Fix channel closing race condition bug

[adfoster-r7]

Problem:
The windows meterpreter test/socket_channels tests would fail 90% of the time - either freezing indefinitely, or sending wrong use-after-free values back to msfconsole for channel closes - i.e. the close channel id was expected to be 4, but it could be 1960858576 in some scenarios

Fixes:

• A race condition/use after free between channel closes across two threads:
  • Thread A — the scheduler waitable thread running tcp_channel_client_local_notify detects the local peer closed the socket (recv() == 0)
  • Thread B — the packet dispatcher thread processing an inbound core_channel_close request from the framework, which calls channel_destroy -> tcp_channel_client_close
• Previously the channel id was being used as the buffer length
• When there were issues during compilation, we'd just silently continue and ship the broken gem

Tests:

• Run full test suite: Update metasploit payloads gem metasploit-framework#21665
• Tested by running the failing windows tests 400 times in a row: Debug c2 errors metasploit-framework#21664

[Copilot]

Pull request overview

This PR targets a Windows-specific stability/correctness issue in Meterpreter’s channel/socket handling, and makes the build Rake tasks fail fast when underlying commands fail.

Changes:

• Make win_compile and java_compile abort the Rake run when make.bat/mvn fails.
• Fix channel_write to send TLV_TYPE_LENGTH as the actual buffer length (instead of the channel id).
• Add additional TCP/channel debug logging and mitigate a TCP client close race by nulling the channel pointer before teardown.

Impact Analysis:

• Blast radius: high; the channel_write TLV payload is part of the core Meterpreter wire contract and affects any consumer interpreting write acknowledgements, plus TCP channel teardown on Windows (direct) and any features built atop it (transitive).
• Data and contract effects: TLV_TYPE_LENGTH now correctly represents byte length, changing on-the-wire semantics from incorrect to correct; this should fix downstream parsing/logic that relies on TLV_TYPE_LENGTH for writes.
• Rollback and test focus: rollback is straightforward (code-only), but validation should focus on Windows TCP channel open/write/close flows, write completion callbacks that consume TLV_TYPE_LENGTH, and repeated connect/disconnect scenarios that previously reproduced the race.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
gem/Rakefile	Abort Rake tasks when Windows/Java build commands fail.
c/meterpreter/source/metsrv/channel.c	Fix TLV_TYPE_LENGTH in channel_write and add channel-close debug logging.
c/meterpreter/source/extensions/stdapi/server/net/socket/tcp.c	Add logging and reduce a channel teardown race by nulling ctx->channel earlier.
c/meterpreter/source/extensions/stdapi/server/net/socket/tcp_server.c	Add additional server-side socket/channel debug logging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

[adfoster-r7]

I think this is redundant, but I'll leave it in for now

[adfoster-r7]

👀

[adfoster-r7]

when there were issues during compilation, we'd just silently continue and ship the broken gem