NetworkPkg/TcpDxe: Check TCP payload for release version.

TCP payload check is implemented by TcpVerifySegment(), but all the function
calls of TcpVerifySegment() are placed in ASSERT(), which is only valid for
debug version:
  ASSERT (TcpVerifySegment (Nbuf) != 0);

This patch is to enable the check for release version.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Wang Fan <fan.wang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>

diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c
index f8845dca470e97732482077ef6770b78533347df..92a0ab8c35148b75921d6995d7d8f0bb197550c2 100644 (file)
--- a/NetworkPkg/TcpDxe/TcpInput.c
+++ b/NetworkPkg/TcpDxe/TcpInput.c
@@ -281,8 +281,11 @@ TcpComputeRtt (
   @param[in]  Left     The sequence number of the window's left edge.\r
   @param[in]  Right    The sequence number of the window's right edge.\r
 \r
+  @retval     0        The segment is broken.\r
+  @retval     1        The segment is in good shape.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpTrimSegment (\r
   IN NET_BUF   *Nbuf,\r
   IN TCP_SEQNO Left,\r
@@ -306,7 +309,7 @@ TcpTrimSegment (
 \r
     Seg->Seq = Seg->End;\r
     NetbufTrim (Nbuf, Nbuf->TotalSize, NET_BUF_HEAD);\r
-    return;\r
+    return 1;\r
   }\r
 \r
   //\r
@@ -359,7 +362,7 @@ TcpTrimSegment (
     }\r
   }\r
 \r
-  ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+  return TcpVerifySegment (Nbuf);\r
 }\r
 \r
 /**\r
@@ -368,14 +371,17 @@ TcpTrimSegment (
   @param[in]  Tcb      Pointer to the TCP_CB of this TCP instance.\r
   @param[in]  Nbuf     Pointer to the NET_BUF containing the received tcp segment.\r
 \r
+  @retval     0        The segment is broken.\r
+  @retval     1        The segment is in good shape.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpTrimInWnd (\r
   IN TCP_CB  *Tcb,\r
   IN NET_BUF *Nbuf\r
   )\r
 {\r
-  TcpTrimSegment (Nbuf, Tcb->RcvNxt, Tcb->RcvWl2 + Tcb->RcvWnd);\r
+  return TcpTrimSegment (Nbuf, Tcb->RcvNxt, Tcb->RcvWl2 + Tcb->RcvWnd);\r
 }\r
 \r
 /**\r
@@ -421,7 +427,16 @@ TcpDeliverData (
     Nbuf  = NET_LIST_USER_STRUCT (Entry, NET_BUF, List);\r
     Seg   = TCPSEG_NETBUF (Nbuf);\r
 \r
-    ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+    if (TcpVerifySegment (Nbuf) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpToSendData: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+      NetbufFree (Nbuf);\r
+      return -1;\r
+    }\r
+    \r
     ASSERT (Nbuf->Tcp == NULL);\r
 \r
     if (TCP_SEQ_GT (Seg->Seq, Seq)) {\r
@@ -561,8 +576,11 @@ TcpDeliverData (
   @param[in, out]  Tcb   Pointer to the TCP_CB of this TCP instance.\r
   @param[in]       Nbuf  Pointer to the buffer containing the data to be queued.\r
 \r
+  @retval          0     An error condition occurred.\r
+  @retval          1     No error occurred to queue data.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpQueueData (\r
   IN OUT TCP_CB  *Tcb,\r
   IN     NET_BUF *Nbuf\r
@@ -588,7 +606,7 @@ TcpQueueData (
   if (IsListEmpty (Head)) {\r
 \r
     InsertTailList (Head, &Nbuf->List);\r
-    return;\r
+    return 1;\r
