Fenrir fixes 2026 08 19

[danielinux]

3f21499 skoll: re-SYN cap, listener-revert drain, esp restore, ttl OOB guard
e91e4bd F-9807: re-arm on re-SYN and fast-fail the pre-accept listener pin
ee217cf F-9806: validate DHCP chaddr/yiaddr and defer config commit to ACK
a3d976a F-10275: enforce strict T1 < T2 < lease in DHCP lease timers
e9095de F-10266: document the no-IPv4-fragmentation forwarding deviation
d49ff7a F-10272: add per-connection IP_TOS setsockopt for outgoing DSCP
e2475ae F-8571: add ESP state persistence callbacks for reboot survival
482451a F-10258: scope ESP unwrap to the declared IP total length
02319ee F-10257: encapsulate the echo reply at its declared IP length
b41c60d F-10256: send ICMP errors from VLAN sub-interfaces via their parent
aa92c66 F-10270: copy the triggering TOS into generated ICMP errors
85205ee F-10267: send TTL-exceeded for short datagrams, quoting what exists
60595eb F-10278: pop one root entry from the timer heap

[Copilot]

Pull request overview

This PR hardens and corrects several wolfIP IPv4/TCP/DHCP/ESP behaviors, primarily around edge-case correctness and security/robustness in forwarding and connection handling.

Changes:

• Add per-socket IPv4 TOS (DSCP) support, and propagate triggering TOS into generated ICMP errors.
• Fix TCP listener lock/pinning scenarios (re-SYN handling, pre-accept fast-fail timer, and state drain when reverting to LISTEN).
• Harden DHCP processing (strict lease timer ordering, validate chaddr/yiaddr, and defer interface commit until ACK) and tighten ESP length scoping to the declared IP total length.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfip.h	Adds WOLFIP_IP_TOS compatibility define.
wolfesp.h	Introduces ESP state persistence callback API.
src/wolfip.c	Implements TCP listener recovery + preaccept timer, TOS plumbing, ICMP quoting fixes, DHCP hardening, and timer-heap behavior update.
src/wolfesp.c	Adds ESP state persistence callbacks and scopes unwrap/wrap operations to IP total length (ignoring L2 slack).
src/test/unit/unit.c	Registers new/renamed unit tests covering the new behaviors.
src/test/unit/unit_tests_vlan.c	Adds VLAN-focused ICMP error generation tests.
src/test/unit/unit_tests_tcp_flow.c	Adds TCP listener lock and IP_TOS behavior tests.
src/test/unit/unit_tests_tcp_ack.c	Updates/extends TTL-exceeded forwarding tests for new quoting rules.
src/test/unit/unit_tests_proto.c	Updates timer-heap tests for “one root per pop” behavior and TTL-exceeded sizing.
src/test/unit/unit_tests_misc_edges.c	Adds port-unreachable TOS propagation test.
src/test/unit/unit_tests_ip_arp_recv.c	Adds TTL=1 forwarding regression tests (header-only/partial quote + ICMP suppression rules + TOS copy).
src/test/unit/unit_tests_dns_dhcp.c	Updates DHCP tests for deferred commit and chaddr/hlen requirements.
src/test/unit/unit_tests_dhcp_edges.c	Adds DHCP edge/security tests (wrong chaddr, zero yiaddr, defer commit).
src/test/unit/unit_tests_branches.c	Adds timer-drain and poll timer-arming regression tests.
src/test/unit/unit_esp.c	Adds ESP length scoping tests and state persistence callback tests.
docs/advanced_ipv4_howto.md	Documents the intentional “no IPv4 fragmentation” forwarding deviation.

Suppressed comments (1)

src/wolfip.c:2358

• Same as wolfIP_send_ttl_exceeded(): for VLAN sub-interfaces, this check should also ensure vlan_parent->send is non-NULL to align with wolfIP_ll_send_frame()'s interface validity and avoid running filter/ESP work when the frame cannot be transmitted.

    if (ll->vlan_active) {
        if (!ll->vlan_parent)
            return;
    } else if (!ll->send) {
        return;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gasbytes]

looks good, just one tiny comment on the new functio tcp_listener_revert_to_listen.