add_stream(pkts)
2970         self.pg_enable_capture(self.pg_interfaces)
2971         self.pg_start()
2972         capture = self.pg0.get_capture(len(pkts))
2973         for p in capture:
2974             if p[IP].dst == server1.ip4:
2975                 server1_n += 1
2976             else:
2977                 server2_n += 1
2978         self.assertGreaterEqual(server1_n, server2_n)
2979
2980         local = {
2981             'addr': server3.ip4,
2982             'port': local_port,
2983             'probability': 20,
2984             'vrf_id': 0
2985         }
2986
2987         # add new back-end
2988         self.vapi.nat44_lb_static_mapping_add_del_local(
2989             is_add=1,
2990             external_addr=external_addr,
2991             external_port=external_port,
2992             local=local,
2993             protocol=IP_PROTOS.tcp)
2994         server1_n = 0
2995         server2_n = 0
2996         server3_n = 0
2997         clients = ip4_range(self.pg1.remote_ip4, 60, 110)
2998         pkts = []
2999         for client in clients:
3000             p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3001                  IP(src=client, dst=self.nat_addr) /
3002                  TCP(sport=12346, dport=external_port))
3003             pkts.append(p)
3004         self.assertGreater(len(pkts), 0)
3005         self.pg1.add_stream(pkts)
3006         self.pg_enable_capture(self.pg_interfaces)
3007         self.pg_start()
3008         capture = self.pg0.get_capture(len(pkts))
3009         for p in capture:
3010             if p[IP].dst == server1.ip4:
3011                 server1_n += 1
3012             elif p[IP].dst == server2.ip4:
3013                 server2_n += 1
3014             else:
3015                 server3_n += 1
3016         self.assertGreater(server1_n, 0)
3017         self.assertGreater(server2_n, 0)
3018         self.assertGreater(server3_n, 0)
3019
3020         local = {
3021             'addr': server2.ip4,
3022             'port': local_port,
3023             'probability': 10,
3024             'vrf_id': 0
3025         }
3026
3027         # remove one back-end
3028         self.vapi.nat44_lb_static_mapping_add_del_local(
3029             is_add=0,
3030             external_addr=external_addr,
3031             external_port=external_port,
3032             local=local,
3033             protocol=IP_PROTOS.tcp)
3034         server1_n = 0
3035         server2_n = 0
3036         server3_n = 0
3037         self.pg1.add_stream(pkts)
3038         self.pg_enable_capture(self.pg_interfaces)
3039         self.pg_start()
3040         capture = self.pg0.get_capture(len(pkts))
3041         for p in capture:
3042             if p[IP].dst == server1.ip4:
3043                 server1_n += 1
3044             elif p[IP].dst == server2.ip4:
3045                 server2_n += 1
3046             else:
3047                 server3_n += 1
3048         self.assertGreater(server1_n, 0)
3049         self.assertEqual(server2_n, 0)
3050         self.assertGreater(server3_n, 0)
3051
3052     # put zzz in front of syslog test name so that it runs as a last test
3053     # setting syslog sender cannot be undone and if it is set, it messes
3054     # with self.send_and_assert_no_replies functionality
3055     def test_zzz_syslog_sess(self):
3056         """ NAT44ED Test syslog session creation and deletion """
3057         self.vapi.syslog_set_filter(
3058             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3059         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3060
3061         self.nat_add_address(self.nat_addr)
3062         self.nat_add_inside_interface(self.pg0)
3063         self.nat_add_outside_interface(self.pg1)
3064
3065         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3066              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3067              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3068         self.pg0.add_stream(p)
3069         self.pg_enable_capture(self.pg_interfaces)
3070         self.pg_start()
3071         capture = self.pg1.get_capture(1)
3072         self.tcp_port_out = capture[0][TCP].sport
3073         capture = self.pg3.get_capture(1)
3074         self.verify_syslog_sess(capture[0][Raw].load, 'SADD')
3075
3076         self.pg_enable_capture(self.pg_interfaces)
3077         self.pg_start()
3078         self.nat_add_address(self.nat_addr, is_add=0)
3079         capture = self.pg3.get_capture(1)
3080         self.verify_syslog_sess(capture[0][Raw].load, 'SDEL')
3081
3082     # put zzz in front of syslog test name so that it runs as a last test
3083     # setting syslog sender cannot be undone and if it is set, it messes
3084     # with self.send_and_assert_no_replies functionality
3085     def test_zzz_syslog_sess_reopen(self):
3086         """ Syslog events for session reopen """
3087         self.vapi.syslog_set_filter(
3088             self.syslog_severity.SYSLOG_API_SEVERITY_INFO)
3089         self.vapi.syslog_set_sender(self.pg3.local_ip4, self.pg3.remote_ip4)
3090
3091         self.nat_add_address(self.nat_addr)
3092         self.nat_add_inside_interface(self.pg0)
3093         self.nat_add_outside_interface(self.pg1)
3094
3095         # SYN in2out
3096         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3097              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3098              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3099         capture = self.send_and_expect(self.pg0, p, self.pg1)[0]
3100         self.tcp_port_out = capture[0][TCP].sport
