Add handling of ICMP error packets in SNAT (VPP-629)

Change-Id: I8d2022b7cb3ef3da736c085bccbb5b9c057a8d76
Signed-off-by: Juraj Sloboda <jsloboda@cisco.com>

3 files changed, 534 insertions, 57 deletions

diff --git a/src/plugins/snat/in2out.c b/src/plugins/snat/in2out.c
index b0047737..e30c913c 100644
--- a/src/plugins/snat/in2out.c
+++ b/src/plugins/snat/in2out.c
@@ -112,6 +112,7 @@ typedef enum {
   SNAT_IN2OUT_NEXT_LOOKUP,
   SNAT_IN2OUT_NEXT_DROP,
   SNAT_IN2OUT_NEXT_SLOW_PATH,
+  SNAT_IN2OUT_NEXT_ICMP_ERROR,
   SNAT_IN2OUT_N_NEXT,
 } snat_in2out_next_t;
 
@@ -410,6 +411,10 @@ static u32 slow_path (snat_main_t *sm, vlib_buffer_t *b0,
   return next0;
 }
                       
+typedef struct {
+  u16 src_port, dst_port;
+} tcp_udp_header_t;
+
 static inline u32 icmp_in2out_slow_path (snat_main_t *sm,
                                          vlib_buffer_t * b0,
                                          ip4_header_t * ip0,
@@ -419,67 +424,171 @@ static inline u32 icmp_in2out_slow_path (snat_main_t *sm,
                                          vlib_node_runtime_t * node,
                                          u32 next0,
                                          f64 now,
-                                         u32 cpu_index)
+                                         u32 cpu_index,
+                                         snat_session_t ** p_s0)
 {
   snat_session_key_t key0;
-  icmp_echo_header_t *echo0;
+  icmp_echo_header_t *echo0, *inner_echo0 = 0;
+  ip4_header_t *inner_ip0;
+  void *l4_header = 0;
+  icmp46_header_t *inner_icmp0;
   clib_bihash_kv_8_8_t kv0, value0;
-  snat_session_t * s0;
+  snat_session_t * s0 = 0;
   u32 new_addr0, old_addr0;
   u16 old_id0, new_id0;
   ip_csum_t sum0;
+  u16 checksum0;
   snat_runtime_t * rt = (snat_runtime_t *)node->runtime_data;
+  u8 is_error_message = 0;
 
-  if (PREDICT_FALSE(icmp0->type != ICMP4_echo_request))
-    {
-      b0->error = node->errors[SNAT_IN2OUT_ERROR_BAD_ICMP_TYPE];
-      return SNAT_IN2OUT_NEXT_DROP;
-    }
-  
   echo0 = (icmp_echo_header_t *)(icmp0+1);
 
   key0.addr = ip0->src_address;
-  key0.port = echo0->identifier;
-  key0.protocol = SNAT_PROTOCOL_ICMP;
   key0.fib_index = rx_fib_index0;
   
+  switch(icmp0->type)
+    {
+    case ICMP4_destination_unreachable:
+    case ICMP4_time_exceeded:
+    case ICMP4_parameter_problem:
+    case ICMP4_source_quench:
+    case ICMP4_redirect:
+    case ICMP4_alternate_host_address:
+      is_error_message = 1;
+    }
+
+  if (!is_error_message)
+    {
+      if (PREDICT_FALSE(icmp0->type != ICMP4_echo_request))
+        {
+          b0->error = node->errors[SNAT_IN2OUT_ERROR_BAD_ICMP_TYPE];
+          next0 = SNAT_IN2OUT_NEXT_DROP;
+          goto out;
+        }
+      key0.protocol = SNAT_PROTOCOL_ICMP;
+      key0.port = echo0->identifier;
+    }
+  else
+    {
+      inner_ip0 = (ip4_header_t *)(echo0+1);
+      l4_header = ip4_next_header (inner_ip0);
+      key0.protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
+      switch (key0.protocol)
+        {
+        case SNAT_PROTOCOL_ICMP:
+          inner_icmp0 = (icmp46_header_t*)l4_header;
+          inner_echo0 = (icmp_echo_header_t *)(inner_icmp0+1);
+          key0.port = inner_echo0->identifier;
+          break;
+        case SNAT_PROTOCOL_UDP:
+        case SNAT_PROTOCOL_TCP:
+          key0.port = ((tcp_udp_header_t*)l4_header)->dst_port;
+          break;
+        default:
+          b0->error = node->errors[SNAT_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
+          next0 = SNAT_IN2OUT_NEXT_DROP;
+          goto out;
+        }
+    }
+
   kv0.key = key0.as_u64;
   
