nat: pnat copy and clear byte instructions

Type: feature
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I8e48bdcc4c311717e067bb0a4e0b409a2eb8e83d
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
Signed-off-by: Ole Troan <ot@cisco.com>

6 files changed, 1045 insertions, 0 deletions

diff --git a/src/plugins/nat/pnat/tests/missing_rule.def b/src/plugins/nat/pnat/tests/missing_rule.def
new file mode 100644
index 00000000000..62135492410
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/missing_rule.def
@@ -0,0 +1,8 @@
+[
+    (
+        "hit missing rule",
+        IP(src='1.1.1.1', dst='123.123.123.123')/UDP(chksum=0, sport=80, dport=6871),
+        IP(src='1.1.1.1', dst='123.123.123.123')/UDP(chksum=0, sport=80, dport=6871),
+        0
+    ),
+]
diff --git a/src/plugins/nat/pnat/tests/packets.def b/src/plugins/nat/pnat/tests/packets.def
new file mode 100644
index 00000000000..b8486642e82
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/packets.def
@@ -0,0 +1,69 @@
+[
+    (
+        "da rewritten",
+        IP(src='1.1.1.1', dst='2.2.2.2')/UDP(sport=80, dport=6871),
+        IP(src='1.1.1.1', dst='1.2.3.4')/UDP(sport=80, dport=6871),
+        4242
+    ),
+    (
+        "unchanged",
+        IP(src='1.1.1.1', dst='2.2.2.2')/UDP(sport=80, dport=8080),
+        IP(src='1.1.1.1', dst='2.2.2.2')/UDP(sport=80, dport=8080),
+        4242
+    ),
+    (
+        "tcp da",
+        IP(src='1.1.1.1', dst='2.2.2.2')/TCP(sport=80, dport=6871),
+        IP(src='1.1.1.1', dst='1.2.3.4')/TCP(sport=80, dport=6871),
+        4242
+    ),
+    (
+        "tcp da ports",
+        IP(src='1.1.1.1', dst='2.2.2.2')/TCP(sport=80, dport=6872),
+        IP(src='1.1.1.1', dst='1.2.3.4')/TCP(sport=53, dport=8000),
+        4242
+    ),
+    (
+        "tcp da ports -- fragmented packet",
+        IP(src='1.1.1.1', dst='2.2.2.2', flags='MF', frag=100)/Raw('X' * 40),
+        IP(src='1.1.1.1', dst='2.2.2.2', flags='MF', frag=100)/Raw('X' * 40),
+        4242
+    ),
+    (
+        "short packet",
+        IP(src='1.1.1.1', dst='2.2.2.2'),
+        IP(src='1.1.1.1', dst='2.2.2.2'),
+        4242
+    ),
+    (
+        "copy byte",
+        IP(src='1.1.1.234', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=6874),
+        IP(src='1.1.1.234', dst='2.2.2.234')/UDP(chksum=0, sport=80, dport=6874),
+        4242
+    ),
+    (
+        "copy byte into Geneve reserved field",
+        IP(src='1.1.1.1', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=6877)/GENEVE(vni=4040),
+        IP(src='1.1.1.1', dst='1.2.3.4')/UDP(chksum=0, sport=80, dport=6877)/Raw(b'\x00\x00\x00\x00\x00\x0F\xC8\x01'),
+        4242
+    ),
+    (
+        "copy byte overrun",
+        IP(src='1.1.1.234', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=6875),
+        IP(src='1.1.1.234', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=6875),
+        0
+    ),
+    (
+        "clear byte",
+        IP(src='1.1.1.234', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=6876),
+        IP(src='1.1.1.234', dst='2.2.2.2')/UDP(chksum=0, sport=80, dport=220),
+        4242
+    ),
+    (
+        "packet with options",
+        IP(src='1.1.1.1', dst='2.2.2.2', options=[IPOption('\x07')])/TCP(sport=80, dport=6872),
+        IP(src='1.1.1.1', dst='1.2.3.4', options=[IPOption('\x07')])/TCP(sport=53, dport=8000),
+        4242
+    ),
+
+]
diff --git a/src/plugins/nat/pnat/tests/pnat_test.c b/src/plugins/nat/pnat/tests/pnat_test.c
new file mode 100644
index 00000000000..ab55e7ef49d
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/pnat_test.c
@@ -0,0 +1,587 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdbool.h>
+#include <assert.h>
+#include <vlib/vlib.h>
+#include <vnet/feature/feature.h>
+#include <vppinfra/clib_error.h>
+#include <vnet/ip/ip4_packet.h>
+#include <vnet/udp/udp.h>
+#include <vppinfra/bihash_16_8.h>
+#include <vppinfra/bihash_template.c>
+#include <vnet/fib/ip4_fib.h>
+#include "../pnat.h"
+#include <pnat/pnat.api_enum.h> /* For error counters */
+#include <arpa/inet.h>
+#include "pnat_test_stubs.h"
+
+/*
+** Buffer management in test setup
+** Allocate buffers return vector of buffer indicies.
+**
+** Setup frame with buffers when calling function.
+** Global vector of all buffers with their indicies?
+** Convert buffer index to pointer?
