Summary:
In picoTCP v1.7.0, the TCP state machine does not properly handle simultaneous-open scenarios. A socket in SYN_SENT state receiving a pure SYN packet does not transition to SYN_RECEIVED, diverging from RFC TCP semantics.
Affected Version:
- picoTCP v1.7.0 (official Git clone)
Details:
- modules/pico_tcp.c FSM table for PICO_SOCKET_STATE_TCP_SYN_SENT:
syn = NULL
synack = tcp_synack
- valid_flags[SYN_SENT] does not accept standalone SYN
- Observed behavior: receiving SYN triggers reset/invalid path, not SYN_RECEIVED
- RFC: SYN_SENT receiving SYN should transition to SYN_RECEIVED
Impact:
- Interoperability issues (e.g., P2P/NAT-hole-punch)
- Fingerprinting opportunity
- Reliability degradation with certain peers
Suggested Remediation:
- Add explicit FSM transition: SYN_SENT + SYN -> SYN_RECEIVED
- Ensure handshake continues correctly
Summary:
In picoTCP v1.7.0, the TCP state machine does not properly handle simultaneous-open scenarios. A socket in SYN_SENT state receiving a pure SYN packet does not transition to SYN_RECEIVED, diverging from RFC TCP semantics.
Affected Version:
Details:
syn = NULL
synack = tcp_synack
Impact:
Suggested Remediation: