Skip to content

net: ipv6: Verify ICMPv6 checksum before accepting packet #10999

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 2, 2018
Merged

net: ipv6: Verify ICMPv6 checksum before accepting packet #10999

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6cf732d
net: ipv6: Verify ICMPv6 checksum before accepting packet
jukkar Nov 1, 2018
7b20753
tests: net: mld: Fix ICMPv6 checksum calculation
jukkar Nov 2, 2018
85190f7
tests: net: ipv6: Calculate ICMPv6 checksum for RA message
jukkar Nov 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions subsys/net/ip/ipv6.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,7 @@ static inline enum net_verdict process_icmpv6_pkt(struct net_pkt *pkt,
struct net_ipv6_hdr *ipv6)
{
struct net_icmp_hdr icmp_hdr;
u16_t chksum;
int ret;

ret = net_icmpv6_get_hdr(pkt, &icmp_hdr);
Expand All @@ -158,6 +159,16 @@ static inline enum net_verdict process_icmpv6_pkt(struct net_pkt *pkt,
return NET_DROP;
}

chksum = icmp_hdr.chksum;
net_icmpv6_set_chksum(pkt);
(void)net_icmpv6_get_hdr(pkt, &icmp_hdr);

if (chksum != icmp_hdr.chksum) {
NET_DBG("ICMPv6 invalid checksum (0x%04x instead of 0x%04x)",
ntohs(chksum), ntohs(icmp_hdr.chksum));
return NET_DROP;
}

NET_DBG("ICMPv6 %s received type %d code %d",
net_icmpv6_type2str(icmp_hdr.type), icmp_hdr.type,
icmp_hdr.code);
Expand Down
30 changes: 22 additions & 8 deletions tests/net/ipv6/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ static struct net_pkt *prepare_ra_message(void)
struct net_linkaddr lladdr_src;
struct net_linkaddr lladdr_dst;
struct net_pkt *pkt;
struct net_buf *frag;
struct net_buf *frag, *frag_ll;
struct net_if *iface;

iface = net_if_get_default();
Expand All @@ -189,23 +189,37 @@ static struct net_pkt *prepare_ra_message(void)

net_pkt_frag_add(pkt, frag);

net_pkt_set_iface(pkt, iface);
net_pkt_set_family(pkt, AF_INET6);
net_pkt_set_ip_hdr_len(pkt, sizeof(struct net_ipv6_hdr));
net_pkt_set_ipv6_ext_len(pkt, 0);

/* First fragment contains now IPv6 header and not ethernet frame
* because ICMPv6 calculation function does not understand ethernet
* header.
*/
memcpy(net_buf_add(frag, sizeof(icmpv6_ra)),
icmpv6_ra, sizeof(icmpv6_ra));

zassert_false(net_icmpv6_set_chksum(pkt) < 0, "Cannot set checksum");

/* Then create ethernet fragment */
frag_ll = net_pkt_get_frag(pkt, K_FOREVER);

lladdr_dst.addr = iface->if_dev->link_addr.addr;
lladdr_dst.len = 6;

lladdr_src.addr = NULL;
lladdr_src.len = 0;

net_pkt_frag_insert(pkt, frag_ll);

net_eth_fill_header(ctx, pkt, htons(NET_ETH_PTYPE_IPV6),
lladdr_src.addr, lladdr_dst.addr);

net_buf_add(frag, net_pkt_ll_reserve(pkt));
net_buf_add(frag_ll, net_pkt_ll_reserve(pkt));

net_pkt_set_iface(pkt, iface);
net_pkt_set_family(pkt, AF_INET6);
net_pkt_set_ip_hdr_len(pkt, sizeof(struct net_ipv6_hdr));

memcpy(net_buf_add(frag, sizeof(icmpv6_ra)),
icmpv6_ra, sizeof(icmpv6_ra));
net_pkt_compact(pkt);

return pkt;
}
Expand Down
2 changes: 2 additions & 0 deletions tests/net/mld/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,8 @@ static void send_query(struct net_if *iface)

net_pkt_set_iface(pkt, iface);

net_pkt_set_ipv6_ext_len(pkt, ROUTER_ALERT_LEN);

net_pkt_write_be16(pkt, pkt->frags,
NET_IPV6H_LEN + ROUTER_ALERT_LEN + 2,
&pos, ntohs(~net_calc_chksum_icmpv6(pkt)));
Expand Down