From d3e77287afcd7fb8c30ca9ee95296300b13b6889 Mon Sep 17 00:00:00 2001 From: jinag12 Date: Mon, 6 Sep 2021 14:09:15 +0800 Subject: [PATCH] add some patches from community (cherry picked from commit 1123dd998feb7304761cb7be8bd9c9e28f67b787) --- ...cted-expiry-of-pending-ARP-table-ent.patch | 33 +++++++++++ ...-double-free-in-tcp_split_unsent_seg.patch | 24 ++++++++ ...t-tcp-fix-sequence-number-comparison.patch | 36 ++++++++++++ ...p-tighten-up-checks-for-received-SYN.patch | 58 +++++++++++++++++++ lwip.spec | 13 ++++- 5 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 backport-bug-54700-Unexpected-expiry-of-pending-ARP-table-ent.patch create mode 100644 backport-tcp-Fix-double-free-in-tcp_split_unsent_seg.patch create mode 100644 backport-tcp-fix-sequence-number-comparison.patch create mode 100644 backport-tcp-tighten-up-checks-for-received-SYN.patch diff --git a/backport-bug-54700-Unexpected-expiry-of-pending-ARP-table-ent.patch b/backport-bug-54700-Unexpected-expiry-of-pending-ARP-table-ent.patch new file mode 100644 index 0000000..156bef4 --- /dev/null +++ b/backport-bug-54700-Unexpected-expiry-of-pending-ARP-table-ent.patch @@ -0,0 +1,33 @@ +From ffbe075d5623c44bbf37618cce78d09ccd4e6760 Mon Sep 17 00:00:00 2001 +From: Florent Matignon +Date: Thu, 20 Sep 2018 16:40:34 +0200 +Subject: [PATCH] bug #54700: Unexpected expiry of pending ARP table entry +New etharp queries should restart the 5 second timeout on the ARP +table entry if it is still pending. +Signed-off-by: Simon Goldschmidt +Conflict: NA +Reference: https://git.savannah.gnu.org/cgit/lwip.git/commit/?id=ffbe075d5623c44bbf37618cce78d09ccd4e6760 +--- + src/core/ipv4/etharp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) +diff --git a/src/core/ipv4/etharp.c b/src/core/ipv4/etharp.c +index b3b7c73c..9d7bf299 100644 +--- a/src/core/ipv4/etharp.c ++++ b/src/core/ipv4/etharp.c +@@ -984,6 +984,14 @@ etharp_query(struct netif *netif, const ip4_addr_t *ipaddr, struct pbuf *q) + /* We don't re-send arp request in etharp_tmr, but we still queue packets, + since this failure could be temporary, and the next packet calling + etharp_query again could lead to sending the queued packets. */ ++ } else { ++ /* ARP request successfully sent */ ++ if ((arp_table[i].state == ETHARP_STATE_PENDING) && !is_new_entry) { ++ /* A new ARP request has been sent for a pending entry. Reset the ctime to ++ not let it expire too fast. */ ++ LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE, ("etharp_query: reset ctime for entry %"S16_F"\n", (s16_t)i)); ++ arp_table[i].ctime = 0; ++ } + } + if (q == NULL) { + return result; +-- +2.28.0.windows.1 diff --git a/backport-tcp-Fix-double-free-in-tcp_split_unsent_seg.patch b/backport-tcp-Fix-double-free-in-tcp_split_unsent_seg.patch new file mode 100644 index 0000000..05addfe --- /dev/null +++ b/backport-tcp-Fix-double-free-in-tcp_split_unsent_seg.patch @@ -0,0 +1,24 @@ +From e80d4ff2cc5f8f864e9e996c72b47ebefd2a5175 Mon Sep 17 00:00:00 2001 +From: Erik Ekman +Date: Fri, 19 Jun 2020 15:00:25 +0200 +Subject: [PATCH] tcp: Fix