Merge branch 'master' of git.sv.gnu.org:/srv/git/lwip

src/api/api_lib.c

@@ -329,7 +329,7 @@ netconn_accept(struct netconn *conn, struct netconn **new_conn)
   /* Let the stack know that we have accepted the connection. */
   msg.msg.conn = conn;
   /* don't care for the return value of do_recv */
-  TCPIP_APIMSG(&msg, do_recv, err);
+  TCPIP_APIMSG_NOERR(&msg, do_recv);
 #endif /* TCP_LISTEN_BACKLOG */
 
   *new_conn = newconn;
@@ -400,7 +400,7 @@ netconn_recv_data(struct netconn *conn, void **new_buf)
         msg.msg.msg.r.len = 1;
       }
       /* don't care for the return value of do_recv */
-      TCPIP_APIMSG(&msg, do_recv, err);
+      TCPIP_APIMSG_NOERR(&msg, do_recv);
     }
 
     /* If we are closed, we indicate that we no longer wish to use the socket */
@@ -532,14 +532,13 @@ netconn_recved(struct netconn *conn, u32_t length)
   if ((conn != NULL) && (NETCONNTYPE_GROUP(conn->type) == NETCONN_TCP) &&
       (netconn_get_noautorecved(conn))) {
     struct api_msg msg;
-    err_t err;
     /* Let the stack know that we have taken the data. */
     /* TODO: Speedup: Don't block and wait for the answer here
        (to prevent multiple thread-switches). */
     msg.msg.conn = conn;
     msg.msg.msg.r.len = length;
     /* don't care for the return value of do_recv */
-    TCPIP_APIMSG(&msg, do_recv, err);
+    TCPIP_APIMSG_NOERR(&msg, do_recv);
   }
 #else /* LWIP_TCP */
   LWIP_UNUSED_ARG(conn);

src/core/ipv6/ip6.c

@@ -395,6 +395,9 @@ ip6_input(struct pbuf *p, struct netif *inp)
   /* current header pointer. */
   ip_data.current_ip6_header = ip6hdr;
 
+  /* In netif, used in case we need to send ICMPv6 packets back. */
+  ip_data.current_netif = inp;
+
   /* match packet against an interface, i.e. is this packet for us? */
   if (ip6_addr_ismulticast(ip6_current_dest_addr())) {
     /* Always joined to multicast if-local and link-local all-nodes group. */
@@ -477,7 +480,7 @@ netif_found:
   }
 
   /* current netif pointer. */
-  ip_data.current_netif = inp;
+  ip_data.current_netif = netif;
 
   /* Save next header type. */
   nexth = IP6H_NEXTH(ip6hdr);
@@ -498,7 +501,7 @@ netif_found:
       nexth = *((u8_t *)p->payload);
 
       /* Get the header length. */
-      hlen = 8 * (1 + *((u8_t *)p->payload) + 1);
+      hlen = 8 * (1 + *((u8_t *)p->payload + 1));
       ip_data.current_ip_header_tot_len += hlen;
 
       /* Skip over this header. */
@@ -521,7 +524,7 @@ netif_found:
       nexth = *((u8_t *)p->payload);
 
       /* Get the header length. */
-      hlen = 8 * (1 + *((u8_t *)p->payload) + 1);
+      hlen = 8 * (1 + *((u8_t *)p->payload + 1));
       ip_data.current_ip_header_tot_len += hlen;
 
       /* Skip over this header. */
@@ -544,7 +547,7 @@ netif_found:
       nexth = *((u8_t *)p->payload);
 
       /* Get the header length. */
-      hlen = 8 * (1 + *((u8_t *)p->payload) + 1);
+      hlen = 8 * (1 + *((u8_t *)p->payload + 1));
       ip_data.current_ip_header_tot_len += hlen;
 
       /* Skip over this header. */
@@ -824,12 +827,24 @@ ip6_output(struct pbuf *p, ip6_addr_t *src, ip6_addr_t *dest,
           u8_t hl, u8_t tc, u8_t nexth)
 {
   struct netif *netif;
+  struct ip6_hdr *ip6hdr;
+  ip6_addr_t src_addr, dest_addr;
 
   /* pbufs passed to IPv6 must have a ref-count of 1 as their payload pointer
      gets altered as the packet is passed down the stack */
   LWIP_ASSERT("p->ref == 1", p->ref == 1);
 
