diff options
| author |   Klement Sekera <ksekera@cisco.com> | 2021-07-27 13:33:51 +0200 |
|---|---|---|
| committer |   Ole Tr�an <otroan@employees.org> | 2021-07-29 08:23:23 +0000 |
| commit | 254c803612c0c9ec5dfc1b90de6efb23ec5bedd5 (patch) | |
| tree | 5bac561399f5845c04bbe73438154f525fdc3345 /src | |
| parent | b2d36784ac6689e323017a6adb9fc284aae01e13 (diff) | |
nat: fix ICMP checksum validation
Handle case where extra data is present in buffer which is not part of
IP/ICMP headers.
Type: fix
Fixes: 05b5a5b3b4b04823776feed6403b5a99b2e06d76
Change-Id: Icfef811470056d38c60fc45cc302139ed7594385
Signed-off-by: Klement Sekera <ksekera@cisco.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/plugins/nat/nat44-ed/nat44_ed.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/src/plugins/nat/nat44-ed/nat44_ed.c b/src/plugins/nat/nat44-ed/nat44_ed.c index 4e13907a9d8..8ad971decea 100644 --- a/src/plugins/nat/nat44-ed/nat44_ed.c +++ b/src/plugins/nat/nat44-ed/nat44_ed.c @@ -3694,15 +3694,6 @@ nat_6t_flow_icmp_translate (vlib_main_t *vm, snat_main_t *sm, vlib_buffer_t *b, return NAT_ED_TRNSL_ERR_PACKET_TRUNCATED; } - ssize_t icmp_offset = (u8 *) icmp - (u8 *) vlib_buffer_get_current (b); - ip_csum_t sum = - ip_incremental_checksum (0, icmp, b->current_length - icmp_offset); - sum = (u16) ~ip_csum_fold (sum); - if (sum != 0) - { - return NAT_ED_TRNSL_ERR_INVALID_CSUM; - } - if (!icmp_type_is_error_message (icmp->type)) { if ((f->ops & NAT_FLOW_OP_ICMP_ID_REWRITE) && @@ -3718,6 +3709,15 @@ nat_6t_flow_icmp_translate (vlib_main_t *vm, snat_main_t *sm, vlib_buffer_t *b, } else { + ip_csum_t sum = ip_incremental_checksum ( + 0, icmp, + clib_net_to_host_u16 (ip->length) - ip4_header_bytes (ip)); + sum = (u16) ~ip_csum_fold (sum); + if (sum != 0) + { + return NAT_ED_TRNSL_ERR_INVALID_CSUM; + } + // errors are not fragmented ip4_header_t *inner_ip = (ip4_header_t *) (echo + 1); |