74#endif
75#include <netinet/tcp.h>
76#include <netinet/tcp_fsm.h>
77#include <netinet/tcp_seq.h>
78#include <netinet/tcp_timer.h>
79#include <netinet/tcp_var.h>
80#ifdef INET6
81#include <netinet6/tcp6_var.h>
82#endif
83#include <netinet/tcpip.h>
84#ifdef TCPDEBUG
85#include <netinet/tcp_debug.h>
86
87u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */
88struct tcphdr tcp_savetcp;
89#endif /* TCPDEBUG */
90
91#ifdef IPSEC
92#include <netinet6/ipsec.h>
93#ifdef INET6
94#include <netinet6/ipsec6.h>
95#endif
96#include <netkey/key.h>
97#endif /*IPSEC*/
98
99#include <machine/in_cksum.h>
100
101MALLOC_DEFINE(M_TSEGQ, "tseg_qent", "TCP segment queue entry");
102
103static int tcprexmtthresh = 3;
104tcp_cc tcp_ccgen;
105
106struct tcpstat tcpstat;
107SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW,
108 &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
109
110static int log_in_vain = 0;
111SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
112 &log_in_vain, 0, "Log all incoming TCP connections");
113
114static int blackhole = 0;
115SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
116 &blackhole, 0, "Do not send RST when dropping refused connections");
117
118int tcp_delack_enabled = 1;
119SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
120 &tcp_delack_enabled, 0,
121 "Delay ACK to try and piggyback it onto a data packet");
122
123#ifdef TCP_DROP_SYNFIN
124static int drop_synfin = 0;
125SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
126 &drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
127#endif
128
129struct inpcbhead tcb;
130#define tcb6 tcb /* for KAME src sync over BSD*'s */
131struct inpcbinfo tcbinfo;
132
133static void tcp_dooptions(struct tcpopt *, u_char *, int, int);
134static void tcp_pulloutofband(struct socket *,
135 struct tcphdr *, struct mbuf *, int);
136static int tcp_reass(struct tcpcb *, struct tcphdr *, int *,
137 struct mbuf *);
138static void tcp_xmit_timer(struct tcpcb *, int);
139static int tcp_newreno(struct tcpcb *, struct tcphdr *);
140
141/* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
142#ifdef INET6
143#define ND6_HINT(tp) \
144do { \
145 if ((tp) && (tp)->t_inpcb && \
146 ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0 && \
147 (tp)->t_inpcb->in6p_route.ro_rt) \
148 nd6_nud_hint((tp)->t_inpcb->in6p_route.ro_rt, NULL, 0); \
149} while (0)
150#else
151#define ND6_HINT(tp)
152#endif
153
154/*
155 * Indicate whether this ack should be delayed. We can delay the ack if
156 * - delayed acks are enabled and
157 * - there is no delayed ack timer in progress and
158 * - our last ack wasn't a 0-sized window. We never want to delay
159 * the ack that opens up a 0-sized window.
160 */
161#define DELAY_ACK(tp) \
162 (tcp_delack_enabled && !callout_pending(tp->tt_delack) && \
163 (tp->t_flags & TF_RXWIN0SENT) == 0)
164
165static int
166tcp_reass(tp, th, tlenp, m)
167 register struct tcpcb *tp;
168 register struct tcphdr *th;
169 int *tlenp;
170 struct mbuf *m;
171{
172 struct tseg_qent *q;
173 struct tseg_qent *p = NULL;
174 struct tseg_qent *nq;
175 struct tseg_qent *te;
176 struct socket *so = tp->t_inpcb->inp_socket;
177 int flags;
178
179 /*
180 * Call with th==0 after become established to
181 * force pre-ESTABLISHED data up to user socket.
182 */
183 if (th == 0)
184 goto present;
185
186 /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */
187 MALLOC(te, struct tseg_qent *, sizeof (struct tseg_qent), M_TSEGQ,
188 M_NOWAIT);
189 if (te == NULL) {
190 tcpstat.tcps_rcvmemdrop++;
191 m_freem(m);
192 return (0);
193 }
194
195 /*
196 * Find a segment which begins after this one does.
197 */
198 LIST_FOREACH(q, &tp->t_segq, tqe_q) {
199 if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
200 break;
201 p = q;
202 }
203
204 /*
205 * If there is a preceding segment, it may provide some of
206 * our data already. If so, drop the data from the incoming
207 * segment. If it provides all of our data, drop us.
208 */
209 if (p != NULL) {
210 register int i;
211 /* conversion to int (in i) handles seq wraparound */
212 i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
213 if (i > 0) {
214 if (i >= *tlenp) {
215 tcpstat.tcps_rcvduppack++;
216 tcpstat.tcps_rcvdupbyte += *tlenp;
217 m_freem(m);
218 FREE(te, M_TSEGQ);
219 /*
220 * Try to present any queued data
221 * at the left window edge to the user.
222 * This is needed after the 3-WHS
223 * completes.
224 */
225 goto present; /* ??? */
226 }
227 m_adj(m, i);
228 *tlenp -= i;
229 th->th_seq += i;
230 }
231 }
232 tcpstat.tcps_rcvoopack++;
233 tcpstat.tcps_rcvoobyte += *tlenp;
234
235 /*
236 * While we overlap succeeding segments trim them or,
237 * if they are completely covered, dequeue them.
238 */
239 while (q) {
240 register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
241 if (i <= 0)
242 break;
243 if (i < q->tqe_len) {
244 q->tqe_th->th_seq += i;
245 q->tqe_len -= i;
246 m_adj(q->tqe_m, i);
247 break;
248 }
249
250 nq = LIST_NEXT(q, tqe_q);
251 LIST_REMOVE(q, tqe_q);
252 m_freem(q->tqe_m);
253 FREE(q, M_TSEGQ);
254 q = nq;
255 }
256
257 /* Insert the new segment queue entry into place. */
258 te->tqe_m = m;
259 te->tqe_th = th;
260 te->tqe_len = *tlenp;
261
262 if (p == NULL) {
263 LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
264 } else {
265 LIST_INSERT_AFTER(p, te, tqe_q);
266 }
267
268present:
269 /*
270 * Present data to user, advancing rcv_nxt through
271 * completed sequence space.
272 */
273 if (!TCPS_HAVEESTABLISHED(tp->t_state))
274 return (0);
275 q = LIST_FIRST(&tp->t_segq);
276 if (!q || q->tqe_th->th_seq != tp->rcv_nxt)
277 return (0);
278 do {
279 tp->rcv_nxt += q->tqe_len;
280 flags = q->tqe_th->th_flags & TH_FIN;
281 nq = LIST_NEXT(q, tqe_q);
282 LIST_REMOVE(q, tqe_q);
283 if (so->so_state & SS_CANTRCVMORE)
284 m_freem(q->tqe_m);
285 else
286 sbappend(&so->so_rcv, q->tqe_m);
287 FREE(q, M_TSEGQ);
288 q = nq;
289 } while (q && q->tqe_th->th_seq == tp->rcv_nxt);
290 ND6_HINT(tp);
291 sorwakeup(so);
292 return (flags);
293}
294
295/*
296 * TCP input routine, follows pages 65-76 of the
297 * protocol specification dated September, 1981 very closely.
298 */
299#ifdef INET6
300int
301tcp6_input(mp, offp, proto)
302 struct mbuf **mp;
303 int *offp, proto;
304{
305 register struct mbuf *m = *mp;
306 struct in6_ifaddr *ia6;
307
308 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
309
310 /*
311 * draft-itojun-ipv6-tcp-to-anycast
312 * better place to put this in?
313 */
314 ia6 = ip6_getdstifaddr(m);
315 if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
316 struct ip6_hdr *ip6;
317
318 ip6 = mtod(m, struct ip6_hdr *);
319 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
320 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
321 return IPPROTO_DONE;
322 }
323
324 tcp_input(m, *offp);
325 return IPPROTO_DONE;
326}
327#endif
328
329void
330tcp_input(m, off0)
331 register struct mbuf *m;
332 int off0;
333{
334 register struct tcphdr *th;
335 register struct ip *ip = NULL;
336 register struct ipovly *ipov;
337 register struct inpcb *inp;
338 u_char *optp = NULL;
339 int optlen = 0;
340 int len, tlen, off;
341 int drop_hdrlen;
342 register struct tcpcb *tp = 0;
343 register int thflags;
344 struct socket *so = 0;
345 int todrop, acked, ourfinisacked, needoutput = 0;
346 u_long tiwin;
347 struct tcpopt to; /* options in this segment */
348 struct rmxp_tao *taop; /* pointer to our TAO cache entry */
349 struct rmxp_tao tao_noncached; /* in case there's no cached entry */
350#ifdef TCPDEBUG
351 short ostate = 0;
352#endif
353#ifdef INET6
354 struct ip6_hdr *ip6 = NULL;
355 int isipv6;
356#endif /* INET6 */
357 int rstreason; /* For badport_bandlim accounting purposes */
358
359#ifdef INET6
360 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
361#endif
362 bzero((char *)&to, sizeof(to));
363
364 tcpstat.tcps_rcvtotal++;
365
366#ifdef INET6
367 if (isipv6) {
368 /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */
369 ip6 = mtod(m, struct ip6_hdr *);
370 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
371 if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
372 tcpstat.tcps_rcvbadsum++;
373 goto drop;
374 }
375 th = (struct tcphdr *)((caddr_t)ip6 + off0);
376
377 /*
378 * Be proactive about unspecified IPv6 address in source.
379 * As we use all-zero to indicate unbounded/unconnected pcb,
380 * unspecified IPv6 address can be used to confuse us.