3101         capture = self.pg3.get_capture(1)
3102         self.verify_syslog_sess(capture[0][Raw].load, 'SADD')
3103
3104         # SYN out2in
3105         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
3106              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3107              TCP(sport=self.tcp_external_port, dport=self.tcp_port_out))
3108         self.send_and_expect(self.pg1, p, self.pg0)
3109
3110         # FIN in2out
3111         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3112              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3113              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
3114                  flags="F"))
3115         self.send_and_expect(self.pg0, p, self.pg1)
3116
3117         # FIN out2in
3118         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
3119              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3120              TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
3121                  flags="F"))
3122         self.send_and_expect(self.pg1, p, self.pg0)
3123
3124         # SYN in2out
3125         p = (Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
3126              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3127              TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
3128         self.send_and_expect(self.pg0, p, self.pg1)
3129
3130         # SYN out2in
3131         p = (Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
3132              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3133              TCP(sport=self.tcp_external_port, dport=self.tcp_port_out))
3134         self.send_and_expect(self.pg1, p, self.pg0)
3135
3136         # 2 records should be produced - first one del & add
3137         capture = self.pg3.get_capture(2)
3138         self.verify_syslog_sess(capture[0][Raw].load, 'SDEL')
3139         self.verify_syslog_sess(capture[1][Raw].load, 'SADD')
3140
3141     def test_twice_nat_interface_addr(self):
3142         """ NAT44ED Acquire twice NAT addresses from interface """
3143         flags = self.config_flags.NAT_IS_TWICE_NAT
3144         self.vapi.nat44_add_del_interface_addr(
3145             sw_if_index=self.pg11.sw_if_index,
3146             flags=flags, is_add=1)
3147
3148         # no address in NAT pool
3149         adresses = self.vapi.nat44_address_dump()
3150         self.assertEqual(0, len(adresses))
3151
3152         # configure interface address and check NAT address pool
3153         self.pg11.config_ip4()
3154         adresses = self.vapi.nat44_address_dump()
3155         self.assertEqual(1, len(adresses))
3156         self.assertEqual(str(adresses[0].ip_address),
3157                          self.pg11.local_ip4)
3158         self.assertEqual(adresses[0].flags, flags)
3159
3160         # remove interface address and check NAT address pool
3161         self.pg11.unconfig_ip4()
3162         adresses = self.vapi.nat44_address_dump()
3163         self.assertEqual(0, len(adresses))
3164
3165     def test_output_feature_stateful_acl(self):
3166         """ NAT44ED output feature works with stateful ACL """
3167
3168         self.nat_add_address(self.nat_addr)
3169         self.vapi.nat44_ed_add_del_output_interface(
3170             sw_if_index=self.pg1.sw_if_index, is_add=1)
3171
3172         # First ensure that the NAT is working sans ACL
3173
3174         # send packets out2in, no sessions yet so packets should drop
3175         pkts_out2in = self.create_stream_out(self.pg1)
3176         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3177
3178         # send packets into inside intf, ensure received via outside intf
3179         pkts_in2out = self.create_stream_in(self.pg0, self.pg1)
3180         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3181                                        len(pkts_in2out))
3182         self.verify_capture_out(capture, ignore_port=True)
3183
3184         # send out2in again, with sessions created it should work now
3185         pkts_out2in = self.create_stream_out(self.pg1)
3186         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3187                                        len(pkts_out2in))
3188         self.verify_capture_in(capture, self.pg0)
3189
3190         # Create an ACL blocking everything
3191         out2in_deny_rule = AclRule(is_permit=0)
3192         out2in_acl = VppAcl(self, rules=[out2in_deny_rule])
3193         out2in_acl.add_vpp_config()
3194
3195         # create an ACL to permit/reflect everything
3196         in2out_reflect_rule = AclRule(is_permit=2)
3197         in2out_acl = VppAcl(self, rules=[in2out_reflect_rule])
3198         in2out_acl.add_vpp_config()
3199
3200         # apply as input acl on interface and confirm it blocks everything
3201         acl_if = VppAclInterface(self, sw_if_index=self.pg1.sw_if_index,
3202                                  n_input=1, acls=[out2in_acl])
3203         acl_if.add_vpp_config()
3204         self.send_and_assert_no_replies(self.pg1, pkts_out2in)
3205
3206         # apply output acl
3207         acl_if.acls = [out2in_acl, in2out_acl]
3208         acl_if.add_vpp_config()
3209         # send in2out to generate ACL state (NAT state was created earlier)
3210         capture = self.send_and_expect(self.pg0, pkts_in2out, self.pg1,
3211                                        len(pkts_in2out))
3212         self.verify_capture_out(capture, ignore_port=True)
3213
3214         # send out2in again. ACL state exists so it should work now.
