icmp_test.go

package gvisorinterop_test

import (
	"bytes"
	"context"
	"encoding/binary"
	"errors"
	"fmt"
	"net"
	"net/netip"
	"os"
	"sync/atomic"
	"syscall"
	"testing"
	"time"

	"github.com/metacubex/gvisor/pkg/tcpip"
	"github.com/metacubex/gvisor/pkg/tcpip/checksum"
	"github.com/metacubex/gvisor/pkg/tcpip/header"
	"github.com/metacubex/gvisor/pkg/tcpip/transport/raw"
	"github.com/metacubex/gvisor/pkg/waiter"
	"github.com/metacubex/mipstack"
)

// TestICMPEchoInterop verifies each stack's echo requester against the other
// stack's automatic responder for IPv4 and IPv6.
func TestICMPEchoInterop(t *testing.T) {
	for _, family := range interopFamilies {
		family := family
		for _, mtu := range interopMTUsForFamily(family) {
			mtu := mtu
			t.Run(family.name+"/"+interopMTUName(mtu)+"/mipstack-sends", func(t *testing.T) {
				network := newFamilyInteropNetwork(t, family, mtu)
				testMipstackICMPEcho(t, network, family, mtu)
			})
			t.Run(family.name+"/"+interopMTUName(mtu)+"/gvisor-sends", func(t *testing.T) {
				network := newFamilyInteropNetwork(t, family, mtu)
				testGVisorICMPEcho(t, network, family, mtu)
			})
		}
	}
}

// TestICMPRXChecksumOffloadInterop verifies that an offloaded echo request
// produces a software-checksummed reply accepted by gVisor's ping endpoint.
func TestICMPRXChecksumOffloadInterop(t *testing.T) {
	for _, family := range interopFamilies {
		t.Run(family.name, func(t *testing.T) {
			var network *interopNetwork
			var mutated atomic.Bool
			network = newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: 1500,
				gvisorToMipstack: func(packet []byte) bool {
					offset := header.IPv6MinimumSize
					if family.mipstackAddress.Is4() {
						offset = int(header.IPv4(packet).HeaderLength())
						if packet[9] != byte(family.icmpProtocol) {
							return true
						}
					} else if packet[6] != byte(family.icmpProtocol) {
						return true
					}
					if len(packet) < offset+8 ||
						family.mipstackAddress.Is4() && packet[offset] != byte(header.ICMPv4Echo) ||
						family.mipstackAddress.Is6() && packet[offset] != byte(header.ICMPv6EchoRequest) ||
						!mutated.CompareAndSwap(false, true) {
						return true
					}
					modified := append([]byte(nil), packet...)
					if family.mipstackAddress.Is4() {
						icmp := header.ICMPv4(modified[offset:])
						icmp.SetChecksum(icmp.Checksum() ^ 1)
					} else {
						icmp := header.ICMPv6(modified[offset:])
						icmp.SetChecksum(icmp.Checksum() ^ 1)
					}
					if err := network.deliverToMipstack(modified); err != nil {
						network.reportBridgeError(err)
					}
					return false
				},
			})
			var offload mipstack.RXChecksumOffload
			offload.SetICMPv4(family.mipstackAddress.Is4()).SetICMPv6(family.mipstackAddress.Is6())
			network.mipstack.SetRXChecksumOffload(offload)
			testGVisorICMPEcho(t, network, family, network.mtu)
			if !mutated.Load() {
				t.Fatal("offload echo mutation did not run")
			}
		})
	}
}

// TestICMPErrorRXChecksumOffloadInterop delivers a native gVisor closed-port
// error to a connected mipstack UDP socket with delegated ICMP verification.
func TestICMPErrorRXChecksumOffloadInterop(t *testing.T) {
	for _, family := range interopFamilies {
		t.Run(family.name, func(t *testing.T) {
			var network *interopNetwork
			var mutated atomic.Bool
			wantType, wantCode := byte(header.ICMPv4DstUnreachable), byte(header.ICMPv4PortUnreachable)
			if family.mipstackAddress.Is6() {
				wantType, wantCode = byte(header.ICMPv6DstUnreachable), byte(header.ICMPv6PortUnreachable)
			}
			network = newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: 1500,
				gvisorToMipstack: func(packet []byte) bool {
					offset := header.IPv6MinimumSize
					if family.mipstackAddress.Is4() {
						offset = int(header.IPv4(packet).HeaderLength())
						if packet[9] != byte(family.icmpProtocol) {
							return true
						}
					} else if packet[6] != byte(family.icmpProtocol) {
						return true
					}
					if len(packet) < offset+8 || packet[offset] != wantType || packet[offset+1] != wantCode || !mutated.CompareAndSwap(false, true) {
						return true
					}
					modified := append([]byte(nil), packet...)
					if family.mipstackAddress.Is4() {
						icmp := header.ICMPv4(modified[offset:])
						icmp.SetChecksum(icmp.Checksum() ^ 1)
					} else {
						icmp := header.ICMPv6(modified[offset:])
						icmp.SetChecksum(icmp.Checksum() ^ 1)
					}
					if err := network.deliverToMipstack(modified); err != nil {
						network.reportBridgeError(err)
					}
					return false
				},
			})
			var offload mipstack.RXChecksumOffload
			offload.SetICMPv4(family.mipstackAddress.Is4()).SetICMPv6(family.mipstackAddress.Is6())
			network.mipstack.SetRXChecksumOffload(offload)
			target := netipAddrPort(family.gvisorAddress, 44023)
			connection, err := network.mipstack.DialUDP(context.Background(), family.udpNetwork, netip.AddrPort{}, target)
			if err != nil {
				t.Fatal(err)
			}
			defer connection.Close()
			_ = connection.SetReadDeadline(time.Now().Add(3 * time.Second))
			if _, err = connection.Write([]byte("offload-closed-port")); err != nil {
				t.Fatal(err)
			}
			var received mipstack.ICMPError
			if n, readErr := connection.Read(make([]byte, 1)); n != 0 || !errors.As(readErr, &received) ||
				received.Type != wantType || received.Code != wantCode || received.Reporter != family.gvisorAddress ||
				received.QuotedSourcePort != uint16(connection.LocalAddr().(*net.UDPAddr).Port) ||
				received.QuotedTargetPort != target.Port() || received.QuotedSource != family.mipstackAddress || received.QuotedTarget != family.gvisorAddress {
				t.Fatalf("native closed-port error = %d, %v; ICMP %+v", n, readErr, received)
			}
			if !mutated.Load() {
				t.Fatal("offload error mutation did not run")
			}
		})
	}
}

