Update on 23 Oct 2023. Expand to see details.v6.3.0_rel

002a5890e Generated rtxp demo in netxduo/samples folder.
c09d9da51 Add function header in .h for RTP and RTSP
f5a96f35b Update function header and version for 6.3.0
0ff7a6809 Correct dhcpv6 server for ignoring lifetime fields in client request
9a2129c35 Fixed dhcpv6 server not update client record issue
e59d2b5f1 Fix dhcp coverage test compile wanrning
d00655d71 Fix infinite loop issue in TCP & UDP free port find function
c194c74ca Optimize rtp_sender and fix pipeline reported issues
b6df8dea0 Add RTxP feature
38e57e633 Added test case for _nx_snmp_utility_object_id_get().
321c88bd9 Added check for pdu length.
36ffb7c39 Fixed packet double release.
92166d736 Fixed SNMP test cases for v4_small_build
67f071552 Improved buffer length verification for padding.
30cc5d8b2 Fix wait option used in FTP test case
098a97213 Avoid duplicate packet release when DTLS send fails
15313e868 Improved buffer length verification for _nx_snmp_utility_object_id_set().
ecd3904d3 Fixed MSRC 81018
caa004007 Fix the logic of handling close notify packet from peer
2b8c87685 Removed main.c into netxduo/samples folder, then all addons can use it.
c72c66cdc Fixed MSARC 81019 and MSRC 81079
8169be7a6 Fixed MSRC81005 and MSRC81020
41389b76b Fixed packet double release issue in _nx_ftp_client_file_write
19348e408 Combined the functions of processing snmp v1 and v2.
9174b6457 Fixed icmpv6 ra buffer overwrite test case.
6bdc703d9 Fixed packet double release issue in _nx_nat_process_packet
403ecd128 Set nx_smtp_server_packet to NULL to avoided duplicate packet release in _nx_smtp_utility_read_server_code
af5dd00c6 Disable FTP server MSS test case when packet chain is disabled
beadbce12 Enable weekly pipeline build to avoid CodeQL expiration
5a3d88f97 Fixed MSRC 81528
df6a1fc57 unify the code.
18c13bfdb Fixed MSRC 80745.
2cce43f48 Fixed bug in utility/iperf/nx_iperf.c pointer used before set its value.
2477fb81c Update product owners
2f5734ada Fixed MSRC 80686
34e713e26 Fixed data length underflow when TCP MSS is less than 255
7097a7859 Improved the test cases for packet chain.
1ffa13cfa Fixed MSRC 80685
97e2b8d8e Set packet pointer to NULL after released to fix duplicate packet release issue
c1e47efa7 Fix ICMPv6 NS buffer overwrite issue.
c2770ea68 Add ICMPv6 NA buffer overwrite test case.
36bb05f85 Validated TCP header buffer to avoid span in multiple packets
84070bb2a Correct the length of packet buffer to avoid write overflow
5b3b3a10b Dropped packet chain for SNTP data to avoid write overflow
82699872d Onebranch build Image Update: Move pipelines to supported and compliant OneBranch container images
a30171f93 Add a test case to demonstrate IGMP override caused by IP assembly.
72472ff4b Fix MSRC 80746
5d9f1266a Corrected the acked packet count when out of order is enabled
b113ebdc9 Fixed DHCP server local variable type issue
b70863299 Enable codeql in onebranch pipeline

18 files changed, 214 insertions, 165 deletions

diff --git a/common/inc/nx_api.h b/common/inc/nx_api.h
index dba70712..12d88a57 100644
--- a/common/inc/nx_api.h
+++ b/common/inc/nx_api.h
@@ -26,7 +26,7 @@
 /*  APPLICATION INTERFACE DEFINITION                       RELEASE        */
 /*                                                                        */
 /*    nx_api.h                                            PORTABLE C      */
-/*                                                           6.x          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -100,9 +100,9 @@
 /*  03-08-2023     Tiejun Zhou              Modified comment(s), and      */
 /*                                            updated product constants,  */
 /*                                            resulting in version 6.2.1  */
-/*  xx-xx-xxxx     Tiejun Zhou              Modified comment(s),          */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
 /*                                            supported random IP id,     */
-/*                                            resulting in version 6.x    */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 
@@ -518,8 +518,8 @@ VOID _nx_trace_event_update(TX_TRACE_BUFFER_ENTRY *event, ULONG timestamp, ULONG
 /* Define basic constants for the NetX TCP/IP Stack.  */
 #define AZURE_RTOS_NETXDUO
 #define NETXDUO_MAJOR_VERSION                    6
-#define NETXDUO_MINOR_VERSION                    2
-#define NETXDUO_PATCH_VERSION                    1
+#define NETXDUO_MINOR_VERSION                    3
+#define NETXDUO_PATCH_VERSION                    0
 
