Prepare 2.1.1 release

Signed-off-by: Axel Lin <axel.lin@ingics.com>
(cherry picked from commit 7bcf0d3334)

CHANGELOG

@@ -6,6 +6,45 @@ HISTORY
 
   * [Enter new changes just after this line - do not remove this line]
 
+(STABLE-2.1.1):
+
+  ++ Bugfixes:
+
+  2018-11-01: Joan Lledó
+  * sockets.c: fix bad assertion in lwip_poll_dec_sockets_used() (bug #54933)
+
+  2018-11-01: Dirk Ziegelmeier
+  * ip4.c: don't send 127.* to default netif (bug #54670)
+
+  2018-10-23: David Girault
+  * altcp_tls_mbedtls.c: fix use-after free (bug #54774)
+
+  2018-10-23: Ognjen Bjelica, Dirk Ziegelmeier
+  * snmp_scalar.c: Avoid NULL pointer dereference (bug #54886)
+
+  2018-10-23: Simon Goldschmidt
+  * Fix missing standard includes in multiple files
+
+  2018-10-17: Ivan Warren
+  * def.h: fix casting htonX and ntohX to u16_t (bug #54850)
+
+  2018-10-12: Simon Goldschmidt
+  * Revert "tcp_abandon: no need to buffer pcb->local_port" (fix that source port was 0 for RST
+    called when aborting a connection)
+
+  2018-10-11: Jonas Rabenstein
+  * tcp.c: tcp_recved: check for overflow and warn about too big values (patch #9699)              
+
+  2018-10-06: Joan Lledó
+  * sockets.c: alloc_socket(): Check for LWIP_SOCKET_POLL when setting select-
+    related variables (patch #9696)
+
+  2018-10-04: Spencer
+  * tcp.c: Update prev pointer when skipping entries in tcp_slowtmr (patch #9694)
+
+  2018-09-27: Martine Lenders
+  * lowpan6.c: Fix IEEE 802.15.4 address setting (bug #54749)
+
 (STABLE-2.1.0):
 
   ++ New features:

doc/doxygen/lwip.Doxyfile

@@ -38,7 +38,7 @@ PROJECT_NAME           = "lwIP"
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = "2.1.0"
+PROJECT_NUMBER         = "2.1.1"
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

src/Filelists.cmake

@@ -10,7 +10,7 @@
 
 set(LWIP_VERSION_MAJOR    "2")
 set(LWIP_VERSION_MINOR    "1")
-set(LWIP_VERSION_REVISION "0")
+set(LWIP_VERSION_REVISION "1")
 # LWIP_VERSION_RC is set to LWIP_RC_RELEASE for official releases
 # LWIP_VERSION_RC is set to LWIP_RC_DEVELOPMENT for Git versions
 # Numbers 1..31 are reserved for release candidates

src/api/sockets.c

@@ -522,14 +522,14 @@ alloc_socket(struct netconn *newconn, int accepted)
          after having marked it as used. */
       SYS_ARCH_UNPROTECT(lev);
       sockets[i].lastdata.pbuf = NULL;
-#if LWIP_SOCKET_SELECT
+#if LWIP_SOCKET_SELECT || LWIP_SOCKET_POLL
       LWIP_ASSERT("sockets[i].select_waiting == 0", sockets[i].select_waiting == 0);
       sockets[i].rcvevent   = 0;
       /* TCP sendbuf is empty, but the socket is not yet writable until connected
        * (unless it has been created by accept()). */
       sockets[i].sendevent  = (NETCONNTYPE_GROUP(newconn->type) == NETCONN_TCP ? (accepted != 0) : 1);
       sockets[i].errevent   = 0;
-#endif /* LWIP_SOCKET_SELECT */
+#endif /* LWIP_SOCKET_SELECT || LWIP_SOCKET_POLL */
       return i + LWIP_SOCKET_OFFSET;
     }
     SYS_ARCH_UNPROTECT(lev);
@@ -1305,7 +1305,7 @@ lwip_recvmsg(int s, struct msghdr *message, int flags)
     if ((message->msg_iov[i].iov_base == NULL) || ((ssize_t)message->msg_iov[i].iov_len <= 0) ||
         ((size_t)(ssize_t)message->msg_iov[i].iov_len != message->msg_iov[i].iov_len) ||
         ((ssize_t)(buflen + (ssize_t)message->msg_iov[i].iov_len) <= 0)) {
-      sock_set_errno(sock, ERR_VAL);
+      sock_set_errno(sock, err_to_errno(ERR_VAL));
       done_socket(sock);
       return -1;
     }
@@ -2304,7 +2304,6 @@ lwip_poll_dec_sockets_used(struct pollfd *fds, nfds_t nfds)
     /* Go through each struct pollfd in the array. */
     for (fdi = 0; fdi < nfds; fdi++) {
       struct lwip_sock *sock = tryget_socket_unconn_nouse(fds[fdi].fd);
-      LWIP_ASSERT("socket gone at the end of select", sock != NULL);
       if (sock != NULL) {
         done_socket(sock);
       }