+*/
+struct buffers {
+    u8 data[2048];
+};
+struct buffers buffers[256];
+struct buffers expected[256];
+u32 *buffers_vector = 0;
+
+static u32 *buffer_init(u32 *vector, int count) {
+    int i;
+    for (i = 0; i < count; i++) {
+        vec_add1(vector, i);
+    }
+    return vector;
+}
+
+u32 *results_bi = 0; /* global vector of result buffers */
+u16 *results_next = 0;
+
+vlib_node_runtime_t *node;
+
+#define log_info(M, ...)                                                       \
+    fprintf(stderr, "\033[32;1m[OK] " M "\033[0m\n", ##__VA_ARGS__)
+#define log_error(M, ...)                                                      \
+    fprintf(stderr, "\033[31;1m[ERROR] (%s:%d:) " M "\033[0m\n", __FILE__,     \
+            __LINE__, ##__VA_ARGS__)
+#define test_assert_log(A, M, ...)                                             \
+    if (!(A)) {                                                                \
+        log_error(M, ##__VA_ARGS__);                                           \
+        assert(A);                                                             \
+    } else {                                                                   \
+        log_info(M, ##__VA_ARGS__);                                            \
+    }
+#define test_assert(A, M, ...)                                                 \
+    if (!(A)) {                                                                \
+        log_error(M, ##__VA_ARGS__);                                           \
+        assert(A);                                                             \
+    }
+
+/*
+ * Always return the frame of generated packets
+ */
+#define vlib_frame_vector_args test_vlib_frame_vector_args
+void *test_vlib_frame_vector_args(vlib_frame_t *f) { return buffers_vector; }
+
+/* Synthetic value for vnet_feature_next  */
+#define NEXT_PASSTHROUGH 4242
+
+#define vnet_feature_next_u16 test_vnet_feature_next_u16
+void vnet_feature_next_u16(u16 *next0, vlib_buffer_t *b0) {
+    *next0 = NEXT_PASSTHROUGH;
+}
+
+/* Gather output packets */
+#define vlib_buffer_enqueue_to_next test_vlib_buffer_enqueue_to_next
+void test_vlib_buffer_enqueue_to_next(vlib_main_t *vm,
+                                      vlib_node_runtime_t *node, u32 *buffers,
+                                      u16 *nexts, uword count) {
+    vec_add(results_next, nexts, count);
+    vec_add(results_bi, buffers, count);
+}
+
+pnat_trace_t trace = {0};
+#define vlib_add_trace test_vlib_add_trace
+void *test_vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r,
+                          vlib_buffer_t *b, u32 n_data_bytes) {
+    return &trace;
+}
+
+#define vlib_get_buffers test_vlib_get_buffers
+void test_vlib_get_buffers(vlib_main_t *vm, u32 *bi, vlib_buffer_t **b,
+                           int count) {
+    int i;
+    for (i = 0; i < count; i++) {
+        b[i] = (vlib_buffer_t *)&buffers[bi[i]];
+    }
+}
+
+vlib_buffer_t *test_vlib_get_buffer(u32 bi) {
+    return (vlib_buffer_t *)&buffers[bi];
+}
+
+/* Must be included here to allow the above functions to override */
+#include "../pnat_node.h"
+
+/*** TESTS ***/
+
+typedef struct {
+    char *name;
+    int nsend;
+    char *send;
+    int nexpect;
+    char *expect;
+    u32 expect_next_index;
+} test_t;
+#include "test_packets.h"
+
+/* Rules */
+typedef struct {
+    char *src;
+    char *dst;
+    u8 proto;
+    u16 sport;
+    u16 dport;
+    u8 from_offset;
+    u8 to_offset;
+    u8 clear_offset;
+} test_5tuple_t;
+
+typedef struct {
+    test_5tuple_t match;
+    test_5tuple_t rewrite;
+    bool in;
+    u32 index;
+} rule_t;
+
+rule_t rules[] = {
+    {
+        .match = {.dst = "2.2.2.2", .proto = 17, .dport = 6871},
+        .rewrite = {.dst = "1.2.3.4"},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 6, .dport = 6871},
+        .rewrite = {.dst = "1.2.3.4"},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 6, .dport = 6872},
+        .rewrite = {.dst = "1.2.3.4", .sport = 53, .dport = 8000},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 6, .dport = 6873},
+        .rewrite = {.dst = "1.2.3.4", .sport = 53, .dport = 8000},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 17, .dport = 6874},
+        .rewrite = {.from_offset = 15, .to_offset = 19},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 17, .dport = 6875},
+        .rewrite = {.from_offset = 15, .to_offset = 50},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 17, .dport = 6877},
