T7181: VPP Static and dynamic NAT

New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface>                     # multi
set vpp nat44 interface inside <interface>                      # multi
set vpp nat44 address-pool translation interface <interface>    # multi
set vpp nat44 address-pool translation address <address>        # multi
set vpp nat44 address-pool twice-nat interface <interface>      # multi
set vpp nat44 address-pool twice-nat address <address>                  # multi

set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>

set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit>            # default 64512
set vpp settings nat44 timeout udp <sec>                # default 300
set vpp settings nat44 timeout tcp-established <sec>    # default 7440
set vpp settings nat44 timeout tcp-transitory <sec>     # default 240
set vpp settings nat44 timeout icmp <sec>               # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```

1 files changed, 212 insertions, 81 deletions

diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in
index 263f9cb91..b1ae348da 100644
--- a/interface-definitions/vpp.xml.in
+++ b/interface-definitions/vpp.xml.in
@@ -788,6 +788,98 @@
             </leafNode>
           </children>
         </node>
+        <node name="nat44">
+          <properties>
+            <help>NAT settings</help>
+          </properties>
+          <children>
+            <node name="timeout">
+              <properties>
+                <help>NAT44 session timeouts</help>
+              </properties>
+              <children>
+                <leafNode name="icmp">
+                  <properties>
+                    <help>ICMP timeout</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>Timeout in seconds (default: 60)</description>
+                    </valueHelp>
+                  </properties>
+                  <defaultValue>60</defaultValue>
+                </leafNode>
+                <leafNode name="tcp-established">
+                  <properties>
+                    <help>TCP established timeout</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>TCP established timeout in seconds (default: 7440)</description>
+                    </valueHelp>
+                  </properties>
+                  <defaultValue>7440</defaultValue>
+                </leafNode>
+                <leafNode name="tcp-transitory">
+                  <properties>
+                    <help>TCP transitory timeout</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>Timeout in seconds (default: 240)</description>
+                    </valueHelp>
+                  </properties>
+                  <defaultValue>240</defaultValue>
+                </leafNode>
+                <leafNode name="udp">
+                  <properties>
+                    <help>UDP timeout</help>
+                    <valueHelp>
+                      <format>u32</format>
+                      <description>Timeout in seconds (default: 60)</description>
+                    </valueHelp>
+                  </properties>
+                  <defaultValue>60</defaultValue>
+                </leafNode>
+              </children>
+            </node>
+            <leafNode name="session-limit">
+              <properties>
+                <help>Maximum number of sessions per thread</help>
+                <valueHelp>
+                  <format>u32</format>
+                  <description>Number of sessions</description>
+                </valueHelp>
+                <constraint>
+                  <validator name="numeric" argument="--range 1-4294967295"/>
+                </constraint>
+                <constraintErrorMessage>Number of sessions must be between 1 and 4294967295</constraintErrorMessage>
+              </properties>
+              <defaultValue>64512</defaultValue>
+            </leafNode>
+            <leafNode name="workers">
+              <properties>
+                <help>List of NAT workers</help>
+                <valueHelp>
+                  <format>&lt;id&gt;</format>
+                  <description>Worker id</description>
+                </valueHelp>
+                <valueHelp>
+                  <format>&lt;idN&gt;-&lt;idM&gt;</format>
+                  <description>Worker id range (use '-' as delimiter)</description>
+                </valueHelp>
+                <constraint>
+                  <validator name="numeric" argument="--allow-range --range 0-512"/>
+                </constraint>
+                <constraintErrorMessage>Not a valid value or range</constraintErrorMessage>
+                <multi/>
+              </properties>
+            </leafNode>
+            <leafNode name="no-forwarding">
+              <properties>
+                <help>Do not forward packets which do not match existing NAT translations (static or dynamic)</help>
+                <valueless/>
+              </properties>
+            </leafNode>
+          </children>
+        </node>
         <node name="physmem">
           <properties>
             <help>Physical memory settings</help>
@@ -842,73 +934,65 @@
         </node>
       </children>
     </node>
-    <node name="nat44">
