[lwip-devel] TCP Timestamp Option Incorrectly Parsed on Big-Endian Systems Due to Byte Assembly Order

[Tsachi Kimeldorfer]

In the current lwIP implementation, the TCP Timestamp option (TSval) is parsed by sequentially reading 4 bytes using tcp_getoptbyte() and combining them with shifts.
However, the assembly of these bytes assumes little-endian order, which causes incorrect results on big-endian systems (such as MIPS), where lwip_ntohl() is defined as a no-op.

This results in pcb->ts_recent containing an incorrectly parsed value, which is then echoed back in TSecr, violating the TCP Timestamp Echo Reply behavior defined in RFC 7323.

---

Affected Code from tcp_in.c function tcp_parseopt():

tsval = tcp_getoptbyte();
tsval |= (tcp_getoptbyte() << 8);
tsval |= (tcp_getoptbyte() << 16);
tsval |= (tcp_getoptbyte() << 24);
tsval = lwip_ntohl(tsval); // NO-OP on big-endian

This code assembles the TSval in little-endian byte order, but since the value is received in network byte order (big-endian), the lwip_ntohl() macro must correct it. 

However, on big-endian systems lwip_ntohl(x) is defined as (x), resulting in no correction, and thus a corrupted value.