From fa293316e679645e6397697428cee96e32e346fc Mon Sep 17 00:00:00 2001
From: Nataliia Solomko <natalirs1985@gmail.com>
Date: Wed, 23 Apr 2025 15:11:16 +0300
Subject: T7181: VPP Static and dynamic NAT

New CLI for static and dynamic NAT:
```
set vpp nat44 interface outside <interface>                     # multi
set vpp nat44 interface inside <interface>                      # multi
set vpp nat44 address-pool translation interface <interface>    # multi
set vpp nat44 address-pool translation address <address>        # multi
set vpp nat44 address-pool twice-nat interface <interface>      # multi
set vpp nat44 address-pool twice-nat address <address>                  # multi

set vpp nat44 static rule <rule> external address <address>
set vpp nat44 static rule <rule> external port <port>
set vpp nat44 static rule <rule> local address <address>
set vpp nat44 static rule <rule> local port <port>
set vpp nat44 static rule <rule> protocol <protocol>
set vpp nat44 static rule <rule> options twice-nat
set vpp nat44 static rule <rule> options self-twice-nat
set vpp nat44 static rule <rule> options out-to-in-only
set vpp nat44 static rule <rule> options twice-nat-address <address>

set vpp nat44 exclude rule <rule> protocol <protocol>
set vpp nat44 exclude rule <rule> local-port <port>
set vpp nat44 exclude rule <rule> local-address <address>
set vpp nat44 exclude rule <rule> external-interface <interface>
```
Settings:
```
set vpp settings nat44 session-limit <limit>            # default 64512
set vpp settings nat44 timeout udp <sec>                # default 300
set vpp settings nat44 timeout tcp-established <sec>    # default 7440
set vpp settings nat44 timeout tcp-transitory <sec>     # default 240
set vpp settings nat44 timeout icmp <sec>               # default 60
set vpp settings nat44 workers <list>
set vpp settings nat44 no-forwarding
```
---
 src/conf_mode/vpp.py | 48 ++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 44 insertions(+), 4 deletions(-)

(limited to 'src/conf_mode/vpp.py')

diff --git a/src/conf_mode/vpp.py b/src/conf_mode/vpp.py
index ca7d19160..7f9adc68b 100755
--- a/src/conf_mode/vpp.py
+++ b/src/conf_mode/vpp.py
@@ -136,10 +136,8 @@ def get_config(config=None):
             set_dependents('ethernet', conf, removed_iface)
 
     # NAT dependency
-    if conf.exists(['vpp', 'nat44', 'source']):
-        set_dependents('vpp_nat_source', conf)
-    if conf.exists(['vpp', 'nat44', 'static']):
-        set_dependents('vpp_nat_static', conf)
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
 
     if not conf.exists(base):
         return {
@@ -424,6 +422,7 @@ def verify(config):
                                 'Only one multipoint GRE tunnel is allowed from the same source address'
                             )
 
+    workers = 0
     if 'cpu' in config['settings']:
         if (
             'corelist_workers' in config['settings']['cpu']
@@ -496,6 +495,22 @@ def verify(config):
                 if not all(el in cpus_available for el in all_core_numbers):
                     raise ConfigError('"cpu corelist-workers" is not correct')
 
+                workers = len(all_core_numbers)
+
+    if 'workers' in config['settings']['nat44']:
+        nat_workers = []
+        for worker_range in config['settings']['nat44']['workers']:
+            worker_numbers = worker_range.split('-')
+            if int(worker_numbers[0]) > int(worker_numbers[-1]):
+                raise ConfigError(
+                    f'Range for "nat44 workers {worker_range}" is not correct'
+                )
+            nat_workers.extend(
+                range(int(worker_numbers[0]), int(worker_numbers[-1]) + 1)
+            )
+        if not all(el in list(range(workers)) for el in nat_workers):
+            raise ConfigError('"nat44 workers" is not correct')
+
     verify_memory(config['settings'])
     if 'host_resources' in config['settings']:
         if (
@@ -716,6 +731,31 @@ def apply(config):
         # Syncronize routes via LCP
         vpp_control.lcp_resync()
 
+        # NAT44 settings
+        nat44_settings = config['settings'].get('nat44', {})
+
+        enable_forwarding = True
+        if 'no_forwarding' in nat44_settings:
+            enable_forwarding = False
+        vpp_control.enable_disable_nat44_forwarding(enable_forwarding)
+
+        vpp_control.set_nat_timeouts(
+            icmp=int(nat44_settings.get('timeout').get('icmp')),
+            udp=int(nat44_settings.get('timeout').get('udp')),
+            tcp_established=int(nat44_settings.get('timeout').get('tcp_established')),
+            tcp_transitory=int(nat44_settings.get('timeout').get('tcp_transitory')),
+        )
+
+        vpp_control.set_nat44_session_limit(int(nat44_settings.get('session_limit')))
+
+        if nat44_settings.get('workers'):
+            bitmask = 0
+            for worker_range in nat44_settings['workers']:
+                worker_numbers = worker_range.split('-')
+                for wid in range(int(worker_numbers[0]), int(worker_numbers[-1]) + 1):
+                    bitmask |= 1 << wid
+            vpp_control.set_nat_workers(bitmask)
+
     # Save persistent config
     if 'persist_config' in config and config['persist_config']:
         persist_config.write('eth_ifaces', config['persist_config'])
-- 
cgit v1.2.3