nuttx/net/tcp/tcp_monitor.c
Ricard Rosson aeaa13227e
Some checks are pending
MemBrowse Memory Report / changes-filter (push) Waiting to run
MemBrowse Memory Report / load-targets (push) Waiting to run
MemBrowse Memory Report / identical (push) Blocked by required conditions
MemBrowse Memory Report / analyze (push) Blocked by required conditions
net/tcp: don't accept a reset connection as connected (fixes send hang)
tcp_start_monitor() is called from accept() (net/inet/inet_sockif.c) for
each newly accepted connection.  When the peer had already closed the
connection before accept() ran, the monitor takes an early-return path so
that any read-ahead data buffered on the connection can still be drained;
it returns OK in that case.  accept() (net/socket/accept.c) then marks the
new socket _SF_CONNECTED unconditionally.

If the peer aborts the connection with an RST immediately after the
three-way handshake completes (for example any close with SO_LINGER
{1, 0}), the connection is moved to TCP_CLOSED with no buffered data, yet
accept() still hands back a socket that reports _SS_ISCONNECTED.  A
subsequent blocking send() on that socket passes the connected check,
registers a send callback and waits on its semaphore forever: the only
TCP_ABORT event was delivered before the callback existed, and no further
ACK, POLL or disconnect event is generated for a closed connection, so the
waiter is never woken.

Any server that writes before reading can hit this; the telnet daemon
(netutils/telnetd) is one example, where the accepted session task blocks
in send() and never completes.

Only return OK from the already-closed path when there is actually
read-ahead data to drain.  Otherwise the connection is dead, so fall
through to the -ENOTCONN return: accept() then fails cleanly instead of
handing back a socket wedged on a connection that will never make progress.
The graceful-close-with-pending-data case (the reason the OK path exists)
is preserved by the conn->readahead check.

Signed-off-by: Ricard Rosson <ricard@groundbits.com>
Assisted-by: Claude (Anthropic Claude Code)
2026-07-28 15:25:47 -03:00