// TestICMPv6ErrorAdmissionInterop sends an actual UDP datagram to gVisor, then
// quotes it through a native gVisor raw endpoint. The receiving socket observes
// the error and remains usable for subsequent gVisor UDP traffic.
func TestICMPv6ErrorAdmissionInterop(t *testing.T) {
	family := interopFamilies[1]
	for _, input := range []struct{ messageType, code byte }{{2, 0}, {2, 1}, {2, 255}, {100, 0}, {100, 255}} {
		t.Run(fmt.Sprintf("type-%d/code-%d", input.messageType, input.code), func(t *testing.T) {
			captured := make(chan []byte, 1)
			network := newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: 1500,
				mipstackToGVisor: func(packet []byte) bool {
					if len(packet) >= header.IPv6MinimumSize && packet[6] == byte(header.UDPProtocolNumber) {
						select {
						case captured <- append([]byte(nil), packet...):
						default:
						}
					}
					return true
				},
			})
			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
			defer cancel()
			opened, peer := openUDPPair(t, ctx, network, family, true)
			defer opened.Close()
			defer peer.Close()
			connection := opened.(*mipstack.UDPConn)
			if err := connection.SetReceiveErrors(true); err != nil {
				t.Fatal(err)
			}
			deadline := time.Now().Add(5 * time.Second)
			_ = connection.SetDeadline(deadline)
			_ = peer.SetDeadline(deadline)
			request := []byte("ICMPv6 error quote")
			if n, err := connection.Write(request); err != nil || n != len(request) {
				t.Fatalf("UDP request = %d, %v", n, err)
			}
			buffer := make([]byte, 1500)
			if n, _, err := peer.ReadFrom(buffer); err != nil || !bytes.Equal(buffer[:n], request) {
				t.Fatalf("gVisor UDP receive = %d, %v", n, err)
			}
			quote := <-captured
			var queue waiter.Queue
			endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
			if tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			defer endpoint.Close()
			if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			message := make([]byte, 8+len(quote))
			copy(message[8:], quote)
			h := header.ICMPv6(message[:8])
			h.SetType(header.ICMPv6Type(input.messageType))
			h.SetCode(header.ICMPv6Code(input.code))
			binary.BigEndian.PutUint32(message[4:8], 1280)
			h.SetChecksum(header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
				Header: h, Src: gvisorAddress(family.gvisorAddress), Dst: gvisorAddress(family.mipstackAddress),
				PayloadCsum: checksum.Checksum(message[8:], 0), PayloadLen: len(quote),
			}))
			if n, writeErr := endpoint.Write(bytes.NewReader(message), tcpip.WriteOptions{}); writeErr != nil || n != int64(len(message)) {
				t.Fatalf("gVisor ICMPv6 write = %d, %s", n, tcpipErrorString(writeErr))
			}
			var networkError mipstack.ICMPError
			if n, err := connection.Read(buffer); n != 0 || !errors.As(err, &networkError) || networkError.Type != input.messageType || networkError.Code != input.code {
				t.Fatalf("pending error = %d, %v; ICMP %+v", n, err, networkError)
			}
			reported, err := connection.ReadError()
			if err != nil || !errors.As(reported, &networkError) || !bytes.Equal(networkError.QuotedPacket, quote) {
				t.Fatalf("extended error = %v, %v", reported, err)
			}
			wantMTU := 1500
			if input.messageType == byte(header.ICMPv6PacketTooBig) {
				wantMTU = 1280
			}
			if mtu, err := network.mipstack.PathMTU(family.gvisorAddress); err != nil || mtu != wantMTU {
				t.Fatalf("PathMTU = %d, %v, want %d", mtu, err, wantMTU)
			}
			if n, err := peer.WriteTo(request, connection.LocalAddr()); err != nil || n != len(request) {
				t.Fatalf("gVisor UDP reply = %d, %v", n, err)
			}
			if n, err := connection.Read(buffer); err != nil || !bytes.Equal(buffer[:n], request) {
				t.Fatalf("UDP receive after error = %d, %v", n, err)
			}
		})
	}
}

