Increase app part size

tighten IP fragment behavior

mongoose.c

@@ -11540,12 +11540,16 @@ static void rx_ip(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   mkpay(pkt, (uint32_t *) pkt->ip + ihl);  // account for opts
   if (!ipcsum_ok(pkt->ip)) return;
   frag = mg_ntohs(pkt->ip->frag);
-  if (frag & IP_MORE_FRAGS_MSK || frag & IP_FRAG_OFFSET_MSK) {
+  if (frag & IP_FRAG_OFFSET_MSK) {  // Non-first fragment: ignore
-    struct mg_connection *c;
+  } else if (frag & IP_MORE_FRAGS_MSK) {  // First fragment: find and close
-    if (pkt->ip->proto == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
+    if (pkt->ip->proto == 17 && pkt->pay.len >= sizeof(*pkt->udp))
-    if (pkt->ip->proto == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
+      pkt->udp = (struct udp *) pkt->pay.buf;
-    c = getpeer(ifp->mgr, pkt, false);
+    if (pkt->ip->proto == 6 && pkt->pay.len >= sizeof(*pkt->tcp))
-    if (c) proto_error(c, false, "Received fragmented packet");
+      pkt->tcp = (struct tcp *) pkt->pay.buf;
+    if (pkt->udp || pkt->tcp) {
+      struct mg_connection *c = getpeer(ifp->mgr, pkt, false);
+      if (c) proto_error(c, false, "Received fragmented packet");
+    }  // else ignore                                      // else ignore
   } else if (pkt->ip->proto == 1) {
     pkt->icmp = (struct icmp *) (pkt->pay.buf);
     if (pkt->pay.len < sizeof(*pkt->icmp)) return;
@@ -11621,15 +11625,19 @@ static void rx_ip6(struct mg_tcpip_if *ifp, struct pkt *pkt) {
         len += hlen;
         nhdr += hlen;
         break;
-      case 44:  // Fragment 4.5
+      case 44:                                    // Fragment 4.5; no reassembly
-      {
+        if ((uint32_t) len + 8 > plen) return;    // Truncated (frag hdr = 8)
-        struct mg_connection *c;
+        if ((nhdr[2] | (nhdr[3] & 0xf8)) == 0) {  // First fragment
-        if (((uint32_t) len + 2) > plen) return;  // nhdr[0, 1]; malformed
+          size_t tlen = (size_t)(plen - len - 8);
-        if (nhdr[0] == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
+          if (nhdr[0] == 17 && tlen >= sizeof(*pkt->udp))
-        if (nhdr[0] == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
+            pkt->udp = (struct udp *) (nhdr + 8);
-        c = getpeer(ifp->mgr, pkt, false);
+          if (nhdr[0] == 6 && tlen >= sizeof(*pkt->tcp))
-        if (c) proto_error(c, false, "Received fragmented packet");
+            pkt->tcp = (struct tcp *) (nhdr + 8);
-      }
+          if (pkt->udp || pkt->tcp) {
+            struct mg_connection *c = getpeer(ifp->mgr, pkt, false);
+            if (c) proto_error(c, false, "Received fragmented packet");
+          }  // else ignore
+        }  // else ignore
         return;
       case 59:  // No Next Header 4.7
         return;
@@ -19571,25 +19579,25 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
     // EC certificate verify packet
     uint8_t verify[82] = {0x0f, 0x00, 0x00, 0x00, 0x04, 0x03, 0x00, 0x00};
     size_t sigsz, verifysz = 0;
-    int adj1, adj2;
+    int neg1, neg2;
     uint8_t sig[64] = {0};
     if (!mg_p256_sign(tls->ec_key, hash, sizeof(hash), sig)) {
       mg_error(c, "P-256 sign");
       return false;
     }
-    adj1 = sig[0] == 0 && !(sig[1] & 0x80) ? -1 : !!(sig[0] & 0x80);
+
-    adj2 = sig[32] == 0 && !(sig[33] & 0x80) ? -1 : !!(sig[32] & 0x80);
+    neg1 = !!(sig[0] & 0x80);
+    neg2 = !!(sig[32] & 0x80);
     verify[8] = 0x30;  // ASN.1 SEQUENCE
-    verify[9] = (uint8_t) (68 + adj1 + adj2);
+    verify[9] = (uint8_t) (68 + neg1 + neg2);
     verify[10] = 0x02;  // ASN.1 INTEGER
-    verify[11] = (uint8_t) (32 + adj1);
+    verify[11] = (uint8_t) (32 + neg1);
-    memmove(verify + (size_t) (12 + (adj1 > 0)), sig + (size_t) (adj1 < 0),
+    memmove(verify + 12 + neg1, sig, 32);
-            (size_t) (32 + (adj1 < 0)));
+    verify[12 + 32 + neg1] = 0x02;  // ASN.1 INTEGER
-    verify[12 + 32 + adj1] = 0x02;  // ASN.1 INTEGER
+    verify[13 + 32 + neg1] = (uint8_t) (32 + neg2);
-    verify[13 + 32 + adj1] = (uint8_t) (32 + adj2);
+    memmove(verify + 14 + 32 + neg1 + neg2, sig + 32, 32);
-    memmove(verify + (size_t) (14 + 32 + adj1 + (adj2 > 0)),
+
-            sig + (size_t) (32 + (adj2 < 0)), (size_t) (32 + (adj2 < 0)));
+    sigsz = (size_t) (70 + neg1 + neg2);
-    sigsz = (size_t) (70 + adj1 + adj2);
     verifysz = 8U + sigsz;
     verify[3] = (uint8_t) (sigsz + 4);
     verify[7] = (uint8_t) sigsz;