src/apps/altcp_tls/altcp_tls_mbedtls.c

@@ -40,17 +40,15 @@
  *   track of the ratio of application data and TLS overhead would be too much.
  *
  * Mandatory security-related configuration:
- * - define ALTCP_MBEDTLS_RNG_FN to a custom GOOD rng function returning 0 on success:
- *   int my_rng_fn(void *ctx, unsigned char *buffer , size_t len)
+ * - define ALTCP_MBEDTLS_RNG_FN to mbedtls_entropy_func to use the standard mbedTLS
+ *   entropy and ensure to add at least one strong entropy source to your mbedtls port
+ *   (implement mbedtls_platform_entropy_poll or mbedtls_hardware_poll providing strong
+ *   entropy)
  * - define ALTCP_MBEDTLS_ENTROPY_PTR and ALTCP_MBEDTLS_ENTROPY_LEN to something providing
  *   GOOD custom entropy
  *
  * Missing things / @todo:
- * - RX data is acknowledged after receiving (tcp_recved is called when enqueueing
- *   the pbuf for mbedTLS receive, not when processed by mbedTLS or the inner
- *   connection; altcp_recved() from inner connection does nothing)
- * - Client connections starting with 'connect()' are not handled yet...
- * - some unhandled things are caught by LWIP_ASSERTs...
+ * - some unhandled/untested things migh be caught by LWIP_ASSERTs...
  */
 
 #include "lwip/opt.h"
@@ -309,17 +307,20 @@ altcp_mbedtls_pass_rx_data(struct altcp_pcb *conn, altcp_mbedtls_state_t *state)
   LWIP_ASSERT("state != NULL", state != NULL);
   buf = state->rx_app;
   if (buf) {
+    state->rx_app = NULL;
     if (conn->recv) {
-      u16_t tot_len = state->rx_app->tot_len;
+      u16_t tot_len = buf->tot_len;
       /* this needs to be increased first because the 'recved' call may come nested */
       state->rx_passed_unrecved += tot_len;
       state->flags |= ALTCP_MBEDTLS_FLAGS_UPPER_CALLED;
-      err = conn->recv(conn->arg, conn, state->rx_app, ERR_OK);
+      err = conn->recv(conn->arg, conn, buf, ERR_OK);
       if (err != ERR_OK) {
         if (err == ERR_ABRT) {
           return ERR_ABRT;
         }
         /* not received, leave the pbuf(s) queued (and decrease 'unrecved' again) */
+        LWIP_ASSERT("state == conn->state", state == conn->state);
+        state->rx_app = buf;
         state->rx_passed_unrecved -= tot_len;
         LWIP_ASSERT("state->rx_passed_unrecved >= 0", state->rx_passed_unrecved >= 0);
         if (state->rx_passed_unrecved < 0) {
@@ -330,7 +331,6 @@ altcp_mbedtls_pass_rx_data(struct altcp_pcb *conn, altcp_mbedtls_state_t *state)
     } else {
       pbuf_free(buf);
     }
-    state->rx_app = NULL;
   } else if ((state->flags & (ALTCP_MBEDTLS_FLAGS_RX_CLOSE_QUEUED | ALTCP_MBEDTLS_FLAGS_RX_CLOSED)) ==
              ALTCP_MBEDTLS_FLAGS_RX_CLOSE_QUEUED) {
     state->flags |= ALTCP_MBEDTLS_FLAGS_RX_CLOSED;
@@ -339,6 +339,11 @@ altcp_mbedtls_pass_rx_data(struct altcp_pcb *conn, altcp_mbedtls_state_t *state)
     }
   }
 