381 *
382 * Note that packets with unspecified IPv6 destination is
383 * already dropped in ip6_input.
384 */
385 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
386 /* XXX stat */
387 goto drop;
388 }
389 } else
390#endif /* INET6 */
391 {
392 /*
393 * Get IP and TCP header together in first mbuf.
394 * Note: IP leaves IP header in first mbuf.
395 */
396 if (off0 > sizeof (struct ip)) {
397 ip_stripoptions(m, (struct mbuf *)0);
398 off0 = sizeof(struct ip);
399 }
400 if (m->m_len < sizeof (struct tcpiphdr)) {
401 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
402 tcpstat.tcps_rcvshort++;
403 return;
404 }
405 }
406 ip = mtod(m, struct ip *);
407 ipov = (struct ipovly *)ip;
408 th = (struct tcphdr *)((caddr_t)ip + off0);
409 tlen = ip->ip_len;
410
411 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
412 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
413 th->th_sum = m->m_pkthdr.csum_data;
414 else
415 th->th_sum = in_pseudo(ip->ip_src.s_addr,
416 ip->ip_dst.s_addr, htonl(m->m_pkthdr.csum_data +
417 ip->ip_len + IPPROTO_TCP));
418 th->th_sum ^= 0xffff;
419 } else {
420 /*
421 * Checksum extended TCP header and data.
422 */
423 len = sizeof (struct ip) + tlen;
424 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
425 ipov->ih_len = (u_short)tlen;
426 ipov->ih_len = htons(ipov->ih_len);
427 th->th_sum = in_cksum(m, len);
428 }
429 if (th->th_sum) {
430 tcpstat.tcps_rcvbadsum++;
431 goto drop;
432 }
433#ifdef INET6
434 /* Re-initialization for later version check */
435 ip->ip_v = IPVERSION;
436#endif
437 }
438
439 /*
440 * Check that TCP offset makes sense,
441 * pull out TCP options and adjust length. XXX
442 */
443 off = th->th_off << 2;
444 if (off < sizeof (struct tcphdr) || off > tlen) {
445 tcpstat.tcps_rcvbadoff++;
446 goto drop;
447 }
448 tlen -= off; /* tlen is used instead of ti->ti_len */
449 if (off > sizeof (struct tcphdr)) {
450#ifdef INET6
451 if (isipv6) {
452 IP6_EXTHDR_CHECK(m, off0, off, );
453 ip6 = mtod(m, struct ip6_hdr *);
454 th = (struct tcphdr *)((caddr_t)ip6 + off0);
455 } else
456#endif /* INET6 */
457 {
458 if (m->m_len < sizeof(struct ip) + off) {
459 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
460 tcpstat.tcps_rcvshort++;
461 return;
462 }
463 ip = mtod(m, struct ip *);
464 ipov = (struct ipovly *)ip;
465 th = (struct tcphdr *)((caddr_t)ip + off0);
466 }
467 }
468 optlen = off - sizeof (struct tcphdr);
469 optp = (u_char *)(th + 1);
470 }
471 thflags = th->th_flags;
472
473#ifdef TCP_DROP_SYNFIN
474 /*
475 * If the drop_synfin option is enabled, drop all packets with
476 * both the SYN and FIN bits set. This prevents e.g. nmap from
477 * identifying the TCP/IP stack.
478 *
479 * This is a violation of the TCP specification.
480 */
481 if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN))
482 goto drop;
483#endif
484
485 /*
486 * Convert TCP protocol specific fields to host format.
487 */
488 th->th_seq = ntohl(th->th_seq);
489 th->th_ack = ntohl(th->th_ack);
490 th->th_win = ntohs(th->th_win);
491 th->th_urp = ntohs(th->th_urp);
492
493 /*
494 * Delay droping TCP, IP headers, IPv6 ext headers, and TCP options,
495 * until after ip6_savecontrol() is called and before other functions
496 * which don't want those proto headers.
497 * Because ip6_savecontrol() is going to parse the mbuf to
498 * search for data to be passed up to user-land, it wants mbuf
499 * parameters to be unchanged.
500 * XXX: the call of ip6_savecontrol() has been obsoleted based on
501 * latest version of the advanced API (20020110).
502 */
503 drop_hdrlen = off0 + off;
504
505 /*
506 * Locate pcb for segment.
507 */
508findpcb:
509#ifdef IPFIREWALL_FORWARD
510 if (ip_fw_fwd_addr != NULL
511#ifdef INET6
512 && isipv6 == NULL /* IPv6 support is not yet */
513#endif /* INET6 */
514 ) {
515 /*
516 * Diverted. Pretend to be the destination.
517 * already got one like this?
518 */
519 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
520 ip->ip_dst, th->th_dport, 0, m->m_pkthdr.rcvif);
521 if (!inp) {
522 /*
523 * No, then it's new. Try find the ambushing socket
524 */
525 if (!ip_fw_fwd_addr->sin_port) {
526 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src,
527 th->th_sport, ip_fw_fwd_addr->sin_addr,
528 th->th_dport, 1, m->m_pkthdr.rcvif);
529 } else {
530 inp = in_pcblookup_hash(&tcbinfo,
531 ip->ip_src, th->th_sport,
532 ip_fw_fwd_addr->sin_addr,
533 ntohs(ip_fw_fwd_addr->sin_port), 1,
534 m->m_pkthdr.rcvif);
535 }
536 }
537 ip_fw_fwd_addr = NULL;
538 } else
539#endif /* IPFIREWALL_FORWARD */
540 {
541#ifdef INET6
542 if (isipv6)
543 inp = in6_pcblookup_hash(&tcbinfo, &ip6->ip6_src, th->th_sport,
544 &ip6->ip6_dst, th->th_dport, 1,
545 m->m_pkthdr.rcvif);
546 else
547#endif /* INET6 */
548 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
549 ip->ip_dst, th->th_dport, 1, m->m_pkthdr.rcvif);
550 }
551
552#ifdef IPSEC
553#ifdef INET6
554 if (isipv6) {
555 if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
556 ipsec6stat.in_polvio++;
557 goto drop;
558 }
559 } else
560#endif /* INET6 */
561 if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
562 ipsecstat.in_polvio++;
563 goto drop;
564 }
565#endif /*IPSEC*/
566
567 /*
568 * If the state is CLOSED (i.e., TCB does not exist) then
569 * all data in the incoming segment is discarded.
570 * If the TCB exists but is in CLOSED state, it is embryonic,
571 * but should either do a listen or a connect soon.
572 */
573 if (inp == NULL) {
574 if (log_in_vain) {
575#ifdef INET6
576 char dbuf[INET6_ADDRSTRLEN], sbuf[INET6_ADDRSTRLEN];
577#else /* INET6 */
578 char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"];
579#endif /* INET6 */
580
581#ifdef INET6
582 if (isipv6) {
583 strcpy(dbuf, ip6_sprintf(&ip6->ip6_dst));
584 strcpy(sbuf, ip6_sprintf(&ip6->ip6_src));
585 } else
586#endif
587 {
588 strcpy(dbuf, inet_ntoa(ip->ip_dst));
589 strcpy(sbuf, inet_ntoa(ip->ip_src));
590 }
591 switch (log_in_vain) {
592 case 1:
593 if(thflags & TH_SYN)
594 log(LOG_INFO,
595 "Connection attempt to TCP %s:%d from %s:%d\n",
596 dbuf, ntohs(th->th_dport),
597 sbuf,
598 ntohs(th->th_sport));
599 break;
600 case 2:
601 log(LOG_INFO,
602 "Connection attempt to TCP %s:%d from %s:%d flags:0x%x\n",
603 dbuf, ntohs(th->th_dport), sbuf,
604 ntohs(th->th_sport), thflags);
605 break;
606 default:
607 break;
608 }
609 }
610 if (blackhole) {
611 switch (blackhole) {
612 case 1:
613 if (thflags & TH_SYN)
614 goto drop;
615 break;
616 case 2:
617 goto drop;
618 default:
619 goto drop;
620 }
621 }
622 rstreason = BANDLIM_RST_CLOSEDPORT;
623 goto dropwithreset;
624 }
625 tp = intotcpcb(inp);
626 if (tp == 0) {
627 rstreason = BANDLIM_RST_CLOSEDPORT;
628 goto dropwithreset;
629 }
630 if (tp->t_state == TCPS_CLOSED)
631 goto drop;
632
633 /* Unscale the window into a 32-bit value. */
634 if ((thflags & TH_SYN) == 0)
635 tiwin = th->th_win << tp->snd_scale;
636 else
637 tiwin = th->th_win;
638
639 so = inp->inp_socket;
640 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
641 struct in_conninfo inc;
642#ifdef TCPDEBUG
643 if (so->so_options & SO_DEBUG) {
644 ostate = tp->t_state;
645#ifdef INET6
646 if (isipv6)
647 bcopy((char *)ip6, (char *)tcp_saveipgen,
648 sizeof(*ip6));
649 else
650#endif /* INET6 */
651 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
652 tcp_savetcp = *th;
653 }
654#endif
655 /* skip if this isn't a listen socket */
656 if ((so->so_options & SO_ACCEPTCONN) == 0)
657 goto after_listen;
658#ifdef INET6
659 inc.inc_isipv6 = isipv6;
660 if (isipv6) {
661 inc.inc6_faddr = ip6->ip6_src;
662 inc.inc6_laddr = ip6->ip6_dst;
663 inc.inc6_route.ro_rt = NULL; /* XXX */
664
665 } else
666#endif /* INET6 */
667 {
668 inc.inc_faddr = ip->ip_src;
669 inc.inc_laddr = ip->ip_dst;
670 inc.inc_route.ro_rt = NULL; /* XXX */
671 }
672 inc.inc_fport = th->th_sport;
673 inc.inc_lport = th->th_dport;
674
675 /*
676 * If the state is LISTEN then ignore segment if it contains
677 * a RST. If the segment contains an ACK then it is bad and
678 * send a RST. If it does not contain a SYN then it is not
679 * interesting; drop it.
