Send ICMP errors when link address resolution fails

Before this change, we would silently drop packets when link resolution
failed. This change brings us into line with RFC 792 (IPv4) and RFC 4443 (IPv6),
both of which specify that gateways should return an ICMP error to the sender
when link resolution fails.

PiperOrigin-RevId: 374699789

12 files changed, 367 insertions, 4 deletions

diff --git a/pkg/tcpip/network/internal/ip/stats.go b/pkg/tcpip/network/internal/ip/stats.go
index 0c2b62127..40ab21cb6 100644
--- a/pkg/tcpip/network/internal/ip/stats.go
+++ b/pkg/tcpip/network/internal/ip/stats.go
@@ -42,6 +42,10 @@ type MultiCounterIPForwardingStats struct {
 	// were too big for the outgoing MTU.
 	PacketTooBig tcpip.MultiCounterStat
 
+	// HostUnreachable is the number of IP packets received which could not be
+	// successfully forwarded due to an unresolvable next hop.
+	HostUnreachable tcpip.MultiCounterStat
+
 	// ExtensionHeaderProblem is the number of IP packets which were dropped
 	// because of a problem encountered when processing an IPv6 extension
 	// header.
@@ -61,6 +65,7 @@ func (m *MultiCounterIPForwardingStats) Init(a, b *tcpip.IPForwardingStats) {
 	m.ExtensionHeaderProblem.Init(a.ExtensionHeaderProblem, b.ExtensionHeaderProblem)
 	m.PacketTooBig.Init(a.PacketTooBig, b.PacketTooBig)
 	m.ExhaustedTTL.Init(a.ExhaustedTTL, b.ExhaustedTTL)
+	m.HostUnreachable.Init(a.HostUnreachable, b.HostUnreachable)
 }
 
 // LINT.ThenChange(:MultiCounterIPForwardingStats, ../../../tcpip.go:IPForwardingStats)
diff --git a/pkg/tcpip/network/internal/testutil/BUILD b/pkg/tcpip/network/internal/testutil/BUILD
index cec3e62c4..b36134ddd 100644
--- a/pkg/tcpip/network/internal/testutil/BUILD
+++ b/pkg/tcpip/network/internal/testutil/BUILD
@@ -10,10 +10,12 @@ go_library(
         "//pkg/tcpip/network/internal/fragmentation:__pkg__",
         "//pkg/tcpip/network/ipv4:__pkg__",
         "//pkg/tcpip/network/ipv6:__pkg__",
+        "//pkg/tcpip/tests/integration:__pkg__",
     ],
     deps = [
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
+        "//pkg/tcpip/faketime",
         "//pkg/tcpip/header",
         "//pkg/tcpip/stack",
     ],
diff --git a/pkg/tcpip/network/internal/testutil/testutil.go b/pkg/tcpip/network/internal/testutil/testutil.go
index 605e9ef8d..328d5efee 100644
--- a/pkg/tcpip/network/internal/testutil/testutil.go
+++ b/pkg/tcpip/network/internal/testutil/testutil.go
@@ -19,13 +19,27 @@ package testutil
 import (
 	"fmt"
 	"math/rand"
+	"time"
 
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip/faketime"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
 
+const (
+	// immediateDuration is a duration of zero for scheduling work that needs to
+	// be done immediately but asynchronously to avoid deadlock.
+	immediateDuration time.Duration = 0
+)
+
+// RunImmediatelyScheduledJobs runs all jobs scheduled to run at the current
+// time.
+func RunImmediatelyScheduledJobs(clock *faketime.ManualClock) {
+	clock.Advance(immediateDuration)
+}
+
 // MockLinkEndpoint is an endpoint used for testing, it stores packets written
 // to it and can mock errors.
 type MockLinkEndpoint struct {
diff --git a/pkg/tcpip/network/ipv4/icmp.go b/pkg/tcpip/network/ipv4/icmp.go
index d1a82b584..8e27a6677 100644
--- a/pkg/tcpip/network/ipv4/icmp.go
+++ b/pkg/tcpip/network/ipv4/icmp.go
@@ -481,6 +481,22 @@ func (*icmpReasonFragmentationNeeded) isForwarding() bool {
 	return true
 }
 
