[lwip-users] Some TCP transitions

[Zschocke, Florian]

Hi all!

I was in the process of adding SNMP support to the tcp part when I tumbled
over a few TCP transitions which I feel need some clarification.

1.) LISTEN -> SYN_SENT
It is a legal operation to set a socket to the listen state and then call
connect on it to send data. Even though it is legal, TCP implementations
don't always support it. The current lwIP implementation doesn't check
whether tcp_connect() gets called on a PCB in LISTEN state. This means that
calling tcp_connect() on a listening PCB will access non-existant members in
the PCB and thus lead to memory corruption. IMHO lwIP tcp_connect() should
check whether the PCB to connect is in the LISTEN state and should either
deny it returning an error, or it should reallocate the PCB to get a proper
active PCB.

2.) SYN_SENT -> SYN_RCVD
A PCB in SYN_SENT state can receive an SYN which would transfer it into
SYN_RCVD state, the so called "simultaneous open". The rule is that from a
simultaneous open only one connection should result, not two. lwIP ignores a
SYN when it is in state SYN_SENT. If the peer has a compliant TCP
implementation (i.e. not lwIP) a connection would still be established since
the peer would go into the SNY_RCVD state upon reveicing the SYN and send a
SYN|ACK. I think if on both ends you have lwIP clients then the connection
attempt would eventually timeout since they do ignore each others first SYN.

3.) SYN_RCVD -> LISTEN
If a listening PCB receives a SYN, it sends a SYN,ACK and goes into state
SYN_RCVD. If this PCB then receives a RST from the peer it will return to
thr LISTEN state and wait for the next connection attempt. lwIP ignores a
RST in state SYN_RCVD. This is probably not much of a problem since the PCB
in state SYN_RCVD is already queued as an active socket and the listeing
socket is ready to listen for the next connection. The PCB in SYN_RCVD will
eventually time out. It could, though, be closed earlier.

4.) Calling tcp_listen() on a PCB not in CLOSED
tcp_listen() should only ever be called on a "new" PCB, i.e. on a PCB not in
any other state valid state (but in the pseudo state CLOSED). Agreed, doing
so is a programming error but I still think tcp_listen() should check for
this and return NULL if the state of the PCB passed is not CLOSED. (And PCBs
need to be set to CLOSED in tcp_alloc()).

I'd be interested in your comments.

Florian.