Thomas Eizinger 33d5c32f35 fix(gateway): truncate payload of ICMP errors (#9059) ...

When the Gateway is handed an IP packet for a DNS resource that it
cannot route, it sends back an ICMP unreachable error. According to RFC
792 [0] (for ICMPv4) and RFC 4443 [1] (for ICMPv6), parts of the
original packet should be included in the ICMP error payload to allow
the sending party to correlate, what could not be sent.

For ICMPv4, the RFC says:

```
Internet Header + 64 bits of Data Datagram

The internet header plus the first 64 bits of the original
datagram's data.  This data is used by the host to match the
message to the appropriate process.  If a higher level protocol
uses port numbers, they are assumed to be in the first 64 data
bits of the original datagram's data.
```

For ICMPv6, the RFC says:

```
As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU
```

[0]: https://datatracker.ietf.org/doc/html/rfc792
[1]: https://datatracker.ietf.org/doc/html/rfc4443#section-3.1

2025-05-09 01:38:31 +00:00

..

proptest-regressions

chore(connlib): implement IP translation according to RFC6145 (#5364)

2024-06-14 21:33:07 +00:00

src

fix(gateway): truncate payload of ICMP errors (#9059)

2025-05-09 01:38:31 +00:00

Cargo.toml

refactor(connlib): introduce our own bufferpool crate (#8928)

2025-04-30 08:52:18 +00:00