Skip to content

vpp: T7972: Make nat44 no-forwarding feature automatically configurable #4880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
natali-rs1985 wants to merge 1 commit into
base: current
Choose a base branch
from
Open

vpp: T7972: Make nat44 no-forwarding feature automatically configurable #4880

natali-rs1985 wants to merge 1 commit into from
+56 −12

Conversation

@natali-rs1985
Copy link
Contributor

@natali-rs1985 natali-rs1985 commented Nov 28, 2025 •
edited
Loading

Change summary

Automatically enable nat44 forwarding if static rules are configured

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe): configure feature automatically

Related Task(s)

Related PR(s)

vyos/vyos-documentation#1717

How to test / Smoketest result

vyos@vyos# /usr/libexec/vyos/tests/smoke/cli/test_vpp.py -k test_16_vpp_nat
test_16_vpp_nat (__main__.TestVPP.test_16_vpp_nat) ... ok

----------------------------------------------------------------------
Ran 1 test in 56.907s

OK

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

@github-actions
Copy link

github-actions bot commented Nov 28, 2025 •
edited
Loading

👍
No issues in PR Title / Commit Title

@natali-rs1985 natali-rs1985 added the bp/circinus Create automatic backport for circinus label Nov 28, 2025
sever-sever
sever-sever reviewed Nov 28, 2025
View reviewed changes
sever-sever
sever-sever reviewed Nov 28, 2025
View reviewed changes
sever-sever
sever-sever reviewed Nov 28, 2025
View reviewed changes
@natali-rs1985 natali-rs1985 mentioned this pull request Nov 28, 2025
Open
1 task
@natali-rs1985
Copy link
Contributor Author

natali-rs1985 commented Nov 28, 2025 •
edited
Loading

@sever-sever All change requests were addressed

sever-sever
sever-sever approved these changes Dec 1, 2025
View reviewed changes
Copy link
Member

@sever-sever sever-sever left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All my requests have been fulfilled.
Migrate NAT no-forwarding option to more clear CLI syntax/meaning

zdc
zdc requested changes Dec 2, 2025
View reviewed changes
interface-definitions/vpp.xml.in Outdated
<regex>(static-dynamic|static-bypass)</regex>
</constraint>
</properties>
<defaultValue>static-dynamic</defaultValue>
Copy link
Contributor

@zdc zdc Dec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't the static-bypass option to be the default one?

How I read this.

  • Before: by default, nat44 forwarding was enabled (no no-forwarding in CLI).
  • After: by default, nat44 forwarding is disabled, because static-dynamic is a default value and enable_forwarding = config['processing_mode'] == 'static-bypass'

Am I missing something?

Copy link
Contributor Author

@natali-rs1985 natali-rs1985 Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Made changes to PR. Now `forwarding' is enable or disabled automatically depending on static rules configuration

@natali-rs1985 natali-rs1985 force-pushed the T7972 branch 2 times, most recently from f0a55e4 to 9690fbb Compare December 3, 2025 12:46
@natali-rs1985 natali-rs1985 changed the title vpp: T7972: Improve nat44 no-forwarding feature name and description in CLI vpp: T7972: Make nat44 no-forwarding feature automatically configurable Dec 3, 2025
zdc
zdc requested changes Dec 4, 2025
View reviewed changes
Copy link
Contributor

@zdc zdc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I understand, the logic appears incomplete. There are three possible configurations to consider:

  1. Only dynamic rules are configured.
  2. Both dynamic and static rules are configured.
  3. Only static rules are configured.

Here is a decision table outlining which forwarding option states are compatible with each configuration:

Rules Forwarding Description
Dynamic Disabled All traffic on an "in" interface is processed by dynamic NAT rules.
Dynamic + Static Disabled All traffic on an "in" interface is processed by static (higher priority) or dynamic NAT rules.
Static Enabled Only traffic on an "in" interface matching static rules undergoes NAT; all other traffic is forwarded unchanged.

In other words, the logic should actually be reversed. If you want to use a single condition to determine the forwarding status, it should be based on dynamic rules. If any dynamic rule is present in the configuration, forwarding must always be disabled - otherwise, those dynamic rules will not function as intended.

@natali-rs1985
Copy link
Contributor Author

natali-rs1985 commented Dec 4, 2025

@zdc Yes, you are right! Thanks for pointing to this!

zdc
zdc approved these changes Dec 4, 2025
View reviewed changes
Copy link
Contributor

@zdc zdc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I just want to see a bit more detailed comment on this, so no one will need to read the whole history next time

@natali-rs1985
vpp: T7972: Make nat44 no-forwarding feature automatically configur…
e091fb8 
…able

If any dynamic rule is configured forwarding should be disabled because each
packet must be processed through the NAT session table to apply proper
translations
@github-actions
Copy link

github-actions bot commented Dec 4, 2025

CI integration 👍 passed!

Details

CI logs

  • CLI Smoketests (no interfaces) 👍 passed
  • CLI Smoketests VPP 👍 passed
  • CLI Smoketests (interfaces only) 👍 passed
  • Config tests 👍 passed
  • Config tests VPP 👍 passed
  • RAID1 tests 👍 passed
  • TPM tests 👍 passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zdc zdc zdc approved these changes

@dmbaturin dmbaturin Awaiting requested review from dmbaturin

@sever-sever sever-sever Awaiting requested review from sever-sever

Assignees

@natali-rs1985 natali-rs1985

Labels

bp/circinus Create automatic backport for circinus current

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@natali-rs1985 @zdc @sever-sever