   if (clib_bihash_search_8_8 (&sm->in2out, &kv0, &value0))
     {
       if (PREDICT_FALSE(snat_not_translate(sm, rt, sw_if_index0, ip0,
           IP_PROTOCOL_ICMP, rx_fib_index0)))
-        return next0;
+        goto out;
+
+      if (is_error_message)
+        {
+          next0 = SNAT_IN2OUT_NEXT_DROP;
+          goto out;
+        }
 
       next0 = slow_path (sm, b0, ip0, rx_fib_index0, &key0,
                          &s0, node, next0, cpu_index);
       
       if (PREDICT_FALSE (next0 == SNAT_IN2OUT_NEXT_DROP))
-        return next0;
+        goto out;
     }
   else
     s0 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
                             value0.value);
 
+  sum0 = ip_incremental_checksum (0, icmp0,
+                                  ntohs(ip0->length) - ip4_header_bytes (ip0));
+  checksum0 = ~ip_csum_fold (sum0);
+  if (PREDICT_FALSE(checksum0 != 0 && checksum0 != 0xffff))
+    {
+      next0 = SNAT_IN2OUT_NEXT_DROP;
+      goto out;
+    }
+
   old_addr0 = ip0->src_address.as_u32;
   ip0->src_address = s0->out2in.addr;
   new_addr0 = ip0->src_address.as_u32;
   vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->out2in.fib_index;
-  
+
   sum0 = ip0->checksum;
-  sum0 = ip_csum_update (sum0, old_addr0, new_addr0,
-                         ip4_header_t,
+  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
                          src_address /* changed member */);
   ip0->checksum = ip_csum_fold (sum0);
   
-  old_id0 = echo0->identifier;
-  new_id0 = s0->out2in.port;
-  echo0->identifier = new_id0;
+  if (!is_error_message)
+    {
+      old_id0 = echo0->identifier;
+      new_id0 = s0->out2in.port;
+      echo0->identifier = new_id0;
 
-  sum0 = icmp0->checksum;
-  sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
-                         identifier);
-  icmp0->checksum = ip_csum_fold (sum0);
+      sum0 = icmp0->checksum;
+      sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+                             identifier);
+      icmp0->checksum = ip_csum_fold (sum0);
+    }
+  else
+    {
+      if (!ip4_header_checksum_is_valid (inner_ip0))
+        {
+          next0 = SNAT_IN2OUT_NEXT_DROP;
+          goto out;
+        }
+
+      old_addr0 = inner_ip0->dst_address.as_u32;
+      inner_ip0->dst_address = s0->out2in.addr;
+      new_addr0 = inner_ip0->src_address.as_u32;
+
+      sum0 = icmp0->checksum;
+      sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+                             dst_address /* changed member */);
+      icmp0->checksum = ip_csum_fold (sum0);
+
+      switch (key0.protocol)
+        {
+          case SNAT_PROTOCOL_ICMP:
+            old_id0 = inner_echo0->identifier;
+            new_id0 = s0->out2in.port;
+            inner_echo0->identifier = new_id0;
+
+            sum0 = icmp0->checksum;
+            sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+                                   identifier);
+            icmp0->checksum = ip_csum_fold (sum0);
+            break;
+          case SNAT_PROTOCOL_UDP:
+          case SNAT_PROTOCOL_TCP:
+            old_id0 = ((tcp_udp_header_t*)l4_header)->dst_port;
+            new_id0 = s0->out2in.port;
+            ((tcp_udp_header_t*)l4_header)->dst_port = new_id0;
+
+            sum0 = icmp0->checksum;
+            sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+                                   dst_port);
+            icmp0->checksum = ip_csum_fold (sum0);
+            break;
+          default:
+            ASSERT(0);
+        }
+    }
 
