nat44-ed: address-only static mappings looked up with the packet's protocol (all flows on one worker; other IP protocols dropped) #3743

#!/usr/bin/env bash
# Reproduce: NAT44-ED looks up address-only static mappings with the packet's
# protocol, but stores them with protocol 0.
#
# Needs: a running VPP with at least 2 workers and nat_plugin and
# af_packet_plugin loaded, NAT44-ED not yet enabled; root; iproute2; python3.
# Builds everything on one host with veth pairs and network namespaces:
#
#   nat-out (10.10.10.2) --veth-- VPP host-vout 10.10.10.1   [nat44 outside]
#   nat-in$i (172.16.0.2) --veth-- VPP host-vin$i 172.16.0.1  [nat44 inside, VRF $i]
#   static mapping: local 172.16.0.2 external 10.20.0.$i vrf $i (address-only)
#
# Checks:
#   1. 200 new UDP flows to the 4 external addresses: NAT sessions per worker.
#   2. 20 inbound packets of IP protocol 253 to 10.20.0.1.
#   3. 20 outbound packets of IP protocol 253 from 172.16.0.2 in VRF 1.
#
# Usage: sudo ./nat44-ed-repro.sh   (VPPCTL="vppctl -s /run/vpp/cli.sock" to override)
set -euo pipefail
VPPCTL=${VPPCTL:-vppctl}
N=4
vpp() { $VPPCTL "$@" | tr -d '\r'; }

cleanup() {
	set +e
	for i in $(seq $N); do ip link del "vin$i" 2>/dev/null; ip netns del "nat-in$i" 2>/dev/null; done
	ip link del vout 2>/dev/null
	ip netns del nat-out 2>/dev/null
}
trap cleanup EXIT
cleanup

vpp nat44 plugin enable sessions 65536

# Outside: a client namespace.
ip netns add nat-out
ip link add vout type veth peer name vout-ns
ip link set vout-ns netns nat-out
ip -n nat-out addr add 10.10.10.2/24 dev vout-ns
ip -n nat-out link set vout-ns up
ip -n nat-out link set lo up
ip -n nat-out route add 10.20.0.0/24 via 10.10.10.1
ip link set vout up
vpp create host-interface name vout >/dev/null
vpp set interface ip address host-vout 10.10.10.1/24
vpp set interface state host-vout up
vpp set interface nat44 out host-vout

# Inside: N servers, each in its own VRF, all with the same address.
for i in $(seq $N); do
	ip netns add "nat-in$i"
	ip link add "vin$i" type veth peer name "vin$i-ns"
	ip link set "vin$i-ns" netns "nat-in$i"
	ip -n "nat-in$i" addr add 172.16.0.2/30 dev "vin$i-ns"
	ip -n "nat-in$i" link set "vin$i-ns" up
	ip -n "nat-in$i" link set lo up
	ip -n "nat-in$i" route add default via 172.16.0.1
	ip link set "vin$i" up
	vpp ip table add "$i"
	vpp create host-interface name "vin$i" >/dev/null
	vpp set interface ip table "host-vin$i" "$i"
	vpp set interface ip address "host-vin$i" 172.16.0.1/30
	vpp set interface state "host-vin$i" up
	vpp set interface nat44 in "host-vin$i"
	vpp ip route add 0.0.0.0/0 table "$i" via 10.10.10.2 next-hop-table 0
	vpp nat44 add static mapping local 172.16.0.2 external "10.20.0.$i" vrf "$i"
done

# Resolve neighbors first so no test packet waits on ARP.
ip netns exec nat-out ping -c1 -W1 10.10.10.1 >/dev/null || true
for i in $(seq $N); do ip netns exec "nat-in$i" ping -c1 -W1 172.16.0.1 >/dev/null || true; done
sleep 1

echo "== 1. 200 UDP flows (50 source ports x $N external addresses), sessions per thread:"
ip netns exec nat-out python3 - "$N" <<'EOF'
import socket, sys
for i in range(1, int(sys.argv[1]) + 1):
    for p in range(50):
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.bind(("", 40000 + i * 50 + p))
        s.sendto(b"x", ("10.20.0.%d" % i, 8080))
        s.close()
EOF
sleep 1
vpp show nat44 sessions | grep -E '^-------- thread'

echo "== 2. inbound IP protocol 253 x20 to 10.20.0.1, delivered to nat-in1:"
vpp clear errors
ip netns exec nat-in1 timeout 3 tcpdump -n -l -i vin1-ns 'ip proto 253' 2>/dev/null >/tmp/nat-repro-in.txt &
sleep 1
ip netns exec nat-out python3 -c '
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, 253)
for _ in range(20): s.sendto(b"proto-253-inbound", ("10.20.0.1", 0))'
wait
echo "   received: $(grep -c ' IP ' /tmp/nat-repro-in.txt) of 20"
vpp show errors | grep -i 'no translation' || echo "   (no 'no translation' errors)"

echo "== 3. outbound IP protocol 253 x20 from 172.16.0.2 (VRF 1), source seen in nat-out:"
ip netns exec nat-out timeout 3 tcpdump -n -l -i vout-ns 'ip proto 253' 2>/dev/null >/tmp/nat-repro-out.txt &
sleep 1
ip netns exec nat-in1 python3 -c '
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, 253)
for _ in range(20): s.sendto(b"proto-253-outbound", ("10.10.10.2", 0))'
wait
echo "   received: $(grep -c ' IP ' /tmp/nat-repro-out.txt) of 20, sources: $(awk '/ IP / {print $3}' /tmp/nat-repro-out.txt | sort -u | tr '\n' ' ')"
rm -f /tmp/nat-repro-in.txt /tmp/nat-repro-out.txt