[lwip-devel] [bug #27209] tcp_input discards frames even though they are within the announced window

[Kieran Mansley]

Follow-up Comment #8, bug #27209 (project lwip):

This suggests that either tcp_recved() is being called inappropriately, or
tcp_wnd is not being decremented correctly earlier in the process of receiving
a packet.

The theory is that when a packet is received, tcp_wnd is decremented by that
length, and then when the application has finished processing it, tcp_wnd is
incremented by the same length.  For tcp_wnd to become larger than TCP_WND in
tcp_recved() is therefore wrong, regardless of it causing an overflow or not.

Looking at the code where it is decremented, I see:
          if (pcb->rcv_wnd < TCP_TCPLEN(cseg)) {
            pcb->rcv_wnd = 0;
          } else {
            pcb->rcv_wnd -= TCP_TCPLEN(cseg);
          }

If we don't decrement it fully but set to zero, then when tcp_recved() is
later called it will be inflated by too much.  I'm not sure why we're trying
to deal with the case of rcv_wnd < tcp_len for a received frame, but this
could conceivably be the source of your problem.  Could you try removing the
code extract above and instead replace with something that does (untested):

LWIP_ASSERT(pcb->rcv_wnd >= TCP_TCPLEN(cseg), "received segment larger than
the window"); 
pcb->rcv_wnd -= TCP_TCPLEN(cseg);

There are couple of places where this change is necessary: look for wherever
rcv_wnd is decremented.

If you can get this tested soon there's a chance it could make it into 1.3.1.
 Thanks!

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?27209>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/