Various hardening fixes

[gasbytes]

• ed23a84 - drop non-rst segments that arrive without a timestamp option on a conenction where timestamps were negotiated
• 3db744f - release the tcp socket slot when closing a socket that never left TCP_CLOSED
• a43d0fb - drop packets whose ipv4 option list contains an option with a length below the two-bytes minimum
• 90df38b - release the DHCP-learned DNS server along with the address, mask and gateway when a lease is lost
• 5fed382 - re-notify the ethernet-layer filter after the 802.1Q tag is tripped so L2 policy keyed on the vlan sub-interface index or the inner ethertype can match, instead of only ever seeing the parent interface and the 0x8100 TPID
• 03037d2 - connect the dns query socket to the configured resolver so the UDP demux drops replies that did not come from the server's port 53 (RFC 1035 section 4.2.1)
• eded7c3 - Add bytes offset tracking in parse_http_request when parsing header lines
• 93b91f3 - verify the DNS response question section against the outstanding query (per RFC 1035 section 7.3)
• 6749cf6 - do not forward datagrams received as link-layer broadcast or multicast per RFC 1812 section 5.3.4

[Copilot]

Pull request overview

This PR delivers a set of TCP/IP stack hardening fixes across TCP, IPv4 option parsing/forwarding, DHCP/DNS behavior, VLAN filter visibility, and HTTP request parsing, with accompanying regression/unit tests.

Changes:

• Tighten protocol validation and forwarding behavior (TCP PAWS TSopt enforcement, IPv4 option length hard-drop, no forwarding of L2 broadcast/multicast frames).
• Improve socket/resource lifecycle correctness (free TCP slot on close from TCP_CLOSED, preserve “pinned” DNS across DHCP lease loss, VLAN eth-filter re-notify after tag strip).
• Strengthen DNS/HTTP parsing security and correctness (connect DNS socket to resolver, verify DNS question section, fix HTTP header accumulation and add standalone regression test).

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/wolfip.c	Core hardening changes across TCP input, socket close, DHCP/DNS handling, IPv4 option parsing/forwarding, VLAN filter notifications, and DNS query validation.
src/http/httpd.c	Fix header accumulation logic in parse_http_request by tracking an offset while copying header lines.
src/test/test_http_headers.c	New standalone regression test ensuring all HTTP headers are preserved in req.headers without overwrite/overflow.
src/test/unit/unit.c	Registers new/updated unit tests covering the new hardening behaviors.
src/test/unit/unit_shared.c	Adds DNS test helpers (arm_dns_query) and shared wire-format QNAME constants.
src/test/unit/unit_tests_api.c	Adds regression test ensuring undersized IPv4 options can’t hide source-route options from local delivery.
src/test/unit/unit_tests_proto.c	Adds regression test ensuring undersized IPv4 options can’t hide source-route options from forwarding path.
src/test/unit/unit_tests_ip_arp_recv.c	Adds forwarding regression test: never forward frames received as L2 broadcast; updates malformed-option test expectation to “drop”.
src/test/unit/unit_tests_tcp_ack.c	Updates DNS tests to arm query buffer correctly for new DNS question verification behavior.
src/test/unit/unit_tests_dns_edges.c	Updates DNS edge tests to use arm_dns_query to match new question verification.
src/test/unit/unit_tests_dns_dhcp.c	Updates TCP close tests (slot freed on TCP_CLOSED) and DNS tests to use arm_dns_query; adds new TCP close coverage.
src/test/unit/unit_tests_dhcp_edges.c	Adds DHCP tests verifying DNS server is released/relearned on lease loss, but pinned DNS persists.
src/test/unit/unit_tests_vlan.c	Adds VLAN eth-filter visibility tests (parent + subif notifications) and enforcement test blocking ARP learning via subif filter.
Makefile	Adds build/test-http-headers target to the standalone test suite.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #148

Scan targets checked: wolfip-bugs, wolfip-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🟠 [Medium] L2-broadcast/multicast forwarding skip also bypasses RPF/anti-spoof checks · Missing input validation

l2_group is meant only to stop forwarding of L2 broadcast/multicast frames (RFC 1812 5.3.4), but it also disables the entire !is_local block, skipping the martian-source, self-spoof, and strict-RPF checks so a spoofed-source packet reaches local dispatch (tcp_input/udp_try_recv/icmp_input) unfiltered whenever it arrives as an L2 broadcast/multicast frame with a non-local IP destination.

Fix: Keep the RPF/martian/self-spoof checks unconditional and use l2_group only to skip the forwarding attempt itself, not the whole validation block.