680 *
681 * If the state is SYN_RECEIVED (syncache) and seg contains
682 * an ACK, but not for our SYN/ACK, send a RST. If the seg
683 * contains a RST, check the sequence number to see if it
684 * is a valid reset segment.
685 */
686 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
687 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
688 if (!syncache_expand(&inc, th, &so, m)) {
689 /*
690 * No syncache entry, or ACK was not
691 * for our SYN/ACK. Send a RST.
692 */
693 tcpstat.tcps_badsyn++;
694 rstreason = BANDLIM_RST_OPENPORT;
695 goto dropwithreset;
696 }
697 if (so == NULL)
698 /*
699 * Could not complete 3-way handshake,
700 * connection is being closed down, and
701 * syncache will free mbuf.
702 */
703 return;
704 /*
705 * Socket is created in state SYN_RECEIVED.
706 * Continue processing segment.
707 */
708 inp = sotoinpcb(so);
709 tp = intotcpcb(inp);
710 /*
711 * This is what would have happened in
712 * tcp_output() when the SYN,ACK was sent.
713 */
714 tp->snd_up = tp->snd_una;
715 tp->snd_max = tp->snd_nxt = tp->iss + 1;
716 tp->last_ack_sent = tp->rcv_nxt;
717/*
718 * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled
719 * until the _second_ ACK is received:
720 * rcv SYN (set wscale opts) --> send SYN/ACK, set snd_wnd = window.
721 * rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale,
722 * move to ESTAB, set snd_wnd to tiwin.
723 */
724 tp->snd_wnd = tiwin; /* unscaled */
725 goto after_listen;
726 }
727 if (thflags & TH_RST) {
728 syncache_chkrst(&inc, th);
729 goto drop;
730 }
731 if (thflags & TH_ACK) {
732 syncache_badack(&inc);
733 tcpstat.tcps_badsyn++;
734 rstreason = BANDLIM_RST_OPENPORT;
735 goto dropwithreset;
736 }
737 goto drop;
738 }
739
740 /*
741 * Segment's flags are (SYN) or (SYN|FIN).
742 */
743#ifdef INET6
744 /*
745 * If deprecated address is forbidden,
746 * we do not accept SYN to deprecated interface
747 * address to prevent any new inbound connection from
748 * getting established.
749 * When we do not accept SYN, we send a TCP RST,
750 * with deprecated source address (instead of dropping
751 * it). We compromise it as it is much better for peer
752 * to send a RST, and RST will be the final packet
753 * for the exchange.
754 *
755 * If we do not forbid deprecated addresses, we accept
756 * the SYN packet. RFC2462 does not suggest dropping
757 * SYN in this case.
758 * If we decipher RFC2462 5.5.4, it says like this:
759 * 1. use of deprecated addr with existing
760 * communication is okay - "SHOULD continue to be
761 * used"
762 * 2. use of it with new communication:
763 * (2a) "SHOULD NOT be used if alternate address
764 * with sufficient scope is available"
765 * (2b) nothing mentioned otherwise.
766 * Here we fall into (2b) case as we have no choice in
767 * our source address selection - we must obey the peer.
768 *
769 * The wording in RFC2462 is confusing, and there are
770 * multiple description text for deprecated address
771 * handling - worse, they are not exactly the same.
772 * I believe 5.5.4 is the best one, so we follow 5.5.4.
773 */
774 if (isipv6 && !ip6_use_deprecated) {
775 struct in6_ifaddr *ia6;
776
777 if ((ia6 = ip6_getdstifaddr(m)) &&
778 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
779 tp = NULL;
780 rstreason = BANDLIM_RST_OPENPORT;
781 goto dropwithreset;
782 }
783 }
784#endif
785 /*
786 * If it is from this socket, drop it, it must be forged.
787 * Don't bother responding if the destination was a broadcast.
788 */
789 if (th->th_dport == th->th_sport) {
790#ifdef INET6
791 if (isipv6) {
792 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
793 &ip6->ip6_src))
794 goto drop;
795 } else
796#endif /* INET6 */
797 if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
798 goto drop;
799 }
800 /*
801 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
802 *
803 * Note that it is quite possible to receive unicast
804 * link-layer packets with a broadcast IP address. Use
805 * in_broadcast() to find them.
806 */
807 if (m->m_flags & (M_BCAST|M_MCAST))
808 goto drop;
809#ifdef INET6
810 if (isipv6) {
811 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
812 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
813 goto drop;
814 } else
815#endif
816 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
817 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
818 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
819 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
820 goto drop;
821 /*
822 * SYN appears to be valid; create compressed TCP state
823 * for syncache, or perform t/tcp connection.
824 */
825 if (so->so_qlen <= so->so_qlimit) {
826 tcp_dooptions(&to, optp, optlen, 1);
827 if (!syncache_add(&inc, &to, th, &so, m))
828 goto drop;
829 if (so == NULL)
830 /*
831 * Entry added to syncache, mbuf used to
832 * send SYN,ACK packet.
833 */
834 return;
835 /*
836 * Segment passed TAO tests.
837 */
838 inp = sotoinpcb(so);
839 tp = intotcpcb(inp);
840 tp->snd_wnd = tiwin;
841 tp->t_starttime = ticks;
842 tp->t_state = TCPS_ESTABLISHED;
843
844 /*
845 * If there is a FIN, or if there is data and the
846 * connection is local, then delay SYN,ACK(SYN) in
847 * the hope of piggy-backing it on a response
848 * segment. Otherwise must send ACK now in case
849 * the other side is slow starting.
850 */
851 if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
852 (tlen != 0 &&
853#ifdef INET6
854 ((isipv6 && in6_localaddr(&inp->in6p_faddr))
855 ||
856 (!isipv6 &&
857#endif
858 in_localaddr(inp->inp_faddr)
859#ifdef INET6
860 ))
861#endif
862 ))) {
863 callout_reset(tp->tt_delack, tcp_delacktime,
864 tcp_timer_delack, tp);
865 tp->t_flags |= TF_NEEDSYN;
866 } else
867 tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
868
869 tcpstat.tcps_connects++;
870 soisconnected(so);
871 goto trimthenstep6;
872 }
873 goto drop;
874 }
875after_listen:
876
877/* XXX temp debugging */
878 /* should not happen - syncache should pick up these connections */
879 if (tp->t_state == TCPS_LISTEN)
880 panic("tcp_input: TCPS_LISTEN");
881
882 /*
883 * Segment received on connection.
884 * Reset idle time and keep-alive timer.
885 */
886 tp->t_rcvtime = ticks;
887 if (TCPS_HAVEESTABLISHED(tp->t_state))
888 callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
889
890 /*
891 * Process options.
892 * XXX this is tradtitional behavior, may need to be cleaned up.
893 */
894 tcp_dooptions(&to, optp, optlen, thflags & TH_SYN);
895 if (thflags & TH_SYN) {
896 if (to.to_flags & TOF_SCALE) {
897 tp->t_flags |= TF_RCVD_SCALE;
898 tp->requested_s_scale = to.to_requested_s_scale;
899 }
900 if (to.to_flags & TOF_TS) {
901 tp->t_flags |= TF_RCVD_TSTMP;
902 tp->ts_recent = to.to_tsval;
903 tp->ts_recent_age = ticks;
904 }
905 if (to.to_flags & (TOF_CC|TOF_CCNEW))
906 tp->t_flags |= TF_RCVD_CC;
907 if (to.to_flags & TOF_MSS)
908 tcp_mss(tp, to.to_mss);
909 }
910
911 /*
912 * Header prediction: check for the two common cases
913 * of a uni-directional data xfer. If the packet has
914 * no control flags, is in-sequence, the window didn't
915 * change and we're not retransmitting, it's a
916 * candidate. If the length is zero and the ack moved
917 * forward, we're the sender side of the xfer. Just
918 * free the data acked & wake any higher level process
919 * that was blocked waiting for space. If the length
920 * is non-zero and the ack didn't move, we're the
921 * receiver side. If we're getting packets in-order
922 * (the reassembly queue is empty), add the data to
923 * the socket buffer and note that we need a delayed ack.
924 * Make sure that the hidden state-flags are also off.
925 * Since we check for TCPS_ESTABLISHED above, it can only
926 * be TH_NEEDSYN.
927 */
928 if (tp->t_state == TCPS_ESTABLISHED &&
929 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
930 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
931 ((to.to_flags & TOF_TS) == 0 ||
932 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
933 /*
934 * Using the CC option is compulsory if once started:
935 * the segment is OK if no T/TCP was negotiated or
936 * if the segment has a CC option equal to CCrecv
937 */
938 ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) ||
939 ((to.to_flags & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
940 th->th_seq == tp->rcv_nxt &&
941 tiwin && tiwin == tp->snd_wnd &&
942 tp->snd_nxt == tp->snd_max) {
943
944 /*
945 * If last ACK falls within this segment's sequence numbers,
946 * record the timestamp.
947 * NOTE that the test is modified according to the latest
948 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
949 */
950 if ((to.to_flags & TOF_TS) != 0 &&
951 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
952 tp->ts_recent_age = ticks;
953 tp->ts_recent = to.to_tsval;
954 }
955
956 if (tlen == 0) {
957 if (SEQ_GT(th->th_ack, tp->snd_una) &&
958 SEQ_LEQ(th->th_ack, tp->snd_max) &&
959 tp->snd_cwnd >= tp->snd_wnd &&
960 tp->t_dupacks < tcprexmtthresh) {
961 /*
962 * this is a pure ack for outstanding data.