414 lines
13 KiB
C

/****************************************************************************
* net/tcp/tcp_monitor.c
*
* SPDX-License-Identifier: Apache-2.0
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership. The
* ASF licenses this file to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance with the
* License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*
****************************************************************************/
/****************************************************************************
* Included Files
****************************************************************************/
#include <nuttx/config.h>
#include <stdint.h>
#include <assert.h>
#include <nuttx/debug.h>
#include <nuttx/net/tcp.h>
#include "devif/devif.h"
#include "socket/socket.h"
#include "utils/utils.h"
#include "tcp/tcp.h"
#ifdef NET_TCP_HAVE_STACK
/****************************************************************************
* Private Function Prototypes
****************************************************************************/
static void tcp_close_connection(FAR struct tcp_conn_s *conn,
uint32_t flags);
static uint32_t tcp_monitor_event(FAR struct net_driver_s *dev,
FAR void *pvpriv, uint32_t flags);
/****************************************************************************
* Private Functions
****************************************************************************/
/****************************************************************************
* Name: tcp_close_connection
*
* Description:
* Called when a loss-of-connection event has occurred.
*
* Input Parameters:
* conn The TCP connection structure
* flags Set of connection events events
*
* Returned Value:
* None
*
* Assumptions:
* The caller holds the network lock.
*
****************************************************************************/
static void tcp_close_connection(FAR struct tcp_conn_s *conn, uint32_t flags)
{
/* These loss-of-connection events may be reported:
*
* TCP_ABORT: The remote host has aborted the connection
* TCP_TIMEDOUT: Connection aborted due to too many retransmissions.
* NETDEV_DOWN: The network device went down
*
* And we need to set these two socket status bits appropriately:
*
* _SF_CONNECTED==1 && _SF_CLOSED==0 - the socket is connected
* _SF_CONNECTED==0 && _SF_CLOSED==1 - the socket was gracefully
* disconnected
* _SF_CONNECTED==0 && _SF_CLOSED==0 - the socket was rudely disconnected
*/
/* The loss of connection was less than graceful. This will
* (eventually) be reported as an ENOTCONN error.
*/
if ((flags & TCP_ABORT) != 0)
{
/* The peer gracefully closed the connection. Marking the
* connection as disconnected will suppress some subsequent
* ENOTCONN errors from receive. A graceful disconnection is
* not handle as an error but as an "end-of-file"
*/
conn->sconn.s_flags &= ~_SF_CONNECTED;
conn->sconn.s_flags |= _SF_CLOSED;
}
else if ((flags & (TCP_TIMEDOUT | NETDEV_DOWN)) != 0)
{
/* The loss of connection was less than graceful. This will
* (eventually) be reported as an ENOTCONN error.
*/
conn->sconn.s_flags &= ~(_SF_CONNECTED | _SF_CLOSED);
}
}
/****************************************************************************
* Name: tcp_monitor_event
*
* Description:
* Some connection related event has occurred
*
* Input Parameters:
* dev The device which as active when the event was detected.
* pvpriv An instance of struct tcp_conn_s cast to void*
* flags Set of events describing why the callback was invoked
*
* Returned Value:
* None
*
* Assumptions:
* The network is locked.
*
****************************************************************************/
static uint32_t tcp_monitor_event(FAR struct net_driver_s *dev,
FAR void *pvpriv, uint32_t flags)
{
FAR struct tcp_conn_s *conn = pvpriv;
if (conn != NULL)
{
ninfo("flags: %" PRIx32 " s_flags: %02x\n", flags,
conn->sconn.s_flags);
/* TCP_DISCONN_EVENTS: TCP_ABORT, TCP_TIMEDOUT, or NETDEV_DOWN.
* All loss-of-connection events.
*/
if ((flags & TCP_DISCONN_EVENTS) != 0)
{
tcp_close_connection(conn, flags);
}
/* TCP_CONNECTED: The socket is successfully connected */
else if ((flags & TCP_CONNECTED) != 0)
{
#if 0 /* REVISIT: Assertion fires. Why? */
FAR struct tcp_conn_s *conn = psock->s_conn;
/* Make sure that this is the device bound to the connection */
DEBUGASSERT(conn->dev == NULL || conn->dev == dev);
conn->dev = dev;
#endif
/* If there is no local address assigned to the socket (perhaps
* because it was INADDR_ANY), then assign it the address of the
* connecting device.
*
* TODO: Implement this.
*/
/* Clear the socket error */
_SO_CONN_SETERRNO(conn, OK);
/* Indicate that the socket is now connected */
conn->sconn.s_flags |= (_SF_BOUND | _SF_CONNECTED);
conn->sconn.s_flags &= ~_SF_CLOSED;
}
else if ((flags & TCP_RXCLOSE) != 0)
{
conn->shutdown |= SHUT_RD;
}
}
return flags;
}
/****************************************************************************
* Name: tcp_shutdown_monitor
*
* Description:
* Stop monitoring TCP connection changes for a given socket.
*
* Input Parameters:
* conn - The TCP connection of interest
* flags - Indicates the type of shutdown. TCP_TXCLOSE or TCP_ABORT
*
* Returned Value:
* None
*
* Assumptions:
* The caller holds the network lock (if not, it will be locked momentarily
* by this function).
*
****************************************************************************/
static void tcp_shutdown_monitor(FAR struct tcp_conn_s *conn, uint32_t flags)
{
/* Perform callbacks to assure that all sockets, including dup'ed copies,