 /* Define the following symbols for backward compatibility */
 #define EL_PRODUCT_NETXDUO
diff --git a/common/inc/nx_icmpv6.h b/common/inc/nx_icmpv6.h
index 15b2e196..0e517d7e 100644
--- a/common/inc/nx_icmpv6.h
+++ b/common/inc/nx_icmpv6.h
@@ -26,7 +26,7 @@
 /*  COMPONENT DEFINITION                                   RELEASE        */
 /*                                                                        */
 /*    nx_icmpv6.h                                         PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -44,6 +44,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 
@@ -255,24 +258,13 @@ typedef struct NX_ICMPV6_OPTION_PREFIX_STRUCT
 typedef struct NX_ICMPV6_OPTION_MTU_STRUCT
 {
 
-    /* prefix type. */
-    /*lint -esym(768,NX_ICMPV6_OPTION_MTU_STRUCT::nx_icmpv6_option_mtu_type) suppress member not referenced. It is used before type casting from NX_ICMPV6_OPTION. */
-    UCHAR nx_icmpv6_option_mtu_type;
-
-    /* option length. */
-    /*lint -esym(768,NX_ICMPV6_OPTION_MTU_STRUCT::nx_icmpv6_option_mtu_length) suppress member not referenced. It is used before type casting from NX_ICMPV6_OPTION. */
-    UCHAR nx_icmpv6_option_mtu_length;
-
-    /* Unused  */
-    /*lint -esym(768,NX_ICMPV6_OPTION_MTU_STRUCT::nx_icmpv6_option_mtu_reserved) suppress member not referenced. It is reserved for future use. */
-    USHORT nx_icmpv6_option_mtu_reserved;
+    /* General ICMPv6 header. */
+    /*lint -esym(768,NX_ICMPV6_OPTION_MTU_STRUCT::nx_icmpv6_option_mtu_icmpv6_header) suppress member not referenced. It is used before type casting from NX_ICMPV6_HEADER. */
+    NX_ICMPV6_HEADER nx_icmpv6_option_mtu_icmpv6_header;
 
     /* MTU length. */
     ULONG nx_icmpv6_option_mtu_path_mtu;
 
-    /* Pointer to the probe message (not the ICMPv6 header)
-       which for path MTU discovery. */
-    UCHAR *nx_icmpv6_option_mtu_message;
 } NX_ICMPV6_OPTION_MTU;
 