963 */
964 ++tcpstat.tcps_predack;
965 /*
966 * "bad retransmit" recovery
967 */
968 if (tp->t_rxtshift == 1 &&
969 ticks < tp->t_badrxtwin) {
970 tp->snd_cwnd = tp->snd_cwnd_prev;
971 tp->snd_ssthresh =
972 tp->snd_ssthresh_prev;
973 tp->snd_nxt = tp->snd_max;
974 tp->t_badrxtwin = 0;
975 }
976 if ((to.to_flags & TOF_TS) != 0)
977 tcp_xmit_timer(tp,
978 ticks - to.to_tsecr + 1);
979 else if (tp->t_rtttime &&
980 SEQ_GT(th->th_ack, tp->t_rtseq))
981 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
982 acked = th->th_ack - tp->snd_una;
983 tcpstat.tcps_rcvackpack++;
984 tcpstat.tcps_rcvackbyte += acked;
985 sbdrop(&so->so_snd, acked);
986 tp->snd_una = th->th_ack;
987 m_freem(m);
988 ND6_HINT(tp); /* some progress has been done */
989
990 /*
991 * If all outstanding data are acked, stop
992 * retransmit timer, otherwise restart timer
993 * using current (possibly backed-off) value.
994 * If process is waiting for space,
995 * wakeup/selwakeup/signal. If data
996 * are ready to send, let tcp_output
997 * decide between more output or persist.
998 */
999 if (tp->snd_una == tp->snd_max)
1000 callout_stop(tp->tt_rexmt);
1001 else if (!callout_active(tp->tt_persist))
1002 callout_reset(tp->tt_rexmt,
1003 tp->t_rxtcur,
1004 tcp_timer_rexmt, tp);
1005
1006 sowwakeup(so);
1007 if (so->so_snd.sb_cc)
1008 (void) tcp_output(tp);
1009 return;
1010 }
1011 } else if (th->th_ack == tp->snd_una &&
1012 LIST_EMPTY(&tp->t_segq) &&
1013 tlen <= sbspace(&so->so_rcv)) {
1014 /*
1015 * this is a pure, in-sequence data packet
1016 * with nothing on the reassembly queue and
1017 * we have enough buffer space to take it.
1018 */
1019 ++tcpstat.tcps_preddat;
1020 tp->rcv_nxt += tlen;
1021 tcpstat.tcps_rcvpack++;
1022 tcpstat.tcps_rcvbyte += tlen;
1023 ND6_HINT(tp); /* some progress has been done */
1024 /*
1025 * Add data to socket buffer.
1026 */
1027 m_adj(m, drop_hdrlen); /* delayed header drop */
1028 sbappend(&so->so_rcv, m);
1029 sorwakeup(so);
1030 if (DELAY_ACK(tp)) {
1031 callout_reset(tp->tt_delack, tcp_delacktime,
1032 tcp_timer_delack, tp);
1033 } else {
1034 tp->t_flags |= TF_ACKNOW;
1035 tcp_output(tp);
1036 }
1037 return;
1038 }
1039 }
1040
1041 /*
1042 * Calculate amount of space in receive window,
1043 * and then do TCP input processing.
1044 * Receive window is amount of space in rcv queue,
1045 * but not less than advertised window.
1046 */
1047 { int win;
1048
1049 win = sbspace(&so->so_rcv);
1050 if (win < 0)
1051 win = 0;
1052 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1053 }
1054
1055 switch (tp->t_state) {
1056
1057 /*
1058 * If the state is SYN_RECEIVED:
1059 * if seg contains an ACK, but not for our SYN/ACK, send a RST.
1060 */
1061 case TCPS_SYN_RECEIVED:
1062 if ((thflags & TH_ACK) &&
1063 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1064 SEQ_GT(th->th_ack, tp->snd_max))) {
1065 rstreason = BANDLIM_RST_OPENPORT;
1066 goto dropwithreset;
1067 }
1068 break;
1069
1070 /*
1071 * If the state is SYN_SENT:
1072 * if seg contains an ACK, but not for our SYN, drop the input.
1073 * if seg contains a RST, then drop the connection.
1074 * if seg does not contain SYN, then drop it.
1075 * Otherwise this is an acceptable SYN segment
1076 * initialize tp->rcv_nxt and tp->irs
1077 * if seg contains ack then advance tp->snd_una
1078 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1079 * arrange for segment to be acked (eventually)
1080 * continue processing rest of data/controls, beginning with URG
1081 */
1082 case TCPS_SYN_SENT:
1083 if ((taop = tcp_gettaocache(&inp->inp_inc)) == NULL) {
1084 taop = &tao_noncached;
1085 bzero(taop, sizeof(*taop));
1086 }
1087
1088 if ((thflags & TH_ACK) &&
1089 (SEQ_LEQ(th->th_ack, tp->iss) ||
1090 SEQ_GT(th->th_ack, tp->snd_max))) {
1091 /*
1092 * If we have a cached CCsent for the remote host,
1093 * hence we haven't just crashed and restarted,
1094 * do not send a RST. This may be a retransmission
1095 * from the other side after our earlier ACK was lost.
1096 * Our new SYN, when it arrives, will serve as the
1097 * needed ACK.
1098 */
1099 if (taop->tao_ccsent != 0)
1100 goto drop;
1101 else {
1102 rstreason = BANDLIM_UNLIMITED;
1103 goto dropwithreset;
1104 }
1105 }
1106 if (thflags & TH_RST) {
1107 if (thflags & TH_ACK)
1108 tp = tcp_drop(tp, ECONNREFUSED);
1109 goto drop;
1110 }
1111 if ((thflags & TH_SYN) == 0)
1112 goto drop;
1113 tp->snd_wnd = th->th_win; /* initial send window */
1114 tp->cc_recv = to.to_cc; /* foreign CC */
1115
1116 tp->irs = th->th_seq;
1117 tcp_rcvseqinit(tp);
1118 if (thflags & TH_ACK) {
1119 /*
1120 * Our SYN was acked. If segment contains CC.ECHO
1121 * option, check it to make sure this segment really
1122 * matches our SYN. If not, just drop it as old
1123 * duplicate, but send an RST if we're still playing
1124 * by the old rules. If no CC.ECHO option, make sure
1125 * we don't get fooled into using T/TCP.
1126 */
1127 if (to.to_flags & TOF_CCECHO) {
1128 if (tp->cc_send != to.to_ccecho) {
1129 if (taop->tao_ccsent != 0)
1130 goto drop;
1131 else {
1132 rstreason = BANDLIM_UNLIMITED;
1133 goto dropwithreset;
1134 }
1135 }
1136 } else
1137 tp->t_flags &= ~TF_RCVD_CC;
1138 tcpstat.tcps_connects++;
1139 soisconnected(so);
1140 /* Do window scaling on this connection? */
1141 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1142 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1143 tp->snd_scale = tp->requested_s_scale;
1144 tp->rcv_scale = tp->request_r_scale;
1145 }
1146 /* Segment is acceptable, update cache if undefined. */
1147 if (taop->tao_ccsent == 0)
1148 taop->tao_ccsent = to.to_ccecho;
1149
1150 tp->rcv_adv += tp->rcv_wnd;
1151 tp->snd_una++; /* SYN is acked */
1152 /*
1153 * If there's data, delay ACK; if there's also a FIN
1154 * ACKNOW will be turned on later.
1155 */
1156 if (DELAY_ACK(tp) && tlen != 0)
1157 callout_reset(tp->tt_delack, tcp_delacktime,
1158 tcp_timer_delack, tp);
1159 else
1160 tp->t_flags |= TF_ACKNOW;
1161 /*
1162 * Received <SYN,ACK> in SYN_SENT[*] state.
1163 * Transitions:
1164 * SYN_SENT --> ESTABLISHED
1165 * SYN_SENT* --> FIN_WAIT_1
1166 */
1167 tp->t_starttime = ticks;
1168 if (tp->t_flags & TF_NEEDFIN) {
1169 tp->t_state = TCPS_FIN_WAIT_1;
1170 tp->t_flags &= ~TF_NEEDFIN;
1171 thflags &= ~TH_SYN;
1172 } else {
1173 tp->t_state = TCPS_ESTABLISHED;
1174 callout_reset(tp->tt_keep, tcp_keepidle,
1175 tcp_timer_keep, tp);
1176 }
1177 } else {
1178 /*
1179 * Received initial SYN in SYN-SENT[*] state => simul-
1180 * taneous open. If segment contains CC option and there is
1181 * a cached CC, apply TAO test; if it succeeds, connection is
1182 * half-synchronized. Otherwise, do 3-way handshake:
1183 * SYN-SENT -> SYN-RECEIVED
1184 * SYN-SENT* -> SYN-RECEIVED*
1185 * If there was no CC option, clear cached CC value.
