Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Jool Stateful is not respoding with ICMP Port Unreachable errors for a certain scenario. #173
Jool Stateful is not respoding with an ICMP Port Unreachable error to an external pier that is trying to open a connection with a TCP SYN when it (Jool) receives a UDP package with same src and dst IPv4#port combination as the TCP SYN that openned a connection.
What I did:
To achieve this scenario, you need to predict the port that the NAT64 will use to mask the outgoing packet. To make this particular scenario easier to preproduce, you can reduce the UDP pool to only 1 port and force jool to always mask the packet with the same port. In the scenario before, my pool4 is
This way the outside pier doesn't need to guess the port NAT64 will use, and always send the packet to the port 64134.
Ok, so what's happening here is
If an UDP packet (or its translated counterpart) happens to have the same IP transport addresses as a TCP Simultaneous Open (SO) currently taking place, it messes up the SO.
Only TCP packets should alter the SO state.
Thankfully, it's easy to fix.