 /* Define the Router solicitation message type.  */
diff --git a/common/inc/nx_user_sample.h b/common/inc/nx_user_sample.h
index 2bc43017..7593d9fa 100644
--- a/common/inc/nx_user_sample.h
+++ b/common/inc/nx_user_sample.h
@@ -26,7 +26,7 @@
 /*  PORT SPECIFIC C INFORMATION                            RELEASE        */
 /*                                                                        */
 /*    nx_user.h                                           PORTABLE C      */
-/*                                                           6.x          */
+/*                                                           6.3.0        */
 /*                                                                        */
 /*  AUTHOR                                                                */
 /*                                                                        */
@@ -52,9 +52,9 @@
 /*                                            resulting in version 6.1.8  */
 /*  04-25-2022     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1.11 */
-/*  xx-xx-xxxx     Tiejun Zhou              Modified comment(s),          */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
 /*                                            supported random IP id,     */
-/*                                            resulting in version 6.x    */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 
diff --git a/common/src/nx_icmpv6_packet_process.c b/common/src/nx_icmpv6_packet_process.c
index 9d5c3f04..a55d84d0 100644
--- a/common/src/nx_icmpv6_packet_process.c
+++ b/common/src/nx_icmpv6_packet_process.c
@@ -46,7 +46,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_packet_process                           PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -96,6 +96,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID  _nx_icmpv6_packet_process(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -112,6 +115,19 @@ NX_IPV6_HEADER   *ipv6_header;
     /* Add debug information. */
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
+    /* Check packet length is at least sizeof(NX_ICMPV6_HEADER). */
+    if ((UINT)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) < sizeof(NX_ICMPV6_HEADER))
+    {
+#ifndef NX_DISABLE_ICMP_INFO
+
+        /* Increment the ICMP invalid packet error.  */
+        ip_ptr -> nx_ip_icmp_invalid_packets++;
+#endif
+
+        _nx_packet_release(packet_ptr);
+        return;
+    }
+
     /* Points to the ICMP message header.  */
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
     header_ptr =  (NX_ICMPV6_HEADER *)packet_ptr -> nx_packet_prepend_ptr;
diff --git a/common/src/nx_icmpv6_process_na.c b/common/src/nx_icmpv6_process_na.c
index acfd9452..f8e4f26a 100644
--- a/common/src/nx_icmpv6_process_na.c
+++ b/common/src/nx_icmpv6_process_na.c
@@ -43,7 +43,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_na                               PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -88,15 +88,16 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID _nx_icmpv6_process_na(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
 {
 
 ND_CACHE_ENTRY   *nd_entry = NX_NULL;
-
-/*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
-NX_ICMPV6_ND     *nd_ptr = (NX_ICMPV6_ND *)(packet_ptr -> nx_packet_prepend_ptr);
+NX_ICMPV6_ND     *nd_ptr;
 NX_ICMPV6_OPTION *option_ptr = NX_NULL;
 INT               error = 0;
 INT               lla_same = 0;
@@ -109,6 +110,29 @@ UINT              i;
     /* Add debug information. */
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
+#ifndef NX_DISABLE_RX_SIZE_CHECKING
+    /* Check packet length is at least sizeof(NX_ICMPV6_ND). */
+    if ((packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_ND))
+#ifndef NX_DISABLE_PACKET_CHAIN
+        || (packet_ptr -> nx_packet_next) /* Ignore chained packet.  */
+#endif /* NX_DISABLE_PACKET_CHAIN */
+        )
+    {
+#ifndef NX_DISABLE_ICMP_INFO
+
+        /* Increment the ICMP invalid packet error. */
+        ip_ptr -> nx_ip_icmp_invalid_packets++;
+#endif /* NX_DISABLE_ICMP_INFO */
+
+        /* Release the packet and we are done. */
+        _nx_packet_release(packet_ptr);
+        return;
+    }
+#endif /* NX_DISABLE_RX_SIZE_CHECKING */
+
+    /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
+    nd_ptr = (NX_ICMPV6_ND *)(packet_ptr -> nx_packet_prepend_ptr);
+
     /* Take care of endian-ness. */
     NX_IPV6_ADDRESS_CHANGE_ENDIAN(nd_ptr -> nx_icmpv6_nd_targetAddress);
     NX_CHANGE_ULONG_ENDIAN(nd_ptr -> nx_icmpv6_nd_flag);
diff --git a/common/src/nx_icmpv6_process_ns.c b/common/src/nx_icmpv6_process_ns.c
index 9cdc06f1..ca023b4e 100644
--- a/common/src/nx_icmpv6_process_ns.c
+++ b/common/src/nx_icmpv6_process_ns.c
@@ -44,7 +44,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_ns                               PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -89,6 +89,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID _nx_icmpv6_process_ns(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -125,6 +128,26 @@ ULONG             dest_address[4];
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
     ipv6_header = (NX_IPV6_HEADER *)packet_ptr -> nx_packet_ip_header;
 