// TestReassemblyTimeoutSocketPolicyInterop sends first-fragment quotations
// through gVisor's native raw endpoint. UDP replies provide a delivery barrier
// before testing mipstack's IPv4 exception and unchanged IPv6 error reporting.
func TestReassemblyTimeoutSocketPolicyInterop(t *testing.T) {
	for _, family := range interopFamilies {
		t.Run(family.name, func(t *testing.T) {
			captured := make(chan []byte, 1)
			network := newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: interopDefaultMTU,
				mipstackToGVisor: func(packet []byte) bool {
					select {
					case captured <- append([]byte(nil), packet...):
					default:
					}
					return true
				},
			})
			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
			defer cancel()
			opened, peer := openUDPPair(t, ctx, network, family, true)
			defer opened.Close()
			defer peer.Close()
			connection := opened.(*mipstack.UDPConn)
			if err := connection.SetReceiveErrors(true); err != nil {
				t.Fatal(err)
			}
			if err := connection.SetPathMTUDiscovery(mipstack.PathMTUDiscoveryDont); err != nil {
				t.Fatal(err)
			}
			deadline := time.Now().Add(5 * time.Second)
			_ = connection.SetDeadline(deadline)
			_ = peer.SetDeadline(deadline)
			request := bytes.Repeat([]byte{0x5a}, 2000)
			if n, err := connection.Write(request); err != nil || n != len(request) {
				t.Fatalf("fragmented request = %d, %v", n, err)
			}
			buffer := make([]byte, 4096)
			if n, _, err := peer.ReadFrom(buffer); err != nil || !bytes.Equal(buffer[:n], request) {
				t.Fatalf("gVisor reassembled request = %d, %v", n, err)
			}
			first := <-captured
			parsed, err := mipstack.ParseIPPacket(first)
			if err != nil {
				t.Fatal(err)
			}
			fragment, ok := parsed.Fragment()
			if !ok || fragment.Offset != 0 || !fragment.MoreFragments {
				t.Fatalf("captured packet is not a first fragment: %+v", fragment)
			}
			quoteSize := header.IPv6MinimumSize + header.IPv6FragmentHeaderSize + header.UDPMinimumSize
			if family.mipstackAddress.Is4() {
				quoteSize = int(header.IPv4(first).HeaderLength()) + header.UDPMinimumSize
			}
			quote := first[:quoteSize]
			var queue waiter.Queue
			endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
			if tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			defer endpoint.Close()
			if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
				t.Fatal(tcpipErr.String())
			}
			for _, code := range []uint8{1, 0} {
				message := make([]byte, 8+len(quote))
				copy(message[8:], quote)
				if family.mipstackAddress.Is4() {
					h := header.ICMPv4(message)
					h.SetType(header.ICMPv4TimeExceeded)
					h.SetCode(header.ICMPv4Code(code))
					h.SetChecksum(^checksum.Checksum(message, 0))
				} else {
					h := header.ICMPv6(message[:8])
					h.SetType(header.ICMPv6TimeExceeded)
					h.SetCode(header.ICMPv6Code(code))
					h.SetChecksum(header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
						Header: h, Src: gvisorAddress(family.gvisorAddress), Dst: gvisorAddress(family.mipstackAddress),
						PayloadCsum: checksum.Checksum(message[8:], 0), PayloadLen: len(quote),
					}))
				}
				if n, writeErr := endpoint.Write(bytes.NewReader(message), tcpip.WriteOptions{}); writeErr != nil || n != int64(len(message)) {
					t.Fatalf("gVisor ICMP write = %d, %s", n, tcpipErrorString(writeErr))
				}
				reply := []byte{0x51, code}
				if n, err := peer.WriteTo(reply, connection.LocalAddr()); err != nil || n != len(reply) {
					t.Fatalf("gVisor reply = %d, %v", n, err)
				}
				n, readErr := connection.Read(buffer)
				if family.mipstackAddress.Is6() || code == 0 {
					var networkError mipstack.ICMPError
					if n != 0 || !errors.As(readErr, &networkError) || networkError.Code != code || !bytes.Equal(networkError.QuotedPacket, quote) {
						t.Fatalf("pending gVisor error = %d, %v", n, readErr)
					}
					queued, queueErr := connection.ReadError()
					if queueErr != nil || !errors.As(queued, &networkError) || networkError.Code != code || !bytes.Equal(networkError.QuotedPacket, quote) {
						t.Fatalf("extended gVisor error = %v, %v", queued, queueErr)
					}
					n, readErr = connection.Read(buffer)
				}
				if readErr != nil || !bytes.Equal(buffer[:n], reply) {
					t.Fatalf("UDP reply after ICMP code %d = %d, %v, %x", code, n, readErr, buffer[:n])
				}
				if queued, queueErr := connection.ReadError(); queued != nil || !errors.Is(queueErr, syscall.EAGAIN) {
					t.Fatalf("unexpected additional error: %v, %v", queued, queueErr)
				}
			}
		})
	}
}

// TestPublicICMPMessageCodecInterop verifies that gVisor accepts an echo
// request constructed by the public codec, that ICMPMessage.EchoReply matches
// gVisor's native reply, and that the reply is decoded by the semantic API.
func TestPublicICMPMessageCodecInterop(t *testing.T) {
	for _, family := range interopFamilies {
		family := family
		t.Run(family.name, func(t *testing.T) {
			captured := make(chan []byte, 4)
			network := newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: 1500,
				gvisorToMipstack: func(packet []byte) bool {
					select {
					case captured <- append([]byte(nil), packet...):
					default:
					}
					return false
				},
			})
			protocol := mipstack.ProtocolICMPv4
			if family.mipstackAddress.Is6() {
				protocol = mipstack.ProtocolICMPv6
			}
			message := mipstack.ICMPMessage{
				Source: family.mipstackAddress, Destination: family.gvisorAddress,
			}
			if err := message.SetEchoRequest(0x1234, 7, []byte("public-icmp-codec")); err != nil {
				t.Fatalf("construct public ICMP echo request: %v", err)
			}
			body := append([]byte(nil), message.Body...)
			expectedReply, err := message.EchoReply(family.gvisorAddress)
			if err != nil {
				t.Fatalf("construct public ICMP echo reply: %v", err)
			}
			expectedReplyWire, err := expectedReply.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode public ICMP echo reply: %v", err)
			}
			icmpWire, err := message.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode public ICMP message: %v", err)
			}
			packet := mipstack.IPPacket{
				Source: family.mipstackAddress, Destination: family.gvisorAddress,
				Protocol: protocol, HopLimit: 64, Payload: icmpWire,
			}
			wire, err := packet.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode public ICMP packet: %v", err)
			}
			if err = network.deliverToGVisor(wire); err != nil {
				t.Fatalf("deliver public ICMP packet: %v", err)
			}
			select {
			case responseWire := <-captured:
				parsedPacket, parseErr := mipstack.ParseIPPacket(responseWire)
				if parseErr != nil {
					t.Fatalf("parse gVisor ICMP packet: %v", parseErr)
				}
				actualProtocol, actualReplyWire, upperErr := parsedPacket.UpperLayer()
				if upperErr != nil {
					t.Fatalf("locate gVisor ICMP reply: %v", upperErr)
				}
				if actualProtocol != protocol {
					t.Fatalf("gVisor ICMP reply protocol = %d, want %d", actualProtocol, protocol)
				}
				if !bytes.Equal(actualReplyWire, expectedReplyWire) {
					t.Fatalf("public ICMP echo reply = %x, gVisor reply = %x", expectedReplyWire, actualReplyWire)
				}
				parsed, parseErr := parsedPacket.ICMPMessage()
				identifier, sequence, payload, echo := parsed.Echo()
				if parseErr != nil || parsed.Source != family.gvisorAddress || parsed.Destination != family.mipstackAddress ||
					!parsed.IsEchoReply() || identifier != 0x1234 || sequence != 7 || !bytes.Equal(payload, []byte("public-icmp-codec")) ||
					!echo || !bytes.Equal(parsed.Body, body) {
					t.Fatalf("parsed gVisor ICMP = %+v, %v", parsed, parseErr)
				}
			case <-time.After(3 * time.Second):
				t.Fatal("timed out waiting for gVisor ICMP reply")
			}
		})
	}
}

