35 */
36
37#include "opt_compat.h"
38#include "opt_inet6.h"
39#include "opt_ipsec.h"
40#include "opt_tcpdebug.h"
41
42#include <sys/param.h>
43#include <sys/systm.h>
44#include <sys/callout.h>
45#include <sys/kernel.h>
46#include <sys/sysctl.h>
47#include <sys/malloc.h>
48#include <sys/mbuf.h>
49#ifdef INET6
50#include <sys/domain.h>
51#endif
52#include <sys/proc.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/protosw.h>
56#include <sys/random.h>
57
58#include <vm/vm_zone.h>
59
60#include <net/route.h>
61#include <net/if.h>
62
63#define _IP_VHL
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/ip.h>
67#ifdef INET6
68#include <netinet/ip6.h>
69#endif
70#include <netinet/in_pcb.h>
71#ifdef INET6
72#include <netinet6/in6_pcb.h>
73#endif
74#include <netinet/in_var.h>
75#include <netinet/ip_var.h>
76#ifdef INET6
77#include <netinet6/ip6_var.h>
78#endif
79#include <netinet/tcp.h>
80#include <netinet/tcp_fsm.h>
81#include <netinet/tcp_seq.h>
82#include <netinet/tcp_timer.h>
83#include <netinet/tcp_var.h>
84#ifdef INET6
85#include <netinet6/tcp6_var.h>
86#endif
87#include <netinet/tcpip.h>
88#ifdef TCPDEBUG
89#include <netinet/tcp_debug.h>
90#endif
91#include <netinet6/ip6protosw.h>
92
93#ifdef IPSEC
94#include <netinet6/ipsec.h>
95#ifdef INET6
96#include <netinet6/ipsec6.h>
97#endif
98#endif /*IPSEC*/
99
100#include <machine/in_cksum.h>
101#include <sys/md5.h>
102
103int tcp_mssdflt = TCP_MSS;
104SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
105 &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");
106
107#ifdef INET6
108int tcp_v6mssdflt = TCP6_MSS;
109SYSCTL_INT(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
110 CTLFLAG_RW, &tcp_v6mssdflt , 0,
111 "Default TCP Maximum Segment Size for IPv6");
112#endif
113
114#if 0
115static int tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
116SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
117 &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
118#endif
119
120int tcp_do_rfc1323 = 1;
121SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW,
122 &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
123
124int tcp_do_rfc1644 = 0;
125SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW,
126 &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
127
128static int tcp_tcbhashsize = 0;
129SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RD,
130 &tcp_tcbhashsize, 0, "Size of TCP control-block hashtable");
131
132static int do_tcpdrain = 1;
133SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
134 "Enable tcp_drain routine for extra help when low on mbufs");
135
136SYSCTL_INT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_RD,
137 &tcbinfo.ipi_count, 0, "Number of active PCBs");
138
139static int icmp_may_rst = 1;
140SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_RW, &icmp_may_rst, 0,
141 "Certain ICMP unreachable messages may abort connections in SYN_SENT");
142
143static int tcp_strict_rfc1948 = 0;
144SYSCTL_INT(_net_inet_tcp, OID_AUTO, strict_rfc1948, CTLFLAG_RW,
145 &tcp_strict_rfc1948, 0, "Determines if RFC1948 is followed exactly");
146
147static int tcp_isn_reseed_interval = 0;
148SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_RW,
149 &tcp_isn_reseed_interval, 0, "Seconds between reseeding of ISN secret");
150
151static void tcp_cleartaocache __P((void));
152static void tcp_notify __P((struct inpcb *, int));
153
154/*
155 * Target size of TCP PCB hash tables. Must be a power of two.
156 *
157 * Note that this can be overridden by the kernel environment
158 * variable net.inet.tcp.tcbhashsize
159 */
160#ifndef TCBHASHSIZE
161#define TCBHASHSIZE 512
162#endif
163
164/*
165 * This is the actual shape of what we allocate using the zone
166 * allocator. Doing it this way allows us to protect both structures
167 * using the same generation count, and also eliminates the overhead
168 * of allocating tcpcbs separately. By hiding the structure here,
169 * we avoid changing most of the rest of the code (although it needs
170 * to be changed, eventually, for greater efficiency).
171 */
172#define ALIGNMENT 32
173#define ALIGNM1 (ALIGNMENT - 1)
174struct inp_tp {
175 union {
176 struct inpcb inp;
177 char align[(sizeof(struct inpcb) + ALIGNM1) & ~ALIGNM1];
178 } inp_tp_u;
179 struct tcpcb tcb;
180 struct callout inp_tp_rexmt, inp_tp_persist, inp_tp_keep, inp_tp_2msl;
181 struct callout inp_tp_delack;
182};
183#undef ALIGNMENT
184#undef ALIGNM1
185
186/*
187 * Tcp initialization
188 */
189void
190tcp_init()
191{
192 int hashsize = TCBHASHSIZE;
193
194 tcp_ccgen = 1;
195 tcp_cleartaocache();
196
197 tcp_delacktime = TCPTV_DELACK;
198 tcp_keepinit = TCPTV_KEEP_INIT;
199 tcp_keepidle = TCPTV_KEEP_IDLE;
200 tcp_keepintvl = TCPTV_KEEPINTVL;
201 tcp_maxpersistidle = TCPTV_KEEP_IDLE;
202 tcp_msl = TCPTV_MSL;
203
204 LIST_INIT(&tcb);
205 tcbinfo.listhead = &tcb;
206 TUNABLE_INT_FETCH("net.inet.tcp.tcbhashsize", &hashsize);
207 if (!powerof2(hashsize)) {
208 printf("WARNING: TCB hash size not a power of 2\n");
209 hashsize = 512; /* safe default */
210 }
211 tcp_tcbhashsize = hashsize;
212 tcbinfo.hashbase = hashinit(hashsize, M_PCB, &tcbinfo.hashmask);
213 tcbinfo.porthashbase = hashinit(hashsize, M_PCB,
214 &tcbinfo.porthashmask);
215 tcbinfo.ipi_zone = zinit("tcpcb", sizeof(struct inp_tp), maxsockets,
216 ZONE_INTERRUPT, 0);
217#ifdef INET6
218#define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
219#else /* INET6 */
220#define TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
221#endif /* INET6 */
222 if (max_protohdr < TCP_MINPROTOHDR)
223 max_protohdr = TCP_MINPROTOHDR;
224 if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
225 panic("tcp_init");
226#undef TCP_MINPROTOHDR
227
228 syncache_init();
229}
230
231/*
232 * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
233 * tcp_template used to store this data in mbufs, but we now recopy it out
234 * of the tcpcb each time to conserve mbufs.
235 */
236void
237tcp_fillheaders(tp, ip_ptr, tcp_ptr)
238 struct tcpcb *tp;
239 void *ip_ptr;
240 void *tcp_ptr;
241{
242 struct inpcb *inp = tp->t_inpcb;
243 struct tcphdr *tcp_hdr = (struct tcphdr *)tcp_ptr;
244
245#ifdef INET6
246 if ((inp->inp_vflag & INP_IPV6) != 0) {
247 struct ip6_hdr *ip6;
248
249 ip6 = (struct ip6_hdr *)ip_ptr;
250 ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
251 (inp->in6p_flowinfo & IPV6_FLOWINFO_MASK);
252 ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
253 (IPV6_VERSION & IPV6_VERSION_MASK);
254 ip6->ip6_nxt = IPPROTO_TCP;
255 ip6->ip6_plen = sizeof(struct tcphdr);
256 ip6->ip6_src = inp->in6p_laddr;
257 ip6->ip6_dst = inp->in6p_faddr;
258 tcp_hdr->th_sum = 0;
259 } else
260#endif
261 {
262 struct ip *ip = (struct ip *) ip_ptr;
263
264 ip->ip_vhl = IP_VHL_BORING;
265 ip->ip_tos = 0;
266 ip->ip_len = 0;
267 ip->ip_id = 0;
268 ip->ip_off = 0;
269 ip->ip_ttl = 0;
270 ip->ip_sum = 0;
271 ip->ip_p = IPPROTO_TCP;
272 ip->ip_src = inp->inp_laddr;
273 ip->ip_dst = inp->inp_faddr;
274 tcp_hdr->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
275 htons(sizeof(struct tcphdr) + IPPROTO_TCP));
276 }
277
278 tcp_hdr->th_sport = inp->inp_lport;
279 tcp_hdr->th_dport = inp->inp_fport;
280 tcp_hdr->th_seq = 0;
281 tcp_hdr->th_ack = 0;
282 tcp_hdr->th_x2 = 0;
283 tcp_hdr->th_off = 5;
284 tcp_hdr->th_flags = 0;
285 tcp_hdr->th_win = 0;
286 tcp_hdr->th_urp = 0;
287}
288
289/*
290 * Create template to be used to send tcp packets on a connection.
291 * Allocates an mbuf and fills in a skeletal tcp/ip header. The only
292 * use for this function is in keepalives, which use tcp_respond.
293 */
294struct tcptemp *
295tcp_maketemplate(tp)
296 struct tcpcb *tp;
297{
298 struct mbuf *m;
299 struct tcptemp *n;
300
301 m = m_get(M_DONTWAIT, MT_HEADER);
302 if (m == NULL)
303 return (0);
304 m->m_len = sizeof(struct tcptemp);
305 n = mtod(m, struct tcptemp *);
306
307 tcp_fillheaders(tp, (void *)&n->tt_ipgen, (void *)&n->tt_t);
308 return (n);
309}
310
311/*
312 * Send a single message to the TCP at address specified by
313 * the given TCP/IP header. If m == 0, then we make a copy
314 * of the tcpiphdr at ti and send directly to the addressed host.
315 * This is used to force keep alive messages out using the TCP
316 * template for a connection. If flags are given then we send
317 * a message back to the TCP which originated the * segment ti,
318 * and discard the mbuf containing it and any other attached mbufs.
319 *
320 * In any case the ack and sequence number of the transmitted
321 * segment are as specified by the parameters.
322 *
323 * NOTE: If m != NULL, then ti must point to *inside* the mbuf.
324 */
325void
326tcp_respond(tp, ipgen, th, m, ack, seq, flags)
327 struct tcpcb *tp;
328 void *ipgen;
329 register struct tcphdr *th;
330 register struct mbuf *m;
331 tcp_seq ack, seq;
332 int flags;
333{
334 register int tlen;
335 int win = 0;
336 struct route *ro = 0;
337 struct route sro;
338 struct ip *ip;
339 struct tcphdr *nth;
340#ifdef INET6
341 struct route_in6 *ro6 = 0;
342 struct route_in6 sro6;
343 struct ip6_hdr *ip6;
344 int isipv6;
345#endif /* INET6 */
346 int ipflags = 0;
347
348#ifdef INET6
349 isipv6 = IP_VHL_V(((struct ip *)ipgen)->ip_vhl) == 6;
350 ip6 = ipgen;
351#endif /* INET6 */
352 ip = ipgen;
353
354 if (tp) {
355 if (!(flags & TH_RST)) {
356 win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
357 if (win > (long)TCP_MAXWIN << tp->rcv_scale)
358 win = (long)TCP_MAXWIN << tp->rcv_scale;
359 }
360#ifdef INET6
361 if (isipv6)
362 ro6 = &tp->t_inpcb->in6p_route;
363 else
364#endif /* INET6 */
365 ro = &tp->t_inpcb->inp_route;
366 } else {
367#ifdef INET6
368 if (isipv6) {
369 ro6 = &sro6;
370 bzero(ro6, sizeof *ro6);
371 } else
372#endif /* INET6 */
373 {
374 ro = &sro;
375 bzero(ro, sizeof *ro);
376 }
377 }
378 if (m == 0) {
379 m = m_gethdr(M_DONTWAIT, MT_HEADER);
380 if (m == NULL)
381 return;
382 tlen = 0;
383 m->m_data += max_linkhdr;
384#ifdef INET6
385 if (isipv6) {
386 bcopy((caddr_t)ip6, mtod(m, caddr_t),
387 sizeof(struct ip6_hdr));
388 ip6 = mtod(m, struct ip6_hdr *);
389 nth = (struct tcphdr *)(ip6 + 1);
390 } else
391#endif /* INET6 */
392 {
393 bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
394 ip = mtod(m, struct ip *);
395 nth = (struct tcphdr *)(ip + 1);
396 }
397 bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
398 flags = TH_ACK;
399 } else {
400 m_freem(m->m_next);
401 m->m_next = 0;
402 m->m_data = (caddr_t)ipgen;
403 /* m_len is set later */
404 tlen = 0;
405#define xchg(a,b,type) { type t; t=a; a=b; b=t; }
406#ifdef INET6
407 if (isipv6) {
408 xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
409 nth = (struct tcphdr *)(ip6 + 1);
410 } else
411#endif /* INET6 */
412 {
413 xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, n_long);
414 nth = (struct tcphdr *)(ip + 1);
415 }
416 if (th != nth) {
417 /*
418 * this is usually a case when an extension header
419 * exists between the IPv6 header and the
420 * TCP header.
