91#ifdef IPSEC
92#include <netipsec/ipsec.h>
93#include <netipsec/ipsec6.h>
94#endif /*IPSEC*/
95
96#include <machine/in_cksum.h>
97
98#include <security/mac/mac_framework.h>
99
100static const int tcprexmtthresh = 3;
101
102#ifdef VIMAGE_GLOBALS
103struct tcpstat tcpstat;
104int blackhole;
105int tcp_delack_enabled;
106int drop_synfin;
107int tcp_do_rfc3042;
108int tcp_do_rfc3390;
109int tcp_do_ecn;
110int tcp_ecn_maxretries;
111int tcp_insecure_rst;
112int tcp_do_autorcvbuf;
113int tcp_autorcvbuf_inc;
114int tcp_autorcvbuf_max;
115#endif
116
117SYSCTL_V_STRUCT(V_NET, vnet_inet, _net_inet_tcp, TCPCTL_STATS, stats,
118 CTLFLAG_RW, tcpstat , tcpstat,
119 "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
120
121int tcp_log_in_vain = 0;
122SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
123 &tcp_log_in_vain, 0, "Log all incoming TCP segments to closed ports");
124
125SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
126 blackhole, 0, "Do not send RST on segments to closed ports");
127
128SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, delayed_ack,
129 CTLFLAG_RW, tcp_delack_enabled, 0,
130 "Delay ACK to try and piggyback it onto a data packet");
131
132SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, drop_synfin,
133 CTLFLAG_RW, drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
134
135SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_RW,
136 tcp_do_rfc3042, 0, "Enable RFC 3042 (Limited Transmit)");
137
138SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
139 tcp_do_rfc3390, 0,
140 "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
141
142SYSCTL_NODE(_net_inet_tcp, OID_AUTO, ecn, CTLFLAG_RW, 0, "TCP ECN");
143SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp_ecn, OID_AUTO, enable,
144 CTLFLAG_RW, tcp_do_ecn, 0, "TCP ECN support");
145SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp_ecn, OID_AUTO, maxretries,
146 CTLFLAG_RW, tcp_ecn_maxretries, 0, "Max retries before giving up on ECN");
147
148SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, insecure_rst,
149 CTLFLAG_RW, tcp_insecure_rst, 0,
150 "Follow the old (insecure) criteria for accepting RST packets");
151
152SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_auto,
153 CTLFLAG_RW, tcp_do_autorcvbuf, 0,
154 "Enable automatic receive buffer sizing");
155
156SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_inc,
157 CTLFLAG_RW, tcp_autorcvbuf_inc, 0,
158 "Incrementor step size of automatic receive buffer");
159
160SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_max,
161 CTLFLAG_RW, tcp_autorcvbuf_max, 0,
162 "Max size of automatic receive buffer");
163
164#ifdef VIMAGE_GLOBALS
165struct inpcbhead tcb;
166struct inpcbinfo tcbinfo;
167#endif
168#define tcb6 tcb /* for KAME src sync over BSD*'s */
169
170static void tcp_dooptions(struct tcpopt *, u_char *, int, int);
171static void tcp_do_segment(struct mbuf *, struct tcphdr *,
172 struct socket *, struct tcpcb *, int, int, uint8_t);
173static void tcp_dropwithreset(struct mbuf *, struct tcphdr *,
174 struct tcpcb *, int, int);
175static void tcp_pulloutofband(struct socket *,
176 struct tcphdr *, struct mbuf *, int);
177static void tcp_xmit_timer(struct tcpcb *, int);
178static void tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *);
179static void inline
180 tcp_congestion_exp(struct tcpcb *);
181
182static void inline
183tcp_congestion_exp(struct tcpcb *tp)
184{
185 u_int win;
186
187 win = min(tp->snd_wnd, tp->snd_cwnd) /
188 2 / tp->t_maxseg;
189 if (win < 2)
190 win = 2;
191 tp->snd_ssthresh = win * tp->t_maxseg;
192 ENTER_FASTRECOVERY(tp);
193 tp->snd_recover = tp->snd_max;
194 if (tp->t_flags & TF_ECN_PERMIT)
195 tp->t_flags |= TF_ECN_SND_CWR;
196}
197
198/* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
199#ifdef INET6
200#define ND6_HINT(tp) \
201do { \
202 if ((tp) && (tp)->t_inpcb && \
203 ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0) \
204 nd6_nud_hint(NULL, NULL, 0); \
205} while (0)
206#else
207#define ND6_HINT(tp)
208#endif
209
210/*
211 * Indicate whether this ack should be delayed. We can delay the ack if
212 * - there is no delayed ack timer in progress and
213 * - our last ack wasn't a 0-sized window. We never want to delay
214 * the ack that opens up a 0-sized window and
215 * - delayed acks are enabled or
216 * - this is a half-synchronized T/TCP connection.
217 */
218#define DELAY_ACK(tp) \
219 ((!tcp_timer_active(tp, TT_DELACK) && \
220 (tp->t_flags & TF_RXWIN0SENT) == 0) && \
221 (V_tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN)))
222
223/*
224 * TCP input handling is split into multiple parts:
225 * tcp6_input is a thin wrapper around tcp_input for the extended
226 * ip6_protox[] call format in ip6_input
227 * tcp_input handles primary segment validation, inpcb lookup and
228 * SYN processing on listen sockets
229 * tcp_do_segment processes the ACK and text of the segment for
230 * establishing, established and closing connections
231 */
232#ifdef INET6
233int
234tcp6_input(struct mbuf **mp, int *offp, int proto)
235{
236 INIT_VNET_INET6(curvnet);
237 struct mbuf *m = *mp;
238 struct in6_ifaddr *ia6;
239
240 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
241
242 /*
243 * draft-itojun-ipv6-tcp-to-anycast
244 * better place to put this in?
245 */
246 ia6 = ip6_getdstifaddr(m);
247 if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
248 struct ip6_hdr *ip6;
249
250 ip6 = mtod(m, struct ip6_hdr *);
251 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
252 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
253 return IPPROTO_DONE;
254 }
255
256 tcp_input(m, *offp);
257 return IPPROTO_DONE;
258}
259#endif
260
261void
262tcp_input(struct mbuf *m, int off0)
263{
264 INIT_VNET_INET(curvnet);
265#ifdef INET6
266 INIT_VNET_INET6(curvnet);
267#endif
268#ifdef IPSEC
269 INIT_VNET_IPSEC(curvnet);
270#endif
271 struct tcphdr *th;
272 struct ip *ip = NULL;
273 struct ipovly *ipov;
274 struct inpcb *inp = NULL;
275 struct tcpcb *tp = NULL;
276 struct socket *so = NULL;
277 u_char *optp = NULL;
278 int optlen = 0;
279 int len, tlen, off;
280 int drop_hdrlen;
281 int thflags;
282 int rstreason = 0; /* For badport_bandlim accounting purposes */
283 uint8_t iptos;
284#ifdef IPFIREWALL_FORWARD
285 struct m_tag *fwd_tag;
286#endif
287#ifdef INET6
288 struct ip6_hdr *ip6 = NULL;
289 int isipv6;
290#else
291 const void *ip6 = NULL;
292 const int isipv6 = 0;
293#endif
294 struct tcpopt to; /* options in this segment */
295 char *s = NULL; /* address and port logging */
296
297#ifdef TCPDEBUG
298 /*
299 * The size of tcp_saveipgen must be the size of the max ip header,
300 * now IPv6.
301 */
302 u_char tcp_saveipgen[IP6_HDR_LEN];
303 struct tcphdr tcp_savetcp;
304 short ostate = 0;
305#endif
306
307#ifdef INET6
308 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
309#endif
310
311 to.to_flags = 0;
312 V_tcpstat.tcps_rcvtotal++;
313
314 if (isipv6) {
315#ifdef INET6
316 /* IP6_EXTHDR_CHECK() is already done at tcp6_input(). */
317 ip6 = mtod(m, struct ip6_hdr *);
318 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
319 if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
320 V_tcpstat.tcps_rcvbadsum++;
321 goto drop;
322 }
323 th = (struct tcphdr *)((caddr_t)ip6 + off0);
324
325 /*
326 * Be proactive about unspecified IPv6 address in source.
327 * As we use all-zero to indicate unbounded/unconnected pcb,
328 * unspecified IPv6 address can be used to confuse us.
329 *
330 * Note that packets with unspecified IPv6 destination is
331 * already dropped in ip6_input.
332 */
333 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
334 /* XXX stat */
335 goto drop;
336 }
337#else
338 th = NULL; /* XXX: Avoid compiler warning. */
339#endif
340 } else {
341 /*
342 * Get IP and TCP header together in first mbuf.
343 * Note: IP leaves IP header in first mbuf.
344 */
345 if (off0 > sizeof (struct ip)) {
346 ip_stripoptions(m, (struct mbuf *)0);
347 off0 = sizeof(struct ip);
348 }
349 if (m->m_len < sizeof (struct tcpiphdr)) {
350 if ((m = m_pullup(m, sizeof (struct tcpiphdr)))
351 == NULL) {
352 V_tcpstat.tcps_rcvshort++;
353 return;
354 }
355 }
356 ip = mtod(m, struct ip *);
357 ipov = (struct ipovly *)ip;
358 th = (struct tcphdr *)((caddr_t)ip + off0);
359 tlen = ip->ip_len;
360
361 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
362 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
363 th->th_sum = m->m_pkthdr.csum_data;
364 else
365 th->th_sum = in_pseudo(ip->ip_src.s_addr,
366 ip->ip_dst.s_addr,
367 htonl(m->m_pkthdr.csum_data +
368 ip->ip_len +
369 IPPROTO_TCP));
370 th->th_sum ^= 0xffff;
371#ifdef TCPDEBUG
372 ipov->ih_len = (u_short)tlen;
373 ipov->ih_len = htons(ipov->ih_len);
374#endif
375 } else {
376 /*
377 * Checksum extended TCP header and data.
378 */
379 len = sizeof (struct ip) + tlen;
380 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
381 ipov->ih_len = (u_short)tlen;
382 ipov->ih_len = htons(ipov->ih_len);
383 th->th_sum = in_cksum(m, len);
384 }
385 if (th->th_sum) {
386 V_tcpstat.tcps_rcvbadsum++;
387 goto drop;
388 }
389 /* Re-initialization for later version check */
390 ip->ip_v = IPVERSION;
391 }
392
393#ifdef INET6
394 if (isipv6)
395 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
396 else
397#endif
398 iptos = ip->ip_tos;
399
400 /*
401 * Check that TCP offset makes sense,
402 * pull out TCP options and adjust length. XXX
403 */
404 off = th->th_off << 2;
405 if (off < sizeof (struct tcphdr) || off > tlen) {
406 V_tcpstat.tcps_rcvbadoff++;
407 goto drop;
408 }
409 tlen -= off; /* tlen is used instead of ti->ti_len */
410 if (off > sizeof (struct tcphdr)) {
411 if (isipv6) {
412#ifdef INET6
413 IP6_EXTHDR_CHECK(m, off0, off, );
414 ip6 = mtod(m, struct ip6_hdr *);
415 th = (struct tcphdr *)((caddr_t)ip6 + off0);
416#endif
417 } else {
418 if (m->m_len < sizeof(struct ip) + off) {
419 if ((m = m_pullup(m, sizeof (struct ip) + off))
420 == NULL) {
421 V_tcpstat.tcps_rcvshort++;
422 return;
423 }
424 ip = mtod(m, struct ip *);
425 ipov = (struct ipovly *)ip;
426 th = (struct tcphdr *)((caddr_t)ip + off0);
427 }
428 }
429 optlen = off - sizeof (struct tcphdr);
430 optp = (u_char *)(th + 1);
431 }
432 thflags = th->th_flags;
433
434 /*
435 * Convert TCP protocol specific fields to host format.
436 */
437 th->th_seq = ntohl(th->th_seq);
438 th->th_ack = ntohl(th->th_ack);
439 th->th_win = ntohs(th->th_win);
440 th->th_urp = ntohs(th->th_urp);
441
442 /*
443 * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options.
444 */
445 drop_hdrlen = off0 + off;
446
447 /*
448 * Locate pcb for segment.
449 */
450 INP_INFO_WLOCK(&V_tcbinfo);
451findpcb:
452 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
453#ifdef IPFIREWALL_FORWARD
454 /*
455 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
456 */
457 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
458
459 if (fwd_tag != NULL && isipv6 == 0) { /* IPv6 support is not yet */
460 struct sockaddr_in *next_hop;
461
462 next_hop = (struct sockaddr_in *)(fwd_tag+1);
463 /*
464 * Transparently forwarded. Pretend to be the destination.
465 * already got one like this?
466 */
467 inp = in_pcblookup_hash(&V_tcbinfo,
468 ip->ip_src, th->th_sport,
469 ip->ip_dst, th->th_dport,
470 0, m->m_pkthdr.rcvif);
471 if (!inp) {
472 /* It's new. Try to find the ambushing socket. */
473 inp = in_pcblookup_hash(&V_tcbinfo,
474 ip->ip_src, th->th_sport,
475 next_hop->sin_addr,
476 next_hop->sin_port ?
477 ntohs(next_hop->sin_port) :
478 th->th_dport,
479 INPLOOKUP_WILDCARD,
480 m->m_pkthdr.rcvif);
481 }
482 /* Remove the tag from the packet. We don't need it anymore. */
483 m_tag_delete(m, fwd_tag);
484 } else
485#endif /* IPFIREWALL_FORWARD */
486 {
487 if (isipv6) {
488#ifdef INET6
489 inp = in6_pcblookup_hash(&V_tcbinfo,
490 &ip6->ip6_src, th->th_sport,
491 &ip6->ip6_dst, th->th_dport,
492 INPLOOKUP_WILDCARD,
493 m->m_pkthdr.rcvif);
494#endif
495 } else
496 inp = in_pcblookup_hash(&V_tcbinfo,
497 ip->ip_src, th->th_sport,
498 ip->ip_dst, th->th_dport,
499 INPLOOKUP_WILDCARD,
500 m->m_pkthdr.rcvif);
501 }
502
503 /*
504 * If the INPCB does not exist then all data in the incoming
505 * segment is discarded and an appropriate RST is sent back.
506 * XXX MRT Send RST using which routing table?
507 */
508 if (inp == NULL) {
509 /*
510 * Log communication attempts to ports that are not
511 * in use.
512 */
513 if ((tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
514 tcp_log_in_vain == 2) {
515 if ((s = tcp_log_addrs(NULL, th, (void *)ip, ip6)))
516 log(LOG_INFO, "%s; %s: Connection attempt "
517 "to closed port\n", s, __func__);
518 }
519 /*
520 * When blackholing do not respond with a RST but
521 * completely ignore the segment and drop it.
522 */
523 if ((V_blackhole == 1 && (thflags & TH_SYN)) ||
524 V_blackhole == 2)
525 goto dropunlock;
526
527 rstreason = BANDLIM_RST_CLOSEDPORT;
528 goto dropwithreset;
529 }
530 INP_WLOCK(inp);
531
532#ifdef IPSEC
533#ifdef INET6
534 if (isipv6 && ipsec6_in_reject(m, inp)) {
535 V_ipsec6stat.in_polvio++;
536 goto dropunlock;
537 } else
538#endif /* INET6 */
539 if (ipsec4_in_reject(m, inp) != 0) {
540 V_ipsec4stat.in_polvio++;
541 goto dropunlock;
542 }
543#endif /* IPSEC */
544
545 /*
546 * Check the minimum TTL for socket.
547 */
548 if (inp->inp_ip_minttl != 0) {
549#ifdef INET6
550 if (isipv6 && inp->inp_ip_minttl > ip6->ip6_hlim)
551 goto dropunlock;
552 else
553#endif
554 if (inp->inp_ip_minttl > ip->ip_ttl)
555 goto dropunlock;
556 }
557
558 /*
559 * A previous connection in TIMEWAIT state is supposed to catch
560 * stray or duplicate segments arriving late. If this segment
561 * was a legitimate new connection attempt the old INPCB gets
562 * removed and we can try again to find a listening socket.
563 */
564 if (inp->inp_vflag & INP_TIMEWAIT) {
565 if (thflags & TH_SYN)
566 tcp_dooptions(&to, optp, optlen, TO_SYN);
567 /*
568 * NB: tcp_twcheck unlocks the INP and frees the mbuf.
569 */
570 if (tcp_twcheck(inp, &to, th, m, tlen))
571 goto findpcb;
572 INP_INFO_WUNLOCK(&V_tcbinfo);
573 return;
574 }
575 /*
576 * The TCPCB may no longer exist if the connection is winding
577 * down or it is in the CLOSED state. Either way we drop the
578 * segment and send an appropriate response.
579 */
580 tp = intotcpcb(inp);
581 if (tp == NULL || tp->t_state == TCPS_CLOSED) {
582 rstreason = BANDLIM_RST_CLOSEDPORT;
583 goto dropwithreset;
584 }
585
586#ifdef MAC
587 INP_WLOCK_ASSERT(inp);
588 if (mac_inpcb_check_deliver(inp, m))
589 goto dropunlock;
590#endif
591 so = inp->inp_socket;
592 KASSERT(so != NULL, ("%s: so == NULL", __func__));
593#ifdef TCPDEBUG
594 if (so->so_options & SO_DEBUG) {
595 ostate = tp->t_state;
596 if (isipv6) {
597#ifdef INET6
598 bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6));
599#endif
600 } else
601 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
602 tcp_savetcp = *th;
603 }
604#endif
605 /*
606 * When the socket is accepting connections (the INPCB is in LISTEN
607 * state) we look into the SYN cache if this is a new connection
608 * attempt or the completion of a previous one.
609 */
610 if (so->so_options & SO_ACCEPTCONN) {
611 struct in_conninfo inc;
612
613 KASSERT(tp->t_state == TCPS_LISTEN, ("%s: so accepting but "
614 "tp not listening", __func__));
615
616 bzero(&inc, sizeof(inc));
617 inc.inc_isipv6 = isipv6;
618#ifdef INET6
619 if (isipv6) {
620 inc.inc6_faddr = ip6->ip6_src;
621 inc.inc6_laddr = ip6->ip6_dst;
622 } else
623#endif
624 {
625 inc.inc_faddr = ip->ip_src;
626 inc.inc_laddr = ip->ip_dst;
627 }
628 inc.inc_fport = th->th_sport;
629 inc.inc_lport = th->th_dport;
630
631 /*
632 * Check for an existing connection attempt in syncache if
633 * the flag is only ACK. A successful lookup creates a new
634 * socket appended to the listen queue in SYN_RECEIVED state.
635 */
636 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
637 /*
638 * Parse the TCP options here because
639 * syncookies need access to the reflected
640 * timestamp.
641 */
642 tcp_dooptions(&to, optp, optlen, 0);
643 /*
644 * NB: syncache_expand() doesn't unlock
645 * inp and tcpinfo locks.
646 */
647 if (!syncache_expand(&inc, &to, th, &so, m)) {
648 /*
649 * No syncache entry or ACK was not
650 * for our SYN/ACK. Send a RST.
651 * NB: syncache did its own logging
652 * of the failure cause.
653 */
654 rstreason = BANDLIM_RST_OPENPORT;
655 goto dropwithreset;
656 }
657 if (so == NULL) {
658 /*
659 * We completed the 3-way handshake
660 * but could not allocate a socket
661 * either due to memory shortage,
662 * listen queue length limits or
663 * global socket limits. Send RST
664 * or wait and have the remote end
665 * retransmit the ACK for another
666 * try.
667 */
668 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
669 log(LOG_DEBUG, "%s; %s: Listen socket: "
670 "Socket allocation failed due to "
671 "limits or memory shortage, %s\n",
672 s, __func__,
673 V_tcp_sc_rst_sock_fail ?
674 "sending RST" : "try again");
675 if (V_tcp_sc_rst_sock_fail) {
676 rstreason = BANDLIM_UNLIMITED;
677 goto dropwithreset;
678 } else
679 goto dropunlock;
680 }
681 /*
682 * Socket is created in state SYN_RECEIVED.
683 * Unlock the listen socket, lock the newly
684 * created socket and update the tp variable.
685 */
686 INP_WUNLOCK(inp); /* listen socket */
687 inp = sotoinpcb(so);
688 INP_WLOCK(inp); /* new connection */
689 tp = intotcpcb(inp);
690 KASSERT(tp->t_state == TCPS_SYN_RECEIVED,
691 ("%s: ", __func__));
692 /*
693 * Process the segment and the data it
694 * contains. tcp_do_segment() consumes
695 * the mbuf chain and unlocks the inpcb.
696 */
697 tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen,
698 iptos);
699 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
700 return;
701 }
702 /*
703 * Segment flag validation for new connection attempts:
704 *
705 * Our (SYN|ACK) response was rejected.
706 * Check with syncache and remove entry to prevent
707 * retransmits.
708 *
709 * NB: syncache_chkrst does its own logging of failure
710 * causes.
711 */
712 if (thflags & TH_RST) {
713 syncache_chkrst(&inc, th);
714 goto dropunlock;
715 }
716 /*
717 * We can't do anything without SYN.
718 */
719 if ((thflags & TH_SYN) == 0) {
720 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
721 log(LOG_DEBUG, "%s; %s: Listen socket: "
722 "SYN is missing, segment ignored\n",
723 s, __func__);
724 V_tcpstat.tcps_badsyn++;
725 goto dropunlock;
726 }
727 /*
728 * (SYN|ACK) is bogus on a listen socket.
729 */
730 if (thflags & TH_ACK) {
731 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
732 log(LOG_DEBUG, "%s; %s: Listen socket: "
733 "SYN|ACK invalid, segment rejected\n",
734 s, __func__);
735 syncache_badack(&inc); /* XXX: Not needed! */
736 V_tcpstat.tcps_badsyn++;
737 rstreason = BANDLIM_RST_OPENPORT;
738 goto dropwithreset;
739 }
740 /*
741 * If the drop_synfin option is enabled, drop all
742 * segments with both the SYN and FIN bits set.
743 * This prevents e.g. nmap from identifying the
744 * TCP/IP stack.
745 * XXX: Poor reasoning. nmap has other methods
746 * and is constantly refining its stack detection
747 * strategies.
748 * XXX: This is a violation of the TCP specification
749 * and was used by RFC1644.
750 */
751 if ((thflags & TH_FIN) && V_drop_synfin) {
752 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
753 log(LOG_DEBUG, "%s; %s: Listen socket: "
754 "SYN|FIN segment ignored (based on "
755 "sysctl setting)\n", s, __func__);
756 V_tcpstat.tcps_badsyn++;
757 goto dropunlock;
758 }
759 /*
760 * Segment's flags are (SYN) or (SYN|FIN).
761 *
762 * TH_PUSH, TH_URG, TH_ECE, TH_CWR are ignored
763 * as they do not affect the state of the TCP FSM.
764 * The data pointed to by TH_URG and th_urp is ignored.
765 */
766 KASSERT((thflags & (TH_RST|TH_ACK)) == 0,
767 ("%s: Listen socket: TH_RST or TH_ACK set", __func__));
768 KASSERT(thflags & (TH_SYN),
769 ("%s: Listen socket: TH_SYN not set", __func__));
770#ifdef INET6
771 /*
772 * If deprecated address is forbidden,
773 * we do not accept SYN to deprecated interface
774 * address to prevent any new inbound connection from
775 * getting established.
776 * When we do not accept SYN, we send a TCP RST,
777 * with deprecated source address (instead of dropping
778 * it). We compromise it as it is much better for peer
779 * to send a RST, and RST will be the final packet
780 * for the exchange.
781 *
782 * If we do not forbid deprecated addresses, we accept
783 * the SYN packet. RFC2462 does not suggest dropping
784 * SYN in this case.
785 * If we decipher RFC2462 5.5.4, it says like this:
786 * 1. use of deprecated addr with existing
787 * communication is okay - "SHOULD continue to be
788 * used"
789 * 2. use of it with new communication:
790 * (2a) "SHOULD NOT be used if alternate address
791 * with sufficient scope is available"
792 * (2b) nothing mentioned otherwise.
793 * Here we fall into (2b) case as we have no choice in
794 * our source address selection - we must obey the peer.
795 *
796 * The wording in RFC2462 is confusing, and there are
797 * multiple description text for deprecated address
798 * handling - worse, they are not exactly the same.
799 * I believe 5.5.4 is the best one, so we follow 5.5.4.
800 */
801 if (isipv6 && !V_ip6_use_deprecated) {
802 struct in6_ifaddr *ia6;
803
804 if ((ia6 = ip6_getdstifaddr(m)) &&
805 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
806 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
807 log(LOG_DEBUG, "%s; %s: Listen socket: "
808 "Connection attempt to deprecated "
809 "IPv6 address rejected\n",
810 s, __func__);
811 rstreason = BANDLIM_RST_OPENPORT;
812 goto dropwithreset;
813 }
814 }
815#endif
816 /*
817 * Basic sanity checks on incoming SYN requests:
818 * Don't respond if the destination is a link layer
819 * broadcast according to RFC1122 4.2.3.10, p. 104.
820 * If it is from this socket it must be forged.
821 * Don't respond if the source or destination is a
822 * global or subnet broad- or multicast address.
823 * Note that it is quite possible to receive unicast
824 * link-layer packets with a broadcast IP address. Use
825 * in_broadcast() to find them.
826 */
827 if (m->m_flags & (M_BCAST|M_MCAST)) {
828 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
829 log(LOG_DEBUG, "%s; %s: Listen socket: "
830 "Connection attempt from broad- or multicast "
831 "link layer address ignored\n", s, __func__);
832 goto dropunlock;
833 }
834 if (isipv6) {
835#ifdef INET6
836 if (th->th_dport == th->th_sport &&
837 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) {
838 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
839 log(LOG_DEBUG, "%s; %s: Listen socket: "
840 "Connection attempt to/from self "
841 "ignored\n", s, __func__);
842 goto dropunlock;
843 }
844 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
845 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
846 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
847 log(LOG_DEBUG, "%s; %s: Listen socket: "
848 "Connection attempt from/to multicast "
849 "address ignored\n", s, __func__);
850 goto dropunlock;
851 }
852#endif
853 } else {
854 if (th->th_dport == th->th_sport &&
855 ip->ip_dst.s_addr == ip->ip_src.s_addr) {
856 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
857 log(LOG_DEBUG, "%s; %s: Listen socket: "
858 "Connection attempt from/to self "
859 "ignored\n", s, __func__);
860 goto dropunlock;
861 }
862 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
863 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
864 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
865 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
866 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
867 log(LOG_DEBUG, "%s; %s: Listen socket: "
868 "Connection attempt from/to broad- "
869 "or multicast address ignored\n",
870 s, __func__);
871 goto dropunlock;
872 }
873 }
874 /*
875 * SYN appears to be valid. Create compressed TCP state
876 * for syncache.
877 */
878#ifdef TCPDEBUG
879 if (so->so_options & SO_DEBUG)
880 tcp_trace(TA_INPUT, ostate, tp,
881 (void *)tcp_saveipgen, &tcp_savetcp, 0);
882#endif
883 tcp_dooptions(&to, optp, optlen, TO_SYN);
884 syncache_add(&inc, &to, th, inp, &so, m);
885 /*
886 * Entry added to syncache and mbuf consumed.
887 * Everything already unlocked by syncache_add().
888 */
889 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
890 return;
891 }
892
893 /*
894 * Segment belongs to a connection in SYN_SENT, ESTABLISHED or later
895 * state. tcp_do_segment() always consumes the mbuf chain, unlocks
896 * the inpcb, and unlocks pcbinfo.
897 */
898 tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos);
899 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
900 return;
901
902dropwithreset:
903 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
904 INP_INFO_WUNLOCK(&V_tcbinfo);
905
906 if (inp != NULL) {
907 tcp_dropwithreset(m, th, tp, tlen, rstreason);
908 INP_WUNLOCK(inp);
909 } else
910 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
911 m = NULL; /* mbuf chain got consumed. */
912 goto drop;
913
914dropunlock:
915 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
916 if (inp != NULL)
917 INP_WUNLOCK(inp);
918 INP_INFO_WUNLOCK(&V_tcbinfo);
919
920drop:
921 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
922 if (s != NULL)
923 free(s, M_TCPLOG);
924 if (m != NULL)
925 m_freem(m);
926}
927
928static void
929tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so,
930 struct tcpcb *tp, int drop_hdrlen, int tlen, uint8_t iptos)
931{
932 INIT_VNET_INET(tp->t_vnet);
933 int thflags, acked, ourfinisacked, needoutput = 0;
934 int headlocked = 1;
935 int rstreason, todrop, win;
936 u_long tiwin;
937 struct tcpopt to;
938
939#ifdef TCPDEBUG
940 /*
941 * The size of tcp_saveipgen must be the size of the max ip header,
942 * now IPv6.