+        .rewrite = {.dst = "1.2.3.4", .from_offset = 15, .to_offset = 35},
+        .in = true,
+    },
+    {
+        .match = {.dst = "2.2.2.2", .proto = 17, .dport = 6876},
+        .rewrite = {.clear_offset = 22},
+        .in = true,
+    },
+};
+
+static int fill_packets(vlib_main_t *vm, vlib_buffer_t *b, int n, char *test) {
+    b->flags |= VLIB_BUFFER_IS_TRACED;
+
+    ip4_header_t *ip = (ip4_header_t *)vlib_buffer_get_current(b);
+
+    memcpy(ip, test, n);
+
+    /* Do the work of SVR */
+    vnet_buffer(b)->ip.reass.l4_src_port = 0;
+    vnet_buffer(b)->ip.reass.l4_dst_port = 0;
+    b->current_length = n;
+
+    if (ip4_is_fragment(ip))
+        return 0;
+    if (ip->protocol == IP_PROTOCOL_UDP) {
+        udp_header_t *udp = ip4_next_header(ip);
+        vnet_buffer(b)->ip.reass.l4_src_port = udp->src_port;
+        vnet_buffer(b)->ip.reass.l4_dst_port = udp->dst_port;
+    } else if (ip->protocol == IP_PROTOCOL_TCP) {
+        tcp_header_t *tcp = ip4_next_header(ip);
+        vnet_buffer(b)->ip.reass.l4_src_port = tcp->src_port;
+        vnet_buffer(b)->ip.reass.l4_dst_port = tcp->dst_port;
+    }
+    return 0;
+}
+
+static void ruletomatch(test_5tuple_t *r, pnat_match_tuple_t *t) {
+    if (r->src) {
+        inet_pton(AF_INET, r->src, &t->src);
+        t->mask |= PNAT_SA;
+    }
+    if (r->dst) {
+        inet_pton(AF_INET, r->dst, &t->dst);
+        t->mask |= PNAT_DA;
+    }
+    if (r->dport) {
+        t->dport = r->dport;
+        t->mask |= PNAT_DPORT;
+    }
+    if (r->sport) {
+        t->sport = r->sport;
+        t->mask |= PNAT_SPORT;
+    }
+    t->proto = r->proto;
+}
+
+static void ruletorewrite(test_5tuple_t *r, pnat_rewrite_tuple_t *t) {
+    if (r->src) {
+        inet_pton(AF_INET, r->src, &t->src);
+        t->mask |= PNAT_SA;
+    }
+    if (r->dst) {
+        inet_pton(AF_INET, r->dst, &t->dst);
+        t->mask |= PNAT_DA;
+    }
+    if (r->dport) {
+        t->dport = r->dport;
+        t->mask |= PNAT_DPORT;
+    }
+    if (r->sport) {
+        t->sport = r->sport;
+        t->mask |= PNAT_SPORT;
+    }
+    if (r->to_offset || r->from_offset) {
+        t->to_offset = r->to_offset;
+        t->from_offset = r->from_offset;
+        t->mask |= PNAT_COPY_BYTE;
+    }
+    if (r->clear_offset) {
+        t->clear_offset = r->clear_offset;
+        t->mask |= PNAT_CLEAR_BYTE;
+    }
+}
+
+static void add_translation(rule_t *r) {
+    pnat_match_tuple_t match = {0};
+    pnat_rewrite_tuple_t rewrite = {0};
+
+    ruletomatch(&r->match, &match);
+    ruletorewrite(&r->rewrite, &rewrite);
+
+    int rv = pnat_binding_add(&match, &rewrite, &r->index);
+    assert(rv == 0);
+
+    rv = pnat_binding_attach(0, PNAT_IP4_INPUT, r->index);
+    assert(rv == 0);
+}
+
+static void del_translation(rule_t *r) {
+    int rv = pnat_binding_detach(0, PNAT_IP4_INPUT, r->index);
+    assert(rv == 0);
+
+    rv = pnat_binding_del(r->index);
+    assert(rv == 0);
+}
+
+static void validate_packet(vlib_main_t *vm, char *name, u32 bi,
+                            vlib_buffer_t *expected_b) {
+    vlib_buffer_t *b = test_vlib_get_buffer(bi);
+    assert(b);
+
+    ip4_header_t *ip = (ip4_header_t *)vlib_buffer_get_current(b);
+    ip4_header_t *expected_ip =
+        (ip4_header_t *)vlib_buffer_get_current(expected_b);
+
+    if (ip->protocol == IP_PROTOCOL_UDP || ip->protocol == IP_PROTOCOL_TCP) {
+        u32 flags = ip4_tcp_udp_validate_checksum(vm, b);
+        test_assert((flags & VNET_BUFFER_F_L4_CHECKSUM_CORRECT) != 0, "%s",
+                    name);
+        flags = ip4_tcp_udp_validate_checksum(vm, expected_b);
+        test_assert((flags & VNET_BUFFER_F_L4_CHECKSUM_CORRECT) != 0, "%s",
+                    name);
+    }
+    test_assert(b->current_length == expected_b->current_length, "%s %d vs %d",
+                name, b->current_length, expected_b->current_length);
+
+    if (memcmp(ip, expected_ip, b->current_length) != 0) {
+        if (ip->protocol == IP_PROTOCOL_UDP) {
+            udp_header_t *udp = ip4_next_header(ip);
+            clib_warning("Received: IP: %U UDP: %U", format_ip4_header, ip,
+                         sizeof(*ip), format_udp_header, udp, sizeof(*udp));
+            udp = ip4_next_header(expected_ip);
+            clib_warning("%U", format_hexdump, ip, b->current_length);
+            clib_warning("Expected: IP: %U UDP: %U", format_ip4_header,