421 */
422 nth->th_sport = th->th_sport;
423 nth->th_dport = th->th_dport;
424 }
425 xchg(nth->th_dport, nth->th_sport, n_short);
426#undef xchg
427 }
428#ifdef INET6
429 if (isipv6) {
430 ip6->ip6_flow = 0;
431 ip6->ip6_vfc = IPV6_VERSION;
432 ip6->ip6_nxt = IPPROTO_TCP;
433 ip6->ip6_plen = htons((u_short)(sizeof (struct tcphdr) +
434 tlen));
435 tlen += sizeof (struct ip6_hdr) + sizeof (struct tcphdr);
436 } else
437#endif
438 {
439 tlen += sizeof (struct tcpiphdr);
440 ip->ip_len = tlen;
441 ip->ip_ttl = ip_defttl;
442 }
443 m->m_len = tlen;
444 m->m_pkthdr.len = tlen;
445 m->m_pkthdr.rcvif = (struct ifnet *) 0;
446 nth->th_seq = htonl(seq);
447 nth->th_ack = htonl(ack);
448 nth->th_x2 = 0;
449 nth->th_off = sizeof (struct tcphdr) >> 2;
450 nth->th_flags = flags;
451 if (tp)
452 nth->th_win = htons((u_short) (win >> tp->rcv_scale));
453 else
454 nth->th_win = htons((u_short)win);
455 nth->th_urp = 0;
456#ifdef INET6
457 if (isipv6) {
458 nth->th_sum = 0;
459 nth->th_sum = in6_cksum(m, IPPROTO_TCP,
460 sizeof(struct ip6_hdr),
461 tlen - sizeof(struct ip6_hdr));
462 ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL,
463 ro6 && ro6->ro_rt ?
464 ro6->ro_rt->rt_ifp :
465 NULL);
466 } else
467#endif /* INET6 */
468 {
469 nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
470 htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
471 m->m_pkthdr.csum_flags = CSUM_TCP;
472 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
473 }
474#ifdef TCPDEBUG
475 if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
476 tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
477#endif
478#ifdef IPSEC
479 if (ipsec_setsocket(m, tp ? tp->t_inpcb->inp_socket : NULL) != 0) {
480 m_freem(m);
481 return;
482 }
483#endif
484#ifdef INET6
485 if (isipv6) {
486 (void)ip6_output(m, NULL, ro6, ipflags, NULL, NULL);
487 if (ro6 == &sro6 && ro6->ro_rt) {
488 RTFREE(ro6->ro_rt);
489 ro6->ro_rt = NULL;
490 }
491 } else
492#endif /* INET6 */
493 {
494 (void) ip_output(m, NULL, ro, ipflags, NULL);
495 if (ro == &sro && ro->ro_rt) {
496 RTFREE(ro->ro_rt);
497 ro->ro_rt = NULL;
498 }
499 }
500}
501
502/*
503 * Create a new TCP control block, making an
504 * empty reassembly queue and hooking it to the argument
505 * protocol control block. The `inp' parameter must have
506 * come from the zone allocator set up in tcp_init().
507 */
508struct tcpcb *
509tcp_newtcpcb(inp)
510 struct inpcb *inp;
511{
512 struct inp_tp *it;
513 register struct tcpcb *tp;
514#ifdef INET6
515 int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
516#endif /* INET6 */
517
518 it = (struct inp_tp *)inp;
519 tp = &it->tcb;
520 bzero((char *) tp, sizeof(struct tcpcb));
521 LIST_INIT(&tp->t_segq);
522 tp->t_maxseg = tp->t_maxopd =
523#ifdef INET6
524 isipv6 ? tcp_v6mssdflt :
525#endif /* INET6 */
526 tcp_mssdflt;
527
528 /* Set up our timeouts. */
529 callout_init(tp->tt_rexmt = &it->inp_tp_rexmt, 0);
530 callout_init(tp->tt_persist = &it->inp_tp_persist, 0);
531 callout_init(tp->tt_keep = &it->inp_tp_keep, 0);
532 callout_init(tp->tt_2msl = &it->inp_tp_2msl, 0);
533 callout_init(tp->tt_delack = &it->inp_tp_delack, 0);
534
535 if (tcp_do_rfc1323)
536 tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
537 if (tcp_do_rfc1644)
538 tp->t_flags |= TF_REQ_CC;
539 tp->t_inpcb = inp; /* XXX */
540 /*
541 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
542 * rtt estimate. Set rttvar so that srtt + 4 * rttvar gives
543 * reasonable initial retransmit time.
544 */
545 tp->t_srtt = TCPTV_SRTTBASE;
546 tp->t_rttvar = ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
547 tp->t_rttmin = TCPTV_MIN;
548 tp->t_rxtcur = TCPTV_RTOBASE;
549 tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
550 tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
551 tp->t_rcvtime = ticks;
552 /*
553 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
554 * because the socket may be bound to an IPv6 wildcard address,
555 * which may match an IPv4-mapped IPv6 address.
556 */
557 inp->inp_ip_ttl = ip_defttl;
558 inp->inp_ppcb = (caddr_t)tp;
559 return (tp); /* XXX */
560}
561
562/*
563 * Drop a TCP connection, reporting
564 * the specified error. If connection is synchronized,
565 * then send a RST to peer.
566 */
567struct tcpcb *
568tcp_drop(tp, errno)
569 register struct tcpcb *tp;
570 int errno;
571{
572 struct socket *so = tp->t_inpcb->inp_socket;
573
574 if (TCPS_HAVERCVDSYN(tp->t_state)) {
575 tp->t_state = TCPS_CLOSED;
576 (void) tcp_output(tp);
577 tcpstat.tcps_drops++;
578 } else
579 tcpstat.tcps_conndrops++;
580 if (errno == ETIMEDOUT && tp->t_softerror)
581 errno = tp->t_softerror;
582 so->so_error = errno;
583 return (tcp_close(tp));
584}
585
586/*
587 * Close a TCP control block:
588 * discard all space held by the tcp
589 * discard internet protocol block
590 * wake up any sleepers
591 */
592struct tcpcb *
593tcp_close(tp)
594 register struct tcpcb *tp;
595{
596 register struct tseg_qent *q;
597 struct inpcb *inp = tp->t_inpcb;
598 struct socket *so = inp->inp_socket;
599#ifdef INET6
600 int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
601#endif /* INET6 */
602 register struct rtentry *rt;
603 int dosavessthresh;
604
605 /*
606 * Make sure that all of our timers are stopped before we
607 * delete the PCB.
608 */
609 callout_stop(tp->tt_rexmt);
610 callout_stop(tp->tt_persist);
611 callout_stop(tp->tt_keep);
612 callout_stop(tp->tt_2msl);
613 callout_stop(tp->tt_delack);
614
615 /*
616 * If we got enough samples through the srtt filter,
617 * save the rtt and rttvar in the routing entry.
618 * 'Enough' is arbitrarily defined as the 16 samples.
619 * 16 samples is enough for the srtt filter to converge
620 * to within 5% of the correct value; fewer samples and
621 * we could save a very bogus rtt.
622 *
623 * Don't update the default route's characteristics and don't
624 * update anything that the user "locked".
625 */
626 if (tp->t_rttupdated >= 16) {
627 register u_long i = 0;
628#ifdef INET6
629 if (isipv6) {
630 struct sockaddr_in6 *sin6;
631
632 if ((rt = inp->in6p_route.ro_rt) == NULL)
633 goto no_valid_rt;
634 sin6 = (struct sockaddr_in6 *)rt_key(rt);
635 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
636 goto no_valid_rt;
637 }
638 else
639#endif /* INET6 */
640 if ((rt = inp->inp_route.ro_rt) == NULL ||
641 ((struct sockaddr_in *)rt_key(rt))->sin_addr.s_addr
642 == INADDR_ANY)
643 goto no_valid_rt;
644
645 if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
646 i = tp->t_srtt *
647 (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
648 if (rt->rt_rmx.rmx_rtt && i)
649 /*
650 * filter this update to half the old & half
651 * the new values, converting scale.
652 * See route.h and tcp_var.h for a
653 * description of the scaling constants.
654 */
655 rt->rt_rmx.rmx_rtt =
656 (rt->rt_rmx.rmx_rtt + i) / 2;
657 else
658 rt->rt_rmx.rmx_rtt = i;
659 tcpstat.tcps_cachedrtt++;
660 }
661 if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
662 i = tp->t_rttvar *
663 (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
664 if (rt->rt_rmx.rmx_rttvar && i)
665 rt->rt_rmx.rmx_rttvar =
666 (rt->rt_rmx.rmx_rttvar + i) / 2;
667 else
668 rt->rt_rmx.rmx_rttvar = i;
669 tcpstat.tcps_cachedrttvar++;
670 }
671 /*
672 * The old comment here said:
673 * update the pipelimit (ssthresh) if it has been updated
674 * already or if a pipesize was specified & the threshhold
675 * got below half the pipesize. I.e., wait for bad news
676 * before we start updating, then update on both good
677 * and bad news.
678 *
679 * But we want to save the ssthresh even if no pipesize is
680 * specified explicitly in the route, because such
681 * connections still have an implicit pipesize specified
682 * by the global tcp_sendspace. In the absence of a reliable
683 * way to calculate the pipesize, it will have to do.
684 */
685 i = tp->snd_ssthresh;
686 if (rt->rt_rmx.rmx_sendpipe != 0)
687 dosavessthresh = (i < rt->rt_rmx.rmx_sendpipe / 2);
688 else
689 dosavessthresh = (i < so->so_snd.sb_hiwat / 2);
690 if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
691 i != 0 && rt->rt_rmx.rmx_ssthresh != 0)
692 || dosavessthresh) {
693 /*
694 * convert the limit from user data bytes to
695 * packets then to packet data bytes.
696 */
697 i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
698 if (i < 2)
699 i = 2;
700 i *= (u_long)(tp->t_maxseg +
701#ifdef INET6
702 (isipv6 ? sizeof (struct ip6_hdr) +
703 sizeof (struct tcphdr) :
704#endif
705 sizeof (struct tcpiphdr)
706#ifdef INET6
707 )
708#endif
709 );
710 if (rt->rt_rmx.rmx_ssthresh)
711 rt->rt_rmx.rmx_ssthresh =
712 (rt->rt_rmx.rmx_ssthresh + i) / 2;
713 else
714 rt->rt_rmx.rmx_ssthresh = i;
715 tcpstat.tcps_cachedssthresh++;
716 }
717 }
718 no_valid_rt:
719 /* free the reassembly queue, if any */
720 while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
721 LIST_REMOVE(q, tqe_q);
722 m_freem(q->tqe_m);
723 FREE(q, M_TSEGQ);
724 }
725 inp->inp_ppcb = NULL;
726 soisdisconnected(so);
727#ifdef INET6
728 if (INP_CHECK_SOCKAF(so, AF_INET6))
729 in6_pcbdetach(inp);
730 else
731#endif /* INET6 */
732 in_pcbdetach(inp);
733 tcpstat.tcps_closed++;
734 return ((struct tcpcb *)0);
735}
736
737void
738tcp_drain()
739{
740 if (do_tcpdrain)
741 {
742 struct inpcb *inpb;
743 struct tcpcb *tcpb;
744 struct tseg_qent *te;
745
746 /*
747 * Walk the tcpbs, if existing, and flush the reassembly queue,
748 * if there is one...