3215         # TCP packets with the syn flag set also need the ack flag
3216         for p in pkts_out2in:
3217             if p.haslayer(TCP) and p[TCP].flags & 0x02:
3218                 p[TCP].flags |= 0x10
3219         capture = self.send_and_expect(self.pg1, pkts_out2in, self.pg0,
3220                                        len(pkts_out2in))
3221         self.verify_capture_in(capture, self.pg0)
3222         self.logger.info(self.vapi.cli("show trace"))
3223
3224     def test_tcp_close(self):
3225         """ NAT44ED Close TCP session from inside network - output feature """
3226         old_timeouts = self.vapi.nat_get_timeouts()
3227         new_transitory = 2
3228         self.vapi.nat_set_timeouts(
3229             udp=old_timeouts.udp,
3230             tcp_established=old_timeouts.tcp_established,
3231             icmp=old_timeouts.icmp,
3232             tcp_transitory=new_transitory)
3233
3234         self.vapi.nat44_forwarding_enable_disable(enable=1)
3235         self.nat_add_address(self.pg1.local_ip4)
3236         twice_nat_addr = '10.0.1.3'
3237         service_ip = '192.168.16.150'
3238         self.nat_add_address(twice_nat_addr, twice_nat=1)
3239
3240         flags = self.config_flags.NAT_IS_INSIDE
3241         self.vapi.nat44_interface_add_del_feature(
3242             sw_if_index=self.pg0.sw_if_index,
3243             is_add=1)
3244         self.vapi.nat44_interface_add_del_feature(
3245             sw_if_index=self.pg0.sw_if_index,
3246             flags=flags, is_add=1)
3247         self.vapi.nat44_ed_add_del_output_interface(
3248             is_add=1,
3249             sw_if_index=self.pg1.sw_if_index)
3250
3251         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3252                  self.config_flags.NAT_IS_TWICE_NAT)
3253         self.nat_add_static_mapping(self.pg0.remote_ip4,
3254                                     service_ip, 80, 80,
3255                                     proto=IP_PROTOS.tcp,
3256                                     flags=flags)
3257         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3258         start_sessnum = len(sessions)
3259
3260         # SYN packet out->in
3261         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3262              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3263              TCP(sport=33898, dport=80, flags="S"))
3264         capture = self.send_and_expect(self.pg1, p, self.pg0, n_rx=1)
3265         p = capture[0]
3266         tcp_port = p[TCP].sport
3267
3268         # SYN + ACK packet in->out
3269         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3270              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3271              TCP(sport=80, dport=tcp_port, flags="SA"))
3272         self.send_and_expect(self.pg0, p, self.pg1, n_rx=1)
3273
3274         # ACK packet out->in
3275         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3276              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3277              TCP(sport=33898, dport=80, flags="A"))
3278         self.send_and_expect(self.pg1, p, self.pg0, n_rx=1)
3279
3280         # FIN packet in -> out
3281         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3282              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3283              TCP(sport=80, dport=tcp_port, flags="FA", seq=100, ack=300))
3284         self.send_and_expect(self.pg0, p, self.pg1, n_rx=1)
3285
3286         # FIN+ACK packet out -> in
3287         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3288              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3289              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3290         self.send_and_expect(self.pg1, p, self.pg0, n_rx=1)
3291
3292         # ACK packet in -> out
3293         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3294              IP(src=self.pg0.remote_ip4, dst=twice_nat_addr) /
3295              TCP(sport=80, dport=tcp_port, flags="A", seq=101, ack=301))
3296         self.send_and_expect(self.pg0, p, self.pg1, n_rx=1)
3297
3298         # session now in transitory timeout, but traffic still flows
3299         # try FIN packet out->in
3300         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3301              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3302              TCP(sport=33898, dport=80, flags="F"))
3303         self.pg1.add_stream(p)
3304         self.pg_enable_capture(self.pg_interfaces)
3305         self.pg_start()
3306
3307         self.virtual_sleep(new_transitory, "wait for transitory timeout")
3308         self.pg0.get_capture(1)
3309
3310         # session should still exist
3311         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3312         self.assertEqual(len(sessions) - start_sessnum, 1)
3313
3314         # send FIN+ACK packet out -> in - will cause session to be wiped
3315         # but won't create a new session
3316         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3317              IP(src=self.pg1.remote_ip4, dst=service_ip) /
3318              TCP(sport=33898, dport=80, flags="FA", seq=300, ack=101))
3319         self.send_and_assert_no_replies(self.pg1, p)
3320         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3321         self.assertEqual(len(sessions) - start_sessnum, 0)
3322
3323     def test_tcp_session_close_in(self):
3324         """ NAT44ED Close TCP session from inside network """
3325
3326         in_port = self.tcp_port_in
3327         out_port = 10505
3328         ext_port = self.tcp_external_port
3329
3330         self.nat_add_address(self.nat_addr)
3331         self.nat_add_inside_interface(self.pg0)
3332         self.nat_add_outside_interface(self.pg1)
3333         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3334                                     in_port, out_port, proto=IP_PROTOS.tcp,
3335                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3336
3337         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3338         session_n = len(sessions)
3339
3340         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3341                                    tcp_transitory=2, icmp=5)
3342
3343         self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3344
3345         # FIN packet in -> out
3346         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3347              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3348              TCP(sport=in_port, dport=ext_port,
3349                  flags="FA", seq=100, ack=300))
3350         self.send_and_expect(self.pg0, p, self.pg1)
3351         pkts = []
3352
3353         # ACK packet out -> in
3354         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3355              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3356              TCP(sport=ext_port, dport=out_port,
3357                  flags="A", seq=300, ack=101))
3358         pkts.append(p)
3359
3360         # FIN packet out -> in
3361         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3362              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3363              TCP(sport=ext_port, dport=out_port,
3364                  flags="FA", seq=300, ack=101))
3365         pkts.append(p)
3366
3367         self.send_and_expect(self.pg1, pkts, self.pg0)
3368
3369         # ACK packet in -> out