+                         expected_ip, sizeof(*ip), format_udp_header, udp,
+                         sizeof(*udp));
+            clib_warning("%U", format_hexdump, expected_ip,
+                         expected_b->current_length);
+        } else if (ip->protocol == IP_PROTOCOL_TCP) {
+            tcp_header_t *tcp = ip4_next_header(ip);
+            clib_warning("Received IP: %U TCP: %U", format_ip4_header, ip,
+                         sizeof(*ip), format_tcp_header, tcp, sizeof(*tcp));
+            tcp = ip4_next_header(expected_ip);
+            clib_warning("Expected IP: %U TCP: %U", format_ip4_header,
+                         expected_ip, sizeof(*ip), format_tcp_header, tcp,
+                         sizeof(*tcp));
+        } else {
+            clib_warning("Received: IP: %U", format_ip4_header, ip,
+                         sizeof(*ip));
+            clib_warning("Expected: IP: %U", format_ip4_header, expected_ip,
+                         sizeof(*ip));
+        }
+        test_assert_log(0, "%s", name);
+    } else {
+        test_assert_log(1, "%s", name);
+    }
+}
+
+extern vlib_node_registration_t pnat_input_node;
+
+static void test_table(test_t *t, int no_tests) {
+    // walk through table of tests
+    int i;
+    vlib_main_t *vm = &vlib_global_main;
+
+    /* Generate packet data */
+    for (i = 0; i < no_tests; i++) {
+        // create input buffer(s)
+        fill_packets(vm, (vlib_buffer_t *)&buffers[i], t[i].nsend, t[i].send);
+        fill_packets(vm, (vlib_buffer_t *)&expected[i], t[i].nexpect,
+                     t[i].expect);
+    }
+
+    /* send packets through graph node */
+    vlib_frame_t frame = {.n_vectors = no_tests};
+    node->flags |= VLIB_NODE_FLAG_TRACE;
+
+    pnat_node_inline(vm, node, &frame, PNAT_IP4_INPUT, VLIB_RX);
+
+    /* verify tests */
+    for (i = 0; i < no_tests; i++) {
+        test_assert(t[i].expect_next_index == results_next[i], "%s", t[i].name);
+        validate_packet(vm, t[i].name, results_bi[i],
+                        (vlib_buffer_t *)&expected[i]);
+    }
+    vec_free(results_next);
+    vec_free(results_bi);
+}
+
+void test_performance(void) {
+    pnat_main_t *pm = &pnat_main;
+    int i;
+    vlib_main_t *vm = &vlib_global_main;
+
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        add_translation(&rules[i]);
+    }
+    assert(pool_elts(pm->translations) == sizeof(rules) / sizeof(rules[0]));
+
+    int no_tests = sizeof(tests_packets) / sizeof(tests_packets[0]);
+    /* Generate packet data */
+    for (i = 0; i < VLIB_FRAME_SIZE; i++) {
+        // create input buffer(s)
+        fill_packets(vm, (vlib_buffer_t *)&buffers[i],
+                     tests_packets[i % no_tests].nsend,
+                     tests_packets[i % no_tests].send);
+        // fill_packets(vm, (vlib_buffer_t *)&expected[i], &tests[i %
+        // no_tests].expect);
+    }
+
+    /* send packets through graph node */
+    vlib_frame_t frame = {.n_vectors = VLIB_FRAME_SIZE};
+    node->flags &= ~VLIB_NODE_FLAG_TRACE;
+
+    int j;
+    for (j = 0; j < 10000; j++) {
+        pnat_node_inline(vm, node, &frame, PNAT_IP4_INPUT, VLIB_RX);
+
+#if 0
+    for (i = 0; i < VLIB_FRAME_SIZE; i++) {
+        assert(tests[i % no_tests].expect_next_index == results_next[i]);
+        validate_packet(vm, tests[i % no_tests].name, results_bi[i], (vlib_buffer_t *)&expected[i]);
+    }
+#endif
+        vec_free(results_next);
+        vec_free(results_bi);
+    }
+
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        del_translation(&rules[i]);
+    }
+    assert(pool_elts(pm->translations) == 0);
+    assert(pool_elts(pm->interfaces) == 0);
+}
+
+void test_packets(void) {
+    pnat_main_t *pm = &pnat_main;
+    int i;
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        add_translation(&rules[i]);
+    }
+    assert(pool_elts(pm->translations) == sizeof(rules) / sizeof(rules[0]));
+
+    test_table(tests_packets, sizeof(tests_packets) / sizeof(tests_packets[0]));
+
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        del_translation(&rules[i]);
+    }
+    assert(pool_elts(pm->translations) == 0);
+    assert(pool_elts(pm->interfaces) == 0);
+}
+
+static void test_attach(void) {
+    pnat_attachment_point_t attachment = PNAT_IP4_INPUT;
+    u32 binding_index = 0;
+    u32 sw_if_index = 0;
+    int rv = pnat_binding_attach(sw_if_index, attachment, binding_index);
