Skip to content

Fix TCP low-watermark receive-window underflow and header corruption #435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Sawii00 wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Fix TCP low-watermark receive-window underflow and header corruption #435

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions common/src/nx_tcp_packet_send_control.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* AI Disclosure: Receive-window changes developed with AI assistance.
* Assisted-by: OpenAI Codex
* SPDX-License-Identifier: MIT
**************************************************************************/

Expand Down Expand Up @@ -123,13 +125,16 @@ ULONG window_size;
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */
}

#ifdef NX_ENABLE_TCP_WINDOW_SCALING
/* Make sure the window_size is less than 0xFFFF. */
if (window_size > 0xFFFF)
/* The window is ORed into the header word unmasked. A wrapped (negative)
window advertises zero instead of overwriting the data offset and flags. */
if ((INT)socket_ptr -> nx_tcp_socket_rx_window_current < 0)
{
window_size = 0;
}
else if (window_size > 0xFFFF)
{
window_size = 0xFFFF;
}
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */

#ifdef NX_IPSEC_ENABLE
/* Get data offset from socket directly. */
Expand Down
17 changes: 12 additions & 5 deletions common/src/nx_tcp_socket_retransmit.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* AI Disclosure: Receive-window changes developed with AI assistance.
* Assisted-by: OpenAI Codex
* SPDX-License-Identifier: MIT
**************************************************************************/

Expand Down Expand Up @@ -270,15 +272,20 @@ ULONG window_size;
/* Set window size. */
#ifdef NX_ENABLE_TCP_WINDOW_SCALING
window_size = socket_ptr -> nx_tcp_socket_rx_window_current >> socket_ptr -> nx_tcp_rcv_win_scale_value;
#else
window_size = socket_ptr -> nx_tcp_socket_rx_window_current;
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */

/* Make sure the window_size is less than 0xFFFF. */
if (window_size > 0xFFFF)
/* The window is ORed into the header word unmasked. A wrapped (negative)
window advertises zero instead of overwriting the data offset and flags. */
if ((INT)socket_ptr -> nx_tcp_socket_rx_window_current < 0)
{
window_size = 0;
}
else if (window_size > 0xFFFF)
{
window_size = 0xFFFF;
}
#else
window_size = socket_ptr -> nx_tcp_socket_rx_window_current;
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */

header_ptr -> nx_tcp_header_word_3 = NX_TCP_HEADER_SIZE | NX_TCP_ACK_BIT | NX_TCP_PSH_BIT | window_size;

Expand Down
17 changes: 12 additions & 5 deletions common/src/nx_tcp_socket_send_internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* AI Disclosure: Receive-window changes developed with AI assistance.
* Assisted-by: OpenAI Codex
* SPDX-License-Identifier: MIT
**************************************************************************/

Expand Down Expand Up @@ -715,15 +717,20 @@ UINT compute_checksum = 1;
/* Set window size. */
#ifdef NX_ENABLE_TCP_WINDOW_SCALING
window_size = socket_ptr -> nx_tcp_socket_rx_window_current >> socket_ptr -> nx_tcp_rcv_win_scale_value;
#else
window_size = socket_ptr -> nx_tcp_socket_rx_window_current;
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */

/* Make sure the window_size is less than 0xFFFF. */
if (window_size > 0xFFFF)
/* The window is ORed into the header word unmasked. A wrapped (negative)
window advertises zero instead of overwriting the data offset and flags. */
if ((INT)socket_ptr -> nx_tcp_socket_rx_window_current < 0)
{
window_size = 0;
}
else if (window_size > 0xFFFF)
{
window_size = 0xFFFF;
}
#else
window_size = socket_ptr -> nx_tcp_socket_rx_window_current;
#endif /* NX_ENABLE_TCP_WINDOW_SCALING */

header_ptr -> nx_tcp_header_word_3 = NX_TCP_HEADER_SIZE | NX_TCP_ACK_BIT | NX_TCP_PSH_BIT | window_size;
header_ptr -> nx_tcp_header_word_4 = 0;
Expand Down
20 changes: 19 additions & 1 deletion common/src/nx_tcp_socket_state_data_check.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* AI Disclosure: Receive-window changes developed with AI assistance.
* Assisted-by: OpenAI Codex
* SPDX-License-Identifier: MIT
**************************************************************************/
// Some portions generated by Codex (gpt-5.6-sol).
Expand Down Expand Up @@ -894,6 +896,16 @@ NX_IP *ip_ptr;
do
{

