More various hardening fixes

[gasbytes]

d474681 - use the complete answers present in a truncated dns response instead of discarding it
a290c59 - update the peer receive window only form acceptable segments carrying an in-range ack
b6c9eb9 - jitter teh default DHCP T1/T2 so identically-leased clients do not renew in lockstep
ca86bda - repeat the unsolicited igmp membership report one after a random delay on join
8a39521 - answer an ACK above SND.NXT with a challenge ACK instead of processing it (also updated some related tests after the changes)
3050bc7 - restore the socket interface index when wolfip_sock_bind rejects a bind

[Copilot]

🔵 Needs a closer look

It changes correctness- and security-critical behavior across multiple core protocols (TCP/DNS/DHCP/IGMP) in the main stack file, so a final expert review is warranted despite the added tests.

Pull request overview

This PR applies several protocol-hardening fixes across wolfIP’s core TCP, DNS, DHCP, IGMP/multicast, and socket-bind paths, with accompanying unit test updates to validate the tightened behaviors.

Changes:

• IGMP: repeat the unsolicited membership report once after a randomized delay on multicast join, without suppressing query-driven reports.
• TCP: only update peer_rwnd from acceptable, ACK-bearing in-window segments, and respond to ACKs beyond what has been sent with a challenge ACK instead of processing them.
• DNS/DHCP/bind: accept usable answers from truncated DNS responses (only giving up after parsing), add jitter to default DHCP T1/T2 scheduling, and restore if_idx when wolfIP_sock_bind rejects a bind.

File summaries

File	Description
src/wolfip.c	Implements the hardening changes across IGMP, TCP window/ACK validation, DNS truncation handling, DHCP lease-timer jitter, and bind rollback correctness.
src/test/unit/unit.c	Registers new unit tests covering the added behaviors.
src/test/unit/unit_tests_tcp_state.c	Adds new TCP state tests for out-of-range ACK handling and preventing improper peer_rwnd updates.
src/test/unit/unit_tests_tcp_flow.c	Adjusts TCP flow tests to satisfy stricter acceptability/ACK requirements.
src/test/unit/unit_tests_tcp_ack.c	Updates ACK-related tests to initialize seq/snd_una consistent with new ACK acceptability logic.
src/test/unit/unit_tests_proto.c	Updates protocol tests for stricter ACK acceptability checks in FIN_WAIT_2 paths.
src/test/unit/unit_tests_multicast.c	Adds/adjusts multicast tests to account for the new unsolicited report repeat timer.
src/test/unit/unit_tests_misc_edges.c	Adds regression tests ensuring rejected binds preserve the prior if_idx for TCP/UDP/ICMP sockets.
src/test/unit/unit_tests_dns_edges.c	Adds a test ensuring truncated DNS responses can still deliver a complete usable answer record.
src/test/unit/unit_tests_dns_dhcp.c	Adjusts DHCP timing assertions for jittered defaults and updates a DNS truncation test to match new parsing behavior.
src/test/unit/unit_tests_dhcp_edges.c	Updates DHCP edge-case assertions for fuzzed defaults and adds a determinism-based fuzz validation test.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #168

Scan targets checked: wolfip-bugs, wolfip-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.