src/net_builtin.c

@@ -1867,12 +1867,16 @@ static void rx_ip(struct mg_tcpip_if *ifp, struct pkt *pkt) {
   mkpay(pkt, (uint32_t *) pkt->ip + ihl);  // account for opts
   if (!ipcsum_ok(pkt->ip)) return;
   frag = mg_ntohs(pkt->ip->frag);
-  if (frag & IP_MORE_FRAGS_MSK || frag & IP_FRAG_OFFSET_MSK) {
+  if (frag & IP_FRAG_OFFSET_MSK) {  // Non-first fragment: ignore
-    struct mg_connection *c;
+  } else if (frag & IP_MORE_FRAGS_MSK) {  // First fragment: find and close
-    if (pkt->ip->proto == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
+    if (pkt->ip->proto == 17 && pkt->pay.len >= sizeof(*pkt->udp))
-    if (pkt->ip->proto == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
+      pkt->udp = (struct udp *) pkt->pay.buf;
-    c = getpeer(ifp->mgr, pkt, false);
+    if (pkt->ip->proto == 6 && pkt->pay.len >= sizeof(*pkt->tcp))
-    if (c) proto_error(c, false, "Received fragmented packet");
+      pkt->tcp = (struct tcp *) pkt->pay.buf;
+    if (pkt->udp || pkt->tcp) {
+      struct mg_connection *c = getpeer(ifp->mgr, pkt, false);
+      if (c) proto_error(c, false, "Received fragmented packet");
+    }  // else ignore                                      // else ignore
   } else if (pkt->ip->proto == 1) {
     pkt->icmp = (struct icmp *) (pkt->pay.buf);
     if (pkt->pay.len < sizeof(*pkt->icmp)) return;
@@ -1948,15 +1952,19 @@ static void rx_ip6(struct mg_tcpip_if *ifp, struct pkt *pkt) {
         len += hlen;
         nhdr += hlen;
         break;
-      case 44:  // Fragment 4.5
+      case 44:                                    // Fragment 4.5; no reassembly
-      {
+        if ((uint32_t) len + 8 > plen) return;    // Truncated (frag hdr = 8)
-        struct mg_connection *c;
+        if ((nhdr[2] | (nhdr[3] & 0xf8)) == 0) {  // First fragment
-        if (((uint32_t) len + 2) > plen) return;  // nhdr[0, 1]; malformed
+          size_t tlen = (size_t)(plen - len - 8);
-        if (nhdr[0] == 17) pkt->udp = (struct udp *) (pkt->pay.buf);
+          if (nhdr[0] == 17 && tlen >= sizeof(*pkt->udp))
-        if (nhdr[0] == 6) pkt->tcp = (struct tcp *) (pkt->pay.buf);
+            pkt->udp = (struct udp *) (nhdr + 8);
-        c = getpeer(ifp->mgr, pkt, false);
+          if (nhdr[0] == 6 && tlen >= sizeof(*pkt->tcp))
-        if (c) proto_error(c, false, "Received fragmented packet");
+            pkt->tcp = (struct tcp *) (nhdr + 8);
-      }
+          if (pkt->udp || pkt->tcp) {
+            struct mg_connection *c = getpeer(ifp->mgr, pkt, false);
+            if (c) proto_error(c, false, "Received fragmented packet");
+          }  // else ignore
+        }  // else ignore
         return;
       case 59:  // No Next Header 4.7
         return;