3370         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3371              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3372              TCP(sport=in_port, dport=ext_port,
3373                  flags="A", seq=101, ack=301))
3374         self.send_and_expect(self.pg0, p, self.pg1)
3375
3376         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3377         self.assertEqual(len(sessions) - session_n, 1)
3378
3379         # retransmit FIN packet out -> in
3380         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3381              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3382              TCP(sport=ext_port, dport=out_port,
3383                  flags="FA", seq=300, ack=101))
3384
3385         self.send_and_expect(self.pg1, p, self.pg0)
3386
3387         # retransmit ACK packet in -> out
3388         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3389              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3390              TCP(sport=in_port, dport=ext_port,
3391                  flags="A", seq=101, ack=301))
3392         self.send_and_expect(self.pg0, p, self.pg1)
3393
3394         self.virtual_sleep(3)
3395         # retransmit ACK packet in -> out - this will cause session to be wiped
3396         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3397              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3398              TCP(sport=in_port, dport=ext_port,
3399                  flags="A", seq=101, ack=301))
3400         self.send_and_assert_no_replies(self.pg0, p)
3401         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3402         self.assertEqual(len(sessions) - session_n, 0)
3403
3404     def test_tcp_session_close_out(self):
3405         """ NAT44ED Close TCP session from outside network """
3406
3407         in_port = self.tcp_port_in
3408         out_port = 10505
3409         ext_port = self.tcp_external_port
3410
3411         self.nat_add_address(self.nat_addr)
3412         self.nat_add_inside_interface(self.pg0)
3413         self.nat_add_outside_interface(self.pg1)
3414         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3415                                     in_port, out_port, proto=IP_PROTOS.tcp,
3416                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3417
3418         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3419         session_n = len(sessions)
3420
3421         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3422                                    tcp_transitory=2, icmp=5)
3423
3424         _ = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3425
3426         # FIN packet out -> in
3427         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3428              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3429              TCP(sport=ext_port, dport=out_port,
3430                  flags="FA", seq=100, ack=300))
3431         self.pg1.add_stream(p)
3432         self.pg_enable_capture(self.pg_interfaces)
3433         self.pg_start()
3434         self.pg0.get_capture(1)
3435
3436         # FIN+ACK packet in -> out
3437         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3438              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3439              TCP(sport=in_port, dport=ext_port,
3440                  flags="FA", seq=300, ack=101))
3441
3442         self.pg0.add_stream(p)
3443         self.pg_enable_capture(self.pg_interfaces)
3444         self.pg_start()
3445         self.pg1.get_capture(1)
3446
3447         # ACK packet out -> in
3448         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3449              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3450              TCP(sport=ext_port, dport=out_port,
3451                  flags="A", seq=101, ack=301))
3452         self.pg1.add_stream(p)
3453         self.pg_enable_capture(self.pg_interfaces)
3454         self.pg_start()
3455         self.pg0.get_capture(1)
3456
3457         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3458         self.assertEqual(len(sessions) - session_n, 1)
3459
3460         # retransmit FIN packet out -> in
3461         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3462              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3463              TCP(sport=ext_port, dport=out_port,
3464                  flags="FA", seq=300, ack=101))
3465         self.send_and_expect(self.pg1, p, self.pg0)
3466
3467         # retransmit ACK packet in -> out
3468         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3469              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3470              TCP(sport=in_port, dport=ext_port,
3471                  flags="A", seq=101, ack=301))
3472         self.send_and_expect(self.pg0, p, self.pg1)
3473
3474         self.virtual_sleep(3)
3475         # retransmit ACK packet in -> out - this will cause session to be wiped
3476         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3477              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3478              TCP(sport=in_port, dport=ext_port,
3479                  flags="A", seq=101, ack=301))
3480         self.send_and_assert_no_replies(self.pg0, p)
3481         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3482         self.assertEqual(len(sessions) - session_n, 0)
3483
3484     def test_tcp_session_close_simultaneous(self):
3485         """ Simultaneous TCP close from both sides """
3486
3487         in_port = self.tcp_port_in
3488         ext_port = 10505
3489
3490         self.nat_add_address(self.nat_addr)
3491         self.nat_add_inside_interface(self.pg0)
3492         self.nat_add_outside_interface(self.pg1)
3493         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3494                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3495                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3496
3497         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3498         session_n = len(sessions)
3499
3500         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3501                                    tcp_transitory=2, icmp=5)
3502
3503         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3504
3505         # FIN packet in -> out
3506         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3507              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3508              TCP(sport=in_port, dport=ext_port,
3509                  flags="FA", seq=100, ack=300))
3510         self.send_and_expect(self.pg0, p, self.pg1)
3511
3512         # FIN packet out -> in
3513         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3514              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3515              TCP(sport=ext_port, dport=out_port,
3516                  flags="FA", seq=300, ack=100))
3517         self.send_and_expect(self.pg1, p, self.pg0)
3518
3519         # ACK packet in -> out
3520         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3521              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3522              TCP(sport=in_port, dport=ext_port,
3523                  flags="A", seq=101, ack=301))
3524         self.send_and_expect(self.pg0, p, self.pg1)
3525
3526         # ACK packet out -> in
