ipv6 ready: When there are more fragments(Mbit is not zero), payload_length field in IPV6 header must be the multiple of 8 (see patch #9455)

Signed-off-by: goldsimon <goldsimon@gmx.de>
This commit is contained in:
Jisu Kim 2017-09-19 14:29:27 +02:00 committed by goldsimon
parent fa11461f84
commit 6447a583e2

View File

@ -951,6 +951,11 @@ netif_found:
struct ip6_frag_hdr *frag_hdr; struct ip6_frag_hdr *frag_hdr;
LWIP_DEBUGF(IP6_DEBUG, ("ip6_input: packet with Fragment header\n")); LWIP_DEBUGF(IP6_DEBUG, ("ip6_input: packet with Fragment header\n"));
frag_hdr = (struct ip6_frag_hdr *)p->payload;
/* Get next header type. */
nexth = &IP6_FRAG_NEXTH(frag_hdr);
/* Fragment Header length. */ /* Fragment Header length. */
hlen = 8; hlen = 8;
@ -968,10 +973,15 @@ netif_found:
hlen_tot = (u16_t)(hlen_tot + hlen); hlen_tot = (u16_t)(hlen_tot + hlen);
frag_hdr = (struct ip6_frag_hdr *)p->payload; /* check payload length is multiple of 8 octets when mbit is set */
if (IP6_FRAG_MBIT(frag_hdr) && (IP6H_PLEN(ip6hdr) & 0x7)) {
/* Get next header type. */ /* ipv6 payload length is not multiple of 8 octets */
nexth = &frag_hdr->_nexth; icmp6_param_problem(p, ICMP6_PP_FIELD, &ip6hdr->_plen);
LWIP_DEBUGF(IP6_DEBUG, ("ip6_input: packet with invalid payload length dropped\n"));
pbuf_free(p);
IP6_STATS_INC(ip6.drop);
goto ip6_input_cleanup;
}
/* Offset == 0 and more_fragments == 0? */ /* Offset == 0 and more_fragments == 0? */
if ((frag_hdr->_fragment_offset & if ((frag_hdr->_fragment_offset &
@ -980,7 +990,6 @@ netif_found:
pbuf_remove_header(p, hlen); pbuf_remove_header(p, hlen);
} else { } else {
#if LWIP_IPV6_REASS #if LWIP_IPV6_REASS
/* reassemble the packet */ /* reassemble the packet */
ip_data.current_ip_header_tot_len = hlen_tot; ip_data.current_ip_header_tot_len = hlen_tot;
p = ip6_reass(p); p = ip6_reass(p);