   /* Accounting */
   s0->last_heard = now;
@@ -495,6 +604,8 @@ static inline u32 icmp_in2out_slow_path (snat_main_t *sm,
                           s0->per_user_index);
     }
 
+out:
+  *p_s0 = s0;
   return next0;
 }
 
@@ -685,6 +796,16 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           proto0 = ip_proto_to_snat_proto (ip0->protocol);
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_IN2OUT_NEXT_ICMP_ERROR;
+              goto trace00;
+            }
+
           /* Next configured feature, probably ip4-lookup */
           if (is_slow_path)
             {
@@ -695,7 +816,7 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
                 {
                   next0 = icmp_in2out_slow_path 
                     (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, 
-                     node, next0, now, cpu_index);
+                     node, next0, now, cpu_index, &s0);
                   goto trace00;
                 }
             }
@@ -815,6 +936,16 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           proto1 = ip_proto_to_snat_proto (ip1->protocol);
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_IN2OUT_NEXT_ICMP_ERROR;
+              goto trace01;
+            }
+
           /* Next configured feature, probably ip4-lookup */
           if (is_slow_path)
             {
@@ -825,7 +956,7 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
                 {
                   next1 = icmp_in2out_slow_path 
                     (sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node,
-                     next1, now, cpu_index);
+                     next1, now, cpu_index, &s1);
                   goto trace01;
                 }
             }
@@ -980,6 +1111,16 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
           proto0 = ip_proto_to_snat_proto (ip0->protocol);
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_IN2OUT_NEXT_ICMP_ERROR;
+              goto trace0;
+            }
+
           /* Next configured feature, probably ip4-lookup */
           if (is_slow_path)
             {
@@ -990,7 +1131,7 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
                 {
                   next0 = icmp_in2out_slow_path 
                     (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node,
-                     next0, now, cpu_index);
+                     next0, now, cpu_index, &s0);
                   goto trace0;
                 }
             }
@@ -1020,6 +1161,7 @@ snat_in2out_node_fn_inline (vlib_main_t * vm,
 
                   next0 = slow_path (sm, b0, ip0, rx_fib_index0, &key0,
                                      &s0, node, next0, cpu_index);
+
                   if (PREDICT_FALSE (next0 == SNAT_IN2OUT_NEXT_DROP))
                     goto trace0;
                 }
@@ -1141,6 +1283,7 @@ VLIB_REGISTER_NODE (snat_in2out_node) = {
     [SNAT_IN2OUT_NEXT_DROP] = "error-drop",
     [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
     [SNAT_IN2OUT_NEXT_SLOW_PATH] = "snat-in2out-slowpath",
+    [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
   },
 };
 
@@ -1173,6 +1316,7 @@ VLIB_REGISTER_NODE (snat_in2out_slowpath_node) = {
     [SNAT_IN2OUT_NEXT_DROP] = "error-drop",
     [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
     [SNAT_IN2OUT_NEXT_SLOW_PATH] = "snat-in2out-slowpath",
+    [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
   },
 };
 
@@ -1604,6 +1748,7 @@ VLIB_REGISTER_NODE (snat_in2out_fast_node) = {
     [SNAT_IN2OUT_NEXT_DROP] = "error-drop",
     [SNAT_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
     [SNAT_IN2OUT_NEXT_SLOW_PATH] = "snat-in2out-slowpath",
+    [SNAT_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
   },
 };
 
diff --git a/src/plugins/snat/out2in.c b/src/plugins/snat/out2in.c
index 4f3322a3..3c1bb885 100644
--- a/src/plugins/snat/out2in.c
+++ b/src/plugins/snat/out2in.c
@@ -103,6 +103,7 @@ static char * snat_out2in_error_strings[] = {
 typedef enum {
   SNAT_OUT2IN_NEXT_DROP,
   SNAT_OUT2IN_NEXT_LOOKUP,
+  SNAT_OUT2IN_NEXT_ICMP_ERROR,
   SNAT_OUT2IN_N_NEXT,
 } snat_out2in_next_t;
 