+    <node name="nat44" owner="${vyos_conf_scripts_dir}/vpp_nat.py">
       <properties>
         <help>NAT44</help>
+        <priority>320</priority>
       </properties>
       <children>
-        <node name="source" owner="${vyos_conf_scripts_dir}/vpp_nat_source.py">
+        <node name="interface">
           <properties>
-            <help>Source NAT setting</help>
-            <priority>320</priority>
+            <help>NAT interface setting</help>
           </properties>
           <children>
-            <leafNode name="inside-interface">
+            <leafNode name="inside">
               <properties>
                 <help>NAT inside interface</help>
                 <completionHelp>
-                  <list>any</list>
                   <script>${vyos_completion_dir}/list_interfaces</script>
                 </completionHelp>
+                <multi/>
               </properties>
             </leafNode>
-            <leafNode name="outside-interface">
+            <leafNode name="outside">
               <properties>
                 <help>NAT outside interface</help>
                 <completionHelp>
-                  <list>any</list>
                   <script>${vyos_completion_dir}/list_interfaces</script>
                 </completionHelp>
+                <multi/>
               </properties>
             </leafNode>
+          </children>
+        </node>
+        <node name="address-pool">
+          <properties>
+            <help>NAT address pool</help>
+          </properties>
+          <children>
             <node name="translation">
               <properties>
-                <help>Outside NAT IP (source NAT only)</help>
+                <help>NAT translation pool</help>
               </properties>
               <children>
-                <leafNode name="address">
-                  <properties>
-                    <help>IP address, subnet, or range</help>
-                    <completionHelp>
-                      <list>masquerade</list>
-                    </completionHelp>
-                    <valueHelp>
-                      <format>ipv4</format>
-                      <description>IPv4 address to match</description>
-                    </valueHelp>
-                    <valueHelp>
-                      <format>ipv4range</format>
-                      <description>IPv4 address range to match</description>
-                    </valueHelp>
-                    <valueHelp>
-                      <format>masquerade</format>
-                      <description>NAT to the primary address of outbound-interface</description>
-                    </valueHelp>
-                    <constraint>
-                      <validator name="ipv4-address"/>
-                      <validator name="ipv4-range"/>
-                      <regex>(masquerade)</regex>
-                    </constraint>
-                  </properties>
-                </leafNode>
+                #include <include/vpp/nat_address_range.xml.i>
+                #include <include/vpp/nat_interface.xml.i>
+              </children>
+            </node>
+            <node name="twice-nat">
+              <properties>
+                <help>NAT twice-nat pool</help>
+              </properties>
+              <children>
+                #include <include/vpp/nat_address_range.xml.i>
+                #include <include/vpp/nat_interface.xml.i>
               </children>
             </node>
           </children>
         </node>
-        <node name="static" owner="${vyos_conf_scripts_dir}/vpp_nat_static.py">
+        <node name="static">
           <properties>
-            <help>Static NAT settings</help>
-            <priority>321</priority>
+            <help>Static NAT rules</help>
           </properties>
           <children>
             <tagNode name="rule">
@@ -920,6 +1004,7 @@
                 </valueHelp>
               </properties>
               <children>
+                #include <include/generic-description.xml.i>
                 <node name="external">
                   <properties>
                     <help>NAT external parameters</help>
@@ -940,50 +1025,6 @@
                     #include <include/port-number.xml.i>
                   </children>
                 </node>
-                <leafNode name="protocol">
-                  <properties>
-                    <help>Protocol to NAT</help>
-                    <completionHelp>
-                      <list>tcp udp icmp all</list>
-                    </completionHelp>
-                    <valueHelp>
-                      <format>all</format>
-                      <description>All protocols (TCP, UDP, and ICMP)</description>
-                    </valueHelp>
-                    <valueHelp>
-                      <format>icmp</format>
-                      <description>Internet control message protocol</description>
-                    </valueHelp>
-                    <valueHelp>
-                      <format>tcp</format>
-                      <description>Transmission control protocol</description>
-                    </valueHelp>
-                    <valueHelp>
-                      <format>udp</format>
-                      <description>user datagram protocol</description>