1186 */
1187 tp->t_flags |= TF_ACKNOW;
1188 callout_stop(tp->tt_rexmt);
1189 if (to.to_flags & TOF_CC) {
1190 if (taop->tao_cc != 0 &&
1191 CC_GT(to.to_cc, taop->tao_cc)) {
1192 /*
1193 * update cache and make transition:
1194 * SYN-SENT -> ESTABLISHED*
1195 * SYN-SENT* -> FIN-WAIT-1*
1196 */
1197 taop->tao_cc = to.to_cc;
1198 tp->t_starttime = ticks;
1199 if (tp->t_flags & TF_NEEDFIN) {
1200 tp->t_state = TCPS_FIN_WAIT_1;
1201 tp->t_flags &= ~TF_NEEDFIN;
1202 } else {
1203 tp->t_state = TCPS_ESTABLISHED;
1204 callout_reset(tp->tt_keep,
1205 tcp_keepidle,
1206 tcp_timer_keep,
1207 tp);
1208 }
1209 tp->t_flags |= TF_NEEDSYN;
1210 } else
1211 tp->t_state = TCPS_SYN_RECEIVED;
1212 } else {
1213 /* CC.NEW or no option => invalidate cache */
1214 taop->tao_cc = 0;
1215 tp->t_state = TCPS_SYN_RECEIVED;
1216 }
1217 }
1218
1219trimthenstep6:
1220 /*
1221 * Advance th->th_seq to correspond to first data byte.
1222 * If data, trim to stay within window,
1223 * dropping FIN if necessary.
1224 */
1225 th->th_seq++;
1226 if (tlen > tp->rcv_wnd) {
1227 todrop = tlen - tp->rcv_wnd;
1228 m_adj(m, -todrop);
1229 tlen = tp->rcv_wnd;
1230 thflags &= ~TH_FIN;
1231 tcpstat.tcps_rcvpackafterwin++;
1232 tcpstat.tcps_rcvbyteafterwin += todrop;
1233 }
1234 tp->snd_wl1 = th->th_seq - 1;
1235 tp->rcv_up = th->th_seq;
1236 /*
1237 * Client side of transaction: already sent SYN and data.
1238 * If the remote host used T/TCP to validate the SYN,
1239 * our data will be ACK'd; if so, enter normal data segment
1240 * processing in the middle of step 5, ack processing.
1241 * Otherwise, goto step 6.
1242 */
1243 if (thflags & TH_ACK)
1244 goto process_ACK;
1245 goto step6;
1246 /*
1247 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1248 * if segment contains a SYN and CC [not CC.NEW] option:
1249 * if state == TIME_WAIT and connection duration > MSL,
1250 * drop packet and send RST;
1251 *
1252 * if SEG.CC > CCrecv then is new SYN, and can implicitly
1253 * ack the FIN (and data) in retransmission queue.
1254 * Complete close and delete TCPCB. Then reprocess
1255 * segment, hoping to find new TCPCB in LISTEN state;
1256 *
1257 * else must be old SYN; drop it.
1258 * else do normal processing.
1259 */
1260 case TCPS_LAST_ACK:
1261 case TCPS_CLOSING:
1262 case TCPS_TIME_WAIT:
1263 if ((thflags & TH_SYN) &&
1264 (to.to_flags & TOF_CC) && tp->cc_recv != 0) {
1265 if (tp->t_state == TCPS_TIME_WAIT &&
1266 (ticks - tp->t_starttime) > tcp_msl) {
1267 rstreason = BANDLIM_UNLIMITED;
1268 goto dropwithreset;
1269 }
1270 if (CC_GT(to.to_cc, tp->cc_recv)) {
1271 tp = tcp_close(tp);
1272 goto findpcb;
1273 }
1274 else
1275 goto drop;
1276 }
1277 break; /* continue normal processing */
1278 }
1279
1280 /*
1281 * States other than LISTEN or SYN_SENT.
1282 * First check the RST flag and sequence number since reset segments
1283 * are exempt from the timestamp and connection count tests. This
1284 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1285 * below which allowed reset segments in half the sequence space
1286 * to fall though and be processed (which gives forged reset
1287 * segments with a random sequence number a 50 percent chance of
1288 * killing a connection).
1289 * Then check timestamp, if present.
1290 * Then check the connection count, if present.
1291 * Then check that at least some bytes of segment are within
1292 * receive window. If segment begins before rcv_nxt,
1293 * drop leading data (and SYN); if nothing left, just ack.
1294 *
1295 *
1296 * If the RST bit is set, check the sequence number to see
1297 * if this is a valid reset segment.
1298 * RFC 793 page 37:
1299 * In all states except SYN-SENT, all reset (RST) segments
1300 * are validated by checking their SEQ-fields. A reset is
1301 * valid if its sequence number is in the window.
1302 * Note: this does not take into account delayed ACKs, so
1303 * we should test against last_ack_sent instead of rcv_nxt.
1304 * The sequence number in the reset segment is normally an
1305 * echo of our outgoing acknowlegement numbers, but some hosts
1306 * send a reset with the sequence number at the rightmost edge
1307 * of our receive window, and we have to handle this case.
1308 * If we have multiple segments in flight, the intial reset
1309 * segment sequence numbers will be to the left of last_ack_sent,
1310 * but they will eventually catch up.
1311 * In any case, it never made sense to trim reset segments to
1312 * fit the receive window since RFC 1122 says:
1313 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
1314 *
1315 * A TCP SHOULD allow a received RST segment to include data.
1316 *
1317 * DISCUSSION
1318 * It has been suggested that a RST segment could contain
1319 * ASCII text that encoded and explained the cause of the
1320 * RST. No standard has yet been established for such
1321 * data.
1322 *
1323 * If the reset segment passes the sequence number test examine
1324 * the state:
1325 * SYN_RECEIVED STATE:
1326 * If passive open, return to LISTEN state.
1327 * If active open, inform user that connection was refused.
1328 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
1329 * Inform user that connection was reset, and close tcb.
1330 * CLOSING, LAST_ACK STATES:
1331 * Close the tcb.
1332 * TIME_WAIT STATE:
1333 * Drop the segment - see Stevens, vol. 2, p. 964 and
1334 * RFC 1337.
1335 */
1336 if (thflags & TH_RST) {
1337 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
1338 SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
1339 switch (tp->t_state) {
1340
1341 case TCPS_SYN_RECEIVED:
1342 so->so_error = ECONNREFUSED;
1343 goto close;
1344
1345 case TCPS_ESTABLISHED:
1346 case TCPS_FIN_WAIT_1:
1347 case TCPS_FIN_WAIT_2:
1348 case TCPS_CLOSE_WAIT:
1349 so->so_error = ECONNRESET;
1350 close:
1351 tp->t_state = TCPS_CLOSED;
1352 tcpstat.tcps_drops++;
1353 tp = tcp_close(tp);
1354 break;
1355
1356 case TCPS_CLOSING:
1357 case TCPS_LAST_ACK:
1358 tp = tcp_close(tp);
1359 break;
1360
1361 case TCPS_TIME_WAIT:
1362 break;
1363 }
1364 }
1365 goto drop;
1366 }
1367
1368 /*
1369 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1370 * and it's less than ts_recent, drop it.
1371 */
1372 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
1373 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1374
1375 /* Check to see if ts_recent is over 24 days old. */
1376 if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1377 /*
1378 * Invalidate ts_recent. If this segment updates
1379 * ts_recent, the age will be reset later and ts_recent
1380 * will get a valid value. If it does not, setting
1381 * ts_recent to zero will at least satisfy the
1382 * requirement that zero be placed in the timestamp
1383 * echo reply when ts_recent isn't valid. The
1384 * age isn't reset until we get a valid ts_recent
1385 * because we don't want out-of-order segments to be
1386 * dropped when ts_recent is old.
1387 */
1388 tp->ts_recent = 0;
1389 } else {
1390 tcpstat.tcps_rcvduppack++;
1391 tcpstat.tcps_rcvdupbyte += tlen;
1392 tcpstat.tcps_pawsdrop++;
1393 goto dropafterack;
1394 }
1395 }
1396
1397 /*
1398 * T/TCP mechanism
1399 * If T/TCP was negotiated and the segment doesn't have CC,
1400 * or if its CC is wrong then drop the segment.
1401 * RST segments do not have to comply with this.
1402 */
1403 if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) &&
1404 ((to.to_flags & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
1405 goto dropafterack;
1406
1407 /*
1408 * In the SYN-RECEIVED state, validate that the packet belongs to
1409 * this connection before trimming the data to fit the receive
1410 * window. Check the sequence number versus IRS since we know
1411 * the sequence numbers haven't wrapped. This is a partial fix
1412 * for the "LAND" DoS attack.
1413 */
1414 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1415 rstreason = BANDLIM_RST_OPENPORT;
1416 goto dropwithreset;
1417 }
1418
1419 todrop = tp->rcv_nxt - th->th_seq;
1420 if (todrop > 0) {
1421 if (thflags & TH_SYN) {
1422 thflags &= ~TH_SYN;
1423 th->th_seq++;
1424 if (th->th_urp > 1)
1425 th->th_urp--;
1426 else
1427 thflags &= ~TH_URG;
1428 todrop--;
1429 }
1430 /*
1431 * Following if statement from Stevens, vol. 2, p. 960.
1432 */
1433 if (todrop > tlen
1434 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1435 /*
1436 * Any valid FIN must be to the left of the window.
1437 * At this point the FIN must be a duplicate or out
1438 * of sequence; drop it.
1439 */
1440 thflags &= ~TH_FIN;
1441
1442 /*
1443 * Send an ACK to resynchronize and drop any data.
1444 * But keep on processing for RST or ACK.
1445 */
1446 tp->t_flags |= TF_ACKNOW;
1447 todrop = tlen;
1448 tcpstat.tcps_rcvduppack++;
1449 tcpstat.tcps_rcvdupbyte += todrop;
1450 } else {
1451 tcpstat.tcps_rcvpartduppack++;
1452 tcpstat.tcps_rcvpartdupbyte += todrop;
1453 }
1454 drop_hdrlen += todrop; /* drop from the top afterwards */
1455 th->th_seq += todrop;
1456 tlen -= todrop;
1457 if (th->th_urp > todrop)
1458 th->th_urp -= todrop;
1459 else {
1460 thflags &= ~TH_URG;
1461 th->th_urp = 0;
1462 }
1463 }
1464
1465 /*
1466 * If new data are received on a connection after the
1467 * user processes are gone, then RST the other end.