+// icmpReasonHostUnreachable is an error in which the host specified in the
+// internet destination field of the datagram is unreachable.
+type icmpReasonHostUnreachable struct{}
+
+func (*icmpReasonHostUnreachable) isICMPReason() {}
+func (*icmpReasonHostUnreachable) isForwarding() bool {
+	// If we hit a Host Unreachable error, then we know we are operating as a
+	// router. As per RFC 792 page 5, Destination Unreachable Message,
+	//
+	//   In addition, in some networks, the gateway may be able to determine
+	//   if the internet destination host is unreachable.  Gateways in these
+	//   networks may send destination unreachable messages to the source host
+	//   when the destination host is unreachable.
+	return true
+}
+
 // returnError takes an error descriptor and generates the appropriate ICMP
 // error packet for IPv4 and sends it back to the remote device that sent
 // the problematic packet. It incorporates as much of that packet as
@@ -537,7 +553,12 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) tcpip
 	defer route.Release()
 
 	p.mu.Lock()
-	netEP, ok := p.mu.eps[pkt.NICID]
+	// We retrieve an endpoint using the newly constructed route's NICID rather
+	// than the packet's NICID. The packet's NICID corresponds to the NIC on
+	// which it arrived, which isn't necessarily the same as the NIC on which it
+	// will be transmitted. On the other hand, the route's NIC *is* guaranteed
+	// to be the NIC on which the packet will be transmitted.
+	netEP, ok := p.mu.eps[route.NICID()]
 	p.mu.Unlock()
 	if !ok {
 		return &tcpip.ErrNotConnected{}
@@ -653,6 +674,10 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) tcpip
 		icmpHdr.SetType(header.ICMPv4DstUnreachable)
 		icmpHdr.SetCode(header.ICMPv4NetUnreachable)
 		counter = sent.dstUnreachable
+	case *icmpReasonHostUnreachable:
+		icmpHdr.SetType(header.ICMPv4DstUnreachable)
+		icmpHdr.SetCode(header.ICMPv4HostUnreachable)
+		counter = sent.dstUnreachable
 	case *icmpReasonFragmentationNeeded:
 		icmpHdr.SetType(header.ICMPv4DstUnreachable)
 		icmpHdr.SetCode(header.ICMPv4FragmentationNeeded)
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index 23178277a..26fb8a871 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -104,6 +104,16 @@ type endpoint struct {
 
 // HandleLinkResolutionFailure implements stack.LinkResolvableNetworkEndpoint.
 func (e *endpoint) HandleLinkResolutionFailure(pkt *stack.PacketBuffer) {
+	// If we are operating as a router, return an ICMP error to the original
+	// packet's sender.
+	if pkt.NetworkPacketInfo.IsForwardedPacket {
+		// TODO(gvisor.dev/issue/6005): Propagate asynchronously generated ICMP
+		// errors to local endpoints.
+		e.protocol.returnError(&icmpReasonHostUnreachable{}, pkt)
+		e.stats.ip.Forwarding.Errors.Increment()
+		e.stats.ip.Forwarding.HostUnreachable.Increment()
+		return
+	}
 	// handleControl expects the entire offending packet to be in the packet
 	// buffer's data field.
 	pkt = stack.NewPacketBuffer(stack.PacketBufferOptions{
diff --git a/pkg/tcpip/network/ipv6/icmp.go b/pkg/tcpip/network/ipv6/icmp.go
index 307e1972d..23fc94303 100644
--- a/pkg/tcpip/network/ipv6/icmp.go
+++ b/pkg/tcpip/network/ipv6/icmp.go
@@ -1029,6 +1029,26 @@ func (*icmpReasonNetUnreachable) respondsToMulticast() bool {
 	return false
 }
 