3527         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3528              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3529              TCP(sport=ext_port, dport=out_port,
3530                  flags="A", seq=301, ack=101))
3531         self.send_and_expect(self.pg1, p, self.pg0)
3532
3533         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3534         self.assertEqual(len(sessions) - session_n, 1)
3535
3536         # retransmit FIN packet out -> in
3537         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3538              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3539              TCP(sport=ext_port, dport=out_port,
3540                  flags="FA", seq=300, ack=101))
3541         self.send_and_expect(self.pg1, p, self.pg0)
3542
3543         # retransmit ACK packet in -> out
3544         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3545              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3546              TCP(sport=in_port, dport=ext_port,
3547                  flags="A", seq=101, ack=301))
3548         self.send_and_expect(self.pg0, p, self.pg1)
3549
3550         self.virtual_sleep(3)
3551         # retransmit ACK packet in -> out - this will cause session to be wiped
3552         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3553              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3554              TCP(sport=in_port, dport=ext_port,
3555                  flags="A", seq=101, ack=301))
3556         self.pg_send(self.pg0, p)
3557         self.send_and_assert_no_replies(self.pg0, p)
3558         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3559         self.assertEqual(len(sessions) - session_n, 0)
3560
3561     def test_tcp_session_half_reopen_inside(self):
3562         """ TCP session in FIN/FIN state not reopened by in2out SYN only """
3563         in_port = self.tcp_port_in
3564         ext_port = 10505
3565
3566         self.nat_add_address(self.nat_addr)
3567         self.nat_add_inside_interface(self.pg0)
3568         self.nat_add_outside_interface(self.pg1)
3569         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3570                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3571                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3572
3573         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3574         session_n = len(sessions)
3575
3576         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3577                                    tcp_transitory=2, icmp=5)
3578
3579         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3580
3581         # FIN packet in -> out
3582         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3583              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3584              TCP(sport=in_port, dport=ext_port,
3585                  flags="FA", seq=100, ack=300))
3586         self.send_and_expect(self.pg0, p, self.pg1)
3587
3588         # FIN packet out -> in
3589         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3590              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3591              TCP(sport=ext_port, dport=out_port,
3592                  flags="FA", seq=300, ack=100))
3593         self.send_and_expect(self.pg1, p, self.pg0)
3594
3595         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3596         self.assertEqual(len(sessions) - session_n, 1)
3597
3598         # send SYN packet in -> out
3599         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3600              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3601              TCP(sport=in_port, dport=ext_port,
3602                  flags="S", seq=101, ack=301))
3603         self.send_and_expect(self.pg0, p, self.pg1)
3604
3605         self.virtual_sleep(3)
3606         # send ACK packet in -> out - session should be wiped
3607         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3608              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3609              TCP(sport=in_port, dport=ext_port,
3610                  flags="A", seq=101, ack=301))
3611         self.send_and_assert_no_replies(self.pg0, p, self.pg1)
3612         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3613         self.assertEqual(len(sessions) - session_n, 0)
3614
3615     def test_tcp_session_half_reopen_outside(self):
3616         """ TCP session in FIN/FIN state not reopened by out2in SYN only """
3617         in_port = self.tcp_port_in
3618         ext_port = 10505
3619
3620         self.nat_add_address(self.nat_addr)
3621         self.nat_add_inside_interface(self.pg0)
3622         self.nat_add_outside_interface(self.pg1)
3623         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3624                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3625                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3626
3627         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3628         session_n = len(sessions)
3629
3630         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3631                                    tcp_transitory=2, icmp=5)
3632
3633         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3634
3635         # FIN packet in -> out
3636         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3637              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3638              TCP(sport=in_port, dport=ext_port,
3639                  flags="FA", seq=100, ack=300))
3640         self.send_and_expect(self.pg0, p, self.pg1)
3641
3642         # FIN packet out -> in
3643         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3644              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3645              TCP(sport=ext_port, dport=out_port,
3646                  flags="FA", seq=300, ack=100))
3647         self.send_and_expect(self.pg1, p, self.pg0)
3648
3649         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3650         self.assertEqual(len(sessions) - session_n, 1)
3651
3652         # send SYN packet out -> in
3653         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3654              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3655              TCP(sport=ext_port, dport=out_port,
3656                  flags="S", seq=300, ack=101))
3657         self.send_and_expect(self.pg1, p, self.pg0)
3658
3659         self.virtual_sleep(3)
3660         # send ACK packet in -> out - session should be wiped
3661         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3662              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3663              TCP(sport=in_port, dport=ext_port,
3664                  flags="A", seq=101, ack=301))
3665         self.send_and_assert_no_replies(self.pg0, p, self.pg1)
3666         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3667         self.assertEqual(len(sessions) - session_n, 0)
3668
3669     def test_tcp_session_reopen(self):
3670         """ TCP session in FIN/FIN state reopened by SYN from both sides """
3671         in_port = self.tcp_port_in
3672         ext_port = 10505
3673
3674         self.nat_add_address(self.nat_addr)
3675         self.nat_add_inside_interface(self.pg0)
3676         self.nat_add_outside_interface(self.pg1)
3677         self.nat_add_static_mapping(self.pg0.remote_ip4, self.nat_addr,