#ifdef NX_ENABLE_LOW_WATERMARK
/* The tail is released below, so it must never be acknowledged. The
packet count check at the end of this loop misses the tail when the
pool watermark triggered the drop or a superset packet shrank the queue. */
if (drop_packet && (search_ptr == socket_ptr -> nx_tcp_socket_receive_queue_tail))
{
break;
}
#endif /* NX_ENABLE_LOW_WATERMARK */

/* Setup a pointer to header of this packet in the sent list. */
/*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary */
search_header_ptr = (NX_TCP_HEADER *)search_ptr -> nx_packet_prepend_ptr;
Expand Down Expand Up @@ -1028,7 +1040,13 @@ NX_IP *ip_ptr;
#endif

/* Check if the rx sequence number has been updated. */
if (original_rx_sequence != socket_ptr -> nx_tcp_socket_rx_sequence)
if ((original_rx_sequence != socket_ptr -> nx_tcp_socket_rx_sequence)
#ifdef NX_ENABLE_LOW_WATERMARK
/* A drop already set the window from the advanced rx_sequence.
Subtracting the advance again would wrap the ULONG window. */
&& (drop_packet == NX_FALSE)
#endif /* NX_ENABLE_LOW_WATERMARK */
)
{

/* Decrease the receive window size since rx_sequence is updated. */
Expand Down
5 changes: 4 additions & 1 deletion test/cmake/netxduo/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,9 @@ set(HTTP_PROXY -DNX_ENABLE_HTTP_PROXY)
set(RAND_ID -DNX_ENABLE_IP_ID_RANDOMIZATION)
set(PPP_COMPRESSION -DNX_PPP_COMPRESSION_ENABLE)

set(v4_build ${IPV4} ${PACKET_DEBUG})
# Exercise low-watermark regressions without and with TCP window scaling.
# AI Disclosure: These low-watermark profile changes used OpenAI Codex assistance.
set(v4_build ${IPV4} ${PACKET_DEBUG} ${LOW_WATERMARK})
set(v4_dns_cache_build ${IPV4} ${DNS_CACHE})
set(v4_no_checksum_build ${IPV4} ${DISABLE_TX_CHECKSUM} ${DISABLE_RX_CHECKSUM})
set(v4_physical_48_build ${IPV4} ${PHY_HEADER} ${MDNS_NO_CLIENT} ${PPPOE} ${MULTI_INTERFACE})
Expand All @@ -207,6 +209,7 @@ set(v4_small_build
set(v4_packet_pad_build ${IPV4} ${PACKET_ALIGNMENT})
set(v4_full_build
${IPV4}
${LOW_WATERMARK}
${TCP_KEEPALIVE}
${TCP_WINDOW}
${IP_STATIC_ROUTING}
Expand Down
2 changes: 2 additions & 0 deletions test/cmake/netxduo/regression/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,6 +593,8 @@ set(netxduo_test_cases
${SOURCE_DIR}/netxduo_test/netx_ip_packet_filter_test.c
${SOURCE_DIR}/netxduo_test/netx_ip_packet_filter_extended_test.c
${SOURCE_DIR}/netxduo_test/netx_icmpv6_invalid_na.c
# AI Disclosure: Regression registration added with OpenAI Codex assistance.
${SOURCE_DIR}/netxduo_test/netx_tcp_low_watermark_rx_window_test.c
${SOURCE_DIR}/netxduo_test/netx_low_watermark_test.c
${SOURCE_DIR}/netxduo_test/netx_rarp_nxe_api_test.c
${SOURCE_DIR}/netxduo_test/netx_ip_interface_detachment_arp_table_test.c
Expand Down
Loading
Loading