@@ -222,6 +223,10 @@ create_session_for_static_mapping (snat_main_t *sm,
    return s;
 }
 
+typedef struct {
+  u16 src_port, dst_port;
+} tcp_udp_header_t;
+
 static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
                                          vlib_buffer_t * b0,
                                          ip4_header_t * ip0,
@@ -230,24 +235,73 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
                                          u32 rx_fib_index0,
                                          vlib_node_runtime_t * node,
                                          u32 next0, f64 now,
-                                         u32 cpu_index)
+                                         u32 cpu_index,
+                                         snat_session_t ** p_s0)
 {
   snat_session_key_t key0, sm0;
-  icmp_echo_header_t *echo0;
+  icmp_echo_header_t *echo0, *inner_echo0 = 0;
+  ip4_header_t *inner_ip0 = 0;
+  void *l4_header = 0;
+  icmp46_header_t *inner_icmp0;
   clib_bihash_kv_8_8_t kv0, value0;
-  snat_session_t * s0;
+  snat_session_t * s0 = 0;
   u32 new_addr0, old_addr0;
   u16 old_id0, new_id0;
   ip_csum_t sum0;
+  u16 checksum0;
   snat_runtime_t * rt = (snat_runtime_t *)node->runtime_data;
+  u8 is_error_message = 0;
 
   echo0 = (icmp_echo_header_t *)(icmp0+1);
 
   key0.addr = ip0->dst_address;
-  key0.port = echo0->identifier;
-  key0.protocol = SNAT_PROTOCOL_ICMP;
   key0.fib_index = rx_fib_index0;
-  
+
+  switch(icmp0->type)
+    {
+    case ICMP4_destination_unreachable:
+    case ICMP4_time_exceeded:
+    case ICMP4_parameter_problem:
+    case ICMP4_source_quench:
+    case ICMP4_redirect:
+    case ICMP4_alternate_host_address:
+      is_error_message = 1;
+    }
+
+  if (!is_error_message)
+    {
+      if (PREDICT_FALSE(icmp0->type != ICMP4_echo_reply))
+        {
+          b0->error = node->errors[SNAT_OUT2IN_ERROR_BAD_ICMP_TYPE];
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
+        }
+      key0.protocol = SNAT_PROTOCOL_ICMP;
+      key0.port = echo0->identifier;
+    }
+  else
+    {
+      inner_ip0 = (ip4_header_t *)(echo0+1);
+      l4_header = ip4_next_header (inner_ip0);
+      key0.protocol = ip_proto_to_snat_proto (inner_ip0->protocol);
+      switch (key0.protocol)
+        {
+        case SNAT_PROTOCOL_ICMP:
+          inner_icmp0 = (icmp46_header_t*)l4_header;
+          inner_echo0 = (icmp_echo_header_t *)(inner_icmp0+1);
+          key0.port = inner_echo0->identifier;
+          break;
+        case SNAT_PROTOCOL_UDP:
+        case SNAT_PROTOCOL_TCP:
+          key0.port = ((tcp_udp_header_t*)l4_header)->src_port;
+          break;
+        default:
+          b0->error = node->errors[SNAT_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
+        }
+    }
+
   kv0.key = key0.as_u64;
   
   if (clib_bihash_search_8_8 (&sm->out2in, &kv0, &value0))
@@ -271,43 +325,108 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
             }
           
           /* Don't NAT packet aimed at the intfc address */
-          if (PREDICT_FALSE(ip0->dst_address.as_u32 ==
-                            rt->cached_ip4_address))
-            return next0;
+          if (PREDICT_FALSE(ip0->dst_address.as_u32 == rt->cached_ip4_address))
+            goto out;
 
           b0->error = node->errors[SNAT_OUT2IN_ERROR_NO_TRANSLATION];
-          return SNAT_OUT2IN_NEXT_DROP;
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
+        }
+
+      if (is_error_message)
+        {
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
         }
 