3678                                     in_port, ext_port, proto=IP_PROTOS.tcp,
3679                                     flags=self.config_flags.NAT_IS_TWICE_NAT)
3680
3681         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3682         session_n = len(sessions)
3683
3684         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
3685                                    tcp_transitory=2, icmp=5)
3686
3687         out_port = self.init_tcp_session(self.pg0, self.pg1, in_port, ext_port)
3688
3689         # FIN packet in -> out
3690         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3691              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3692              TCP(sport=in_port, dport=ext_port,
3693                  flags="FA", seq=100, ack=300))
3694         self.send_and_expect(self.pg0, p, self.pg1)
3695
3696         # FIN packet out -> in
3697         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3698              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3699              TCP(sport=ext_port, dport=out_port,
3700                  flags="FA", seq=300, ack=100))
3701         self.send_and_expect(self.pg1, p, self.pg0)
3702
3703         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3704         self.assertEqual(len(sessions) - session_n, 1)
3705
3706         # send SYN packet out -> in
3707         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3708              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
3709              TCP(sport=ext_port, dport=out_port,
3710                  flags="S", seq=300, ack=101))
3711         self.send_and_expect(self.pg1, p, self.pg0)
3712
3713         # send SYN packet in -> out
3714         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3715              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3716              TCP(sport=in_port, dport=ext_port,
3717                  flags="S", seq=101, ack=301))
3718         self.send_and_expect(self.pg0, p, self.pg1)
3719
3720         self.virtual_sleep(3)
3721         # send ACK packet in -> out - should be forwarded and session alive
3722         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3723              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3724              TCP(sport=in_port, dport=ext_port,
3725                  flags="A", seq=101, ack=301))
3726         self.send_and_expect(self.pg0, p, self.pg1)
3727         sessions = self.vapi.nat44_user_session_dump(self.pg0.remote_ip4, 0)
3728         self.assertEqual(len(sessions) - session_n, 1)
3729
3730     def test_dynamic_vrf(self):
3731         """ NAT44ED dynamic translation test: different VRF"""
3732
3733         vrf_id_in = 33
3734         vrf_id_out = 34
3735
3736         self.nat_add_address(self.nat_addr, vrf_id=vrf_id_in)
3737
3738         try:
3739             self.configure_ip4_interface(self.pg7, table_id=vrf_id_in)
3740             self.configure_ip4_interface(self.pg8, table_id=vrf_id_out)
3741
3742             self.nat_add_inside_interface(self.pg7)
3743             self.nat_add_outside_interface(self.pg8)
3744
3745             # just basic stuff nothing special
3746             pkts = self.create_stream_in(self.pg7, self.pg8)
3747             self.pg7.add_stream(pkts)
3748             self.pg_enable_capture(self.pg_interfaces)
3749             self.pg_start()
3750             capture = self.pg8.get_capture(len(pkts))
3751             self.verify_capture_out(capture, ignore_port=True)
3752
3753             pkts = self.create_stream_out(self.pg8)
3754             self.pg8.add_stream(pkts)
3755             self.pg_enable_capture(self.pg_interfaces)
3756             self.pg_start()
3757             capture = self.pg7.get_capture(len(pkts))
3758             self.verify_capture_in(capture, self.pg7)
3759
3760         finally:
3761             self.pg7.unconfig()
3762             self.pg8.unconfig()
3763
3764             self.vapi.ip_table_add_del(is_add=0,
3765                                        table={'table_id': vrf_id_in})
3766             self.vapi.ip_table_add_del(is_add=0,
3767                                        table={'table_id': vrf_id_out})
3768
3769     def test_dynamic_output_feature_vrf(self):
3770         """ NAT44ED dynamic translation test: output-feature, VRF"""
3771
3772         # other then default (0)
3773         new_vrf_id = 22
3774
3775         self.nat_add_address(self.nat_addr)
3776         self.vapi.nat44_interface_add_del_output_feature(
3777             sw_if_index=self.pg8.sw_if_index, is_add=1)
3778
3779         try:
3780             self.configure_ip4_interface(self.pg7, table_id=new_vrf_id)
3781             self.configure_ip4_interface(self.pg8, table_id=new_vrf_id)
3782
3783             # in2out
3784             tcpn = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3785             udpn = self.statistics['/nat44-ed/in2out/slowpath/udp']
3786             icmpn = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3787             drops = self.statistics['/nat44-ed/in2out/slowpath/drops']
3788
3789             pkts = self.create_stream_in(self.pg7, self.pg8)
3790             self.pg7.add_stream(pkts)
3791             self.pg_enable_capture(self.pg_interfaces)
3792             self.pg_start()
3793             capture = self.pg8.get_capture(len(pkts))
3794             self.verify_capture_out(capture, ignore_port=True)
3795
3796             if_idx = self.pg8.sw_if_index
3797             cnt = self.statistics['/nat44-ed/in2out/slowpath/tcp']
3798             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3799             cnt = self.statistics['/nat44-ed/in2out/slowpath/udp']
3800             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3801             cnt = self.statistics['/nat44-ed/in2out/slowpath/icmp']
3802             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3803             cnt = self.statistics['/nat44-ed/in2out/slowpath/drops']
3804             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3805
3806             # out2in
3807             tcpn = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3808             udpn = self.statistics['/nat44-ed/out2in/fastpath/udp']
3809             icmpn = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3810             drops = self.statistics['/nat44-ed/out2in/fastpath/drops']
3811
3812             pkts = self.create_stream_out(self.pg8)
3813             self.pg8.add_stream(pkts)
3814             self.pg_enable_capture(self.pg_interfaces)
3815             self.pg_start()
3816             capture = self.pg7.get_capture(len(pkts))
3817             self.verify_capture_in(capture, self.pg7)
3818
3819             if_idx = self.pg8.sw_if_index
3820             cnt = self.statistics['/nat44-ed/out2in/fastpath/tcp']
3821             self.assertEqual(cnt[:, if_idx].sum() - tcpn[:, if_idx].sum(), 2)
3822             cnt = self.statistics['/nat44-ed/out2in/fastpath/udp']
3823             self.assertEqual(cnt[:, if_idx].sum() - udpn[:, if_idx].sum(), 1)
3824             cnt = self.statistics['/nat44-ed/out2in/fastpath/icmp']
3825             self.assertEqual(cnt[:, if_idx].sum() - icmpn[:, if_idx].sum(), 1)
3826             cnt = self.statistics['/nat44-ed/out2in/fastpath/drops']
3827             self.assertEqual(cnt[:, if_idx].sum() - drops[:, if_idx].sum(), 0)