749 * XXX: The "Net/3" implementation doesn't imply that the TCP
750 * reassembly queue should be flushed, but in a situation
751 * where we're really low on mbufs, this is potentially
752 * usefull.
753 */
754 LIST_FOREACH(inpb, tcbinfo.listhead, inp_list) {
755 if ((tcpb = intotcpcb(inpb))) {
756 while ((te = LIST_FIRST(&tcpb->t_segq))
757 != NULL) {
758 LIST_REMOVE(te, tqe_q);
759 m_freem(te->tqe_m);
760 FREE(te, M_TSEGQ);
761 }
762 }
763 }
764 }
765}
766
767/*
768 * Notify a tcp user of an asynchronous error;
769 * store error as soft error, but wake up user
770 * (for now, won't do anything until can select for soft error).
771 *
772 * Do not wake up user since there currently is no mechanism for
773 * reporting soft errors (yet - a kqueue filter may be added).
774 */
775static void
776tcp_notify(inp, error)
777 struct inpcb *inp;
778 int error;
779{
780 struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
781
782 /*
783 * Ignore some errors if we are hooked up.
784 * If connection hasn't completed, has retransmitted several times,
785 * and receives a second error, give up now. This is better
786 * than waiting a long time to establish a connection that
787 * can never complete.
788 */
789 if (tp->t_state == TCPS_ESTABLISHED &&
790 (error == EHOSTUNREACH || error == ENETUNREACH ||
791 error == EHOSTDOWN)) {
792 return;
793 } else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
794 tp->t_softerror)
795 tcp_drop(tp, error);
796 else
797 tp->t_softerror = error;
798#if 0
799 wakeup((caddr_t) &so->so_timeo);
800 sorwakeup(so);
801 sowwakeup(so);
802#endif
803}
804
805static int
806tcp_pcblist(SYSCTL_HANDLER_ARGS)
807{
808 int error, i, n, s;
809 struct inpcb *inp, **inp_list;
810 inp_gen_t gencnt;
811 struct xinpgen xig;
812
813 /*
814 * The process of preparing the TCB list is too time-consuming and
815 * resource-intensive to repeat twice on every request.
816 */
817 if (req->oldptr == 0) {
818 n = tcbinfo.ipi_count;
819 req->oldidx = 2 * (sizeof xig)
820 + (n + n/8) * sizeof(struct xtcpcb);
821 return 0;
822 }
823
824 if (req->newptr != 0)
825 return EPERM;
826
827 /*
828 * OK, now we're committed to doing something.
829 */
830 s = splnet();
831 gencnt = tcbinfo.ipi_gencnt;
832 n = tcbinfo.ipi_count;
833 splx(s);
834
835 xig.xig_len = sizeof xig;
836 xig.xig_count = n;
837 xig.xig_gen = gencnt;
838 xig.xig_sogen = so_gencnt;
839 error = SYSCTL_OUT(req, &xig, sizeof xig);
840 if (error)
841 return error;
842
843 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
844 if (inp_list == 0)
845 return ENOMEM;
846
847 s = splnet();
848 for (inp = LIST_FIRST(tcbinfo.listhead), i = 0; inp && i < n;
849 inp = LIST_NEXT(inp, inp_list)) {
850 if (inp->inp_gencnt <= gencnt) {
851 if (cr_cansee(req->td->td_proc->p_ucred,
852 inp->inp_socket->so_cred))
853 continue;
854 inp_list[i++] = inp;
855 }
856 }
857 splx(s);
858 n = i;
859
860 error = 0;
861 for (i = 0; i < n; i++) {
862 inp = inp_list[i];
863 if (inp->inp_gencnt <= gencnt) {
864 struct xtcpcb xt;
865 caddr_t inp_ppcb;
866 xt.xt_len = sizeof xt;
867 /* XXX should avoid extra copy */
868 bcopy(inp, &xt.xt_inp, sizeof *inp);
869 inp_ppcb = inp->inp_ppcb;
870 if (inp_ppcb != NULL)
871 bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
872 else
873 bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
874 if (inp->inp_socket)
875 sotoxsocket(inp->inp_socket, &xt.xt_socket);
876 error = SYSCTL_OUT(req, &xt, sizeof xt);
877 }
878 }
879 if (!error) {
880 /*
881 * Give the user an updated idea of our state.
882 * If the generation differs from what we told
883 * her before, she knows that something happened
884 * while we were processing this request, and it
885 * might be necessary to retry.
886 */
887 s = splnet();
888 xig.xig_gen = tcbinfo.ipi_gencnt;
889 xig.xig_sogen = so_gencnt;
890 xig.xig_count = tcbinfo.ipi_count;
891 splx(s);
892 error = SYSCTL_OUT(req, &xig, sizeof xig);
893 }
894 free(inp_list, M_TEMP);
895 return error;
896}
897
898SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
899 tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
900
901static int
902tcp_getcred(SYSCTL_HANDLER_ARGS)
903{
904 struct xucred xuc;
905 struct sockaddr_in addrs[2];
906 struct inpcb *inp;
907 int error, s;
908
909 error = suser_xxx(0, req->td->td_proc, PRISON_ROOT);
910 if (error)
911 return (error);
912 error = SYSCTL_IN(req, addrs, sizeof(addrs));
913 if (error)
914 return (error);
915 s = splnet();
916 inp = in_pcblookup_hash(&tcbinfo, addrs[1].sin_addr, addrs[1].sin_port,
917 addrs[0].sin_addr, addrs[0].sin_port, 0, NULL);
918 if (inp == NULL || inp->inp_socket == NULL) {
919 error = ENOENT;
920 goto out;
921 }
922 error = cr_cansee(req->td->td_proc->p_ucred, inp->inp_socket->so_cred);
923 if (error)
924 goto out;
| 35 */
36
37#include "opt_compat.h"
38#include "opt_inet6.h"
39#include "opt_ipsec.h"
40#include "opt_tcpdebug.h"
41
42#include <sys/param.h>
43#include <sys/systm.h>
44#include <sys/callout.h>
45#include <sys/kernel.h>
46#include <sys/sysctl.h>
47#include <sys/malloc.h>
48#include <sys/mbuf.h>
49#ifdef INET6
50#include <sys/domain.h>
51#endif
52#include <sys/proc.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/protosw.h>
56#include <sys/random.h>
57
58#include <vm/vm_zone.h>
59
60#include <net/route.h>
61#include <net/if.h>
62
63#define _IP_VHL
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/ip.h>
67#ifdef INET6
68#include <netinet/ip6.h>
69#endif
70#include <netinet/in_pcb.h>
71#ifdef INET6
72#include <netinet6/in6_pcb.h>
73#endif
74#include <netinet/in_var.h>
75#include <netinet/ip_var.h>
76#ifdef INET6
77#include <netinet6/ip6_var.h>
78#endif
79#include <netinet/tcp.h>
80#include <netinet/tcp_fsm.h>
81#include <netinet/tcp_seq.h>
82#include <netinet/tcp_timer.h>
83#include <netinet/tcp_var.h>
84#ifdef INET6
85#include <netinet6/tcp6_var.h>
86#endif
87#include <netinet/tcpip.h>
88#ifdef TCPDEBUG
89#include <netinet/tcp_debug.h>
90#endif
91#include <netinet6/ip6protosw.h>
92
93#ifdef IPSEC
94#include <netinet6/ipsec.h>
95#ifdef INET6
96#include <netinet6/ipsec6.h>
97#endif
98#endif /*IPSEC*/
99
100#include <machine/in_cksum.h>
101#include <sys/md5.h>
102
103int tcp_mssdflt = TCP_MSS;
104SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
105 &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");
106
107#ifdef INET6
108int tcp_v6mssdflt = TCP6_MSS;
109SYSCTL_INT(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
110 CTLFLAG_RW, &tcp_v6mssdflt , 0,
111 "Default TCP Maximum Segment Size for IPv6");
112#endif
113
114#if 0
115static int tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
116SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
117 &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
118#endif
119
120int tcp_do_rfc1323 = 1;
121SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW,
122 &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
123
124int tcp_do_rfc1644 = 0;
125SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW,
126 &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
127
128static int tcp_tcbhashsize = 0;
129SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RD,
130 &tcp_tcbhashsize, 0, "Size of TCP control-block hashtable");
131
132static int do_tcpdrain = 1;
133SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
134 "Enable tcp_drain routine for extra help when low on mbufs");
135
136SYSCTL_INT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_RD,
137 &tcbinfo.ipi_count, 0, "Number of active PCBs");
138
139static int icmp_may_rst = 1;
140SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_RW, &icmp_may_rst, 0,
141 "Certain ICMP unreachable messages may abort connections in SYN_SENT");
142
143static int tcp_strict_rfc1948 = 0;
144SYSCTL_INT(_net_inet_tcp, OID_AUTO, strict_rfc1948, CTLFLAG_RW,
145 &tcp_strict_rfc1948, 0, "Determines if RFC1948 is followed exactly");
146
147static int tcp_isn_reseed_interval = 0;
148SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_RW,
149 &tcp_isn_reseed_interval, 0, "Seconds between reseeding of ISN secret");
150
151static void tcp_cleartaocache __P((void));
152static void tcp_notify __P((struct inpcb *, int));
153
154/*
155 * Target size of TCP PCB hash tables. Must be a power of two.
156 *
157 * Note that this can be overridden by the kernel environment
158 * variable net.inet.tcp.tcbhashsize
159 */
160#ifndef TCBHASHSIZE
161#define TCBHASHSIZE 512
162#endif
163
164/*
165 * This is the actual shape of what we allocate using the zone
166 * allocator. Doing it this way allows us to protect both structures
167 * using the same generation count, and also eliminates the overhead
168 * of allocating tcpcbs separately. By hiding the structure here,
169 * we avoid changing most of the rest of the code (although it needs
170 * to be changed, eventually, for greater efficiency).
171 */
172#define ALIGNMENT 32
173#define ALIGNM1 (ALIGNMENT - 1)
174struct inp_tp {
175 union {
176 struct inpcb inp;
177 char align[(sizeof(struct inpcb) + ALIGNM1) & ~ALIGNM1];
178 } inp_tp_u;
179 struct tcpcb tcb;
180 struct callout inp_tp_rexmt, inp_tp_persist, inp_tp_keep, inp_tp_2msl;
181 struct callout inp_tp_delack;
182};
183#undef ALIGNMENT
184#undef ALIGNM1
185
186/*
187 * Tcp initialization
188 */
189void
190tcp_init()
191{
192 int hashsize = TCBHASHSIZE;
193
194 tcp_ccgen = 1;
195 tcp_cleartaocache();
196
197 tcp_delacktime = TCPTV_DELACK;
198 tcp_keepinit = TCPTV_KEEP_INIT;
199 tcp_keepidle = TCPTV_KEEP_IDLE;
200 tcp_keepintvl = TCPTV_KEEPINTVL;
201 tcp_maxpersistidle = TCPTV_KEEP_IDLE;
202 tcp_msl = TCPTV_MSL;
203
204 LIST_INIT(&tcb);
205 tcbinfo.listhead = &tcb;
206 TUNABLE_INT_FETCH("net.inet.tcp.tcbhashsize", &hashsize);
207 if (!powerof2(hashsize)) {
208 printf("WARNING: TCB hash size not a power of 2\n");
209 hashsize = 512; /* safe default */
210 }
211 tcp_tcbhashsize = hashsize;
212 tcbinfo.hashbase = hashinit(hashsize, M_PCB, &tcbinfo.hashmask);
213 tcbinfo.porthashbase = hashinit(hashsize, M_PCB,
214 &tcbinfo.porthashmask);
215 tcbinfo.ipi_zone = zinit("tcpcb", sizeof(struct inp_tp), maxsockets,
216 ZONE_INTERRUPT, 0);
217#ifdef INET6
218#define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
219#else /* INET6 */
220#define TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
221#endif /* INET6 */
222 if (max_protohdr < TCP_MINPROTOHDR)
223 max_protohdr = TCP_MINPROTOHDR;
224 if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
225 panic("tcp_init");
226#undef TCP_MINPROTOHDR
227
228 syncache_init();
229}
230
231/*
232 * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
233 * tcp_template used to store this data in mbufs, but we now recopy it out
234 * of the tcpcb each time to conserve mbufs.