+    test_assert(rv == -1, "binding_attach - nothing to attach");
+
+    rv = pnat_binding_detach(sw_if_index, attachment, 1234);
+    test_assert(rv == -1, "binding_detach - nothing to detach");
+
+    pnat_match_tuple_t match = {.mask = PNAT_SA};
+    pnat_rewrite_tuple_t rewrite = {.mask = PNAT_SA};
+    rv = pnat_binding_add(&match, &rewrite, &binding_index);
+    assert(rv == 0);
+
+    rv = pnat_binding_attach(sw_if_index, attachment, binding_index);
+    test_assert(rv == 0, "binding_attach - rule");
+
+    rv = pnat_binding_detach(sw_if_index, attachment, binding_index);
+    test_assert(rv == 0, "binding_detach - rule");
+
+    rv = pnat_binding_del(binding_index);
+    assert(rv == 0);
+}
+
+static void test_del_before_detach(void) {
+    pnat_attachment_point_t attachment = PNAT_IP4_INPUT;
+    u32 binding_index = 0;
+    u32 sw_if_index = 0;
+
+    /* Ensure 5-tuple here will not duplicate with other tests cause this will
+     * not be removed from flow cache */
+    rule_t rule = {
+        .match = {.dst = "123.123.123.123", .proto = 17, .dport = 6871},
+        .rewrite = {.dst = "1.2.3.4"},
+        .in = true,
+    };
+
+    add_translation(&rule);
+
+    int rv = pnat_binding_del(binding_index);
+    assert(rv == 0);
+
+    test_table(&tests_missing_rule[0], 1);
+
+    /* For now if you have deleted before detach, can't find key */
+    rv = pnat_binding_detach(sw_if_index, attachment, binding_index);
+    test_assert(rv == -1, "binding_detach - failure");
+
+    /* Re-add the rule and try again */
+    pnat_match_tuple_t match = {0};
+    pnat_rewrite_tuple_t rewrite = {0};
+    ruletomatch(&rule.match, &match);
+    ruletorewrite(&rule.rewrite, &rewrite);
+    rv = pnat_binding_add(&match, &rewrite, &binding_index);
+    assert(rv == 0);
+    rv = pnat_binding_detach(sw_if_index, attachment, binding_index);
+    test_assert(rv == 0, "binding_detach - pass");
+    rv = pnat_binding_del(binding_index);
+    assert(rv == 0);
+}
+
+void test_api(void) {
+    test_attach();
+    test_del_before_detach();
+}
+
+void test_checksum(void) {
+    int i;
+    vlib_main_t *vm = &vlib_global_main;
+    pnat_main_t *pm = &pnat_main;
+
+    test_t test = {
+        .name = "checksum",
+        .nsend = 28,
+        .send =
+            (char[]){0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
+                     0x74, 0xcb, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02, 0x02,
+                     0x00, 0x50, 0x1a, 0xd7, 0x00, 0x08, 0xde, 0xb1},
+    };
+
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        add_translation(&rules[i]);
+    }
+    assert(pool_elts(pm->translations) == sizeof(rules) / sizeof(rules[0]));
+
+    /* send packets through graph node */
+    vlib_frame_t frame = {.n_vectors = 1};
+    node->flags |= VLIB_NODE_FLAG_TRACE;
+
+    ip4_header_t *ip =
+        (ip4_header_t *)vlib_buffer_get_current((vlib_buffer_t *)&buffers[0]);
+
+    for (i = 0; i < 65535; i++) {
+
+        /* Get a buffer. Loop through 64K variations of it to check checksum */
+        memset(&buffers[0], 0, 2048);
+        fill_packets(vm, (vlib_buffer_t *)&buffers[0], test.nsend, test.send);
+
+        ip->src_address.as_u32 = i;
+        ip->checksum = 0;
+        ip->checksum = ip4_header_checksum(ip);
+        pnat_node_inline(vm, node, &frame, PNAT_IP4_INPUT, VLIB_RX);
+    }
+
+    test_assert_log(1, "%s", test.name);
+
+    for (i = 0; i < sizeof(rules) / sizeof(rules[0]); i++) {
+        del_translation(&rules[i]);
+    }
+}
+
+/*
+ * Unit testing:
+ * 1) Table of packets and expected outcomes. Run through
+ * 2) Performance tests. Measure instructions, cache behaviour etc.
+ */
+clib_error_t *ip_checksum_init(vlib_main_t *vm);
+
+int main(int argc, char **argv) {
+
+    clib_mem_init(0, 3ULL << 30);
+
+    vlib_main_t *vm = &vlib_global_main;
+
+    buffers_vector = buffer_init(buffers_vector, 256);
+
+    assert(vlib_node_main_init(vm) == 0);
+
+    ip_checksum_init(vm);
+
+    u32 node_index = vlib_register_node(vm, &pnat_input_node);
+    node = vlib_node_get_runtime(vm, node_index);
+    assert(node);
+
+    /* Test API */
+    test_api();
+    test_packets();
+    test_checksum();
+    test_performance();
+}
+
+/*
+ * NEW TESTS:
+ * - Chained buffers. Only do rewrite in first buffer
+ * - No interface. Can that really happen?
+ * - IP length shorter than buffer.
+ * - IP length longer than buffer.
