{"action":"created","issue":{"url":"https://api.github.com/repos/NICMx/NAT64/issues/132","labels_url":"https://api.github.com/repos/NICMx/NAT64/issues/132/labels{/name}","comments_url":"https://api.github.com/repos/NICMx/NAT64/issues/132/comments","events_url":"https://api.github.com/repos/NICMx/NAT64/issues/132/events","html_url":"https://github.com/NICMx/NAT64/issues/132","id":60321070,"number":132,"title":"Wrong IPv6 source address when translating ICMPv4 errors in stateful mode","user":{"login":"toreanderson","id":4557060,"avatar_url":"https://avatars.githubusercontent.com/u/4557060?v=3","gravatar_id":"","url":"https://api.github.com/users/toreanderson","html_url":"https://github.com/toreanderson","followers_url":"https://api.github.com/users/toreanderson/followers","following_url":"https://api.github.com/users/toreanderson/following{/other_user}","gists_url":"https://api.github.com/users/toreanderson/gists{/gist_id}","starred_url":"https://api.github.com/users/toreanderson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toreanderson/subscriptions","organizations_url":"https://api.github.com/users/toreanderson/orgs","repos_url":"https://api.github.com/users/toreanderson/repos","events_url":"https://api.github.com/users/toreanderson/events{/privacy}","received_events_url":"https://api.github.com/users/toreanderson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NICMx/NAT64/labels/Bug%20(non-critical)","name":"Bug (non-critical)","color":"207de5"},{"url":"https://api.github.com/repos/NICMx/NAT64/labels/Coded%20(needs%20merge)","name":"Coded (needs merge)","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/NICMx/NAT64/milestones/24","html_url":"https://github.com/NICMx/NAT64/milestones/3.3.2","labels_url":"https://api.github.com/repos/NICMx/NAT64/milestones/24/labels","id":1015562,"number":24,"title":"3.3.2","description":"Bugfixes since 3.3.1.","creator":{"login":"ydahhrk","id":2389655,"avatar_url":"https://avatars.githubusercontent.com/u/2389655?v=3","gravatar_id":"","url":"https://api.github.com/users/ydahhrk","html_url":"https://github.com/ydahhrk","followers_url":"https://api.github.com/users/ydahhrk/followers","following_url":"https://api.github.com/users/ydahhrk/following{/other_user}","gists_url":"https://api.github.com/users/ydahhrk/gists{/gist_id}","starred_url":"https://api.github.com/users/ydahhrk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ydahhrk/subscriptions","organizations_url":"https://api.github.com/users/ydahhrk/orgs","repos_url":"https://api.github.com/users/ydahhrk/repos","events_url":"https://api.github.com/users/ydahhrk/events{/privacy}","received_events_url":"https://api.github.com/users/ydahhrk/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":12,"state":"open","created_at":"2015-03-10T21:55:05Z","updated_at":"2015-04-14T23:34:29Z","due_on":"2015-04-13T05:00:00Z","closed_at":null},"comments":6,"created_at":"2015-03-09T10:02:49Z","updated_at":"2015-04-14T23:34:29Z","closed_at":"2015-04-14T23:34:29Z","body":"It appears that when tracerouting from an IPv6 node out through a Jool in Stateful NAT64 mode, the source address of ICMPv4 errors is translated to the original IPv6 destination address, rather than the IPv4-converted IPv6 address of the IPv4 router. This fools certain traceroute programs to believe that the traceroute succeeds, since they end up seeing replies that appears to come from the target of the traceroute. For example, below you can see a traceroute towards the IPv4 address 254.254.254.254 (which obviously don't realy respond to anything, since it's a martian).