235 */
236void
237tcp_fillheaders(tp, ip_ptr, tcp_ptr)
238 struct tcpcb *tp;
239 void *ip_ptr;
240 void *tcp_ptr;
241{
242 struct inpcb *inp = tp->t_inpcb;
243 struct tcphdr *tcp_hdr = (struct tcphdr *)tcp_ptr;
244
245#ifdef INET6
246 if ((inp->inp_vflag & INP_IPV6) != 0) {
247 struct ip6_hdr *ip6;
248
249 ip6 = (struct ip6_hdr *)ip_ptr;
250 ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
251 (inp->in6p_flowinfo & IPV6_FLOWINFO_MASK);
252 ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
253 (IPV6_VERSION & IPV6_VERSION_MASK);
254 ip6->ip6_nxt = IPPROTO_TCP;
255 ip6->ip6_plen = sizeof(struct tcphdr);
256 ip6->ip6_src = inp->in6p_laddr;
257 ip6->ip6_dst = inp->in6p_faddr;
258 tcp_hdr->th_sum = 0;
259 } else
260#endif
261 {
262 struct ip *ip = (struct ip *) ip_ptr;
263
264 ip->ip_vhl = IP_VHL_BORING;
265 ip->ip_tos = 0;
266 ip->ip_len = 0;
267 ip->ip_id = 0;
268 ip->ip_off = 0;
269 ip->ip_ttl = 0;
270 ip->ip_sum = 0;
271 ip->ip_p = IPPROTO_TCP;
272 ip->ip_src = inp->inp_laddr;
273 ip->ip_dst = inp->inp_faddr;
274 tcp_hdr->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
275 htons(sizeof(struct tcphdr) + IPPROTO_TCP));
276 }
277
278 tcp_hdr->th_sport = inp->inp_lport;
279 tcp_hdr->th_dport = inp->inp_fport;
280 tcp_hdr->th_seq = 0;
281 tcp_hdr->th_ack = 0;
282 tcp_hdr->th_x2 = 0;
283 tcp_hdr->th_off = 5;
284 tcp_hdr->th_flags = 0;
285 tcp_hdr->th_win = 0;
286 tcp_hdr->th_urp = 0;
287}
288
289/*
290 * Create template to be used to send tcp packets on a connection.
291 * Allocates an mbuf and fills in a skeletal tcp/ip header. The only
292 * use for this function is in keepalives, which use tcp_respond.
293 */
294struct tcptemp *
295tcp_maketemplate(tp)
296 struct tcpcb *tp;
297{
298 struct mbuf *m;
299 struct tcptemp *n;
300
301 m = m_get(M_DONTWAIT, MT_HEADER);
302 if (m == NULL)
303 return (0);
304 m->m_len = sizeof(struct tcptemp);
305 n = mtod(m, struct tcptemp *);
306
307 tcp_fillheaders(tp, (void *)&n->tt_ipgen, (void *)&n->tt_t);
308 return (n);
309}
310
311/*
312 * Send a single message to the TCP at address specified by
313 * the given TCP/IP header. If m == 0, then we make a copy
314 * of the tcpiphdr at ti and send directly to the addressed host.
315 * This is used to force keep alive messages out using the TCP
316 * template for a connection. If flags are given then we send
317 * a message back to the TCP which originated the * segment ti,
318 * and discard the mbuf containing it and any other attached mbufs.
319 *
320 * In any case the ack and sequence number of the transmitted
321 * segment are as specified by the parameters.
322 *
323 * NOTE: If m != NULL, then ti must point to *inside* the mbuf.
324 */
325void
326tcp_respond(tp, ipgen, th, m, ack, seq, flags)
327 struct tcpcb *tp;
328 void *ipgen;
329 register struct tcphdr *th;
330 register struct mbuf *m;
331 tcp_seq ack, seq;
332 int flags;
333{
334 register int tlen;
335 int win = 0;
336 struct route *ro = 0;
337 struct route sro;
338 struct ip *ip;
339 struct tcphdr *nth;
340#ifdef INET6
341 struct route_in6 *ro6 = 0;
342 struct route_in6 sro6;
343 struct ip6_hdr *ip6;
344 int isipv6;
345#endif /* INET6 */
346 int ipflags = 0;
347
348#ifdef INET6
349 isipv6 = IP_VHL_V(((struct ip *)ipgen)->ip_vhl) == 6;
350 ip6 = ipgen;
351#endif /* INET6 */
352 ip = ipgen;
353
354 if (tp) {
355 if (!(flags & TH_RST)) {
356 win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
357 if (win > (long)TCP_MAXWIN << tp->rcv_scale)
358 win = (long)TCP_MAXWIN << tp->rcv_scale;
359 }
360#ifdef INET6
361 if (isipv6)
362 ro6 = &tp->t_inpcb->in6p_route;
363 else
364#endif /* INET6 */
365 ro = &tp->t_inpcb->inp_route;
366 } else {
367#ifdef INET6
368 if (isipv6) {
369 ro6 = &sro6;
370 bzero(ro6, sizeof *ro6);
371 } else
372#endif /* INET6 */
373 {
374 ro = &sro;
375 bzero(ro, sizeof *ro);
376 }
377 }
378 if (m == 0) {
379 m = m_gethdr(M_DONTWAIT, MT_HEADER);
380 if (m == NULL)
381 return;
382 tlen = 0;
383 m->m_data += max_linkhdr;
384#ifdef INET6
385 if (isipv6) {
386 bcopy((caddr_t)ip6, mtod(m, caddr_t),
387 sizeof(struct ip6_hdr));
388 ip6 = mtod(m, struct ip6_hdr *);
389 nth = (struct tcphdr *)(ip6 + 1);
390 } else
391#endif /* INET6 */
392 {
393 bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
394 ip = mtod(m, struct ip *);
395 nth = (struct tcphdr *)(ip + 1);
396 }
397 bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
398 flags = TH_ACK;
399 } else {
400 m_freem(m->m_next);
401 m->m_next = 0;
402 m->m_data = (caddr_t)ipgen;
403 /* m_len is set later */
404 tlen = 0;
405#define xchg(a,b,type) { type t; t=a; a=b; b=t; }
406#ifdef INET6
407 if (isipv6) {
408 xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
409 nth = (struct tcphdr *)(ip6 + 1);
410 } else
411#endif /* INET6 */
412 {
413 xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, n_long);
414 nth = (struct tcphdr *)(ip + 1);
415 }
416 if (th != nth) {
417 /*
418 * this is usually a case when an extension header
419 * exists between the IPv6 header and the
420 * TCP header.
421 */
422 nth->th_sport = th->th_sport;
423 nth->th_dport = th->th_dport;
424 }
425 xchg(nth->th_dport, nth->th_sport, n_short);
426#undef xchg
427 }
428#ifdef INET6
429 if (isipv6) {
430 ip6->ip6_flow = 0;
431 ip6->ip6_vfc = IPV6_VERSION;
432 ip6->ip6_nxt = IPPROTO_TCP;
433 ip6->ip6_plen = htons((u_short)(sizeof (struct tcphdr) +
434 tlen));
435 tlen += sizeof (struct ip6_hdr) + sizeof (struct tcphdr);
436 } else
437#endif
438 {
439 tlen += sizeof (struct tcpiphdr);
440 ip->ip_len = tlen;
441 ip->ip_ttl = ip_defttl;
442 }
443 m->m_len = tlen;
444 m->m_pkthdr.len = tlen;
445 m->m_pkthdr.rcvif = (struct ifnet *) 0;
446 nth->th_seq = htonl(seq);
447 nth->th_ack = htonl(ack);
448 nth->th_x2 = 0;
449 nth->th_off = sizeof (struct tcphdr) >> 2;
450 nth->th_flags = flags;
451 if (tp)
452 nth->th_win = htons((u_short) (win >> tp->rcv_scale));
453 else
454 nth->th_win = htons((u_short)win);
455 nth->th_urp = 0;
456#ifdef INET6
457 if (isipv6) {
458 nth->th_sum = 0;
459 nth->th_sum = in6_cksum(m, IPPROTO_TCP,
460 sizeof(struct ip6_hdr),
461 tlen - sizeof(struct ip6_hdr));
462 ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL,
463 ro6 && ro6->ro_rt ?
464 ro6->ro_rt->rt_ifp :
465 NULL);
466 } else
467#endif /* INET6 */
468 {
469 nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
470 htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
471 m->m_pkthdr.csum_flags = CSUM_TCP;
472 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
473 }
474#ifdef TCPDEBUG
475 if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
476 tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
477#endif
478#ifdef IPSEC
479 if (ipsec_setsocket(m, tp ? tp->t_inpcb->inp_socket : NULL) != 0) {
480 m_freem(m);
481 return;
482 }
483#endif
484#ifdef INET6
485 if (isipv6) {
486 (void)ip6_output(m, NULL, ro6, ipflags, NULL, NULL);
487 if (ro6 == &sro6 && ro6->ro_rt) {
488 RTFREE(ro6->ro_rt);
489 ro6->ro_rt = NULL;
490 }
491 } else
492#endif /* INET6 */
493 {
494 (void) ip_output(m, NULL, ro, ipflags, NULL);
495 if (ro == &sro && ro->ro_rt) {
496 RTFREE(ro->ro_rt);
497 ro->ro_rt = NULL;
498 }
499 }
500}
501
502/*
503 * Create a new TCP control block, making an
504 * empty reassembly queue and hooking it to the argument
505 * protocol control block. The `inp' parameter must have
506 * come from the zone allocator set up in tcp_init().
507 */
508struct tcpcb *
509tcp_newtcpcb(inp)
510 struct inpcb *inp;
511{
512 struct inp_tp *it;
513 register struct tcpcb *tp;
514#ifdef INET6
515 int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
516#endif /* INET6 */
517
518 it = (struct inp_tp *)inp;
519 tp = &it->tcb;
520 bzero((char *) tp, sizeof(struct tcpcb));
521 LIST_INIT(&tp->t_segq);
522 tp->t_maxseg = tp->t_maxopd =
523#ifdef INET6
524 isipv6 ? tcp_v6mssdflt :
525#endif /* INET6 */
526 tcp_mssdflt;
527
528 /* Set up our timeouts. */
529 callout_init(tp->tt_rexmt = &it->inp_tp_rexmt, 0);
530 callout_init(tp->tt_persist = &it->inp_tp_persist, 0);
531 callout_init(tp->tt_keep = &it->inp_tp_keep, 0);
532 callout_init(tp->tt_2msl = &it->inp_tp_2msl, 0);
533 callout_init(tp->tt_delack = &it->inp_tp_delack, 0);
534
535 if (tcp_do_rfc1323)
536 tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
537 if (tcp_do_rfc1644)
538 tp->t_flags |= TF_REQ_CC;
539 tp->t_inpcb = inp; /* XXX */
540 /*
541 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
542 * rtt estimate. Set rttvar so that srtt + 4 * rttvar gives
543 * reasonable initial retransmit time.