       /* Create session initiated by host from external network */
       s0 = create_session_for_static_mapping(sm, b0, sm0, key0,
                                              node, cpu_index);
+
       if (!s0)
-        return SNAT_OUT2IN_NEXT_DROP;
+        {
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
+        }
     }
   else
     s0 = pool_elt_at_index (sm->per_thread_data[cpu_index].sessions,
                             value0.value);
 
+  sum0 = ip_incremental_checksum (0, icmp0,
+                                  ntohs(ip0->length) - ip4_header_bytes (ip0));
+  checksum0 = ~ip_csum_fold (sum0);
+  if (checksum0 != 0 && checksum0 != 0xffff)
+    {
+      next0 = SNAT_OUT2IN_NEXT_DROP;
+      goto out;
+    }
+
   old_addr0 = ip0->dst_address.as_u32;
   ip0->dst_address = s0->in2out.addr;
   new_addr0 = ip0->dst_address.as_u32;
   vnet_buffer(b0)->sw_if_index[VLIB_TX] = s0->in2out.fib_index;
   
   sum0 = ip0->checksum;
-  sum0 = ip_csum_update (sum0, old_addr0, new_addr0,
-                         ip4_header_t,
+  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
                          dst_address /* changed member */);
   ip0->checksum = ip_csum_fold (sum0);
   
-  old_id0 = echo0->identifier;
-  new_id0 = s0->in2out.port;
-  echo0->identifier = new_id0;
+  if (!is_error_message)
+    {
+      old_id0 = echo0->identifier;
+      new_id0 = s0->in2out.port;
+      echo0->identifier = new_id0;
+
+      sum0 = icmp0->checksum;
+      sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+                             identifier /* changed member */);
+      icmp0->checksum = ip_csum_fold (sum0);
+    }
+  else
+    {
+      if (!ip4_header_checksum_is_valid (inner_ip0))
+        {
+          next0 = SNAT_OUT2IN_NEXT_DROP;
+          goto out;
+        }
+
+      old_addr0 = inner_ip0->src_address.as_u32;
+      inner_ip0->src_address = s0->in2out.addr;
+      new_addr0 = inner_ip0->src_address.as_u32;
+
+      sum0 = icmp0->checksum;
+      sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+                             src_address /* changed member */);
+      icmp0->checksum = ip_csum_fold (sum0);
 
-  sum0 = icmp0->checksum;
-  sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
-                         identifier);
-  icmp0->checksum = ip_csum_fold (sum0);
+      switch (key0.protocol)
+        {
+        case SNAT_PROTOCOL_ICMP:
+          old_id0 = inner_echo0->identifier;
+          new_id0 = s0->in2out.port;
+          inner_echo0->identifier = new_id0;
+
+          sum0 = icmp0->checksum;
+          sum0 = ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+                                 identifier);
+          icmp0->checksum = ip_csum_fold (sum0);
+          break;
+        case SNAT_PROTOCOL_UDP:
+        case SNAT_PROTOCOL_TCP:
+          old_id0 = ((tcp_udp_header_t*)l4_header)->src_port;
+          new_id0 = s0->in2out.port;
+          ((tcp_udp_header_t*)l4_header)->src_port = new_id0;
+
+          sum0 = icmp0->checksum;
+          sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+                                 src_port);
+          icmp0->checksum = ip_csum_fold (sum0);
+          break;
+        default:
+          ASSERT(0);
+        }
+    }
 
   /* Accounting */
   s0->last_heard = now;
@@ -323,6 +442,8 @@ static inline u32 icmp_out2in_slow_path (snat_main_t *sm,
                           s0->per_user_index);
     }
 