// TestPublicICMPErrorInterop verifies that the semantic API decodes native
// gVisor errors and their quoted transport tuple in both address families.
func TestPublicICMPErrorInterop(t *testing.T) {
	const (
		mipstackPort = 44021
		gvisorPort   = 44022
	)
	for _, family := range interopFamilies {
		family := family
		t.Run(family.name, func(t *testing.T) {
			captured := make(chan []byte, 4)
			network := newInteropNetworkWithOptions(t, interopNetworkOptions{
				families: []interopFamily{family}, mtu: 1500,
				gvisorToMipstack: func(packet []byte) bool {
					select {
					case captured <- append([]byte(nil), packet...):
					default:
					}
					return false
				},
			})
			datagram := mipstack.UDPDatagram{
				Source:      netipAddrPort(family.mipstackAddress, mipstackPort),
				Destination: netipAddrPort(family.gvisorAddress, gvisorPort),
				Payload:     []byte("unbound-public-udp"),
			}
			udpWire, err := datagram.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode UDP probe: %v", err)
			}
			packet := mipstack.IPPacket{
				Source: family.mipstackAddress, Destination: family.gvisorAddress,
				Protocol: mipstack.ProtocolUDP, HopLimit: 64, Payload: udpWire,
			}
			wire, err := packet.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode UDP probe packet: %v", err)
			}
			if err = network.deliverToGVisor(wire); err != nil {
				t.Fatalf("deliver UDP probe: %v", err)
			}
			select {
			case responseWire := <-captured:
				response, parseErr := mipstack.ParseIPPacket(responseWire)
				if parseErr != nil {
					t.Fatalf("parse gVisor ICMP error packet: %v", parseErr)
				}
				message, parseErr := response.ICMPMessage()
				if parseErr != nil {
					t.Fatalf("parse gVisor ICMP error message: %v", parseErr)
				}
				networkError, parseErr := message.ICMPError()
				if parseErr != nil {
					t.Fatalf("parse gVisor quoted packet: %v", parseErr)
				}
				wantType, wantCode := uint8(header.ICMPv4DstUnreachable), uint8(header.ICMPv4PortUnreachable)
				if family.mipstackAddress.Is6() {
					wantType, wantCode = uint8(header.ICMPv6DstUnreachable), uint8(header.ICMPv6PortUnreachable)
				}
				if !message.IsError() || message.Type != wantType || message.Code != wantCode ||
					networkError.Reporter != family.gvisorAddress || networkError.QuotedSource != family.mipstackAddress ||
					networkError.QuotedTarget != family.gvisorAddress || networkError.QuotedProtocol != mipstack.ProtocolUDP ||
					networkError.QuotedSourcePort != mipstackPort || networkError.QuotedTargetPort != gvisorPort {
					t.Fatalf("decoded gVisor ICMP error = message %+v, error %+v", message, networkError)
				}
			case <-time.After(3 * time.Second):
				t.Fatal("timed out waiting for gVisor ICMP error")
			}
		})
	}
}

// TestPublicICMPErrorConstructionInterop verifies that gVisor accepts v4 and
// v6 Destination Unreachable messages constructed by the public semantic API.
func TestPublicICMPErrorConstructionInterop(t *testing.T) {
	const (
		gvisorPort   = 44041
		mipstackPort = 44042
	)
	for _, family := range interopFamilies {
		family := family
		t.Run(family.name, func(t *testing.T) {
			network := newFamilyInteropNetwork(t, family, interopDefaultMTU)
			var queue waiter.Queue
			endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
			if tcpipErr != nil {
				t.Fatalf("create gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}
			defer endpoint.Close()
			if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
				t.Fatalf("bind gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}
			if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
				t.Fatalf("connect gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}
			entry, notifications := registerReadable(&queue)
			defer queue.EventUnregister(&entry)

			datagram := mipstack.UDPDatagram{
				Source:      netipAddrPort(family.gvisorAddress, gvisorPort),
				Destination: netipAddrPort(family.mipstackAddress, mipstackPort),
				Payload:     []byte("quoted-public-udp"),
			}
			udpWire, err := datagram.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode quoted UDP datagram: %v", err)
			}
			quotedPacket := mipstack.IPPacket{
				Source: family.gvisorAddress, Destination: family.mipstackAddress,
				Protocol: mipstack.ProtocolUDP, HopLimit: 31, Payload: udpWire,
			}
			quote, err := quotedPacket.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode quoted IP packet: %v", err)
			}
			messageType, code, protocol := uint8(mipstack.ICMPv4TypeDestinationUnreachable), uint8(mipstack.ICMPv4DestinationUnreachableCodePort), mipstack.ProtocolICMPv4
			if family.mipstackAddress.Is6() {
				messageType, code, protocol = mipstack.ICMPv6TypeDestinationUnreachable, mipstack.ICMPv6DestinationUnreachableCodePort, mipstack.ProtocolICMPv6
			}
			networkError := mipstack.ICMPError{
				Reporter: family.mipstackAddress, Type: messageType, Code: code, QuotedPacket: quote,
			}
			message, err := networkError.ICMPMessage(family.gvisorAddress)
			if err != nil {
				t.Fatalf("construct public ICMP error: %v", err)
			}
			icmpWire, err := message.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode public ICMP error: %v", err)
			}
			packet := mipstack.IPPacket{
				Source: family.mipstackAddress, Destination: family.gvisorAddress,
				Protocol: protocol, HopLimit: 64, Payload: icmpWire,
			}
			wire, err := packet.AppendBinary(nil)
			if err != nil {
				t.Fatalf("encode public ICMP error packet: %v", err)
			}
			if err = network.deliverToGVisor(wire); err != nil {
				t.Fatalf("deliver public ICMP error: %v", err)
			}
			ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
			defer cancel()
			received, _, err := readGVisorEndpoint(ctx, endpoint, notifications, 65535)
			if err != nil {
				t.Fatalf("read public ICMP error in gVisor: %v", err)
			}
			received, err = stripGVisorRawHeader(family, received)
			if err != nil {
				t.Fatalf("strip gVisor raw IP header: %v", err)
			}
			if !bytes.Equal(received, icmpWire) || len(received) < 8 || received[0] != messageType || received[1] != code ||
				!bytes.Equal(received[8:], quote) {
				t.Fatalf("gVisor received ICMP error = %x, want %x", received, icmpWire)
			}
		})
	}
}