+ */
diff --git a/src/plugins/nat/pnat/tests/pnat_test_stubs.h b/src/plugins/nat/pnat/tests/pnat_test_stubs.h
new file mode 100644
index 00000000000..62aa050989a
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/pnat_test_stubs.h
@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2021 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_pnat_test_stubs_h
+#define included_pnat_test_stubs_h
+
+void os_panic(void) {}
+void os_exit(int code) {}
+u32 ip4_fib_table_get_index_for_sw_if_index(u32 sw_if_index) { return 0; }
+#include <vpp/stats/stat_segment.h>
+clib_error_t *stat_segment_register_gauge(u8 *names,
+                                          stat_segment_update_fn update_fn,
+                                          u32 index) {
+    return 0;
+};
+#include <vnet/feature/feature.h>
+vnet_feature_main_t feature_main;
+void classify_get_trace_chain(void){};
+
+/* Format an IP4 address. */
+u8 *format_ip4_address(u8 *s, va_list *args) {
+    u8 *a = va_arg(*args, u8 *);
+    return format(s, "%d.%d.%d.%d", a[0], a[1], a[2], a[3]);
+}
+
+u8 *format_pnat_match_tuple(u8 *s, va_list *args) { return 0; }
+u8 *format_pnat_rewrite_tuple(u8 *s, va_list *args) { return 0; }
+
+vl_counter_t pnat_error_counters[10];
+
+int ip4_sv_reass_enable_disable_with_refcnt(u32 sw_if_index, int is_enable) {
+    return 0;
+}
+int ip4_sv_reass_output_enable_disable_with_refcnt(u32 sw_if_index,
+                                                   int is_enable) {
+    return 0;
+}
+int vnet_feature_enable_disable(const char *arc_name, const char *node_name,
+                                u32 sw_if_index, int enable_disable,
+                                void *feature_config,
+                                u32 n_feature_config_bytes) {
+    return 0;
+}
+vnet_main_t *vnet_get_main(void) { return 0; }
+
+static struct {
+    vec_header_t h;
+    vlib_main_t *vm;
+} __attribute__((packed)) __bootstrap_vlib_main_vector
+    __attribute__((aligned(CLIB_CACHE_LINE_BYTES))) = {
+        .h.len = 1,
+        .vm = &vlib_global_main,
+};
+
+vlib_main_t **vlib_mains = &__bootstrap_vlib_main_vector.vm;
+
+/* Compute TCP/UDP/ICMP4 checksum in software. */
+u16 ip4_tcp_udp_compute_checksum(vlib_main_t *vm, vlib_buffer_t *p0,
+                                 ip4_header_t *ip0) {
+    ip_csum_t sum0;
+    u32 ip_header_length, payload_length_host_byte_order;
+
+    /* Initialize checksum with ip header. */
+    ip_header_length = ip4_header_bytes(ip0);
+    payload_length_host_byte_order =
+        clib_net_to_host_u16(ip0->length) - ip_header_length;
+    sum0 = clib_host_to_net_u32(payload_length_host_byte_order +
+                                (ip0->protocol << 16));
+
+    if (BITS(uword) == 32) {
+        sum0 = ip_csum_with_carry(sum0,
+                                  clib_mem_unaligned(&ip0->src_address, u32));
+        sum0 = ip_csum_with_carry(sum0,
+                                  clib_mem_unaligned(&ip0->dst_address, u32));
+    } else
+        sum0 = ip_csum_with_carry(sum0,
+                                  clib_mem_unaligned(&ip0->src_address, u64));
+    return ip_calculate_l4_checksum(vm, p0, sum0,
+                                    payload_length_host_byte_order, (u8 *)ip0,
+                                    ip_header_length, NULL);
+}
+
+u32 ip4_tcp_udp_validate_checksum(vlib_main_t *vm, vlib_buffer_t *p0) {
+    ip4_header_t *ip0 = vlib_buffer_get_current(p0);
+    udp_header_t *udp0;
+    u16 sum16;
+
+    ASSERT(ip0->protocol == IP_PROTOCOL_TCP ||
+           ip0->protocol == IP_PROTOCOL_UDP);
+
+    udp0 = (void *)(ip0 + 1);
+    if (ip0->protocol == IP_PROTOCOL_UDP && udp0->checksum == 0) {
+        p0->flags |= (VNET_BUFFER_F_L4_CHECKSUM_COMPUTED |
+                      VNET_BUFFER_F_L4_CHECKSUM_CORRECT);
+        return p0->flags;
+    }
+
+    sum16 = ip4_tcp_udp_compute_checksum(vm, p0, ip0);
+
+    p0->flags |= (VNET_BUFFER_F_L4_CHECKSUM_COMPUTED |
+                  ((sum16 == 0) << VNET_BUFFER_F_LOG2_L4_CHECKSUM_CORRECT));
+
+    return p0->flags;
+}
+u8 *format_tcp_header(u8 *s, va_list *args) {
+    tcp_header_t *tcp = va_arg(*args, tcp_header_t *);
+    u32 max_header_bytes = va_arg(*args, u32);
+    u32 header_bytes;
+    u32 indent;
+
+    /* Nothing to do. */
+    if (max_header_bytes < sizeof(tcp[0]))
+        return format(s, "TCP header truncated");
+
