Reject zero-length TCP messages to prevent connection slot abuse (#71942) (#72383)

* Reject zero-length TCP messages to prevent connection slot abuse

Zero-length messages (4-byte header of all zeros) were silently
accepted as valid, keeping the connection alive. An attacker could
hold all TCP connection slots (default: 4) indefinitely by sending
just 4 zero bytes per probe, blocking legitimate CASE sessions.

Reject zero-length messages and close the connection, since no valid
Matter message has zero payload length.



* Address review: remove redundant CloseConnectionInternal, fix test

- Remove explicit CloseConnectionInternal call since the caller
  (OnDataReceived) already handles connection closure on error return
- Update test to expect CHIP_ERROR_INVALID_MESSAGE_LENGTH for
  zero-length messages



* Retrigger CI (REPL timeout)

* Retrigger CI

---------



(cherry picked from commit 0e0a4aa)

Co-authored-by: Justin Wood <woody@apple.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Robert Szewczyk <szewczyk@google.com>

Author: 4 people

src/transport/raw/TCP.cpp

@@ -347,8 +347,10 @@ CHIP_ERROR TCPBase::ProcessReceivedBuffer(Inet::TCPEndPoint * endPoint, const Pe
 
         if (messageSize == 0)
         {
-            // No payload but considered a valid message. Return success to keep the connection alive.
-            return CHIP_NO_ERROR;
+            // Zero-length messages are not valid Matter messages. Reject to
+            // prevent attackers from holding TCP connection slots indefinitely.
+            ChipLogError(Inet, "Received zero-length TCP message, closing connection.");
+            return CHIP_ERROR_INVALID_MESSAGE_LENGTH;
         }
 
         ReturnErrorOnFailure(ProcessSingleMessage(peerAddress, state, messageSize));

src/transport/raw/tests/TestTCP.cpp

@@ -696,11 +696,11 @@ TEST_F(TestTCP, CheckProcessReceivedBuffer)
     TestData testData[2];
     gMockTransportMgrDelegate.SetCallback(TestDataCallbackCheck, testData);
 
-    // Test a single packet buffer with zero message size.
+    // Test a single packet buffer with zero message size - should be rejected.
     System::PacketBufferHandle buf = System::PacketBufferHandle::NewWithData(messageSize_TEST, 4);
     ASSERT_NE(&buf, nullptr);
     err = TestAccess::ProcessReceivedBuffer(tcp, lEndPoint, lPeerAddress, std::move(buf));
-    EXPECT_EQ(err, CHIP_NO_ERROR);
+    EXPECT_EQ(err, CHIP_ERROR_INVALID_MESSAGE_LENGTH);
 
     // Test a single packet buffer.
     gMockTransportMgrDelegate.mReceiveHandlerCallCount = 0;