* are informed of the loss of connection event.
*/
/* Free all allocated connection event callback structures */
while (conn->connevents != NULL)
{
devif_conn_callback_free(conn->dev, conn->connevents,
&conn->connevents,
&conn->connevents_tail);
}
}
/****************************************************************************
* Public Functions
****************************************************************************/
/****************************************************************************
* Name: tcp_start_monitor
*
* Description:
* Set up to receive TCP connection state changes for a given socket
*
* Input Parameters:
* psock - The socket of interest
*
* Returned Value:
* On success, tcp_start_monitor returns OK; On any failure,
* tcp_start_monitor will return a negated errno value. The only failure
* that can occur is if the socket has already been closed and, in this
* case, -ENOTCONN is returned.
*
* Assumptions:
* The caller holds the network lock (if not, it will be locked momentarily
* by this function).
*
****************************************************************************/
int tcp_start_monitor(FAR struct socket *psock)
{
FAR struct devif_callback_s *cb;
FAR struct tcp_conn_s *conn;
bool nonblock_conn;
conn = psock->s_conn;
/* Non-blocking connection ? */
nonblock_conn = (conn->tcpstateflags == TCP_SYN_SENT &&
_SS_ISNONBLOCK(conn->sconn.s_flags));
/* Check if the connection has already been closed before any callbacks
* have been registered. (Maybe the connection is lost before accept has
* registered the monitoring callback.)
*/
if (!(conn->tcpstateflags == TCP_ESTABLISHED ||
conn->tcpstateflags == TCP_SYN_RCVD || nonblock_conn))
{
/* Invoke the TCP_ABORT connection event now */
tcp_shutdown_monitor(conn, TCP_ABORT);
/* If the peer closed the connection before we called accept, and
* there is buffered read-ahead data, return OK so that the caller
* still gets a socket from which the pending data can be drained
* (followed by EOF).
*
* If there is no buffered data, however, the connection is dead:
* presenting it to the caller as a successfully-accepted socket
* makes accept() mark it _SF_CONNECTED (see net/socket/accept.c),
* and a subsequent blocking send() would then wait forever on a
* connection that will never post another event. This happens when
* a peer resets the connection immediately after the handshake (for
* example a close with SO_LINGER {1, 0}). Report it as not-connected
* instead so accept() fails cleanly rather than handing back a wedged
* socket.
*/
if ((conn->tcpstateflags == TCP_CLOSED ||
conn->tcpstateflags == TCP_LAST_ACK) &&
conn->readahead != NULL)
{
return OK;
}
/* And return -ENOTCONN to indicate the monitor was not started
* because the socket was already disconnected.
*/
return -ENOTCONN;
}
/* Allocate a callback structure that we will use to get callbacks if
* the network goes down.
*/
conn_dev_lock(&conn->sconn, conn->dev);
cb = devif_callback_alloc(conn->dev,
&conn->connevents,
&conn->connevents_tail);
if (cb != NULL)
{
cb->event = tcp_monitor_event;
cb->priv = (FAR void *)conn;
cb->flags = TCP_DISCONN_EVENTS | TCP_RXCLOSE;
/* Monitor the connected event */
if (nonblock_conn)
{
cb->flags |= TCP_CONNECTED;
}
}
conn_dev_unlock(&conn->sconn, conn->dev);
return OK;
}
/****************************************************************************
* Name: tcp_stop_monitor
*
* Description:
* Stop monitoring TCP connection changes for a sockets associated with
* a given TCP connection structure.
*
* Input Parameters:
* conn - The TCP connection of interest
* flags Set of disconnection events
*
* Returned Value:
* None
*
* Assumptions:
* The caller holds the network lock (if not, it will be locked momentarily
* by this function).
*
****************************************************************************/
void tcp_stop_monitor(FAR struct tcp_conn_s *conn, uint32_t flags)
{
DEBUGASSERT(conn != NULL);
/* Stop the network monitor */
tcp_shutdown_monitor(conn, flags);
}
/****************************************************************************
* Name: tcp_lost_connection
*
* Description:
* Called when a loss-of-connection event has been detected by network
* event handling logic. Perform operations like tcp_stop_monitor but (1)
* explicitly mark this socket and (2) disable further callbacks the to the
* event handler.
*
* Input Parameters:
* conn - The TCP connection of interest
* cb - devif callback structure
* flags - Set of connection events events
*
* Returned Value:
* None
*
* Assumptions:
* The caller holds the network lock (if not, it will be locked momentarily
* by this function).
*
****************************************************************************/
void tcp_lost_connection(FAR struct tcp_conn_s *conn,
FAR struct devif_callback_s *cb, uint32_t flags)
{
DEBUGASSERT(conn != NULL);
/* Nullify the callback structure so that recursive callbacks are not
* received by the event handler due to disconnection processing.
*
* NOTE: In a configuration with CONFIG_NET_TCP_WRITE_BUFFERS=y,
* the "semi-permanent" callback structure may have already been
* nullified.
*/
if (cb != NULL)
{
cb->flags = 0;
cb->priv = NULL;
cb->event = NULL;
}
/* Make sure that this socket is explicitly marked. It may not get a
* callback due to the above nullification.
*/
tcp_close_connection(conn, flags);
/* Then stop the network monitor for all sockets. */
tcp_shutdown_monitor(conn, flags);
}
#endif /* NET_TCP_HAVE_STACK */