1468 */
1469 if ((so->so_state & SS_NOFDREF) &&
1470 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1471 tp = tcp_close(tp);
1472 tcpstat.tcps_rcvafterclose++;
1473 rstreason = BANDLIM_UNLIMITED;
1474 goto dropwithreset;
1475 }
1476
1477 /*
1478 * If segment ends after window, drop trailing data
1479 * (and PUSH and FIN); if nothing left, just ACK.
1480 */
1481 todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1482 if (todrop > 0) {
1483 tcpstat.tcps_rcvpackafterwin++;
1484 if (todrop >= tlen) {
1485 tcpstat.tcps_rcvbyteafterwin += tlen;
1486 /*
1487 * If a new connection request is received
1488 * while in TIME_WAIT, drop the old connection
1489 * and start over if the sequence numbers
1490 * are above the previous ones.
1491 */
1492 if (thflags & TH_SYN &&
1493 tp->t_state == TCPS_TIME_WAIT &&
1494 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1495 tp = tcp_close(tp);
1496 goto findpcb;
1497 }
1498 /*
1499 * If window is closed can only take segments at
1500 * window edge, and have to drop data and PUSH from
1501 * incoming segments. Continue processing, but
1502 * remember to ack. Otherwise, drop segment
1503 * and ack.
1504 */
1505 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1506 tp->t_flags |= TF_ACKNOW;
1507 tcpstat.tcps_rcvwinprobe++;
1508 } else
1509 goto dropafterack;
1510 } else
1511 tcpstat.tcps_rcvbyteafterwin += todrop;
1512 m_adj(m, -todrop);
1513 tlen -= todrop;
1514 thflags &= ~(TH_PUSH|TH_FIN);
1515 }
1516
1517 /*
1518 * If last ACK falls within this segment's sequence numbers,
1519 * record its timestamp.
1520 * NOTE that the test is modified according to the latest
1521 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1522 */
1523 if ((to.to_flags & TOF_TS) != 0 &&
1524 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1525 tp->ts_recent_age = ticks;
1526 tp->ts_recent = to.to_tsval;
1527 }
1528
1529 /*
1530 * If a SYN is in the window, then this is an
1531 * error and we send an RST and drop the connection.
1532 */
1533 if (thflags & TH_SYN) {
1534 tp = tcp_drop(tp, ECONNRESET);
1535 rstreason = BANDLIM_UNLIMITED;
1536 goto dropwithreset;
1537 }
1538
1539 /*
1540 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
1541 * flag is on (half-synchronized state), then queue data for
1542 * later processing; else drop segment and return.
1543 */
1544 if ((thflags & TH_ACK) == 0) {
1545 if (tp->t_state == TCPS_SYN_RECEIVED ||
1546 (tp->t_flags & TF_NEEDSYN))
1547 goto step6;
1548 else
1549 goto drop;
1550 }
1551
1552 /*
1553 * Ack processing.
1554 */
1555 switch (tp->t_state) {
1556
1557 /*
1558 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1559 * ESTABLISHED state and continue processing.
1560 * The ACK was checked above.
1561 */
1562 case TCPS_SYN_RECEIVED:
1563
1564 tcpstat.tcps_connects++;
1565 soisconnected(so);
1566 /* Do window scaling? */
1567 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1568 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1569 tp->snd_scale = tp->requested_s_scale;
1570 tp->rcv_scale = tp->request_r_scale;
1571 }
1572 /*
1573 * Upon successful completion of 3-way handshake,
1574 * update cache.CC if it was undefined, pass any queued
1575 * data to the user, and advance state appropriately.
1576 */
1577 if ((taop = tcp_gettaocache(&inp->inp_inc)) != NULL &&
1578 taop->tao_cc == 0)
1579 taop->tao_cc = tp->cc_recv;
1580
1581 /*
1582 * Make transitions:
1583 * SYN-RECEIVED -> ESTABLISHED
1584 * SYN-RECEIVED* -> FIN-WAIT-1
1585 */
1586 tp->t_starttime = ticks;
1587 if (tp->t_flags & TF_NEEDFIN) {
1588 tp->t_state = TCPS_FIN_WAIT_1;
1589 tp->t_flags &= ~TF_NEEDFIN;
1590 } else {
1591 tp->t_state = TCPS_ESTABLISHED;
1592 callout_reset(tp->tt_keep, tcp_keepidle,
1593 tcp_timer_keep, tp);
1594 }
1595 /*
1596 * If segment contains data or ACK, will call tcp_reass()
1597 * later; if not, do so now to pass queued data to user.
1598 */
1599 if (tlen == 0 && (thflags & TH_FIN) == 0)
1600 (void) tcp_reass(tp, (struct tcphdr *)0, 0,
1601 (struct mbuf *)0);
1602 tp->snd_wl1 = th->th_seq - 1;
1603 /* fall into ... */
1604
1605 /*
1606 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1607 * ACKs. If the ack is in the range
1608 * tp->snd_una < th->th_ack <= tp->snd_max
1609 * then advance tp->snd_una to th->th_ack and drop
1610 * data from the retransmission queue. If this ACK reflects
1611 * more up to date window information we update our window information.
1612 */
1613 case TCPS_ESTABLISHED:
1614 case TCPS_FIN_WAIT_1:
1615 case TCPS_FIN_WAIT_2:
1616 case TCPS_CLOSE_WAIT:
1617 case TCPS_CLOSING:
1618 case TCPS_LAST_ACK:
1619 case TCPS_TIME_WAIT:
1620
1621 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1622 if (tlen == 0 && tiwin == tp->snd_wnd) {
1623 tcpstat.tcps_rcvdupack++;
1624 /*
1625 * If we have outstanding data (other than
1626 * a window probe), this is a completely
1627 * duplicate ack (ie, window info didn't
1628 * change), the ack is the biggest we've
1629 * seen and we've seen exactly our rexmt
1630 * threshhold of them, assume a packet
1631 * has been dropped and retransmit it.
1632 * Kludge snd_nxt & the congestion
1633 * window so we send only this one
1634 * packet.
1635 *
1636 * We know we're losing at the current
1637 * window size so do congestion avoidance
1638 * (set ssthresh to half the current window
1639 * and pull our congestion window back to
1640 * the new ssthresh).
1641 *
1642 * Dup acks mean that packets have left the
1643 * network (they're now cached at the receiver)
1644 * so bump cwnd by the amount in the receiver
1645 * to keep a constant cwnd packets in the
1646 * network.
1647 */
1648 if (!callout_active(tp->tt_rexmt) ||
1649 th->th_ack != tp->snd_una)
1650 tp->t_dupacks = 0;
1651 else if (++tp->t_dupacks == tcprexmtthresh) {
1652 tcp_seq onxt = tp->snd_nxt;
1653 u_int win =
1654 min(tp->snd_wnd, tp->snd_cwnd) / 2 /
1655 tp->t_maxseg;
1656 if (tcp_do_newreno && SEQ_LT(th->th_ack,
1657 tp->snd_recover)) {
1658 /* False retransmit, should not
1659 * cut window
1660 */
1661 tp->snd_cwnd += tp->t_maxseg;
1662 tp->t_dupacks = 0;
1663 (void) tcp_output(tp);
1664 goto drop;
1665 }
1666 if (win < 2)
1667 win = 2;
1668 tp->snd_ssthresh = win * tp->t_maxseg;
1669 tp->snd_recover = tp->snd_max;
1670 callout_stop(tp->tt_rexmt);
1671 tp->t_rtttime = 0;
1672 tp->snd_nxt = th->th_ack;
1673 tp->snd_cwnd = tp->t_maxseg;
1674 (void) tcp_output(tp);
1675 tp->snd_cwnd = tp->snd_ssthresh +
1676 tp->t_maxseg * tp->t_dupacks;
1677 if (SEQ_GT(onxt, tp->snd_nxt))
1678 tp->snd_nxt = onxt;
1679 goto drop;
1680 } else if (tp->t_dupacks > tcprexmtthresh) {
1681 tp->snd_cwnd += tp->t_maxseg;
1682 (void) tcp_output(tp);
1683 goto drop;
1684 }
1685 } else
1686 tp->t_dupacks = 0;
1687 break;
1688 }
1689 /*
1690 * If the congestion window was inflated to account
1691 * for the other side's cached packets, retract it.
1692 */
1693 if (tcp_do_newreno == 0) {
1694 if (tp->t_dupacks >= tcprexmtthresh &&
1695 tp->snd_cwnd > tp->snd_ssthresh)
1696 tp->snd_cwnd = tp->snd_ssthresh;
1697 tp->t_dupacks = 0;
1698 } else if (tp->t_dupacks >= tcprexmtthresh &&
1699 !tcp_newreno(tp, th)) {
1700 /*
1701 * Window inflation should have left us with approx.
1702 * snd_ssthresh outstanding data. But in case we
1703 * would be inclined to send a burst, better to do
1704 * it via the slow start mechanism.
1705 */
1706 if (SEQ_GT(th->th_ack + tp->snd_ssthresh, tp->snd_max))
1707 tp->snd_cwnd =
1708 tp->snd_max - th->th_ack + tp->t_maxseg;
1709 else
1710 tp->snd_cwnd = tp->snd_ssthresh;
1711 tp->t_dupacks = 0;
1712 }
1713 if (tp->t_dupacks < tcprexmtthresh)
1714 tp->t_dupacks = 0;
1715 if (SEQ_GT(th->th_ack, tp->snd_max)) {
1716 tcpstat.tcps_rcvacktoomuch++;
1717 goto dropafterack;
1718 }
1719 /*
1720 * If we reach this point, ACK is not a duplicate,
1721 * i.e., it ACKs something we sent.
