Introduce and use IcmpErrorPacket view#1591
Open
qmonnet wants to merge 4 commits into
Open
Conversation
qmonnet
requested review from
Fredi-raspall,
Copilot,
daniel-noland and
mvachhar
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a new IcmpErrorPacket “view” type in net to represent ICMP error packets that contain embedded (inner) IP + transport headers, and updates NAT ICMP-error handling and flow-key extraction to use it for simpler, more centralized parsing/checksum validation.
Changes:
- Add
net::packet::icmp_err::IcmpErrorPacketwith checksum validation and accessors for inner headers. - Refactor flow-key extraction for embedded packets into an
IcmpErrorPacket::embedded_flowkey()helper. - Update NAT ICMP error handler and related tests/bolero checks to use
IcmpErrorPacketinstead of duplicated checksum/parse logic.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| net/src/udp/truncated.rs | Add From<Udp> / From<TruncatedUdpHeader> conversions into TruncatedUdp. |
| net/src/tcp/truncated.rs | Add From<Tcp> / From<TruncatedTcpHeader> conversions into TruncatedTcp. |
| net/src/icmp4/truncated.rs | Add From<Icmp4> / From<TruncatedIcmp4Header> conversions into TruncatedIcmp4. |
| net/src/icmp6/truncated.rs | Add From<Icmp6> / From<TruncatedIcmp6Header> conversions into TruncatedIcmp6. |
| net/src/headers/embedded.rs | Add (test-only) From<…> conversions into EmbeddedTransport variants. |
| net/src/packet/mod.rs | Export the new icmp_err packet view module. |
| net/src/packet/icmp_err.rs | Implement IcmpErrorPacket view + checksum validation and unit tests. |
| net/src/flows/flow_key.rs | Add IcmpErrorPacket::embedded_flowkey() to build flow keys from embedded headers. |
| nat/src/icmp_handler/nf.rs | Use IcmpErrorPacket for parsing, checksum validation, and inner flow-key extraction. |
| nat/src/icmp_handler/icmp_error_msg.rs | Remove legacy checksum-validation helper and update bolero tests to use IcmpErrorPacket. |
qmonnet
force-pushed
the
pr/qmonnet/icmp-error-packet
branch
from
02a3d14 to
b613305
Compare
qmonnet
force-pushed
the
pr/qmonnet/icmp-checksums
branch
from
5ca15fa to
054a648
Compare
Implement trait From for EmbeddedTransport, and for its variants, so that we can turn directly a Tcp object directly into EmbeddedTransport, for example. Some of the implementations are only available (and used) for the test target. More specifically, we implement: - For<Tcp> for TruncatedTcp - For<Tcp> for EmbeddedTransport - For<TruncatedTcpHeader> for TruncatedTcp - For<TruncatedTcpHeader> for EmbeddedTransport - For<Udp> for TruncatedUdp - For<Udp> for EmbeddedTransport - For<TruncatedUdpHeader> for TruncatedUdp - For<TruncatedUdpHeader> for EmbeddedTransport - For<Icmp4> for TruncatedIcmp4 - For<Icmp4> for EmbeddedTransport - For<TruncatedIcmp4Header> for TruncatedIcmp4 - For<TruncatedIcmp4Header> for EmbeddedTransport - For<Icmp6> for TruncatedIcmp6 - For<Icmp6> for EmbeddedTransport - For<TruncatedIcmp6Header> for TruncatedIcmp6 - For<TruncatedIcmp6Header> for EmbeddedTransport Signed-off-by: Quentin Monnet <qmo@qmon.net>
Add an IcmpErrorPacket view of a Packet. This is in fact not a complete view, but a holder for references to its outer IP header, (outer) ICMP header, ICMP payload, inner IP header, and inner transport header. The view is read-only, and is only created if all of these headers (including the inner transport header) are present for the packet. This view will help process ICMP Error messages in a future commit. Signed-off-by: Quentin Monnet <qmo@qmon.net>
Rather than re-validating that the packet has an outer IP, ICMP, inner IP and inner transport layers, use the IcmpErrorPacket view to validate just once at the beginning of the ICMP Error messages handler, and use the view when we need read-only checks or flowkey extraction from the packet. Signed-off-by: Quentin Monnet <qmo@qmon.net>
Now that we've moved to the IcmpErrorPacket view in the ICMP Error handler code, we can remove function validate_checksums_icmp() which is no longer used outside of tests. Tests can be adjusted to use the IcmpErrorPacket view as well, and its method validate_checksums(). Move unit tests related to checksum validation to net/src/packet/icmp_err.rs, where they now belong. Most of these tests now validate whether we manage to form a valid IcmpErrorPacket view from a packet, rather than the result from the checksum validation: they were adjusted and renamed accordingly. Add a test to check that the view fails when we have an ICMP Error message with embedded packet fragment, but without an embedded transport layer. The bolero tests, which check the full translation in addition to the checksum update, remain at the same location. One adjustment is that we now only check the checksums when we are supposed to be able to form a valid IcmpErrorPacket, in other words, when the generated packet contains an inner transport layer. Signed-off-by: Quentin Monnet <qmo@qmon.net>
qmonnet
force-pushed
the
pr/qmonnet/icmp-error-packet
branch
from
b613305 to
f3cb653
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce a new “validated” type to represent an ICMP Error packet with embedded IP and transport headers, and use it to simplify the checksum validation code and flow key extraction code in the ICMP Error handler.
Please refer to individual commit descriptions for details.
On top of #1587.