Skip to content

Commit 4748108

Browse files
hlefdavidchisnall
authored andcommitted
Fix failure to remove firewall entries.
We do not call the firewall API consistently: when we add entries, we pass ports in host endianness (see `network_socket_connect_tcp`), however when we remove them we pass ports in network endianness. As a result, upon removal, the firewall cannot find the relevant entry in the table and fails to remove the rule. Signed-off-by: Hugo Lefeuvre <[email protected]>
1 parent 4654f33 commit 4748108

File tree

1 file changed

+26
-6
lines changed

1 file changed

+26
-6
lines changed

lib/tcpip/network_wrapper.cc

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,27 @@ using CHERI::PermissionSet;
3030

3131
namespace
3232
{
33+
// TODO These should probably be in their own library.
34+
uint16_t constexpr ntohs(uint16_t value)
35+
{
36+
return
37+
#ifdef __LITTLE_ENDIAN__
38+
__builtin_bswap16(value)
39+
#else
40+
value
41+
#endif
42+
;
43+
}
44+
uint16_t constexpr htons(uint16_t value)
45+
{
46+
return
47+
#ifdef __LITTLE_ENDIAN__
48+
__builtin_bswap16(value)
49+
#else
50+
value
51+
#endif
52+
;
53+
}
3354

3455
/**
3556
* The sealed wrapper around a FreeRTOS socket.
@@ -558,28 +579,27 @@ int network_socket_close(Timeout *t, SObj mallocCapability, SObj sealedSocket)
558579
// mainly if the TCP connection is dead, which is likely to
559580
// happen in practice and has no impact for us.
560581
FreeRTOS_shutdown(socket->socket, FREERTOS_SHUT_RDWR);
582+
auto localPort = ntohs(socket->socket->usLocalPort);
561583
if (socket->socket->bits.bIsIPv6)
562584
{
563585
if (isTCP)
564586
{
565-
firewall_remove_tcpipv6_endpoint(socket->socket->usLocalPort);
587+
firewall_remove_tcpipv6_endpoint(localPort);
566588
}
567589
else
568590
{
569-
firewall_remove_udpipv6_local_endpoint(
570-
socket->socket->usLocalPort);
591+
firewall_remove_udpipv6_local_endpoint(localPort);
571592
}
572593
}
573594
else
574595
{
575596
if (isTCP)
576597
{
577-
firewall_remove_tcpipv4_endpoint(socket->socket->usLocalPort);
598+
firewall_remove_tcpipv4_endpoint(localPort);
578599
}
579600
else
580601
{
581-
firewall_remove_udpipv4_local_endpoint(
582-
socket->socket->usLocalPort);
602+
firewall_remove_udpipv4_local_endpoint(localPort);
583603
}
584604
}
585605
// Close the socket. Another thread will actually clean up the

0 commit comments

Comments
 (0)