943 */
944 u_char tcp_saveipgen[IP6_HDR_LEN];
945 struct tcphdr tcp_savetcp;
946 short ostate = 0;
947#endif
948 thflags = th->th_flags;
949
950 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
951 INP_WLOCK_ASSERT(tp->t_inpcb);
952 KASSERT(tp->t_state > TCPS_LISTEN, ("%s: TCPS_LISTEN",
953 __func__));
954 KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
955 __func__));
956
957 /*
958 * Segment received on connection.
959 * Reset idle time and keep-alive timer.
960 * XXX: This should be done after segment
961 * validation to ignore broken/spoofed segs.
962 */
963 tp->t_rcvtime = ticks;
964 if (TCPS_HAVEESTABLISHED(tp->t_state))
965 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
966
967 /*
968 * Unscale the window into a 32-bit value.
969 * For the SYN_SENT state the scale is zero.
970 */
971 tiwin = th->th_win << tp->snd_scale;
972
973 /*
974 * TCP ECN processing.
975 */
976 if (tp->t_flags & TF_ECN_PERMIT) {
977 switch (iptos & IPTOS_ECN_MASK) {
978 case IPTOS_ECN_CE:
979 tp->t_flags |= TF_ECN_SND_ECE;
980 V_tcpstat.tcps_ecn_ce++;
981 break;
982 case IPTOS_ECN_ECT0:
983 V_tcpstat.tcps_ecn_ect0++;
984 break;
985 case IPTOS_ECN_ECT1:
986 V_tcpstat.tcps_ecn_ect1++;
987 break;
988 }
989
990 if (thflags & TH_CWR)
991 tp->t_flags &= ~TF_ECN_SND_ECE;
992
993 /*
994 * Congestion experienced.
995 * Ignore if we are already trying to recover.
996 */
997 if ((thflags & TH_ECE) &&
998 SEQ_LEQ(th->th_ack, tp->snd_recover)) {
999 V_tcpstat.tcps_ecn_rcwnd++;
1000 tcp_congestion_exp(tp);
1001 }
1002 }
1003
1004 /*
1005 * Parse options on any incoming segment.
1006 */
1007 tcp_dooptions(&to, (u_char *)(th + 1),
1008 (th->th_off << 2) - sizeof(struct tcphdr),
1009 (thflags & TH_SYN) ? TO_SYN : 0);
1010
1011 /*
1012 * If echoed timestamp is later than the current time,
1013 * fall back to non RFC1323 RTT calculation. Normalize
1014 * timestamp if syncookies were used when this connection
1015 * was established.
1016 */
1017 if ((to.to_flags & TOF_TS) && (to.to_tsecr != 0)) {
1018 to.to_tsecr -= tp->ts_offset;
1019 if (TSTMP_GT(to.to_tsecr, ticks))
1020 to.to_tsecr = 0;
1021 }
1022
1023 /*
1024 * Process options only when we get SYN/ACK back. The SYN case
1025 * for incoming connections is handled in tcp_syncache.
1026 * According to RFC1323 the window field in a SYN (i.e., a <SYN>
1027 * or <SYN,ACK>) segment itself is never scaled.
1028 * XXX this is traditional behavior, may need to be cleaned up.
1029 */
1030 if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
1031 if ((to.to_flags & TOF_SCALE) &&
1032 (tp->t_flags & TF_REQ_SCALE)) {
1033 tp->t_flags |= TF_RCVD_SCALE;
1034 tp->snd_scale = to.to_wscale;
1035 }
1036 /*
1037 * Initial send window. It will be updated with
1038 * the next incoming segment to the scaled value.
1039 */
1040 tp->snd_wnd = th->th_win;
1041 if (to.to_flags & TOF_TS) {
1042 tp->t_flags |= TF_RCVD_TSTMP;
1043 tp->ts_recent = to.to_tsval;
1044 tp->ts_recent_age = ticks;
1045 }
1046 if (to.to_flags & TOF_MSS)
1047 tcp_mss(tp, to.to_mss);
1048 if ((tp->t_flags & TF_SACK_PERMIT) &&
1049 (to.to_flags & TOF_SACKPERM) == 0)
1050 tp->t_flags &= ~TF_SACK_PERMIT;
1051 }
1052
1053 /*
1054 * Header prediction: check for the two common cases
1055 * of a uni-directional data xfer. If the packet has
1056 * no control flags, is in-sequence, the window didn't
1057 * change and we're not retransmitting, it's a
1058 * candidate. If the length is zero and the ack moved
1059 * forward, we're the sender side of the xfer. Just
1060 * free the data acked & wake any higher level process
1061 * that was blocked waiting for space. If the length
1062 * is non-zero and the ack didn't move, we're the
1063 * receiver side. If we're getting packets in-order
1064 * (the reassembly queue is empty), add the data to
1065 * the socket buffer and note that we need a delayed ack.
1066 * Make sure that the hidden state-flags are also off.
1067 * Since we check for TCPS_ESTABLISHED first, it can only
1068 * be TH_NEEDSYN.
1069 */
1070 if (tp->t_state == TCPS_ESTABLISHED &&
1071 th->th_seq == tp->rcv_nxt &&
1072 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1073 tp->snd_nxt == tp->snd_max &&
1074 tiwin && tiwin == tp->snd_wnd &&
1075 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1076 LIST_EMPTY(&tp->t_segq) &&
1077 ((to.to_flags & TOF_TS) == 0 ||
1078 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) {
1079
1080 /*
1081 * If last ACK falls within this segment's sequence numbers,
1082 * record the timestamp.
1083 * NOTE that the test is modified according to the latest
1084 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1085 */
1086 if ((to.to_flags & TOF_TS) != 0 &&
1087 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1088 tp->ts_recent_age = ticks;
1089 tp->ts_recent = to.to_tsval;
1090 }
1091
1092 if (tlen == 0) {
1093 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1094 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1095 tp->snd_cwnd >= tp->snd_wnd &&
1096 ((!V_tcp_do_newreno &&
1097 !(tp->t_flags & TF_SACK_PERMIT) &&
1098 tp->t_dupacks < tcprexmtthresh) ||
1099 ((V_tcp_do_newreno ||
1100 (tp->t_flags & TF_SACK_PERMIT)) &&
1101 !IN_FASTRECOVERY(tp) &&
1102 (to.to_flags & TOF_SACK) == 0 &&
1103 TAILQ_EMPTY(&tp->snd_holes)))) {
1104 KASSERT(headlocked,
1105 ("%s: headlocked", __func__));
1106 INP_INFO_WUNLOCK(&V_tcbinfo);
1107 headlocked = 0;
1108 /*
1109 * This is a pure ack for outstanding data.
1110 */
1111 ++V_tcpstat.tcps_predack;
1112 /*
1113 * "bad retransmit" recovery.
1114 */
1115 if (tp->t_rxtshift == 1 &&
1116 ticks < tp->t_badrxtwin) {
1117 ++V_tcpstat.tcps_sndrexmitbad;
1118 tp->snd_cwnd = tp->snd_cwnd_prev;
1119 tp->snd_ssthresh =
1120 tp->snd_ssthresh_prev;
1121 tp->snd_recover = tp->snd_recover_prev;
1122 if (tp->t_flags & TF_WASFRECOVERY)
1123 ENTER_FASTRECOVERY(tp);
1124 tp->snd_nxt = tp->snd_max;
1125 tp->t_badrxtwin = 0;
1126 }
1127
1128 /*
1129 * Recalculate the transmit timer / rtt.
1130 *
1131 * Some boxes send broken timestamp replies
1132 * during the SYN+ACK phase, ignore
1133 * timestamps of 0 or we could calculate a
1134 * huge RTT and blow up the retransmit timer.
1135 */
1136 if ((to.to_flags & TOF_TS) != 0 &&
1137 to.to_tsecr) {
1138 if (!tp->t_rttlow ||
1139 tp->t_rttlow > ticks - to.to_tsecr)
1140 tp->t_rttlow = ticks - to.to_tsecr;
1141 tcp_xmit_timer(tp,
1142 ticks - to.to_tsecr + 1);
1143 } else if (tp->t_rtttime &&
1144 SEQ_GT(th->th_ack, tp->t_rtseq)) {
1145 if (!tp->t_rttlow ||
1146 tp->t_rttlow > ticks - tp->t_rtttime)
1147 tp->t_rttlow = ticks - tp->t_rtttime;
1148 tcp_xmit_timer(tp,
1149 ticks - tp->t_rtttime);
1150 }
1151 tcp_xmit_bandwidth_limit(tp, th->th_ack);
1152 acked = th->th_ack - tp->snd_una;
1153 V_tcpstat.tcps_rcvackpack++;
1154 V_tcpstat.tcps_rcvackbyte += acked;
1155 sbdrop(&so->so_snd, acked);
1156 if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
1157 SEQ_LEQ(th->th_ack, tp->snd_recover))
1158 tp->snd_recover = th->th_ack - 1;
1159 tp->snd_una = th->th_ack;
1160 /*
1161 * Pull snd_wl2 up to prevent seq wrap relative
1162 * to th_ack.
1163 */
1164 tp->snd_wl2 = th->th_ack;
1165 tp->t_dupacks = 0;
1166 m_freem(m);
1167 ND6_HINT(tp); /* Some progress has been made. */
1168
1169 /*
1170 * If all outstanding data are acked, stop
1171 * retransmit timer, otherwise restart timer
1172 * using current (possibly backed-off) value.
1173 * If process is waiting for space,
1174 * wakeup/selwakeup/signal. If data
1175 * are ready to send, let tcp_output
1176 * decide between more output or persist.
1177 */
1178#ifdef TCPDEBUG
1179 if (so->so_options & SO_DEBUG)
1180 tcp_trace(TA_INPUT, ostate, tp,
1181 (void *)tcp_saveipgen,
1182 &tcp_savetcp, 0);
1183#endif
1184 if (tp->snd_una == tp->snd_max)
1185 tcp_timer_activate(tp, TT_REXMT, 0);
1186 else if (!tcp_timer_active(tp, TT_PERSIST))
1187 tcp_timer_activate(tp, TT_REXMT,
1188 tp->t_rxtcur);
1189 sowwakeup(so);
1190 if (so->so_snd.sb_cc)
1191 (void) tcp_output(tp);
1192 goto check_delack;
1193 }
1194 } else if (th->th_ack == tp->snd_una &&
1195 tlen <= sbspace(&so->so_rcv)) {
1196 int newsize = 0; /* automatic sockbuf scaling */
1197
1198 KASSERT(headlocked, ("%s: headlocked", __func__));
1199 INP_INFO_WUNLOCK(&V_tcbinfo);
1200 headlocked = 0;
1201 /*
1202 * This is a pure, in-sequence data packet
1203 * with nothing on the reassembly queue and
1204 * we have enough buffer space to take it.
1205 */
1206 /* Clean receiver SACK report if present */
1207 if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
1208 tcp_clean_sackreport(tp);
1209 ++V_tcpstat.tcps_preddat;
1210 tp->rcv_nxt += tlen;
1211 /*
1212 * Pull snd_wl1 up to prevent seq wrap relative to
1213 * th_seq.
1214 */
1215 tp->snd_wl1 = th->th_seq;
1216 /*
1217 * Pull rcv_up up to prevent seq wrap relative to
1218 * rcv_nxt.
1219 */
1220 tp->rcv_up = tp->rcv_nxt;
1221 V_tcpstat.tcps_rcvpack++;
1222 V_tcpstat.tcps_rcvbyte += tlen;
1223 ND6_HINT(tp); /* Some progress has been made */
1224#ifdef TCPDEBUG
1225 if (so->so_options & SO_DEBUG)
1226 tcp_trace(TA_INPUT, ostate, tp,
1227 (void *)tcp_saveipgen, &tcp_savetcp, 0);
1228#endif
1229 /*
1230 * Automatic sizing of receive socket buffer. Often the send
1231 * buffer size is not optimally adjusted to the actual network
1232 * conditions at hand (delay bandwidth product). Setting the
1233 * buffer size too small limits throughput on links with high
1234 * bandwidth and high delay (eg. trans-continental/oceanic links).
1235 *
1236 * On the receive side the socket buffer memory is only rarely
1237 * used to any significant extent. This allows us to be much
1238 * more aggressive in scaling the receive socket buffer. For
1239 * the case that the buffer space is actually used to a large
1240 * extent and we run out of kernel memory we can simply drop
1241 * the new segments; TCP on the sender will just retransmit it
1242 * later. Setting the buffer size too big may only consume too
1243 * much kernel memory if the application doesn't read() from
1244 * the socket or packet loss or reordering makes use of the
1245 * reassembly queue.
1246 *
1247 * The criteria to step up the receive buffer one notch are:
1248 * 1. the number of bytes received during the time it takes
1249 * one timestamp to be reflected back to us (the RTT);
1250 * 2. received bytes per RTT is within seven eighth of the
1251 * current socket buffer size;
1252 * 3. receive buffer size has not hit maximal automatic size;
1253 *
1254 * This algorithm does one step per RTT at most and only if
1255 * we receive a bulk stream w/o packet losses or reorderings.
1256 * Shrinking the buffer during idle times is not necessary as
1257 * it doesn't consume any memory when idle.
1258 *
1259 * TODO: Only step up if the application is actually serving
1260 * the buffer to better manage the socket buffer resources.
1261 */
1262 if (V_tcp_do_autorcvbuf &&
1263 to.to_tsecr &&
1264 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1265 if (to.to_tsecr > tp->rfbuf_ts &&
1266 to.to_tsecr - tp->rfbuf_ts < hz) {
1267 if (tp->rfbuf_cnt >
1268 (so->so_rcv.sb_hiwat / 8 * 7) &&
1269 so->so_rcv.sb_hiwat <
1270 V_tcp_autorcvbuf_max) {
1271 newsize =
1272 min(so->so_rcv.sb_hiwat +
1273 V_tcp_autorcvbuf_inc,
1274 V_tcp_autorcvbuf_max);
1275 }
1276 /* Start over with next RTT. */
1277 tp->rfbuf_ts = 0;
1278 tp->rfbuf_cnt = 0;
1279 } else
1280 tp->rfbuf_cnt += tlen; /* add up */
1281 }
1282
1283 /* Add data to socket buffer. */
1284 SOCKBUF_LOCK(&so->so_rcv);
1285 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1286 m_freem(m);
1287 } else {
1288 /*
1289 * Set new socket buffer size.
1290 * Give up when limit is reached.
1291 */
1292 if (newsize)
1293 if (!sbreserve_locked(&so->so_rcv,
1294 newsize, so, NULL))
1295 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1296 m_adj(m, drop_hdrlen); /* delayed header drop */
1297 sbappendstream_locked(&so->so_rcv, m);
1298 }
1299 /* NB: sorwakeup_locked() does an implicit unlock. */
1300 sorwakeup_locked(so);
1301 if (DELAY_ACK(tp)) {
1302 tp->t_flags |= TF_DELACK;
1303 } else {
1304 tp->t_flags |= TF_ACKNOW;
1305 tcp_output(tp);
1306 }
1307 goto check_delack;
1308 }
1309 }
1310
1311 /*
1312 * Calculate amount of space in receive window,
1313 * and then do TCP input processing.
1314 * Receive window is amount of space in rcv queue,
1315 * but not less than advertised window.
1316 */
1317 win = sbspace(&so->so_rcv);
1318 if (win < 0)
1319 win = 0;
1320 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1321
1322 /* Reset receive buffer auto scaling when not in bulk receive mode. */
1323 tp->rfbuf_ts = 0;
1324 tp->rfbuf_cnt = 0;
1325
1326 switch (tp->t_state) {
1327
1328 /*
1329 * If the state is SYN_RECEIVED:
1330 * if seg contains an ACK, but not for our SYN/ACK, send a RST.
1331 */
1332 case TCPS_SYN_RECEIVED:
1333 if ((thflags & TH_ACK) &&
1334 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1335 SEQ_GT(th->th_ack, tp->snd_max))) {
1336 rstreason = BANDLIM_RST_OPENPORT;
1337 goto dropwithreset;
1338 }
1339 break;
1340
1341 /*
1342 * If the state is SYN_SENT:
1343 * if seg contains an ACK, but not for our SYN, drop the input.
1344 * if seg contains a RST, then drop the connection.
1345 * if seg does not contain SYN, then drop it.
1346 * Otherwise this is an acceptable SYN segment
1347 * initialize tp->rcv_nxt and tp->irs
1348 * if seg contains ack then advance tp->snd_una
1349 * if seg contains an ECE and ECN support is enabled, the stream
1350 * is ECN capable.
1351 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1352 * arrange for segment to be acked (eventually)
1353 * continue processing rest of data/controls, beginning with URG
1354 */
1355 case TCPS_SYN_SENT:
1356 if ((thflags & TH_ACK) &&
1357 (SEQ_LEQ(th->th_ack, tp->iss) ||
1358 SEQ_GT(th->th_ack, tp->snd_max))) {
1359 rstreason = BANDLIM_UNLIMITED;
1360 goto dropwithreset;
1361 }
1362 if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST))
1363 tp = tcp_drop(tp, ECONNREFUSED);
1364 if (thflags & TH_RST)
1365 goto drop;
1366 if (!(thflags & TH_SYN))
1367 goto drop;
1368
1369 tp->irs = th->th_seq;
1370 tcp_rcvseqinit(tp);
1371 if (thflags & TH_ACK) {
1372 V_tcpstat.tcps_connects++;
1373 soisconnected(so);
1374#ifdef MAC
1375 SOCK_LOCK(so);
1376 mac_socketpeer_set_from_mbuf(m, so);
1377 SOCK_UNLOCK(so);
1378#endif
1379 /* Do window scaling on this connection? */
1380 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1381 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1382 tp->rcv_scale = tp->request_r_scale;
1383 }
1384 tp->rcv_adv += tp->rcv_wnd;
1385 tp->snd_una++; /* SYN is acked */
1386 /*
1387 * If there's data, delay ACK; if there's also a FIN
1388 * ACKNOW will be turned on later.
1389 */
1390 if (DELAY_ACK(tp) && tlen != 0)
1391 tcp_timer_activate(tp, TT_DELACK,
1392 tcp_delacktime);
1393 else
1394 tp->t_flags |= TF_ACKNOW;
1395
1396 if ((thflags & TH_ECE) && V_tcp_do_ecn) {
1397 tp->t_flags |= TF_ECN_PERMIT;
1398 V_tcpstat.tcps_ecn_shs++;
1399 }
1400
1401 /*
1402 * Received <SYN,ACK> in SYN_SENT[*] state.
1403 * Transitions:
1404 * SYN_SENT --> ESTABLISHED
1405 * SYN_SENT* --> FIN_WAIT_1
1406 */
1407 tp->t_starttime = ticks;
1408 if (tp->t_flags & TF_NEEDFIN) {
1409 tp->t_state = TCPS_FIN_WAIT_1;
1410 tp->t_flags &= ~TF_NEEDFIN;
1411 thflags &= ~TH_SYN;
1412 } else {
1413 tp->t_state = TCPS_ESTABLISHED;
1414 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
1415 }
1416 } else {
1417 /*
1418 * Received initial SYN in SYN-SENT[*] state =>
1419 * simultaneous open. If segment contains CC option
1420 * and there is a cached CC, apply TAO test.
1421 * If it succeeds, connection is * half-synchronized.
1422 * Otherwise, do 3-way handshake:
1423 * SYN-SENT -> SYN-RECEIVED
1424 * SYN-SENT* -> SYN-RECEIVED*
1425 * If there was no CC option, clear cached CC value.
1426 */
1427 tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
1428 tcp_timer_activate(tp, TT_REXMT, 0);
1429 tp->t_state = TCPS_SYN_RECEIVED;
1430 }
1431
1432 KASSERT(headlocked, ("%s: trimthenstep6: head not locked",
1433 __func__));
1434 INP_WLOCK_ASSERT(tp->t_inpcb);
1435
1436 /*
1437 * Advance th->th_seq to correspond to first data byte.
1438 * If data, trim to stay within window,
1439 * dropping FIN if necessary.
1440 */
1441 th->th_seq++;
1442 if (tlen > tp->rcv_wnd) {
1443 todrop = tlen - tp->rcv_wnd;
1444 m_adj(m, -todrop);
1445 tlen = tp->rcv_wnd;
1446 thflags &= ~TH_FIN;
1447 V_tcpstat.tcps_rcvpackafterwin++;
1448 V_tcpstat.tcps_rcvbyteafterwin += todrop;
1449 }
1450 tp->snd_wl1 = th->th_seq - 1;
1451 tp->rcv_up = th->th_seq;
1452 /*
1453 * Client side of transaction: already sent SYN and data.
1454 * If the remote host used T/TCP to validate the SYN,
1455 * our data will be ACK'd; if so, enter normal data segment
1456 * processing in the middle of step 5, ack processing.
1457 * Otherwise, goto step 6.
1458 */
1459 if (thflags & TH_ACK)
1460 goto process_ACK;
1461
1462 goto step6;
1463
1464 /*
1465 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1466 * do normal processing.
1467 *
1468 * NB: Leftover from RFC1644 T/TCP. Cases to be reused later.
1469 */
1470 case TCPS_LAST_ACK:
1471 case TCPS_CLOSING:
1472 break; /* continue normal processing */
1473 }
1474
1475 /*
1476 * States other than LISTEN or SYN_SENT.
1477 * First check the RST flag and sequence number since reset segments
1478 * are exempt from the timestamp and connection count tests. This
1479 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1480 * below which allowed reset segments in half the sequence space
1481 * to fall though and be processed (which gives forged reset
1482 * segments with a random sequence number a 50 percent chance of
1483 * killing a connection).
1484 * Then check timestamp, if present.
1485 * Then check the connection count, if present.
1486 * Then check that at least some bytes of segment are within
1487 * receive window. If segment begins before rcv_nxt,
1488 * drop leading data (and SYN); if nothing left, just ack.
1489 *
1490 *
1491 * If the RST bit is set, check the sequence number to see
1492 * if this is a valid reset segment.
1493 * RFC 793 page 37:
1494 * In all states except SYN-SENT, all reset (RST) segments
1495 * are validated by checking their SEQ-fields. A reset is
1496 * valid if its sequence number is in the window.
1497 * Note: this does not take into account delayed ACKs, so
1498 * we should test against last_ack_sent instead of rcv_nxt.
1499 * The sequence number in the reset segment is normally an
1500 * echo of our outgoing acknowlegement numbers, but some hosts
1501 * send a reset with the sequence number at the rightmost edge
1502 * of our receive window, and we have to handle this case.
1503 * Note 2: Paul Watson's paper "Slipping in the Window" has shown
1504 * that brute force RST attacks are possible. To combat this,
1505 * we use a much stricter check while in the ESTABLISHED state,
1506 * only accepting RSTs where the sequence number is equal to
1507 * last_ack_sent. In all other states (the states in which a
1508 * RST is more likely), the more permissive check is used.
1509 * If we have multiple segments in flight, the initial reset
1510 * segment sequence numbers will be to the left of last_ack_sent,
1511 * but they will eventually catch up.
1512 * In any case, it never made sense to trim reset segments to
1513 * fit the receive window since RFC 1122 says:
1514 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
1515 *
1516 * A TCP SHOULD allow a received RST segment to include data.
1517 *
1518 * DISCUSSION
1519 * It has been suggested that a RST segment could contain
1520 * ASCII text that encoded and explained the cause of the
1521 * RST. No standard has yet been established for such
1522 * data.
1523 *
1524 * If the reset segment passes the sequence number test examine
1525 * the state:
1526 * SYN_RECEIVED STATE:
1527 * If passive open, return to LISTEN state.
1528 * If active open, inform user that connection was refused.
1529 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
1530 * Inform user that connection was reset, and close tcb.
1531 * CLOSING, LAST_ACK STATES:
1532 * Close the tcb.
1533 * TIME_WAIT STATE:
1534 * Drop the segment - see Stevens, vol. 2, p. 964 and
1535 * RFC 1337.
1536 */
1537 if (thflags & TH_RST) {
1538 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
1539 SEQ_LEQ(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
1540 switch (tp->t_state) {
1541
1542 case TCPS_SYN_RECEIVED:
1543 so->so_error = ECONNREFUSED;
1544 goto close;
1545
1546 case TCPS_ESTABLISHED:
1547 if (V_tcp_insecure_rst == 0 &&
1548 !(SEQ_GEQ(th->th_seq, tp->rcv_nxt - 1) &&
1549 SEQ_LEQ(th->th_seq, tp->rcv_nxt + 1)) &&
1550 !(SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
1551 SEQ_LEQ(th->th_seq, tp->last_ack_sent + 1))) {
1552 V_tcpstat.tcps_badrst++;
1553 goto drop;
1554 }
1555 /* FALLTHROUGH */
1556 case TCPS_FIN_WAIT_1:
1557 case TCPS_FIN_WAIT_2:
1558 case TCPS_CLOSE_WAIT:
1559 so->so_error = ECONNRESET;
1560 close:
1561 tp->t_state = TCPS_CLOSED;
1562 V_tcpstat.tcps_drops++;
1563 KASSERT(headlocked, ("%s: trimthenstep6: "
1564 "tcp_close: head not locked", __func__));
1565 tp = tcp_close(tp);
1566 break;
1567
1568 case TCPS_CLOSING:
1569 case TCPS_LAST_ACK:
1570 KASSERT(headlocked, ("%s: trimthenstep6: "
1571 "tcp_close.2: head not locked", __func__));
1572 tp = tcp_close(tp);
1573 break;
1574 }
1575 }
1576 goto drop;
1577 }
1578
1579 /*
1580 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1581 * and it's less than ts_recent, drop it.
1582 */
1583 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
1584 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1585
1586 /* Check to see if ts_recent is over 24 days old. */
1587 if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1588 /*
1589 * Invalidate ts_recent. If this segment updates
1590 * ts_recent, the age will be reset later and ts_recent
1591 * will get a valid value. If it does not, setting
1592 * ts_recent to zero will at least satisfy the
1593 * requirement that zero be placed in the timestamp
1594 * echo reply when ts_recent isn't valid. The
1595 * age isn't reset until we get a valid ts_recent
1596 * because we don't want out-of-order segments to be
1597 * dropped when ts_recent is old.
1598 */
1599 tp->ts_recent = 0;
1600 } else {
1601 V_tcpstat.tcps_rcvduppack++;
1602 V_tcpstat.tcps_rcvdupbyte += tlen;
1603 V_tcpstat.tcps_pawsdrop++;
1604 if (tlen)
1605 goto dropafterack;
1606 goto drop;
1607 }
1608 }
1609
1610 /*
1611 * In the SYN-RECEIVED state, validate that the packet belongs to
1612 * this connection before trimming the data to fit the receive
1613 * window. Check the sequence number versus IRS since we know
1614 * the sequence numbers haven't wrapped. This is a partial fix
1615 * for the "LAND" DoS attack.
1616 */
1617 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1618 rstreason = BANDLIM_RST_OPENPORT;
1619 goto dropwithreset;
1620 }
1621
1622 todrop = tp->rcv_nxt - th->th_seq;
1623 if (todrop > 0) {
1624 if (thflags & TH_SYN) {
1625 thflags &= ~TH_SYN;
1626 th->th_seq++;
1627 if (th->th_urp > 1)
1628 th->th_urp--;
1629 else
1630 thflags &= ~TH_URG;
1631 todrop--;
1632 }
1633 /*
1634 * Following if statement from Stevens, vol. 2, p. 960.
1635 */
1636 if (todrop > tlen
1637 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1638 /*
1639 * Any valid FIN must be to the left of the window.
1640 * At this point the FIN must be a duplicate or out
1641 * of sequence; drop it.
1642 */
1643 thflags &= ~TH_FIN;
1644
1645 /*
1646 * Send an ACK to resynchronize and drop any data.
1647 * But keep on processing for RST or ACK.