+    indent = format_get_indent(s);
+    indent += 2;
+    header_bytes = tcp_header_bytes(tcp);
+
+    s = format(s, "TCP: %d -> %d", clib_net_to_host_u16(tcp->src),
+               clib_net_to_host_u16(tcp->dst));
+
+    s = format(s, "\n%Useq. 0x%08x ack 0x%08x", format_white_space, indent,
+               clib_net_to_host_u32(tcp->seq_number),
+               clib_net_to_host_u32(tcp->ack_number));
+
+    s = format(s, "\n%Utcp header: %d bytes", format_white_space, indent,
+               tcp->flags, header_bytes);
+
+    s = format(s, "\n%Uwindow %d, checksum 0x%04x", format_white_space, indent,
+               clib_net_to_host_u16(tcp->window),
+               clib_net_to_host_u16(tcp->checksum));
+    return s;
+}
+/* Format UDP header. */
+u8 *format_udp_header(u8 *s, va_list *args) {
+    udp_header_t *udp = va_arg(*args, udp_header_t *);
+    u32 max_header_bytes = va_arg(*args, u32);
+    u32 indent;
+
+    /* Nothing to do. */
+    if (max_header_bytes < sizeof(udp[0]))
+        return format(s, "UDP header truncated");
+
+    indent = format_get_indent(s);
+    indent += 2;
+
+    s = format(s, "UDP: %d -> %d", clib_net_to_host_u16(udp->src_port),
+               clib_net_to_host_u16(udp->dst_port));
+
+    s = format(s, "\n%Ulength %d, checksum 0x%04x", format_white_space, indent,
+               clib_net_to_host_u16(udp->length),
+               clib_net_to_host_u16(udp->checksum));
+
+    return s;
+}
+
+/* Format an IP4 header. */
+u8 *format_ip4_header(u8 *s, va_list *args) {
+    ip4_header_t *ip = va_arg(*args, ip4_header_t *);
+    u32 max_header_bytes = va_arg(*args, u32);
+    u32 ip_version, header_bytes;
+    u32 indent;
+
+    /* Nothing to do. */
+    if (max_header_bytes < sizeof(ip[0]))
+        return format(s, "IP header truncated");
+
+    indent = format_get_indent(s);
+    indent += 2;
+
+    ip_version = (ip->ip_version_and_header_length >> 4);
+    header_bytes = (ip->ip_version_and_header_length & 0xf) * sizeof(u32);
+
+    s = format(s, "%d: %U -> %U", ip->protocol, format_ip4_address,
+               ip->src_address.data, format_ip4_address, ip->dst_address.data);
+
+    /* Show IP version and header length only with unexpected values. */
+    if (ip_version != 4 || header_bytes != sizeof(ip4_header_t))
+        s = format(s, "\n%Uversion %d, header length %d", format_white_space,
+                   indent, ip_version, header_bytes);
+
+    s = format(s, "\n%Utos 0x%02x, ttl %d, length %d, checksum 0x%04x",
+               format_white_space, indent, ip->tos, ip->ttl,
+               clib_net_to_host_u16(ip->length),
+               clib_net_to_host_u16(ip->checksum));
+
+    /* Check and report invalid checksums. */
+    {
+        if (!ip4_header_checksum_is_valid(ip))
+            s = format(s, " (should be 0x%04x)",
+                       clib_net_to_host_u16(ip4_header_checksum(ip)));
+    }
+
+    {
+        u32 f = clib_net_to_host_u16(ip->flags_and_fragment_offset);
+        u32 o;
+
+        s = format(s, "\n%Ufragment id 0x%04x", format_white_space, indent,
+                   clib_net_to_host_u16(ip->fragment_id));
+
+        /* Fragment offset. */
+        o = 8 * (f & 0x1fff);
+        f ^= f & 0x1fff;
+        if (o != 0)
+            s = format(s, " offset %d", o);
+
+        if (f != 0) {
+            s = format(s, ", flags ");
+#define _(l)                                                                   \
+    if (f & IP4_HEADER_FLAG_##l)                                               \
+        s = format(s, #l);
+            _(MORE_FRAGMENTS);
+            _(DONT_FRAGMENT);
+            _(CONGESTION);
+#undef _
+        }
+        /* Fragment packet but not the first. */
+        if (o != 0)
+            return s;
+    }
+
+    return s;
+}
+
+#endif
diff --git a/src/plugins/nat/pnat/tests/test_genpackets.py b/src/plugins/nat/pnat/tests/test_genpackets.py
new file mode 100755
index 00000000000..9d32d3e3656
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/test_genpackets.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+from importlib.machinery import SourceFileLoader
+from scapy.all import *
+from scapy.contrib.geneve import GENEVE
+
+def hexstring(p):
+    s = bytes(p.__class__(p))
+    return ",".join("0x{:02x}".format(c) for c in s)
+
+def output_test(filename, tests):
+    (name, ext) = os.path.basename(filename).split(".")
