T7929: VPP: nat44: validate that only self-twice-nat external address is in translation pool

[natali-rs1985]

Change summary

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T7929

Related PR(s)

vyos/vyos-documentation#1695

How to test / Smoketest result

set vpp settings interface eth1 driver 'dpdk'
set vpp settings interface eth0 driver 'dpdk'
set vpp nat44 address-pool twice-nat address '203.0.113.6'
set vpp nat44 interface inside 'eth1'
set vpp nat44 interface outside 'eth0'
set vpp nat44 static rule 100 description 'RDP server - external access only'
set vpp nat44 static rule 100 external address '203.0.113.5'
set vpp nat44 static rule 100 external port '3389'
set vpp nat44 static rule 100 local address '10.10.10.30'
set vpp nat44 static rule 100 local port '3389'
set vpp nat44 static rule 100 options out-to-in-only
set vpp nat44 static rule 100 protocol 'tcp'
set vpp nat44 static rule 200 description 'Web server alt port with twice-NAT'
set vpp nat44 static rule 200 external address '203.0.113.3'
set vpp nat44 static rule 200 external port '8080'
set vpp nat44 static rule 200 local address '10.10.10.10'
set vpp nat44 static rule 200 local port '8080'
set vpp nat44 static rule 200 options self-twice-nat
set vpp nat44 static rule 200 protocol 'tcp'


vyos@vyos# commit
[ vpp ]

WARNING: NOTE: Current dataplane capacity (estimated): 2.1 M IPv4
routes. Exceeding these values will lead to a dataplane out-of-memory
condition and a crash. Extensive use of features like ACLs, NAT and
others may reduce the numbers above. Please read the documentation for
details: https://docs.vyos.io/


[ vpp nat44 ]
Configuration error in static rule 200: external address 203.0.113.3 is
not in "address-pool translation"
[[vpp nat44]] failed
Commit failed
[edit]
vyos@vyos# set vpp nat44 address-pool translation address 203.0.113.3
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# sudo vppctl show nat44 static mappings
NAT44 static mappings:
 TCP local 10.10.10.30:3389 external 203.0.113.5:3389 vrf 0  out2in-only
 TCP local 10.10.10.10:8080 external 203.0.113.3:8080 vrf 0 self-twice-nat
[edit]

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests VPP 👍 passed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• Config tests VPP 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed

[zdc]

I have not tested this, but this looks very straightforward.