-  if ((netif = ip6_route(src, dest)) == NULL) {
+  if (dest != IP_HDRINCL) {
+    netif = ip6_route(src, dest);
+  } else {
+    /* IP header included in p, read addresses. */
+    ip6hdr = (struct ip6_hdr *)p->payload;
+    ip6_addr_copy(src_addr, ip6hdr->src);
+    ip6_addr_copy(dest_addr, ip6hdr->dest);
+    netif = ip6_route(&src_addr, &dest_addr);
+  }
+
+  if (netif == NULL) {
     LWIP_DEBUGF(IP6_DEBUG, ("ip6_output: no route for %"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F"\n",
         IP6_ADDR_BLOCK1(dest),
         IP6_ADDR_BLOCK2(dest),
@@ -872,13 +887,25 @@ ip6_output_hinted(struct pbuf *p, ip6_addr_t *src, ip6_addr_t *dest,
           u8_t hl, u8_t tc, u8_t nexth, u8_t *addr_hint)
 {
   struct netif *netif;
+  struct ip6_hdr *ip6hdr;
+  ip6_addr_t src_addr, dest_addr;
   err_t err;
 
   /* pbufs passed to IP must have a ref-count of 1 as their payload pointer
      gets altered as the packet is passed down the stack */
   LWIP_ASSERT("p->ref == 1", p->ref == 1);
 
-  if ((netif = ip6_route(src, dest)) == NULL) {
+  if (dest != IP_HDRINCL) {
+    netif = ip6_route(src, dest);
+  } else {
+    /* IP header included in p, read addresses. */
+    ip6hdr = (struct ip6_hdr *)p->payload;
+    ip6_addr_copy(src_addr, ip6hdr->src);
+    ip6_addr_copy(dest_addr, ip6hdr->dest);
+    netif = ip6_route(&src_addr, &dest_addr);
+  }
+
+  if (netif == NULL) {
     LWIP_DEBUGF(IP6_DEBUG, ("ip6_output: no route for %"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F":%"X16_F"\n",
         IP6_ADDR_BLOCK1(dest),
         IP6_ADDR_BLOCK2(dest),

src/core/ipv6/ip6_frag.c

@@ -149,8 +149,12 @@ ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
     p = ipr->p;
     ipr->p = iprh->next_pbuf;
     /* Then, move back to the original header (we are now pointing to Fragment header). */
-    pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr);
-    icmp6_time_exceeded(p, ICMP6_TE_FRAG);
+    if (pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr)) {
+      LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
+    }
+    else {
+      icmp6_time_exceeded(p, ICMP6_TE_FRAG);
+    }
     clen = pbuf_clen(p);
     LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
     pbufs_freed += clen;
@@ -439,7 +443,7 @@ ip6_reass(struct pbuf *p)
   /* Final validity test: no gaps between current and last fragment. */
   iprh_prev = iprh;
   q = iprh->next_pbuf;
-  while (q != NULL) {
+  while ((q != NULL) && valid) {
     iprh = (struct ip6_reass_helper*)q->payload;
     if (iprh_prev->end != iprh->start) {
       valid = 0;
@@ -490,9 +494,6 @@ ip6_reass(struct pbuf *p)
     frag_hdr->_fragment_offset = 0;
     frag_hdr->_identification = 0;
 
-    /* Move pbuf back to IPv6 header. */
-    pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr);
-
     /* release the sources allocate for the fragment queue entry */
     if (reassdatagrams == ipr) {
       /* it was the first in the list */
@@ -504,9 +505,16 @@ ip6_reass(struct pbuf *p)
     }
     memp_free(MEMP_IP6_REASSDATA, ipr);
 
-    /* and adjust the number of pbufs currently queued for reassembly. */
+    /* adjust the number of pbufs currently queued for reassembly. */
     ip6_reass_pbufcount -= pbuf_clen(p);
 
+    /* Move pbuf back to IPv6 header. */
+    if (pbuf_header(p, (u8_t*)p->payload - (u8_t*)ipr->iphdr)) {
+      LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
+      pbuf_free(p);
+      return NULL;
+    }
+
     /* Return the pbuf chain */
     return p;
   }

src/core/ipv6/nd6.c

@@ -375,9 +375,7 @@ nd6_input(struct pbuf *p, struct netif *inp)
 
     /* If we are sending RS messages, stop. */
 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
-    if (inp->rs_count > 0) {
-      inp->rs_count = 0;
-    }
+    inp->rs_count = 0;
 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
 
     /* Get the matching default router entry. */
@@ -885,7 +883,7 @@ nd6_send_na(struct netif * netif, ip6_addr_t * target_addr, u8_t flags)
 
   /* Set fields. */
   na_hdr = (struct na_header *)p->payload;
-  lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct ns_header));
+  lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
 
   na_hdr->type = ICMP6_TYPE_NA;
   na_hdr->code = 0;
@@ -1133,6 +1131,10 @@ nd6_new_neighbor_cache_entry(void)
 static void
 nd6_free_neighbor_cache_entry(s8_t i)
 {
+  if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
+    return;
+  }
+
 #if LWIP_ND6_QUEUEING
   /* Free any queued packets. */
   if (neighbor_cache[i].q != NULL) {
@@ -1463,14 +1465,14 @@ nd6_get_next_hop_entry(ip6_addr_t * ip6addr, struct netif * netif)
       }
 