544 */
545 tp->t_srtt = TCPTV_SRTTBASE;
546 tp->t_rttvar = ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
547 tp->t_rttmin = TCPTV_MIN;
548 tp->t_rxtcur = TCPTV_RTOBASE;
549 tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
550 tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
551 tp->t_rcvtime = ticks;
552 /*
553 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
554 * because the socket may be bound to an IPv6 wildcard address,
555 * which may match an IPv4-mapped IPv6 address.
556 */
557 inp->inp_ip_ttl = ip_defttl;
558 inp->inp_ppcb = (caddr_t)tp;
559 return (tp); /* XXX */
560}
561
562/*
563 * Drop a TCP connection, reporting
564 * the specified error. If connection is synchronized,
565 * then send a RST to peer.
566 */
567struct tcpcb *
568tcp_drop(tp, errno)
569 register struct tcpcb *tp;
570 int errno;
571{
572 struct socket *so = tp->t_inpcb->inp_socket;
573
574 if (TCPS_HAVERCVDSYN(tp->t_state)) {
575 tp->t_state = TCPS_CLOSED;
576 (void) tcp_output(tp);
577 tcpstat.tcps_drops++;
578 } else
579 tcpstat.tcps_conndrops++;
580 if (errno == ETIMEDOUT && tp->t_softerror)
581 errno = tp->t_softerror;
582 so->so_error = errno;
583 return (tcp_close(tp));
584}
585
586/*
587 * Close a TCP control block:
588 * discard all space held by the tcp
589 * discard internet protocol block
590 * wake up any sleepers
591 */
592struct tcpcb *
593tcp_close(tp)
594 register struct tcpcb *tp;
595{
596 register struct tseg_qent *q;
597 struct inpcb *inp = tp->t_inpcb;
598 struct socket *so = inp->inp_socket;
599#ifdef INET6
600 int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
601#endif /* INET6 */
602 register struct rtentry *rt;
603 int dosavessthresh;
604
605 /*
606 * Make sure that all of our timers are stopped before we
607 * delete the PCB.
608 */
609 callout_stop(tp->tt_rexmt);
610 callout_stop(tp->tt_persist);
611 callout_stop(tp->tt_keep);
612 callout_stop(tp->tt_2msl);
613 callout_stop(tp->tt_delack);
614
615 /*
616 * If we got enough samples through the srtt filter,
617 * save the rtt and rttvar in the routing entry.
618 * 'Enough' is arbitrarily defined as the 16 samples.
619 * 16 samples is enough for the srtt filter to converge
620 * to within 5% of the correct value; fewer samples and
621 * we could save a very bogus rtt.
622 *
623 * Don't update the default route's characteristics and don't
624 * update anything that the user "locked".
625 */
626 if (tp->t_rttupdated >= 16) {
627 register u_long i = 0;
628#ifdef INET6
629 if (isipv6) {
630 struct sockaddr_in6 *sin6;
631
632 if ((rt = inp->in6p_route.ro_rt) == NULL)
633 goto no_valid_rt;
634 sin6 = (struct sockaddr_in6 *)rt_key(rt);
635 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
636 goto no_valid_rt;
637 }
638 else
639#endif /* INET6 */
640 if ((rt = inp->inp_route.ro_rt) == NULL ||
641 ((struct sockaddr_in *)rt_key(rt))->sin_addr.s_addr
642 == INADDR_ANY)
643 goto no_valid_rt;
644
645 if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
646 i = tp->t_srtt *
647 (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
648 if (rt->rt_rmx.rmx_rtt && i)
649 /*
650 * filter this update to half the old & half
651 * the new values, converting scale.
652 * See route.h and tcp_var.h for a
653 * description of the scaling constants.
654 */
655 rt->rt_rmx.rmx_rtt =
656 (rt->rt_rmx.rmx_rtt + i) / 2;
657 else
658 rt->rt_rmx.rmx_rtt = i;
659 tcpstat.tcps_cachedrtt++;
660 }
661 if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
662 i = tp->t_rttvar *
663 (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
664 if (rt->rt_rmx.rmx_rttvar && i)
665 rt->rt_rmx.rmx_rttvar =
666 (rt->rt_rmx.rmx_rttvar + i) / 2;
667 else
668 rt->rt_rmx.rmx_rttvar = i;
669 tcpstat.tcps_cachedrttvar++;
670 }
671 /*
672 * The old comment here said:
673 * update the pipelimit (ssthresh) if it has been updated
674 * already or if a pipesize was specified & the threshhold
675 * got below half the pipesize. I.e., wait for bad news
676 * before we start updating, then update on both good
677 * and bad news.
678 *
679 * But we want to save the ssthresh even if no pipesize is
680 * specified explicitly in the route, because such
681 * connections still have an implicit pipesize specified
682 * by the global tcp_sendspace. In the absence of a reliable
683 * way to calculate the pipesize, it will have to do.
684 */
685 i = tp->snd_ssthresh;
686 if (rt->rt_rmx.rmx_sendpipe != 0)
687 dosavessthresh = (i < rt->rt_rmx.rmx_sendpipe / 2);
688 else
689 dosavessthresh = (i < so->so_snd.sb_hiwat / 2);
690 if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
691 i != 0 && rt->rt_rmx.rmx_ssthresh != 0)
692 || dosavessthresh) {
693 /*
694 * convert the limit from user data bytes to
695 * packets then to packet data bytes.
696 */
697 i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
698 if (i < 2)
699 i = 2;
700 i *= (u_long)(tp->t_maxseg +
701#ifdef INET6
702 (isipv6 ? sizeof (struct ip6_hdr) +
703 sizeof (struct tcphdr) :
704#endif
705 sizeof (struct tcpiphdr)
706#ifdef INET6
707 )
708#endif
709 );
710 if (rt->rt_rmx.rmx_ssthresh)
711 rt->rt_rmx.rmx_ssthresh =
712 (rt->rt_rmx.rmx_ssthresh + i) / 2;
713 else
714 rt->rt_rmx.rmx_ssthresh = i;
715 tcpstat.tcps_cachedssthresh++;
716 }
717 }
718 no_valid_rt:
719 /* free the reassembly queue, if any */
720 while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
721 LIST_REMOVE(q, tqe_q);
722 m_freem(q->tqe_m);
723 FREE(q, M_TSEGQ);
724 }
725 inp->inp_ppcb = NULL;
726 soisdisconnected(so);
727#ifdef INET6
728 if (INP_CHECK_SOCKAF(so, AF_INET6))
729 in6_pcbdetach(inp);
730 else
731#endif /* INET6 */
732 in_pcbdetach(inp);
733 tcpstat.tcps_closed++;
734 return ((struct tcpcb *)0);
735}
736
737void
738tcp_drain()
739{
740 if (do_tcpdrain)
741 {
742 struct inpcb *inpb;
743 struct tcpcb *tcpb;
744 struct tseg_qent *te;
745
746 /*
747 * Walk the tcpbs, if existing, and flush the reassembly queue,
748 * if there is one...
749 * XXX: The "Net/3" implementation doesn't imply that the TCP
750 * reassembly queue should be flushed, but in a situation
751 * where we're really low on mbufs, this is potentially
752 * usefull.
753 */
754 LIST_FOREACH(inpb, tcbinfo.listhead, inp_list) {
755 if ((tcpb = intotcpcb(inpb))) {
756 while ((te = LIST_FIRST(&tcpb->t_segq))
757 != NULL) {
758 LIST_REMOVE(te, tqe_q);
759 m_freem(te->tqe_m);
760 FREE(te, M_TSEGQ);
761 }
762 }
763 }
764 }
765}
766
767/*
768 * Notify a tcp user of an asynchronous error;
769 * store error as soft error, but wake up user
770 * (for now, won't do anything until can select for soft error).
771 *
772 * Do not wake up user since there currently is no mechanism for
773 * reporting soft errors (yet - a kqueue filter may be added).
774 */
775static void
776tcp_notify(inp, error)
777 struct inpcb *inp;
778 int error;
779{
780 struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
781
782 /*
783 * Ignore some errors if we are hooked up.
784 * If connection hasn't completed, has retransmitted several times,
785 * and receives a second error, give up now. This is better
786 * than waiting a long time to establish a connection that
787 * can never complete.
788 */
789 if (tp->t_state == TCPS_ESTABLISHED &&
790 (error == EHOSTUNREACH || error == ENETUNREACH ||
791 error == EHOSTDOWN)) {
792 return;
793 } else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
794 tp->t_softerror)
795 tcp_drop(tp, error);
796 else
797 tp->t_softerror = error;
798#if 0
799 wakeup((caddr_t) &so->so_timeo);
800 sorwakeup(so);
801 sowwakeup(so);
802#endif
803}
804
805static int
806tcp_pcblist(SYSCTL_HANDLER_ARGS)
807{
808 int error, i, n, s;
809 struct inpcb *inp, **inp_list;
810 inp_gen_t gencnt;
811 struct xinpgen xig;
812
813 /*
814 * The process of preparing the TCB list is too time-consuming and
815 * resource-intensive to repeat twice on every request.
816 */
817 if (req->oldptr == 0) {
818 n = tcbinfo.ipi_count;
819 req->oldidx = 2 * (sizeof xig)
820 + (n + n/8) * sizeof(struct xtcpcb);
821 return 0;
822 }
823
824 if (req->newptr != 0)
825 return EPERM;
826
827 /*
828 * OK, now we're committed to doing something.
829 */
830 s = splnet();
831 gencnt = tcbinfo.ipi_gencnt;
832 n = tcbinfo.ipi_count;
833 splx(s);
834
835 xig.xig_len = sizeof xig;
836 xig.xig_count = n;
837 xig.xig_gen = gencnt;
838 xig.xig_sogen = so_gencnt;
839 error = SYSCTL_OUT(req, &xig, sizeof xig);
840 if (error)
841 return error;
842
843 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
844 if (inp_list == 0)
845 return ENOMEM;
846
847 s = splnet();
848 for (inp = LIST_FIRST(tcbinfo.listhead), i = 0; inp && i < n;
849 inp = LIST_NEXT(inp, inp_list)) {
850 if (inp->inp_gencnt <= gencnt) {
851 if (cr_cansee(req->td->td_proc->p_ucred,
852 inp->inp_socket->so_cred))
853 continue;
854 inp_list[i++] = inp;
855 }
856 }
857 splx(s);
858 n = i;
859
860 error = 0;
861 for (i = 0; i < n; i++) {
862 inp = inp_list[i];
863 if (inp->inp_gencnt <= gencnt) {
864 struct xtcpcb xt;
865 caddr_t inp_ppcb;
866 xt.xt_len = sizeof xt;
867 /* XXX should avoid extra copy */
868 bcopy(inp, &xt.xt_inp, sizeof *inp);
869 inp_ppcb = inp->inp_ppcb;
870 if (inp_ppcb != NULL)
871 bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
872 else
873 bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
874 if (inp->inp_socket)
875 sotoxsocket(inp->inp_socket, &xt.xt_socket);
876 error = SYSCTL_OUT(req, &xt, sizeof xt);
877 }
878 }
879 if (!error) {
880 /*
881 * Give the user an updated idea of our state.
882 * If the generation differs from what we told
883 * her before, she knows that something happened
884 * while we were processing this request, and it
885 * might be necessary to retry.
