3 files changed, 34 insertions, 0 deletions
diff --git a/src/include/ndpi_main.h b/src/include/ndpi_main.h
index 66567d871..790fa4c33 100644
--- a/src/include/ndpi_main.h
+++ b/src/include/ndpi_main.h
@@ -155,6 +155,7 @@ extern "C" {
   int ndpi_is_printable_string(char * const str, size_t len);
 #define NDPI_ENTROPY_ENCRYPTED_OR_RANDOM(entropy) (entropy > 7.0f)
   float ndpi_entropy(u_int8_t const * const buf, size_t len);
+  u_int16_t ndpi_calculate_icmp4_checksum(u_int8_t const * const buf, size_t len);
   void load_common_alpns(struct ndpi_detection_module_struct *ndpi_str);
   u_int8_t is_a_common_alpn(struct ndpi_detection_module_struct *ndpi_str,
 			    const char *alpn_to_check, u_int alpn_to_check_len);    
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index d9dc9ec02..f85ff831d 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3066,6 +3066,12 @@ u_int16_t ndpi_guess_protocol_id(struct ndpi_detection_module_struct *ndpi_str,
 	    if (NDPI_ENTROPY_ENCRYPTED_OR_RANDOM(flow->entropy) != 0) {
 	      ndpi_set_risk(ndpi_str, flow, NDPI_SUSPICIOUS_ENTROPY);
 	    }
+
+	    struct ndpi_icmphdr * const icmphdr = (struct ndpi_icmphdr *)packet->payload;
+	    u_int16_t chksm = ndpi_calculate_icmp4_checksum(packet->payload, packet->payload_packet_len);
+	    if (icmphdr->checksum != chksm) {
+	      ndpi_set_risk(ndpi_str, flow, NDPI_MALFORMED_PACKET);
+	    }
 	  }
 	}
       }
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index 675c5dfcc..313448c51 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -2299,6 +2299,33 @@ float ndpi_entropy(u_int8_t const * const buf, size_t len) {
   return entropy;
 }
 
+/* ******************************************************************** */
+
+u_int16_t ndpi_calculate_icmp4_checksum(u_int8_t const * const buf, size_t len) {
+  u_int16_t const * sbuf = (u_int16_t *)buf;
+  u_int32_t checksum = 0;
+
+  /*
+   * The first two bytes of the icmp header are required.
+   * The next two bytes is the checksum, which we want to ignore.
+   */
+  checksum += *sbuf++; len -= 2; /* icmp->type, icmp->code */
+  sbuf++; len -= 2; /* icmp->checksum */
+
+  for (; len > 1; len -= 2) {
+    checksum += *sbuf++;
+  }
+
+  if (len == 1) {
+    checksum += *(u_int8_t *)sbuf;
+  }
+
+  checksum = (checksum >> 16) + (checksum & 0xFFFF);
+  checksum += (checksum >> 16);
+
+  return ~checksum;
+}
+
 /* ******************************************* */
 
 char* ndpi_get_flow_name(struct ndpi_flow_struct *flow) {