+out:
+  *p_s0 = s0;
   return next0;
 }
 
@@ -410,11 +531,21 @@ snat_out2in_node_fn (vlib_main_t * vm,
           if (PREDICT_FALSE (proto0 == ~0))
               goto trace0;
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_OUT2IN_NEXT_ICMP_ERROR;
+              goto trace0;
+            }
+
           if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
             {
               next0 = icmp_out2in_slow_path 
                 (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, 
-                 next0, now, cpu_index);
+                 next0, now, cpu_index, &s0);
               goto trace0;
             }
 
@@ -535,11 +666,21 @@ snat_out2in_node_fn (vlib_main_t * vm,
           if (PREDICT_FALSE (proto1 == ~0))
               goto trace1;
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_OUT2IN_NEXT_ICMP_ERROR;
+              goto trace1;
+            }
+
           if (PREDICT_FALSE (proto1 == SNAT_PROTOCOL_ICMP))
             {
               next1 = icmp_out2in_slow_path 
                 (sm, b1, ip1, icmp1, sw_if_index1, rx_fib_index1, node, 
-                 next1, now, cpu_index);
+                 next1, now, cpu_index, &s1);
               goto trace1;
             }
 
@@ -694,11 +835,21 @@ snat_out2in_node_fn (vlib_main_t * vm,
           if (PREDICT_FALSE (proto0 == ~0))
               goto trace00;
 
+          if (PREDICT_FALSE(ip0->ttl == 1))
+            {
+              vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+              icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+                                           ICMP4_time_exceeded_ttl_exceeded_in_transit,
+                                           0);
+              next0 = SNAT_OUT2IN_NEXT_ICMP_ERROR;
+              goto trace00;
+            }
+
           if (PREDICT_FALSE (proto0 == SNAT_PROTOCOL_ICMP))
             {
               next0 = icmp_out2in_slow_path 
                 (sm, b0, ip0, icmp0, sw_if_index0, rx_fib_index0, node, 
-                 next0, now, cpu_index);
+                 next0, now, cpu_index, &s0);
               goto trace00;
             }
 
@@ -838,6 +989,7 @@ VLIB_REGISTER_NODE (snat_out2in_node) = {
   .next_nodes = {
     [SNAT_OUT2IN_NEXT_DROP] = "error-drop",
     [SNAT_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
+    [SNAT_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
   },
 };
 VLIB_NODE_FUNCTION_MULTIARCH (snat_out2in_node, snat_out2in_node_fn);
@@ -1295,6 +1447,7 @@ VLIB_REGISTER_NODE (snat_out2in_fast_node) = {
   .next_nodes = {
     [SNAT_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
     [SNAT_OUT2IN_NEXT_DROP] = "error-drop",
+    [SNAT_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
   },
 };
 VLIB_NODE_FUNCTION_MULTIARCH (snat_out2in_fast_node, snat_out2in_fast_node_fn);
diff --git a/test/test_snat.py b/test/test_snat.py
index 9d2070a0..500d629d 100644
--- a/test/test_snat.py
+++ b/test/test_snat.py
@@ -6,6 +6,7 @@ import struct
 
 from framework import VppTestCase, VppTestRunner
 from scapy.layers.inet import IP, TCP, UDP, ICMP
+from scapy.layers.inet import IPerror, TCPerror, UDPerror, ICMPerror
 from scapy.layers.l2 import Ether, ARP
 from scapy.data import IP_PROTOS
 from util import ppp
@@ -64,59 +65,61 @@ class TestSNAT(VppTestCase):
             super(TestSNAT, cls).tearDownClass()
             raise
 
-    def create_stream_in(self, in_if, out_if):
+    def create_stream_in(self, in_if, out_if, ttl=64):
         """
         Create packet stream for inside network
 
         :param in_if: Inside interface
         :param out_if: Outside interface
+        :param ttl: TTL of generated packets
         """
         pkts = []
         # TCP
         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
              TCP(sport=self.tcp_port_in))
         pkts.append(p)
 
         # UDP
         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
              UDP(sport=self.udp_port_in))
         pkts.append(p)
 
         # ICMP
         p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
              ICMP(id=self.icmp_id_in, type='echo-request'))
         pkts.append(p)
 
         return pkts
 
-    def create_stream_out(self, out_if, dst_ip=None):
+    def create_stream_out(self, out_if, dst_ip=None, ttl=64):
         """
         Create packet stream for outside network
 