+#ifndef NX_DISABLE_RX_SIZE_CHECKING
+    /* Check packet length is at least sizeof(NX_ICMPV6_ND). */
+    if ((packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_ND))
+#ifndef NX_DISABLE_PACKET_CHAIN
+        || (packet_ptr -> nx_packet_next) /* Ignore chained packet.  */
+#endif /* NX_DISABLE_PACKET_CHAIN */
+        )
+    {
+#ifndef NX_DISABLE_ICMP_INFO
+
+        /* Increment the ICMP invalid packet error. */
+        ip_ptr -> nx_ip_icmp_invalid_packets++;
+#endif /* NX_DISABLE_ICMP_INFO */
+
+        /* Release the packet and we are done. */
+        _nx_packet_release(packet_ptr);
+        return;
+    }
+#endif /* NX_DISABLE_RX_SIZE_CHECKING */
+
     /* Get a pointer to the Neighbor Discovery message. */
     /*lint -e{929} suppress cast of pointer to pointer, since it is necessary  */
     nd_ptr = (NX_ICMPV6_ND *)header_ptr;
diff --git a/common/src/nx_icmpv6_process_packet_too_big.c b/common/src/nx_icmpv6_process_packet_too_big.c
index 54e62c3a..fb30b859 100644
--- a/common/src/nx_icmpv6_process_packet_too_big.c
+++ b/common/src/nx_icmpv6_process_packet_too_big.c
@@ -45,7 +45,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_packet_too_big                   PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -87,6 +87,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT _nx_icmpv6_process_packet_too_big(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -105,7 +108,11 @@ NX_INTERFACE              *if_ptr;
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
 #ifndef NX_DISABLE_RX_SIZE_CHECKING
-    if (packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_OPTION_MTU))
+    if ((packet_ptr -> nx_packet_length < (sizeof(NX_ICMPV6_OPTION_MTU) + sizeof(NX_IPV6_HEADER)))
+#ifndef NX_DISABLE_PACKET_CHAIN
+        || (packet_ptr -> nx_packet_next) /* Ignore chained packet.  */
+#endif /* NX_DISABLE_PACKET_CHAIN */
+        )
     {
 #ifndef NX_DISABLE_ICMP_INFO
 
@@ -129,7 +136,7 @@ NX_INTERFACE              *if_ptr;
 
     /* Parse the original sender data. */
     /*lint -e{929} -e{826} -e{740} suppress cast of pointer to pointer, since it is necessary  */
-    original_ip_header_ptr = (NX_IPV6_HEADER *)(&(icmpv6_mtu_option_ptr ->  nx_icmpv6_option_mtu_message));
+    original_ip_header_ptr = (NX_IPV6_HEADER *)(packet_ptr -> nx_packet_prepend_ptr + sizeof(NX_ICMPV6_OPTION_MTU));
 
     /* Extract the original sender from the IP header. */
     packet_ptr -> nx_packet_prepend_ptr -= sizeof(NX_IPV6_HEADER);
diff --git a/common/src/nx_icmpv6_process_ra.c b/common/src/nx_icmpv6_process_ra.c
index 423576a1..6ae4de9b 100644
--- a/common/src/nx_icmpv6_process_ra.c
+++ b/common/src/nx_icmpv6_process_ra.c
@@ -37,7 +37,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_ra                               PORTABLE C      */
-/*                                                           6.1.11       */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -83,6 +83,9 @@
 /*                                            added internal ip address   */
 /*                                            change notification,        */
 /*                                            resulting in version 6.1.11 */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID _nx_icmpv6_process_ra(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -112,6 +115,26 @@ UINT                          interface_index;
     /* Add debug information. */
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
+    /* Check packet length is at least sizeof(NX_ICMPV6_RA). */
+#ifndef NX_DISABLE_RX_SIZE_CHECKING
+    if ((packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_RA))
+#ifndef NX_DISABLE_PACKET_CHAIN
+        || (packet_ptr -> nx_packet_next) /* Ignore chained packet.  */
+#endif /* NX_DISABLE_PACKET_CHAIN */
+        )
+    {
+#ifndef NX_DISABLE_ICMP_INFO
+
+        /* Increment the ICMP invalid message count.  */
+        ip_ptr -> nx_ip_icmp_invalid_packets++;
+#endif
+
+        /* Invalid ICMP message, just release it.  */
+        _nx_packet_release(packet_ptr);
+        return;
+    }
+#endif /* NX_DISABLE_RX_SIZE_CHECKING */
+
     /* Initialize the ND cache table entry to NULL */
     nd_entry = NX_NULL;
 