+    print('/* DO NOT EDIT: automatically generated by test_genpackets.py */')
+    print('/* clang-format off */')
+    print('test_t tests_{}[] = {{'.format(name))
+
+    for t in tests:
+        print('  {')
+        print('    .name = "{}",'.format(t[0]))
+        print('    .nsend = {},'.format(len(t[1])))
+        print('    .send = (char []){{{}}},'.format(hexstring(t[1])))
+        print('    .nexpect = {},'.format(len(t[2])))
+        print('    .expect = (char []){{{}}},'.format(hexstring(t[2])))
+        print('    .expect_next_index = {}'.format(t[3]))
+        print('  },')
+    print('};')
+    print('/* clang-format on */')
+
+# Read tests from file
+for filename in sys.argv[1:]:
+    with open(filename) as f:
+        content = f.read().replace('\n', '')
+
+    tests = eval(content)
+    output_test(filename, tests)
+
diff --git a/src/plugins/nat/pnat/tests/test_packets.h b/src/plugins/nat/pnat/tests/test_packets.h
new file mode 100644
index 00000000000..b010450d4a6
--- /dev/null
+++ b/src/plugins/nat/pnat/tests/test_packets.h
@@ -0,0 +1,106 @@
+/* DO NOT EDIT: automatically generated by test_genpackets.py */
+/* clang-format off */
+test_t tests_packets[] = {
+  {
+    .name = "da rewritten",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xcb,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xd7,0x00,0x08,0xde,0xb1},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xc9,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x00,0x50,0x1a,0xd7,0x00,0x08,0xde,0xaf},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "unchanged",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xcb,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1f,0x90,0x00,0x08,0xd9,0xf8},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xcb,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1f,0x90,0x00,0x08,0xd9,0xf8},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "tcp da",
+    .nsend = 40,
+    .send = (char []){0x45,0x00,0x00,0x28,0x00,0x01,0x00,0x00,0x40,0x06,0x74,0xca,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xd7,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6e,0xb6,0x00,0x00},
+    .nexpect = 40,
+    .expect = (char []){0x45,0x00,0x00,0x28,0x00,0x01,0x00,0x00,0x40,0x06,0x74,0xc8,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x00,0x50,0x1a,0xd7,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6e,0xb4,0x00,0x00},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "tcp da ports",
+    .nsend = 40,
+    .send = (char []){0x45,0x00,0x00,0x28,0x00,0x01,0x00,0x00,0x40,0x06,0x74,0xca,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xd8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6e,0xb5,0x00,0x00},
+    .nexpect = 40,
+    .expect = (char []){0x45,0x00,0x00,0x28,0x00,0x01,0x00,0x00,0x40,0x06,0x74,0xc8,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x00,0x35,0x1f,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6a,0x66,0x00,0x00},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "tcp da ports -- fragmented packet",
+    .nsend = 60,
+    .send = (char []){0x45,0x00,0x00,0x3c,0x00,0x01,0x20,0x64,0x40,0x00,0x54,0x58,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58},
+    .nexpect = 60,
+    .expect = (char []){0x45,0x00,0x00,0x3c,0x00,0x01,0x20,0x64,0x40,0x00,0x54,0x58,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "short packet",
+    .nsend = 20,
+    .send = (char []){0x45,0x00,0x00,0x14,0x00,0x01,0x00,0x00,0x40,0x00,0x74,0xe4,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02},
+    .nexpect = 20,
+    .expect = (char []){0x45,0x00,0x00,0x14,0x00,0x01,0x00,0x00,0x40,0x00,0x74,0xe4,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "copy byte",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x73,0xe2,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xda,0x00,0x08,0x00,0x00},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x72,0xfa,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0xea,0x00,0x50,0x1a,0xda,0x00,0x08,0x00,0x00},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "copy byte into Geneve reserved field",
+    .nsend = 36,
+    .send = (char []){0x45,0x00,0x00,0x24,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xc3,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xdd,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0f,0xc8,0x00},
+    .nexpect = 36,
+    .expect = (char []){0x45,0x00,0x00,0x24,0x00,0x01,0x00,0x00,0x40,0x11,0x74,0xc1,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x00,0x50,0x1a,0xdd,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0f,0xc8,0x01},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "copy byte overrun",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x73,0xe2,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xdb,0x00,0x08,0x00,0x00},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x73,0xe2,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xdb,0x00,0x08,0x00,0x00},
+    .expect_next_index = 0
+  },
+  {
+    .name = "clear byte",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x73,0xe2,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0x02,0x00,0x50,0x1a,0xdc,0x00,0x08,0x00,0x00},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x73,0xe2,0x01,0x01,0x01,0xea,0x02,0x02,0x02,0x02,0x00,0x50,0x00,0xdc,0x00,0x08,0x00,0x00},
+    .expect_next_index = 4242
+  },
+  {
+    .name = "packet with options",
+    .nsend = 44,
+    .send = (char []){0x46,0x00,0x00,0x2c,0x00,0x01,0x00,0x00,0x40,0x06,0x6c,0xc6,0x01,0x01,0x01,0x01,0x02,0x02,0x02,0x02,0x07,0x00,0x00,0x00,0x00,0x50,0x1a,0xd8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6e,0xb5,0x00,0x00},
+    .nexpect = 44,
+    .expect = (char []){0x46,0x00,0x00,0x2c,0x00,0x01,0x00,0x00,0x40,0x06,0x6c,0xc4,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x07,0x00,0x00,0x00,0x00,0x35,0x1f,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x02,0x20,0x00,0x6a,0x66,0x00,0x00},
+    .expect_next_index = 4242
+  },
+};
+/* clang-format on */
+/* DO NOT EDIT: automatically generated by test_genpackets.py */
+/* clang-format off */
+test_t tests_missing_rule[] = {
+  {
+    .name = "hit missing rule",
+    .nsend = 28,
+    .send = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x81,0xd8,0x01,0x01,0x01,0x01,0x7b,0x7b,0x7b,0x7b,0x00,0x50,0x1a,0xd7,0x00,0x08,0x00,0x00},
+    .nexpect = 28,
+    .expect = (char []){0x45,0x00,0x00,0x1c,0x00,0x01,0x00,0x00,0x40,0x11,0x81,0xd8,0x01,0x01,0x01,0x01,0x7b,0x7b,0x7b,0x7b,0x00,0x50,0x1a,0xd7,0x00,0x08,0x00,0x00},
+    .expect_next_index = 0
+  },
+};
+/* clang-format on */