Open
Description
Description
When NAT client using ICMP echo method to do traceroute after enable nat44 plugin, the TTL exceeded error packet got the wrong checksum.
After some debugging, I found that at src/plugins/nat/nat44-ed/nat44_ed.c:3946 to 3961 , when updating checksum, nat44 only updates the inner and outer ICMP header checksum for ICMP ID but forgot to also update the outer ICMP checksum again after the inner ICMP checksum is changed.
if (f->rewrite.icmp_id != inner_echo->identifier)
{
ip_csum_t sum = icmp->checksum;
sum = ip_csum_update (sum, inner_echo->identifier,
f->rewrite.icmp_id,
nat_icmp_echo_header_t,
identifier /* changed member */);
icmp->checksum = ip_csum_fold (sum);
ip_csum_t inner_sum = inner_icmp->checksum;
inner_sum = ip_csum_update (
sum, inner_echo->identifier, f->rewrite.icmp_id,
nat_icmp_echo_header_t,
identifier /* changed member */);
inner_icmp->checksum = ip_csum_fold (inner_sum);
inner_echo->identifier = f->rewrite.icmp_id;
}
if (f->rewrite.icmp_id != inner_echo->identifier)
{
ip_csum_t sum = icmp->checksum;
sum = ip_csum_update (sum, inner_echo->identifier,
f->rewrite.icmp_id,
nat_icmp_echo_header_t,
identifier /* changed member */);
icmp->checksum = ip_csum_fold (sum);
ip_csum_t inner_sum = inner_icmp->checksum;
inner_sum = ip_csum_update (
sum, inner_echo->identifier, f->rewrite.icmp_id,
nat_icmp_echo_header_t,
identifier /* changed member */);
+ sum = icmp->checksum;
+ sum = ip_csum_update(sum, inner_icmp->checksum,
+ ip_csum_fold(inner_sum),
+ icmp46_header_t,
+ checksum);
+ icmp->checksum = ip_csum_fold (sum);
inner_icmp->checksum = ip_csum_fold (inner_sum);
inner_echo->identifier = f->rewrite.icmp_id;
}
How to reproduce
VPP script
nat44 plugin enable nat44 forwarding enablenat44 add interface address <wan interface>
set int nat44 out <wan interface> output-feature
traceroute -I www.google.com
Assignee
Unassigned
Reporter
Ander
Comments
No comments.
Original issue: https://jira.fd.io/browse/VPP-2126
Metadata
Metadata
Assignees
Labels
No labels