1648 */
1649 tp->t_flags |= TF_ACKNOW;
1650 todrop = tlen;
1651 V_tcpstat.tcps_rcvduppack++;
1652 V_tcpstat.tcps_rcvdupbyte += todrop;
1653 } else {
1654 V_tcpstat.tcps_rcvpartduppack++;
1655 V_tcpstat.tcps_rcvpartdupbyte += todrop;
1656 }
1657 drop_hdrlen += todrop; /* drop from the top afterwards */
1658 th->th_seq += todrop;
1659 tlen -= todrop;
1660 if (th->th_urp > todrop)
1661 th->th_urp -= todrop;
1662 else {
1663 thflags &= ~TH_URG;
1664 th->th_urp = 0;
1665 }
1666 }
1667
1668 /*
1669 * If new data are received on a connection after the
1670 * user processes are gone, then RST the other end.
1671 */
1672 if ((so->so_state & SS_NOFDREF) &&
1673 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1674 char *s;
1675
1676 KASSERT(headlocked, ("%s: trimthenstep6: tcp_close.3: head "
1677 "not locked", __func__));
1678 if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
1679 log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data after socket "
1680 "was closed, sending RST and removing tcpcb\n",
1681 s, __func__, tcpstates[tp->t_state], tlen);
1682 free(s, M_TCPLOG);
1683 }
1684 tp = tcp_close(tp);
1685 V_tcpstat.tcps_rcvafterclose++;
1686 rstreason = BANDLIM_UNLIMITED;
1687 goto dropwithreset;
1688 }
1689
1690 /*
1691 * If segment ends after window, drop trailing data
1692 * (and PUSH and FIN); if nothing left, just ACK.
1693 */
1694 todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
1695 if (todrop > 0) {
1696 V_tcpstat.tcps_rcvpackafterwin++;
1697 if (todrop >= tlen) {
1698 V_tcpstat.tcps_rcvbyteafterwin += tlen;
1699 /*
1700 * If window is closed can only take segments at
1701 * window edge, and have to drop data and PUSH from
1702 * incoming segments. Continue processing, but
1703 * remember to ack. Otherwise, drop segment
1704 * and ack.
1705 */
1706 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1707 tp->t_flags |= TF_ACKNOW;
1708 V_tcpstat.tcps_rcvwinprobe++;
1709 } else
1710 goto dropafterack;
1711 } else
1712 V_tcpstat.tcps_rcvbyteafterwin += todrop;
1713 m_adj(m, -todrop);
1714 tlen -= todrop;
1715 thflags &= ~(TH_PUSH|TH_FIN);
1716 }
1717
1718 /*
1719 * If last ACK falls within this segment's sequence numbers,
1720 * record its timestamp.
1721 * NOTE:
1722 * 1) That the test incorporates suggestions from the latest
1723 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1724 * 2) That updating only on newer timestamps interferes with
1725 * our earlier PAWS tests, so this check should be solely
1726 * predicated on the sequence space of this segment.
1727 * 3) That we modify the segment boundary check to be
1728 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
1729 * instead of RFC1323's
1730 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
1731 * This modified check allows us to overcome RFC1323's
1732 * limitations as described in Stevens TCP/IP Illustrated
1733 * Vol. 2 p.869. In such cases, we can still calculate the
1734 * RTT correctly when RCV.NXT == Last.ACK.Sent.
1735 */
1736 if ((to.to_flags & TOF_TS) != 0 &&
1737 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1738 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
1739 ((thflags & (TH_SYN|TH_FIN)) != 0))) {
1740 tp->ts_recent_age = ticks;
1741 tp->ts_recent = to.to_tsval;
1742 }
1743
1744 /*
1745 * If a SYN is in the window, then this is an
1746 * error and we send an RST and drop the connection.
1747 */
1748 if (thflags & TH_SYN) {
1749 KASSERT(headlocked, ("%s: tcp_drop: trimthenstep6: "
1750 "head not locked", __func__));
1751 tp = tcp_drop(tp, ECONNRESET);
1752 rstreason = BANDLIM_UNLIMITED;
1753 goto drop;
1754 }
1755
1756 /*
1757 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
1758 * flag is on (half-synchronized state), then queue data for
1759 * later processing; else drop segment and return.
1760 */
1761 if ((thflags & TH_ACK) == 0) {
1762 if (tp->t_state == TCPS_SYN_RECEIVED ||
1763 (tp->t_flags & TF_NEEDSYN))
1764 goto step6;
1765 else if (tp->t_flags & TF_ACKNOW)
1766 goto dropafterack;
1767 else
1768 goto drop;
1769 }
1770
1771 /*
1772 * Ack processing.
1773 */
1774 switch (tp->t_state) {
1775
1776 /*
1777 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1778 * ESTABLISHED state and continue processing.
1779 * The ACK was checked above.
1780 */
1781 case TCPS_SYN_RECEIVED:
1782
1783 V_tcpstat.tcps_connects++;
1784 soisconnected(so);
1785 /* Do window scaling? */
1786 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1787 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1788 tp->rcv_scale = tp->request_r_scale;
1789 tp->snd_wnd = tiwin;
1790 }
1791 /*
1792 * Make transitions:
1793 * SYN-RECEIVED -> ESTABLISHED
1794 * SYN-RECEIVED* -> FIN-WAIT-1
1795 */
1796 tp->t_starttime = ticks;
1797 if (tp->t_flags & TF_NEEDFIN) {
1798 tp->t_state = TCPS_FIN_WAIT_1;
1799 tp->t_flags &= ~TF_NEEDFIN;
1800 } else {
1801 tp->t_state = TCPS_ESTABLISHED;
1802 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
1803 }
1804 /*
1805 * If segment contains data or ACK, will call tcp_reass()
1806 * later; if not, do so now to pass queued data to user.
1807 */
1808 if (tlen == 0 && (thflags & TH_FIN) == 0)
1809 (void) tcp_reass(tp, (struct tcphdr *)0, 0,
1810 (struct mbuf *)0);
1811 tp->snd_wl1 = th->th_seq - 1;
1812 /* FALLTHROUGH */
1813
1814 /*
1815 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1816 * ACKs. If the ack is in the range
1817 * tp->snd_una < th->th_ack <= tp->snd_max
1818 * then advance tp->snd_una to th->th_ack and drop
1819 * data from the retransmission queue. If this ACK reflects
1820 * more up to date window information we update our window information.
1821 */
1822 case TCPS_ESTABLISHED:
1823 case TCPS_FIN_WAIT_1:
1824 case TCPS_FIN_WAIT_2:
1825 case TCPS_CLOSE_WAIT:
1826 case TCPS_CLOSING:
1827 case TCPS_LAST_ACK:
1828 if (SEQ_GT(th->th_ack, tp->snd_max)) {
1829 V_tcpstat.tcps_rcvacktoomuch++;
1830 goto dropafterack;
1831 }
1832 if ((tp->t_flags & TF_SACK_PERMIT) &&
1833 ((to.to_flags & TOF_SACK) ||
1834 !TAILQ_EMPTY(&tp->snd_holes)))
1835 tcp_sack_doack(tp, &to, th->th_ack);
1836 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1837 if (tlen == 0 && tiwin == tp->snd_wnd) {
1838 V_tcpstat.tcps_rcvdupack++;
1839 /*
1840 * If we have outstanding data (other than
1841 * a window probe), this is a completely
1842 * duplicate ack (ie, window info didn't
1843 * change), the ack is the biggest we've
1844 * seen and we've seen exactly our rexmt
1845 * threshhold of them, assume a packet
1846 * has been dropped and retransmit it.
1847 * Kludge snd_nxt & the congestion
1848 * window so we send only this one
1849 * packet.
1850 *
1851 * We know we're losing at the current
1852 * window size so do congestion avoidance
1853 * (set ssthresh to half the current window
1854 * and pull our congestion window back to
1855 * the new ssthresh).
1856 *
1857 * Dup acks mean that packets have left the
1858 * network (they're now cached at the receiver)
1859 * so bump cwnd by the amount in the receiver
1860 * to keep a constant cwnd packets in the
1861 * network.
1862 *
1863 * When using TCP ECN, notify the peer that
1864 * we reduced the cwnd.
1865 */
1866 if (!tcp_timer_active(tp, TT_REXMT) ||
1867 th->th_ack != tp->snd_una)
1868 tp->t_dupacks = 0;
1869 else if (++tp->t_dupacks > tcprexmtthresh ||
1870 ((V_tcp_do_newreno ||
1871 (tp->t_flags & TF_SACK_PERMIT)) &&
1872 IN_FASTRECOVERY(tp))) {
1873 if ((tp->t_flags & TF_SACK_PERMIT) &&
1874 IN_FASTRECOVERY(tp)) {
1875 int awnd;
1876
1877 /*
1878 * Compute the amount of data in flight first.
1879 * We can inject new data into the pipe iff
1880 * we have less than 1/2 the original window's
1881 * worth of data in flight.
1882 */
1883 awnd = (tp->snd_nxt - tp->snd_fack) +
1884 tp->sackhint.sack_bytes_rexmit;
1885 if (awnd < tp->snd_ssthresh) {
1886 tp->snd_cwnd += tp->t_maxseg;
1887 if (tp->snd_cwnd > tp->snd_ssthresh)
1888 tp->snd_cwnd = tp->snd_ssthresh;
1889 }
1890 } else
1891 tp->snd_cwnd += tp->t_maxseg;
1892 (void) tcp_output(tp);
1893 goto drop;
1894 } else if (tp->t_dupacks == tcprexmtthresh) {
1895 tcp_seq onxt = tp->snd_nxt;
1896
1897 /*
1898 * If we're doing sack, check to
1899 * see if we're already in sack
1900 * recovery. If we're not doing sack,
1901 * check to see if we're in newreno
1902 * recovery.
1903 */
1904 if (tp->t_flags & TF_SACK_PERMIT) {
1905 if (IN_FASTRECOVERY(tp)) {
1906 tp->t_dupacks = 0;
1907 break;
1908 }
1909 } else if (V_tcp_do_newreno ||
1910 V_tcp_do_ecn) {
1911 if (SEQ_LEQ(th->th_ack,
1912 tp->snd_recover)) {
1913 tp->t_dupacks = 0;
1914 break;
1915 }
1916 }
1917 tcp_congestion_exp(tp);
1918 tcp_timer_activate(tp, TT_REXMT, 0);
1919 tp->t_rtttime = 0;
1920 if (tp->t_flags & TF_SACK_PERMIT) {
1921 V_tcpstat.tcps_sack_recovery_episode++;
1922 tp->sack_newdata = tp->snd_nxt;
1923 tp->snd_cwnd = tp->t_maxseg;
1924 (void) tcp_output(tp);
1925 goto drop;
1926 }
1927 tp->snd_nxt = th->th_ack;
1928 tp->snd_cwnd = tp->t_maxseg;
1929 (void) tcp_output(tp);
1930 KASSERT(tp->snd_limited <= 2,
1931 ("%s: tp->snd_limited too big",
1932 __func__));
1933 tp->snd_cwnd = tp->snd_ssthresh +
1934 tp->t_maxseg *
1935 (tp->t_dupacks - tp->snd_limited);
1936 if (SEQ_GT(onxt, tp->snd_nxt))
1937 tp->snd_nxt = onxt;
1938 goto drop;
1939 } else if (V_tcp_do_rfc3042) {
1940 u_long oldcwnd = tp->snd_cwnd;
1941 tcp_seq oldsndmax = tp->snd_max;
1942 u_int sent;
1943
1944 KASSERT(tp->t_dupacks == 1 ||
1945 tp->t_dupacks == 2,
1946 ("%s: dupacks not 1 or 2",
1947 __func__));
1948 if (tp->t_dupacks == 1)
1949 tp->snd_limited = 0;
1950 tp->snd_cwnd =
1951 (tp->snd_nxt - tp->snd_una) +
1952 (tp->t_dupacks - tp->snd_limited) *
1953 tp->t_maxseg;
1954 (void) tcp_output(tp);
1955 sent = tp->snd_max - oldsndmax;
1956 if (sent > tp->t_maxseg) {
1957 KASSERT((tp->t_dupacks == 2 &&
1958 tp->snd_limited == 0) ||
1959 (sent == tp->t_maxseg + 1 &&
1960 tp->t_flags & TF_SENTFIN),
1961 ("%s: sent too much",
1962 __func__));
1963 tp->snd_limited = 2;
1964 } else if (sent > 0)
1965 ++tp->snd_limited;
1966 tp->snd_cwnd = oldcwnd;
1967 goto drop;
1968 }
1969 } else
1970 tp->t_dupacks = 0;
1971 break;
1972 }
1973
1974 KASSERT(SEQ_GT(th->th_ack, tp->snd_una),
1975 ("%s: th_ack <= snd_una", __func__));
1976
1977 /*
1978 * If the congestion window was inflated to account
1979 * for the other side's cached packets, retract it.
1980 */
1981 if (V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) {
1982 if (IN_FASTRECOVERY(tp)) {
1983 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
1984 if (tp->t_flags & TF_SACK_PERMIT)
1985 tcp_sack_partialack(tp, th);
1986 else
1987 tcp_newreno_partial_ack(tp, th);
1988 } else {
1989 /*
1990 * Out of fast recovery.
1991 * Window inflation should have left us
1992 * with approximately snd_ssthresh
1993 * outstanding data.
1994 * But in case we would be inclined to
1995 * send a burst, better to do it via
1996 * the slow start mechanism.
1997 */
1998 if (SEQ_GT(th->th_ack +
1999 tp->snd_ssthresh,
2000 tp->snd_max))
2001 tp->snd_cwnd = tp->snd_max -
2002 th->th_ack +
2003 tp->t_maxseg;
2004 else
2005 tp->snd_cwnd = tp->snd_ssthresh;
2006 }
2007 }
2008 } else {
2009 if (tp->t_dupacks >= tcprexmtthresh &&
2010 tp->snd_cwnd > tp->snd_ssthresh)
2011 tp->snd_cwnd = tp->snd_ssthresh;
2012 }
2013 tp->t_dupacks = 0;
2014 /*
2015 * If we reach this point, ACK is not a duplicate,
2016 * i.e., it ACKs something we sent.
2017 */
2018 if (tp->t_flags & TF_NEEDSYN) {
2019 /*
2020 * T/TCP: Connection was half-synchronized, and our
2021 * SYN has been ACK'd (so connection is now fully
2022 * synchronized). Go to non-starred state,
2023 * increment snd_una for ACK of SYN, and check if
2024 * we can do window scaling.
2025 */
2026 tp->t_flags &= ~TF_NEEDSYN;
2027 tp->snd_una++;
2028 /* Do window scaling? */
2029 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2030 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2031 tp->rcv_scale = tp->request_r_scale;
2032 /* Send window already scaled. */
2033 }
2034 }
2035
2036process_ACK:
2037 KASSERT(headlocked, ("%s: process_ACK: head not locked",
2038 __func__));
2039 INP_WLOCK_ASSERT(tp->t_inpcb);
2040
2041 acked = th->th_ack - tp->snd_una;
2042 V_tcpstat.tcps_rcvackpack++;
2043 V_tcpstat.tcps_rcvackbyte += acked;
2044
2045 /*
2046 * If we just performed our first retransmit, and the ACK
2047 * arrives within our recovery window, then it was a mistake
2048 * to do the retransmit in the first place. Recover our
2049 * original cwnd and ssthresh, and proceed to transmit where
2050 * we left off.
2051 */
2052 if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) {
2053 ++V_tcpstat.tcps_sndrexmitbad;
2054 tp->snd_cwnd = tp->snd_cwnd_prev;
2055 tp->snd_ssthresh = tp->snd_ssthresh_prev;
2056 tp->snd_recover = tp->snd_recover_prev;
2057 if (tp->t_flags & TF_WASFRECOVERY)
2058 ENTER_FASTRECOVERY(tp);
2059 tp->snd_nxt = tp->snd_max;
2060 tp->t_badrxtwin = 0; /* XXX probably not required */
2061 }
2062
2063 /*
2064 * If we have a timestamp reply, update smoothed
2065 * round trip time. If no timestamp is present but
2066 * transmit timer is running and timed sequence
2067 * number was acked, update smoothed round trip time.
2068 * Since we now have an rtt measurement, cancel the
2069 * timer backoff (cf., Phil Karn's retransmit alg.).
2070 * Recompute the initial retransmit timer.
2071 *
2072 * Some boxes send broken timestamp replies
2073 * during the SYN+ACK phase, ignore
2074 * timestamps of 0 or we could calculate a
2075 * huge RTT and blow up the retransmit timer.
2076 */
2077 if ((to.to_flags & TOF_TS) != 0 &&
2078 to.to_tsecr) {
2079 if (!tp->t_rttlow || tp->t_rttlow > ticks - to.to_tsecr)
2080 tp->t_rttlow = ticks - to.to_tsecr;
2081 tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
2082 } else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) {
2083 if (!tp->t_rttlow || tp->t_rttlow > ticks - tp->t_rtttime)
2084 tp->t_rttlow = ticks - tp->t_rtttime;
2085 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
2086 }
2087 tcp_xmit_bandwidth_limit(tp, th->th_ack);
2088
2089 /*
2090 * If all outstanding data is acked, stop retransmit
2091 * timer and remember to restart (more output or persist).
2092 * If there is more data to be acked, restart retransmit
2093 * timer, using current (possibly backed-off) value.
2094 */
2095 if (th->th_ack == tp->snd_max) {
2096 tcp_timer_activate(tp, TT_REXMT, 0);
2097 needoutput = 1;
2098 } else if (!tcp_timer_active(tp, TT_PERSIST))
2099 tcp_timer_activate(tp, TT_REXMT, tp->t_rxtcur);
2100
2101 /*
2102 * If no data (only SYN) was ACK'd,
2103 * skip rest of ACK processing.
2104 */
2105 if (acked == 0)
2106 goto step6;
2107
2108 /*
2109 * When new data is acked, open the congestion window.
2110 * If the window gives us less than ssthresh packets
2111 * in flight, open exponentially (maxseg per packet).
2112 * Otherwise open linearly: maxseg per window
2113 * (maxseg^2 / cwnd per packet).
2114 * If cwnd > maxseg^2, fix the cwnd increment at 1 byte
2115 * to avoid capping cwnd (as suggested in RFC2581).
2116 */
2117 if ((!V_tcp_do_newreno && !(tp->t_flags & TF_SACK_PERMIT)) ||
2118 !IN_FASTRECOVERY(tp)) {
2119 u_int cw = tp->snd_cwnd;
2120 u_int incr = tp->t_maxseg;
2121 if (cw > tp->snd_ssthresh)
2122 incr = max((incr * incr / cw), 1);
2123 tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale);
2124 }
2125 SOCKBUF_LOCK(&so->so_snd);
2126 if (acked > so->so_snd.sb_cc) {
2127 tp->snd_wnd -= so->so_snd.sb_cc;
2128 sbdrop_locked(&so->so_snd, (int)so->so_snd.sb_cc);
2129 ourfinisacked = 1;
2130 } else {
2131 sbdrop_locked(&so->so_snd, acked);
2132 tp->snd_wnd -= acked;
2133 ourfinisacked = 0;
2134 }
2135 /* NB: sowwakeup_locked() does an implicit unlock. */
2136 sowwakeup_locked(so);
2137 /* Detect una wraparound. */
2138 if ((V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) &&
2139 !IN_FASTRECOVERY(tp) &&
2140 SEQ_GT(tp->snd_una, tp->snd_recover) &&
2141 SEQ_LEQ(th->th_ack, tp->snd_recover))
2142 tp->snd_recover = th->th_ack - 1;
2143 if ((V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) &&
2144 IN_FASTRECOVERY(tp) &&
2145 SEQ_GEQ(th->th_ack, tp->snd_recover))
2146 EXIT_FASTRECOVERY(tp);
2147 tp->snd_una = th->th_ack;
2148 if (tp->t_flags & TF_SACK_PERMIT) {
2149 if (SEQ_GT(tp->snd_una, tp->snd_recover))
2150 tp->snd_recover = tp->snd_una;
2151 }
2152 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2153 tp->snd_nxt = tp->snd_una;
2154
2155 switch (tp->t_state) {
2156
2157 /*
2158 * In FIN_WAIT_1 STATE in addition to the processing
2159 * for the ESTABLISHED state if our FIN is now acknowledged
2160 * then enter FIN_WAIT_2.
2161 */
2162 case TCPS_FIN_WAIT_1:
2163 if (ourfinisacked) {
2164 /*
2165 * If we can't receive any more
2166 * data, then closing user can proceed.
2167 * Starting the timer is contrary to the
2168 * specification, but if we don't get a FIN
2169 * we'll hang forever.
2170 *
2171 * XXXjl:
2172 * we should release the tp also, and use a
2173 * compressed state.
2174 */
2175 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
2176 int timeout;
2177
2178 soisdisconnected(so);
2179 timeout = (tcp_fast_finwait2_recycle) ?
2180 tcp_finwait2_timeout : tcp_maxidle;
2181 tcp_timer_activate(tp, TT_2MSL, timeout);
2182 }
2183 tp->t_state = TCPS_FIN_WAIT_2;
2184 }
2185 break;
2186
2187 /*
2188 * In CLOSING STATE in addition to the processing for
2189 * the ESTABLISHED state if the ACK acknowledges our FIN
2190 * then enter the TIME-WAIT state, otherwise ignore
2191 * the segment.
2192 */
2193 case TCPS_CLOSING:
2194 if (ourfinisacked) {
2195 KASSERT(headlocked, ("%s: process_ACK: "
2196 "head not locked", __func__));
2197 tcp_twstart(tp);
2198 INP_INFO_WUNLOCK(&V_tcbinfo);
2199 headlocked = 0;
2200 m_freem(m);
2201 return;
2202 }
2203 break;
2204
2205 /*
2206 * In LAST_ACK, we may still be waiting for data to drain
2207 * and/or to be acked, as well as for the ack of our FIN.
2208 * If our FIN is now acknowledged, delete the TCB,
2209 * enter the closed state and return.
2210 */
2211 case TCPS_LAST_ACK:
2212 if (ourfinisacked) {
2213 KASSERT(headlocked, ("%s: process_ACK: "
2214 "tcp_close: head not locked", __func__));
2215 tp = tcp_close(tp);
2216 goto drop;
2217 }
2218 break;
2219 }
2220 }
2221
2222step6:
2223 KASSERT(headlocked, ("%s: step6: head not locked", __func__));
2224 INP_WLOCK_ASSERT(tp->t_inpcb);
2225
2226 /*
2227 * Update window information.
2228 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2229 */
2230 if ((thflags & TH_ACK) &&
2231 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2232 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2233 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2234 /* keep track of pure window updates */
2235 if (tlen == 0 &&
2236 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2237 V_tcpstat.tcps_rcvwinupd++;
2238 tp->snd_wnd = tiwin;
2239 tp->snd_wl1 = th->th_seq;
2240 tp->snd_wl2 = th->th_ack;
2241 if (tp->snd_wnd > tp->max_sndwnd)
2242 tp->max_sndwnd = tp->snd_wnd;
2243 needoutput = 1;
2244 }
2245
2246 /*
2247 * Process segments with URG.
2248 */
2249 if ((thflags & TH_URG) && th->th_urp &&
2250 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2251 /*
2252 * This is a kludge, but if we receive and accept
2253 * random urgent pointers, we'll crash in
2254 * soreceive. It's hard to imagine someone
2255 * actually wanting to send this much urgent data.
2256 */
2257 SOCKBUF_LOCK(&so->so_rcv);
2258 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2259 th->th_urp = 0; /* XXX */
2260 thflags &= ~TH_URG; /* XXX */
2261 SOCKBUF_UNLOCK(&so->so_rcv); /* XXX */
2262 goto dodata; /* XXX */
2263 }
2264 /*
2265 * If this segment advances the known urgent pointer,
2266 * then mark the data stream. This should not happen
2267 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2268 * a FIN has been received from the remote side.
2269 * In these states we ignore the URG.
2270 *
2271 * According to RFC961 (Assigned Protocols),
2272 * the urgent pointer points to the last octet
2273 * of urgent data. We continue, however,
2274 * to consider it to indicate the first octet
2275 * of data past the urgent section as the original
2276 * spec states (in one of two places).
2277 */
2278 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2279 tp->rcv_up = th->th_seq + th->th_urp;
2280 so->so_oobmark = so->so_rcv.sb_cc +
2281 (tp->rcv_up - tp->rcv_nxt) - 1;
2282 if (so->so_oobmark == 0)
2283 so->so_rcv.sb_state |= SBS_RCVATMARK;
2284 sohasoutofband(so);
2285 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2286 }
2287 SOCKBUF_UNLOCK(&so->so_rcv);
2288 /*
2289 * Remove out of band data so doesn't get presented to user.
2290 * This can happen independent of advancing the URG pointer,
2291 * but if two URG's are pending at once, some out-of-band
2292 * data may creep in... ick.
2293 */
2294 if (th->th_urp <= (u_long)tlen &&
2295 !(so->so_options & SO_OOBINLINE)) {
2296 /* hdr drop is delayed */
2297 tcp_pulloutofband(so, th, m, drop_hdrlen);
2298 }
2299 } else {
2300 /*
2301 * If no out of band data is expected,
2302 * pull receive urgent pointer along
2303 * with the receive window.
2304 */
2305 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2306 tp->rcv_up = tp->rcv_nxt;
2307 }
2308dodata: /* XXX */
2309 KASSERT(headlocked, ("%s: dodata: head not locked", __func__));
2310 INP_WLOCK_ASSERT(tp->t_inpcb);
2311
2312 /*
2313 * Process the segment text, merging it into the TCP sequencing queue,
2314 * and arranging for acknowledgment of receipt if necessary.
2315 * This process logically involves adjusting tp->rcv_wnd as data
2316 * is presented to the user (this happens in tcp_usrreq.c,
2317 * case PRU_RCVD). If a FIN has already been received on this
2318 * connection then we just ignore the text.
2319 */
2320 if ((tlen || (thflags & TH_FIN)) &&
2321 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2322 tcp_seq save_start = th->th_seq;
2323 m_adj(m, drop_hdrlen); /* delayed header drop */
2324 /*
2325 * Insert segment which includes th into TCP reassembly queue
2326 * with control block tp. Set thflags to whether reassembly now
2327 * includes a segment with FIN. This handles the common case
2328 * inline (segment is the next to be received on an established
2329 * connection, and the queue is empty), avoiding linkage into
2330 * and removal from the queue and repetition of various
2331 * conversions.
2332 * Set DELACK for segments received in order, but ack
2333 * immediately when segments are out of order (so
2334 * fast retransmit can work).
2335 */
2336 if (th->th_seq == tp->rcv_nxt &&
2337 LIST_EMPTY(&tp->t_segq) &&
2338 TCPS_HAVEESTABLISHED(tp->t_state)) {
2339 if (DELAY_ACK(tp))
2340 tp->t_flags |= TF_DELACK;
2341 else
2342 tp->t_flags |= TF_ACKNOW;
2343 tp->rcv_nxt += tlen;
2344 thflags = th->th_flags & TH_FIN;
2345 V_tcpstat.tcps_rcvpack++;
2346 V_tcpstat.tcps_rcvbyte += tlen;
2347 ND6_HINT(tp);
2348 SOCKBUF_LOCK(&so->so_rcv);
2349 if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
2350 m_freem(m);
2351 else
2352 sbappendstream_locked(&so->so_rcv, m);
2353 /* NB: sorwakeup_locked() does an implicit unlock. */
2354 sorwakeup_locked(so);
2355 } else {
2356 /*
2357 * XXX: Due to the header drop above "th" is
2358 * theoretically invalid by now. Fortunately
2359 * m_adj() doesn't actually frees any mbufs
2360 * when trimming from the head.
2361 */
2362 thflags = tcp_reass(tp, th, &tlen, m);
2363 tp->t_flags |= TF_ACKNOW;
2364 }
2365 if (tlen > 0 && (tp->t_flags & TF_SACK_PERMIT))
2366 tcp_update_sack_list(tp, save_start, save_start + tlen);
2367#if 0
2368 /*
2369 * Note the amount of data that peer has sent into
2370 * our window, in order to estimate the sender's
2371 * buffer size.
2372 * XXX: Unused.
2373 */
2374 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2375#endif
2376 } else {
2377 m_freem(m);
2378 thflags &= ~TH_FIN;
2379 }
2380
2381 /*
2382 * If FIN is received ACK the FIN and let the user know
2383 * that the connection is closing.
2384 */
2385 if (thflags & TH_FIN) {
2386 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2387 socantrcvmore(so);
2388 /*
2389 * If connection is half-synchronized
2390 * (ie NEEDSYN flag on) then delay ACK,
2391 * so it may be piggybacked when SYN is sent.
2392 * Otherwise, since we received a FIN then no
2393 * more input can be expected, send ACK now.
2394 */
2395 if (tp->t_flags & TF_NEEDSYN)
2396 tp->t_flags |= TF_DELACK;
2397 else
2398 tp->t_flags |= TF_ACKNOW;
2399 tp->rcv_nxt++;
2400 }
2401 switch (tp->t_state) {
2402
2403 /*
2404 * In SYN_RECEIVED and ESTABLISHED STATES
2405 * enter the CLOSE_WAIT state.
2406 */
2407 case TCPS_SYN_RECEIVED:
2408 tp->t_starttime = ticks;
2409 /* FALLTHROUGH */
2410 case TCPS_ESTABLISHED:
2411 tp->t_state = TCPS_CLOSE_WAIT;
2412 break;
2413
2414 /*
2415 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2416 * enter the CLOSING state.
2417 */
2418 case TCPS_FIN_WAIT_1:
2419 tp->t_state = TCPS_CLOSING;
2420 break;
2421
2422 /*
2423 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2424 * starting the time-wait timer, turning off the other
2425 * standard timers.
2426 */
2427 case TCPS_FIN_WAIT_2:
2428 KASSERT(headlocked == 1, ("%s: dodata: "
2429 "TCP_FIN_WAIT_2: head not locked", __func__));
2430 tcp_twstart(tp);
2431 INP_INFO_WUNLOCK(&V_tcbinfo);
2432 return;
2433 }
2434 }
2435 INP_INFO_WUNLOCK(&V_tcbinfo);
2436 headlocked = 0;
2437#ifdef TCPDEBUG
2438 if (so->so_options & SO_DEBUG)
2439 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2440 &tcp_savetcp, 0);
2441#endif
2442
2443 /*
2444 * Return any desired output.
2445 */
2446 if (needoutput || (tp->t_flags & TF_ACKNOW))
2447 (void) tcp_output(tp);
2448
2449check_delack:
2450 KASSERT(headlocked == 0, ("%s: check_delack: head locked",
2451 __func__));
2452 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
2453 INP_WLOCK_ASSERT(tp->t_inpcb);
2454 if (tp->t_flags & TF_DELACK) {
2455 tp->t_flags &= ~TF_DELACK;
2456 tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
2457 }
2458 INP_WUNLOCK(tp->t_inpcb);
2459 return;
2460
2461dropafterack:
2462 KASSERT(headlocked, ("%s: dropafterack: head not locked", __func__));
2463 /*
2464 * Generate an ACK dropping incoming segment if it occupies
2465 * sequence space, where the ACK reflects our state.
2466 *
2467 * We can now skip the test for the RST flag since all
2468 * paths to this code happen after packets containing
2469 * RST have been dropped.
2470 *
2471 * In the SYN-RECEIVED state, don't send an ACK unless the
2472 * segment we received passes the SYN-RECEIVED ACK test.
2473 * If it fails send a RST. This breaks the loop in the
2474 * "LAND" DoS attack, and also prevents an ACK storm
2475 * between two listening ports that have been sent forged
2476 * SYN segments, each with the source address of the other.
2477 */
2478 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2479 (SEQ_GT(tp->snd_una, th->th_ack) ||
2480 SEQ_GT(th->th_ack, tp->snd_max)) ) {
2481 rstreason = BANDLIM_RST_OPENPORT;
2482 goto dropwithreset;
2483 }
2484#ifdef TCPDEBUG
2485 if (so->so_options & SO_DEBUG)
2486 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2487 &tcp_savetcp, 0);
2488#endif
2489 KASSERT(headlocked, ("%s: headlocked should be 1", __func__));
2490 INP_INFO_WUNLOCK(&V_tcbinfo);
2491 tp->t_flags |= TF_ACKNOW;
2492 (void) tcp_output(tp);
2493 INP_WUNLOCK(tp->t_inpcb);
2494 m_freem(m);
2495 return;
2496
2497dropwithreset:
2498 KASSERT(headlocked, ("%s: dropwithreset: head not locked", __func__));
2499 INP_INFO_WUNLOCK(&V_tcbinfo);
2500
2501 if (tp != NULL) {
2502 tcp_dropwithreset(m, th, tp, tlen, rstreason);
2503 INP_WUNLOCK(tp->t_inpcb);
2504 } else
2505 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
2506 return;
2507
2508drop:
2509 /*
2510 * Drop space held by incoming segment and return.
2511 */
2512#ifdef TCPDEBUG
2513 if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2514 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2515 &tcp_savetcp, 0);
2516#endif
2517 if (tp != NULL)
2518 INP_WUNLOCK(tp->t_inpcb);
2519 if (headlocked)
2520 INP_INFO_WUNLOCK(&V_tcbinfo);
2521 m_freem(m);
2522}
2523
2524/*
2525 * Issue RST and make ACK acceptable to originator of segment.
2526 * The mbuf must still include the original packet header.
2527 * tp may be NULL.
2528 */
2529static void
2530tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
2531 int tlen, int rstreason)
2532{
2533 struct ip *ip;
2534#ifdef INET6
2535 struct ip6_hdr *ip6;
2536#endif
2537
2538 if (tp != NULL) {
2539 INP_WLOCK_ASSERT(tp->t_inpcb);
2540 }
2541
2542 /* Don't bother if destination was broadcast/multicast. */
2543 if ((th->th_flags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2544 goto drop;
2545#ifdef INET6
2546 if (mtod(m, struct ip *)->ip_v == 6) {
2547 ip6 = mtod(m, struct ip6_hdr *);
2548 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2549 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2550 goto drop;
2551 /* IPv6 anycast check is done at tcp6_input() */
2552 } else
2553#endif
2554 {
2555 ip = mtod(m, struct ip *);
2556 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2557 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2558 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2559 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2560 goto drop;
2561 }
2562
2563 /* Perform bandwidth limiting. */
2564 if (badport_bandlim(rstreason) < 0)
2565 goto drop;
2566
2567 /* tcp_respond consumes the mbuf chain. */
2568 if (th->th_flags & TH_ACK) {
2569 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0,
2570 th->th_ack, TH_RST);
2571 } else {
2572 if (th->th_flags & TH_SYN)
2573 tlen++;
2574 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2575 (tcp_seq)0, TH_RST|TH_ACK);
2576 }
2577 return;
2578drop:
2579 m_freem(m);
2580}
2581
2582/*
2583 * Parse TCP options and place in tcpopt.
2584 */
2585static void
2586tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, int flags)
2587{
2588 INIT_VNET_INET(curvnet);
2589 int opt, optlen;
2590
2591 to->to_flags = 0;
2592 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2593 opt = cp[0];
2594 if (opt == TCPOPT_EOL)
2595 break;
2596 if (opt == TCPOPT_NOP)
2597 optlen = 1;
2598 else {
2599 if (cnt < 2)
2600 break;
2601 optlen = cp[1];
2602 if (optlen < 2 || optlen > cnt)
2603 break;
2604 }
2605 switch (opt) {
2606 case TCPOPT_MAXSEG:
2607 if (optlen != TCPOLEN_MAXSEG)
2608 continue;
2609 if (!(flags & TO_SYN))
2610 continue;
2611 to->to_flags |= TOF_MSS;
2612 bcopy((char *)cp + 2,
2613 (char *)&to->to_mss, sizeof(to->to_mss));
2614 to->to_mss = ntohs(to->to_mss);
2615 break;
2616 case TCPOPT_WINDOW:
2617 if (optlen != TCPOLEN_WINDOW)
2618 continue;
2619 if (!(flags & TO_SYN))
2620 continue;
2621 to->to_flags |= TOF_SCALE;
2622 to->to_wscale = min(cp[2], TCP_MAX_WINSHIFT);
2623 break;
2624 case TCPOPT_TIMESTAMP:
2625 if (optlen != TCPOLEN_TIMESTAMP)
2626 continue;
2627 to->to_flags |= TOF_TS;
2628 bcopy((char *)cp + 2,
2629 (char *)&to->to_tsval, sizeof(to->to_tsval));
2630 to->to_tsval = ntohl(to->to_tsval);
2631 bcopy((char *)cp + 6,
2632 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2633 to->to_tsecr = ntohl(to->to_tsecr);
2634 break;
2635#ifdef TCP_SIGNATURE
2636 /*
2637 * XXX In order to reply to a host which has set the
2638 * TCP_SIGNATURE option in its initial SYN, we have to
2639 * record the fact that the option was observed here
2640 * for the syncache code to perform the correct response.
2641 */
2642 case TCPOPT_SIGNATURE:
2643 if (optlen != TCPOLEN_SIGNATURE)
2644 continue;
2645 to->to_flags |= TOF_SIGNATURE;
2646 to->to_signature = cp + 2;
2647 break;
2648#endif
2649 case TCPOPT_SACK_PERMITTED:
2650 if (optlen != TCPOLEN_SACK_PERMITTED)
2651 continue;
2652 if (!(flags & TO_SYN))
2653 continue;
2654 if (!V_tcp_do_sack)
2655 continue;
2656 to->to_flags |= TOF_SACKPERM;
2657 break;
2658 case TCPOPT_SACK:
2659 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
2660 continue;
2661 if (flags & TO_SYN)
2662 continue;
2663 to->to_flags |= TOF_SACK;
2664 to->to_nsacks = (optlen - 2) / TCPOLEN_SACK;
2665 to->to_sacks = cp + 2;
2666 V_tcpstat.tcps_sack_rcv_blocks++;
2667 break;
2668 default:
2669 continue;
2670 }
2671 }
2672}
2673
2674/*
2675 * Pull out of band byte out of a segment so
2676 * it doesn't appear in the user's data queue.
2677 * It is still reflected in the segment length for
2678 * sequencing purposes.
2679 */
2680static void
2681tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m,
2682 int off)
2683{
2684 int cnt = off + th->th_urp - 1;
2685
2686 while (cnt >= 0) {
2687 if (m->m_len > cnt) {
2688 char *cp = mtod(m, caddr_t) + cnt;
2689 struct tcpcb *tp = sototcpcb(so);
2690
2691 INP_WLOCK_ASSERT(tp->t_inpcb);
2692
2693 tp->t_iobc = *cp;
2694 tp->t_oobflags |= TCPOOB_HAVEDATA;
2695 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2696 m->m_len--;
2697 if (m->m_flags & M_PKTHDR)
2698 m->m_pkthdr.len--;
2699 return;
2700 }
2701 cnt -= m->m_len;
2702 m = m->m_next;
2703 if (m == NULL)
2704 break;
2705 }
2706 panic("tcp_pulloutofband");
2707}
2708
2709/*
2710 * Collect new round-trip time estimate
2711 * and update averages and current timeout.
2712 */
2713static void
2714tcp_xmit_timer(struct tcpcb *tp, int rtt)
2715{
2716 INIT_VNET_INET(tp->t_inpcb->inp_vnet);
2717 int delta;
2718
2719 INP_WLOCK_ASSERT(tp->t_inpcb);
2720
2721 V_tcpstat.tcps_rttupdated++;
2722 tp->t_rttupdated++;
2723 if (tp->t_srtt != 0) {
2724 /*
2725 * srtt is stored as fixed point with 5 bits after the
2726 * binary point (i.e., scaled by 8). The following magic
2727 * is equivalent to the smoothing algorithm in rfc793 with
2728 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2729 * point). Adjust rtt to origin 0.
2730 */
2731 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2732 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2733
2734 if ((tp->t_srtt += delta) <= 0)
2735 tp->t_srtt = 1;
2736
2737 /*
2738 * We accumulate a smoothed rtt variance (actually, a
2739 * smoothed mean difference), then set the retransmit
2740 * timer to smoothed rtt + 4 times the smoothed variance.
2741 * rttvar is stored as fixed point with 4 bits after the
2742 * binary point (scaled by 16). The following is
2743 * equivalent to rfc793 smoothing with an alpha of .75
2744 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2745 * rfc793's wired-in beta.
2746 */
2747 if (delta < 0)
2748 delta = -delta;
2749 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2750 if ((tp->t_rttvar += delta) <= 0)
2751 tp->t_rttvar = 1;
2752 if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar)
2753 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2754 } else {
2755 /*
2756 * No rtt measurement yet - use the unsmoothed rtt.
2757 * Set the variance to half the rtt (so our first
2758 * retransmit happens at 3*rtt).
2759 */
2760 tp->t_srtt = rtt << TCP_RTT_SHIFT;
2761 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2762 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2763 }
2764 tp->t_rtttime = 0;
2765 tp->t_rxtshift = 0;
2766
2767 /*
2768 * the retransmit should happen at rtt + 4 * rttvar.
2769 * Because of the way we do the smoothing, srtt and rttvar
2770 * will each average +1/2 tick of bias. When we compute
2771 * the retransmit timer, we want 1/2 tick of rounding and
2772 * 1 extra tick because of +-1/2 tick uncertainty in the
2773 * firing of the timer. The bias will give us exactly the
2774 * 1.5 tick we need. But, because the bias is
2775 * statistical, we have to test that we don't drop below
2776 * the minimum feasible timer (which is 2 ticks).
2777 */
2778 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2779 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2780
2781 /*
2782 * We received an ack for a packet that wasn't retransmitted;
2783 * it is probably safe to discard any error indications we've
2784 * received recently. This isn't quite right, but close enough
2785 * for now (a route might have failed after we sent a segment,
2786 * and the return path might not be symmetrical).
2787 */
2788 tp->t_softerror = 0;
2789}
2790
2791/*
2792 * Determine a reasonable value for maxseg size.
2793 * If the route is known, check route for mtu.
2794 * If none, use an mss that can be handled on the outgoing
2795 * interface without forcing IP to fragment; if bigger than
2796 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2797 * to utilize large mbufs. If no route is found, route has no mtu,
2798 * or the destination isn't local, use a default, hopefully conservative
2799 * size (usually 512 or the default IP max size, but no more than the mtu
2800 * of the interface), as we can't discover anything about intervening
2801 * gateways or networks. We also initialize the congestion/slow start
2802 * window to be a single segment if the destination isn't local.
2803 * While looking at the routing entry, we also initialize other path-dependent
2804 * parameters from pre-set or cached values in the routing entry.
2805 *
2806 * Also take into account the space needed for options that we
2807 * send regularly. Make maxseg shorter by that amount to assure
2808 * that we can send maxseg amount of data even when the options
2809 * are present. Store the upper limit of the length of options plus
2810 * data in maxopd.
2811 *
2812 * In case of T/TCP, we call this routine during implicit connection
2813 * setup as well (offer = -1), to initialize maxseg from the cached
2814 * MSS of our peer.
2815 *
2816 * NOTE that this routine is only called when we process an incoming
2817 * segment. Outgoing SYN/ACK MSS settings are handled in tcp_mssopt().
2818 */
2819void
2820tcp_mss_update(struct tcpcb *tp, int offer,
2821 struct hc_metrics_lite *metricptr, int *mtuflags)
2822{
2823 INIT_VNET_INET(tp->t_inpcb->inp_vnet);
2824 int mss;
2825 u_long maxmtu;
2826 struct inpcb *inp = tp->t_inpcb;
2827 struct hc_metrics_lite metrics;
2828 int origoffer = offer;
2829#ifdef INET6
2830 int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2831 size_t min_protoh = isipv6 ?
2832 sizeof (struct ip6_hdr) + sizeof (struct tcphdr) :
2833 sizeof (struct tcpiphdr);
2834#else
2835 const size_t min_protoh = sizeof(struct tcpiphdr);
2836#endif
2837
2838 INP_WLOCK_ASSERT(tp->t_inpcb);
2839
2840 /* Initialize. */
2841#ifdef INET6
2842 if (isipv6) {
2843 maxmtu = tcp_maxmtu6(&inp->inp_inc, mtuflags);
2844 tp->t_maxopd = tp->t_maxseg = V_tcp_v6mssdflt;
2845 } else
2846#endif
2847 {
2848 maxmtu = tcp_maxmtu(&inp->inp_inc, mtuflags);
2849 tp->t_maxopd = tp->t_maxseg = V_tcp_mssdflt;
2850 }
2851
2852 /*
2853 * No route to sender, stay with default mss and return.
2854 */
2855 if (maxmtu == 0) {
2856 /*
2857 * In case we return early we need to initialize metrics
2858 * to a defined state as tcp_hc_get() would do for us
2859 * if there was no cache hit.
2860 */
2861 if (metricptr != NULL)
2862 bzero(metricptr, sizeof(struct hc_metrics_lite));
2863 return;
2864 }
2865
2866 /* What have we got? */
2867 switch (offer) {
2868 case 0:
2869 /*
2870 * Offer == 0 means that there was no MSS on the SYN
2871 * segment, in this case we use tcp_mssdflt as
2872 * already assigned to t_maxopd above.
2873 */
2874 offer = tp->t_maxopd;
2875 break;
2876
2877 case -1:
2878 /*
2879 * Offer == -1 means that we didn't receive SYN yet.
2880 */
2881 /* FALLTHROUGH */
2882
2883 default:
2884 /*
2885 * Prevent DoS attack with too small MSS. Round up
2886 * to at least minmss.
2887 */
2888 offer = max(offer, V_tcp_minmss);
2889 }
2890
2891 /*
2892 * rmx information is now retrieved from tcp_hostcache.
2893 */
2894 tcp_hc_get(&inp->inp_inc, &metrics);
2895 if (metricptr != NULL)
2896 bcopy(&metrics, metricptr, sizeof(struct hc_metrics_lite));
2897
2898 /*
2899 * If there's a discovered mtu int tcp hostcache, use it
2900 * else, use the link mtu.
2901 */
2902 if (metrics.rmx_mtu)
2903 mss = min(metrics.rmx_mtu, maxmtu) - min_protoh;
2904 else {
2905#ifdef INET6
2906 if (isipv6) {
2907 mss = maxmtu - min_protoh;
2908 if (!V_path_mtu_discovery &&
2909 !in6_localaddr(&inp->in6p_faddr))
2910 mss = min(mss, V_tcp_v6mssdflt);
2911 } else
2912#endif
2913 {
2914 mss = maxmtu - min_protoh;
2915 if (!V_path_mtu_discovery &&
2916 !in_localaddr(inp->inp_faddr))
2917 mss = min(mss, V_tcp_mssdflt);
2918 }
2919 /*
2920 * XXX - The above conditional (mss = maxmtu - min_protoh)
2921 * probably violates the TCP spec.
2922 * The problem is that, since we don't know the
2923 * other end's MSS, we are supposed to use a conservative
2924 * default. But, if we do that, then MTU discovery will
2925 * never actually take place, because the conservative
2926 * default is much less than the MTUs typically seen
2927 * on the Internet today. For the moment, we'll sweep
2928 * this under the carpet.
2929 *
2930 * The conservative default might not actually be a problem
2931 * if the only case this occurs is when sending an initial
2932 * SYN with options and data to a host we've never talked
2933 * to before. Then, they will reply with an MSS value which
2934 * will get recorded and the new parameters should get
2935 * recomputed. For Further Study.
2936 */
2937 }
2938 mss = min(mss, offer);
2939
2940 /*
2941 * Sanity check: make sure that maxopd will be large
2942 * enough to allow some data on segments even if the
2943 * all the option space is used (40bytes). Otherwise
2944 * funny things may happen in tcp_output.
2945 */
2946 mss = max(mss, 64);
2947
2948 /*
2949 * maxopd stores the maximum length of data AND options
2950 * in a segment; maxseg is the amount of data in a normal
2951 * segment. We need to store this value (maxopd) apart
2952 * from maxseg, because now every segment carries options
2953 * and thus we normally have somewhat less data in segments.
2954 */
2955 tp->t_maxopd = mss;
2956
2957 /*
2958 * origoffer==-1 indicates that no segments were received yet.
2959 * In this case we just guess.
2960 */
2961 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2962 (origoffer == -1 ||
2963 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
2964 mss -= TCPOLEN_TSTAMP_APPA;
2965
2966#if (MCLBYTES & (MCLBYTES - 1)) == 0
2967 if (mss > MCLBYTES)
2968 mss &= ~(MCLBYTES-1);
2969#else
2970 if (mss > MCLBYTES)
2971 mss = mss / MCLBYTES * MCLBYTES;
2972#endif
2973 tp->t_maxseg = mss;
2974}
2975
2976void
2977tcp_mss(struct tcpcb *tp, int offer)
2978{
2979 int rtt, mss;
2980 u_long bufsize;
2981 struct inpcb *inp;
2982 struct socket *so;
2983 struct hc_metrics_lite metrics;
2984 int mtuflags = 0;
2985#ifdef INET6
2986 int isipv6;
2987#endif
2988 KASSERT(tp != NULL, ("%s: tp == NULL", __func__));
2989 INIT_VNET_INET(tp->t_vnet);
2990
2991 tcp_mss_update(tp, offer, &metrics, &mtuflags);
2992
2993 mss = tp->t_maxseg;
2994 inp = tp->t_inpcb;
2995#ifdef INET6
2996 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2997#endif
2998
2999 /*
3000 * If there's a pipesize, change the socket buffer to that size,
3001 * don't change if sb_hiwat is different than default (then it
3002 * has been changed on purpose with setsockopt).
3003 * Make the socket buffers an integral number of mss units;
3004 * if the mss is larger than the socket buffer, decrease the mss.
3005 */
3006 so = inp->inp_socket;
3007 SOCKBUF_LOCK(&so->so_snd);
3008 if ((so->so_snd.sb_hiwat == tcp_sendspace) && metrics.rmx_sendpipe)
3009 bufsize = metrics.rmx_sendpipe;
3010 else
3011 bufsize = so->so_snd.sb_hiwat;
3012 if (bufsize < mss)
3013 mss = bufsize;
3014 else {
3015 bufsize = roundup(bufsize, mss);
3016 if (bufsize > sb_max)
3017 bufsize = sb_max;
3018 if (bufsize > so->so_snd.sb_hiwat)
3019 (void)sbreserve_locked(&so->so_snd, bufsize, so, NULL);
3020 }
3021 SOCKBUF_UNLOCK(&so->so_snd);
3022 tp->t_maxseg = mss;
3023
3024 SOCKBUF_LOCK(&so->so_rcv);
3025 if ((so->so_rcv.sb_hiwat == tcp_recvspace) && metrics.rmx_recvpipe)
3026 bufsize = metrics.rmx_recvpipe;
3027 else
3028 bufsize = so->so_rcv.sb_hiwat;
3029 if (bufsize > mss) {
3030 bufsize = roundup(bufsize, mss);
3031 if (bufsize > sb_max)
3032 bufsize = sb_max;
3033 if (bufsize > so->so_rcv.sb_hiwat)
3034 (void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL);
3035 }
3036 SOCKBUF_UNLOCK(&so->so_rcv);
3037 /*
3038 * While we're here, check the others too.
3039 */
3040 if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) {
3041 tp->t_srtt = rtt;
3042 tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE;
3043 V_tcpstat.tcps_usedrtt++;
3044 if (metrics.rmx_rttvar) {
3045 tp->t_rttvar = metrics.rmx_rttvar;
3046 V_tcpstat.tcps_usedrttvar++;
3047 } else {
3048 /* default variation is +- 1 rtt */
3049 tp->t_rttvar =
3050 tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
3051 }
3052 TCPT_RANGESET(tp->t_rxtcur,
3053 ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
3054 tp->t_rttmin, TCPTV_REXMTMAX);
3055 }
3056 if (metrics.rmx_ssthresh) {
3057 /*
3058 * There's some sort of gateway or interface
3059 * buffer limit on the path. Use this to set
3060 * the slow start threshhold, but set the
3061 * threshold to no less than 2*mss.
3062 */
3063 tp->snd_ssthresh = max(2 * mss, metrics.rmx_ssthresh);
3064 V_tcpstat.tcps_usedssthresh++;
3065 }
3066 if (metrics.rmx_bandwidth)
3067 tp->snd_bandwidth = metrics.rmx_bandwidth;
3068
3069 /*
3070 * Set the slow-start flight size depending on whether this
3071 * is a local network or not.
3072 *
3073 * Extend this so we cache the cwnd too and retrieve it here.
3074 * Make cwnd even bigger than RFC3390 suggests but only if we
3075 * have previous experience with the remote host. Be careful
3076 * not make cwnd bigger than remote receive window or our own
3077 * send socket buffer. Maybe put some additional upper bound
3078 * on the retrieved cwnd. Should do incremental updates to
3079 * hostcache when cwnd collapses so next connection doesn't
3080 * overloads the path again.
3081 *
3082 * RFC3390 says only do this if SYN or SYN/ACK didn't got lost.
3083 * We currently check only in syncache_socket for that.
3084 */
3085#define TCP_METRICS_CWND
3086#ifdef TCP_METRICS_CWND
3087 if (metrics.rmx_cwnd)
3088 tp->snd_cwnd = max(mss,
3089 min(metrics.rmx_cwnd / 2,
3090 min(tp->snd_wnd, so->so_snd.sb_hiwat)));
3091 else
3092#endif
3093 if (V_tcp_do_rfc3390)
3094 tp->snd_cwnd = min(4 * mss, max(2 * mss, 4380));
3095#ifdef INET6
3096 else if ((isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
3097 (!isipv6 && in_localaddr(inp->inp_faddr)))
3098#else
3099 else if (in_localaddr(inp->inp_faddr))
3100#endif
3101 tp->snd_cwnd = mss * V_ss_fltsz_local;
3102 else
3103 tp->snd_cwnd = mss * V_ss_fltsz;
3104
3105 /* Check the interface for TSO capabilities. */
3106 if (mtuflags & CSUM_TSO)
3107 tp->t_flags |= TF_TSO;
3108}
3109
3110/*
3111 * Determine the MSS option to send on an outgoing SYN.
3112 */
3113int
3114tcp_mssopt(struct in_conninfo *inc)
3115{
3116 INIT_VNET_INET(curvnet);
3117 int mss = 0;
3118 u_long maxmtu = 0;
3119 u_long thcmtu = 0;
3120 size_t min_protoh;
3121#ifdef INET6
3122 int isipv6 = inc->inc_isipv6 ? 1 : 0;
3123#endif
3124
3125 KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer"));
3126
3127#ifdef INET6
3128 if (isipv6) {
3129 mss = V_tcp_v6mssdflt;
3130 maxmtu = tcp_maxmtu6(inc, NULL);
3131 thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3132 min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
3133 } else
3134#endif
3135 {
3136 mss = V_tcp_mssdflt;
3137 maxmtu = tcp_maxmtu(inc, NULL);
3138 thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3139 min_protoh = sizeof(struct tcpiphdr);
3140 }
3141 if (maxmtu && thcmtu)
3142 mss = min(maxmtu, thcmtu) - min_protoh;
3143 else if (maxmtu || thcmtu)
3144 mss = max(maxmtu, thcmtu) - min_protoh;
3145
3146 return (mss);
3147}
3148
3149
3150/*
3151 * On a partial ack arrives, force the retransmission of the
3152 * next unacknowledged segment. Do not clear tp->t_dupacks.
3153 * By setting snd_nxt to ti_ack, this forces retransmission timer to
3154 * be started again.
3155 */
3156static void
3157tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th)
3158{
3159 tcp_seq onxt = tp->snd_nxt;
3160 u_long ocwnd = tp->snd_cwnd;
3161
3162 INP_WLOCK_ASSERT(tp->t_inpcb);
3163
3164 tcp_timer_activate(tp, TT_REXMT, 0);
3165 tp->t_rtttime = 0;
3166 tp->snd_nxt = th->th_ack;
3167 /*
3168 * Set snd_cwnd to one segment beyond acknowledged offset.
3169 * (tp->snd_una has not yet been updated when this function is called.)
3170 */
3171 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
3172 tp->t_flags |= TF_ACKNOW;
3173 (void) tcp_output(tp);
3174 tp->snd_cwnd = ocwnd;
3175 if (SEQ_GT(onxt, tp->snd_nxt))
3176 tp->snd_nxt = onxt;
3177 /*
3178 * Partial window deflation. Relies on fact that tp->snd_una
3179 * not updated yet.