   }\r
 \r
   //\r
@@ -615,12 +633,12 @@ TcpQueueData (
     if (TCP_SEQ_LT (Seg->Seq, TCPSEG_NETBUF (Node)->End)) {\r
 \r
       if (TCP_SEQ_LEQ (Seg->End, TCPSEG_NETBUF (Node)->End)) {\r
-\r
-        NetbufFree (Nbuf);\r
-        return;\r
+        return 1;\r
       }\r
 \r
-      TcpTrimSegment (Nbuf, TCPSEG_NETBUF (Node)->End, Seg->End);\r
+      if (TcpTrimSegment (Nbuf, TCPSEG_NETBUF (Node)->End, Seg->End) == 0) {\r
+        return 0;\r
+      }\r
     }\r
   }\r
 \r
@@ -648,16 +666,20 @@ TcpQueueData (
       if (TCP_SEQ_LEQ (TCPSEG_NETBUF (Node)->Seq, Seg->Seq)) {\r
 \r
         RemoveEntryList (&Nbuf->List);\r
-        NetbufFree (Nbuf);\r
-        return;\r
+        return 1;\r
       }\r
 \r
-      TcpTrimSegment (Nbuf, Seg->Seq, TCPSEG_NETBUF (Node)->Seq);\r
+      if (TcpTrimSegment (Nbuf, Seg->Seq, TCPSEG_NETBUF (Node)->Seq) == 0) {\r
+        RemoveEntryList (&Nbuf->List);\r
+        return 0;\r
+      }\r
       break;\r
     }\r
 \r
     Cur = Cur->ForwardLink;\r
   }\r
+\r
+  return 1;\r
 }\r
 \r
 \r
@@ -667,8 +689,11 @@ TcpQueueData (
   @param[in]  Tcb      Pointer to the TCP_CB of this TCP instance.\r
   @param[in]  Ack      The acknowledge seuqence number of the received segment.\r
 \r
+  @retval          0     An error condition occurred.\r
+  @retval          1     No error occurred.\r
+\r
 **/\r
-VOID\r
+INTN\r
 TcpAdjustSndQue (\r
   IN TCP_CB    *Tcb,\r
   IN TCP_SEQNO Ack\r
@@ -701,9 +726,10 @@ TcpAdjustSndQue (
       continue;\r
     }\r
 \r
-    TcpTrimSegment (Node, Ack, Seg->End);\r
-    break;\r
+    return TcpTrimSegment (Node, Ack, Seg->End);\r
   }\r
+\r
+  return 1;\r
 }\r
 \r
 /**\r
@@ -893,7 +919,15 @@ TcpInput (
 \r
       TcpSetState (Tcb, TCP_SYN_RCVD);\r
       TcpSetTimer (Tcb, TCP_TIMER_CONNECT, Tcb->ConnectTimeout);\r
-      TcpTrimInWnd (Tcb, Nbuf);\r
+      if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+        DEBUG (\r
+          (EFI_D_ERROR,\r
+          "TcpInput: discard a broken segment for TCB %p\n",\r
+          Tcb)\r
+          );\r
+\r
+        goto DISCARD;\r
+      }\r
 \r
       goto StepSix;\r
     }\r
@@ -975,7 +1009,15 @@ TcpInput (
           TCP_CLEAR_FLG (Tcb->CtrlFlag, TCP_CTRL_RTT_ON);\r
         }\r
 \r
-        TcpTrimInWnd (Tcb, Nbuf);\r
+        if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+          DEBUG (\r
+            (EFI_D_ERROR,\r
+            "TcpInput: discard a broken segment for TCB %p\n",\r
+            Tcb)\r
+            );\r
+\r
+          goto DISCARD;\r
+        }\r
 \r
         TCP_SET_FLG (Tcb->CtrlFlag, TCP_CTRL_ACK_NOW);\r
 \r
@@ -993,9 +1035,16 @@ TcpInput (
         TcpSetState (Tcb, TCP_SYN_RCVD);\r
 \r
         ASSERT (Tcb->SndNxt == Tcb->Iss + 1);\r
-        TcpAdjustSndQue (Tcb, Tcb->SndNxt);\r
 \r
-        TcpTrimInWnd (Tcb, Nbuf);\r
+        if (TcpAdjustSndQue (Tcb, Tcb->SndNxt) == 0 || TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+          DEBUG (\r
+            (EFI_D_ERROR,\r
+            "TcpInput: discard a broken segment for TCB %p\n",\r
+            Tcb)\r
+            );\r
+\r