+// icmpReasonHostUnreachable is an error in which the host specified in the
+// internet destination field of the datagram is unreachable.
+type icmpReasonHostUnreachable struct{}
+
+func (*icmpReasonHostUnreachable) isICMPReason() {}
+func (*icmpReasonHostUnreachable) isForwarding() bool {
+	// If we hit a Host Unreachable error, then we know we are operating as a
+	// router. As per RFC 4443 page 8, Destination Unreachable Message,
+	//
+	//   If the reason for the failure to deliver cannot be mapped to any of
+	//   other codes, the Code field is set to 3.  Example of such cases are
+	//   an inability to resolve the IPv6 destination address into a
+	//   corresponding link address, or a link-specific problem of some sort.
+	return true
+}
+
+func (*icmpReasonHostUnreachable) respondsToMulticast() bool {
+	return false
+}
+
 // icmpReasonFragmentationNeeded is an error where a packet is to big to be sent
 // out through the outgoing MTU, as per RFC 4443 page 9, Packet Too Big Message.
 type icmpReasonPacketTooBig struct{}
@@ -1143,7 +1163,12 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) tcpip
 	defer route.Release()
 
 	p.mu.Lock()
-	netEP, ok := p.mu.eps[pkt.NICID]
+	// We retrieve an endpoint using the newly constructed route's NICID rather
+	// than the packet's NICID. The packet's NICID corresponds to the NIC on
+	// which it arrived, which isn't necessarily the same as the NIC on which it
+	// will be transmitted. On the other hand, the route's NIC *is* guaranteed
+	// to be the NIC on which the packet will be transmitted.
+	netEP, ok := p.mu.eps[route.NICID()]
 	p.mu.Unlock()
 	if !ok {
 		return &tcpip.ErrNotConnected{}
@@ -1222,6 +1247,10 @@ func (p *protocol) returnError(reason icmpReason, pkt *stack.PacketBuffer) tcpip
 		icmpHdr.SetType(header.ICMPv6DstUnreachable)
 		icmpHdr.SetCode(header.ICMPv6NetworkUnreachable)
 		counter = sent.dstUnreachable
+	case *icmpReasonHostUnreachable:
+		icmpHdr.SetType(header.ICMPv6DstUnreachable)
+		icmpHdr.SetCode(header.ICMPv6AddressUnreachable)
+		counter = sent.dstUnreachable
 	case *icmpReasonPacketTooBig:
 		icmpHdr.SetType(header.ICMPv6PacketTooBig)
 		icmpHdr.SetCode(header.ICMPv6UnusedCode)
diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index 95e11ac51..68f8308f2 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -282,6 +282,16 @@ func (*endpoint) DuplicateAddressProtocol() tcpip.NetworkProtocolNumber {
 
 // HandleLinkResolutionFailure implements stack.LinkResolvableNetworkEndpoint.
 func (e *endpoint) HandleLinkResolutionFailure(pkt *stack.PacketBuffer) {
+	// If we are operating as a router, we should return an ICMP error to the
+	// original packet's sender.
+	if pkt.NetworkPacketInfo.IsForwardedPacket {
+		// TODO(gvisor.dev/issue/6005): Propagate asynchronously generated ICMP
+		// errors to local endpoints.
+		e.protocol.returnError(&icmpReasonHostUnreachable{}, pkt)
+		e.stats.ip.Forwarding.Errors.Increment()
+		e.stats.ip.Forwarding.HostUnreachable.Increment()
+		return
+	}
 	// handleControl expects the entire offending packet to be in the packet
 	// buffer's data field.
 	pkt = stack.NewPacketBuffer(stack.PacketBufferOptions{
diff --git a/pkg/tcpip/stack/neighbor_entry.go b/pkg/tcpip/stack/neighbor_entry.go
index 6d95e1664..418c71fe5 100644
--- a/pkg/tcpip/stack/neighbor_entry.go
+++ b/pkg/tcpip/stack/neighbor_entry.go
@@ -307,7 +307,7 @@ func (e *neighborEntry) setStateLocked(next NeighborState) {
 		// a shared lock.
 		e.mu.timer = timer{
 			done: &done,
-			timer: e.cache.nic.stack.Clock().AfterFunc(0, func() {
+			timer: e.cache.nic.stack.Clock().AfterFunc(immediateDuration, func() {
 				var err tcpip.Error = &tcpip.ErrTimeout{}
 				if remaining != 0 {
 					err = e.cache.linkRes.LinkAddressRequest(addr, "" /* localAddr */, linkAddr)
@@ -378,7 +378,7 @@ func (e *neighborEntry) handlePacketQueuedLocked(localAddr tcpip.Address) {
 		// a shared lock.
 		e.mu.timer = timer{
 			done: &done,
-			timer: e.cache.nic.stack.Clock().AfterFunc(0, func() {
+			timer: e.cache.nic.stack.Clock().AfterFunc(immediateDuration, func() {
 				var err tcpip.Error = &tcpip.ErrTimeout{}
 				if remaining != 0 {
 					// As per RFC 4861 section 7.2.2:
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index 797778e08..328470f3e 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -1552,6 +1552,10 @@ type IPForwardingStats struct {
 	// were too big for the outgoing MTU.
 	PacketTooBig *StatCounter
 