diff --git a/common/src/nx_icmpv6_process_redirect.c b/common/src/nx_icmpv6_process_redirect.c
index 8c42db68..43f50fa8 100644
--- a/common/src/nx_icmpv6_process_redirect.c
+++ b/common/src/nx_icmpv6_process_redirect.c
@@ -38,7 +38,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_icmpv6_process_redirect                         PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -83,6 +83,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Bo Chen                  Modified comment(s), improved */
+/*                                            packet length verification, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 
@@ -115,7 +118,11 @@ NX_IPV6_DESTINATION_ENTRY    *dest_entry_ptr;
     NX_PACKET_DEBUG(__FILE__, __LINE__, packet_ptr);
 
 #ifndef NX_DISABLE_RX_SIZE_CHECKING
-    if (packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_REDIRECT_MESSAGE))
+    if ((packet_ptr -> nx_packet_length < sizeof(NX_ICMPV6_REDIRECT_MESSAGE))
+#ifndef NX_DISABLE_PACKET_CHAIN
+        || (packet_ptr -> nx_packet_next) /* Ignore chained packet.  */
+#endif /* NX_DISABLE_PACKET_CHAIN */
+        )
     {
 #ifndef NX_DISABLE_ICMP_INFO
 
diff --git a/common/src/nx_igmp_packet_process.c b/common/src/nx_igmp_packet_process.c
index 4c11c0b2..914d5fad 100644
--- a/common/src/nx_igmp_packet_process.c
+++ b/common/src/nx_igmp_packet_process.c
@@ -28,6 +28,7 @@
 #include "nx_api.h"
 #include "nx_packet.h"
 #include "nx_igmp.h"
+#include "nx_ip.h"
 
 
 #ifndef NX_DISABLE_IPV4
@@ -36,7 +37,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_igmp_packet_process                             PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -76,6 +77,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
+/*                                            unified checksum calculate, */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID  _nx_igmp_packet_process(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -86,11 +90,6 @@ ULONG           update_time;
 NX_IGMP_HEADER *header_ptr;
 USHORT          max_update_time;
 ULONG           checksum;
-ULONG           length;
-UCHAR          *word_ptr;
-NX_PACKET      *current_packet;
-ULONG           long_temp;
-USHORT          short_temp;
 
 
     /* Add debug information. */
@@ -107,113 +106,9 @@ USHORT          short_temp;
 