\r\n\r\n```\r\n$ mtr -n -c 1 -r --report-wide 2a02:c0::46:42:254.254.254.254\r\nStart: Mon Mar  9 10:45:28 2015\r\nHOST: echo.ms.redpill-linpro.com        Loss%   Snt   Last   Avg  Best  Wrst StDev\r\n  1.|-- 2a02:c0:2:4:6666:17:0:1            0.0%     1    1.3   1.3   1.3   1.3   0.0\r\n  2.|-- 2a02:c0:2:4::                      0.0%     1    1.9   1.9   1.9   1.9   0.0\r\n  3.|-- 2a02:c0:1:401::13                  0.0%     1    1.5   1.5   1.5   1.5   0.0\r\n  4.|-- 2a02:c0:400:104:218:59ff:fe19:403  0.0%     1    1.4   1.4   1.4   1.4   0.0\r\n  5.|-- 2a02:c0::46:42:fefe:fefe           0.0%     1    1.4   1.4   1.4   1.4   0.0\r\n$ \r\n```\r\n\r\nA tcpdump running on the Jool node shows what's going on:\r\n\r\n```\r\n10:45:20.814229 IP (tos 0xc0, ttl 64, id 8441, offset 0, flags [none], proto ICMP (1), length 112)\r\n    185.47.41.1 > 185.47.42.1: ICMP time exceeded in-transit, length 92\r\n\tIP (tos 0x0, ttl 1, id 18041, offset 0, flags [none], proto ICMP (1), length 84)\r\n    185.47.42.1 > 254.254.254.254: ICMP echo request, id 36874, seq 60544, length 64\r\n10:45:20.814253 IP6 (class 0xc0, hlim 63, next-header ICMPv6 (58) payload length: 112) 2a02:c0::46:42:fefe:fefe > 2a02:c0:2:4:6666:17:0:1001: [icmp6 sum ok] ICMP6, time exceeded in-transit for 2a02:c0::46:42:fefe:fefe\r\n```\r\n\r\nSo the source address of the original ICMPv4 error `185.47.41.1` ended up being translated to `2a02:c0::46:42:254.254.254.254` in the resulting ICMPv6 packet. I believe it ought to have been translated to `2a02:c0::46:42:185.47.41.1` instead.\r\n\r\nThis breaks traceroute through the Stateful NAT64 for all valid destinations, too. Some traceroute programs, like MTR, doesn't show any hops beyond the Jool node, because it gets a response from the original target of the traceroute, as shown here towards Google's public DNS service (the Jool node is `kvmtest.i.bitbit.net`):\r\n\r\n```\r\n$ mtr -c 1 -r --report-wide 2a02:c0::46:42:8.8.8.8\r\nStart: Mon Mar  9 10:57:12 2015\r\nHOST: echo.ms.redpill-linpro.com      Loss%   Snt   Last   Avg  Best  Wrst StDev\r\n  1.|-- 2a02:c0:2:4:6666:17:0:1          0.0%     1    1.2   1.2   1.2   1.2   0.0\r\n  2.|-- ge-1-0-39.cs1-osl3.n.bitbit.net  0.0%     1    2.5   2.5   2.5   2.5   0.0\r\n  3.|-- bond0.fw2-osl3.n.bitbit.net      0.0%     1    1.1   1.1   1.1   1.1   0.0\r\n  4.|-- kvmtest.i.bitbit.net             0.0%     1    1.4   1.4   1.4   1.4   0.0\r\n  5.|-- 2a02:c0::46:42:808:808           0.0%     1    1.5   1.5   1.5   1.5   0.0\r\n$ \r\n```\r\n\r\nRegular traceroute fares better, as it appears to continue decrementing the TTL when receiving ICMPv6 Time Exceeded. However all the IPv4 hops in the path are represented using the target IPv6 address, rather than their IPv4-converted IPv6 address per RFC6052:\r\n\r\n```\r\n$ sudo traceroute6 -I 2a02:c0::46:42:8.8.8.8\r\ntraceroute to 2a02:c0::46:42:8.8.8.8 (2a02:c0::46:42:808:808), 30 hops max, 80 byte packets\r\n 1  2a02:c0:2:4:6666:17:0:1 (2a02:c0:2:4:6666:17:0:1)  2.392 ms  2.399 ms  2.413 ms\r\n 2  ge-1-0-39.cs1-osl3.n.bitbit.net (2a02:c0:2:4::)  2.740 ms  2.822 ms  2.856 ms\r\n 3  bond0.fw2-osl3.n.bitbit.net (2a02:c0:1:401::13)  2.503 ms  2.529 ms  2.564 ms\r\n 4  kvmtest.i.bitbit.net (2a02:c0:400:104:218:59ff:fe19:403)  2.580 ms  2.613 ms  2.758 ms\r\n 5  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  2.986 ms  3.011 ms  3.026 ms\r\n 6  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  3.458 ms  2.088 ms  2.104 ms\r\n 7  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  