886 */
887 s = splnet();
888 xig.xig_gen = tcbinfo.ipi_gencnt;
889 xig.xig_sogen = so_gencnt;
890 xig.xig_count = tcbinfo.ipi_count;
891 splx(s);
892 error = SYSCTL_OUT(req, &xig, sizeof xig);
893 }
894 free(inp_list, M_TEMP);
895 return error;
896}
897
898SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
899 tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
900
901static int
902tcp_getcred(SYSCTL_HANDLER_ARGS)
903{
904 struct xucred xuc;
905 struct sockaddr_in addrs[2];
906 struct inpcb *inp;
907 int error, s;
908
909 error = suser_xxx(0, req->td->td_proc, PRISON_ROOT);
910 if (error)
911 return (error);
912 error = SYSCTL_IN(req, addrs, sizeof(addrs));
913 if (error)
914 return (error);
915 s = splnet();
916 inp = in_pcblookup_hash(&tcbinfo, addrs[1].sin_addr, addrs[1].sin_port,
917 addrs[0].sin_addr, addrs[0].sin_port, 0, NULL);
918 if (inp == NULL || inp->inp_socket == NULL) {
919 error = ENOENT;
920 goto out;
921 }
922 error = cr_cansee(req->td->td_proc->p_ucred, inp->inp_socket->so_cred);
923 if (error)
924 goto out;
|
986 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
987out:
988 splx(s);
989 return (error);
990}
991
992SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred,
993 CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
994 tcp6_getcred, "S,xucred", "Get the xucred of a TCP6 connection");
995#endif
996
997
998void
999tcp_ctlinput(cmd, sa, vip)
1000 int cmd;
1001 struct sockaddr *sa;
1002 void *vip;
1003{
1004 struct ip *ip = vip;
1005 struct tcphdr *th;
1006 struct in_addr faddr;
1007 struct inpcb *inp;
1008 struct tcpcb *tp;
1009 void (*notify) __P((struct inpcb *, int)) = tcp_notify;
1010 tcp_seq icmp_seq;
1011 int s;
1012
1013 faddr = ((struct sockaddr_in *)sa)->sin_addr;
1014 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1015 return;
1016
1017 if (cmd == PRC_QUENCH)
1018 notify = tcp_quench;
1019 else if (icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||
1020 cmd == PRC_UNREACH_PORT) && ip)
1021 notify = tcp_drop_syn_sent;
1022 else if (cmd == PRC_MSGSIZE)
1023 notify = tcp_mtudisc;
1024 else if (PRC_IS_REDIRECT(cmd)) {
1025 ip = 0;
1026 notify = in_rtchange;
1027 } else if (cmd == PRC_HOSTDEAD)
1028 ip = 0;
1029 else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
1030 return;
1031 if (ip) {
1032 s = splnet();
1033 th = (struct tcphdr *)((caddr_t)ip
1034 + (IP_VHL_HL(ip->ip_vhl) << 2));
1035 inp = in_pcblookup_hash(&tcbinfo, faddr, th->th_dport,
1036 ip->ip_src, th->th_sport, 0, NULL);
1037 if (inp != NULL && inp->inp_socket != NULL) {
1038 icmp_seq = htonl(th->th_seq);
1039 tp = intotcpcb(inp);
1040 if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
1041 SEQ_LT(icmp_seq, tp->snd_max))
1042 (*notify)(inp, inetctlerrmap[cmd]);
1043 } else {
1044 struct in_conninfo inc;
1045
1046 inc.inc_fport = th->th_dport;
1047 inc.inc_lport = th->th_sport;
1048 inc.inc_faddr = faddr;
1049 inc.inc_laddr = ip->ip_src;
1050#ifdef INET6
1051 inc.inc_isipv6 = 0;
1052#endif
1053 syncache_unreach(&inc, th);
1054 }
1055 splx(s);
1056 } else
1057 in_pcbnotifyall(&tcb, faddr, inetctlerrmap[cmd], notify);
1058}
1059
1060#ifdef INET6
1061void
1062tcp6_ctlinput(cmd, sa, d)
1063 int cmd;
1064 struct sockaddr *sa;
1065 void *d;
1066{
1067 struct tcphdr th;
1068 void (*notify) __P((struct inpcb *, int)) = tcp_notify;
1069 struct ip6_hdr *ip6;
1070 struct mbuf *m;
1071 struct ip6ctlparam *ip6cp = NULL;
1072 const struct sockaddr_in6 *sa6_src = NULL;
1073 int off;
1074 struct tcp_portonly {
1075 u_int16_t th_sport;
1076 u_int16_t th_dport;
1077 } *thp;
1078
1079 if (sa->sa_family != AF_INET6 ||
1080 sa->sa_len != sizeof(struct sockaddr_in6))
1081 return;
1082
1083 if (cmd == PRC_QUENCH)
1084 notify = tcp_quench;
1085 else if (cmd == PRC_MSGSIZE)
1086 notify = tcp_mtudisc;
1087 else if (!PRC_IS_REDIRECT(cmd) &&
1088 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1089 return;
1090
1091 /* if the parameter is from icmp6, decode it. */
1092 if (d != NULL) {
1093 ip6cp = (struct ip6ctlparam *)d;
1094 m = ip6cp->ip6c_m;
1095 ip6 = ip6cp->ip6c_ip6;
1096 off = ip6cp->ip6c_off;
1097 sa6_src = ip6cp->ip6c_src;
1098 } else {
1099 m = NULL;
1100 ip6 = NULL;
1101 off = 0; /* fool gcc */
1102 sa6_src = &sa6_any;
1103 }
1104
1105 if (ip6) {
1106 struct in_conninfo inc;
1107 /*
1108 * XXX: We assume that when IPV6 is non NULL,
1109 * M and OFF are valid.
1110 */
1111
1112 /* check if we can safely examine src and dst ports */
1113 if (m->m_pkthdr.len < off + sizeof(*thp))
1114 return;
1115
1116 bzero(&th, sizeof(th));
1117 m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
1118
1119 in6_pcbnotify(&tcb, sa, th.th_dport,
1120 (struct sockaddr *)ip6cp->ip6c_src,
1121 th.th_sport, cmd, notify);
1122
1123 inc.inc_fport = th.th_dport;
1124 inc.inc_lport = th.th_sport;
1125 inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
1126 inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
1127 inc.inc_isipv6 = 1;
1128 syncache_unreach(&inc, &th);
1129 } else
1130 in6_pcbnotify(&tcb, sa, 0, (struct sockaddr *)sa6_src,
1131 0, cmd, notify);
1132}
1133#endif /* INET6 */
1134
1135
1136/*
1137 * Following is where TCP initial sequence number generation occurs.
1138 *
1139 * There are two places where we must use initial sequence numbers:
1140 * 1. In SYN-ACK packets.
1141 * 2. In SYN packets.
1142 *
1143 * The ISNs in SYN-ACK packets have no monotonicity requirement,
1144 * and should be as unpredictable as possible to avoid the possibility
1145 * of spoofing and/or connection hijacking. To satisfy this
1146 * requirement, SYN-ACK ISNs are generated via the arc4random()
1147 * function. If exact RFC 1948 compliance is requested via sysctl,
1148 * these ISNs will be generated just like those in SYN packets.
1149 *
1150 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
1151 * depends on this property. In addition, these ISNs should be
1152 * unguessable so as to prevent connection hijacking. To satisfy
1153 * the requirements of this situation, the algorithm outlined in
1154 * RFC 1948 is used to generate sequence numbers.
1155 *
1156 * For more information on the theory of operation, please see
1157 * RFC 1948.
1158 *
1159 * Implementation details:
1160 *
1161 * Time is based off the system timer, and is corrected so that it
1162 * increases by one megabyte per second. This allows for proper
1163 * recycling on high speed LANs while still leaving over an hour
1164 * before rollover.
1165 *
1166 * Two sysctls control the generation of ISNs:
1167 *
1168 * net.inet.tcp.isn_reseed_interval controls the number of seconds
1169 * between seeding of isn_secret. This is normally set to zero,
1170 * as reseeding should not be necessary.
1171 *
1172 * net.inet.tcp.strict_rfc1948 controls whether RFC 1948 is followed
1173 * strictly. When strict compliance is requested, reseeding is
1174 * disabled and SYN-ACKs will be generated in the same manner as
1175 * SYNs. Strict mode is disabled by default.
1176 *
1177 */
1178
1179#define ISN_BYTES_PER_SECOND 1048576
1180
1181u_char isn_secret[32];
1182int isn_last_reseed;
1183MD5_CTX isn_ctx;
1184
1185tcp_seq
1186tcp_new_isn(tp)
1187 struct tcpcb *tp;
1188{
1189 u_int32_t md5_buffer[4];
1190 tcp_seq new_isn;
1191
1192 /* Use arc4random for SYN-ACKs when not in exact RFC1948 mode. */
1193 if (((tp->t_state == TCPS_LISTEN) || (tp->t_state == TCPS_TIME_WAIT))
1194 && tcp_strict_rfc1948 == 0)
1195 return arc4random();
1196
1197 /* Seed if this is the first use, reseed if requested. */
1198 if ((isn_last_reseed == 0) ||
1199 ((tcp_strict_rfc1948 == 0) && (tcp_isn_reseed_interval > 0) &&
1200 (((u_int)isn_last_reseed + (u_int)tcp_isn_reseed_interval*hz)
1201 < (u_int)ticks))) {
1202 read_random(&isn_secret, sizeof(isn_secret));
1203 isn_last_reseed = ticks;
1204 }
1205
1206 /* Compute the md5 hash and return the ISN. */
1207 MD5Init(&isn_ctx);
1208 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_fport, sizeof(u_short));
1209 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_lport, sizeof(u_short));
1210#ifdef INET6
1211 if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
1212 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
1213 sizeof(struct in6_addr));
1214 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
1215 sizeof(struct in6_addr));
1216 } else
1217#endif
1218 {
1219 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
1220 sizeof(struct in_addr));
1221 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
1222 sizeof(struct in_addr));
1223 }
1224 MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret));
1225 MD5Final((u_char *) &md5_buffer, &isn_ctx);
1226 new_isn = (tcp_seq) md5_buffer[0];
1227 new_isn += ticks * (ISN_BYTES_PER_SECOND / hz);
1228 return new_isn;
1229}
1230
1231/*
1232 * When a source quench is received, close congestion window
1233 * to one segment. We will gradually open it again as we proceed.
1234 */
1235void
1236tcp_quench(inp, errno)
1237 struct inpcb *inp;
1238 int errno;
1239{
1240 struct tcpcb *tp = intotcpcb(inp);
1241
1242 if (tp)
1243 tp->snd_cwnd = tp->t_maxseg;
1244}
1245
1246/*
1247 * When a specific ICMP unreachable message is received and the
1248 * connection state is SYN-SENT, drop the connection. This behavior
1249 * is controlled by the icmp_may_rst sysctl.
1250 */
1251void
1252tcp_drop_syn_sent(inp, errno)
1253 struct inpcb *inp;
1254 int errno;
1255{
1256 struct tcpcb *tp = intotcpcb(inp);
1257
1258 if (tp && tp->t_state == TCPS_SYN_SENT)
1259 tcp_drop(tp, errno);
1260}
1261
1262/*
1263 * When `need fragmentation' ICMP is received, update our idea of the MSS
1264 * based on the new value in the route. Also nudge TCP to send something,
1265 * since we know the packet we just sent was dropped.
1266 * This duplicates some code in the tcp_mss() function in tcp_input.c.
1267 */
1268void
1269tcp_mtudisc(inp, errno)
1270 struct inpcb *inp;
1271 int errno;
1272{
1273 struct tcpcb *tp = intotcpcb(inp);
1274 struct rtentry *rt;
1275 struct rmxp_tao *taop;
1276 struct socket *so = inp->inp_socket;
1277 int offered;
1278 int mss;
1279#ifdef INET6
1280 int isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0;
1281#endif /* INET6 */
1282
1283 if (tp) {
1284#ifdef INET6
1285 if (isipv6)
1286 rt = tcp_rtlookup6(&inp->inp_inc);
1287 else
1288#endif /* INET6 */
1289 rt = tcp_rtlookup(&inp->inp_inc);
1290 if (!rt || !rt->rt_rmx.rmx_mtu) {
1291 tp->t_maxopd = tp->t_maxseg =
1292#ifdef INET6
1293 isipv6 ? tcp_v6mssdflt :
1294#endif /* INET6 */
1295 tcp_mssdflt;
1296 return;
1297 }
1298 taop = rmx_taop(rt->rt_rmx);
1299 offered = taop->tao_mssopt;
1300 mss = rt->rt_rmx.rmx_mtu -
1301#ifdef INET6
1302 (isipv6 ?