3180 */
3181 if (tp->snd_cwnd > th->th_ack - tp->snd_una)
3182 tp->snd_cwnd -= th->th_ack - tp->snd_una;
3183 else
3184 tp->snd_cwnd = 0;
3185 tp->snd_cwnd += tp->t_maxseg;
3186}
| 96#ifdef IPSEC
97#include <netipsec/ipsec.h>
98#include <netipsec/ipsec6.h>
99#endif /*IPSEC*/
100
101#include <machine/in_cksum.h>
102
103#include <security/mac/mac_framework.h>
104
105static const int tcprexmtthresh = 3;
106
107#ifdef VIMAGE_GLOBALS
108struct tcpstat tcpstat;
109int blackhole;
110int tcp_delack_enabled;
111int drop_synfin;
112int tcp_do_rfc3042;
113int tcp_do_rfc3390;
114int tcp_do_ecn;
115int tcp_ecn_maxretries;
116int tcp_insecure_rst;
117int tcp_do_autorcvbuf;
118int tcp_autorcvbuf_inc;
119int tcp_autorcvbuf_max;
120#endif
121
122SYSCTL_V_STRUCT(V_NET, vnet_inet, _net_inet_tcp, TCPCTL_STATS, stats,
123 CTLFLAG_RW, tcpstat , tcpstat,
124 "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
125
126int tcp_log_in_vain = 0;
127SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
128 &tcp_log_in_vain, 0, "Log all incoming TCP segments to closed ports");
129
130SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
131 blackhole, 0, "Do not send RST on segments to closed ports");
132
133SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, delayed_ack,
134 CTLFLAG_RW, tcp_delack_enabled, 0,
135 "Delay ACK to try and piggyback it onto a data packet");
136
137SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, drop_synfin,
138 CTLFLAG_RW, drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
139
140SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_RW,
141 tcp_do_rfc3042, 0, "Enable RFC 3042 (Limited Transmit)");
142
143SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
144 tcp_do_rfc3390, 0,
145 "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
146
147SYSCTL_NODE(_net_inet_tcp, OID_AUTO, ecn, CTLFLAG_RW, 0, "TCP ECN");
148SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp_ecn, OID_AUTO, enable,
149 CTLFLAG_RW, tcp_do_ecn, 0, "TCP ECN support");
150SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp_ecn, OID_AUTO, maxretries,
151 CTLFLAG_RW, tcp_ecn_maxretries, 0, "Max retries before giving up on ECN");
152
153SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, insecure_rst,
154 CTLFLAG_RW, tcp_insecure_rst, 0,
155 "Follow the old (insecure) criteria for accepting RST packets");
156
157SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_auto,
158 CTLFLAG_RW, tcp_do_autorcvbuf, 0,
159 "Enable automatic receive buffer sizing");
160
161SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_inc,
162 CTLFLAG_RW, tcp_autorcvbuf_inc, 0,
163 "Incrementor step size of automatic receive buffer");
164
165SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, recvbuf_max,
166 CTLFLAG_RW, tcp_autorcvbuf_max, 0,
167 "Max size of automatic receive buffer");
168
169#ifdef VIMAGE_GLOBALS
170struct inpcbhead tcb;
171struct inpcbinfo tcbinfo;
172#endif
173#define tcb6 tcb /* for KAME src sync over BSD*'s */
174
175static void tcp_dooptions(struct tcpopt *, u_char *, int, int);
176static void tcp_do_segment(struct mbuf *, struct tcphdr *,
177 struct socket *, struct tcpcb *, int, int, uint8_t);
178static void tcp_dropwithreset(struct mbuf *, struct tcphdr *,
179 struct tcpcb *, int, int);
180static void tcp_pulloutofband(struct socket *,
181 struct tcphdr *, struct mbuf *, int);
182static void tcp_xmit_timer(struct tcpcb *, int);
183static void tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *);
184static void inline
185 tcp_congestion_exp(struct tcpcb *);
186
187static void inline
188tcp_congestion_exp(struct tcpcb *tp)
189{
190 u_int win;
191
192 win = min(tp->snd_wnd, tp->snd_cwnd) /
193 2 / tp->t_maxseg;
194 if (win < 2)
195 win = 2;
196 tp->snd_ssthresh = win * tp->t_maxseg;
197 ENTER_FASTRECOVERY(tp);
198 tp->snd_recover = tp->snd_max;
199 if (tp->t_flags & TF_ECN_PERMIT)
200 tp->t_flags |= TF_ECN_SND_CWR;
201}
202
203/* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
204#ifdef INET6
205#define ND6_HINT(tp) \
206do { \
207 if ((tp) && (tp)->t_inpcb && \
208 ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0) \
209 nd6_nud_hint(NULL, NULL, 0); \
210} while (0)
211#else
212#define ND6_HINT(tp)
213#endif
214
215/*
216 * Indicate whether this ack should be delayed. We can delay the ack if
217 * - there is no delayed ack timer in progress and
218 * - our last ack wasn't a 0-sized window. We never want to delay
219 * the ack that opens up a 0-sized window and
220 * - delayed acks are enabled or
221 * - this is a half-synchronized T/TCP connection.
222 */
223#define DELAY_ACK(tp) \
224 ((!tcp_timer_active(tp, TT_DELACK) && \
225 (tp->t_flags & TF_RXWIN0SENT) == 0) && \
226 (V_tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN)))
227
228/*
229 * TCP input handling is split into multiple parts:
230 * tcp6_input is a thin wrapper around tcp_input for the extended
231 * ip6_protox[] call format in ip6_input
232 * tcp_input handles primary segment validation, inpcb lookup and
233 * SYN processing on listen sockets
234 * tcp_do_segment processes the ACK and text of the segment for
235 * establishing, established and closing connections
236 */
237#ifdef INET6
238int
239tcp6_input(struct mbuf **mp, int *offp, int proto)
240{
241 INIT_VNET_INET6(curvnet);
242 struct mbuf *m = *mp;
243 struct in6_ifaddr *ia6;
244
245 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
246
247 /*
248 * draft-itojun-ipv6-tcp-to-anycast
249 * better place to put this in?
250 */
251 ia6 = ip6_getdstifaddr(m);
252 if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
253 struct ip6_hdr *ip6;
254
255 ip6 = mtod(m, struct ip6_hdr *);
256 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
257 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
258 return IPPROTO_DONE;
259 }
260
261 tcp_input(m, *offp);
262 return IPPROTO_DONE;
263}
264#endif
265
266void
267tcp_input(struct mbuf *m, int off0)
268{
269 INIT_VNET_INET(curvnet);
270#ifdef INET6
271 INIT_VNET_INET6(curvnet);
272#endif
273#ifdef IPSEC
274 INIT_VNET_IPSEC(curvnet);
275#endif
276 struct tcphdr *th;
277 struct ip *ip = NULL;
278 struct ipovly *ipov;
279 struct inpcb *inp = NULL;
280 struct tcpcb *tp = NULL;
281 struct socket *so = NULL;
282 u_char *optp = NULL;
283 int optlen = 0;
284 int len, tlen, off;
285 int drop_hdrlen;
286 int thflags;
287 int rstreason = 0; /* For badport_bandlim accounting purposes */
288 uint8_t iptos;
289#ifdef IPFIREWALL_FORWARD
290 struct m_tag *fwd_tag;
291#endif
292#ifdef INET6
293 struct ip6_hdr *ip6 = NULL;
294 int isipv6;
295#else
296 const void *ip6 = NULL;
297 const int isipv6 = 0;
298#endif
299 struct tcpopt to; /* options in this segment */
300 char *s = NULL; /* address and port logging */
301
302#ifdef TCPDEBUG
303 /*
304 * The size of tcp_saveipgen must be the size of the max ip header,
305 * now IPv6.
306 */
307 u_char tcp_saveipgen[IP6_HDR_LEN];
308 struct tcphdr tcp_savetcp;
309 short ostate = 0;
310#endif
311
312#ifdef INET6
313 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
314#endif
315
316 to.to_flags = 0;
317 V_tcpstat.tcps_rcvtotal++;
318
319 if (isipv6) {
320#ifdef INET6
321 /* IP6_EXTHDR_CHECK() is already done at tcp6_input(). */
322 ip6 = mtod(m, struct ip6_hdr *);
323 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
324 if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
325 V_tcpstat.tcps_rcvbadsum++;
326 goto drop;
327 }
328 th = (struct tcphdr *)((caddr_t)ip6 + off0);
329
330 /*
331 * Be proactive about unspecified IPv6 address in source.
332 * As we use all-zero to indicate unbounded/unconnected pcb,
333 * unspecified IPv6 address can be used to confuse us.
334 *
335 * Note that packets with unspecified IPv6 destination is
336 * already dropped in ip6_input.
337 */
338 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
339 /* XXX stat */
340 goto drop;
341 }
342#else
343 th = NULL; /* XXX: Avoid compiler warning. */
344#endif
345 } else {
346 /*
347 * Get IP and TCP header together in first mbuf.
348 * Note: IP leaves IP header in first mbuf.
349 */
350 if (off0 > sizeof (struct ip)) {
351 ip_stripoptions(m, (struct mbuf *)0);
352 off0 = sizeof(struct ip);
353 }
354 if (m->m_len < sizeof (struct tcpiphdr)) {
355 if ((m = m_pullup(m, sizeof (struct tcpiphdr)))
356 == NULL) {
357 V_tcpstat.tcps_rcvshort++;
358 return;
359 }
360 }
361 ip = mtod(m, struct ip *);
362 ipov = (struct ipovly *)ip;
363 th = (struct tcphdr *)((caddr_t)ip + off0);
364 tlen = ip->ip_len;
365
366 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
367 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
368 th->th_sum = m->m_pkthdr.csum_data;
369 else
370 th->th_sum = in_pseudo(ip->ip_src.s_addr,
371 ip->ip_dst.s_addr,
372 htonl(m->m_pkthdr.csum_data +
373 ip->ip_len +
374 IPPROTO_TCP));
375 th->th_sum ^= 0xffff;
376#ifdef TCPDEBUG
377 ipov->ih_len = (u_short)tlen;
378 ipov->ih_len = htons(ipov->ih_len);
379#endif
380 } else {
381 /*
382 * Checksum extended TCP header and data.
383 */
384 len = sizeof (struct ip) + tlen;
385 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
386 ipov->ih_len = (u_short)tlen;
387 ipov->ih_len = htons(ipov->ih_len);
388 th->th_sum = in_cksum(m, len);
389 }
390 if (th->th_sum) {
391 V_tcpstat.tcps_rcvbadsum++;
392 goto drop;
393 }
394 /* Re-initialization for later version check */
395 ip->ip_v = IPVERSION;
396 }
397
398#ifdef INET6
399 if (isipv6)
400 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
401 else
402#endif
403 iptos = ip->ip_tos;
404
405 /*
406 * Check that TCP offset makes sense,
407 * pull out TCP options and adjust length. XXX
408 */
409 off = th->th_off << 2;
410 if (off < sizeof (struct tcphdr) || off > tlen) {
411 V_tcpstat.tcps_rcvbadoff++;
412 goto drop;
413 }
414 tlen -= off; /* tlen is used instead of ti->ti_len */
415 if (off > sizeof (struct tcphdr)) {
416 if (isipv6) {
417#ifdef INET6
418 IP6_EXTHDR_CHECK(m, off0, off, );
419 ip6 = mtod(m, struct ip6_hdr *);
420 th = (struct tcphdr *)((caddr_t)ip6 + off0);
421#endif
422 } else {
423 if (m->m_len < sizeof(struct ip) + off) {
424 if ((m = m_pullup(m, sizeof (struct ip) + off))
425 == NULL) {
426 V_tcpstat.tcps_rcvshort++;
427 return;
428 }
429 ip = mtod(m, struct ip *);
430 ipov = (struct ipovly *)ip;
431 th = (struct tcphdr *)((caddr_t)ip + off0);
432 }
433 }
434 optlen = off - sizeof (struct tcphdr);
435 optp = (u_char *)(th + 1);
436 }
437 thflags = th->th_flags;
438
439 /*
440 * Convert TCP protocol specific fields to host format.
441 */
442 th->th_seq = ntohl(th->th_seq);
443 th->th_ack = ntohl(th->th_ack);
444 th->th_win = ntohs(th->th_win);
445 th->th_urp = ntohs(th->th_urp);
446
447 /*
448 * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options.
449 */
450 drop_hdrlen = off0 + off;
451
452 /*
453 * Locate pcb for segment.
454 */
455 INP_INFO_WLOCK(&V_tcbinfo);
456findpcb:
457 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
458#ifdef IPFIREWALL_FORWARD
459 /*
460 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
461 */
462 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
463
464 if (fwd_tag != NULL && isipv6 == 0) { /* IPv6 support is not yet */
465 struct sockaddr_in *next_hop;
466
467 next_hop = (struct sockaddr_in *)(fwd_tag+1);
468 /*
469 * Transparently forwarded. Pretend to be the destination.
470 * already got one like this?
471 */
472 inp = in_pcblookup_hash(&V_tcbinfo,
473 ip->ip_src, th->th_sport,
474 ip->ip_dst, th->th_dport,
475 0, m->m_pkthdr.rcvif);
476 if (!inp) {
477 /* It's new. Try to find the ambushing socket. */
478 inp = in_pcblookup_hash(&V_tcbinfo,
479 ip->ip_src, th->th_sport,
480 next_hop->sin_addr,
481 next_hop->sin_port ?
482 ntohs(next_hop->sin_port) :
483 th->th_dport,
484 INPLOOKUP_WILDCARD,
485 m->m_pkthdr.rcvif);
486 }
487 /* Remove the tag from the packet. We don't need it anymore. */
488 m_tag_delete(m, fwd_tag);
489 } else
490#endif /* IPFIREWALL_FORWARD */
491 {
492 if (isipv6) {
493#ifdef INET6
494 inp = in6_pcblookup_hash(&V_tcbinfo,
495 &ip6->ip6_src, th->th_sport,
496 &ip6->ip6_dst, th->th_dport,
497 INPLOOKUP_WILDCARD,
498 m->m_pkthdr.rcvif);
499#endif
500 } else
501 inp = in_pcblookup_hash(&V_tcbinfo,
502 ip->ip_src, th->th_sport,
503 ip->ip_dst, th->th_dport,
504 INPLOOKUP_WILDCARD,
505 m->m_pkthdr.rcvif);
506 }
507
508 /*
509 * If the INPCB does not exist then all data in the incoming
510 * segment is discarded and an appropriate RST is sent back.
511 * XXX MRT Send RST using which routing table?
512 */
513 if (inp == NULL) {
514 /*
515 * Log communication attempts to ports that are not
516 * in use.
517 */
518 if ((tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
519 tcp_log_in_vain == 2) {
520 if ((s = tcp_log_addrs(NULL, th, (void *)ip, ip6)))
521 log(LOG_INFO, "%s; %s: Connection attempt "
522 "to closed port\n", s, __func__);
523 }
524 /*
525 * When blackholing do not respond with a RST but
526 * completely ignore the segment and drop it.
527 */
528 if ((V_blackhole == 1 && (thflags & TH_SYN)) ||
529 V_blackhole == 2)
530 goto dropunlock;
531
532 rstreason = BANDLIM_RST_CLOSEDPORT;
533 goto dropwithreset;
534 }
535 INP_WLOCK(inp);
536
537#ifdef IPSEC
538#ifdef INET6
539 if (isipv6 && ipsec6_in_reject(m, inp)) {
540 V_ipsec6stat.in_polvio++;
541 goto dropunlock;
542 } else
543#endif /* INET6 */
544 if (ipsec4_in_reject(m, inp) != 0) {
545 V_ipsec4stat.in_polvio++;
546 goto dropunlock;
547 }
548#endif /* IPSEC */
549
550 /*
551 * Check the minimum TTL for socket.
552 */
553 if (inp->inp_ip_minttl != 0) {
554#ifdef INET6
555 if (isipv6 && inp->inp_ip_minttl > ip6->ip6_hlim)
556 goto dropunlock;
557 else
558#endif
559 if (inp->inp_ip_minttl > ip->ip_ttl)
560 goto dropunlock;
561 }
562
563 /*
564 * A previous connection in TIMEWAIT state is supposed to catch
565 * stray or duplicate segments arriving late. If this segment
566 * was a legitimate new connection attempt the old INPCB gets
567 * removed and we can try again to find a listening socket.
568 */
569 if (inp->inp_vflag & INP_TIMEWAIT) {
570 if (thflags & TH_SYN)
571 tcp_dooptions(&to, optp, optlen, TO_SYN);
572 /*
573 * NB: tcp_twcheck unlocks the INP and frees the mbuf.
574 */
575 if (tcp_twcheck(inp, &to, th, m, tlen))
576 goto findpcb;
577 INP_INFO_WUNLOCK(&V_tcbinfo);
578 return;
579 }
580 /*
581 * The TCPCB may no longer exist if the connection is winding
582 * down or it is in the CLOSED state. Either way we drop the
583 * segment and send an appropriate response.
584 */
585 tp = intotcpcb(inp);
586 if (tp == NULL || tp->t_state == TCPS_CLOSED) {
587 rstreason = BANDLIM_RST_CLOSEDPORT;
588 goto dropwithreset;
589 }
590
591#ifdef MAC
592 INP_WLOCK_ASSERT(inp);
593 if (mac_inpcb_check_deliver(inp, m))
594 goto dropunlock;
595#endif
596 so = inp->inp_socket;
597 KASSERT(so != NULL, ("%s: so == NULL", __func__));
598#ifdef TCPDEBUG
599 if (so->so_options & SO_DEBUG) {
600 ostate = tp->t_state;
601 if (isipv6) {
602#ifdef INET6
603 bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6));
604#endif
605 } else
606 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
607 tcp_savetcp = *th;
608 }
609#endif
610 /*
611 * When the socket is accepting connections (the INPCB is in LISTEN
612 * state) we look into the SYN cache if this is a new connection
613 * attempt or the completion of a previous one.
614 */
615 if (so->so_options & SO_ACCEPTCONN) {
616 struct in_conninfo inc;
617
618 KASSERT(tp->t_state == TCPS_LISTEN, ("%s: so accepting but "
619 "tp not listening", __func__));
620
621 bzero(&inc, sizeof(inc));
622 inc.inc_isipv6 = isipv6;
623#ifdef INET6
624 if (isipv6) {
625 inc.inc6_faddr = ip6->ip6_src;
626 inc.inc6_laddr = ip6->ip6_dst;
627 } else
628#endif
629 {
630 inc.inc_faddr = ip->ip_src;
631 inc.inc_laddr = ip->ip_dst;
632 }
633 inc.inc_fport = th->th_sport;
634 inc.inc_lport = th->th_dport;
635
636 /*
637 * Check for an existing connection attempt in syncache if
638 * the flag is only ACK. A successful lookup creates a new
639 * socket appended to the listen queue in SYN_RECEIVED state.
640 */
641 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
642 /*
643 * Parse the TCP options here because
644 * syncookies need access to the reflected
645 * timestamp.
646 */
647 tcp_dooptions(&to, optp, optlen, 0);
648 /*
649 * NB: syncache_expand() doesn't unlock
650 * inp and tcpinfo locks.
651 */
652 if (!syncache_expand(&inc, &to, th, &so, m)) {
653 /*
654 * No syncache entry or ACK was not
655 * for our SYN/ACK. Send a RST.
656 * NB: syncache did its own logging
657 * of the failure cause.
658 */
659 rstreason = BANDLIM_RST_OPENPORT;
660 goto dropwithreset;
661 }
662 if (so == NULL) {
663 /*
664 * We completed the 3-way handshake
665 * but could not allocate a socket
666 * either due to memory shortage,
667 * listen queue length limits or
668 * global socket limits. Send RST
669 * or wait and have the remote end
670 * retransmit the ACK for another
671 * try.
672 */
673 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
674 log(LOG_DEBUG, "%s; %s: Listen socket: "
675 "Socket allocation failed due to "
676 "limits or memory shortage, %s\n",
677 s, __func__,
678 V_tcp_sc_rst_sock_fail ?
679 "sending RST" : "try again");
680 if (V_tcp_sc_rst_sock_fail) {
681 rstreason = BANDLIM_UNLIMITED;
682 goto dropwithreset;
683 } else
684 goto dropunlock;
685 }
686 /*
687 * Socket is created in state SYN_RECEIVED.
688 * Unlock the listen socket, lock the newly
689 * created socket and update the tp variable.
690 */
691 INP_WUNLOCK(inp); /* listen socket */
692 inp = sotoinpcb(so);
693 INP_WLOCK(inp); /* new connection */
694 tp = intotcpcb(inp);
695 KASSERT(tp->t_state == TCPS_SYN_RECEIVED,
696 ("%s: ", __func__));
697 /*
698 * Process the segment and the data it
699 * contains. tcp_do_segment() consumes
700 * the mbuf chain and unlocks the inpcb.
701 */
702 tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen,
703 iptos);
704 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
705 return;
706 }
707 /*
708 * Segment flag validation for new connection attempts:
709 *
710 * Our (SYN|ACK) response was rejected.
711 * Check with syncache and remove entry to prevent
712 * retransmits.
713 *
714 * NB: syncache_chkrst does its own logging of failure
715 * causes.
716 */
717 if (thflags & TH_RST) {
718 syncache_chkrst(&inc, th);
719 goto dropunlock;
720 }
721 /*
722 * We can't do anything without SYN.
723 */
724 if ((thflags & TH_SYN) == 0) {
725 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
726 log(LOG_DEBUG, "%s; %s: Listen socket: "
727 "SYN is missing, segment ignored\n",
728 s, __func__);
729 V_tcpstat.tcps_badsyn++;
730 goto dropunlock;
731 }
732 /*
733 * (SYN|ACK) is bogus on a listen socket.
734 */
735 if (thflags & TH_ACK) {
736 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
737 log(LOG_DEBUG, "%s; %s: Listen socket: "
738 "SYN|ACK invalid, segment rejected\n",
739 s, __func__);
740 syncache_badack(&inc); /* XXX: Not needed! */
741 V_tcpstat.tcps_badsyn++;
742 rstreason = BANDLIM_RST_OPENPORT;
743 goto dropwithreset;
744 }
745 /*
746 * If the drop_synfin option is enabled, drop all
747 * segments with both the SYN and FIN bits set.
748 * This prevents e.g. nmap from identifying the
749 * TCP/IP stack.
750 * XXX: Poor reasoning. nmap has other methods
751 * and is constantly refining its stack detection
752 * strategies.
753 * XXX: This is a violation of the TCP specification
754 * and was used by RFC1644.
755 */
756 if ((thflags & TH_FIN) && V_drop_synfin) {
757 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
758 log(LOG_DEBUG, "%s; %s: Listen socket: "
759 "SYN|FIN segment ignored (based on "
760 "sysctl setting)\n", s, __func__);
761 V_tcpstat.tcps_badsyn++;
762 goto dropunlock;
763 }
764 /*
765 * Segment's flags are (SYN) or (SYN|FIN).
766 *
767 * TH_PUSH, TH_URG, TH_ECE, TH_CWR are ignored
768 * as they do not affect the state of the TCP FSM.
769 * The data pointed to by TH_URG and th_urp is ignored.
770 */
771 KASSERT((thflags & (TH_RST|TH_ACK)) == 0,
772 ("%s: Listen socket: TH_RST or TH_ACK set", __func__));
773 KASSERT(thflags & (TH_SYN),
774 ("%s: Listen socket: TH_SYN not set", __func__));
775#ifdef INET6
776 /*
777 * If deprecated address is forbidden,
778 * we do not accept SYN to deprecated interface
779 * address to prevent any new inbound connection from
780 * getting established.
781 * When we do not accept SYN, we send a TCP RST,
782 * with deprecated source address (instead of dropping
783 * it). We compromise it as it is much better for peer
784 * to send a RST, and RST will be the final packet
785 * for the exchange.
786 *
787 * If we do not forbid deprecated addresses, we accept
788 * the SYN packet. RFC2462 does not suggest dropping
789 * SYN in this case.
790 * If we decipher RFC2462 5.5.4, it says like this:
791 * 1. use of deprecated addr with existing
792 * communication is okay - "SHOULD continue to be
793 * used"
794 * 2. use of it with new communication:
795 * (2a) "SHOULD NOT be used if alternate address
796 * with sufficient scope is available"
797 * (2b) nothing mentioned otherwise.
798 * Here we fall into (2b) case as we have no choice in
799 * our source address selection - we must obey the peer.
800 *
801 * The wording in RFC2462 is confusing, and there are
802 * multiple description text for deprecated address
803 * handling - worse, they are not exactly the same.
804 * I believe 5.5.4 is the best one, so we follow 5.5.4.
805 */
806 if (isipv6 && !V_ip6_use_deprecated) {
807 struct in6_ifaddr *ia6;
808
809 if ((ia6 = ip6_getdstifaddr(m)) &&
810 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
811 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
812 log(LOG_DEBUG, "%s; %s: Listen socket: "
813 "Connection attempt to deprecated "
814 "IPv6 address rejected\n",
815 s, __func__);
816 rstreason = BANDLIM_RST_OPENPORT;
817 goto dropwithreset;
818 }
819 }
820#endif
821 /*
822 * Basic sanity checks on incoming SYN requests:
823 * Don't respond if the destination is a link layer
824 * broadcast according to RFC1122 4.2.3.10, p. 104.
825 * If it is from this socket it must be forged.
826 * Don't respond if the source or destination is a
827 * global or subnet broad- or multicast address.
828 * Note that it is quite possible to receive unicast
829 * link-layer packets with a broadcast IP address. Use
830 * in_broadcast() to find them.
831 */
832 if (m->m_flags & (M_BCAST|M_MCAST)) {
833 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
834 log(LOG_DEBUG, "%s; %s: Listen socket: "
835 "Connection attempt from broad- or multicast "
836 "link layer address ignored\n", s, __func__);
837 goto dropunlock;
838 }
839 if (isipv6) {
840#ifdef INET6
841 if (th->th_dport == th->th_sport &&
842 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) {
843 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
844 log(LOG_DEBUG, "%s; %s: Listen socket: "
845 "Connection attempt to/from self "
846 "ignored\n", s, __func__);
847 goto dropunlock;
848 }
849 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
850 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
851 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
852 log(LOG_DEBUG, "%s; %s: Listen socket: "
853 "Connection attempt from/to multicast "
854 "address ignored\n", s, __func__);
855 goto dropunlock;
856 }
857#endif
858 } else {
859 if (th->th_dport == th->th_sport &&
860 ip->ip_dst.s_addr == ip->ip_src.s_addr) {
861 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
862 log(LOG_DEBUG, "%s; %s: Listen socket: "
863 "Connection attempt from/to self "
864 "ignored\n", s, __func__);
865 goto dropunlock;
866 }
867 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
868 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
869 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
870 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
871 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
872 log(LOG_DEBUG, "%s; %s: Listen socket: "
873 "Connection attempt from/to broad- "
874 "or multicast address ignored\n",
875 s, __func__);
876 goto dropunlock;
877 }
878 }
879 /*
880 * SYN appears to be valid. Create compressed TCP state
881 * for syncache.
882 */
883#ifdef TCPDEBUG
884 if (so->so_options & SO_DEBUG)
885 tcp_trace(TA_INPUT, ostate, tp,
886 (void *)tcp_saveipgen, &tcp_savetcp, 0);
887#endif
888 tcp_dooptions(&to, optp, optlen, TO_SYN);
889 syncache_add(&inc, &to, th, inp, &so, m);
890 /*
891 * Entry added to syncache and mbuf consumed.
892 * Everything already unlocked by syncache_add().
893 */
894 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
895 return;
896 }
897
898 /*
899 * Segment belongs to a connection in SYN_SENT, ESTABLISHED or later
900 * state. tcp_do_segment() always consumes the mbuf chain, unlocks
901 * the inpcb, and unlocks pcbinfo.
902 */
903 tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos);
904 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
905 return;
906
907dropwithreset:
908 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
909 INP_INFO_WUNLOCK(&V_tcbinfo);
910
911 if (inp != NULL) {
912 tcp_dropwithreset(m, th, tp, tlen, rstreason);
913 INP_WUNLOCK(inp);
914 } else
915 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
916 m = NULL; /* mbuf chain got consumed. */
917 goto drop;
918
919dropunlock:
920 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
921 if (inp != NULL)
922 INP_WUNLOCK(inp);
923 INP_INFO_WUNLOCK(&V_tcbinfo);
924
925drop:
926 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
927 if (s != NULL)
928 free(s, M_TCPLOG);
929 if (m != NULL)
930 m_freem(m);
931}
932
933static void
934tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so,
935 struct tcpcb *tp, int drop_hdrlen, int tlen, uint8_t iptos)
936{
937 INIT_VNET_INET(tp->t_vnet);
938 int thflags, acked, ourfinisacked, needoutput = 0;
939 int headlocked = 1;
940 int rstreason, todrop, win;
941 u_long tiwin;
942 struct tcpopt to;
943
944#ifdef TCPDEBUG
945 /*
946 * The size of tcp_saveipgen must be the size of the max ip header,
947 * now IPv6.