3828
3829             sessions = self.statistics['/nat44-ed/total-sessions']
3830             self.assertEqual(sessions[:, 0].sum(), 3)
3831
3832         finally:
3833             self.pg7.unconfig()
3834             self.pg8.unconfig()
3835
3836             self.vapi.ip_table_add_del(is_add=0,
3837                                        table={'table_id': new_vrf_id})
3838
3839     def test_next_src_nat(self):
3840         """ NAT44ED On way back forward packet to nat44-in2out node. """
3841
3842         twice_nat_addr = '10.0.1.3'
3843         external_port = 80
3844         local_port = 8080
3845         post_twice_nat_port = 0
3846
3847         self.vapi.nat44_forwarding_enable_disable(enable=1)
3848         self.nat_add_address(twice_nat_addr, twice_nat=1)
3849         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3850                  self.config_flags.NAT_IS_SELF_TWICE_NAT)
3851         self.nat_add_static_mapping(self.pg6.remote_ip4, self.pg1.remote_ip4,
3852                                     local_port, external_port,
3853                                     proto=IP_PROTOS.tcp, vrf_id=1,
3854                                     flags=flags)
3855         self.vapi.nat44_interface_add_del_feature(
3856             sw_if_index=self.pg6.sw_if_index,
3857             is_add=1)
3858
3859         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3860              IP(src=self.pg6.remote_ip4, dst=self.pg1.remote_ip4) /
3861              TCP(sport=12345, dport=external_port))
3862         self.pg6.add_stream(p)
3863         self.pg_enable_capture(self.pg_interfaces)
3864         self.pg_start()
3865         capture = self.pg6.get_capture(1)
3866         p = capture[0]
3867         try:
3868             ip = p[IP]
3869             tcp = p[TCP]
3870             self.assertEqual(ip.src, twice_nat_addr)
3871             self.assertNotEqual(tcp.sport, 12345)
3872             post_twice_nat_port = tcp.sport
3873             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3874             self.assertEqual(tcp.dport, local_port)
3875             self.assert_packet_checksums_valid(p)
3876         except:
3877             self.logger.error(ppp("Unexpected or invalid packet:", p))
3878             raise
3879
3880         p = (Ether(src=self.pg6.remote_mac, dst=self.pg6.local_mac) /
3881              IP(src=self.pg6.remote_ip4, dst=twice_nat_addr) /
3882              TCP(sport=local_port, dport=post_twice_nat_port))
3883         self.pg6.add_stream(p)
3884         self.pg_enable_capture(self.pg_interfaces)
3885         self.pg_start()
3886         capture = self.pg6.get_capture(1)
3887         p = capture[0]
3888         try:
3889             ip = p[IP]
3890             tcp = p[TCP]
3891             self.assertEqual(ip.src, self.pg1.remote_ip4)
3892             self.assertEqual(tcp.sport, external_port)
3893             self.assertEqual(ip.dst, self.pg6.remote_ip4)
3894             self.assertEqual(tcp.dport, 12345)
3895             self.assert_packet_checksums_valid(p)
3896         except:
3897             self.logger.error(ppp("Unexpected or invalid packet:", p))
3898             raise
3899
3900     def test_one_armed_nat44_static(self):
3901         """ NAT44ED One armed NAT and 1:1 NAPT asymmetrical rule """
3902
3903         remote_host = self.pg4.remote_hosts[0]
3904         local_host = self.pg4.remote_hosts[1]
3905         external_port = 80
3906         local_port = 8080
3907         eh_port_in = 0
3908
3909         self.vapi.nat44_forwarding_enable_disable(enable=1)
3910         self.nat_add_address(self.nat_addr, twice_nat=1)
3911         flags = (self.config_flags.NAT_IS_OUT2IN_ONLY |
3912                  self.config_flags.NAT_IS_TWICE_NAT)
3913         self.nat_add_static_mapping(local_host.ip4, self.nat_addr,
3914                                     local_port, external_port,
3915                                     proto=IP_PROTOS.tcp, flags=flags)
3916         flags = self.config_flags.NAT_IS_INSIDE
3917         self.vapi.nat44_interface_add_del_feature(
3918             sw_if_index=self.pg4.sw_if_index,
3919             is_add=1)
3920         self.vapi.nat44_interface_add_del_feature(
3921             sw_if_index=self.pg4.sw_if_index,
3922             flags=flags, is_add=1)
3923
3924         # from client to service
3925         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3926              IP(src=remote_host.ip4, dst=self.nat_addr) /
3927              TCP(sport=12345, dport=external_port))
3928         self.pg4.add_stream(p)
3929         self.pg_enable_capture(self.pg_interfaces)
3930         self.pg_start()
3931         capture = self.pg4.get_capture(1)
3932         p = capture[0]
3933         try:
3934             ip = p[IP]
3935             tcp = p[TCP]
3936             self.assertEqual(ip.dst, local_host.ip4)
3937             self.assertEqual(ip.src, self.nat_addr)
3938             self.assertEqual(tcp.dport, local_port)
3939             self.assertNotEqual(tcp.sport, 12345)
3940             eh_port_in = tcp.sport
3941             self.assert_packet_checksums_valid(p)
3942         except:
3943             self.logger.error(ppp("Unexpected or invalid packet:", p))
3944             raise
3945
3946         # from service back to client
3947         p = (Ether(src=self.pg4.remote_mac, dst=self.pg4.local_mac) /
3948              IP(src=local_host.ip4, dst=self.nat_addr) /
3949              TCP(sport=local_port, dport=eh_port_in))
3950         self.pg4.add_stream(p)
3951         self.pg_enable_capture(self.pg_interfaces)
3952         self.pg_start()
3953         capture = self.pg4.get_capture(1)
3954         p = capture[0]
3955         try:
3956             ip = p[IP]
3957             tcp = p[TCP]
3958             self.assertEqual(ip.src, self.nat_addr)
3959             self.assertEqual(ip.dst, remote_host.ip4)
3960             self.assertEqual(tcp.sport, external_port)
3961             self.assertEqual(tcp.dport, 12345)
3962             self.assert_packet_checksums_valid(p)
3963         except:
3964             self.logger.error(ppp("Unexpected or invalid packet:", p))
3965             raise
3966
3967     def test_icmp_error_fwd_outbound(self):
3968         """ NAT44ED ICMP error outbound with forwarding enabled """
3969
3970         # Ensure that an outbound ICMP error message is properly associated
3971         # with the inbound forward bypass session it is related to.
3972         payload = "H" * 10
3973
3974         self.nat_add_address(self.nat_addr)
3975         self.nat_add_inside_interface(self.pg0)
3976         self.nat_add_outside_interface(self.pg1)
3977
3978         # enable forwarding and initiate connection out2in
3979         self.vapi.nat44_forwarding_enable_disable(enable=1)
3980         p1 = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
3981               IP(src=self.pg1.remote_ip4, dst=self.pg0.remote_ip4) /
3982               UDP(sport=21, dport=20) / payload)
3983
3984         self.pg1.add_stream(p1)
3985         self.pg_enable_capture(self.pg_interfaces)
3986         self.pg_start()
3987         capture = self.pg0.get_capture(1)[0]
3988
3989         self.logger.info(self.vapi.cli("show nat44 sessions"))
3990
3991         # reply with ICMP error message in2out
3992         # We cannot reliably retrieve forward bypass sessions via the API.