1303 sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
1304#endif /* INET6 */
1305 sizeof(struct tcpiphdr)
1306#ifdef INET6
1307 )
1308#endif /* INET6 */
1309 ;
1310
1311 if (offered)
1312 mss = min(mss, offered);
1313 /*
1314 * XXX - The above conditional probably violates the TCP
1315 * spec. The problem is that, since we don't know the
1316 * other end's MSS, we are supposed to use a conservative
1317 * default. But, if we do that, then MTU discovery will
1318 * never actually take place, because the conservative
1319 * default is much less than the MTUs typically seen
1320 * on the Internet today. For the moment, we'll sweep
1321 * this under the carpet.
1322 *
1323 * The conservative default might not actually be a problem
1324 * if the only case this occurs is when sending an initial
1325 * SYN with options and data to a host we've never talked
1326 * to before. Then, they will reply with an MSS value which
1327 * will get recorded and the new parameters should get
1328 * recomputed. For Further Study.
1329 */
1330 if (tp->t_maxopd <= mss)
1331 return;
1332 tp->t_maxopd = mss;
1333
1334 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
1335 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
1336 mss -= TCPOLEN_TSTAMP_APPA;
1337 if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
1338 (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)
1339 mss -= TCPOLEN_CC_APPA;
1340#if (MCLBYTES & (MCLBYTES - 1)) == 0
1341 if (mss > MCLBYTES)
1342 mss &= ~(MCLBYTES-1);
1343#else
1344 if (mss > MCLBYTES)
1345 mss = mss / MCLBYTES * MCLBYTES;
1346#endif
1347 if (so->so_snd.sb_hiwat < mss)
1348 mss = so->so_snd.sb_hiwat;
1349
1350 tp->t_maxseg = mss;
1351
1352 tcpstat.tcps_mturesent++;
1353 tp->t_rtttime = 0;
1354 tp->snd_nxt = tp->snd_una;
1355 tcp_output(tp);
1356 }
1357}
1358
1359/*
1360 * Look-up the routing entry to the peer of this inpcb. If no route
1361 * is found and it cannot be allocated the return NULL. This routine
1362 * is called by TCP routines that access the rmx structure and by tcp_mss
1363 * to get the interface MTU.
1364 */
1365struct rtentry *
1366tcp_rtlookup(inc)
1367 struct in_conninfo *inc;
1368{
1369 struct route *ro;
1370 struct rtentry *rt;
1371
1372 ro = &inc->inc_route;
1373 rt = ro->ro_rt;
1374 if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1375 /* No route yet, so try to acquire one */
1376 if (inc->inc_faddr.s_addr != INADDR_ANY) {
1377 ro->ro_dst.sa_family = AF_INET;
1378 ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
1379 ((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1380 inc->inc_faddr;
1381 rtalloc(ro);
1382 rt = ro->ro_rt;
1383 }
1384 }
1385 return rt;
1386}
1387
1388#ifdef INET6
1389struct rtentry *
1390tcp_rtlookup6(inc)
1391 struct in_conninfo *inc;
1392{
1393 struct route_in6 *ro6;
1394 struct rtentry *rt;
1395
1396 ro6 = &inc->inc6_route;
1397 rt = ro6->ro_rt;
1398 if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1399 /* No route yet, so try to acquire one */
1400 if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
1401 ro6->ro_dst.sin6_family = AF_INET6;
1402 ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
1403 ro6->ro_dst.sin6_addr = inc->inc6_faddr;
1404 rtalloc((struct route *)ro6);
1405 rt = ro6->ro_rt;
1406 }
1407 }
1408 return rt;
1409}
1410#endif /* INET6 */
1411
1412#ifdef IPSEC
1413/* compute ESP/AH header size for TCP, including outer IP header. */
1414size_t
1415ipsec_hdrsiz_tcp(tp)
1416 struct tcpcb *tp;
1417{
1418 struct inpcb *inp;
1419 struct mbuf *m;
1420 size_t hdrsiz;
1421 struct ip *ip;
1422#ifdef INET6
1423 struct ip6_hdr *ip6;
1424#endif /* INET6 */
1425 struct tcphdr *th;
1426
1427 if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
1428 return 0;
1429 MGETHDR(m, M_DONTWAIT, MT_DATA);
1430 if (!m)
1431 return 0;
1432
1433#ifdef INET6
1434 if ((inp->inp_vflag & INP_IPV6) != 0) {
1435 ip6 = mtod(m, struct ip6_hdr *);
1436 th = (struct tcphdr *)(ip6 + 1);
1437 m->m_pkthdr.len = m->m_len =
1438 sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
1439 tcp_fillheaders(tp, ip6, th);
1440 hdrsiz = ipsec6_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1441 } else
1442#endif /* INET6 */
1443 {
1444 ip = mtod(m, struct ip *);
1445 th = (struct tcphdr *)(ip + 1);
1446 m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
1447 tcp_fillheaders(tp, ip, th);
1448 hdrsiz = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1449 }
1450
1451 m_free(m);
1452 return hdrsiz;
1453}
1454#endif /*IPSEC*/
1455
1456/*
1457 * Return a pointer to the cached information about the remote host.
1458 * The cached information is stored in the protocol specific part of
1459 * the route metrics.
1460 */
1461struct rmxp_tao *
1462tcp_gettaocache(inc)
1463 struct in_conninfo *inc;
1464{
1465 struct rtentry *rt;
1466
1467#ifdef INET6
1468 if (inc->inc_isipv6)
1469 rt = tcp_rtlookup6(inc);
1470 else
1471#endif /* INET6 */
1472 rt = tcp_rtlookup(inc);
1473
1474 /* Make sure this is a host route and is up. */
1475 if (rt == NULL ||
1476 (rt->rt_flags & (RTF_UP|RTF_HOST)) != (RTF_UP|RTF_HOST))
1477 return NULL;
1478
1479 return rmx_taop(rt->rt_rmx);
1480}
1481
1482/*
1483 * Clear all the TAO cache entries, called from tcp_init.
1484 *
1485 * XXX
1486 * This routine is just an empty one, because we assume that the routing
1487 * routing tables are initialized at the same time when TCP, so there is
1488 * nothing in the cache left over.
1489 */
1490static void
1491tcp_cleartaocache()
1492{
1493}
| 978 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
979out:
980 splx(s);
981 return (error);
982}
983
984SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred,
985 CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
986 tcp6_getcred, "S,xucred", "Get the xucred of a TCP6 connection");
987#endif
988
989
990void
991tcp_ctlinput(cmd, sa, vip)
992 int cmd;
993 struct sockaddr *sa;
994 void *vip;
995{
996 struct ip *ip = vip;
997 struct tcphdr *th;
998 struct in_addr faddr;
999 struct inpcb *inp;
1000 struct tcpcb *tp;
1001 void (*notify) __P((struct inpcb *, int)) = tcp_notify;
1002 tcp_seq icmp_seq;
1003 int s;
1004
1005 faddr = ((struct sockaddr_in *)sa)->sin_addr;
1006 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1007 return;
1008
1009 if (cmd == PRC_QUENCH)
1010 notify = tcp_quench;
1011 else if (icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||
1012 cmd == PRC_UNREACH_PORT) && ip)
1013 notify = tcp_drop_syn_sent;
1014 else if (cmd == PRC_MSGSIZE)
1015 notify = tcp_mtudisc;
1016 else if (PRC_IS_REDIRECT(cmd)) {
1017 ip = 0;
1018 notify = in_rtchange;
1019 } else if (cmd == PRC_HOSTDEAD)
1020 ip = 0;
1021 else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
1022 return;
1023 if (ip) {
1024 s = splnet();
1025 th = (struct tcphdr *)((caddr_t)ip
1026 + (IP_VHL_HL(ip->ip_vhl) << 2));
1027 inp = in_pcblookup_hash(&tcbinfo, faddr, th->th_dport,
1028 ip->ip_src, th->th_sport, 0, NULL);
1029 if (inp != NULL && inp->inp_socket != NULL) {
1030 icmp_seq = htonl(th->th_seq);
1031 tp = intotcpcb(inp);
1032 if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
1033 SEQ_LT(icmp_seq, tp->snd_max))
1034 (*notify)(inp, inetctlerrmap[cmd]);
1035 } else {
1036 struct in_conninfo inc;
1037
1038 inc.inc_fport = th->th_dport;
1039 inc.inc_lport = th->th_sport;
1040 inc.inc_faddr = faddr;
1041 inc.inc_laddr = ip->ip_src;
1042#ifdef INET6
1043 inc.inc_isipv6 = 0;
1044#endif
1045 syncache_unreach(&inc, th);
1046 }
1047 splx(s);
1048 } else
1049 in_pcbnotifyall(&tcb, faddr, inetctlerrmap[cmd], notify);
1050}
1051
1052#ifdef INET6
1053void
1054tcp6_ctlinput(cmd, sa, d)
1055 int cmd;
1056 struct sockaddr *sa;
1057 void *d;
1058{
1059 struct tcphdr th;
1060 void (*notify) __P((struct inpcb *, int)) = tcp_notify;
1061 struct ip6_hdr *ip6;
1062 struct mbuf *m;
1063 struct ip6ctlparam *ip6cp = NULL;
1064 const struct sockaddr_in6 *sa6_src = NULL;
1065 int off;
1066 struct tcp_portonly {
1067 u_int16_t th_sport;
1068 u_int16_t th_dport;
1069 } *thp;
1070
1071 if (sa->sa_family != AF_INET6 ||
1072 sa->sa_len != sizeof(struct sockaddr_in6))
1073 return;
1074
1075 if (cmd == PRC_QUENCH)
1076 notify = tcp_quench;
1077 else if (cmd == PRC_MSGSIZE)
1078 notify = tcp_mtudisc;
1079 else if (!PRC_IS_REDIRECT(cmd) &&
1080 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1081 return;
1082
1083 /* if the parameter is from icmp6, decode it. */
1084 if (d != NULL) {
1085 ip6cp = (struct ip6ctlparam *)d;
1086 m = ip6cp->ip6c_m;
1087 ip6 = ip6cp->ip6c_ip6;
1088 off = ip6cp->ip6c_off;
1089 sa6_src = ip6cp->ip6c_src;
1090 } else {
1091 m = NULL;
1092 ip6 = NULL;
1093 off = 0; /* fool gcc */
1094 sa6_src = &sa6_any;
1095 }
1096
1097 if (ip6) {
1098 struct in_conninfo inc;
1099 /*
1100 * XXX: We assume that when IPV6 is non NULL,
1101 * M and OFF are valid.
1102 */
1103
1104 /* check if we can safely examine src and dst ports */
1105 if (m->m_pkthdr.len < off + sizeof(*thp))
1106 return;
1107
1108 bzero(&th, sizeof(th));
1109 m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
1110
1111 in6_pcbnotify(&tcb, sa, th.th_dport,
1112 (struct sockaddr *)ip6cp->ip6c_src,
1113 th.th_sport, cmd, notify);
1114
1115 inc.inc_fport = th.th_dport;
1116 inc.inc_lport = th.th_sport;
1117 inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
1118 inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
1119 inc.inc_isipv6 = 1;
1120 syncache_unreach(&inc, &th);
1121 } else
1122 in6_pcbnotify(&tcb, sa, 0, (struct sockaddr *)sa6_src,
1123 0, cmd, notify);
1124}
1125#endif /* INET6 */
1126
1127
1128/*
1129 * Following is where TCP initial sequence number generation occurs.
1130 *
1131 * There are two places where we must use initial sequence numbers:
1132 * 1. In SYN-ACK packets.
1133 * 2. In SYN packets.
1134 *
1135 * The ISNs in SYN-ACK packets have no monotonicity requirement,
1136 * and should be as unpredictable as possible to avoid the possibility
1137 * of spoofing and/or connection hijacking. To satisfy this
1138 * requirement, SYN-ACK ISNs are generated via the arc4random()
1139 * function. If exact RFC 1948 compliance is requested via sysctl,
1140 * these ISNs will be generated just like those in SYN packets.