         :param out_if: Outside interface
         :param dst_ip: Destination IP address (Default use global SNAT address)
+        :param ttl: TTL of generated packets
         """
         if dst_ip is None:
             dst_ip = self.snat_addr
         pkts = []
         # TCP
         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
              TCP(dport=self.tcp_port_out))
         pkts.append(p)
 
         # UDP
         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
              UDP(dport=self.udp_port_out))
         pkts.append(p)
 
         # ICMP
         p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
              ICMP(id=self.icmp_id_out, type='echo-reply'))
         pkts.append(p)
 
@@ -209,6 +212,75 @@ class TestSNAT(VppTestCase):
                                       "(inside network):", packet))
                 raise
 
+    def verify_capture_out_with_icmp_errors(self, capture, src_ip=None,
+                                            packet_num=3, icmp_type=11):
+        """
+        Verify captured packets with ICMP errors on outside network
+
+        :param capture: Captured packets
+        :param src_ip: Translated IP address or IP address of VPP
+                       (Default use global SNAT address)
+        :param packet_num: Expected number of packets (Default 3)
+        :param icmp_type: Type of error ICMP packet
+                          we are expecting (Default 11)
+        """
+        if src_ip is None:
+            src_ip = self.snat_addr
+        self.assertEqual(packet_num, len(capture))
+        for packet in capture:
+            try:
+                self.assertEqual(packet[IP].src, src_ip)
+                self.assertTrue(packet.haslayer(ICMP))
+                icmp = packet[ICMP]
+                self.assertEqual(icmp.type, icmp_type)
+                self.assertTrue(icmp.haslayer(IPerror))
+                inner_ip = icmp[IPerror]
+                if inner_ip.haslayer(TCPerror):
+                    self.assertEqual(inner_ip[TCPerror].dport,
+                                     self.tcp_port_out)
+                elif inner_ip.haslayer(UDPerror):
+                    self.assertEqual(inner_ip[UDPerror].dport,
+                                     self.udp_port_out)
+                else:
+                    self.assertEqual(inner_ip[ICMPerror].id, self.icmp_id_out)
+            except:
+                self.logger.error(ppp("Unexpected or invalid packet "
+                                      "(outside network):", packet))
+                raise
+
+    def verify_capture_in_with_icmp_errors(self, capture, in_if, packet_num=3,
+                                           icmp_type=11):
+        """
+        Verify captured packets with ICMP errors on inside network
+
+        :param capture: Captured packets
+        :param in_if: Inside interface
+        :param packet_num: Expected number of packets (Default 3)
+        :param icmp_type: Type of error ICMP packet
+                          we are expecting (Default 11)
+        """
+        self.assertEqual(packet_num, len(capture))
+        for packet in capture:
+            try:
+                self.assertEqual(packet[IP].dst, in_if.remote_ip4)
+                self.assertTrue(packet.haslayer(ICMP))
+                icmp = packet[ICMP]
+                self.assertEqual(icmp.type, icmp_type)
+                self.assertTrue(icmp.haslayer(IPerror))
+                inner_ip = icmp[IPerror]
+                if inner_ip.haslayer(TCPerror):
+                    self.assertEqual(inner_ip[TCPerror].sport,
+                                     self.tcp_port_in)
+                elif inner_ip.haslayer(UDPerror):
+                    self.assertEqual(inner_ip[UDPerror].sport,
+                                     self.udp_port_in)
+                else:
+                    self.assertEqual(inner_ip[ICMPerror].id, self.icmp_id_in)
+            except:
+                self.logger.error(ppp("Unexpected or invalid packet "
+                                      "(inside network):", packet))
+                raise
+
     def verify_ipfix_nat44_ses(self, data):
         """
         Verify IPFIX NAT44 session create/delete event
@@ -367,6 +439,113 @@ class TestSNAT(VppTestCase):
         capture = self.pg0.get_capture(len(pkts))
         self.verify_capture_in(capture, self.pg0)
 