// TestPublicICMPExtensionInterop verifies bidirectional raw-socket transport
// of RFC 4884 errors at every family MTU. gVisor does not expose semantic RFC
// 4884 decoding, so it acts as an unmodified L3/raw-socket peer while mipstack
// independently parses and constructs the extension structure.
func TestPublicICMPExtensionInterop(t *testing.T) {
	for _, family := range interopFamilies {
		family := family
		for _, mtu := range interopMTUsForFamily(family) {
			mtu := mtu
			t.Run(family.name+"/"+interopMTUName(mtu), func(t *testing.T) {
				network := newFamilyInteropNetwork(t, family, mtu)
				connection, err := network.mipstack.ListenIP(context.Background(), family.icmpNetwork, family.mipstackAddress)
				if err != nil {
					t.Fatalf("listen mipstack raw ICMP: %v", err)
				}
				defer connection.Close()
				if err = connection.SetDeadline(time.Now().Add(8 * time.Second)); err != nil {
					t.Fatal(err)
				}

				var queue waiter.Queue
				endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
				if tcpipErr != nil {
					t.Fatalf("create gVisor raw ICMP endpoint: %s", tcpipErr.String())
				}
				defer endpoint.Close()
				if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
					t.Fatalf("bind gVisor raw ICMP endpoint: %s", tcpipErr.String())
				}
				if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
					t.Fatalf("connect gVisor raw ICMP endpoint: %s", tcpipErr.String())
				}
				entry, notifications := registerReadable(&queue)
				defer queue.EventUnregister(&entry)

				gvisorWire, quote, pointer, err := makeInteropICMPExtension(
					family, family.gvisorAddress, family.mipstackAddress,
					family.mipstackAddress, family.gvisorAddress,
				)
				if err != nil {
					t.Fatal(err)
				}
				written, writeErr := endpoint.Write(bytes.NewReader(gvisorWire), tcpip.WriteOptions{})
				_, gvisorMTUFloor := writeErr.(*tcpip.ErrMessageTooLong)
				// The pinned gVisor raw endpoint declines source fragmentation
				// below this 148-byte message at IPv4's 68-byte minimum MTU.
				// Keep that external policy as an explicit one-way exception;
				// the reverse direction below still verifies mipstack's IPv4
				// fragmentation and gVisor's reassembly at the same MTU.
				if (writeErr != nil && !(family.mipstackAddress.Is4() && mtu == 68 && gvisorMTUFloor)) ||
					(writeErr == nil && written != int64(len(gvisorWire))) {
					t.Fatalf("write gVisor RFC 4884 message: n=%d, error=%s", written, tcpipErrorString(writeErr))
				}
				if writeErr == nil {
					storage := make([]byte, 65535)
					read, readErr := connection.(*mipstack.IPConn).Read(storage)
					if readErr != nil {
						t.Fatalf("read gVisor RFC 4884 message in mipstack: %v", readErr)
					}
					if !bytes.Equal(storage[:read], gvisorWire) {
						t.Fatalf("mipstack received RFC 4884 message = %x, want %x", storage[:read], gvisorWire)
					}
					protocol := mipstack.ProtocolICMPv4
					if family.mipstackAddress.Is6() {
						protocol = mipstack.ProtocolICMPv6
					}
					parsedMessage, err := (mipstack.IPPacket{
						Source: family.gvisorAddress, Destination: family.mipstackAddress,
						Protocol: protocol, HopLimit: 64, Payload: storage[:read],
					}).ICMPMessage()
					if err != nil {
						t.Fatalf("parse gVisor RFC 4884 message: %v", err)
					}
					parsedError, err := parsedMessage.ICMPError()
					if err != nil || !bytes.Equal(parsedError.QuotedPacket, quote) {
						t.Fatalf("decode gVisor RFC 4884 error = %+v, %v", parsedError, err)
					}
					objects, err := parsedError.ExtensionObjects()
					if err != nil || len(objects) != 1 {
						t.Fatalf("decode gVisor RFC 4884 objects = %+v, %v", objects, err)
					}
					if family.mipstackAddress.Is6() {
						if value, ok := objects[0].Pointer(); !ok || value != pointer {
							t.Fatalf("decode gVisor Headers Too Long Pointer = %d, %t", value, ok)
						}
					} else if objects[0].Class != 0xfe || objects[0].Type != 7 || !bytes.Equal(objects[0].Data, []byte{1, 2, 3, 4}) {
						t.Fatalf("decode gVisor unknown extension object = %+v", objects[0])
					}
				}

				mipWire, _, _, err := makeMipstackICMPExtension(
					family, family.mipstackAddress, family.gvisorAddress,
					family.gvisorAddress, family.mipstackAddress,
				)
				if err != nil {
					t.Fatal(err)
				}
				if written, writeErr := connection.WriteTo(mipWire, &net.IPAddr{IP: net.IP(family.gvisorAddress.AsSlice())}); writeErr != nil || written != len(mipWire) {
					t.Fatalf("write mipstack RFC 4884 message: n=%d, error=%v", written, writeErr)
				}
				ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
				received, _, readErr := readGVisorEndpoint(ctx, endpoint, notifications, 65535)
				cancel()
				if readErr != nil {
					t.Fatalf("read mipstack RFC 4884 message in gVisor: %v", readErr)
				}
				received, err = stripGVisorRawHeader(family, received)
				if err != nil || !bytes.Equal(received, mipWire) {
					t.Fatalf("gVisor received RFC 4884 message = %x, %v; want %x", received, err, mipWire)
				}
			})
		}
	}
}