+	// HostUnreachable is the number of IP packets received which could not be
+	// successfully forwarded due to an unresolvable next hop.
+	HostUnreachable *StatCounter
+
 	// ExtensionHeaderProblem is the number of IP packets which were dropped
 	// because of a problem encountered when processing an IPv6 extension
 	// header.
diff --git a/pkg/tcpip/tests/integration/BUILD b/pkg/tcpip/tests/integration/BUILD
index ab2dab60c..e446c8cf3 100644
--- a/pkg/tcpip/tests/integration/BUILD
+++ b/pkg/tcpip/tests/integration/BUILD
@@ -48,17 +48,21 @@ go_test(
     size = "small",
     srcs = ["link_resolution_test.go"],
     deps = [
+        "//pkg/context",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/checker",
         "//pkg/tcpip/faketime",
         "//pkg/tcpip/header",
+        "//pkg/tcpip/link/channel",
         "//pkg/tcpip/link/pipe",
         "//pkg/tcpip/network/arp",
+        "//pkg/tcpip/network/internal/testutil",
         "//pkg/tcpip/network/ipv4",
         "//pkg/tcpip/network/ipv6",
         "//pkg/tcpip/stack",
         "//pkg/tcpip/tests/utils",
+        "//pkg/tcpip/testutil",
         "//pkg/tcpip/transport/icmp",
         "//pkg/tcpip/transport/tcp",
         "//pkg/tcpip/transport/udp",
diff --git a/pkg/tcpip/tests/integration/link_resolution_test.go b/pkg/tcpip/tests/integration/link_resolution_test.go
index c657714ba..e94f31ad7 100644
--- a/pkg/tcpip/tests/integration/link_resolution_test.go
+++ b/pkg/tcpip/tests/integration/link_resolution_test.go
@@ -17,22 +17,27 @@ package link_resolution_test
 import (
 	"bytes"
 	"fmt"
+	"net"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/checker"
 	"gvisor.dev/gvisor/pkg/tcpip/faketime"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
 	"gvisor.dev/gvisor/pkg/tcpip/link/pipe"
 	"gvisor.dev/gvisor/pkg/tcpip/network/arp"
+	iptestutil "gvisor.dev/gvisor/pkg/tcpip/network/internal/testutil"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/tests/utils"
+	tcptestutil "gvisor.dev/gvisor/pkg/tcpip/testutil"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
@@ -395,6 +400,249 @@ func TestTCPLinkResolutionFailure(t *testing.T) {
 	}
 }
 
