[VPP-2126] Wrong ICMP checksum when using ICMP echo method to do tracerouting

[vvalderrv]

Description

When NAT client using ICMP echo method to do traceroute after enable nat44 plugin, the TTL exceeded error packet got the wrong checksum.

 

After some debugging, I found that at src/plugins/nat/nat44-ed/nat44_ed.c:3946 to 3961 , when updating checksum, nat44 only updates the inner and outer ICMP header checksum for ICMP ID but forgot to also update the outer ICMP checksum again after the inner ICMP checksum is changed.

          if (f->rewrite.icmp_id != inner_echo->identifier)
            {
              ip_csum_t sum = icmp->checksum;
              sum = ip_csum_update (sum, inner_echo->identifier,
                        f->rewrite.icmp_id,
                        nat_icmp_echo_header_t,
                        identifier /* changed member */);
              icmp->checksum = ip_csum_fold (sum);
              ip_csum_t inner_sum = inner_icmp->checksum;
              inner_sum = ip_csum_update (
            sum, inner_echo->identifier, f->rewrite.icmp_id,
            nat_icmp_echo_header_t,
            identifier /* changed member */);
              inner_icmp->checksum = ip_csum_fold (inner_sum);
              inner_echo->identifier = f->rewrite.icmp_id;
            } 

 The problem is temporarily  fixed after I add this snippet of code.

          if (f->rewrite.icmp_id != inner_echo->identifier)
            {
              ip_csum_t sum = icmp->checksum;
              sum = ip_csum_update (sum, inner_echo->identifier,
                        f->rewrite.icmp_id,
                        nat_icmp_echo_header_t,
                        identifier /* changed member */);
              icmp->checksum = ip_csum_fold (sum);
              ip_csum_t inner_sum = inner_icmp->checksum;
              inner_sum = ip_csum_update (
            sum, inner_echo->identifier, f->rewrite.icmp_id,
            nat_icmp_echo_header_t,
            identifier /* changed member */);
+              sum = icmp->checksum;
+              sum = ip_csum_update(sum, inner_icmp->checksum,
+            ip_csum_fold(inner_sum),
+            icmp46_header_t,
+            checksum);
+              icmp->checksum = ip_csum_fold (sum);
              inner_icmp->checksum = ip_csum_fold (inner_sum);
              inner_echo->identifier = f->rewrite.icmp_id;
            } 

 

How to reproduce

VPP script

nat44 plugin enable
nat44 forwarding enable 
nat44 add interface address <wan interface>

set int nat44 out <wan interface> output-feature

NAT client

traceroute -I www.google.com

Assignee

Unassigned

Reporter

Ander

Comments

No comments.

Original issue: https://jira.fd.io/browse/VPP-2126