net: ipv6: Verify ICMPv6 checksum before accepting packet

Make sure that ICMPv6 checksum is correct before continuing
processing the packet.

Fixes #10971

Signed-off-by: Jukka Rissanen <[email protected]>

Author: jukkar

subsys/net/ip/ipv6.c

@@ -150,6 +150,7 @@ static inline enum net_verdict process_icmpv6_pkt(struct net_pkt *pkt,
 						  struct net_ipv6_hdr *ipv6)
 {
 	struct net_icmp_hdr icmp_hdr;
+	u16_t chksum;
 	int ret;
 
 	ret = net_icmpv6_get_hdr(pkt, &icmp_hdr);
@@ -158,6 +159,16 @@ static inline enum net_verdict process_icmpv6_pkt(struct net_pkt *pkt,
 		return NET_DROP;
 	}
 
+	chksum = icmp_hdr.chksum;
+	net_icmpv6_set_chksum(pkt);
+	(void)net_icmpv6_get_hdr(pkt, &icmp_hdr);
+
+	if (chksum != icmp_hdr.chksum) {
+		NET_DBG("ICMPv6 invalid checksum (0x%04x instead of 0x%04x)",
+			ntohs(chksum), ntohs(icmp_hdr.chksum));
+		return NET_DROP;
+	}
+
 	NET_DBG("ICMPv6 %s received type %d code %d",
 		net_icmpv6_type2str(icmp_hdr.type), icmp_hdr.type,
 		icmp_hdr.code);