+func TestForwardingWithLinkResolutionFailure(t *testing.T) {
+	const (
+		incomingNICID                     = 1
+		outgoingNICID                     = 2
+		randomSequence                    = 123
+		randomIdent                       = 42
+		randomTimeOffset                  = 0x10203040
+		ttl                               = 2
+		expectedHostUnreachableErrorCount = 1
+	)
+	outgoingLinkAddr := tcptestutil.MustParseLink("02:03:03:04:05:06")
+
+	rxICMPv4EchoRequest := func(e *channel.Endpoint, src, dst tcpip.Address) {
+		utils.RxICMPv4EchoRequest(e, src, dst, ttl)
+	}
+
+	rxICMPv6EchoRequest := func(e *channel.Endpoint, src, dst tcpip.Address) {
+		utils.RxICMPv6EchoRequest(e, src, dst, ttl)
+	}
+
+	arpChecker := func(t *testing.T, request channel.PacketInfo, src, dst tcpip.Address) {
+		if request.Proto != arp.ProtocolNumber {
+			t.Errorf("got request.Proto = %d, want = %d", request.Proto, arp.ProtocolNumber)
+		}
+		if request.Route.RemoteLinkAddress != header.EthernetBroadcastAddress {
+			t.Errorf("got request.Route.RemoteLinkAddress = %s, want = %s", request.Route.RemoteLinkAddress, header.EthernetBroadcastAddress)
+		}
+		rep := header.ARP(request.Pkt.NetworkHeader().View())
+		if got := rep.Op(); got != header.ARPRequest {
+			t.Errorf("got Op() = %d, want = %d", got, header.ARPRequest)
+		}
+		if got := tcpip.LinkAddress(rep.HardwareAddressSender()); got != outgoingLinkAddr {
+			t.Errorf("got HardwareAddressSender = %s, want = %s", got, outgoingLinkAddr)
+		}
+		if got := tcpip.Address(rep.ProtocolAddressSender()); got != src {
+			t.Errorf("got ProtocolAddressSender = %s, want = %s", got, src)
+		}
+		if got := tcpip.Address(rep.ProtocolAddressTarget()); got != dst {
+			t.Errorf("got ProtocolAddressTarget = %s, want = %s", got, dst)
+		}
+	}
+
+	ndpChecker := func(t *testing.T, request channel.PacketInfo, src, dst tcpip.Address) {
+		if request.Proto != header.IPv6ProtocolNumber {
+			t.Fatalf("got Proto = %d, want = %d", request.Proto, header.IPv6ProtocolNumber)
+		}
+
+		snmc := header.SolicitedNodeAddr(dst)
+		if want := header.EthernetAddressFromMulticastIPv6Address(snmc); request.Route.RemoteLinkAddress != want {
+			t.Errorf("got remote link address = %s, want = %s", request.Route.RemoteLinkAddress, want)
+		}
+
+		checker.IPv6(t, stack.PayloadSince(request.Pkt.NetworkHeader()),
+			checker.SrcAddr(src),
+			checker.DstAddr(snmc),
+			checker.TTL(header.NDPHopLimit),
+			checker.NDPNS(
+				checker.NDPNSTargetAddress(dst),
+			))
+	}
+
+	icmpv4Checker := func(t *testing.T, b []byte, src, dst tcpip.Address) {
+		checker.IPv4(t, b,
+			checker.SrcAddr(src),
+			checker.DstAddr(dst),
+			checker.TTL(ipv4.DefaultTTL),
+			checker.ICMPv4(
+				checker.ICMPv4Checksum(),
+				checker.ICMPv4Type(header.ICMPv4DstUnreachable),
+				checker.ICMPv4Code(header.ICMPv4HostUnreachable),
+			),
+		)
+	}
+
+	icmpv6Checker := func(t *testing.T, b []byte, src, dst tcpip.Address) {
+		checker.IPv6(t, b,
+			checker.SrcAddr(src),
+			checker.DstAddr(dst),
+			checker.TTL(ipv6.DefaultTTL),
+			checker.ICMPv6(
+				checker.ICMPv6Type(header.ICMPv6DstUnreachable),
+				checker.ICMPv6Code(header.ICMPv6AddressUnreachable),
+			),
+		)
+	}
+
+	tests := []struct {
+		name                         string
+		networkProtocolFactory       []stack.NetworkProtocolFactory
+		networkProtocolNumber        tcpip.NetworkProtocolNumber
+		sourceAddr                   tcpip.Address
+		destAddr                     tcpip.Address