1141 *
1142 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
1143 * depends on this property. In addition, these ISNs should be
1144 * unguessable so as to prevent connection hijacking. To satisfy
1145 * the requirements of this situation, the algorithm outlined in
1146 * RFC 1948 is used to generate sequence numbers.
1147 *
1148 * For more information on the theory of operation, please see
1149 * RFC 1948.
1150 *
1151 * Implementation details:
1152 *
1153 * Time is based off the system timer, and is corrected so that it
1154 * increases by one megabyte per second. This allows for proper
1155 * recycling on high speed LANs while still leaving over an hour
1156 * before rollover.
1157 *
1158 * Two sysctls control the generation of ISNs:
1159 *
1160 * net.inet.tcp.isn_reseed_interval controls the number of seconds
1161 * between seeding of isn_secret. This is normally set to zero,
1162 * as reseeding should not be necessary.
1163 *
1164 * net.inet.tcp.strict_rfc1948 controls whether RFC 1948 is followed
1165 * strictly. When strict compliance is requested, reseeding is
1166 * disabled and SYN-ACKs will be generated in the same manner as
1167 * SYNs. Strict mode is disabled by default.
1168 *
1169 */
1170
1171#define ISN_BYTES_PER_SECOND 1048576
1172
1173u_char isn_secret[32];
1174int isn_last_reseed;
1175MD5_CTX isn_ctx;
1176
1177tcp_seq
1178tcp_new_isn(tp)
1179 struct tcpcb *tp;
1180{
1181 u_int32_t md5_buffer[4];
1182 tcp_seq new_isn;
1183
1184 /* Use arc4random for SYN-ACKs when not in exact RFC1948 mode. */
1185 if (((tp->t_state == TCPS_LISTEN) || (tp->t_state == TCPS_TIME_WAIT))
1186 && tcp_strict_rfc1948 == 0)
1187 return arc4random();
1188
1189 /* Seed if this is the first use, reseed if requested. */
1190 if ((isn_last_reseed == 0) ||
1191 ((tcp_strict_rfc1948 == 0) && (tcp_isn_reseed_interval > 0) &&
1192 (((u_int)isn_last_reseed + (u_int)tcp_isn_reseed_interval*hz)
1193 < (u_int)ticks))) {
1194 read_random(&isn_secret, sizeof(isn_secret));
1195 isn_last_reseed = ticks;
1196 }
1197
1198 /* Compute the md5 hash and return the ISN. */
1199 MD5Init(&isn_ctx);
1200 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_fport, sizeof(u_short));
1201 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_lport, sizeof(u_short));
1202#ifdef INET6
1203 if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
1204 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
1205 sizeof(struct in6_addr));
1206 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
1207 sizeof(struct in6_addr));
1208 } else
1209#endif
1210 {
1211 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
1212 sizeof(struct in_addr));
1213 MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
1214 sizeof(struct in_addr));
1215 }
1216 MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret));
1217 MD5Final((u_char *) &md5_buffer, &isn_ctx);
1218 new_isn = (tcp_seq) md5_buffer[0];
1219 new_isn += ticks * (ISN_BYTES_PER_SECOND / hz);
1220 return new_isn;
1221}
1222
1223/*
1224 * When a source quench is received, close congestion window
1225 * to one segment. We will gradually open it again as we proceed.
1226 */
1227void
1228tcp_quench(inp, errno)
1229 struct inpcb *inp;
1230 int errno;
1231{
1232 struct tcpcb *tp = intotcpcb(inp);
1233
1234 if (tp)
1235 tp->snd_cwnd = tp->t_maxseg;
1236}
1237
1238/*
1239 * When a specific ICMP unreachable message is received and the
1240 * connection state is SYN-SENT, drop the connection. This behavior
1241 * is controlled by the icmp_may_rst sysctl.
1242 */
1243void
1244tcp_drop_syn_sent(inp, errno)
1245 struct inpcb *inp;
1246 int errno;
1247{
1248 struct tcpcb *tp = intotcpcb(inp);
1249
1250 if (tp && tp->t_state == TCPS_SYN_SENT)
1251 tcp_drop(tp, errno);
1252}
1253
1254/*
1255 * When `need fragmentation' ICMP is received, update our idea of the MSS
1256 * based on the new value in the route. Also nudge TCP to send something,
1257 * since we know the packet we just sent was dropped.
1258 * This duplicates some code in the tcp_mss() function in tcp_input.c.
1259 */
1260void
1261tcp_mtudisc(inp, errno)
1262 struct inpcb *inp;
1263 int errno;
1264{
1265 struct tcpcb *tp = intotcpcb(inp);
1266 struct rtentry *rt;
1267 struct rmxp_tao *taop;
1268 struct socket *so = inp->inp_socket;
1269 int offered;
1270 int mss;
1271#ifdef INET6
1272 int isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0;
1273#endif /* INET6 */
1274
1275 if (tp) {
1276#ifdef INET6
1277 if (isipv6)
1278 rt = tcp_rtlookup6(&inp->inp_inc);
1279 else
1280#endif /* INET6 */
1281 rt = tcp_rtlookup(&inp->inp_inc);
1282 if (!rt || !rt->rt_rmx.rmx_mtu) {
1283 tp->t_maxopd = tp->t_maxseg =
1284#ifdef INET6
1285 isipv6 ? tcp_v6mssdflt :
1286#endif /* INET6 */
1287 tcp_mssdflt;
1288 return;
1289 }
1290 taop = rmx_taop(rt->rt_rmx);
1291 offered = taop->tao_mssopt;
1292 mss = rt->rt_rmx.rmx_mtu -
1293#ifdef INET6
1294 (isipv6 ?
1295 sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
1296#endif /* INET6 */
1297 sizeof(struct tcpiphdr)
1298#ifdef INET6
1299 )
1300#endif /* INET6 */
1301 ;
1302
1303 if (offered)
1304 mss = min(mss, offered);
1305 /*
1306 * XXX - The above conditional probably violates the TCP
1307 * spec. The problem is that, since we don't know the
1308 * other end's MSS, we are supposed to use a conservative
1309 * default. But, if we do that, then MTU discovery will
1310 * never actually take place, because the conservative
1311 * default is much less than the MTUs typically seen
1312 * on the Internet today. For the moment, we'll sweep
1313 * this under the carpet.
1314 *
1315 * The conservative default might not actually be a problem
1316 * if the only case this occurs is when sending an initial
1317 * SYN with options and data to a host we've never talked
1318 * to before. Then, they will reply with an MSS value which
1319 * will get recorded and the new parameters should get
1320 * recomputed. For Further Study.
1321 */
1322 if (tp->t_maxopd <= mss)
1323 return;
1324 tp->t_maxopd = mss;
1325
1326 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
1327 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
1328 mss -= TCPOLEN_TSTAMP_APPA;
1329 if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
1330 (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)
1331 mss -= TCPOLEN_CC_APPA;
1332#if (MCLBYTES & (MCLBYTES - 1)) == 0
1333 if (mss > MCLBYTES)
1334 mss &= ~(MCLBYTES-1);
1335#else
1336 if (mss > MCLBYTES)
1337 mss = mss / MCLBYTES * MCLBYTES;
1338#endif
1339 if (so->so_snd.sb_hiwat < mss)
1340 mss = so->so_snd.sb_hiwat;
1341
1342 tp->t_maxseg = mss;
1343
1344 tcpstat.tcps_mturesent++;
1345 tp->t_rtttime = 0;
1346 tp->snd_nxt = tp->snd_una;
1347 tcp_output(tp);
1348 }
1349}
1350
1351/*
1352 * Look-up the routing entry to the peer of this inpcb. If no route
1353 * is found and it cannot be allocated the return NULL. This routine
1354 * is called by TCP routines that access the rmx structure and by tcp_mss
1355 * to get the interface MTU.
1356 */
1357struct rtentry *
1358tcp_rtlookup(inc)
1359 struct in_conninfo *inc;
1360{
1361 struct route *ro;
1362 struct rtentry *rt;
1363
1364 ro = &inc->inc_route;
1365 rt = ro->ro_rt;
1366 if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1367 /* No route yet, so try to acquire one */
1368 if (inc->inc_faddr.s_addr != INADDR_ANY) {
1369 ro->ro_dst.sa_family = AF_INET;
1370 ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
1371 ((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1372 inc->inc_faddr;
1373 rtalloc(ro);
1374 rt = ro->ro_rt;
1375 }
1376 }
1377 return rt;
1378}
1379
1380#ifdef INET6
1381struct rtentry *
1382tcp_rtlookup6(inc)
1383 struct in_conninfo *inc;
1384{
1385 struct route_in6 *ro6;
1386 struct rtentry *rt;
1387
1388 ro6 = &inc->inc6_route;
1389 rt = ro6->ro_rt;
1390 if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1391 /* No route yet, so try to acquire one */
1392 if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
1393 ro6->ro_dst.sin6_family = AF_INET6;
1394 ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
1395 ro6->ro_dst.sin6_addr = inc->inc6_faddr;
1396 rtalloc((struct route *)ro6);
1397 rt = ro6->ro_rt;
1398 }
1399 }
1400 return rt;
1401}
1402#endif /* INET6 */
1403
1404#ifdef IPSEC
1405/* compute ESP/AH header size for TCP, including outer IP header. */
1406size_t
1407ipsec_hdrsiz_tcp(tp)
1408 struct tcpcb *tp;
1409{
1410 struct inpcb *inp;
1411 struct mbuf *m;
1412 size_t hdrsiz;
1413 struct ip *ip;
1414#ifdef INET6
1415 struct ip6_hdr *ip6;
1416#endif /* INET6 */
1417 struct tcphdr *th;
1418
1419 if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
1420 return 0;
1421 MGETHDR(m, M_DONTWAIT, MT_DATA);
1422 if (!m)
1423 return 0;
1424
1425#ifdef INET6
1426 if ((inp->inp_vflag & INP_IPV6) != 0) {
1427 ip6 = mtod(m, struct ip6_hdr *);
1428 th = (struct tcphdr *)(ip6 + 1);
1429 m->m_pkthdr.len = m->m_len =
1430 sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
1431 tcp_fillheaders(tp, ip6, th);
1432 hdrsiz = ipsec6_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1433 } else
1434#endif /* INET6 */
1435 {
1436 ip = mtod(m, struct ip *);
1437 th = (struct tcphdr *)(ip + 1);
1438 m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
1439 tcp_fillheaders(tp, ip, th);
1440 hdrsiz = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1441 }
1442
1443 m_free(m);
1444 return hdrsiz;
1445}
1446#endif /*IPSEC*/
1447
1448/*
1449 * Return a pointer to the cached information about the remote host.
1450 * The cached information is stored in the protocol specific part of
1451 * the route metrics.
1452 */
1453struct rmxp_tao *
1454tcp_gettaocache(inc)
1455 struct in_conninfo *inc;
1456{
1457 struct rtentry *rt;
1458
1459#ifdef INET6
1460 if (inc->inc_isipv6)
1461 rt = tcp_rtlookup6(inc);
1462 else
1463#endif /* INET6 */
1464 rt = tcp_rtlookup(inc);
1465
1466 /* Make sure this is a host route and is up. */
1467 if (rt == NULL ||
1468 (rt->rt_flags & (RTF_UP|RTF_HOST)) != (RTF_UP|RTF_HOST))
1469 return NULL;
1470
1471 return rmx_taop(rt->rt_rmx);
1472}
1473
1474/*
1475 * Clear all the TAO cache entries, called from tcp_init.
1476 *
1477 * XXX
1478 * This routine is just an empty one, because we assume that the routing
1479 * routing tables are initialized at the same time when TCP, so there is
1480 * nothing in the cache left over.
1481 */
1482static void
1483tcp_cleartaocache()
1484{
1485}
|