948 */
949 u_char tcp_saveipgen[IP6_HDR_LEN];
950 struct tcphdr tcp_savetcp;
951 short ostate = 0;
952#endif
953 thflags = th->th_flags;
954
955 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
956 INP_WLOCK_ASSERT(tp->t_inpcb);
957 KASSERT(tp->t_state > TCPS_LISTEN, ("%s: TCPS_LISTEN",
958 __func__));
959 KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
960 __func__));
961
962 /*
963 * Segment received on connection.
964 * Reset idle time and keep-alive timer.
965 * XXX: This should be done after segment
966 * validation to ignore broken/spoofed segs.
967 */
968 tp->t_rcvtime = ticks;
969 if (TCPS_HAVEESTABLISHED(tp->t_state))
970 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
971
972 /*
973 * Unscale the window into a 32-bit value.
974 * For the SYN_SENT state the scale is zero.
975 */
976 tiwin = th->th_win << tp->snd_scale;
977
978 /*
979 * TCP ECN processing.
980 */
981 if (tp->t_flags & TF_ECN_PERMIT) {
982 switch (iptos & IPTOS_ECN_MASK) {
983 case IPTOS_ECN_CE:
984 tp->t_flags |= TF_ECN_SND_ECE;
985 V_tcpstat.tcps_ecn_ce++;
986 break;
987 case IPTOS_ECN_ECT0:
988 V_tcpstat.tcps_ecn_ect0++;
989 break;
990 case IPTOS_ECN_ECT1:
991 V_tcpstat.tcps_ecn_ect1++;
992 break;
993 }
994
995 if (thflags & TH_CWR)
996 tp->t_flags &= ~TF_ECN_SND_ECE;
997
998 /*
999 * Congestion experienced.
1000 * Ignore if we are already trying to recover.
1001 */
1002 if ((thflags & TH_ECE) &&
1003 SEQ_LEQ(th->th_ack, tp->snd_recover)) {
1004 V_tcpstat.tcps_ecn_rcwnd++;
1005 tcp_congestion_exp(tp);
1006 }
1007 }
1008
1009 /*
1010 * Parse options on any incoming segment.
1011 */
1012 tcp_dooptions(&to, (u_char *)(th + 1),
1013 (th->th_off << 2) - sizeof(struct tcphdr),
1014 (thflags & TH_SYN) ? TO_SYN : 0);
1015
1016 /*
1017 * If echoed timestamp is later than the current time,
1018 * fall back to non RFC1323 RTT calculation. Normalize
1019 * timestamp if syncookies were used when this connection
1020 * was established.
1021 */
1022 if ((to.to_flags & TOF_TS) && (to.to_tsecr != 0)) {
1023 to.to_tsecr -= tp->ts_offset;
1024 if (TSTMP_GT(to.to_tsecr, ticks))
1025 to.to_tsecr = 0;
1026 }
1027
1028 /*
1029 * Process options only when we get SYN/ACK back. The SYN case
1030 * for incoming connections is handled in tcp_syncache.
1031 * According to RFC1323 the window field in a SYN (i.e., a <SYN>
1032 * or <SYN,ACK>) segment itself is never scaled.
1033 * XXX this is traditional behavior, may need to be cleaned up.
1034 */
1035 if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
1036 if ((to.to_flags & TOF_SCALE) &&
1037 (tp->t_flags & TF_REQ_SCALE)) {
1038 tp->t_flags |= TF_RCVD_SCALE;
1039 tp->snd_scale = to.to_wscale;
1040 }
1041 /*
1042 * Initial send window. It will be updated with
1043 * the next incoming segment to the scaled value.
1044 */
1045 tp->snd_wnd = th->th_win;
1046 if (to.to_flags & TOF_TS) {
1047 tp->t_flags |= TF_RCVD_TSTMP;
1048 tp->ts_recent = to.to_tsval;
1049 tp->ts_recent_age = ticks;
1050 }
1051 if (to.to_flags & TOF_MSS)
1052 tcp_mss(tp, to.to_mss);
1053 if ((tp->t_flags & TF_SACK_PERMIT) &&
1054 (to.to_flags & TOF_SACKPERM) == 0)
1055 tp->t_flags &= ~TF_SACK_PERMIT;
1056 }
1057
1058 /*
1059 * Header prediction: check for the two common cases
1060 * of a uni-directional data xfer. If the packet has
1061 * no control flags, is in-sequence, the window didn't
1062 * change and we're not retransmitting, it's a
1063 * candidate. If the length is zero and the ack moved
1064 * forward, we're the sender side of the xfer. Just
1065 * free the data acked & wake any higher level process
1066 * that was blocked waiting for space. If the length
1067 * is non-zero and the ack didn't move, we're the
1068 * receiver side. If we're getting packets in-order
1069 * (the reassembly queue is empty), add the data to
1070 * the socket buffer and note that we need a delayed ack.
1071 * Make sure that the hidden state-flags are also off.
1072 * Since we check for TCPS_ESTABLISHED first, it can only
1073 * be TH_NEEDSYN.
1074 */
1075 if (tp->t_state == TCPS_ESTABLISHED &&
1076 th->th_seq == tp->rcv_nxt &&
1077 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1078 tp->snd_nxt == tp->snd_max &&
1079 tiwin && tiwin == tp->snd_wnd &&
1080 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1081 LIST_EMPTY(&tp->t_segq) &&
1082 ((to.to_flags & TOF_TS) == 0 ||
1083 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) {
1084
1085 /*
1086 * If last ACK falls within this segment's sequence numbers,
1087 * record the timestamp.
1088 * NOTE that the test is modified according to the latest
1089 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1090 */
1091 if ((to.to_flags & TOF_TS) != 0 &&
1092 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1093 tp->ts_recent_age = ticks;
1094 tp->ts_recent = to.to_tsval;
1095 }
1096
1097 if (tlen == 0) {
1098 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1099 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1100 tp->snd_cwnd >= tp->snd_wnd &&
1101 ((!V_tcp_do_newreno &&
1102 !(tp->t_flags & TF_SACK_PERMIT) &&
1103 tp->t_dupacks < tcprexmtthresh) ||
1104 ((V_tcp_do_newreno ||
1105 (tp->t_flags & TF_SACK_PERMIT)) &&
1106 !IN_FASTRECOVERY(tp) &&
1107 (to.to_flags & TOF_SACK) == 0 &&
1108 TAILQ_EMPTY(&tp->snd_holes)))) {
1109 KASSERT(headlocked,
1110 ("%s: headlocked", __func__));
1111 INP_INFO_WUNLOCK(&V_tcbinfo);
1112 headlocked = 0;
1113 /*
1114 * This is a pure ack for outstanding data.
1115 */
1116 ++V_tcpstat.tcps_predack;
1117 /*
1118 * "bad retransmit" recovery.
1119 */
1120 if (tp->t_rxtshift == 1 &&
1121 ticks < tp->t_badrxtwin) {
1122 ++V_tcpstat.tcps_sndrexmitbad;
1123 tp->snd_cwnd = tp->snd_cwnd_prev;
1124 tp->snd_ssthresh =
1125 tp->snd_ssthresh_prev;
1126 tp->snd_recover = tp->snd_recover_prev;
1127 if (tp->t_flags & TF_WASFRECOVERY)
1128 ENTER_FASTRECOVERY(tp);
1129 tp->snd_nxt = tp->snd_max;
1130 tp->t_badrxtwin = 0;
1131 }
1132
1133 /*
1134 * Recalculate the transmit timer / rtt.
1135 *
1136 * Some boxes send broken timestamp replies
1137 * during the SYN+ACK phase, ignore
1138 * timestamps of 0 or we could calculate a
1139 * huge RTT and blow up the retransmit timer.
1140 */
1141 if ((to.to_flags & TOF_TS) != 0 &&
1142 to.to_tsecr) {
1143 if (!tp->t_rttlow ||
1144 tp->t_rttlow > ticks - to.to_tsecr)
1145 tp->t_rttlow = ticks - to.to_tsecr;
1146 tcp_xmit_timer(tp,
1147 ticks - to.to_tsecr + 1);
1148 } else if (tp->t_rtttime &&
1149 SEQ_GT(th->th_ack, tp->t_rtseq)) {
1150 if (!tp->t_rttlow ||
1151 tp->t_rttlow > ticks - tp->t_rtttime)
1152 tp->t_rttlow = ticks - tp->t_rtttime;
1153 tcp_xmit_timer(tp,
1154 ticks - tp->t_rtttime);
1155 }
1156 tcp_xmit_bandwidth_limit(tp, th->th_ack);
1157 acked = th->th_ack - tp->snd_una;
1158 V_tcpstat.tcps_rcvackpack++;
1159 V_tcpstat.tcps_rcvackbyte += acked;
1160 sbdrop(&so->so_snd, acked);
1161 if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
1162 SEQ_LEQ(th->th_ack, tp->snd_recover))
1163 tp->snd_recover = th->th_ack - 1;
1164 tp->snd_una = th->th_ack;
1165 /*
1166 * Pull snd_wl2 up to prevent seq wrap relative
1167 * to th_ack.
1168 */
1169 tp->snd_wl2 = th->th_ack;
1170 tp->t_dupacks = 0;
1171 m_freem(m);
1172 ND6_HINT(tp); /* Some progress has been made. */
1173
1174 /*
1175 * If all outstanding data are acked, stop
1176 * retransmit timer, otherwise restart timer
1177 * using current (possibly backed-off) value.
1178 * If process is waiting for space,
1179 * wakeup/selwakeup/signal. If data
1180 * are ready to send, let tcp_output
1181 * decide between more output or persist.
1182 */
1183#ifdef TCPDEBUG
1184 if (so->so_options & SO_DEBUG)
1185 tcp_trace(TA_INPUT, ostate, tp,
1186 (void *)tcp_saveipgen,
1187 &tcp_savetcp, 0);
1188#endif
1189 if (tp->snd_una == tp->snd_max)
1190 tcp_timer_activate(tp, TT_REXMT, 0);
1191 else if (!tcp_timer_active(tp, TT_PERSIST))
1192 tcp_timer_activate(tp, TT_REXMT,
1193 tp->t_rxtcur);
1194 sowwakeup(so);
1195 if (so->so_snd.sb_cc)
1196 (void) tcp_output(tp);
1197 goto check_delack;
1198 }
1199 } else if (th->th_ack == tp->snd_una &&
1200 tlen <= sbspace(&so->so_rcv)) {
1201 int newsize = 0; /* automatic sockbuf scaling */
1202
1203 KASSERT(headlocked, ("%s: headlocked", __func__));
1204 INP_INFO_WUNLOCK(&V_tcbinfo);
1205 headlocked = 0;
1206 /*
1207 * This is a pure, in-sequence data packet
1208 * with nothing on the reassembly queue and
1209 * we have enough buffer space to take it.
1210 */
1211 /* Clean receiver SACK report if present */
1212 if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
1213 tcp_clean_sackreport(tp);
1214 ++V_tcpstat.tcps_preddat;
1215 tp->rcv_nxt += tlen;
1216 /*
1217 * Pull snd_wl1 up to prevent seq wrap relative to
1218 * th_seq.
1219 */
1220 tp->snd_wl1 = th->th_seq;
1221 /*
1222 * Pull rcv_up up to prevent seq wrap relative to
1223 * rcv_nxt.
1224 */
1225 tp->rcv_up = tp->rcv_nxt;
1226 V_tcpstat.tcps_rcvpack++;
1227 V_tcpstat.tcps_rcvbyte += tlen;
1228 ND6_HINT(tp); /* Some progress has been made */
1229#ifdef TCPDEBUG
1230 if (so->so_options & SO_DEBUG)
1231 tcp_trace(TA_INPUT, ostate, tp,
1232 (void *)tcp_saveipgen, &tcp_savetcp, 0);
1233#endif
1234 /*
1235 * Automatic sizing of receive socket buffer. Often the send
1236 * buffer size is not optimally adjusted to the actual network
1237 * conditions at hand (delay bandwidth product). Setting the
1238 * buffer size too small limits throughput on links with high
1239 * bandwidth and high delay (eg. trans-continental/oceanic links).
1240 *
1241 * On the receive side the socket buffer memory is only rarely
1242 * used to any significant extent. This allows us to be much
1243 * more aggressive in scaling the receive socket buffer. For
1244 * the case that the buffer space is actually used to a large
1245 * extent and we run out of kernel memory we can simply drop
1246 * the new segments; TCP on the sender will just retransmit it
1247 * later. Setting the buffer size too big may only consume too
1248 * much kernel memory if the application doesn't read() from
1249 * the socket or packet loss or reordering makes use of the
1250 * reassembly queue.
1251 *
1252 * The criteria to step up the receive buffer one notch are:
1253 * 1. the number of bytes received during the time it takes
1254 * one timestamp to be reflected back to us (the RTT);
1255 * 2. received bytes per RTT is within seven eighth of the
1256 * current socket buffer size;
1257 * 3. receive buffer size has not hit maximal automatic size;
1258 *
1259 * This algorithm does one step per RTT at most and only if
1260 * we receive a bulk stream w/o packet losses or reorderings.
1261 * Shrinking the buffer during idle times is not necessary as
1262 * it doesn't consume any memory when idle.
1263 *
1264 * TODO: Only step up if the application is actually serving
1265 * the buffer to better manage the socket buffer resources.
1266 */
1267 if (V_tcp_do_autorcvbuf &&
1268 to.to_tsecr &&
1269 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1270 if (to.to_tsecr > tp->rfbuf_ts &&
1271 to.to_tsecr - tp->rfbuf_ts < hz) {
1272 if (tp->rfbuf_cnt >
1273 (so->so_rcv.sb_hiwat / 8 * 7) &&
1274 so->so_rcv.sb_hiwat <
1275 V_tcp_autorcvbuf_max) {
1276 newsize =
1277 min(so->so_rcv.sb_hiwat +
1278 V_tcp_autorcvbuf_inc,
1279 V_tcp_autorcvbuf_max);
1280 }
1281 /* Start over with next RTT. */
1282 tp->rfbuf_ts = 0;
1283 tp->rfbuf_cnt = 0;
1284 } else
1285 tp->rfbuf_cnt += tlen; /* add up */
1286 }
1287
1288 /* Add data to socket buffer. */
1289 SOCKBUF_LOCK(&so->so_rcv);
1290 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1291 m_freem(m);
1292 } else {
1293 /*
1294 * Set new socket buffer size.
1295 * Give up when limit is reached.
1296 */
1297 if (newsize)
1298 if (!sbreserve_locked(&so->so_rcv,
1299 newsize, so, NULL))
1300 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1301 m_adj(m, drop_hdrlen); /* delayed header drop */
1302 sbappendstream_locked(&so->so_rcv, m);
1303 }
1304 /* NB: sorwakeup_locked() does an implicit unlock. */
1305 sorwakeup_locked(so);
1306 if (DELAY_ACK(tp)) {
1307 tp->t_flags |= TF_DELACK;
1308 } else {
1309 tp->t_flags |= TF_ACKNOW;
1310 tcp_output(tp);
1311 }
1312 goto check_delack;
1313 }
1314 }
1315
1316 /*
1317 * Calculate amount of space in receive window,
1318 * and then do TCP input processing.
1319 * Receive window is amount of space in rcv queue,
1320 * but not less than advertised window.
1321 */
1322 win = sbspace(&so->so_rcv);
1323 if (win < 0)
1324 win = 0;
1325 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1326
1327 /* Reset receive buffer auto scaling when not in bulk receive mode. */
1328 tp->rfbuf_ts = 0;
1329 tp->rfbuf_cnt = 0;
1330
1331 switch (tp->t_state) {
1332
1333 /*
1334 * If the state is SYN_RECEIVED:
1335 * if seg contains an ACK, but not for our SYN/ACK, send a RST.
1336 */
1337 case TCPS_SYN_RECEIVED:
1338 if ((thflags & TH_ACK) &&
1339 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1340 SEQ_GT(th->th_ack, tp->snd_max))) {
1341 rstreason = BANDLIM_RST_OPENPORT;
1342 goto dropwithreset;
1343 }
1344 break;
1345
1346 /*
1347 * If the state is SYN_SENT:
1348 * if seg contains an ACK, but not for our SYN, drop the input.
1349 * if seg contains a RST, then drop the connection.
1350 * if seg does not contain SYN, then drop it.
1351 * Otherwise this is an acceptable SYN segment
1352 * initialize tp->rcv_nxt and tp->irs
1353 * if seg contains ack then advance tp->snd_una
1354 * if seg contains an ECE and ECN support is enabled, the stream
1355 * is ECN capable.
1356 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1357 * arrange for segment to be acked (eventually)
1358 * continue processing rest of data/controls, beginning with URG
1359 */
1360 case TCPS_SYN_SENT:
1361 if ((thflags & TH_ACK) &&
1362 (SEQ_LEQ(th->th_ack, tp->iss) ||
1363 SEQ_GT(th->th_ack, tp->snd_max))) {
1364 rstreason = BANDLIM_UNLIMITED;
1365 goto dropwithreset;
1366 }
1367 if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST))
1368 tp = tcp_drop(tp, ECONNREFUSED);
1369 if (thflags & TH_RST)
1370 goto drop;
1371 if (!(thflags & TH_SYN))
1372 goto drop;
1373
1374 tp->irs = th->th_seq;
1375 tcp_rcvseqinit(tp);
1376 if (thflags & TH_ACK) {
1377 V_tcpstat.tcps_connects++;
1378 soisconnected(so);
1379#ifdef MAC
1380 SOCK_LOCK(so);
1381 mac_socketpeer_set_from_mbuf(m, so);
1382 SOCK_UNLOCK(so);
1383#endif
1384 /* Do window scaling on this connection? */
1385 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1386 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1387 tp->rcv_scale = tp->request_r_scale;
1388 }
1389 tp->rcv_adv += tp->rcv_wnd;
1390 tp->snd_una++; /* SYN is acked */
1391 /*
1392 * If there's data, delay ACK; if there's also a FIN
1393 * ACKNOW will be turned on later.
1394 */
1395 if (DELAY_ACK(tp) && tlen != 0)
1396 tcp_timer_activate(tp, TT_DELACK,
1397 tcp_delacktime);
1398 else
1399 tp->t_flags |= TF_ACKNOW;
1400
1401 if ((thflags & TH_ECE) && V_tcp_do_ecn) {
1402 tp->t_flags |= TF_ECN_PERMIT;
1403 V_tcpstat.tcps_ecn_shs++;
1404 }
1405
1406 /*
1407 * Received <SYN,ACK> in SYN_SENT[*] state.
1408 * Transitions:
1409 * SYN_SENT --> ESTABLISHED
1410 * SYN_SENT* --> FIN_WAIT_1
1411 */
1412 tp->t_starttime = ticks;
1413 if (tp->t_flags & TF_NEEDFIN) {
1414 tp->t_state = TCPS_FIN_WAIT_1;
1415 tp->t_flags &= ~TF_NEEDFIN;
1416 thflags &= ~TH_SYN;
1417 } else {
1418 tp->t_state = TCPS_ESTABLISHED;
1419 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
1420 }
1421 } else {
1422 /*
1423 * Received initial SYN in SYN-SENT[*] state =>
1424 * simultaneous open. If segment contains CC option
1425 * and there is a cached CC, apply TAO test.
1426 * If it succeeds, connection is * half-synchronized.
1427 * Otherwise, do 3-way handshake:
1428 * SYN-SENT -> SYN-RECEIVED
1429 * SYN-SENT* -> SYN-RECEIVED*
1430 * If there was no CC option, clear cached CC value.
1431 */
1432 tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
1433 tcp_timer_activate(tp, TT_REXMT, 0);
1434 tp->t_state = TCPS_SYN_RECEIVED;
1435 }
1436
1437 KASSERT(headlocked, ("%s: trimthenstep6: head not locked",
1438 __func__));
1439 INP_WLOCK_ASSERT(tp->t_inpcb);
1440
1441 /*
1442 * Advance th->th_seq to correspond to first data byte.
1443 * If data, trim to stay within window,
1444 * dropping FIN if necessary.
1445 */
1446 th->th_seq++;
1447 if (tlen > tp->rcv_wnd) {
1448 todrop = tlen - tp->rcv_wnd;
1449 m_adj(m, -todrop);
1450 tlen = tp->rcv_wnd;
1451 thflags &= ~TH_FIN;
1452 V_tcpstat.tcps_rcvpackafterwin++;
1453 V_tcpstat.tcps_rcvbyteafterwin += todrop;
1454 }
1455 tp->snd_wl1 = th->th_seq - 1;
1456 tp->rcv_up = th->th_seq;
1457 /*
1458 * Client side of transaction: already sent SYN and data.
1459 * If the remote host used T/TCP to validate the SYN,
1460 * our data will be ACK'd; if so, enter normal data segment
1461 * processing in the middle of step 5, ack processing.
1462 * Otherwise, goto step 6.
1463 */
1464 if (thflags & TH_ACK)
1465 goto process_ACK;
1466
1467 goto step6;
1468
1469 /*
1470 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1471 * do normal processing.
1472 *
1473 * NB: Leftover from RFC1644 T/TCP. Cases to be reused later.
1474 */
1475 case TCPS_LAST_ACK:
1476 case TCPS_CLOSING:
1477 break; /* continue normal processing */
1478 }
1479
1480 /*
1481 * States other than LISTEN or SYN_SENT.
1482 * First check the RST flag and sequence number since reset segments
1483 * are exempt from the timestamp and connection count tests. This
1484 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1485 * below which allowed reset segments in half the sequence space
1486 * to fall though and be processed (which gives forged reset
1487 * segments with a random sequence number a 50 percent chance of
1488 * killing a connection).
1489 * Then check timestamp, if present.
1490 * Then check the connection count, if present.
1491 * Then check that at least some bytes of segment are within
1492 * receive window. If segment begins before rcv_nxt,
1493 * drop leading data (and SYN); if nothing left, just ack.
1494 *
1495 *
1496 * If the RST bit is set, check the sequence number to see
1497 * if this is a valid reset segment.
1498 * RFC 793 page 37:
1499 * In all states except SYN-SENT, all reset (RST) segments
1500 * are validated by checking their SEQ-fields. A reset is
1501 * valid if its sequence number is in the window.
1502 * Note: this does not take into account delayed ACKs, so
1503 * we should test against last_ack_sent instead of rcv_nxt.
1504 * The sequence number in the reset segment is normally an
1505 * echo of our outgoing acknowlegement numbers, but some hosts
1506 * send a reset with the sequence number at the rightmost edge
1507 * of our receive window, and we have to handle this case.
1508 * Note 2: Paul Watson's paper "Slipping in the Window" has shown
1509 * that brute force RST attacks are possible. To combat this,
1510 * we use a much stricter check while in the ESTABLISHED state,
1511 * only accepting RSTs where the sequence number is equal to
1512 * last_ack_sent. In all other states (the states in which a
1513 * RST is more likely), the more permissive check is used.
1514 * If we have multiple segments in flight, the initial reset
1515 * segment sequence numbers will be to the left of last_ack_sent,
1516 * but they will eventually catch up.
1517 * In any case, it never made sense to trim reset segments to
1518 * fit the receive window since RFC 1122 says:
1519 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
1520 *
1521 * A TCP SHOULD allow a received RST segment to include data.
1522 *
1523 * DISCUSSION
1524 * It has been suggested that a RST segment could contain
1525 * ASCII text that encoded and explained the cause of the
1526 * RST. No standard has yet been established for such
1527 * data.
1528 *
1529 * If the reset segment passes the sequence number test examine
1530 * the state:
1531 * SYN_RECEIVED STATE:
1532 * If passive open, return to LISTEN state.
1533 * If active open, inform user that connection was refused.
1534 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
1535 * Inform user that connection was reset, and close tcb.
1536 * CLOSING, LAST_ACK STATES:
1537 * Close the tcb.
1538 * TIME_WAIT STATE:
1539 * Drop the segment - see Stevens, vol. 2, p. 964 and
1540 * RFC 1337.
1541 */
1542 if (thflags & TH_RST) {
1543 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
1544 SEQ_LEQ(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
1545 switch (tp->t_state) {
1546
1547 case TCPS_SYN_RECEIVED:
1548 so->so_error = ECONNREFUSED;
1549 goto close;
1550
1551 case TCPS_ESTABLISHED:
1552 if (V_tcp_insecure_rst == 0 &&
1553 !(SEQ_GEQ(th->th_seq, tp->rcv_nxt - 1) &&
1554 SEQ_LEQ(th->th_seq, tp->rcv_nxt + 1)) &&
1555 !(SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
1556 SEQ_LEQ(th->th_seq, tp->last_ack_sent + 1))) {
1557 V_tcpstat.tcps_badrst++;
1558 goto drop;
1559 }
1560 /* FALLTHROUGH */
1561 case TCPS_FIN_WAIT_1:
1562 case TCPS_FIN_WAIT_2:
1563 case TCPS_CLOSE_WAIT:
1564 so->so_error = ECONNRESET;
1565 close:
1566 tp->t_state = TCPS_CLOSED;
1567 V_tcpstat.tcps_drops++;
1568 KASSERT(headlocked, ("%s: trimthenstep6: "
1569 "tcp_close: head not locked", __func__));
1570 tp = tcp_close(tp);
1571 break;
1572
1573 case TCPS_CLOSING:
1574 case TCPS_LAST_ACK:
1575 KASSERT(headlocked, ("%s: trimthenstep6: "
1576 "tcp_close.2: head not locked", __func__));
1577 tp = tcp_close(tp);
1578 break;
1579 }
1580 }
1581 goto drop;
1582 }
1583
1584 /*
1585 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1586 * and it's less than ts_recent, drop it.
1587 */
1588 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
1589 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1590
1591 /* Check to see if ts_recent is over 24 days old. */
1592 if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1593 /*
1594 * Invalidate ts_recent. If this segment updates
1595 * ts_recent, the age will be reset later and ts_recent
1596 * will get a valid value. If it does not, setting
1597 * ts_recent to zero will at least satisfy the
1598 * requirement that zero be placed in the timestamp
1599 * echo reply when ts_recent isn't valid. The
1600 * age isn't reset until we get a valid ts_recent
1601 * because we don't want out-of-order segments to be
1602 * dropped when ts_recent is old.
1603 */
1604 tp->ts_recent = 0;
1605 } else {
1606 V_tcpstat.tcps_rcvduppack++;
1607 V_tcpstat.tcps_rcvdupbyte += tlen;
1608 V_tcpstat.tcps_pawsdrop++;
1609 if (tlen)
1610 goto dropafterack;
1611 goto drop;
1612 }
1613 }
1614
1615 /*
1616 * In the SYN-RECEIVED state, validate that the packet belongs to
1617 * this connection before trimming the data to fit the receive
1618 * window. Check the sequence number versus IRS since we know
1619 * the sequence numbers haven't wrapped. This is a partial fix
1620 * for the "LAND" DoS attack.
1621 */
1622 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1623 rstreason = BANDLIM_RST_OPENPORT;
1624 goto dropwithreset;
1625 }
1626
1627 todrop = tp->rcv_nxt - th->th_seq;
1628 if (todrop > 0) {
1629 if (thflags & TH_SYN) {
1630 thflags &= ~TH_SYN;
1631 th->th_seq++;
1632 if (th->th_urp > 1)
1633 th->th_urp--;
1634 else
1635 thflags &= ~TH_URG;
1636 todrop--;
1637 }
1638 /*
1639 * Following if statement from Stevens, vol. 2, p. 960.
1640 */
1641 if (todrop > tlen
1642 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1643 /*
1644 * Any valid FIN must be to the left of the window.
1645 * At this point the FIN must be a duplicate or out
1646 * of sequence; drop it.
1647 */
1648 thflags &= ~TH_FIN;
1649
1650 /*
1651 * Send an ACK to resynchronize and drop any data.
1652 * But keep on processing for RST or ACK.