1722 */
1723 if (tp->t_flags & TF_NEEDSYN) {
1724 /*
1725 * T/TCP: Connection was half-synchronized, and our
1726 * SYN has been ACK'd (so connection is now fully
1727 * synchronized). Go to non-starred state,
1728 * increment snd_una for ACK of SYN, and check if
1729 * we can do window scaling.
1730 */
1731 tp->t_flags &= ~TF_NEEDSYN;
1732 tp->snd_una++;
1733 /* Do window scaling? */
1734 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1735 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1736 tp->snd_scale = tp->requested_s_scale;
1737 tp->rcv_scale = tp->request_r_scale;
1738 }
1739 }
1740
1741process_ACK:
1742 acked = th->th_ack - tp->snd_una;
1743 tcpstat.tcps_rcvackpack++;
1744 tcpstat.tcps_rcvackbyte += acked;
1745
1746 /*
1747 * If we just performed our first retransmit, and the ACK
1748 * arrives within our recovery window, then it was a mistake
1749 * to do the retransmit in the first place. Recover our
1750 * original cwnd and ssthresh, and proceed to transmit where
1751 * we left off.
1752 */
1753 if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) {
1754 tp->snd_cwnd = tp->snd_cwnd_prev;
1755 tp->snd_ssthresh = tp->snd_ssthresh_prev;
1756 tp->snd_nxt = tp->snd_max;
1757 tp->t_badrxtwin = 0; /* XXX probably not required */
1758 }
1759
1760 /*
1761 * If we have a timestamp reply, update smoothed
1762 * round trip time. If no timestamp is present but
1763 * transmit timer is running and timed sequence
1764 * number was acked, update smoothed round trip time.
1765 * Since we now have an rtt measurement, cancel the
1766 * timer backoff (cf., Phil Karn's retransmit alg.).
1767 * Recompute the initial retransmit timer.
1768 */
1769 if (to.to_flags & TOF_TS)
1770 tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
1771 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
1772 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
1773
1774 /*
1775 * If all outstanding data is acked, stop retransmit
1776 * timer and remember to restart (more output or persist).
1777 * If there is more data to be acked, restart retransmit
1778 * timer, using current (possibly backed-off) value.
1779 */
1780 if (th->th_ack == tp->snd_max) {
1781 callout_stop(tp->tt_rexmt);
1782 needoutput = 1;
1783 } else if (!callout_active(tp->tt_persist))
1784 callout_reset(tp->tt_rexmt, tp->t_rxtcur,
1785 tcp_timer_rexmt, tp);
1786
1787 /*
1788 * If no data (only SYN) was ACK'd,
1789 * skip rest of ACK processing.
1790 */
1791 if (acked == 0)
1792 goto step6;
1793
1794 /*
1795 * When new data is acked, open the congestion window.
1796 * If the window gives us less than ssthresh packets
1797 * in flight, open exponentially (maxseg per packet).
1798 * Otherwise open linearly: maxseg per window
1799 * (maxseg^2 / cwnd per packet).
1800 */
1801 {
1802 register u_int cw = tp->snd_cwnd;
1803 register u_int incr = tp->t_maxseg;
1804
1805 if (cw > tp->snd_ssthresh)
1806 incr = incr * incr / cw;
1807 /*
1808 * If t_dupacks != 0 here, it indicates that we are still
1809 * in NewReno fast recovery mode, so we leave the congestion
1810 * window alone.
1811 */
1812 if (tcp_do_newreno == 0 || tp->t_dupacks == 0)
1813 tp->snd_cwnd = min(cw + incr,TCP_MAXWIN<<tp->snd_scale);
1814 }
1815 if (acked > so->so_snd.sb_cc) {
1816 tp->snd_wnd -= so->so_snd.sb_cc;
1817 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
1818 ourfinisacked = 1;
1819 } else {
1820 sbdrop(&so->so_snd, acked);
1821 tp->snd_wnd -= acked;
1822 ourfinisacked = 0;
1823 }
1824 sowwakeup(so);
1825 tp->snd_una = th->th_ack;
1826 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1827 tp->snd_nxt = tp->snd_una;
1828
1829 switch (tp->t_state) {
1830
1831 /*
1832 * In FIN_WAIT_1 STATE in addition to the processing
1833 * for the ESTABLISHED state if our FIN is now acknowledged
1834 * then enter FIN_WAIT_2.
1835 */
1836 case TCPS_FIN_WAIT_1:
1837 if (ourfinisacked) {
1838 /*
1839 * If we can't receive any more
1840 * data, then closing user can proceed.
1841 * Starting the timer is contrary to the
1842 * specification, but if we don't get a FIN
1843 * we'll hang forever.
1844 */
1845 SIGIO_SLOCK();
1846 if (so->so_state & SS_CANTRCVMORE) {
1847 soisdisconnected_locked(so);
1848 SIGIO_SUNLOCK();
1849 callout_reset(tp->tt_2msl, tcp_maxidle,
1850 tcp_timer_2msl, tp);
1851 } else {
1852 SIGIO_SUNLOCK();
1853 }
1854 tp->t_state = TCPS_FIN_WAIT_2;
1855 }
1856 break;
1857
1858 /*
1859 * In CLOSING STATE in addition to the processing for
1860 * the ESTABLISHED state if the ACK acknowledges our FIN
1861 * then enter the TIME-WAIT state, otherwise ignore
1862 * the segment.
1863 */
1864 case TCPS_CLOSING:
1865 if (ourfinisacked) {
1866 tp->t_state = TCPS_TIME_WAIT;
1867 tcp_canceltimers(tp);
1868 /* Shorten TIME_WAIT [RFC-1644, p.28] */
1869 if (tp->cc_recv != 0 &&
1870 (ticks - tp->t_starttime) < tcp_msl)
1871 callout_reset(tp->tt_2msl,
1872 tp->t_rxtcur *
1873 TCPTV_TWTRUNC,
1874 tcp_timer_2msl, tp);
1875 else
1876 callout_reset(tp->tt_2msl, 2 * tcp_msl,
1877 tcp_timer_2msl, tp);
1878 soisdisconnected(so);
1879 }
1880 break;
1881
1882 /*
1883 * In LAST_ACK, we may still be waiting for data to drain
1884 * and/or to be acked, as well as for the ack of our FIN.
1885 * If our FIN is now acknowledged, delete the TCB,
1886 * enter the closed state and return.
1887 */
1888 case TCPS_LAST_ACK:
1889 if (ourfinisacked) {
1890 tp = tcp_close(tp);
1891 goto drop;
1892 }
1893 break;
1894
1895 /*
1896 * In TIME_WAIT state the only thing that should arrive
1897 * is a retransmission of the remote FIN. Acknowledge
1898 * it and restart the finack timer.
1899 */
1900 case TCPS_TIME_WAIT:
1901 callout_reset(tp->tt_2msl, 2 * tcp_msl,
1902 tcp_timer_2msl, tp);
1903 goto dropafterack;
1904 }
1905 }
1906
1907step6:
1908 /*
1909 * Update window information.
1910 * Don't look at window if no ACK: TAC's send garbage on first SYN.
1911 */
1912 if ((thflags & TH_ACK) &&
1913 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
1914 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
1915 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
1916 /* keep track of pure window updates */
1917 if (tlen == 0 &&
1918 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
1919 tcpstat.tcps_rcvwinupd++;
1920 tp->snd_wnd = tiwin;
1921 tp->snd_wl1 = th->th_seq;
1922 tp->snd_wl2 = th->th_ack;
1923 if (tp->snd_wnd > tp->max_sndwnd)
1924 tp->max_sndwnd = tp->snd_wnd;
1925 needoutput = 1;
1926 }
1927
1928 /*
1929 * Process segments with URG.
1930 */
1931 if ((thflags & TH_URG) && th->th_urp &&
1932 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1933 /*
1934 * This is a kludge, but if we receive and accept
1935 * random urgent pointers, we'll crash in
1936 * soreceive. It's hard to imagine someone
1937 * actually wanting to send this much urgent data.
1938 */
1939 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
1940 th->th_urp = 0; /* XXX */
1941 thflags &= ~TH_URG; /* XXX */
1942 goto dodata; /* XXX */
1943 }
1944 /*
1945 * If this segment advances the known urgent pointer,
1946 * then mark the data stream. This should not happen
1947 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1948 * a FIN has been received from the remote side.
1949 * In these states we ignore the URG.
1950 *
1951 * According to RFC961 (Assigned Protocols),
1952 * the urgent pointer points to the last octet
1953 * of urgent data. We continue, however,
1954 * to consider it to indicate the first octet
1955 * of data past the urgent section as the original
1956 * spec states (in one of two places).
1957 */
1958 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
1959 tp->rcv_up = th->th_seq + th->th_urp;
1960 so->so_oobmark = so->so_rcv.sb_cc +
1961 (tp->rcv_up - tp->rcv_nxt) - 1;
1962 if (so->so_oobmark == 0)
1963 so->so_state |= SS_RCVATMARK;
1964 sohasoutofband(so);
1965 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1966 }
1967 /*
1968 * Remove out of band data so doesn't get presented to user.
1969 * This can happen independent of advancing the URG pointer,
1970 * but if two URG's are pending at once, some out-of-band
1971 * data may creep in... ick.