double free in tcp_split_unsent_seg() +Fixes bug #57377 (found by Hiromasa Ito). +Conflict: NA +Reference: https://git.savannah.gnu.org/cgit/lwip.git/commit/?id=e80d4ff2cc5f8f864e9e996c72b47ebefd2a5175 +--- + src/core/tcp_out.c | 1 + + 1 file changed, 1 insertion(+) +diff --git a/src/core/tcp_out.c b/src/core/tcp_out.c +index bfb033b1..d9d1b57b 100644 +--- a/src/core/tcp_out.c ++++ b/src/core/tcp_out.c +@@ -913,6 +913,7 @@ tcp_split_unsent_seg(struct tcp_pcb *pcb, u16_t split) + + seg = tcp_create_segment(pcb, p, remainder_flags, lwip_ntohl(useg->tcphdr->seqno) + split, optflags); + if (seg == NULL) { ++ p = NULL; /* Freed by tcp_create_segment */ + LWIP_DEBUGF(TCP_OUTPUT_DEBUG | LWIP_DBG_LEVEL_SERIOUS, + ("tcp_split_unsent_seg: could not create new TCP segment\n")); + goto memerr; +-- +2.28.0.windows.1 diff --git a/backport-tcp-fix-sequence-number-comparison.patch b/backport-tcp-fix-sequence-number-comparison.patch new file mode 100644 index 0000000..5c0f960 --- /dev/null +++ b/backport-tcp-fix-sequence-number-comparison.patch @@ -0,0 +1,36 @@ +From 003d34eebd223c16a3dbf6a970bb6e23cb7d1a24 Mon Sep 17 00:00:00 2001 +From: Simon Goldschmidt +Date: Fri, 27 Mar 2020 22:59:05 +0100 +Subject: [PATCH] tcp: fix sequence number comparison +This fixes both undefined behavior (see bug #51447) as well as a possible bug +where sequence numbers in 31 bit distance may come through. +Conflict: NA +Reference: https://git.savannah.gnu.org/cgit/lwip.git/commit/?id=003d34eebd223c16a3dbf6a970bb6e23cb7d1a24 +--- + src/include/lwip/priv/tcp_priv.h | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) +diff --git a/src/include/lwip/priv/tcp_priv.h b/src/include/lwip/priv/tcp_priv.h +index 72f9126d..c84b5be8 100644 +--- a/src/include/lwip/priv/tcp_priv.h ++++ b/src/include/lwip/priv/tcp_priv.h +@@ -106,14 +106,11 @@ err_t tcp_process_refused_data(struct tcp_pcb *pcb); + #define tcp_output_nagle(tpcb) (tcp_do_output_nagle(tpcb) ? tcp_output(tpcb) : ERR_OK) + + +-#define TCP_SEQ_LT(a,b) ((s32_t)((u32_t)(a) - (u32_t)(b)) < 0) +-#define TCP_SEQ_LEQ(a,b) ((s32_t)((u32_t)(a) - (u32_t)(b)) <= 0) +-#define TCP_SEQ_GT(a,b) ((s32_t)((u32_t)(a) - (u32_t)(b)) > 0) +-#define TCP_SEQ_GEQ(a,b) ((s32_t)((u32_t)(a) - (u32_t)(b)) >= 0) ++#define TCP_SEQ_LT(a,b) (((u32_t)((u32_t)(a) - (u32_t)(b)) & 0x80000000u) != 0) ++#define TCP_SEQ_LEQ(a,b) (!(TCP_SEQ_LT(b,a))) ++#define TCP_SEQ_GT(a,b) TCP_SEQ_LT(b,a) ++#define TCP_SEQ_GEQ(a,b) TCP_SEQ_LEQ(b,a) + /* is b<=a<=c? */ +-#if 0 /* see bug #10548 */ +-#define TCP_SEQ_BETWEEN(a,b,c) ((c)-(b) >= (a)-(b)) +-#endif + #define TCP_SEQ_BETWEEN(a,b,c) (TCP_SEQ_GEQ(a,b) && TCP_SEQ_LEQ(a,c)) + + #ifndef TCP_TMR_INTERVAL +-- +2.28.0.windows.1 diff --git a/backport-tcp-tighten-up-checks-for-received-SYN.patch b/backport-tcp-tighten-up-checks-for-received-SYN.patch new file mode 100644 index 0000000..0892cbf --- /dev/null +++ b/backport-tcp-tighten-up-checks-for-received-SYN.patch @@ -0,0 +1,58 @@ +From adbc5b5f716d108966bcf606e61de60b83f525a5 Mon Sep 17 00:00:00 2001 +From: Simon Goldschmidt +Date: Thu, 5 Mar 