// makeInteropICMPExtension constructs an RFC 4884 error independently with
// gVisor's checksum primitives for the gVisor-to-mipstack direction.
func makeInteropICMPExtension(family interopFamily, reporter, destination, quotedSource, quotedTarget netip.Addr) (message, quote []byte, pointer uint32, err error) {
	quote, err = makeInteropICMPQuote(quotedSource, quotedTarget)
	if err != nil {
		return nil, nil, 0, err
	}
	const paddedQuoteLength = 128
	message = make([]byte, 8+paddedQuoteLength+4+8)
	copy(message[8:], quote)
	structure := message[8+paddedQuoteLength:]
	structure[0] = 2 << 4
	binary.BigEndian.PutUint16(structure[4:6], 8)
	if family.mipstackAddress.Is4() {
		message[0], message[1], message[5] = mipstack.ICMPv4TypeTimeExceeded, mipstack.ICMPv4TimeExceededCodeTTLInTransit, paddedQuoteLength/4
		structure[6], structure[7] = 0xfe, 7
		copy(structure[8:], []byte{1, 2, 3, 4})
	} else {
		message[0], message[1], message[4] = mipstack.ICMPv6TypeDestinationUnreachable, mipstack.ICMPv6DestinationUnreachableCodeHeadersTooLong, paddedQuoteLength/8
		structure[6], structure[7] = mipstack.ICMPExtensionClassExtendedInformation, mipstack.ICMPExtensionExtendedInformationTypePointer
		pointer = uint32(len(quote) + 4096)
		binary.BigEndian.PutUint32(structure[8:12], pointer)
	}
	binary.BigEndian.PutUint16(structure[2:4], ^checksum.Checksum(structure, 0))
	if family.mipstackAddress.Is4() {
		binary.BigEndian.PutUint16(message[2:4], ^checksum.Checksum(message, 0))
	} else {
		icmpHeader := header.ICMPv6(message[:8])
		icmpHeader.SetChecksum(header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
			Header: icmpHeader, Src: gvisorAddress(reporter), Dst: gvisorAddress(destination),
			PayloadCsum: checksum.Checksum(message[8:], 0), PayloadLen: len(message) - 8,
		}))
	}
	return message, quote, pointer, nil
}

// makeInteropICMPQuote constructs the invoking UDP/IP packet shared by both
// independent extension encoders.
func makeInteropICMPQuote(source, destination netip.Addr) ([]byte, error) {
	udpWire, err := (mipstack.UDPDatagram{
		Source: netipAddrPort(source, 45001), Destination: netipAddrPort(destination, 45002),
		Payload: []byte("rfc4884-interop"),
	}).MarshalBinary()
	if err != nil {
		return nil, err
	}
	return (mipstack.IPPacket{
		Source: source, Destination: destination,
		Protocol: mipstack.ProtocolUDP, HopLimit: 31, Payload: udpWire,
	}).MarshalBinary()
}

// makeMipstackICMPExtension constructs the reverse-direction message through
// mipstack's semantic API.
func makeMipstackICMPExtension(family interopFamily, reporter, destination, quotedSource, quotedTarget netip.Addr) (message, quote []byte, pointer uint32, err error) {
	quote, err = makeInteropICMPQuote(quotedSource, quotedTarget)
	if err != nil {
		return nil, nil, 0, err
	}
	messageType, code := uint8(mipstack.ICMPv4TypeTimeExceeded), uint8(mipstack.ICMPv4TimeExceededCodeTTLInTransit)
	objects := []mipstack.ICMPExtensionObject{{Class: 0xfe, Type: 7, Data: []byte{1, 2, 3, 4}}}
	if family.mipstackAddress.Is6() {
		messageType, code = mipstack.ICMPv6TypeDestinationUnreachable, mipstack.ICMPv6DestinationUnreachableCodeHeadersTooLong
		pointer = uint32(len(quote) + 4096)
		var object mipstack.ICMPExtensionObject
		object.SetPointer(pointer)
		objects = []mipstack.ICMPExtensionObject{object}
	}
	networkError := mipstack.ICMPError{Reporter: reporter, Type: messageType, Code: code, QuotedPacket: quote}
	if err = networkError.SetExtensionObjects(objects); err != nil {
		return nil, nil, 0, err
	}
	semantic, err := networkError.ICMPMessage(destination)
	if err != nil {
		return nil, nil, 0, err
	}
	message, err = semantic.MarshalBinary()
	return message, quote, pointer, err
}

// TestMipstackICMPFilterInterop verifies that native gVisor raw ICMP traffic
// observes mipstack's Linux-compatible IPv4 and RFC 3542 IPv6 type filters.
func TestMipstackICMPFilterInterop(t *testing.T) {
	for _, family := range interopFamilies {
		family := family
		t.Run(family.name, func(t *testing.T) {
			network := newFamilyInteropNetwork(t, family, interopDefaultMTU)
			var option mipstack.SocketOption
			if family.mipstackAddress.Is4() {
				var filter mipstack.ICMPv4Filter
				filter.Block(uint8(header.ICMPv4EchoReply))
				option = mipstack.SocketOptions.ICMPv4Filter(filter)
			} else {
				var filter mipstack.ICMPv6Filter
				filter.Block(uint8(header.ICMPv6EchoReply))
				option = mipstack.SocketOptions.ICMPv6Filter(filter)
			}
			connection, err := (&mipstack.ListenConfig{Options: []mipstack.SocketOption{option}}).ListenIP(
				context.Background(), network.mipstack, family.icmpNetwork, family.mipstackAddress,
			)
			if err != nil {
				t.Fatalf("listen with mipstack ICMP filter: %v", err)
			}
			defer connection.Close()

			var queue waiter.Queue
			endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
			if tcpipErr != nil {
				t.Fatalf("create gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}
			defer endpoint.Close()
			if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
				t.Fatalf("bind gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}
			if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
				t.Fatalf("connect gVisor raw ICMP endpoint: %s", tcpipErr.String())
			}

			message := makeICMPEcho(family, true, 0x5310, 1, []byte("filtered"), family.gvisorAddress, family.mipstackAddress)
			if written, writeErr := endpoint.Write(bytes.NewReader(message), tcpip.WriteOptions{}); writeErr != nil || written != int64(len(message)) {
				t.Fatalf("write filtered gVisor ICMP: n=%d, error=%s", written, tcpipErrorString(writeErr))
			}
			if err = connection.SetReadDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
				t.Fatal(err)
			}
			if _, readErr := connection.(*mipstack.IPConn).Read(make([]byte, 64)); !errors.Is(readErr, os.ErrDeadlineExceeded) {
				t.Fatalf("blocked ICMP read = %v, want deadline", readErr)
			}
			if err = connection.SetReadDeadline(time.Time{}); err != nil {
				t.Fatal(err)
			}
			if family.mipstackAddress.Is4() {
				err = connection.(*mipstack.IPConn).SetICMPv4Filter(mipstack.ICMPv4Filter{})
			} else {
				err = connection.(*mipstack.IPConn).SetICMPv6Filter(mipstack.ICMPv6Filter{})
			}
			if err != nil {
				t.Fatal(err)
			}
			message = makeICMPEcho(family, true, 0x5310, 2, []byte("accepted"), family.gvisorAddress, family.mipstackAddress)
			if written, writeErr := endpoint.Write(bytes.NewReader(message), tcpip.WriteOptions{}); writeErr != nil || written != int64(len(message)) {
				t.Fatalf("write accepted gVisor ICMP: n=%d, error=%s", written, tcpipErrorString(writeErr))
			}
			storage := make([]byte, 64)
			read, readErr := connection.(*mipstack.IPConn).Read(storage)
			if readErr != nil || !bytes.Equal(storage[:read], message) {
				t.Fatalf("accepted gVisor ICMP = %x, %v", storage[:read], readErr)
			}
		})
	}
}