+  /* application may have close the connection */
+  if (conn->state != state) {
+    /* return error code to ensure altcp_mbedtls_handle_rx_appldata() exits the loop */
+    return ERR_CLSD;
+  }
   return ERR_OK;
 }
 
@@ -635,12 +640,13 @@ altcp_tls_context(struct altcp_pcb *conn)
 static void
 altcp_mbedtls_debug(void *ctx, int level, const char *file, int line, const char *str)
 {
-  LWIP_UNUSED_ARG(str);
+  LWIP_UNUSED_ARG(ctx);
   LWIP_UNUSED_ARG(level);
   LWIP_UNUSED_ARG(file);
   LWIP_UNUSED_ARG(line);
-  LWIP_UNUSED_ARG(ctx);
-  /* @todo: output debug string :-) */
+  LWIP_UNUSED_ARG(str);
+
+  LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("%s:%04d: %s", file, line, str));
 }
 #endif
 
@@ -673,7 +679,7 @@ altcp_tls_create_config(int is_server, int have_cert, int have_pkey, int have_ca
 
   if (TCP_WND < MBEDTLS_SSL_MAX_CONTENT_LEN) {
     LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS,
-      ("altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!\n"));
+      ("altcp_tls: TCP_WND is smaller than the RX decryption buffer, connection RX might stall!\n"));
   }
 
   altcp_mbedtls_mem_init();

src/apps/http/altcp_proxyconnect.c

@@ -51,6 +51,8 @@
 #include "lwip/mem.h"
 #include "lwip/init.h"
 
+#include <stdio.h>
+
 /** This string is passed in the HTTP header as "User-Agent: " */
 #ifndef ALTCP_PROXYCONNECT_CLIENT_AGENT
 #define ALTCP_PROXYCONNECT_CLIENT_AGENT "lwIP/" LWIP_VERSION_STRING " (http://savannah.nongnu.org/projects/lwip)"

src/apps/http/http_client.c

@@ -55,6 +55,7 @@
 #include "lwip/init.h"
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 
 #if LWIP_TCP && LWIP_CALLBACK_API

src/apps/snmp/snmp_scalar.c

@@ -193,28 +193,40 @@ snmp_scalar_array_get_next_instance(const u32_t *root_oid, u8_t root_oid_len, st
 static s16_t
 snmp_scalar_array_get_value(struct snmp_node_instance *instance, void *value)
 {
+  s16_t result = -1;
   const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
   const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;
 
-  return array_node->get_value(array_node_def, value);
+  if (array_node->get_value != NULL) {
+    result = array_node->get_value(array_node_def, value);
+  }
+  return result;
 }
 
 static snmp_err_t
 snmp_scalar_array_set_test(struct snmp_node_instance *instance, u16_t value_len, void *value)
 {
+  snmp_err_t result = SNMP_ERR_NOTWRITABLE;
   const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
   const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;
 
-  return array_node->set_test(array_node_def, value_len, value);
+  if (array_node->set_test != NULL) {
+    result = array_node->set_test(array_node_def, value_len, value);
+  }
+  return result;
 }
 
 static snmp_err_t
 snmp_scalar_array_set_value(struct snmp_node_instance *instance, u16_t value_len, void *value)
 {
+  snmp_err_t result = SNMP_ERR_NOTWRITABLE;
   const struct snmp_scalar_array_node *array_node = (const struct snmp_scalar_array_node *)(const void *)instance->node;
   const struct snmp_scalar_array_node_def *array_node_def = (const struct snmp_scalar_array_node_def *)instance->reference.const_ptr;
 
-  return array_node->set_value(array_node_def, value_len, value);
+  if (array_node->set_value != NULL) {
+    result = array_node->set_value(array_node_def, value_len, value);
+  }
+  return result;
 }
 
 #endif /* LWIP_SNMP */

src/apps/snmp/snmp_threadsync.c

@@ -55,7 +55,11 @@ threadsync_get_value_synced(void *ctx)
 {
   struct threadsync_data *call_data = (struct threadsync_data *)ctx;
 
-  call_data->retval.s16 = call_data->proxy_instance.get_value(&call_data->proxy_instance, call_data->arg1.value);
+  if (call_data->proxy_instance.get_value != NULL) {
+    call_data->retval.s16 = call_data->proxy_instance.get_value(&call_data->proxy_instance, call_data->arg1.value);
+  } else {
+    call_data->retval.s16 = -1;
+  }
 
   sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }
@@ -76,7 +80,11 @@ threadsync_set_test_synced(void *ctx)
 {
   struct threadsync_data *call_data = (struct threadsync_data *)ctx;
 