-                    </valueHelp>
-                    <constraint>
-                      <regex>(tcp|udp|icmp|all)</regex>
-                    </constraint>
-                  </properties>
-                  <defaultValue>all</defaultValue>
-                </leafNode>
-                <leafNode name="outside-interface">
-                  <properties>
-                    <help>NAT outside interface</help>
-                    <completionHelp>
-                      <script>${vyos_completion_dir}/list_interfaces</script>
-                    </completionHelp>
-                  </properties>
-                </leafNode>
-                <leafNode name="inside-interface">
-                  <properties>
-                    <help>NAT inside interface</help>
-                    <completionHelp>
-                      <script>${vyos_completion_dir}/list_interfaces</script>
-                    </completionHelp>
-                  </properties>
-                </leafNode>
                 <node name="local">
                   <properties>
                     <help>NAT local parameters</help>
@@ -1004,6 +1045,96 @@
                     #include <include/port-number.xml.i>
                   </children>
                 </node>
+                <node name="options">
+                  <properties>
+                    <help>NAT static mapping options</help>
+                  </properties>
+                  <children>
+                    <leafNode name="twice-nat">
+                      <properties>
+                        <help>Rewrite source IP addresses on packets sent from outside to inside</help>
+                        <valueless/>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="self-twice-nat">
+                      <properties>
+                        <help>Rewrite source IP addresses on packets sent only from a local address to an external address</help>
+                        <valueless/>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="out-to-in-only">
+                      <properties>
+                        <help>Only apply rule for traffic from outside to inside interfaces</help>
+                        <valueless/>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="twice-nat-address">
+                      <properties>
+                        <help>Force use of specific IP address from twice-nat address pool</help>
+                        <valueHelp>
+                          <format>ipv4</format>
+                          <description>IPv4 address</description>
+                        </valueHelp>
+                        <constraint>
+                          <validator name="ipv4-address"/>
+                        </constraint>
+                      </properties>
+                    </leafNode>
+                  </children>
+                </node>
+                #include <include/vpp/nat_protocol.xml.i>
+              </children>
+            </tagNode>
+          </children>
+        </node>
+        <node name="exclude">
+          <properties>
+            <help>Exclude packets matching these rules from NAT</help>
+          </properties>
+          <children>
+            <tagNode name="rule">
+              <properties>
+                <help>Rule number</help>
+                <valueHelp>
+                  <format>u32</format>
+                  <description>Number of rule</description>
+                </valueHelp>
+              </properties>
+              <children>
+                <leafNode name="local-address">
+                  <properties>
+                    <help>IP address of the internal (local) device</help>
+                    <valueHelp>
+                      <format>ipv4</format>
+                      <description>IPv4 address</description>
+                    </valueHelp>
+                    <constraint>
+                      <validator name="ipv4-address"/>
+                    </constraint>
+                  </properties>
+                </leafNode>
+                <leafNode name="local-port">
+                  <properties>
+                    <help>Port number used by connection on internal device</help>
+                    <valueHelp>
+                      <format>u32:1-65535</format>
+                      <description>Numeric IP port</description>
+                    </valueHelp>
+                    <constraint>
+                      <validator name="numeric" argument="--range 1-65535"/>
+                    </constraint>
+                    <constraintErrorMessage>Port number must be in range 1 to 65535</constraintErrorMessage>
+                  </properties>
+                </leafNode>
+                #include <include/vpp/nat_protocol.xml.i>
+                <leafNode name="external-interface">
+                  <properties>
+                    <help>External interface</help>
+                    <completionHelp>
+                      <script>${vyos_completion_dir}/list_interfaces</script>
+                    </completionHelp>
+                  </properties>
+                </leafNode>
                 #include <include/generic-description.xml.i>
               </children>
             </tagNode>