 
         /* First verify the checksum is correct. */
-
-        /* Setup the length of the packet checksum.  */
-        length =  packet_ptr -> nx_packet_length;
-
-        /* Determine if we need to add a padding byte.  */
-        if (((length / sizeof(USHORT)) * sizeof(USHORT)) != length)
-        {
-
-            /* We have single byte alignment and we need two byte alignment.  */
-            length++;
-
-#ifndef NX_DISABLE_PACKET_CHAIN
-            /* Determine if there is a last packet pointer.  */
-            if (packet_ptr -> nx_packet_last)
-            {
-
-                /* Multi-packet message, add a zero byte at the end.  */
-                *((packet_ptr -> nx_packet_last) -> nx_packet_append_ptr) =  0;
-            }
-            else
-            {
-#endif
-
-                /* Write a zero byte at the end of the first and only packet.  */
-                *(packet_ptr -> nx_packet_append_ptr) =  0;
-#ifndef NX_DISABLE_PACKET_CHAIN
-            }
-#endif
-        }
-
-        /* Setup the pointer to the start of the packet.  */
-        word_ptr =  (UCHAR *)packet_ptr -> nx_packet_prepend_ptr;
-
-        /* Initialize the current packet to the input packet pointer.  */
-        current_packet =  packet_ptr;
-
-        checksum = 0;
-
-
-        /* Loop to calculate the checksum over the entire packet.  */
-        while (length)
-        {
-            /* Determine if there is at least one ULONG left.  */
-            if ((UINT)(current_packet -> nx_packet_append_ptr - word_ptr) >= sizeof(ULONG))
-            {
-
-                /* Pickup a whole ULONG.  */
-                long_temp =  *((ULONG *)word_ptr);
-
-                /* Add upper 16-bits into checksum.  */
-                checksum =  checksum + (long_temp >> NX_SHIFT_BY_16);
-
-                /* Check for carry bits.  */
-                if (checksum & NX_CARRY_BIT)
-                {
-                    checksum =  (checksum & NX_LOWER_16_MASK) + 1;
-                }
-
-                /* Add lower 16-bits into checksum.  */
-                checksum =  checksum + (long_temp & NX_LOWER_16_MASK);
-
-                /* Check for carry bits.  */
-
-                if (checksum & NX_CARRY_BIT)
-                {
-                    checksum =  (checksum & NX_LOWER_16_MASK) + 1;
-                }
-
-                /* Move the word pointer and decrease the length.  */
-                word_ptr =  word_ptr + sizeof(ULONG);
-                length = length - (ULONG)sizeof(ULONG);
-            }
-            else
-            {
-
-                /* Pickup the 16-bit word.  */
-                short_temp =  *((USHORT *)word_ptr);
-
-                /* Add next 16-bit word into checksum.  */
-                checksum =  checksum + short_temp;
-
-                /* Check for carry bits.  */
-                if (checksum & NX_CARRY_BIT)
-                {
-                    checksum =  (checksum & NX_LOWER_16_MASK) + 1;
-                }
-
-                /* Move the word pointer and decrease the length.  */
-                word_ptr =  word_ptr + sizeof(USHORT);
-                length = length - (ULONG)sizeof(USHORT);
-            }
-
-#ifndef NX_DISABLE_PACKET_CHAIN
-            /* Determine if we are at the end of the current packet.  */
-            if ((word_ptr >= (UCHAR *)current_packet -> nx_packet_append_ptr) &&
-                (current_packet -> nx_packet_next))
-            {
-
-                /* We have crossed the packet boundary.  Move to the next packet
-                   structure.  */
-                current_packet =  current_packet -> nx_packet_next;
-
-                /* Setup the new word pointer.  */
-                word_ptr =  (UCHAR *)current_packet -> nx_packet_prepend_ptr;
-            }
-#endif
-        }
+        checksum =  _nx_ip_checksum_compute(packet_ptr, NX_IP_IGMP,
+                                            (UINT)packet_ptr -> nx_packet_length,
+                                            NX_NULL, NX_NULL);
 
         checksum = ~checksum & NX_LOWER_16_MASK;
 
diff --git a/common/src/nx_ip_create.c b/common/src/nx_ip_create.c
index e4d82e8d..5f9a43f2 100644
--- a/common/src/nx_ip_create.c
+++ b/common/src/nx_ip_create.c
@@ -35,7 +35,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ip_create                                       PORTABLE C      */
-/*                                                           6.x          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -82,9 +82,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
-/*  xx-xx-xxxx     Tiejun Zhou              Modified comment(s),          */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
 /*                                            supported random IP id,     */
-/*                                            resulting in version 6.x    */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT  _nx_ip_create(NX_IP *ip_ptr, CHAR *name, ULONG ip_address, ULONG network_mask,
diff --git a/common/src/nx_ip_header_add.c b/common/src/nx_ip_header_add.c
index 1f401fbc..f0f65002 100644
--- a/common/src/nx_ip_header_add.c
+++ b/common/src/nx_ip_header_add.c
@@ -39,7 +39,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ip_header_add                                   PORTABLE C      */
-/*                                                           6.x          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -83,9 +83,9 @@
 /*  08-02-2021     Yuxin Zhou               Modified comment(s), and      */
 /*                                            supported TCP/IP offload,   */
 /*                                            resulting in version 6.1.8  */
-/*  xx-xx-xxxx     Tiejun Zhou              Modified comment(s),          */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
 /*                                            supported random IP id,     */
-/*                                            resulting in version 6.x    */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT  _nx_ip_header_add(NX_IP *ip_ptr, NX_PACKET *packet_ptr, ULONG source_ip, ULONG destination_ip,
diff --git a/common/src/nx_ipv4_packet_receive.c b/common/src/nx_ipv4_packet_receive.c
index f2e996a8..66b5deb6 100644
--- a/common/src/nx_ipv4_packet_receive.c
+++ b/common/src/nx_ipv4_packet_receive.c
@@ -37,7 +37,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ipv4_packet_receive                             PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -79,6 +79,10 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
+/*                                            validated packet length for */
+/*                                            fragments,                  */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID  _nx_ipv4_packet_receive(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -571,6 +575,21 @@ UINT            packet_consumed;
                 /* Yes, fragmenting is available.  Place the packet on the incoming
                    fragment queue.  */
 