       /* Copy dest address to destination cache. */
-      ip6_addr_set(&(destination_cache[i].destination_addr), ip6addr);
+      ip6_addr_set(&(destination_cache[nd6_cached_destination_index].destination_addr), ip6addr);
 
       /* Now find the next hop. is it a neighbor? */
       if (ip6_addr_islinklocal(ip6addr) ||
           nd6_is_prefix_in_netif(ip6addr, netif)) {
         /* Destination in local link. */
-        destination_cache[i].pmtu = netif->mtu;
-        ip6_addr_copy(destination_cache[i].next_hop_addr, destination_cache[nd6_cached_destination_index].destination_addr);
+        destination_cache[nd6_cached_destination_index].pmtu = netif->mtu;
+        ip6_addr_copy(destination_cache[nd6_cached_destination_index].next_hop_addr, destination_cache[nd6_cached_destination_index].destination_addr);
       }
       else {
         /* We need to select a router. */
@@ -1549,6 +1551,10 @@ nd6_queue_packet(s8_t neighbor_index, struct pbuf * q)
   int copy_needed = 0;
   struct nd6_q_entry *new_entry, *r;
 
+  if ((neighbor_index < 0) || (neighbor_index >= LWIP_ND6_NUM_NEIGHBORS)) {
+    return ERR_ARG;
+  }
+
   /* IF q includes a PBUF_REF, PBUF_POOL or PBUF_RAM, we have no choice but
    * to copy the whole queue into a new PBUF_RAM (see bug #11400)
    * PBUF_ROMs can be left as they are, since ROM must not get changed. */
@@ -1656,6 +1662,10 @@ nd6_send_q(s8_t i)
   struct ip6_hdr *ip6hdr;
   struct nd6_q_entry *q;
 
+  if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
+    return;
+  }
+
   while (neighbor_cache[i].q != NULL) {
     /* remember first in queue */
     q = neighbor_cache[i].q;

src/core/stats.c

@@ -99,8 +99,8 @@ stats_display_igmp(struct stats_igmp *igmp, const char *name)
   LWIP_PLATFORM_DIAG(("memerr: %"STAT_COUNTER_F"\n\t", igmp->memerr)); 
   LWIP_PLATFORM_DIAG(("proterr: %"STAT_COUNTER_F"\n\t", igmp->proterr)); 
   LWIP_PLATFORM_DIAG(("rx_v1: %"STAT_COUNTER_F"\n\t", igmp->rx_v1)); 
-  LWIP_PLATFORM_DIAG(("rx_group: %"STAT_COUNTER_F"\n", igmp->rx_group));
-  LWIP_PLATFORM_DIAG(("rx_general: %"STAT_COUNTER_F"\n", igmp->rx_general));
+  LWIP_PLATFORM_DIAG(("rx_group: %"STAT_COUNTER_F"\n\t", igmp->rx_group));
+  LWIP_PLATFORM_DIAG(("rx_general: %"STAT_COUNTER_F"\n\t", igmp->rx_general));
   LWIP_PLATFORM_DIAG(("rx_report: %"STAT_COUNTER_F"\n\t", igmp->rx_report)); 
   LWIP_PLATFORM_DIAG(("tx_join: %"STAT_COUNTER_F"\n\t", igmp->tx_join)); 
   LWIP_PLATFORM_DIAG(("tx_leave: %"STAT_COUNTER_F"\n\t", igmp->tx_leave)); 

src/include/lwip/tcpip.h

@@ -64,11 +64,14 @@ extern sys_mutex_t lock_tcpip_core;
 #else
 #define TCIP_APIMSG_SET_ERR(m, e)
 #endif
-#define TCPIP_APIMSG(m,f,e)   do { \
+#define TCPIP_APIMSG_NOERR(m,f) do { \
   TCIP_APIMSG_SET_ERR(m, ERR_VAL); \
   LOCK_TCPIP_CORE(); \
   f(&((m)->msg)); \
   UNLOCK_TCPIP_CORE(); \
+} while(0)
+#define TCPIP_APIMSG(m,f,e)   do { \
+  TCPIP_APIMSG_NOERR(m,f); \
   (e) = (m)->msg.err; \
 } while(0)
 #define TCPIP_APIMSG_ACK(m)
@@ -77,6 +80,7 @@ extern sys_mutex_t lock_tcpip_core;
 #else /* LWIP_TCPIP_CORE_LOCKING */
 #define LOCK_TCPIP_CORE()
 #define UNLOCK_TCPIP_CORE()
+#define TCPIP_APIMSG_NOERR(m,f) do { (m)->function = f; tcpip_apimsg(m); } while(0)
 #define TCPIP_APIMSG(m,f,e)   do { (m)->function = f; (e) = tcpip_apimsg(m); } while(0)
 #define TCPIP_APIMSG_ACK(m)   sys_sem_signal(&m->conn->op_completed)
 #define TCPIP_NETIFAPI(m)     tcpip_netifapi(m)