1.360 ms  1.388 ms  1.527 ms\r\n 8  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  1.546 ms  1.716 ms  1.898 ms\r\n 9  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  8.424 ms  8.432 ms  8.429 ms\r\n10  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  8.488 ms  8.284 ms  8.313 ms\r\n11  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  8.803 ms  9.084 ms  9.414 ms\r\n12  2a02:c0::46:42:808:808 (2a02:c0::46:42:808:808)  8.937 ms  8.993 ms  9.047 ms\r\n```\r\n\r\nFor comparsion, here's another MTR to Google's public DNS through another implementation of Stateful NAT64. It contains plenty of IPv4-converted IPv6 addresses, as I expect it to.\r\n\r\n```\r\n$ mtr -c 1 -r --report-wide 2a02:c0::64:0:8.8.8.8\r\nStart: Mon Mar  9 11:01:12 2015\r\nHOST: echo.ms.redpill-linpro.com       Loss%   Snt   Last   Avg  Best  Wrst StDev\r\n  1.|-- 2a02:c0:2:4:6666:17:0:1           0.0%     1    1.2   1.2   1.2   1.2   0.0\r\n  2.|-- ge-1-0-39.cs1-osl3.n.bitbit.net   0.0%     1    1.7   1.7   1.7   1.7   0.0\r\n  3.|-- xe-1-3-0-0.cr1-osl2.n.bitbit.net  0.0%     1    1.3   1.3   1.3   1.3   0.0\r\n  4.|-- vlan-9.cs1-osl2.n.bitbit.net      0.0%     1    2.4   2.4   2.4   2.4   0.0\r\n  5.|-- nat64gw1-osl2.n.bitbit.net        0.0%     1    1.4   1.4   1.4   1.4   0.0\r\n  6.|-- 2a02:c0::64:0:57ee:210f           0.0%     1    1.8   1.8   1.8   1.8   0.0\r\n  7.|-- 2a02:c0::64:0:c000:200            0.0%     1    1.8   1.8   1.8   1.8   0.0\r\n  8.|-- 2a02:c0::64:0:57ee:3e58           0.0%     1    3.2   3.2   3.2   3.2   0.0\r\n  9.|-- 2a02:c0::64:0:57ee:3e54           0.0%     1    3.9   3.9   3.9   3.9   0.0\r\n 10.|-- 2a02:c0::64:0:40d2:4555           0.0%     1    1.9   1.9   1.9   1.9   0.0\r\n 11.|-- 2a02:c0::64:0:4310:8806           0.0%     1   15.0  15.0  15.0  15.0   0.0\r\n 12.|-- 2a02:c0::64:0:480e:f336           0.0%     1    9.3   9.3   9.3   9.3   0.0\r\n 13.|-- 2a02:c0::64:0:480e:efef           0.0%     1   10.7  10.7  10.7  10.7   0.0\r\n 14.|-- 2a02:c0::64:0:808:808             0.0%     1    9.4   9.4   9.4   9.4   0.0\r\n```"},"comment":{"url":"https://api.github.com/repos/NICMx/NAT64/issues/comments/93111770","html_url":"https://github.com/NICMx/NAT64/issues/132#issuecomment-93111770","issue_url":"https://api.github.com/repos/NICMx/NAT64/issues/132","id":93111770,"user":{"login":"ydahhrk","id":2389655,"avatar_url":"https://avatars.githubusercontent.com/u/2389655?v=3","gravatar_id":"","url":"https://api.github.com/users/ydahhrk","html_url":"https://github.com/ydahhrk","followers_url":"https://api.github.com/users/ydahhrk/followers","following_url":"https://api.github.com/users/ydahhrk/following{/other_user}","gists_url":"https://api.github.com/users/ydahhrk/gists{/gist_id}","starred_url":"https://api.github.com/users/ydahhrk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ydahhrk/subscriptions","organizations_url":"https://api.github.com/users/ydahhrk/orgs","repos_url":"https://api.github.com/users/ydahhrk/repos","events_url":"https://api.github.com/users/ydahhrk/events{/privacy}","received_events_url":"https://api.github.com/users/ydahhrk/received_events","type":"User","site_admin":false},"created_at":"2015-04-14T23:34:29Z","updated_at":"2015-04-14T23:34:29Z","body":"It seems we still don't have much of an answer, so this ended up as an alternate configuration mode, rather than the de facto implementation.\r\nHere's the doc (F5 might be necessary if it's too early): http://jool.mx/usr-flags-global.html#source-icmpv6-errors-better"}}