+                /* Check packet length with more fragment bit. If not multiple of 8 bytes...  */
+                if ((ip_header_ptr -> nx_ip_header_word_1 & NX_IP_MORE_FRAGMENT) &&
+                    (((pkt_length  - (ULONG)sizeof(NX_IPV4_HEADER))  & 0x7) != 0))
+                {
+
+                    /* Invalid length.  Drop the packet.  */
+#ifndef NX_DISABLE_IP_INFO
+
+                    /* Increment the IP receive packets dropped count.  */
+                    ip_ptr -> nx_ip_receive_packets_dropped++;
+#endif
+                    _nx_packet_release(packet_ptr);
+                    return;
+                }
+
                 /* Disable interrupts.  */
                 TX_DISABLE
 
diff --git a/common/src/nx_ipv6_fragment_process.c b/common/src/nx_ipv6_fragment_process.c
index 57e6e71e..2114215f 100644
--- a/common/src/nx_ipv6_fragment_process.c
+++ b/common/src/nx_ipv6_fragment_process.c
@@ -39,7 +39,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_ipv6_fragment_process                           PORTABLE C      */
-/*                                                           6.x          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -84,9 +84,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
-/*  xx-xx-xxxx     Tiejun Zhou              Modified comment(s),          */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
 /*                                            supported random IP id,     */
-/*                                            resulting in version 6.x    */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID _nx_ipv6_fragment_process(struct NX_IP_DRIVER_STRUCT *driver_req_ptr, UINT mtu)
diff --git a/common/src/nx_tcp_free_port_find.c b/common/src/nx_tcp_free_port_find.c
index 5997831a..f194c8ea 100644
--- a/common/src/nx_tcp_free_port_find.c
+++ b/common/src/nx_tcp_free_port_find.c
@@ -34,7 +34,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_tcp_free_port_find                              PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -71,6 +71,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Haiqing Zhao             Modified comment(s), improved */
+/*                                            internal logic,             */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT  _nx_tcp_free_port_find(NX_IP *ip_ptr, UINT port, UINT *free_port_ptr)
@@ -175,6 +178,12 @@ ULONG                  trace_timestamp;
         if (port > NX_MAX_PORT)
         {
 
+            /* Jump out if the original port is ahead of the defined search start port. */
+            if (starting_port <= NX_SEARCH_PORT_START)
+            {
+                break;
+            }
+
             /* Yes, we need to wrap around.  */
             port =  NX_SEARCH_PORT_START;
         }
diff --git a/common/src/nx_tcp_packet_process.c b/common/src/nx_tcp_packet_process.c
index 31dbe41e..0d6bd566 100644
--- a/common/src/nx_tcp_packet_process.c
+++ b/common/src/nx_tcp_packet_process.c
@@ -44,7 +44,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_tcp_packet_process                              PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -92,6 +92,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Tiejun Zhou              Modified comment(s),          */
+/*                                            validated TCP header buffer,*/
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 VOID  _nx_tcp_packet_process(NX_IP *ip_ptr, NX_PACKET *packet_ptr)
@@ -215,6 +218,22 @@ ULONG                        rwin_scale = 0xFF;
         }
     }
 
+#ifndef NX_DISABLE_RX_SIZE_CHECKING
+    /* Make sure the TCP header is in the first packet.  */
+    if ((UINT)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) < sizeof(NX_TCP_HEADER))
+    {
+
+#ifndef NX_DISABLE_TCP_INFO
+        /* Increment the TCP invalid packet error.  */
+        ip_ptr -> nx_ip_tcp_invalid_packets++;
+#endif
+
+        /* Not supported.  */
+        _nx_packet_release(packet_ptr);
+        return;
+    }
+#endif /* NX_DISABLE_RX_SIZE_CHECKING */
+
     /* Pickup the pointer to the head of the TCP packet.  */
     /*lint -e{927} -e{826} suppress cast of pointer to pointer, since it is necessary  */
     tcp_header_ptr =  (NX_TCP_HEADER *)packet_ptr -> nx_packet_prepend_ptr;
@@ -232,7 +251,9 @@ ULONG                        rwin_scale = 0xFF;
 