1653 */
1654 tp->t_flags |= TF_ACKNOW;
1655 todrop = tlen;
1656 V_tcpstat.tcps_rcvduppack++;
1657 V_tcpstat.tcps_rcvdupbyte += todrop;
1658 } else {
1659 V_tcpstat.tcps_rcvpartduppack++;
1660 V_tcpstat.tcps_rcvpartdupbyte += todrop;
1661 }
1662 drop_hdrlen += todrop; /* drop from the top afterwards */
1663 th->th_seq += todrop;
1664 tlen -= todrop;
1665 if (th->th_urp > todrop)
1666 th->th_urp -= todrop;
1667 else {
1668 thflags &= ~TH_URG;
1669 th->th_urp = 0;
1670 }
1671 }
1672
1673 /*
1674 * If new data are received on a connection after the
1675 * user processes are gone, then RST the other end.
1676 */
1677 if ((so->so_state & SS_NOFDREF) &&
1678 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1679 char *s;
1680
1681 KASSERT(headlocked, ("%s: trimthenstep6: tcp_close.3: head "
1682 "not locked", __func__));
1683 if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
1684 log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data after socket "
1685 "was closed, sending RST and removing tcpcb\n",
1686 s, __func__, tcpstates[tp->t_state], tlen);
1687 free(s, M_TCPLOG);
1688 }
1689 tp = tcp_close(tp);
1690 V_tcpstat.tcps_rcvafterclose++;
1691 rstreason = BANDLIM_UNLIMITED;
1692 goto dropwithreset;
1693 }
1694
1695 /*
1696 * If segment ends after window, drop trailing data
1697 * (and PUSH and FIN); if nothing left, just ACK.
1698 */
1699 todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
1700 if (todrop > 0) {
1701 V_tcpstat.tcps_rcvpackafterwin++;
1702 if (todrop >= tlen) {
1703 V_tcpstat.tcps_rcvbyteafterwin += tlen;
1704 /*
1705 * If window is closed can only take segments at
1706 * window edge, and have to drop data and PUSH from
1707 * incoming segments. Continue processing, but
1708 * remember to ack. Otherwise, drop segment
1709 * and ack.
1710 */
1711 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1712 tp->t_flags |= TF_ACKNOW;
1713 V_tcpstat.tcps_rcvwinprobe++;
1714 } else
1715 goto dropafterack;
1716 } else
1717 V_tcpstat.tcps_rcvbyteafterwin += todrop;
1718 m_adj(m, -todrop);
1719 tlen -= todrop;
1720 thflags &= ~(TH_PUSH|TH_FIN);
1721 }
1722
1723 /*
1724 * If last ACK falls within this segment's sequence numbers,
1725 * record its timestamp.
1726 * NOTE:
1727 * 1) That the test incorporates suggestions from the latest
1728 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1729 * 2) That updating only on newer timestamps interferes with
1730 * our earlier PAWS tests, so this check should be solely
1731 * predicated on the sequence space of this segment.
1732 * 3) That we modify the segment boundary check to be
1733 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
1734 * instead of RFC1323's
1735 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
1736 * This modified check allows us to overcome RFC1323's
1737 * limitations as described in Stevens TCP/IP Illustrated
1738 * Vol. 2 p.869. In such cases, we can still calculate the
1739 * RTT correctly when RCV.NXT == Last.ACK.Sent.
1740 */
1741 if ((to.to_flags & TOF_TS) != 0 &&
1742 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1743 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
1744 ((thflags & (TH_SYN|TH_FIN)) != 0))) {
1745 tp->ts_recent_age = ticks;
1746 tp->ts_recent = to.to_tsval;
1747 }
1748
1749 /*
1750 * If a SYN is in the window, then this is an
1751 * error and we send an RST and drop the connection.
1752 */
1753 if (thflags & TH_SYN) {
1754 KASSERT(headlocked, ("%s: tcp_drop: trimthenstep6: "
1755 "head not locked", __func__));
1756 tp = tcp_drop(tp, ECONNRESET);
1757 rstreason = BANDLIM_UNLIMITED;
1758 goto drop;
1759 }
1760
1761 /*
1762 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
1763 * flag is on (half-synchronized state), then queue data for
1764 * later processing; else drop segment and return.
1765 */
1766 if ((thflags & TH_ACK) == 0) {
1767 if (tp->t_state == TCPS_SYN_RECEIVED ||
1768 (tp->t_flags & TF_NEEDSYN))
1769 goto step6;
1770 else if (tp->t_flags & TF_ACKNOW)
1771 goto dropafterack;
1772 else
1773 goto drop;
1774 }
1775
1776 /*
1777 * Ack processing.
1778 */
1779 switch (tp->t_state) {
1780
1781 /*
1782 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1783 * ESTABLISHED state and continue processing.
1784 * The ACK was checked above.
1785 */
1786 case TCPS_SYN_RECEIVED:
1787
1788 V_tcpstat.tcps_connects++;
1789 soisconnected(so);
1790 /* Do window scaling? */
1791 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1792 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1793 tp->rcv_scale = tp->request_r_scale;
1794 tp->snd_wnd = tiwin;
1795 }
1796 /*
1797 * Make transitions:
1798 * SYN-RECEIVED -> ESTABLISHED
1799 * SYN-RECEIVED* -> FIN-WAIT-1
1800 */
1801 tp->t_starttime = ticks;
1802 if (tp->t_flags & TF_NEEDFIN) {
1803 tp->t_state = TCPS_FIN_WAIT_1;
1804 tp->t_flags &= ~TF_NEEDFIN;
1805 } else {
1806 tp->t_state = TCPS_ESTABLISHED;
1807 tcp_timer_activate(tp, TT_KEEP, tcp_keepidle);
1808 }
1809 /*
1810 * If segment contains data or ACK, will call tcp_reass()
1811 * later; if not, do so now to pass queued data to user.
1812 */
1813 if (tlen == 0 && (thflags & TH_FIN) == 0)
1814 (void) tcp_reass(tp, (struct tcphdr *)0, 0,
1815 (struct mbuf *)0);
1816 tp->snd_wl1 = th->th_seq - 1;
1817 /* FALLTHROUGH */
1818
1819 /*
1820 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1821 * ACKs. If the ack is in the range
1822 * tp->snd_una < th->th_ack <= tp->snd_max
1823 * then advance tp->snd_una to th->th_ack and drop
1824 * data from the retransmission queue. If this ACK reflects
1825 * more up to date window information we update our window information.
1826 */
1827 case TCPS_ESTABLISHED:
1828 case TCPS_FIN_WAIT_1:
1829 case TCPS_FIN_WAIT_2:
1830 case TCPS_CLOSE_WAIT:
1831 case TCPS_CLOSING:
1832 case TCPS_LAST_ACK:
1833 if (SEQ_GT(th->th_ack, tp->snd_max)) {
1834 V_tcpstat.tcps_rcvacktoomuch++;
1835 goto dropafterack;
1836 }
1837 if ((tp->t_flags & TF_SACK_PERMIT) &&
1838 ((to.to_flags & TOF_SACK) ||
1839 !TAILQ_EMPTY(&tp->snd_holes)))
1840 tcp_sack_doack(tp, &to, th->th_ack);
1841 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1842 if (tlen == 0 && tiwin == tp->snd_wnd) {
1843 V_tcpstat.tcps_rcvdupack++;
1844 /*
1845 * If we have outstanding data (other than
1846 * a window probe), this is a completely
1847 * duplicate ack (ie, window info didn't
1848 * change), the ack is the biggest we've
1849 * seen and we've seen exactly our rexmt
1850 * threshhold of them, assume a packet
1851 * has been dropped and retransmit it.
1852 * Kludge snd_nxt & the congestion
1853 * window so we send only this one
1854 * packet.
1855 *
1856 * We know we're losing at the current
1857 * window size so do congestion avoidance
1858 * (set ssthresh to half the current window
1859 * and pull our congestion window back to
1860 * the new ssthresh).
1861 *
1862 * Dup acks mean that packets have left the
1863 * network (they're now cached at the receiver)
1864 * so bump cwnd by the amount in the receiver
1865 * to keep a constant cwnd packets in the
1866 * network.
1867 *
1868 * When using TCP ECN, notify the peer that
1869 * we reduced the cwnd.
1870 */
1871 if (!tcp_timer_active(tp, TT_REXMT) ||
1872 th->th_ack != tp->snd_una)
1873 tp->t_dupacks = 0;
1874 else if (++tp->t_dupacks > tcprexmtthresh ||
1875 ((V_tcp_do_newreno ||
1876 (tp->t_flags & TF_SACK_PERMIT)) &&
1877 IN_FASTRECOVERY(tp))) {
1878 if ((tp->t_flags & TF_SACK_PERMIT) &&
1879 IN_FASTRECOVERY(tp)) {
1880 int awnd;
1881
1882 /*
1883 * Compute the amount of data in flight first.
1884 * We can inject new data into the pipe iff
1885 * we have less than 1/2 the original window's
1886 * worth of data in flight.
1887 */
1888 awnd = (tp->snd_nxt - tp->snd_fack) +
1889 tp->sackhint.sack_bytes_rexmit;
1890 if (awnd < tp->snd_ssthresh) {
1891 tp->snd_cwnd += tp->t_maxseg;
1892 if (tp->snd_cwnd > tp->snd_ssthresh)
1893 tp->snd_cwnd = tp->snd_ssthresh;
1894 }
1895 } else
1896 tp->snd_cwnd += tp->t_maxseg;
1897 (void) tcp_output(tp);
1898 goto drop;
1899 } else if (tp->t_dupacks == tcprexmtthresh) {
1900 tcp_seq onxt = tp->snd_nxt;
1901
1902 /*
1903 * If we're doing sack, check to
1904 * see if we're already in sack
1905 * recovery. If we're not doing sack,
1906 * check to see if we're in newreno
1907 * recovery.
1908 */
1909 if (tp->t_flags & TF_SACK_PERMIT) {
1910 if (IN_FASTRECOVERY(tp)) {
1911 tp->t_dupacks = 0;
1912 break;
1913 }
1914 } else if (V_tcp_do_newreno ||
1915 V_tcp_do_ecn) {
1916 if (SEQ_LEQ(th->th_ack,
1917 tp->snd_recover)) {
1918 tp->t_dupacks = 0;
1919 break;
1920 }
1921 }
1922 tcp_congestion_exp(tp);
1923 tcp_timer_activate(tp, TT_REXMT, 0);
1924 tp->t_rtttime = 0;
1925 if (tp->t_flags & TF_SACK_PERMIT) {
1926 V_tcpstat.tcps_sack_recovery_episode++;
1927 tp->sack_newdata = tp->snd_nxt;
1928 tp->snd_cwnd = tp->t_maxseg;
1929 (void) tcp_output(tp);
1930 goto drop;
1931 }
1932 tp->snd_nxt = th->th_ack;
1933 tp->snd_cwnd = tp->t_maxseg;
1934 (void) tcp_output(tp);
1935 KASSERT(tp->snd_limited <= 2,
1936 ("%s: tp->snd_limited too big",
1937 __func__));
1938 tp->snd_cwnd = tp->snd_ssthresh +
1939 tp->t_maxseg *
1940 (tp->t_dupacks - tp->snd_limited);
1941 if (SEQ_GT(onxt, tp->snd_nxt))
1942 tp->snd_nxt = onxt;
1943 goto drop;
1944 } else if (V_tcp_do_rfc3042) {
1945 u_long oldcwnd = tp->snd_cwnd;
1946 tcp_seq oldsndmax = tp->snd_max;
1947 u_int sent;
1948
1949 KASSERT(tp->t_dupacks == 1 ||
1950 tp->t_dupacks == 2,
1951 ("%s: dupacks not 1 or 2",
1952 __func__));
1953 if (tp->t_dupacks == 1)
1954 tp->snd_limited = 0;
1955 tp->snd_cwnd =
1956 (tp->snd_nxt - tp->snd_una) +
1957 (tp->t_dupacks - tp->snd_limited) *
1958 tp->t_maxseg;
1959 (void) tcp_output(tp);
1960 sent = tp->snd_max - oldsndmax;
1961 if (sent > tp->t_maxseg) {
1962 KASSERT((tp->t_dupacks == 2 &&
1963 tp->snd_limited == 0) ||
1964 (sent == tp->t_maxseg + 1 &&
1965 tp->t_flags & TF_SENTFIN),
1966 ("%s: sent too much",
1967 __func__));
1968 tp->snd_limited = 2;
1969 } else if (sent > 0)
1970 ++tp->snd_limited;
1971 tp->snd_cwnd = oldcwnd;
1972 goto drop;
1973 }
1974 } else
1975 tp->t_dupacks = 0;
1976 break;
1977 }
1978
1979 KASSERT(SEQ_GT(th->th_ack, tp->snd_una),
1980 ("%s: th_ack <= snd_una", __func__));
1981
1982 /*
1983 * If the congestion window was inflated to account
1984 * for the other side's cached packets, retract it.
1985 */
1986 if (V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) {
1987 if (IN_FASTRECOVERY(tp)) {
1988 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
1989 if (tp->t_flags & TF_SACK_PERMIT)
1990 tcp_sack_partialack(tp, th);
1991 else
1992 tcp_newreno_partial_ack(tp, th);
1993 } else {
1994 /*
1995 * Out of fast recovery.
1996 * Window inflation should have left us
1997 * with approximately snd_ssthresh
1998 * outstanding data.
1999 * But in case we would be inclined to
2000 * send a burst, better to do it via
2001 * the slow start mechanism.
2002 */
2003 if (SEQ_GT(th->th_ack +
2004 tp->snd_ssthresh,
2005 tp->snd_max))
2006 tp->snd_cwnd = tp->snd_max -
2007 th->th_ack +
2008 tp->t_maxseg;
2009 else
2010 tp->snd_cwnd = tp->snd_ssthresh;
2011 }
2012 }
2013 } else {
2014 if (tp->t_dupacks >= tcprexmtthresh &&
2015 tp->snd_cwnd > tp->snd_ssthresh)
2016 tp->snd_cwnd = tp->snd_ssthresh;
2017 }
2018 tp->t_dupacks = 0;
2019 /*
2020 * If we reach this point, ACK is not a duplicate,
2021 * i.e., it ACKs something we sent.
2022 */
2023 if (tp->t_flags & TF_NEEDSYN) {
2024 /*
2025 * T/TCP: Connection was half-synchronized, and our
2026 * SYN has been ACK'd (so connection is now fully
2027 * synchronized). Go to non-starred state,
2028 * increment snd_una for ACK of SYN, and check if
2029 * we can do window scaling.
2030 */
2031 tp->t_flags &= ~TF_NEEDSYN;
2032 tp->snd_una++;
2033 /* Do window scaling? */
2034 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2035 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2036 tp->rcv_scale = tp->request_r_scale;
2037 /* Send window already scaled. */
2038 }
2039 }
2040
2041process_ACK:
2042 KASSERT(headlocked, ("%s: process_ACK: head not locked",
2043 __func__));
2044 INP_WLOCK_ASSERT(tp->t_inpcb);
2045
2046 acked = th->th_ack - tp->snd_una;
2047 V_tcpstat.tcps_rcvackpack++;
2048 V_tcpstat.tcps_rcvackbyte += acked;
2049
2050 /*
2051 * If we just performed our first retransmit, and the ACK
2052 * arrives within our recovery window, then it was a mistake
2053 * to do the retransmit in the first place. Recover our
2054 * original cwnd and ssthresh, and proceed to transmit where
2055 * we left off.
2056 */
2057 if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) {
2058 ++V_tcpstat.tcps_sndrexmitbad;
2059 tp->snd_cwnd = tp->snd_cwnd_prev;
2060 tp->snd_ssthresh = tp->snd_ssthresh_prev;
2061 tp->snd_recover = tp->snd_recover_prev;
2062 if (tp->t_flags & TF_WASFRECOVERY)
2063 ENTER_FASTRECOVERY(tp);
2064 tp->snd_nxt = tp->snd_max;
2065 tp->t_badrxtwin = 0; /* XXX probably not required */
2066 }
2067
2068 /*
2069 * If we have a timestamp reply, update smoothed
2070 * round trip time. If no timestamp is present but
2071 * transmit timer is running and timed sequence
2072 * number was acked, update smoothed round trip time.
2073 * Since we now have an rtt measurement, cancel the
2074 * timer backoff (cf., Phil Karn's retransmit alg.).
2075 * Recompute the initial retransmit timer.
2076 *
2077 * Some boxes send broken timestamp replies
2078 * during the SYN+ACK phase, ignore
2079 * timestamps of 0 or we could calculate a
2080 * huge RTT and blow up the retransmit timer.
2081 */
2082 if ((to.to_flags & TOF_TS) != 0 &&
2083 to.to_tsecr) {
2084 if (!tp->t_rttlow || tp->t_rttlow > ticks - to.to_tsecr)
2085 tp->t_rttlow = ticks - to.to_tsecr;
2086 tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
2087 } else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) {
2088 if (!tp->t_rttlow || tp->t_rttlow > ticks - tp->t_rtttime)
2089 tp->t_rttlow = ticks - tp->t_rtttime;
2090 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
2091 }
2092 tcp_xmit_bandwidth_limit(tp, th->th_ack);
2093
2094 /*
2095 * If all outstanding data is acked, stop retransmit
2096 * timer and remember to restart (more output or persist).
2097 * If there is more data to be acked, restart retransmit
2098 * timer, using current (possibly backed-off) value.
2099 */
2100 if (th->th_ack == tp->snd_max) {
2101 tcp_timer_activate(tp, TT_REXMT, 0);
2102 needoutput = 1;
2103 } else if (!tcp_timer_active(tp, TT_PERSIST))
2104 tcp_timer_activate(tp, TT_REXMT, tp->t_rxtcur);
2105
2106 /*
2107 * If no data (only SYN) was ACK'd,
2108 * skip rest of ACK processing.
2109 */
2110 if (acked == 0)
2111 goto step6;
2112
2113 /*
2114 * When new data is acked, open the congestion window.
2115 * If the window gives us less than ssthresh packets
2116 * in flight, open exponentially (maxseg per packet).
2117 * Otherwise open linearly: maxseg per window
2118 * (maxseg^2 / cwnd per packet).
2119 * If cwnd > maxseg^2, fix the cwnd increment at 1 byte
2120 * to avoid capping cwnd (as suggested in RFC2581).
2121 */
2122 if ((!V_tcp_do_newreno && !(tp->t_flags & TF_SACK_PERMIT)) ||
2123 !IN_FASTRECOVERY(tp)) {
2124 u_int cw = tp->snd_cwnd;
2125 u_int incr = tp->t_maxseg;
2126 if (cw > tp->snd_ssthresh)
2127 incr = max((incr * incr / cw), 1);
2128 tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale);
2129 }
2130 SOCKBUF_LOCK(&so->so_snd);
2131 if (acked > so->so_snd.sb_cc) {
2132 tp->snd_wnd -= so->so_snd.sb_cc;
2133 sbdrop_locked(&so->so_snd, (int)so->so_snd.sb_cc);
2134 ourfinisacked = 1;
2135 } else {
2136 sbdrop_locked(&so->so_snd, acked);
2137 tp->snd_wnd -= acked;
2138 ourfinisacked = 0;
2139 }
2140 /* NB: sowwakeup_locked() does an implicit unlock. */
2141 sowwakeup_locked(so);
2142 /* Detect una wraparound. */
2143 if ((V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) &&
2144 !IN_FASTRECOVERY(tp) &&
2145 SEQ_GT(tp->snd_una, tp->snd_recover) &&
2146 SEQ_LEQ(th->th_ack, tp->snd_recover))
2147 tp->snd_recover = th->th_ack - 1;
2148 if ((V_tcp_do_newreno || (tp->t_flags & TF_SACK_PERMIT)) &&
2149 IN_FASTRECOVERY(tp) &&
2150 SEQ_GEQ(th->th_ack, tp->snd_recover))
2151 EXIT_FASTRECOVERY(tp);
2152 tp->snd_una = th->th_ack;
2153 if (tp->t_flags & TF_SACK_PERMIT) {
2154 if (SEQ_GT(tp->snd_una, tp->snd_recover))
2155 tp->snd_recover = tp->snd_una;
2156 }
2157 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2158 tp->snd_nxt = tp->snd_una;
2159
2160 switch (tp->t_state) {
2161
2162 /*
2163 * In FIN_WAIT_1 STATE in addition to the processing
2164 * for the ESTABLISHED state if our FIN is now acknowledged
2165 * then enter FIN_WAIT_2.
2166 */
2167 case TCPS_FIN_WAIT_1:
2168 if (ourfinisacked) {
2169 /*
2170 * If we can't receive any more
2171 * data, then closing user can proceed.
2172 * Starting the timer is contrary to the
2173 * specification, but if we don't get a FIN
2174 * we'll hang forever.
2175 *
2176 * XXXjl:
2177 * we should release the tp also, and use a
2178 * compressed state.
2179 */
2180 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
2181 int timeout;
2182
2183 soisdisconnected(so);
2184 timeout = (tcp_fast_finwait2_recycle) ?
2185 tcp_finwait2_timeout : tcp_maxidle;
2186 tcp_timer_activate(tp, TT_2MSL, timeout);
2187 }
2188 tp->t_state = TCPS_FIN_WAIT_2;
2189 }
2190 break;
2191
2192 /*
2193 * In CLOSING STATE in addition to the processing for
2194 * the ESTABLISHED state if the ACK acknowledges our FIN
2195 * then enter the TIME-WAIT state, otherwise ignore
2196 * the segment.
2197 */
2198 case TCPS_CLOSING:
2199 if (ourfinisacked) {
2200 KASSERT(headlocked, ("%s: process_ACK: "
2201 "head not locked", __func__));
2202 tcp_twstart(tp);
2203 INP_INFO_WUNLOCK(&V_tcbinfo);
2204 headlocked = 0;
2205 m_freem(m);
2206 return;
2207 }
2208 break;
2209
2210 /*
2211 * In LAST_ACK, we may still be waiting for data to drain
2212 * and/or to be acked, as well as for the ack of our FIN.
2213 * If our FIN is now acknowledged, delete the TCB,
2214 * enter the closed state and return.
2215 */
2216 case TCPS_LAST_ACK:
2217 if (ourfinisacked) {
2218 KASSERT(headlocked, ("%s: process_ACK: "
2219 "tcp_close: head not locked", __func__));
2220 tp = tcp_close(tp);
2221 goto drop;
2222 }
2223 break;
2224 }
2225 }
2226
2227step6:
2228 KASSERT(headlocked, ("%s: step6: head not locked", __func__));
2229 INP_WLOCK_ASSERT(tp->t_inpcb);
2230
2231 /*
2232 * Update window information.
2233 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2234 */
2235 if ((thflags & TH_ACK) &&
2236 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2237 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2238 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2239 /* keep track of pure window updates */
2240 if (tlen == 0 &&
2241 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2242 V_tcpstat.tcps_rcvwinupd++;
2243 tp->snd_wnd = tiwin;
2244 tp->snd_wl1 = th->th_seq;
2245 tp->snd_wl2 = th->th_ack;
2246 if (tp->snd_wnd > tp->max_sndwnd)
2247 tp->max_sndwnd = tp->snd_wnd;
2248 needoutput = 1;
2249 }
2250
2251 /*
2252 * Process segments with URG.
2253 */
2254 if ((thflags & TH_URG) && th->th_urp &&
2255 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2256 /*
2257 * This is a kludge, but if we receive and accept
2258 * random urgent pointers, we'll crash in
2259 * soreceive. It's hard to imagine someone
2260 * actually wanting to send this much urgent data.
2261 */
2262 SOCKBUF_LOCK(&so->so_rcv);
2263 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2264 th->th_urp = 0; /* XXX */
2265 thflags &= ~TH_URG; /* XXX */
2266 SOCKBUF_UNLOCK(&so->so_rcv); /* XXX */
2267 goto dodata; /* XXX */
2268 }
2269 /*
2270 * If this segment advances the known urgent pointer,
2271 * then mark the data stream. This should not happen
2272 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2273 * a FIN has been received from the remote side.
2274 * In these states we ignore the URG.
2275 *
2276 * According to RFC961 (Assigned Protocols),
2277 * the urgent pointer points to the last octet
2278 * of urgent data. We continue, however,
2279 * to consider it to indicate the first octet
2280 * of data past the urgent section as the original
2281 * spec states (in one of two places).
2282 */
2283 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2284 tp->rcv_up = th->th_seq + th->th_urp;
2285 so->so_oobmark = so->so_rcv.sb_cc +
2286 (tp->rcv_up - tp->rcv_nxt) - 1;
2287 if (so->so_oobmark == 0)
2288 so->so_rcv.sb_state |= SBS_RCVATMARK;
2289 sohasoutofband(so);
2290 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2291 }
2292 SOCKBUF_UNLOCK(&so->so_rcv);
2293 /*
2294 * Remove out of band data so doesn't get presented to user.
2295 * This can happen independent of advancing the URG pointer,
2296 * but if two URG's are pending at once, some out-of-band
2297 * data may creep in... ick.
2298 */
2299 if (th->th_urp <= (u_long)tlen &&
2300 !(so->so_options & SO_OOBINLINE)) {
2301 /* hdr drop is delayed */
2302 tcp_pulloutofband(so, th, m, drop_hdrlen);
2303 }
2304 } else {
2305 /*
2306 * If no out of band data is expected,
2307 * pull receive urgent pointer along
2308 * with the receive window.
2309 */
2310 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2311 tp->rcv_up = tp->rcv_nxt;
2312 }
2313dodata: /* XXX */
2314 KASSERT(headlocked, ("%s: dodata: head not locked", __func__));
2315 INP_WLOCK_ASSERT(tp->t_inpcb);
2316
2317 /*
2318 * Process the segment text, merging it into the TCP sequencing queue,
2319 * and arranging for acknowledgment of receipt if necessary.
2320 * This process logically involves adjusting tp->rcv_wnd as data
2321 * is presented to the user (this happens in tcp_usrreq.c,
2322 * case PRU_RCVD). If a FIN has already been received on this
2323 * connection then we just ignore the text.
2324 */
2325 if ((tlen || (thflags & TH_FIN)) &&
2326 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2327 tcp_seq save_start = th->th_seq;
2328 m_adj(m, drop_hdrlen); /* delayed header drop */
2329 /*
2330 * Insert segment which includes th into TCP reassembly queue
2331 * with control block tp. Set thflags to whether reassembly now
2332 * includes a segment with FIN. This handles the common case
2333 * inline (segment is the next to be received on an established
2334 * connection, and the queue is empty), avoiding linkage into
2335 * and removal from the queue and repetition of various
2336 * conversions.
2337 * Set DELACK for segments received in order, but ack
2338 * immediately when segments are out of order (so
2339 * fast retransmit can work).
2340 */
2341 if (th->th_seq == tp->rcv_nxt &&
2342 LIST_EMPTY(&tp->t_segq) &&
2343 TCPS_HAVEESTABLISHED(tp->t_state)) {
2344 if (DELAY_ACK(tp))
2345 tp->t_flags |= TF_DELACK;
2346 else
2347 tp->t_flags |= TF_ACKNOW;
2348 tp->rcv_nxt += tlen;
2349 thflags = th->th_flags & TH_FIN;
2350 V_tcpstat.tcps_rcvpack++;
2351 V_tcpstat.tcps_rcvbyte += tlen;
2352 ND6_HINT(tp);
2353 SOCKBUF_LOCK(&so->so_rcv);
2354 if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
2355 m_freem(m);
2356 else
2357 sbappendstream_locked(&so->so_rcv, m);
2358 /* NB: sorwakeup_locked() does an implicit unlock. */
2359 sorwakeup_locked(so);
2360 } else {
2361 /*
2362 * XXX: Due to the header drop above "th" is
2363 * theoretically invalid by now. Fortunately
2364 * m_adj() doesn't actually frees any mbufs
2365 * when trimming from the head.
2366 */
2367 thflags = tcp_reass(tp, th, &tlen, m);
2368 tp->t_flags |= TF_ACKNOW;
2369 }
2370 if (tlen > 0 && (tp->t_flags & TF_SACK_PERMIT))
2371 tcp_update_sack_list(tp, save_start, save_start + tlen);
2372#if 0
2373 /*
2374 * Note the amount of data that peer has sent into
2375 * our window, in order to estimate the sender's
2376 * buffer size.
2377 * XXX: Unused.
2378 */
2379 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2380#endif
2381 } else {
2382 m_freem(m);
2383 thflags &= ~TH_FIN;
2384 }
2385
2386 /*
2387 * If FIN is received ACK the FIN and let the user know
2388 * that the connection is closing.