+		incomingAddr                 tcpip.AddressWithPrefix
+		outgoingAddr                 tcpip.AddressWithPrefix
+		transportProtocol            func(*stack.Stack) stack.TransportProtocol
+		rx                           func(*channel.Endpoint, tcpip.Address, tcpip.Address)
+		linkResolutionRequestChecker func(*testing.T, channel.PacketInfo, tcpip.Address, tcpip.Address)
+		icmpReplyChecker             func(*testing.T, []byte, tcpip.Address, tcpip.Address)
+		mtu                          uint32
+	}{
+		{
+			name:                   "IPv4 Host unreachable",
+			networkProtocolFactory: []stack.NetworkProtocolFactory{arp.NewProtocol, ipv4.NewProtocol},
+			networkProtocolNumber:  header.IPv4ProtocolNumber,
+			sourceAddr:             tcptestutil.MustParse4("10.0.0.2"),
+			destAddr:               tcptestutil.MustParse4("11.0.0.2"),
+			incomingAddr: tcpip.AddressWithPrefix{
+				Address:   tcpip.Address(net.ParseIP("10.0.0.1").To4()),
+				PrefixLen: 8,
+			},
+			outgoingAddr: tcpip.AddressWithPrefix{
+				Address:   tcpip.Address(net.ParseIP("11.0.0.1").To4()),
+				PrefixLen: 8,
+			},
+			transportProtocol:            icmp.NewProtocol4,
+			linkResolutionRequestChecker: arpChecker,
+			icmpReplyChecker:             icmpv4Checker,
+			rx:                           rxICMPv4EchoRequest,
+			mtu:                          ipv4.MaxTotalSize,
+		},
+		{
+			name:                   "IPv6 Host unreachable",
+			networkProtocolFactory: []stack.NetworkProtocolFactory{ipv6.NewProtocol},
+			networkProtocolNumber:  header.IPv6ProtocolNumber,
+			sourceAddr:             tcptestutil.MustParse6("10::2"),
+			destAddr:               tcptestutil.MustParse6("11::2"),
+			incomingAddr: tcpip.AddressWithPrefix{
+				Address:   tcpip.Address(net.ParseIP("10::1").To16()),
+				PrefixLen: 64,
+			},
+			outgoingAddr: tcpip.AddressWithPrefix{
+				Address:   tcpip.Address(net.ParseIP("11::1").To16()),
+				PrefixLen: 64,
+			},
+			transportProtocol:            icmp.NewProtocol6,
+			linkResolutionRequestChecker: ndpChecker,
+			icmpReplyChecker:             icmpv6Checker,
+			rx:                           rxICMPv6EchoRequest,
+			mtu:                          header.IPv6MinimumMTU,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			clock := faketime.NewManualClock()
+
+			s := stack.New(stack.Options{
+				NetworkProtocols:   test.networkProtocolFactory,
+				TransportProtocols: []stack.TransportProtocolFactory{test.transportProtocol},
+				Clock:              clock,
+			})
+
+			// Set up endpoint through which we will receive packets.
+			incomingEndpoint := channel.New(1, test.mtu, "")
+			if err := s.CreateNIC(incomingNICID, incomingEndpoint); err != nil {
+				t.Fatalf("CreateNIC(%d, _): %s", incomingNICID, err)
+			}
+			incomingProtoAddr := tcpip.ProtocolAddress{
+				Protocol:          test.networkProtocolNumber,
+				AddressWithPrefix: test.incomingAddr,
+			}
+			if err := s.AddProtocolAddress(incomingNICID, incomingProtoAddr); err != nil {
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", incomingNICID, incomingProtoAddr, err)
+			}
+
+			// Set up endpoint through which we will attempt to forward packets.
+			outgoingEndpoint := channel.New(1, test.mtu, outgoingLinkAddr)
+			outgoingEndpoint.LinkEPCapabilities |= stack.CapabilityResolutionRequired
+			if err := s.CreateNIC(outgoingNICID, outgoingEndpoint); err != nil {
+				t.Fatalf("CreateNIC(%d, _): %s", outgoingNICID, err)
+			}