+          goto DISCARD;\r
+        }\r
 \r
         DEBUG (\r
           (EFI_D_WARN,\r
@@ -1081,7 +1130,15 @@ TcpInput (
   //\r
   // Trim the data and flags.\r
   //\r
-  TcpTrimInWnd (Tcb, Nbuf);\r
+  if (TcpTrimInWnd (Tcb, Nbuf) == 0) {\r
+    DEBUG (\r
+      (EFI_D_ERROR,\r
+      "TcpInput: discard a broken segment for TCB %p\n",\r
+      Tcb)\r
+      );\r
+\r
+    goto DISCARD;\r
+  }\r
 \r
   //\r
   // Third step: Check security and precedence, Ignored\r
@@ -1256,7 +1313,16 @@ TcpInput (
 \r
   if (TCP_SEQ_GT (Seg->Ack, Tcb->SndUna)) {\r
 \r
-    TcpAdjustSndQue (Tcb, Seg->Ack);\r
+    if (TcpAdjustSndQue (Tcb, Seg->Ack) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpInput: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+\r
+      goto DISCARD;\r
+    }\r
+    \r
     Tcb->SndUna = Seg->Ack;\r
 \r
     if (TCP_FLG_ON (Tcb->CtrlFlag, TCP_CTRL_SND_URG) &&\r
@@ -1489,7 +1555,16 @@ StepSix:
       goto RESET_THEN_DROP;\r
     }\r
 \r
-    TcpQueueData (Tcb, Nbuf);\r
+    if (TcpQueueData (Tcb, Nbuf) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpInput: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+\r
+      goto DISCARD;\r
+    }\r
+    \r
     if (TcpDeliverData (Tcb) == -1) {\r
       goto RESET_THEN_DROP;\r
     }\r

diff --git a/NetworkPkg/TcpDxe/TcpOutput.c b/NetworkPkg/TcpDxe/TcpOutput.c
index a7e59f0ed6e0e60aa97aa2e755f0be4222eccd38..1697514a92bff1b1e4981e0ff1b71f4a5af430e0 100644 (file)
--- a/NetworkPkg/TcpDxe/TcpOutput.c
+++ b/NetworkPkg/TcpDxe/TcpOutput.c
@@ -292,7 +292,11 @@ TcpTransmitSegment (
   BOOLEAN   Syn;\r
   UINT32    DataLen;\r
 \r
-  ASSERT ((Nbuf != NULL) && (Nbuf->Tcp == NULL) && (TcpVerifySegment (Nbuf) != 0));\r
+  ASSERT ((Nbuf != NULL) && (Nbuf->Tcp == NULL));\r
+\r
+  if (TcpVerifySegment (Nbuf) == 0) {\r
+    return -1; \r
+  }\r
 \r
   DataLen = Nbuf->TotalSize;\r
 \r
@@ -634,7 +638,11 @@ TcpGetSegment (
     Nbuf = TcpGetSegmentSock (Tcb, Seq, Len);\r
   }\r
 \r
-  ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+  if (TcpVerifySegment (Nbuf) == 0) {\r
+    NetbufFree (Nbuf);\r
+    return NULL;\r
+  }\r
+  \r
   return Nbuf;\r
 }\r
 \r
@@ -701,7 +709,9 @@ TcpRetransmit (
     return -1;\r
   }\r
 \r
-  ASSERT (TcpVerifySegment (Nbuf) != 0);\r
+  if (TcpVerifySegment (Nbuf) == 0) {\r
+    goto OnError;\r
+  }\r
 \r
   if (TcpTransmitSegment (Tcb, Nbuf) != 0) {\r
     goto OnError;\r
@@ -886,8 +896,14 @@ TcpToSendData (
     Seg->End  = End;\r
     Seg->Flag = Flag;\r
 \r
-    ASSERT (TcpVerifySegment (Nbuf) != 0);\r
-    ASSERT (TcpCheckSndQue (&Tcb->SndQue) != 0);\r
+    if (TcpVerifySegment (Nbuf) == 0 || TcpCheckSndQue (&Tcb->SndQue) == 0) {\r
+      DEBUG (\r
+        (EFI_D_ERROR,\r
+        "TcpToSendData: discard a broken segment for TCB %p\n",\r
+        Tcb)\r
+        );\r
+      goto OnError;\r
+    }\r
 \r
     //\r
     // Don't send an empty segment here.\r
@@ -899,8 +915,7 @@ TcpToSendData (
         Tcb)\r
         );\r
 \r
-      NetbufFree (Nbuf);\r
-      return Sent;\r
+      goto OnError;\r
     }\r
 \r
     if (TcpTransmitSegment (Tcb, Nbuf) != 0) {\r