Skip to content

Commit 2822cc6

Browse files
committed
fix(lwip): Fix ping_v6 receiving to accept only echo replies
This fixes a bug where we ping our own IP and the request itself bounces back to the raw receive function and is incorrectly treated as reply. (this bug was discovered when fixing ICMPv6 pings with incorrect checksums, while the ping request was dropped in icmpv6.c due to wrong checksum, but was also fed to raw layers where it was treated as "correct" response, so the PINGv6 to ourselves still worked)
1 parent e390c17 commit 2822cc6

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

components/lwip/apps/ping/ping_sock.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,8 @@ static int esp_ping_receive(esp_ping_t *ep)
133133
if (IP_IS_V6_VAL(recv_addr)) { // Currently we process IPv6
134134
struct ip6_hdr *iphdr = (struct ip6_hdr *)buf;
135135
struct icmp6_echo_hdr *iecho6 = (struct icmp6_echo_hdr *)(buf + sizeof(struct ip6_hdr)); // IPv6 head length is 40
136-
if ((iecho6->id == ep->packet_hdr->id) && (iecho6->seqno == ep->packet_hdr->seqno)) {
136+
if ((iecho6->type == ICMP6_TYPE_EREP) // only check the ICMPv6 echo reply types
137+
&& (iecho6->id == ep->packet_hdr->id) && (iecho6->seqno == ep->packet_hdr->seqno)) {
137138
ip_addr_copy(ep->recv_addr, recv_addr);
138139
ep->received++;
139140
ep->recv_len = IP6H_PLEN(iphdr) - sizeof(struct icmp6_echo_hdr); //The data portion of ICMPv6

0 commit comments

Comments
 (0)