// TestGVisorICMPv6FilterInterop verifies mipstack-generated ICMPv6 against
// gVisor's native ICMP6_FILTER implementation.
func TestGVisorICMPv6FilterInterop(t *testing.T) {
	family := interopFamilies[1]
	network := newFamilyInteropNetwork(t, family, interopDefaultMTU)
	connection, err := network.mipstack.ListenIP(context.Background(), family.icmpNetwork, family.mipstackAddress)
	if err != nil {
		t.Fatalf("listen with mipstack ICMPv6 socket: %v", err)
	}
	defer connection.Close()

	var queue waiter.Queue
	endpoint, tcpipErr := raw.NewEndpoint(network.gvisor, family.networkProtocol, family.icmpProtocol, &queue)
	if tcpipErr != nil {
		t.Fatalf("create gVisor raw ICMPv6 endpoint: %s", tcpipErr.String())
	}
	defer endpoint.Close()
	if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, 0)); tcpipErr != nil {
		t.Fatalf("bind gVisor raw ICMPv6 endpoint: %s", tcpipErr.String())
	}
	if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
		t.Fatalf("connect gVisor raw ICMPv6 endpoint: %s", tcpipErr.String())
	}
	var filter tcpip.ICMPv6Filter
	filter.DenyType[uint8(header.ICMPv6EchoReply)>>5] |= uint32(1) << (uint8(header.ICMPv6EchoReply) & 31)
	if tcpipErr = endpoint.SetSockOpt(&filter); tcpipErr != nil {
		t.Fatalf("set gVisor ICMPv6 filter: %s", tcpipErr.String())
	}
	entry, notifications := registerReadable(&queue)
	defer queue.EventUnregister(&entry)

	message := makeICMPEcho(family, true, 0x5320, 1, []byte("filtered"), family.mipstackAddress, family.gvisorAddress)
	if written, writeErr := connection.WriteTo(message, &net.IPAddr{IP: net.IP(family.gvisorAddress.AsSlice())}); writeErr != nil || written != len(message) {
		t.Fatalf("write filtered mipstack ICMPv6: n=%d, error=%v", written, writeErr)
	}
	blockedContext, cancelBlocked := context.WithTimeout(context.Background(), 100*time.Millisecond)
	if _, _, readErr := readGVisorEndpoint(blockedContext, endpoint, notifications, 64); !errors.Is(readErr, context.DeadlineExceeded) {
		cancelBlocked()
		t.Fatalf("gVisor blocked ICMPv6 read = %v, want deadline", readErr)
	}
	cancelBlocked()
	if tcpipErr = endpoint.SetSockOpt(&tcpip.ICMPv6Filter{}); tcpipErr != nil {
		t.Fatalf("clear gVisor ICMPv6 filter: %s", tcpipErr.String())
	}
	message = makeICMPEcho(family, true, 0x5320, 2, []byte("accepted"), family.mipstackAddress, family.gvisorAddress)
	if written, writeErr := connection.WriteTo(message, &net.IPAddr{IP: net.IP(family.gvisorAddress.AsSlice())}); writeErr != nil || written != len(message) {
		t.Fatalf("write accepted mipstack ICMPv6: n=%d, error=%v", written, writeErr)
	}
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	packet, _, readErr := readGVisorEndpoint(ctx, endpoint, notifications, 64)
	if readErr != nil || !bytes.Equal(packet, message) {
		t.Fatalf("accepted mipstack ICMPv6 = %x, %v", packet, readErr)
	}
}

// testMipstackICMPEcho sends fitting and fragmented echo requests through a
// mipstack IPConn and validates gVisor's replies.
func testMipstackICMPEcho(t *testing.T, network *interopNetwork, family interopFamily, mtu uint32) {
	t.Helper()
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()
	connection, err := network.mipstack.DialIP(ctx, family.icmpNetwork, family.mipstackAddress, family.gvisorAddress)
	if err != nil {
		t.Fatalf("dial mipstack ICMP: %v", err)
	}
	defer connection.Close()
	if err = connection.SetDeadline(time.Now().Add(8 * time.Second)); err != nil {
		t.Fatalf("set mipstack ICMP deadline: %v", err)
	}

	storage := make([]byte, 65535)
	const identifier = 0x5101
	for index, size := range []int{29, fragmentedInteropPayloadSize(mtu, 4096)} {
		payload := patternedPayload(size, byte(43+index))
		request := makeICMPEcho(family, false, identifier, uint16(index+1), payload, family.mipstackAddress, family.gvisorAddress)
		written, writeErr := connection.Write(request)
		if writeErr != nil || written != len(request) {
			t.Fatalf("write mipstack ICMP echo: n=%d, error=%v", written, writeErr)
		}
		read, readErr := connection.Read(storage)
		if readErr != nil {
			t.Fatalf("read mipstack ICMP echo reply: %v", readErr)
		}
		if err = validateICMPEcho(family, storage[:read], true, identifier, uint16(index+1), payload, family.gvisorAddress, family.mipstackAddress); err != nil {
			t.Fatal(err)
		}
	}
}

