[lwip-devel] [bug #51789] TCP_EVENT_CLOSE, tcp_close() and possible use of pcb with tcp_output()

[Art Heers]

Follow-up Comment #4, bug #51789 (project lwip):

  > OK, if you tell me where a pcb in SYN_SENT accepts a FIN,...

A pcb is put into the tcp_sctive_pcbs list as it enters the SYN_SENT state. 
Further inside function tcp_input() a pcb in this list is found and if the
incoming packet received flag has  TF_GOT_FIN set TCP_EVENT_CLOSED is called. 
I cannot see any condition that if the pcb is in the SYN_SENT state that would
prohibit this call back to be called at this spot within tcp_input(), given
that the pcb was found in the tcp_active_pcbs list.

Admittedly it is hard to see how the remote would send a FIN when the connect
process between the two sides had not completed the 3 way connect handshake,
but minimally it is likely there is an ill designed stack out there that could
send the FIN before receiving the ACK to its ACK to the SYN.  Perhaps
minimally, inside tcp_input(), after calling TCP_EVENT_CLOSED, along with
jumping to aborted if the call back returns ERR_ABRT it could also jump to
aborted only if the pcb was in an OK state before the TCP)EVENT_CLOSED is
called, assuming that it called tcp_close() that might have released the pcb. 
 

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?51789>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/