+    def test_dynamic_icmp_errors_in2out_ttl_1(self):
+        """ SNAT handling of client packets with TTL=1 """
+
+        self.snat_add_address(self.snat_addr)
+        self.vapi.snat_interface_add_del_feature(self.pg0.sw_if_index)
+        self.vapi.snat_interface_add_del_feature(self.pg1.sw_if_index,
+                                                 is_inside=0)
+
+        # Client side - generate traffic
+        pkts = self.create_stream_in(self.pg0, self.pg1, ttl=1)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Client side - verify ICMP type 11 packets
+        capture = self.pg0.get_capture(len(pkts))
+        self.verify_capture_in_with_icmp_errors(capture, self.pg0)
+
+    def test_dynamic_icmp_errors_out2in_ttl_1(self):
+        """ SNAT handling of server packets with TTL=1 """
+
+        self.snat_add_address(self.snat_addr)
+        self.vapi.snat_interface_add_del_feature(self.pg0.sw_if_index)
+        self.vapi.snat_interface_add_del_feature(self.pg1.sw_if_index,
+                                                 is_inside=0)
+
+        # Client side - create sessions
+        pkts = self.create_stream_in(self.pg0, self.pg1)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Server side - generate traffic
+        capture = self.pg1.get_capture(len(pkts))
+        self.verify_capture_out(capture)
+        pkts = self.create_stream_out(self.pg1, ttl=1)
+        self.pg1.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Server side - verify ICMP type 11 packets
+        capture = self.pg1.get_capture(len(pkts))
+        self.verify_capture_out_with_icmp_errors(capture,
+                                                 src_ip=self.pg1.local_ip4)
+
+    def test_dynamic_icmp_errors_in2out_ttl_2(self):
+        """ SNAT handling of error respones to client packets with TTL=2 """
+
+        self.snat_add_address(self.snat_addr)
+        self.vapi.snat_interface_add_del_feature(self.pg0.sw_if_index)
+        self.vapi.snat_interface_add_del_feature(self.pg1.sw_if_index,
+                                                 is_inside=0)
+
+        # Client side - generate traffic
+        pkts = self.create_stream_in(self.pg0, self.pg1, ttl=2)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Server side - simulate ICMP type 11 response
+        capture = self.pg1.get_capture(len(pkts))
+        pkts = [Ether(dst=self.pg1.local_mac, src=self.pg1.remote_mac) /
+                IP(src=self.pg1.remote_ip4, dst=self.snat_addr) /
+                ICMP(type=11) / packet[IP] for packet in capture]
+        self.pg1.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Client side - verify ICMP type 11 packets
+        capture = self.pg0.get_capture(len(pkts))
+        self.verify_capture_in_with_icmp_errors(capture, self.pg0)
+
+    def test_dynamic_icmp_errors_out2in_ttl_2(self):
+        """ SNAT handling of error respones to server packets with TTL=2 """
+
+        self.snat_add_address(self.snat_addr)
+        self.vapi.snat_interface_add_del_feature(self.pg0.sw_if_index)
+        self.vapi.snat_interface_add_del_feature(self.pg1.sw_if_index,
+                                                 is_inside=0)
+
+        # Client side - create sessions
+        pkts = self.create_stream_in(self.pg0, self.pg1)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Server side - generate traffic
+        capture = self.pg1.get_capture(len(pkts))
+        self.verify_capture_out(capture)
+        pkts = self.create_stream_out(self.pg1, ttl=2)
+        self.pg1.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Client side - simulate ICMP type 11 response
+        capture = self.pg0.get_capture(len(pkts))
+        pkts = [Ether(dst=self.pg0.local_mac, src=self.pg0.remote_mac) /
+                IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                ICMP(type=11) / packet[IP] for packet in capture]
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        # Server side - verify ICMP type 11 packets
+        capture = self.pg1.get_capture(len(pkts))
+        self.verify_capture_out_with_icmp_errors(capture)
+
     def test_static_in(self):
         """ SNAT 1:1 NAT initialized from inside network """