Gitiles
Code Review Sign In
gerrit.nordix.org / fdio / vpp / aa7cfd04e7bb89208afe57cd84e96ced32153044 / . / test / test_nat44_ed_output.py
blob: ea5c14e706451a8349a77d19caa156a39908e6be [file] [log] [blame]
Klement Sekeraff334db2021-05-26 13:02:35 +0200[diff] [blame]1#!/usr/bin/env python3
2"""NAT44 ED output-feature tests"""
3
4import random
5import unittest
6from scapy.layers.inet import ICMP, Ether, IP, TCP
7from scapy.packet import Raw
8from scapy.data import IP_PROTOS
9from framework import VppTestCase, VppTestRunner
10from vpp_papi import VppEnum
11
12
13def get_nat44_ed_in2out_worker_index(ip, vpp_worker_count):
14 if 0 == vpp_worker_count:
15 return 0
16 numeric = socket.inet_aton(ip)
17 numeric = struct.unpack("!L", numeric)[0]
18 numeric = socket.htonl(numeric)
19 h = numeric + (numeric >> 8) + (numeric >> 16) + (numeric >> 24)
20 return 1 + h % vpp_worker_count
21
22
23class TestNAT44EDOutput(VppTestCase):
24 """ NAT44 ED output feature Test Case """
25 max_sessions = 1024
26
27 @classmethod
28 def setUpClass(cls):
29 super().setUpClass()
30 cls.create_pg_interfaces(range(2))
31 cls.interfaces = list(cls.pg_interfaces)
32
33 @classmethod
34 def tearDownClass(cls):
35 super().tearDownClass()
36
37 def setUp(self):
38 super().setUp()
39 for i in self.interfaces:
40 i.admin_up()
41 i.config_ip4()
42 i.resolve_arp()
43 self.vapi.nat44_ed_plugin_enable_disable(sessions=self.max_sessions,
44 enable=1)
45
46 def tearDown(self):
47 if not self.vpp_dead:
48 self.logger.debug(self.vapi.cli("show nat44 sessions"))
49 super().tearDown()
50 if not self.vpp_dead:
51 for i in self.pg_interfaces:
52 i.unconfig_ip4()
53 i.admin_down()
54 self.vapi.nat44_ed_plugin_enable_disable(enable=0)
55
56 def test_static_dynamic(self):
57 """ Create static mapping which matches existing dynamic mapping """
58
59 old_timeouts = self.vapi.nat_get_timeouts()
60 new_transitory = 2
61 self.vapi.nat_set_timeouts(
62 udp=old_timeouts.udp,
63 tcp_established=old_timeouts.tcp_established,
64 icmp=old_timeouts.icmp,
65 tcp_transitory=new_transitory)
66
67 local_host = self.pg0.remote_ip4
68 remote_host = self.pg1.remote_ip4
69 nat_intf = self.pg1
70 outside_addr = nat_intf.local_ip4
71
72 self.vapi.nat44_add_del_address_range(first_ip_address=outside_addr,
73 last_ip_address=outside_addr,
74 vrf_id=0xffffffff,
75 is_add=1,
76 flags=0)
77 self.vapi.nat44_interface_add_del_feature(
78 sw_if_index=self.pg0.sw_if_index,
79 is_add=1)
80 self.vapi.nat44_interface_add_del_feature(
81 sw_if_index=self.pg0.sw_if_index,
82 flags=VppEnum.vl_api_nat_config_flags_t.NAT_IS_INSIDE, is_add=1)
83 self.vapi.nat44_interface_add_del_output_feature(
84 is_add=1,
85 sw_if_index=self.pg1.sw_if_index)
86
87 thread_index = get_nat44_ed_in2out_worker_index(
88 local_host, self.vpp_worker_count)
89 port_per_thread = int((0xffff-1024) / max(1, self.vpp_worker_count))
90 local_sport = 1024 + random.randint(1, port_per_thread)
91 if self.vpp_worker_count > 0:
92 local_sport += port_per_thread * (thread_index - 1)
93
94 remote_dport = 10000
95
96 pg0 = self.pg0
97 pg1 = self.pg1
98
99 # first setup a dynamic TCP session
100
101 # SYN packet in->out
102 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
103 IP(src=local_host, dst=remote_host) /
104 TCP(sport=local_sport, dport=remote_dport, flags="S"))
105 p = self.send_and_expect(pg0, [p], pg1)[0]
106
107 self.assertEqual(p[IP].src, outside_addr)
108 self.assertEqual(p[TCP].sport, local_sport)
109 outside_port = p[TCP].sport
110
111 # SYN+ACK packet out->in
112 p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
113 IP(src=remote_host, dst=outside_addr) /
114 TCP(sport=remote_dport, dport=outside_port, flags="SA"))
115 self.send_and_expect(pg1, [p], pg0)
116
117 # ACK packet in->out
118 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
119 IP(src=local_host, dst=remote_host) /