3993         # session dumps for a user will only look on the worker that the
3994         # user is supposed to be mapped to in2out. The forward bypass session
3995         # is not necessarily created on that worker.
3996         p2 = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
3997               IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
3998               ICMP(type='dest-unreach', code='port-unreachable') /
3999               capture[IP:])
4000
4001         self.pg0.add_stream(p2)
4002         self.pg_enable_capture(self.pg_interfaces)
4003         self.pg_start()
4004         capture = self.pg1.get_capture(1)[0]
4005
4006         self.logger.info(self.vapi.cli("show nat44 sessions"))
4007
4008         self.logger.info(ppp("p1 packet:", p1))
4009         self.logger.info(ppp("p2 packet:", p2))
4010         self.logger.info(ppp("capture packet:", capture))
4011
4012     def test_tcp_session_open_retransmit1(self):
4013         """ NAT44ED Open TCP session with SYN,ACK retransmit 1
4014
4015             The client does not receive the [SYN,ACK] or the
4016             ACK from the client is lost. Therefore, the [SYN, ACK]
4017             is retransmitted by the server.
4018         """
4019
4020         in_port = self.tcp_port_in
4021         ext_port = self.tcp_external_port
4022         payload = "H" * 10
4023
4024         self.nat_add_address(self.nat_addr)
4025         self.nat_add_inside_interface(self.pg0)
4026         self.nat_add_outside_interface(self.pg1)
4027
4028         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
4029                                    tcp_transitory=5, icmp=60)
4030         # SYN packet in->out
4031         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4032              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4033              TCP(sport=in_port, dport=ext_port, flags="S"))
4034         p = self.send_and_expect(self.pg0, p, self.pg1)[0]
4035         out_port = p[TCP].sport
4036
4037         # SYN + ACK packet out->in
4038         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
4039              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
4040              TCP(sport=ext_port, dport=out_port, flags="SA"))
4041         self.send_and_expect(self.pg1, p, self.pg0)
4042
4043         # ACK in->out does not arrive
4044
4045         # resent SYN + ACK packet out->in
4046         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
4047              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
4048              TCP(sport=ext_port, dport=out_port, flags="SA"))
4049         self.send_and_expect(self.pg1, p, self.pg0)
4050
4051         # ACK packet in->out
4052         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4053              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4054              TCP(sport=in_port, dport=ext_port, flags="A"))
4055         self.send_and_expect(self.pg0, p, self.pg1)
4056
4057         # Verify that the data can be transmitted after the transitory time
4058         self.virtual_sleep(6)
4059
4060         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4061              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4062              TCP(sport=in_port, dport=ext_port, flags="PA") /
4063              Raw(payload))
4064         self.send_and_expect(self.pg0, p, self.pg1)
4065
4066     def test_tcp_session_open_retransmit2(self):
4067         """ NAT44ED Open TCP session with SYN,ACK retransmit 2
4068
4069             The ACK is lost to the server after the TCP session is opened.
4070             Data is sent by the client, then the [SYN,ACK] is
4071             retransmitted by the server.
4072         """
4073
4074         in_port = self.tcp_port_in
4075         ext_port = self.tcp_external_port
4076         payload = "H" * 10
4077
4078         self.nat_add_address(self.nat_addr)
4079         self.nat_add_inside_interface(self.pg0)
4080         self.nat_add_outside_interface(self.pg1)
4081
4082         self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
4083                                    tcp_transitory=5, icmp=60)
4084         # SYN packet in->out
4085         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4086              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4087              TCP(sport=in_port, dport=ext_port, flags="S"))
4088         p = self.send_and_expect(self.pg0, p, self.pg1)[0]
4089         out_port = p[TCP].sport
4090
4091         # SYN + ACK packet out->in
4092         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
4093              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
4094              TCP(sport=ext_port, dport=out_port, flags="SA"))
4095         self.send_and_expect(self.pg1, p, self.pg0)
4096
4097         # ACK packet in->out -- not received by the server
4098         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4099              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4100              TCP(sport=in_port, dport=ext_port, flags="A"))
4101         self.send_and_expect(self.pg0, p, self.pg1)
4102
4103         # PUSH + ACK packet in->out
4104         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4105              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4106              TCP(sport=in_port, dport=ext_port, flags="PA") /
4107              Raw(payload))
4108         self.send_and_expect(self.pg0, p, self.pg1)
4109
4110         # resent SYN + ACK packet out->in
4111         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
4112              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
4113              TCP(sport=ext_port, dport=out_port, flags="SA"))
4114         self.send_and_expect(self.pg1, p, self.pg0)
4115
4116         # resent ACK packet in->out
4117         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4118              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4119              TCP(sport=in_port, dport=ext_port, flags="A"))
4120         self.send_and_expect(self.pg0, p, self.pg1)
4121
4122         # resent PUSH + ACK packet in->out
4123         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4124              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4125              TCP(sport=in_port, dport=ext_port, flags="PA") /
4126              Raw(payload))
4127         self.send_and_expect(self.pg0, p, self.pg1)
4128
4129         # ACK packet out->in
4130         p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
4131              IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
4132              TCP(sport=ext_port, dport=out_port, flags="A"))
4133         self.send_and_expect(self.pg1, p, self.pg0)
4134
4135         # Verify that the data can be transmitted after the transitory time
4136         self.virtual_sleep(6)
4137
4138         p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
4139              IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
4140              TCP(sport=in_port, dport=ext_port, flags="PA") /
4141              Raw(payload))
4142         self.send_and_expect(self.pg0, p, self.pg1)
4143
4144
4145 if __name__ == '__main__':
4146     unittest.main(testRunner=VppTestRunner)