src/tls_builtin.c

@@ -1175,25 +1175,25 @@ static bool mg_tls_send_cert_verify(struct mg_connection *c, bool is_client) {
     // EC certificate verify packet
     uint8_t verify[82] = {0x0f, 0x00, 0x00, 0x00, 0x04, 0x03, 0x00, 0x00};
     size_t sigsz, verifysz = 0;
-    int adj1, adj2;
+    int neg1, neg2;
     uint8_t sig[64] = {0};
     if (!mg_p256_sign(tls->ec_key, hash, sizeof(hash), sig)) {
       mg_error(c, "P-256 sign");
       return false;
     }
-    adj1 = sig[0] == 0 && !(sig[1] & 0x80) ? -1 : !!(sig[0] & 0x80);
+
-    adj2 = sig[32] == 0 && !(sig[33] & 0x80) ? -1 : !!(sig[32] & 0x80);
+    neg1 = !!(sig[0] & 0x80);
+    neg2 = !!(sig[32] & 0x80);
     verify[8] = 0x30;  // ASN.1 SEQUENCE
-    verify[9] = (uint8_t) (68 + adj1 + adj2);
+    verify[9] = (uint8_t) (68 + neg1 + neg2);
     verify[10] = 0x02;  // ASN.1 INTEGER
-    verify[11] = (uint8_t) (32 + adj1);
+    verify[11] = (uint8_t) (32 + neg1);
-    memmove(verify + (size_t) (12 + (adj1 > 0)), sig + (size_t) (adj1 < 0),
+    memmove(verify + 12 + neg1, sig, 32);
-            (size_t) (32 + (adj1 < 0)));
+    verify[12 + 32 + neg1] = 0x02;  // ASN.1 INTEGER
-    verify[12 + 32 + adj1] = 0x02;  // ASN.1 INTEGER
+    verify[13 + 32 + neg1] = (uint8_t) (32 + neg2);
-    verify[13 + 32 + adj1] = (uint8_t) (32 + adj2);
+    memmove(verify + 14 + 32 + neg1 + neg2, sig + 32, 32);
-    memmove(verify + (size_t) (14 + 32 + adj1 + (adj2 > 0)),
+
-            sig + (size_t) (32 + (adj2 < 0)), (size_t) (32 + (adj2 < 0)));
+    sigsz = (size_t) (70 + neg1 + neg2);
-    sigsz = (size_t) (70 + adj1 + adj2);
     verifysz = 8U + sigsz;
     verify[3] = (uint8_t) (sigsz + 4);
     verify[7] = (uint8_t) sigsz;

test/mip_test.c

@@ -1257,7 +1257,7 @@ static void test_frag_recv_path(void) {
   init_tcp_handshake(&e, &ipp, &mgr);  // starts with seq_no=1000, ackno=2
 
   // send fragmented TCP packet
-  ip.frag |= IP_MORE_FRAGS_MSK;  // setting More Fragments bit to 1
+  ip.frag = mg_htons(IP_MORE_FRAGS_MSK);  // setting More Fragments bit to 1
   create_tcp_simpleseg(&e, &ipp, 1001, 2, TH_PUSH | TH_ACK, 1000);
   s_sent_fragment = 1;           // "enable" fn
   mg_mgr_poll(&mgr, 0);          // call it (process fake frag IP)

tutorials/esp32/minimal/partitions.csv

@@ -1,5 +1,5 @@
 # Name,   Type, SubType, Offset,  Size, Flags
 nvs,      data, nvs,     ,        0x6000
 phy_init, data, phy,     ,        0x1000
-factory,  app,  factory, ,        1M
+factory,  app,  factory, ,        1200K
 coredump, data, coredump,,        128K