120 TCP(sport=local_sport, dport=remote_dport, flags="A"))
121 self.send_and_expect(pg0, [p], pg1)
122
123 # now we have a session up, create a conflicting static mapping
124 self.vapi.nat44_add_del_static_mapping(
125 is_add=1,
126 local_ip_address=local_host,
127 external_ip_address=outside_addr,
128 external_sw_if_index=0xffffffff,
129 local_port=local_sport,
130 external_port=outside_port,
131 protocol=IP_PROTOS.tcp,
132 flags=VppEnum.vl_api_nat_config_flags_t.NAT_IS_OUT2IN_ONLY)
133
134 sessions = self.vapi.nat44_user_session_dump(local_host, 0)
135 self.assertEqual(1, len(sessions))
136
137 # now send some more data over existing session - it should pass
138
139 # in->out
140 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
141 IP(src=local_host, dst=remote_host) /
142 TCP(sport=local_sport, dport=remote_dport) /
143 Raw("zippity zap"))
144 self.send_and_expect(pg0, [p], pg1)
145
146 # out->in
147 p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
148 IP(src=remote_host, dst=outside_addr) /
149 TCP(sport=remote_dport, dport=outside_port) /
150 Raw("flippity flop"))
151 self.send_and_expect(pg1, [p], pg0)
152
153 # now close the session
154
155 # FIN packet in -> out
156 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
157 IP(src=local_host, dst=remote_host) /
158 TCP(sport=local_sport, dport=remote_dport, flags="FA", seq=100,
159 ack=300))
160 self.send_and_expect(pg0, [p], pg1)
161
162 # FIN+ACK packet out -> in
163 p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
164 IP(src=remote_host, dst=outside_addr) /
165 TCP(sport=remote_dport, dport=outside_port, flags="FA", seq=300,
166 ack=101))
167 self.send_and_expect(pg1, [p], pg0)
168
169 # ACK packet in -> out
170 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
171 IP(src=local_host, dst=remote_host) /
172 TCP(sport=local_sport, dport=remote_dport, flags="A", seq=101,
173 ack=301))
174 self.send_and_expect(pg0, [p], pg1)
175
176 # session now in transitory timeout
177 # try SYN packet in->out - should be dropped
178 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
179 IP(src=local_host, dst=remote_host) /
180 TCP(sport=local_sport, dport=remote_dport, flags="S"))
181 pg0.add_stream(p)
182 self.pg_enable_capture()
183 self.pg_start()
184
185 self.sleep(new_transitory, "wait for transitory timeout")
186 pg0.assert_nothing_captured(0)
187
188 # session should still exist
189 sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
190 self.assertEqual(1, len(sessions))
191
192 # send FIN+ACK packet in->out - will cause session to be wiped
193 # but won't create a new session
194 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
195 IP(src=local_host, dst=remote_host) /
196 TCP(sport=local_sport, dport=remote_dport, flags="FA", seq=300,
197 ack=101))
198 pg1.add_stream(p)
199 self.pg_enable_capture()
200 self.pg_start()
201 pg0.assert_nothing_captured(0)
202
203 sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
204 self.assertEqual(0, len(sessions))
205
206 # create a new session and make sure the outside port is remapped
207 # SYN packet in->out
208
209 p = (Ether(src=pg0.remote_mac, dst=pg0.local_mac) /
210 IP(src=local_host, dst=remote_host) /
211 TCP(sport=local_sport, dport=remote_dport, flags="S"))
212 p = self.send_and_expect(pg0, [p], pg1)[0]
213
214 self.assertEqual(p[IP].src, outside_addr)
215 self.assertNotEqual(p[TCP].sport, local_sport)
216
217 # make sure static mapping works and creates a new session
218 # SYN packet out->in
219 p = (Ether(src=pg1.remote_mac, dst=pg1.local_mac) /
220 IP(src=remote_host, dst=outside_addr) /
221 TCP(sport=remote_dport, dport=outside_port, flags="S"))
222 self.send_and_expect(pg1, [p], pg0)
223
224 sessions = self.vapi.nat44_user_session_dump(pg0.remote_ip4, 0)
225 self.assertEqual(2, len(sessions))
226
227
228if __name__ == '__main__':
229 unittest.main(testRunner=VppTestRunner)