nptv6: T2518: Support IPv6 address translation

5 files changed, 106 insertions, 13 deletions

diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl
index b1a8f7a16..9f5d49ba7 100644
--- a/data/templates/firewall/nftables-nat66.tmpl
+++ b/data/templates/firewall/nftables-nat66.tmpl
@@ -13,8 +13,14 @@
 {%     endif %}
 {%     set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none  %}
 {%   elif chain == "POSTROUTING" %}
+{%     if config.translation.address | is_ip_network %}
+{#       support 1:1 network translation #}
+{%       set snat_type = "snat prefix to " %}
+{%     else   %}
+{%       set snat_type = "snat to " %}
+{%     endif %}
 {%     set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %}
-{%     set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %}
+{%     set trns_address = snat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
 {%   endif %}
 {%   set comment   = "NPT-NAT-" + rule %}
 {%   if rule.log %}
@@ -35,9 +41,6 @@
 {%   if dest_address %}
 {%     set output = output + " " + dest_address %}
 {%   endif %}
-{%   if trns_prefix %}
-{%     set output = output + " " + trns_prefix %}
-{%   endif %}
 {%   if trns_address %}
 {%     set output = output + " " + trns_address %}
 {%   endif %}
diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in
index b45ebc0a8..d5e1226f9 100644
--- a/interface-definitions/nat66.xml.in
+++ b/interface-definitions/nat66.xml.in
@@ -70,18 +70,31 @@
               </node>
               <node name="translation">
                 <properties>
-                  <help>Translated IPv6 prefix options</help>
+                  <help>Translated IPv6 address options</help>
                 </properties>
                 <children>
-                  <leafNode name="prefix">
+                  <leafNode name="address">
                     <properties>
-                      <help>IPv6 prefix to translate to</help>
+                      <help>IPv6 address to translate to</help>
+                      <completionHelp>
+                        <list>masquerade</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>IPv6 address</description>
+                      </valueHelp>
                       <valueHelp>
                         <format>ipv6net</format>
                         <description>IPv6 prefix</description>
                       </valueHelp>
+                      <valueHelp>
+                        <format>masquerade</format>
+                        <description>NAT to the primary address of outbound-interface</description>
+                      </valueHelp>
                       <constraint>
+                        <validator name="ipv6-address"/>
                         <validator name="ipv6-prefix"/>
+                        <regex>(masquerade)</regex>
                       </constraint>
                     </properties>
                   </leafNode>
diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py
index ccc4196e0..d2cb60025 100755
--- a/smoketest/scripts/cli/test_nat66.py
+++ b/smoketest/scripts/cli/test_nat66.py
@@ -44,7 +44,7 @@ class TestNAT66(unittest.TestCase):
         translation_prefix = 'fc01::/64'
         self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1'])
         self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix])
-        self.session.set(src_path + ['rule', '1', 'translation', 'prefix', translation_prefix])
+        self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_prefix])
 
         # check validate() - outbound-interface must be defined
         self.session.commit()
@@ -70,6 +70,36 @@ class TestNAT66(unittest.TestCase):
             self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix)
             self.assertEqual(f'{address}/{mask}', source_prefix)
     
+    def test_source_nat66_address(self):
+        source_prefix = 'fc00::/64'
+        translation_address = 'fc00::1'
+        self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1'])
+        self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix])
+        self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_address])
+
+        # check validate() - outbound-interface must be defined
+        self.session.commit()
+
+        tmp = cmd('sudo nft -j list table ip6 nat')
+        data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp))
+
+        for idx in range(0, len(data_json)):
+            data = data_json[idx]
+
+            self.assertEqual(data['chain'], 'POSTROUTING')
+            self.assertEqual(data['family'], 'ip6')
+            self.assertEqual(data['table'], 'nat')
+
+            iface = dict_search('match.right', data['expr'][0])
+            address = dict_search('match.right.prefix.addr', data['expr'][2])
+            mask = dict_search('match.right.prefix.len', data['expr'][2])
+            snat_address = dict_search('snat.addr', data['expr'][3])
+
+            self.assertEqual(iface, 'eth1')
+            # check for translation address
+            self.assertEqual(snat_address, translation_address)
+            self.assertEqual(f'{address}/{mask}', source_prefix)
+    
     def test_destination_nat66(self):
         destination_address = 'fc00::1'
         translation_address = 'fc01::1'
@@ -139,7 +169,7 @@ class TestNAT66(unittest.TestCase):
         with self.assertRaises(ConfigSessionError):
             self.session.commit()
 
-        self.session.set(src_path + ['rule', rule, 'translation', 'prefix', translation_prefix])
+        self.session.set(src_path + ['rule', rule, 'translation', 'address', translation_prefix])
         self.session.commit()
 
     def test_nat66_no_rules(self):
diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py
index dc3cd550c..ce1db316c 100755
--- a/src/conf_mode/nat66.py
+++ b/src/conf_mode/nat66.py
@@ -28,6 +28,7 @@ from vyos.util import cmd
 from vyos.util import check_kmod
 from vyos.util import dict_search
 from vyos.template import is_ipv6
+from vyos.template import is_ip_network
 from vyos.xml import defaults
 from vyos import ConfigError
 from vyos import airbag
@@ -116,10 +117,10 @@ def verify(nat):
                 if config['outbound_interface'] not in interfaces():
                     print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system')
 
-            prefix = dict_search('translation.prefix', config)
-            if prefix != None:
-                if not is_ipv6(prefix):
-                    raise ConfigError(f'Warning: IPv6 prefix {prefix} is not a valid address prefix')
+            addr = dict_search('translation.address', config)
+            if addr != None:
+                if addr != 'masquerade' and not is_ipv6(addr):
+                    raise ConfigError(f'Warning: IPv6 address {addr} is not a valid address')
 
             prefix = dict_search('source.prefix', config)
             if prefix != None:
diff --git a/src/migration-scripts/nat66/1-to-2 b/src/migration-scripts/nat66/1-to-2
new file mode 100755
index 000000000..9c3998ec1
--- /dev/null
+++ b/src/migration-scripts/nat66/1-to-2
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import argv,exit
+from vyos.configtree import ConfigTree
+
+if (len(argv) < 1):
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+base = ['nat66', 'source']
+
+if not config.exists(base):
+    # Nothing to do
+    exit(0)
+
+for rule in config.list_nodes(base + ['rule']):
+    rule_base = base + ['rule', rule]
+    config.rename(rule_base + ['translation', 'prefix'], 'address')
+    
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)