2389 */
2390 if (thflags & TH_FIN) {
2391 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2392 socantrcvmore(so);
2393 /*
2394 * If connection is half-synchronized
2395 * (ie NEEDSYN flag on) then delay ACK,
2396 * so it may be piggybacked when SYN is sent.
2397 * Otherwise, since we received a FIN then no
2398 * more input can be expected, send ACK now.
2399 */
2400 if (tp->t_flags & TF_NEEDSYN)
2401 tp->t_flags |= TF_DELACK;
2402 else
2403 tp->t_flags |= TF_ACKNOW;
2404 tp->rcv_nxt++;
2405 }
2406 switch (tp->t_state) {
2407
2408 /*
2409 * In SYN_RECEIVED and ESTABLISHED STATES
2410 * enter the CLOSE_WAIT state.
2411 */
2412 case TCPS_SYN_RECEIVED:
2413 tp->t_starttime = ticks;
2414 /* FALLTHROUGH */
2415 case TCPS_ESTABLISHED:
2416 tp->t_state = TCPS_CLOSE_WAIT;
2417 break;
2418
2419 /*
2420 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2421 * enter the CLOSING state.
2422 */
2423 case TCPS_FIN_WAIT_1:
2424 tp->t_state = TCPS_CLOSING;
2425 break;
2426
2427 /*
2428 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2429 * starting the time-wait timer, turning off the other
2430 * standard timers.
2431 */
2432 case TCPS_FIN_WAIT_2:
2433 KASSERT(headlocked == 1, ("%s: dodata: "
2434 "TCP_FIN_WAIT_2: head not locked", __func__));
2435 tcp_twstart(tp);
2436 INP_INFO_WUNLOCK(&V_tcbinfo);
2437 return;
2438 }
2439 }
2440 INP_INFO_WUNLOCK(&V_tcbinfo);
2441 headlocked = 0;
2442#ifdef TCPDEBUG
2443 if (so->so_options & SO_DEBUG)
2444 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2445 &tcp_savetcp, 0);
2446#endif
2447
2448 /*
2449 * Return any desired output.
2450 */
2451 if (needoutput || (tp->t_flags & TF_ACKNOW))
2452 (void) tcp_output(tp);
2453
2454check_delack:
2455 KASSERT(headlocked == 0, ("%s: check_delack: head locked",
2456 __func__));
2457 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
2458 INP_WLOCK_ASSERT(tp->t_inpcb);
2459 if (tp->t_flags & TF_DELACK) {
2460 tp->t_flags &= ~TF_DELACK;
2461 tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
2462 }
2463 INP_WUNLOCK(tp->t_inpcb);
2464 return;
2465
2466dropafterack:
2467 KASSERT(headlocked, ("%s: dropafterack: head not locked", __func__));
2468 /*
2469 * Generate an ACK dropping incoming segment if it occupies
2470 * sequence space, where the ACK reflects our state.
2471 *
2472 * We can now skip the test for the RST flag since all
2473 * paths to this code happen after packets containing
2474 * RST have been dropped.
2475 *
2476 * In the SYN-RECEIVED state, don't send an ACK unless the
2477 * segment we received passes the SYN-RECEIVED ACK test.
2478 * If it fails send a RST. This breaks the loop in the
2479 * "LAND" DoS attack, and also prevents an ACK storm
2480 * between two listening ports that have been sent forged
2481 * SYN segments, each with the source address of the other.
2482 */
2483 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2484 (SEQ_GT(tp->snd_una, th->th_ack) ||
2485 SEQ_GT(th->th_ack, tp->snd_max)) ) {
2486 rstreason = BANDLIM_RST_OPENPORT;
2487 goto dropwithreset;
2488 }
2489#ifdef TCPDEBUG
2490 if (so->so_options & SO_DEBUG)
2491 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2492 &tcp_savetcp, 0);
2493#endif
2494 KASSERT(headlocked, ("%s: headlocked should be 1", __func__));
2495 INP_INFO_WUNLOCK(&V_tcbinfo);
2496 tp->t_flags |= TF_ACKNOW;
2497 (void) tcp_output(tp);
2498 INP_WUNLOCK(tp->t_inpcb);
2499 m_freem(m);
2500 return;
2501
2502dropwithreset:
2503 KASSERT(headlocked, ("%s: dropwithreset: head not locked", __func__));
2504 INP_INFO_WUNLOCK(&V_tcbinfo);
2505
2506 if (tp != NULL) {
2507 tcp_dropwithreset(m, th, tp, tlen, rstreason);
2508 INP_WUNLOCK(tp->t_inpcb);
2509 } else
2510 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
2511 return;
2512
2513drop:
2514 /*
2515 * Drop space held by incoming segment and return.
2516 */
2517#ifdef TCPDEBUG
2518 if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2519 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2520 &tcp_savetcp, 0);
2521#endif
2522 if (tp != NULL)
2523 INP_WUNLOCK(tp->t_inpcb);
2524 if (headlocked)
2525 INP_INFO_WUNLOCK(&V_tcbinfo);
2526 m_freem(m);
2527}
2528
2529/*
2530 * Issue RST and make ACK acceptable to originator of segment.
2531 * The mbuf must still include the original packet header.
2532 * tp may be NULL.
2533 */
2534static void
2535tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
2536 int tlen, int rstreason)
2537{
2538 struct ip *ip;
2539#ifdef INET6
2540 struct ip6_hdr *ip6;
2541#endif
2542
2543 if (tp != NULL) {
2544 INP_WLOCK_ASSERT(tp->t_inpcb);
2545 }
2546
2547 /* Don't bother if destination was broadcast/multicast. */
2548 if ((th->th_flags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2549 goto drop;
2550#ifdef INET6
2551 if (mtod(m, struct ip *)->ip_v == 6) {
2552 ip6 = mtod(m, struct ip6_hdr *);
2553 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2554 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2555 goto drop;
2556 /* IPv6 anycast check is done at tcp6_input() */
2557 } else
2558#endif
2559 {
2560 ip = mtod(m, struct ip *);
2561 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2562 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2563 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2564 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2565 goto drop;
2566 }
2567
2568 /* Perform bandwidth limiting. */
2569 if (badport_bandlim(rstreason) < 0)
2570 goto drop;
2571
2572 /* tcp_respond consumes the mbuf chain. */
2573 if (th->th_flags & TH_ACK) {
2574 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0,
2575 th->th_ack, TH_RST);
2576 } else {
2577 if (th->th_flags & TH_SYN)
2578 tlen++;
2579 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2580 (tcp_seq)0, TH_RST|TH_ACK);
2581 }
2582 return;
2583drop:
2584 m_freem(m);
2585}
2586
2587/*
2588 * Parse TCP options and place in tcpopt.
2589 */
2590static void
2591tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, int flags)
2592{
2593 INIT_VNET_INET(curvnet);
2594 int opt, optlen;
2595
2596 to->to_flags = 0;
2597 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2598 opt = cp[0];
2599 if (opt == TCPOPT_EOL)
2600 break;
2601 if (opt == TCPOPT_NOP)
2602 optlen = 1;
2603 else {
2604 if (cnt < 2)
2605 break;
2606 optlen = cp[1];
2607 if (optlen < 2 || optlen > cnt)
2608 break;
2609 }
2610 switch (opt) {
2611 case TCPOPT_MAXSEG:
2612 if (optlen != TCPOLEN_MAXSEG)
2613 continue;
2614 if (!(flags & TO_SYN))
2615 continue;
2616 to->to_flags |= TOF_MSS;
2617 bcopy((char *)cp + 2,
2618 (char *)&to->to_mss, sizeof(to->to_mss));
2619 to->to_mss = ntohs(to->to_mss);
2620 break;
2621 case TCPOPT_WINDOW:
2622 if (optlen != TCPOLEN_WINDOW)
2623 continue;
2624 if (!(flags & TO_SYN))
2625 continue;
2626 to->to_flags |= TOF_SCALE;
2627 to->to_wscale = min(cp[2], TCP_MAX_WINSHIFT);
2628 break;
2629 case TCPOPT_TIMESTAMP:
2630 if (optlen != TCPOLEN_TIMESTAMP)
2631 continue;
2632 to->to_flags |= TOF_TS;
2633 bcopy((char *)cp + 2,
2634 (char *)&to->to_tsval, sizeof(to->to_tsval));
2635 to->to_tsval = ntohl(to->to_tsval);
2636 bcopy((char *)cp + 6,
2637 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2638 to->to_tsecr = ntohl(to->to_tsecr);
2639 break;
2640#ifdef TCP_SIGNATURE
2641 /*
2642 * XXX In order to reply to a host which has set the
2643 * TCP_SIGNATURE option in its initial SYN, we have to
2644 * record the fact that the option was observed here
2645 * for the syncache code to perform the correct response.
2646 */
2647 case TCPOPT_SIGNATURE:
2648 if (optlen != TCPOLEN_SIGNATURE)
2649 continue;
2650 to->to_flags |= TOF_SIGNATURE;
2651 to->to_signature = cp + 2;
2652 break;
2653#endif
2654 case TCPOPT_SACK_PERMITTED:
2655 if (optlen != TCPOLEN_SACK_PERMITTED)
2656 continue;
2657 if (!(flags & TO_SYN))
2658 continue;
2659 if (!V_tcp_do_sack)
2660 continue;
2661 to->to_flags |= TOF_SACKPERM;
2662 break;
2663 case TCPOPT_SACK:
2664 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
2665 continue;
2666 if (flags & TO_SYN)
2667 continue;
2668 to->to_flags |= TOF_SACK;
2669 to->to_nsacks = (optlen - 2) / TCPOLEN_SACK;
2670 to->to_sacks = cp + 2;
2671 V_tcpstat.tcps_sack_rcv_blocks++;
2672 break;
2673 default:
2674 continue;
2675 }
2676 }
2677}
2678
2679/*
2680 * Pull out of band byte out of a segment so
2681 * it doesn't appear in the user's data queue.
2682 * It is still reflected in the segment length for
2683 * sequencing purposes.
2684 */
2685static void
2686tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m,
2687 int off)
2688{
2689 int cnt = off + th->th_urp - 1;
2690
2691 while (cnt >= 0) {
2692 if (m->m_len > cnt) {
2693 char *cp = mtod(m, caddr_t) + cnt;
2694 struct tcpcb *tp = sototcpcb(so);
2695
2696 INP_WLOCK_ASSERT(tp->t_inpcb);
2697
2698 tp->t_iobc = *cp;
2699 tp->t_oobflags |= TCPOOB_HAVEDATA;
2700 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2701 m->m_len--;
2702 if (m->m_flags & M_PKTHDR)
2703 m->m_pkthdr.len--;
2704 return;
2705 }
2706 cnt -= m->m_len;
2707 m = m->m_next;
2708 if (m == NULL)
2709 break;
2710 }
2711 panic("tcp_pulloutofband");
2712}
2713
2714/*
2715 * Collect new round-trip time estimate
2716 * and update averages and current timeout.
2717 */
2718static void
2719tcp_xmit_timer(struct tcpcb *tp, int rtt)
2720{
2721 INIT_VNET_INET(tp->t_inpcb->inp_vnet);
2722 int delta;
2723
2724 INP_WLOCK_ASSERT(tp->t_inpcb);
2725
2726 V_tcpstat.tcps_rttupdated++;
2727 tp->t_rttupdated++;
2728 if (tp->t_srtt != 0) {
2729 /*
2730 * srtt is stored as fixed point with 5 bits after the
2731 * binary point (i.e., scaled by 8). The following magic
2732 * is equivalent to the smoothing algorithm in rfc793 with
2733 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2734 * point). Adjust rtt to origin 0.
2735 */
2736 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2737 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2738
2739 if ((tp->t_srtt += delta) <= 0)
2740 tp->t_srtt = 1;
2741
2742 /*
2743 * We accumulate a smoothed rtt variance (actually, a
2744 * smoothed mean difference), then set the retransmit
2745 * timer to smoothed rtt + 4 times the smoothed variance.
2746 * rttvar is stored as fixed point with 4 bits after the
2747 * binary point (scaled by 16). The following is
2748 * equivalent to rfc793 smoothing with an alpha of .75
2749 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2750 * rfc793's wired-in beta.
2751 */
2752 if (delta < 0)
2753 delta = -delta;
2754 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2755 if ((tp->t_rttvar += delta) <= 0)
2756 tp->t_rttvar = 1;
2757 if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar)
2758 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2759 } else {
2760 /*
2761 * No rtt measurement yet - use the unsmoothed rtt.
2762 * Set the variance to half the rtt (so our first
2763 * retransmit happens at 3*rtt).
2764 */
2765 tp->t_srtt = rtt << TCP_RTT_SHIFT;
2766 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2767 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2768 }
2769 tp->t_rtttime = 0;
2770 tp->t_rxtshift = 0;
2771
2772 /*
2773 * the retransmit should happen at rtt + 4 * rttvar.
2774 * Because of the way we do the smoothing, srtt and rttvar
2775 * will each average +1/2 tick of bias. When we compute
2776 * the retransmit timer, we want 1/2 tick of rounding and
2777 * 1 extra tick because of +-1/2 tick uncertainty in the
2778 * firing of the timer. The bias will give us exactly the
2779 * 1.5 tick we need. But, because the bias is
2780 * statistical, we have to test that we don't drop below
2781 * the minimum feasible timer (which is 2 ticks).
2782 */
2783 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2784 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2785
2786 /*
2787 * We received an ack for a packet that wasn't retransmitted;
2788 * it is probably safe to discard any error indications we've
2789 * received recently. This isn't quite right, but close enough
2790 * for now (a route might have failed after we sent a segment,
2791 * and the return path might not be symmetrical).
2792 */
2793 tp->t_softerror = 0;
2794}
2795
2796/*
2797 * Determine a reasonable value for maxseg size.
2798 * If the route is known, check route for mtu.
2799 * If none, use an mss that can be handled on the outgoing
2800 * interface without forcing IP to fragment; if bigger than
2801 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2802 * to utilize large mbufs. If no route is found, route has no mtu,
2803 * or the destination isn't local, use a default, hopefully conservative
2804 * size (usually 512 or the default IP max size, but no more than the mtu
2805 * of the interface), as we can't discover anything about intervening
2806 * gateways or networks. We also initialize the congestion/slow start
2807 * window to be a single segment if the destination isn't local.
2808 * While looking at the routing entry, we also initialize other path-dependent
2809 * parameters from pre-set or cached values in the routing entry.
2810 *
2811 * Also take into account the space needed for options that we
2812 * send regularly. Make maxseg shorter by that amount to assure
2813 * that we can send maxseg amount of data even when the options
2814 * are present. Store the upper limit of the length of options plus
2815 * data in maxopd.
2816 *
2817 * In case of T/TCP, we call this routine during implicit connection
2818 * setup as well (offer = -1), to initialize maxseg from the cached
2819 * MSS of our peer.
2820 *
2821 * NOTE that this routine is only called when we process an incoming
2822 * segment. Outgoing SYN/ACK MSS settings are handled in tcp_mssopt().
2823 */
2824void
2825tcp_mss_update(struct tcpcb *tp, int offer,
2826 struct hc_metrics_lite *metricptr, int *mtuflags)
2827{
2828 INIT_VNET_INET(tp->t_inpcb->inp_vnet);
2829 int mss;
2830 u_long maxmtu;
2831 struct inpcb *inp = tp->t_inpcb;
2832 struct hc_metrics_lite metrics;
2833 int origoffer = offer;
2834#ifdef INET6
2835 int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2836 size_t min_protoh = isipv6 ?
2837 sizeof (struct ip6_hdr) + sizeof (struct tcphdr) :
2838 sizeof (struct tcpiphdr);
2839#else
2840 const size_t min_protoh = sizeof(struct tcpiphdr);
2841#endif
2842
2843 INP_WLOCK_ASSERT(tp->t_inpcb);
2844
2845 /* Initialize. */
2846#ifdef INET6
2847 if (isipv6) {
2848 maxmtu = tcp_maxmtu6(&inp->inp_inc, mtuflags);
2849 tp->t_maxopd = tp->t_maxseg = V_tcp_v6mssdflt;
2850 } else
2851#endif
2852 {
2853 maxmtu = tcp_maxmtu(&inp->inp_inc, mtuflags);
2854 tp->t_maxopd = tp->t_maxseg = V_tcp_mssdflt;
2855 }
2856
2857 /*
2858 * No route to sender, stay with default mss and return.
2859 */
2860 if (maxmtu == 0) {
2861 /*
2862 * In case we return early we need to initialize metrics
2863 * to a defined state as tcp_hc_get() would do for us
2864 * if there was no cache hit.
2865 */
2866 if (metricptr != NULL)
2867 bzero(metricptr, sizeof(struct hc_metrics_lite));
2868 return;
2869 }
2870
2871 /* What have we got? */
2872 switch (offer) {
2873 case 0:
2874 /*
2875 * Offer == 0 means that there was no MSS on the SYN
2876 * segment, in this case we use tcp_mssdflt as
2877 * already assigned to t_maxopd above.
2878 */
2879 offer = tp->t_maxopd;
2880 break;
2881
2882 case -1:
2883 /*
2884 * Offer == -1 means that we didn't receive SYN yet.
2885 */
2886 /* FALLTHROUGH */
2887
2888 default:
2889 /*
2890 * Prevent DoS attack with too small MSS. Round up
2891 * to at least minmss.
2892 */
2893 offer = max(offer, V_tcp_minmss);
2894 }
2895
2896 /*
2897 * rmx information is now retrieved from tcp_hostcache.
2898 */
2899 tcp_hc_get(&inp->inp_inc, &metrics);
2900 if (metricptr != NULL)
2901 bcopy(&metrics, metricptr, sizeof(struct hc_metrics_lite));
2902
2903 /*
2904 * If there's a discovered mtu int tcp hostcache, use it
2905 * else, use the link mtu.
2906 */
2907 if (metrics.rmx_mtu)
2908 mss = min(metrics.rmx_mtu, maxmtu) - min_protoh;
2909 else {
2910#ifdef INET6
2911 if (isipv6) {
2912 mss = maxmtu - min_protoh;
2913 if (!V_path_mtu_discovery &&
2914 !in6_localaddr(&inp->in6p_faddr))
2915 mss = min(mss, V_tcp_v6mssdflt);
2916 } else
2917#endif
2918 {
2919 mss = maxmtu - min_protoh;
2920 if (!V_path_mtu_discovery &&
2921 !in_localaddr(inp->inp_faddr))
2922 mss = min(mss, V_tcp_mssdflt);
2923 }
2924 /*
2925 * XXX - The above conditional (mss = maxmtu - min_protoh)
2926 * probably violates the TCP spec.
2927 * The problem is that, since we don't know the
2928 * other end's MSS, we are supposed to use a conservative
2929 * default. But, if we do that, then MTU discovery will
2930 * never actually take place, because the conservative
2931 * default is much less than the MTUs typically seen
2932 * on the Internet today. For the moment, we'll sweep
2933 * this under the carpet.
2934 *
2935 * The conservative default might not actually be a problem
2936 * if the only case this occurs is when sending an initial
2937 * SYN with options and data to a host we've never talked
2938 * to before. Then, they will reply with an MSS value which
2939 * will get recorded and the new parameters should get
2940 * recomputed. For Further Study.
2941 */
2942 }
2943 mss = min(mss, offer);
2944
2945 /*
2946 * Sanity check: make sure that maxopd will be large
2947 * enough to allow some data on segments even if the
2948 * all the option space is used (40bytes). Otherwise
2949 * funny things may happen in tcp_output.
2950 */
2951 mss = max(mss, 64);
2952
2953 /*
2954 * maxopd stores the maximum length of data AND options
2955 * in a segment; maxseg is the amount of data in a normal
2956 * segment. We need to store this value (maxopd) apart
2957 * from maxseg, because now every segment carries options
2958 * and thus we normally have somewhat less data in segments.
2959 */
2960 tp->t_maxopd = mss;
2961
2962 /*
2963 * origoffer==-1 indicates that no segments were received yet.
2964 * In this case we just guess.
2965 */
2966 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2967 (origoffer == -1 ||
2968 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
2969 mss -= TCPOLEN_TSTAMP_APPA;
2970
2971#if (MCLBYTES & (MCLBYTES - 1)) == 0
2972 if (mss > MCLBYTES)
2973 mss &= ~(MCLBYTES-1);
2974#else
2975 if (mss > MCLBYTES)
2976 mss = mss / MCLBYTES * MCLBYTES;
2977#endif
2978 tp->t_maxseg = mss;
2979}
2980
2981void
2982tcp_mss(struct tcpcb *tp, int offer)
2983{
2984 int rtt, mss;
2985 u_long bufsize;
2986 struct inpcb *inp;
2987 struct socket *so;
2988 struct hc_metrics_lite metrics;
2989 int mtuflags = 0;
2990#ifdef INET6
2991 int isipv6;
2992#endif
2993 KASSERT(tp != NULL, ("%s: tp == NULL", __func__));
2994 INIT_VNET_INET(tp->t_vnet);
2995
2996 tcp_mss_update(tp, offer, &metrics, &mtuflags);
2997
2998 mss = tp->t_maxseg;
2999 inp = tp->t_inpcb;
3000#ifdef INET6
3001 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
3002#endif
3003
3004 /*
3005 * If there's a pipesize, change the socket buffer to that size,
3006 * don't change if sb_hiwat is different than default (then it
3007 * has been changed on purpose with setsockopt).
3008 * Make the socket buffers an integral number of mss units;
3009 * if the mss is larger than the socket buffer, decrease the mss.
3010 */
3011 so = inp->inp_socket;
3012 SOCKBUF_LOCK(&so->so_snd);
3013 if ((so->so_snd.sb_hiwat == tcp_sendspace) && metrics.rmx_sendpipe)
3014 bufsize = metrics.rmx_sendpipe;
3015 else
3016 bufsize = so->so_snd.sb_hiwat;
3017 if (bufsize < mss)
3018 mss = bufsize;
3019 else {
3020 bufsize = roundup(bufsize, mss);
3021 if (bufsize > sb_max)
3022 bufsize = sb_max;
3023 if (bufsize > so->so_snd.sb_hiwat)
3024 (void)sbreserve_locked(&so->so_snd, bufsize, so, NULL);
3025 }
3026 SOCKBUF_UNLOCK(&so->so_snd);
3027 tp->t_maxseg = mss;
3028
3029 SOCKBUF_LOCK(&so->so_rcv);
3030 if ((so->so_rcv.sb_hiwat == tcp_recvspace) && metrics.rmx_recvpipe)
3031 bufsize = metrics.rmx_recvpipe;
3032 else
3033 bufsize = so->so_rcv.sb_hiwat;
3034 if (bufsize > mss) {
3035 bufsize = roundup(bufsize, mss);
3036 if (bufsize > sb_max)
3037 bufsize = sb_max;
3038 if (bufsize > so->so_rcv.sb_hiwat)
3039 (void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL);
3040 }
3041 SOCKBUF_UNLOCK(&so->so_rcv);
3042 /*
3043 * While we're here, check the others too.
3044 */
3045 if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) {
3046 tp->t_srtt = rtt;
3047 tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE;
3048 V_tcpstat.tcps_usedrtt++;
3049 if (metrics.rmx_rttvar) {
3050 tp->t_rttvar = metrics.rmx_rttvar;
3051 V_tcpstat.tcps_usedrttvar++;
3052 } else {
3053 /* default variation is +- 1 rtt */
3054 tp->t_rttvar =
3055 tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
3056 }
3057 TCPT_RANGESET(tp->t_rxtcur,
3058 ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
3059 tp->t_rttmin, TCPTV_REXMTMAX);
3060 }
3061 if (metrics.rmx_ssthresh) {
3062 /*
3063 * There's some sort of gateway or interface
3064 * buffer limit on the path. Use this to set
3065 * the slow start threshhold, but set the
3066 * threshold to no less than 2*mss.
3067 */
3068 tp->snd_ssthresh = max(2 * mss, metrics.rmx_ssthresh);
3069 V_tcpstat.tcps_usedssthresh++;
3070 }
3071 if (metrics.rmx_bandwidth)
3072 tp->snd_bandwidth = metrics.rmx_bandwidth;
3073
3074 /*
3075 * Set the slow-start flight size depending on whether this
3076 * is a local network or not.
3077 *
3078 * Extend this so we cache the cwnd too and retrieve it here.
3079 * Make cwnd even bigger than RFC3390 suggests but only if we
3080 * have previous experience with the remote host. Be careful
3081 * not make cwnd bigger than remote receive window or our own
3082 * send socket buffer. Maybe put some additional upper bound
3083 * on the retrieved cwnd. Should do incremental updates to
3084 * hostcache when cwnd collapses so next connection doesn't
3085 * overloads the path again.
3086 *
3087 * RFC3390 says only do this if SYN or SYN/ACK didn't got lost.
3088 * We currently check only in syncache_socket for that.
3089 */
3090#define TCP_METRICS_CWND
3091#ifdef TCP_METRICS_CWND
3092 if (metrics.rmx_cwnd)
3093 tp->snd_cwnd = max(mss,
3094 min(metrics.rmx_cwnd / 2,
3095 min(tp->snd_wnd, so->so_snd.sb_hiwat)));
3096 else
3097#endif
3098 if (V_tcp_do_rfc3390)
3099 tp->snd_cwnd = min(4 * mss, max(2 * mss, 4380));
3100#ifdef INET6
3101 else if ((isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
3102 (!isipv6 && in_localaddr(inp->inp_faddr)))
3103#else
3104 else if (in_localaddr(inp->inp_faddr))
3105#endif
3106 tp->snd_cwnd = mss * V_ss_fltsz_local;
3107 else
3108 tp->snd_cwnd = mss * V_ss_fltsz;
3109
3110 /* Check the interface for TSO capabilities. */
3111 if (mtuflags & CSUM_TSO)
3112 tp->t_flags |= TF_TSO;
3113}
3114
3115/*
3116 * Determine the MSS option to send on an outgoing SYN.
3117 */
3118int
3119tcp_mssopt(struct in_conninfo *inc)
3120{
3121 INIT_VNET_INET(curvnet);
3122 int mss = 0;
3123 u_long maxmtu = 0;
3124 u_long thcmtu = 0;
3125 size_t min_protoh;
3126#ifdef INET6
3127 int isipv6 = inc->inc_isipv6 ? 1 : 0;
3128#endif
3129
3130 KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer"));
3131
3132#ifdef INET6
3133 if (isipv6) {
3134 mss = V_tcp_v6mssdflt;
3135 maxmtu = tcp_maxmtu6(inc, NULL);
3136 thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3137 min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
3138 } else
3139#endif
3140 {
3141 mss = V_tcp_mssdflt;
3142 maxmtu = tcp_maxmtu(inc, NULL);
3143 thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3144 min_protoh = sizeof(struct tcpiphdr);
3145 }
3146 if (maxmtu && thcmtu)
3147 mss = min(maxmtu, thcmtu) - min_protoh;
3148 else if (maxmtu || thcmtu)
3149 mss = max(maxmtu, thcmtu) - min_protoh;
3150
3151 return (mss);
3152}
3153
3154
3155/*
3156 * On a partial ack arrives, force the retransmission of the
3157 * next unacknowledged segment. Do not clear tp->t_dupacks.
3158 * By setting snd_nxt to ti_ack, this forces retransmission timer to
3159 * be started again.
3160 */
3161static void
3162tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th)
3163{
3164 tcp_seq onxt = tp->snd_nxt;
3165 u_long ocwnd = tp->snd_cwnd;
3166
3167 INP_WLOCK_ASSERT(tp->t_inpcb);
3168
3169 tcp_timer_activate(tp, TT_REXMT, 0);
3170 tp->t_rtttime = 0;
3171 tp->snd_nxt = th->th_ack;
3172 /*
3173 * Set snd_cwnd to one segment beyond acknowledged offset.
3174 * (tp->snd_una has not yet been updated when this function is called.)
3175 */
3176 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
3177 tp->t_flags |= TF_ACKNOW;
3178 (void) tcp_output(tp);
3179 tp->snd_cwnd = ocwnd;
3180 if (SEQ_GT(onxt, tp->snd_nxt))
3181 tp->snd_nxt = onxt;
3182 /*
3183 * Partial window deflation. Relies on fact that tp->snd_una
3184 * not updated yet.
3185 */
3186 if (tp->snd_cwnd > th->th_ack - tp->snd_una)
3187 tp->snd_cwnd -= th->th_ack - tp->snd_una;
3188 else
3189 tp->snd_cwnd = 0;
3190 tp->snd_cwnd += tp->t_maxseg;
3191}
|