-  call_data->retval.err = call_data->proxy_instance.set_test(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  if (call_data->proxy_instance.set_test != NULL) {
+    call_data->retval.err = call_data->proxy_instance.set_test(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  } else {
+    call_data->retval.err = SNMP_ERR_NOTWRITABLE;
+  }
 
   sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }
@@ -98,7 +106,11 @@ threadsync_set_value_synced(void *ctx)
 {
   struct threadsync_data *call_data = (struct threadsync_data *)ctx;
 
-  call_data->retval.err = call_data->proxy_instance.set_value(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  if (call_data->proxy_instance.set_value != NULL) {
+    call_data->retval.err = call_data->proxy_instance.set_value(&call_data->proxy_instance, call_data->arg2.len, call_data->arg1.value);
+  } else {
+    call_data->retval.err = SNMP_ERR_NOTWRITABLE;
+  }
 
   sys_sem_signal(&call_data->threadsync_node->instance->sem);
 }

src/core/ipv4/ip4.c

@@ -214,7 +214,7 @@ ip4_route(const ip4_addr_t *dest)
 #endif /* !LWIP_SINGLE_NETIF */
 
   if ((netif_default == NULL) || !netif_is_up(netif_default) || !netif_is_link_up(netif_default) ||
-      ip4_addr_isany_val(*netif_ip4_addr(netif_default))) {
+      ip4_addr_isany_val(*netif_ip4_addr(netif_default)) || ip4_addr_isloopback(dest)) {
     /* No matching netif found and default netif is not usable.
        If this is not good enough for you, use LWIP_HOOK_IP4_ROUTE() */
     LWIP_DEBUGF(IP_DEBUG | LWIP_DBG_LEVEL_SERIOUS, ("ip4_route: No route to %"U16_F".%"U16_F".%"U16_F".%"U16_F"\n",

src/core/tcp.c

@@ -583,6 +583,7 @@ tcp_abandon(struct tcp_pcb *pcb, int reset)
     tcp_free(pcb);
   } else {
     int send_rst = 0;
+    u16_t local_port = 0;
     enum tcp_state last_state;
     seqno = pcb->snd_nxt;
     ackno = pcb->rcv_nxt;
@@ -597,6 +598,7 @@ tcp_abandon(struct tcp_pcb *pcb, int reset)
       }
     } else {
       send_rst = reset;
+      local_port = pcb->local_port;
       TCP_PCB_REMOVE_ACTIVE(pcb);
     }
     if (pcb->unacked != NULL) {
@@ -613,7 +615,7 @@ tcp_abandon(struct tcp_pcb *pcb, int reset)
     tcp_backlog_accepted(pcb);
     if (send_rst) {
       LWIP_DEBUGF(TCP_RST_DEBUG, ("tcp_abandon: sending RST\n"));
-      tcp_rst(pcb, seqno, ackno, &pcb->local_ip, &pcb->remote_ip, pcb->local_port, pcb->remote_port);
+      tcp_rst(pcb, seqno, ackno, &pcb->local_ip, &pcb->remote_ip, local_port, pcb->remote_port);
     }
     last_state = pcb->state;
     tcp_free(pcb);
@@ -966,6 +968,7 @@ void
 tcp_recved(struct tcp_pcb *pcb, u16_t len)
 {
   u32_t wnd_inflation;
+  tcpwnd_size_t rcv_wnd;
 
   LWIP_ASSERT_CORE_LOCKED();
 
@@ -975,10 +978,8 @@ tcp_recved(struct tcp_pcb *pcb, u16_t len)
   LWIP_ASSERT("don't call tcp_recved for listen-pcbs",
               pcb->state != LISTEN);
 