2020 21:20:35 +0100 +Subject: [PATCH] tcp: tighten up checks for received SYN +Any malicous segment could contain a SYN up to now (no check). +A SYN in the wrong segment could break OOSEQ queueing. +Fix this by allowing SYN only in states where it is required. +See bug #56397: Assert "tcp_receive: ooseq tcplen > rcv_wnd" +Signed-off-by: Simon Goldschmidt +Conflict: NA +Reference: https://git.savannah.gnu.org/cgit/lwip.git/commit/?id=adbc5b5f716d108966bcf606e61de60b83f525a5 +--- + src/core/tcp_in.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) +diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c +index 4bfba85f..90061281 100644 +--- a/src/core/tcp_in.c ++++ b/src/core/tcp_in.c +@@ -852,6 +852,13 @@ tcp_process(struct tcp_pcb *pcb) + + tcp_parseopt(pcb); + ++ if (flags & TCP_SYN) { ++ /* accept SYN only in 2 states: */ ++ if ((pcb->state != SYN_SENT) && (pcb->state != SYN_RCVD)) { ++ return ERR_OK; ++ } ++ } ++ + /* Do different things depending on the TCP state. */ + switch (pcb->state) { + case SYN_SENT: +@@ -924,7 +931,12 @@ tcp_process(struct tcp_pcb *pcb) + } + break; + case SYN_RCVD: +- if (flags & TCP_ACK) { ++ if (flags & TCP_SYN) { ++ if (seqno == pcb->rcv_nxt - 1) { ++ /* Looks like another copy of the SYN - retransmit our SYN-ACK */ ++ tcp_rexmit(pcb); ++ } ++ } else if (flags & TCP_ACK) { + /* expected ACK number? */ + if (TCP_SEQ_BETWEEN(ackno, pcb->lastack + 1, pcb->snd_nxt)) { + pcb->state = ESTABLISHED; +@@ -975,9 +987,6 @@ tcp_process(struct tcp_pcb *pcb) + tcp_rst(pcb, ackno, seqno + tcplen, ip_current_dest_addr(), + ip_current_src_addr(), tcphdr->dest, tcphdr->src); + } +- } else if ((flags & TCP_SYN) && (seqno == pcb->rcv_nxt - 1)) { +- /* Looks like another copy of the SYN - retransmit our SYN-ACK */ +- tcp_rexmit(pcb); + } + break; + case CLOSE_WAIT: +-- +2.28.0.windows.1 diff --git a/lwip.spec b/lwip.spec index 3904f22..2f40286 100644 --- a/lwip.spec +++ b/lwip.spec @@ -4,12 +4,16 @@ Summary: lwip is a small independent implementation of the TCP/IP protocol suite Name: lwip Version: 2.1.2 -Release: 1 +Release: 2 License: BSD URL: http://savannah.nongnu.org/projects/lwip/ Source0: http://download.savannah.nongnu.org/releases/lwip/%{name}-%{version}.zip Patch0: 0001-add-makefile.patch +Patch1: backport-bug-54700-Unexpected-expiry-of-pending-ARP-table-ent.patch +Patch2: backport-tcp-Fix-double-free-in-tcp_split_unsent_seg.patch +Patch3: backport-tcp-fix-sequence-number-comparison.patch +Patch4: backport-tcp-tighten-up-checks-for-received-SYN.patch BuildRequires: gcc-c++ dos2unix @@ -25,6 +29,10 @@ lwip is a small independent implementation of the TCP/IP protocol suite. find %{_builddir}/%{name}-%{version} -type f -exec dos2unix -q {} \; %patch0 -p1 +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 %build cd %{_builddir}/%{name}-%{version}/src @@ -40,6 +48,9 @@ cd %{_builddir}/%{name}-%{version}/src %{_libdir}/liblwip.a %changelog +* Mon Sep 06 2020 jiangheng - 2.1.2-2 +- backport some patches from community + * Mon Nov 30 2020 peanut_huang - 2.1.2-1 - remove README -- Gitee