fix(gateway): truncate payload of ICMP errors

[thomaseizinger]

When the Gateway is handed an IP packet for a DNS resource that it cannot route, it sends back an ICMP unreachable error. According to RFC 792 0 (for ICMPv4) and RFC 4443 1 (for ICMPv6), parts of the original packet should be included in the ICMP error payload to allow the sending party to correlate, what could not be sent.

For ICMPv4, the RFC says:

Internet Header + 64 bits of Data Datagram

The internet header plus the first 64 bits of the original
datagram's data.  This data is used by the host to match the
message to the appropriate process.  If a higher level protocol
uses port numbers, they are assumed to be in the first 64 data
bits of the original datagram's data.

For ICMPv6, the RFC says:

As much of invoking packet as possible without the ICMPv6 packet exceeding the minimum IPv6 MTU

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 9, 2025 1:15am

[sentry]

Sentry Issue: GATEWAY-C9

[Copilot]

Pull Request Overview

This PR fixes the truncation of ICMP error payloads by updating how the unreachable ICMP packets are built for both IPv4 and IPv6, in accordance with RFC 792 and RFC 4443. Key changes include:

• Introducing new functions (icmp_dst_unreachable, icmpv4_network_unreachable, icmpv6_address_unreachable) to correctly truncate and build ICMP error packets.
• Adding property-based tests to verify the behavior of both IPv4 and IPv6 ICMP unreachable packet generation.
• Removing deprecated unreachable functions in favor of the new, consolidated implementation.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
rust/ip-packet/src/make.rs	Adds new functions for ICMP unreachable error packet construction with proper payload truncation.
rust/connlib/tunnel/src/peer.rs	Replaces legacy unreachable logic with calls to the new icmp_dst_unreachable function.

Comments suppressed due to low confidence (1)

rust/ip-packet/src/make.rs:159

• [nitpick] Consider renaming the parameters 'ipv4_src' and 'ipv6_src' to 'gateway_ipv4' and 'gateway_ipv6' respectively to more clearly indicate that these addresses are the source addresses of the gateway for ICMP errors.

pub fn icmp_dst_unreachable(ipv4_src: Ipv4Addr, ipv6_src: Ipv6Addr, original_packet: &IpPacket) -> Result<IpPacket> {

[Copilot]

It would be helpful to add an inline comment explaining that 'header_len + 8' represents the IPv4 header plus the first 64 bits of data as specified in RFC 792.

Suggested change

	.header_len();
	.header_len();
	// According to RFC 792, ICMP error messages include the IPv4 header
	// and the first 64 bits (8 bytes) of the original packet's data.

[sentry]

Sentry Issue: GATEWAY-C8