-  pcb->rcv_wnd = (tcpwnd_size_t)(pcb->rcv_wnd + len);
-  if (pcb->rcv_wnd > TCP_WND_MAX(pcb)) {
-    pcb->rcv_wnd = TCP_WND_MAX(pcb);
-  } else if (pcb->rcv_wnd == 0) {
+  rcv_wnd = pcb->rcv_wnd + len;
+  if (rcv_wnd < pcb->rcv_wnd || (len != 0 && rcv_wnd == pcb->rcv_wnd)) {
     /* rcv_wnd overflowed */
     if (TCP_STATE_IS_CLOSING(pcb->state)) {
       /* In passive close, we allow this, since the FIN bit is added to rcv_wnd
@@ -988,6 +989,12 @@ tcp_recved(struct tcp_pcb *pcb, u16_t len)
     } else {
       LWIP_ASSERT("tcp_recved: len wrapped rcv_wnd\n", 0);
     }
+  } else if (rcv_wnd <= TCP_WND_MAX(pcb)) {
+    pcb->rcv_wnd = rcv_wnd;
+  } else {
+    LWIP_ASSERT("tcp_recved: len overflowed TCP_WND_MAX",
+		rcv_wnd <= TCP_WND_MAX(pcb));
+    pcb->rcv_wnd = TCP_WND_MAX(pcb);
   }
 
   wnd_inflation = tcp_update_rcv_ann_wnd(pcb);
@@ -1219,6 +1226,7 @@ tcp_slowtmr_start:
     LWIP_ASSERT("tcp_slowtmr: active pcb->state != TIME-WAIT\n", pcb->state != TIME_WAIT);
     if (pcb->last_timer == tcp_timer_ctr) {
       /* skip this pcb, we have already processed it */
+      prev = pcb;
       pcb = pcb->next;
       continue;
     }

src/include/lwip/def.h

@@ -83,14 +83,14 @@ extern "C" {
 #endif
 
 #if BYTE_ORDER == BIG_ENDIAN
-#define lwip_htons(x) (x)
-#define lwip_ntohs(x) (x)
-#define lwip_htonl(x) (x)
-#define lwip_ntohl(x) (x)
-#define PP_HTONS(x) (x)
-#define PP_NTOHS(x) (x)
-#define PP_HTONL(x) (x)
-#define PP_NTOHL(x) (x)
+#define lwip_htons(x) ((u16_t)(x))
+#define lwip_ntohs(x) ((u16_t)(x))
+#define lwip_htonl(x) ((u32_t)(x))
+#define lwip_ntohl(x) ((u32_t)(x))
+#define PP_HTONS(x)   ((u16_t)(x))
+#define PP_NTOHS(x)   ((u16_t)(x))
+#define PP_HTONL(x)   ((u32_t)(x))
+#define PP_NTOHL(x)   ((u32_t)(x))
 #else /* BYTE_ORDER != BIG_ENDIAN */
 #ifndef lwip_htons
 u16_t lwip_htons(u16_t x);

src/include/lwip/err.h

@@ -49,14 +49,6 @@ extern "C" {
  * @{
  */
 
-/** Define LWIP_ERR_T in cc.h if you want to use
- *  a different type for your platform (must be signed). */
-#ifdef LWIP_ERR_T
-typedef LWIP_ERR_T err_t;
-#else /* LWIP_ERR_T */
-typedef s8_t err_t;
-#endif /* LWIP_ERR_T*/
-
 /** Definitions for error constants. */
 typedef enum {
 /** No error, everything OK. */
@@ -96,6 +88,14 @@ typedef enum {
   ERR_ARG        = -16
 } err_enum_t;
 
+/** Define LWIP_ERR_T in cc.h if you want to use
+ *  a different type for your platform (must be signed). */
+#ifdef LWIP_ERR_T
+typedef LWIP_ERR_T err_t;
+#else /* LWIP_ERR_T */
+typedef s8_t err_t;
+#endif /* LWIP_ERR_T*/
+
 /**
  * @}
  */

src/include/lwip/init.h

@@ -54,7 +54,7 @@ extern "C" {
 /** x.X.x: Minor version of the stack */
 #define LWIP_VERSION_MINOR      1
 /** x.x.X: Revision of the stack */
-#define LWIP_VERSION_REVISION   0
+#define LWIP_VERSION_REVISION   1
 /** For release candidates, this is set to 1..254
   * For official releases, this is set to 255 (LWIP_RC_RELEASE)
   * For development versions (Git), this is set to 0 (LWIP_RC_DEVELOPMENT) */

src/netif/lowpan6.c

@@ -630,11 +630,11 @@ lowpan6_output(struct netif *netif, struct pbuf *q, const ip6_addr_t *ip6addr)
   }
 