// testGVisorICMPEcho sends fitting and fragmented echo requests through a
// native gVisor ping endpoint and validates mipstack's replies.
func testGVisorICMPEcho(t *testing.T, network *interopNetwork, family interopFamily, mtu uint32) {
	t.Helper()
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	var queue waiter.Queue
	endpoint, tcpipErr := network.gvisor.NewEndpoint(family.icmpProtocol, family.networkProtocol, &queue)
	if tcpipErr != nil {
		t.Fatalf("create gVisor ICMP endpoint: %s", tcpipErr.String())
	}
	defer endpoint.Close()
	const identifier = 0x5201
	if tcpipErr = endpoint.Bind(gvisorFullAddress(family.gvisorAddress, identifier)); tcpipErr != nil {
		t.Fatalf("bind gVisor ICMP endpoint: %s", tcpipErr.String())
	}
	if tcpipErr = endpoint.Connect(gvisorFullAddress(family.mipstackAddress, 0)); tcpipErr != nil {
		t.Fatalf("connect gVisor ICMP endpoint: %s", tcpipErr.String())
	}
	entry, notifications := registerReadable(&queue)
	defer queue.EventUnregister(&entry)

	for index, size := range []int{31, fragmentedInteropPayloadSize(mtu, 4096)} {
		payload := patternedPayload(size, byte(71+index))
		request := makeICMPEcho(family, false, identifier, uint16(index+1), payload, family.gvisorAddress, family.mipstackAddress)
		written, writeErr := endpoint.Write(bytes.NewReader(request), tcpip.WriteOptions{})
		if writeErr != nil || written != int64(len(request)) {
			t.Fatalf("write gVisor ICMP echo: n=%d, error=%v", written, tcpipErrorString(writeErr))
		}
		reply, _, readErr := readGVisorEndpoint(ctx, endpoint, notifications, 65535)
		if readErr != nil {
			t.Fatalf("read gVisor ICMP echo reply: %v", readErr)
		}
		if err := validateICMPEcho(family, reply, true, identifier, uint16(index+1), payload, family.mipstackAddress, family.gvisorAddress); err != nil {
			t.Fatal(err)
		}
	}
}

// makeICMPEcho builds a checksum-valid echo request or reply for one family.
func makeICMPEcho(family interopFamily, reply bool, identifier, sequence uint16, payload []byte, source, target netip.Addr) []byte {
	message := make([]byte, 8+len(payload))
	copy(message[8:], payload)
	if family.networkProtocol == header.IPv4ProtocolNumber {
		icmpHeader := header.ICMPv4(message[:8])
		messageType := header.ICMPv4Echo
		if reply {
			messageType = header.ICMPv4EchoReply
		}
		icmpHeader.SetType(messageType)
		icmpHeader.SetCode(0)
		icmpHeader.SetIdent(identifier)
		icmpHeader.SetSequence(sequence)
		icmpHeader.SetChecksum(^checksum.Checksum(message, 0))
		return message
	}

	icmpHeader := header.ICMPv6(message[:8])
	messageType := header.ICMPv6EchoRequest
	if reply {
		messageType = header.ICMPv6EchoReply
	}
	icmpHeader.SetType(messageType)
	icmpHeader.SetCode(0)
	icmpHeader.SetIdent(identifier)
	icmpHeader.SetSequence(sequence)
	icmpHeader.SetChecksum(header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
		Header:      icmpHeader,
		Src:         gvisorAddress(source),
		Dst:         gvisorAddress(target),
		PayloadCsum: checksum.Checksum(message[8:], 0),
		PayloadLen:  len(message) - 8,
	}))
	return message
}

// validateICMPEcho checks framing, type, checksum, identity, sequence, and
// payload without retaining the message.
func validateICMPEcho(family interopFamily, message []byte, reply bool, identifier, sequence uint16, payload []byte, source, target netip.Addr) error {
	if len(message) != 8+len(payload) {
		return fmt.Errorf("ICMP echo length: got %d, want %d", len(message), 8+len(payload))
	}
	if family.networkProtocol == header.IPv4ProtocolNumber {
		icmpHeader := header.ICMPv4(message[:8])
		expectedType := header.ICMPv4Echo
		if reply {
			expectedType = header.ICMPv4EchoReply
		}
		if icmpHeader.Type() != expectedType || icmpHeader.Code() != 0 {
			return fmt.Errorf("ICMPv4 echo type/code: got %d/%d, want %d/0", icmpHeader.Type(), icmpHeader.Code(), expectedType)
		}
		if checksum.Checksum(message, 0) != 0xffff {
			return errors.New("ICMPv4 echo checksum is invalid")
		}
	} else {
		icmpHeader := header.ICMPv6(message[:8])
		expectedType := header.ICMPv6EchoRequest
		if reply {
			expectedType = header.ICMPv6EchoReply
		}
		if icmpHeader.Type() != expectedType || icmpHeader.Code() != 0 {
			return fmt.Errorf("ICMPv6 echo type/code: got %d/%d, want %d/0", icmpHeader.Type(), icmpHeader.Code(), expectedType)
		}
		actualChecksum := icmpHeader.Checksum()
		icmpHeader.SetChecksum(0)
		expectedChecksum := header.ICMPv6Checksum(header.ICMPv6ChecksumParams{
			Header:      icmpHeader,
			Src:         gvisorAddress(source),
			Dst:         gvisorAddress(target),
			PayloadCsum: checksum.Checksum(message[8:], 0),
			PayloadLen:  len(message) - 8,
		})
		icmpHeader.SetChecksum(actualChecksum)
		if actualChecksum != expectedChecksum {
			return fmt.Errorf("ICMPv6 echo checksum: got %#04x, want %#04x", actualChecksum, expectedChecksum)
		}
	}
	var actualIdentifier, actualSequence uint16
	if family.networkProtocol == header.IPv4ProtocolNumber {
		actualIdentifier = header.ICMPv4(message[:8]).Ident()
		actualSequence = header.ICMPv4(message[:8]).Sequence()
	} else {
		actualIdentifier = header.ICMPv6(message[:8]).Ident()
		actualSequence = header.ICMPv6(message[:8]).Sequence()
	}
	if actualIdentifier != identifier || actualSequence != sequence {
		return fmt.Errorf("ICMP echo identifier/sequence: got %#x/%d, want %#x/%d", actualIdentifier, actualSequence, identifier, sequence)
	}
	if !bytes.Equal(message[8:], payload) {
		return errors.New("ICMP echo payload mismatch")
	}
	return nil
}

// tcpipErrorString formats gVisor's non-standard error interface safely.
func tcpipErrorString(err tcpip.Error) string {
	if err == nil {
		return "<nil>"
	}
	return err.String()
}