 #ifndef NX_DISABLE_RX_SIZE_CHECKING
     /* Check for valid packet length.  */
-    if (((INT)option_words < 0) || (packet_ptr -> nx_packet_length < (sizeof(NX_TCP_HEADER) + (option_words << 2))))
+    if (((INT)option_words < 0) ||
+        ((UINT)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) <
+         (sizeof(NX_TCP_HEADER) + (option_words << 2))))
     {
 
 #ifndef NX_DISABLE_TCP_INFO
diff --git a/common/src/nx_tcp_socket_state_data_check.c b/common/src/nx_tcp_socket_state_data_check.c
index e23023d0..95b53c47 100644
--- a/common/src/nx_tcp_socket_state_data_check.c
+++ b/common/src/nx_tcp_socket_state_data_check.c
@@ -282,7 +282,7 @@ ULONG      work_length;
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_tcp_socket_state_data_check                     PORTABLE C      */
-/*                                                           6.2.0        */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -333,6 +333,9 @@ ULONG      work_length;
 /*  10-31-2022     Wenhui Xie               Modified comment(s), and      */
 /*                                            supported HTTP Proxy,       */
 /*                                            resulting in version 6.2.0  */
+/*  10-31-2023     Bo Chen                 Modified comment(s), corrected */
+/*                                            the acked packet count,     */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT  _nx_tcp_socket_state_data_check(NX_TCP_SOCKET *socket_ptr, NX_PACKET *packet_ptr)
@@ -925,6 +928,9 @@ NX_IP         *ip_ptr;
             if ((INT)(expected_sequence - search_begin_sequence) >= 0)
             {
 
+                /* Increment the acked packet count.  */
+                acked_packets++;
+
                 if ((INT)(search_end_sequence - expected_sequence) > 0)
                 {
                     /* Sequence number is within this packet.  Advance sequence number. */
@@ -932,8 +938,6 @@ NX_IP         *ip_ptr;
 
                     socket_ptr -> nx_tcp_socket_rx_sequence = expected_sequence;
 
-                    acked_packets++;
-
                     /* Mark this packet as ready for retrieval.  */
                     /*lint -e{923} suppress cast of ULONG to pointer.  */
                     search_ptr -> nx_packet_queue_next =  (NX_PACKET *)NX_PACKET_READY;
diff --git a/common/src/nx_udp_free_port_find.c b/common/src/nx_udp_free_port_find.c
index 4acadf0e..6df31e9d 100644
--- a/common/src/nx_udp_free_port_find.c
+++ b/common/src/nx_udp_free_port_find.c
@@ -34,7 +34,7 @@
 /*  FUNCTION                                               RELEASE        */
 /*                                                                        */
 /*    _nx_udp_free_port_find                              PORTABLE C      */
-/*                                                           6.1          */
+/*                                                           6.3.0        */
 /*  AUTHOR                                                                */
 /*                                                                        */
 /*    Yuxin Zhou, Microsoft Corporation                                   */
@@ -71,6 +71,9 @@
 /*  05-19-2020     Yuxin Zhou               Initial Version 6.0           */
 /*  09-30-2020     Yuxin Zhou               Modified comment(s),          */
 /*                                            resulting in version 6.1    */
+/*  10-31-2023     Haiqing Zhao             Modified comment(s), improved */
+/*                                            internal logic,             */
+/*                                            resulting in version 6.3.0  */
 /*                                                                        */
 /**************************************************************************/
 UINT  _nx_udp_free_port_find(NX_IP *ip_ptr, UINT port, UINT *free_port_ptr)
@@ -175,6 +178,12 @@ ULONG                  trace_timestamp;
         if (port > NX_MAX_PORT)
         {
 
+            /* Jump out if the original port is ahead of the defined search start port. */
+            if (starting_port <= NX_SEARCH_PORT_START)
+            {
+                break;
+            }
+
             /* Yes, we need to wrap around.  */
             port =  NX_SEARCH_PORT_START;
         }