[lwip-devel] TCP window processing bug

[Karl Jeacle]

Hi all,

I think there is a small bug in lwIP's TCP window processing. 

I have a simple file transfer application where host A sends data
continuously to host B. No data travels from B back to A. While
lwIP on A processes incoming ACKs, it ignores the window updates
in the ACKs. This is because the incoming segments contain no data
(they are just ACKs) and the initial value of snd_wl1 is incorrect.

In tcp_process() at line 558 (of tcp_in.c), the state machine SYNACK
handling code reads:

        pcb->snd_wnd = pcb->snd_wl1 = tcphdr->wnd;

But snd_wl1 should be the last seqno received, not the peer's
advertised window. snd_wl1 should not be initialised like this.
Only snd_wnd's value should be set here. The code should read:

        pcb->snd_wnd = tcphdr->wnd;

This change allows the ACK window processing code in tcp_receive()
(tcp_in.c lines 693-698) to correctly update snd_wl1 regardless of
whether or not incoming segments contain data.

As for the initial value of snd_wl1, I think previous versions of
lwIP didn't initialize snd_wl1 at all, so it defaulted to zero, and
everything just worked.  Currently tcp_listen_input() line 454 inits
it to seqno, but perhaps both line 454 and the tcp_process() SYNACK
handling code above should set the initial value to "seqno - 1",
as described in TCP/IP Illustrated Vol.2 (pages 951, 969 and 981).

Comments welcome.

Thanks,
Karl