+			outgoingProtoAddr := tcpip.ProtocolAddress{
+				Protocol:          test.networkProtocolNumber,
+				AddressWithPrefix: test.outgoingAddr,
+			}
+			if err := s.AddProtocolAddress(outgoingNICID, outgoingProtoAddr); err != nil {
+				t.Fatalf("AddProtocolAddress(%d, %#v): %s", outgoingNICID, outgoingProtoAddr, err)
+			}
+
+			s.SetRouteTable([]tcpip.Route{
+				{
+					Destination: test.incomingAddr.Subnet(),
+					NIC:         incomingNICID,
+				},
+				{
+					Destination: test.outgoingAddr.Subnet(),
+					NIC:         outgoingNICID,
+				},
+			})
+
+			if err := s.SetForwardingDefaultAndAllNICs(test.networkProtocolNumber, true); err != nil {
+				t.Fatalf("SetForwardingDefaultAndAllNICs(%d, true): %s", test.networkProtocolNumber, err)
+			}
+
+			test.rx(incomingEndpoint, test.sourceAddr, test.destAddr)
+
+			var request channel.PacketInfo
+			var ok bool
+			nudConfigs, err := s.NUDConfigurations(outgoingNICID, test.networkProtocolNumber)
+			if err != nil {
+				t.Fatalf("s.NUDConfigurations(%d, %d): %s", outgoingNICID, test.networkProtocolNumber, err)
+			}
+			// Trigger the first packet on the endpoint.
+			iptestutil.RunImmediatelyScheduledJobs(clock)
+
+			for i := 0; i < int(nudConfigs.MaxMulticastProbes); i++ {
+				if request, ok = outgoingEndpoint.Read(); !ok {
+					t.Fatal("expected ARP packet through outgoing NIC")
+				}
+
+				test.linkResolutionRequestChecker(t, request, test.outgoingAddr.Address, test.destAddr)
+
+				// Advance the clock the span of one request timeout.
+				clock.Advance(nudConfigs.RetransmitTimer)
+			}
+
+			// Next, we make a blocking read to retrieve the error packet. This is
+			// necessary because outgoing packets are dequeued asynchronously when
+			// link resolution fails, and this dequeue is what triggers the ICMP
+			// error.
+			//
+			// TODO(gvisor.dev/issue/6012): Replace with asynchronous read after we
+			// have integrated the stack clock with the dequeuing code.
+			reply, ok := incomingEndpoint.ReadContext(context.Background())
+			if !ok {
+				t.Fatal("expected ICMP packet through incoming NIC")
+			}
+
+			test.icmpReplyChecker(t, stack.PayloadSince(reply.Pkt.NetworkHeader()), test.incomingAddr.Address, test.sourceAddr)
+
+			// Since link resolution failed, we don't expect the packet to be
+			// forwarded.
+			forwardedPacket, ok := outgoingEndpoint.Read()
+			if ok {
+				t.Fatalf("expected no ICMP Echo packet through outgoing NIC, instead found: %#v", forwardedPacket)
+			}
+
+			if got, want := s.Stats().IP.Forwarding.HostUnreachable.Value(), expectedHostUnreachableErrorCount; int(got) != want {
+				t.Errorf("got rt.Stats().IP.Forwarding.HostUnreachable.Value() = %d, want = %d", got, want)
+			}
+		})
+	}
+}
+
 func TestGetLinkAddress(t *testing.T) {
 	const (
 		host1NICID = 1
diff --git a/pkg/tcpip/testutil/testutil.go b/pkg/tcpip/testutil/testutil.go
index f84d399fb..94b580a70 100644
--- a/pkg/tcpip/testutil/testutil.go
+++ b/pkg/tcpip/testutil/testutil.go
@@ -109,3 +109,15 @@ func ValidateMultiCounterStats(multi reflect.Value, counters []reflect.Value) er
 
 	return nil
 }
+
+// MustParseLink parses a Link string into a tcpip.LinkAddress, panicking on
+// error.
+//
+// The string must be in the format aa:bb:cc:dd:ee:ff or aa-bb-cc-dd-ee-ff.
+func MustParseLink(addr string) tcpip.LinkAddress {
+	parsed, err := tcpip.ParseMACAddress(addr)
+	if err != nil {
+		panic(fmt.Sprintf("tcpip.ParseMACAddress(%s): %s", addr, err))
+	}
+	return parsed
+}