   /* Send out the packet using the returned hardware address. */
-  result = lowpan6_hwaddr_to_addr(netif, &dest);
-  if (result != ERR_OK) {
-    MIB2_STATS_NETIF_INC(netif, ifoutdiscards);
-    return result;
-  }
+  dest.addr_len = netif->hwaddr_len;
+  /* XXX: Inferring the length of the source address from the destination address
+   * is not correct for IEEE 802.15.4, but currently we don't get this information
+   * from the neighbor cache */
+  SMEMCPY(dest.addr, hwaddr, netif->hwaddr_len);
   MIB2_STATS_NETIF_INC(netif, ifoutucastpkts);
   return lowpan6_frag(netif, q, &src, &dest);
 }

src/netif/ppp/pppos.c

@@ -482,7 +482,7 @@ pppos_input(ppp_pcb *ppp, u8_t *s, int l)
   u8_t cur_char;
   u8_t escaped;
   PPPOS_DECL_PROTECT(lev);
-#if PPP_INPROC_IRQ_SAFE
+#if !PPP_INPROC_IRQ_SAFE
   LWIP_ASSERT_CORE_LOCKED();
 #endif
 

test/unit/mqtt/test_mqtt.c

@@ -94,6 +94,8 @@ START_TEST(basic_connect)
   p = pbuf_alloc(PBUF_RAW, sizeof(rxbuf), PBUF_REF);
   fail_unless(p != NULL);
   p->payload = rxbuf;
+  /* since we hack the rx path, we have to hack the rx window, too: */
+  client->conn->rcv_wnd -= p->tot_len;
   if (client->conn->recv(client->conn->callback_arg, client->conn, p, ERR_OK) != ERR_OK) {
     pbuf_free(p);
   }

test/unit/tcp/test_tcp.c

@@ -330,6 +330,53 @@ START_TEST(test_tcp_passive_close)
 }
 END_TEST
 
+START_TEST(test_tcp_active_abort)
+{
+  struct test_tcp_counters counters;
+  struct tcp_pcb* pcb;
+  char data = 0x0f;
+  struct netif netif;
+  struct test_tcp_txcounters txcounters;
+  LWIP_UNUSED_ARG(_i);
+
+  memset(&txcounters, 0, sizeof(txcounters));
+
+  /* initialize local vars */
+  test_tcp_init_netif(&netif, &txcounters, &test_local_ip, &test_netmask);
+
+  /* initialize counter struct */
+  memset(&counters, 0, sizeof(counters));
+  counters.expected_data_len = 1;
+  counters.expected_data = &data;
+
+  /* create and initialize the pcb */
+  pcb = test_tcp_new_counters_pcb(&counters);
+  EXPECT_RET(pcb != NULL);
+  tcp_set_state(pcb, ESTABLISHED, &test_local_ip, &test_remote_ip, TEST_LOCAL_PORT, TEST_REMOTE_PORT);
+
+  /* abort the pcb */
+  EXPECT_RET(txcounters.num_tx_calls == 0);
+  txcounters.copy_tx_packets = 1;
+  tcp_abort(pcb);
+  txcounters.copy_tx_packets = 0;
+  EXPECT(txcounters.num_tx_calls == 1);
+  EXPECT(txcounters.num_tx_bytes == 40U);
+  EXPECT(txcounters.tx_packets != NULL);
+  if (txcounters.tx_packets != NULL) {
+    u16_t ret;
+    struct tcp_hdr tcphdr;
+    ret = pbuf_copy_partial(txcounters.tx_packets, &tcphdr, 20, 20);
+    EXPECT(ret == 20);
+    EXPECT(tcphdr.dest == PP_HTONS(TEST_REMOTE_PORT));
+    EXPECT(tcphdr.src == PP_HTONS(TEST_LOCAL_PORT));
+    pbuf_free(txcounters.tx_packets);
+    txcounters.tx_packets = NULL;
+  }
+
+  /* don't free the pcb here (part of the test!) */
+}
+END_TEST
+
 /** Check that we handle malformed tcp headers, and discard the pbuf(s) */
 START_TEST(test_tcp_malformed_header)
 {
@@ -1627,6 +1674,7 @@ tcp_suite(void)
     TESTFUNC(test_tcp_recv_inseq),
     TESTFUNC(test_tcp_recv_inseq_trim),
     TESTFUNC(test_tcp_passive_close),
+    TESTFUNC(test_tcp_active_abort),
     TESTFUNC(test_tcp_malformed_header),
     TESTFUNC(test_tcp_fast_retx_recover),
     TESTFUNC(test_tcp_fast_rexmit_wraparound),