1972 */
1973 if (th->th_urp <= (u_long)tlen
1974#ifdef SO_OOBINLINE
1975 && (so->so_options & SO_OOBINLINE) == 0
1976#endif
1977 )
1978 tcp_pulloutofband(so, th, m,
1979 drop_hdrlen); /* hdr drop is delayed */
1980 } else
1981 /*
1982 * If no out of band data is expected,
1983 * pull receive urgent pointer along
1984 * with the receive window.
1985 */
1986 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1987 tp->rcv_up = tp->rcv_nxt;
1988dodata: /* XXX */
1989
1990 /*
1991 * Process the segment text, merging it into the TCP sequencing queue,
1992 * and arranging for acknowledgment of receipt if necessary.
1993 * This process logically involves adjusting tp->rcv_wnd as data
1994 * is presented to the user (this happens in tcp_usrreq.c,
1995 * case PRU_RCVD). If a FIN has already been received on this
1996 * connection then we just ignore the text.
1997 */
1998 if ((tlen || (thflags&TH_FIN)) &&
1999 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2000 m_adj(m, drop_hdrlen); /* delayed header drop */
2001 /*
2002 * Insert segment which inludes th into reassembly queue of tcp with
2003 * control block tp. Return TH_FIN if reassembly now includes
2004 * a segment with FIN. This handle the common case inline (segment
2005 * is the next to be received on an established connection, and the
2006 * queue is empty), avoiding linkage into and removal from the queue
2007 * and repetition of various conversions.
2008 * Set DELACK for segments received in order, but ack immediately
2009 * when segments are out of order (so fast retransmit can work).
2010 */
2011 if (th->th_seq == tp->rcv_nxt &&
2012 LIST_EMPTY(&tp->t_segq) &&
2013 TCPS_HAVEESTABLISHED(tp->t_state)) {
2014 if (DELAY_ACK(tp))
2015 callout_reset(tp->tt_delack, tcp_delacktime,
2016 tcp_timer_delack, tp);
2017 else
2018 tp->t_flags |= TF_ACKNOW;
2019 tp->rcv_nxt += tlen;
2020 thflags = th->th_flags & TH_FIN;
2021 tcpstat.tcps_rcvpack++;
2022 tcpstat.tcps_rcvbyte += tlen;
2023 ND6_HINT(tp);
2024 sbappend(&so->so_rcv, m);
2025 sorwakeup(so);
2026 } else {
2027 thflags = tcp_reass(tp, th, &tlen, m);
2028 tp->t_flags |= TF_ACKNOW;
2029 }
2030
2031 /*
2032 * Note the amount of data that peer has sent into
2033 * our window, in order to estimate the sender's
2034 * buffer size.
2035 */
2036 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2037 } else {
2038 m_freem(m);
2039 thflags &= ~TH_FIN;
2040 }
2041
2042 /*
2043 * If FIN is received ACK the FIN and let the user know
2044 * that the connection is closing.
2045 */
2046 if (thflags & TH_FIN) {
2047 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2048 socantrcvmore(so);
2049 /*
2050 * If connection is half-synchronized
2051 * (ie NEEDSYN flag on) then delay ACK,
2052 * so it may be piggybacked when SYN is sent.
2053 * Otherwise, since we received a FIN then no
2054 * more input can be expected, send ACK now.
2055 */
2056 if (DELAY_ACK(tp) && (tp->t_flags & TF_NEEDSYN))
2057 callout_reset(tp->tt_delack, tcp_delacktime,
2058 tcp_timer_delack, tp);
2059 else
2060 tp->t_flags |= TF_ACKNOW;
2061 tp->rcv_nxt++;
2062 }
2063 switch (tp->t_state) {
2064
2065 /*
2066 * In SYN_RECEIVED and ESTABLISHED STATES
2067 * enter the CLOSE_WAIT state.
2068 */
2069 case TCPS_SYN_RECEIVED:
2070 tp->t_starttime = ticks;
2071 /*FALLTHROUGH*/
2072 case TCPS_ESTABLISHED:
2073 tp->t_state = TCPS_CLOSE_WAIT;
2074 break;
2075
2076 /*
2077 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2078 * enter the CLOSING state.
2079 */
2080 case TCPS_FIN_WAIT_1:
2081 tp->t_state = TCPS_CLOSING;
2082 break;
2083
2084 /*
2085 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2086 * starting the time-wait timer, turning off the other
2087 * standard timers.
2088 */
2089 case TCPS_FIN_WAIT_2:
2090 tp->t_state = TCPS_TIME_WAIT;
2091 tcp_canceltimers(tp);
2092 /* Shorten TIME_WAIT [RFC-1644, p.28] */
2093 if (tp->cc_recv != 0 &&
2094 (ticks - tp->t_starttime) < tcp_msl) {
2095 callout_reset(tp->tt_2msl,
2096 tp->t_rxtcur * TCPTV_TWTRUNC,
2097 tcp_timer_2msl, tp);
2098 /* For transaction client, force ACK now. */
2099 tp->t_flags |= TF_ACKNOW;
2100 }
2101 else
2102 callout_reset(tp->tt_2msl, 2 * tcp_msl,
2103 tcp_timer_2msl, tp);
2104 soisdisconnected(so);
2105 break;
2106
2107 /*
2108 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2109 */
2110 case TCPS_TIME_WAIT:
2111 callout_reset(tp->tt_2msl, 2 * tcp_msl,
2112 tcp_timer_2msl, tp);
2113 break;
2114 }
2115 }
2116#ifdef TCPDEBUG
2117 if (so->so_options & SO_DEBUG)
2118 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2119 &tcp_savetcp, 0);
2120#endif
2121
2122 /*
2123 * Return any desired output.
2124 */
2125 if (needoutput || (tp->t_flags & TF_ACKNOW))
2126 (void) tcp_output(tp);
2127 return;
2128
2129dropafterack:
2130 /*
2131 * Generate an ACK dropping incoming segment if it occupies
2132 * sequence space, where the ACK reflects our state.
2133 *
2134 * We can now skip the test for the RST flag since all
2135 * paths to this code happen after packets containing
2136 * RST have been dropped.
2137 *
2138 * In the SYN-RECEIVED state, don't send an ACK unless the
2139 * segment we received passes the SYN-RECEIVED ACK test.
2140 * If it fails send a RST. This breaks the loop in the
2141 * "LAND" DoS attack, and also prevents an ACK storm
2142 * between two listening ports that have been sent forged
2143 * SYN segments, each with the source address of the other.
2144 */
2145 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2146 (SEQ_GT(tp->snd_una, th->th_ack) ||
2147 SEQ_GT(th->th_ack, tp->snd_max)) ) {
2148 rstreason = BANDLIM_RST_OPENPORT;
2149 goto dropwithreset;
2150 }
2151#ifdef TCPDEBUG
2152 if (so->so_options & SO_DEBUG)
2153 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2154 &tcp_savetcp, 0);
2155#endif
2156 m_freem(m);
2157 tp->t_flags |= TF_ACKNOW;
2158 (void) tcp_output(tp);
2159 return;
2160
2161dropwithreset:
2162 /*
2163 * Generate a RST, dropping incoming segment.
2164 * Make ACK acceptable to originator of segment.
2165 * Don't bother to respond if destination was broadcast/multicast.
2166 */
2167 if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2168 goto drop;
2169#ifdef INET6
2170 if (isipv6) {
2171 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2172 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2173 goto drop;
2174 } else
2175#endif /* INET6 */
2176 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2177 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2178 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2179 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2180 goto drop;
2181 /* IPv6 anycast check is done at tcp6_input() */
2182
2183 /*
2184 * Perform bandwidth limiting.
2185 */
2186 if (badport_bandlim(rstreason) < 0)
2187 goto drop;
2188
2189#ifdef TCPDEBUG
2190 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2191 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2192 &tcp_savetcp, 0);
2193#endif
2194 if (thflags & TH_ACK)
2195 /* mtod() below is safe as long as hdr dropping is delayed */
2196 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack,
2197 TH_RST);
2198 else {
2199 if (thflags & TH_SYN)
2200 tlen++;
2201 /* mtod() below is safe as long as hdr dropping is delayed */
2202 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2203 (tcp_seq)0, TH_RST|TH_ACK);
2204 }
2205 return;
2206
2207drop:
2208 /*
2209 * Drop space held by incoming segment and return.
2210 */
2211#ifdef TCPDEBUG
2212 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2213 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2214 &tcp_savetcp, 0);
2215#endif
2216 m_freem(m);
2217 return;
2218}
2219
2220/*
2221 * Parse TCP options and place in tcpopt.
2222 */
2223static void
2224tcp_dooptions(to, cp, cnt, is_syn)
2225 struct tcpopt *to;
2226 u_char *cp;
2227 int cnt;
2228{
2229 int opt, optlen;
2230
2231 to->to_flags = 0;
2232 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2233 opt = cp[0];
2234 if (opt == TCPOPT_EOL)
2235 break;
2236 if (opt == TCPOPT_NOP)
2237 optlen = 1;
2238 else {
2239 if (cnt < 2)
2240 break;
2241 optlen = cp[1];
2242 if (optlen < 2 || optlen > cnt)
2243 break;
2244 }
2245 switch (opt) {
2246 case TCPOPT_MAXSEG:
2247 if (optlen != TCPOLEN_MAXSEG)
2248 continue;
2249 if (!is_syn)
2250 continue;
2251 to->to_flags |= TOF_MSS;
2252 bcopy((char *)cp + 2,
2253 (char *)&to->to_mss, sizeof(to->to_mss));
2254 to->to_mss = ntohs(to->to_mss);
2255 break;
2256 case TCPOPT_WINDOW:
2257 if (optlen != TCPOLEN_WINDOW)
2258 continue;
2259 if (! is_syn)
2260 continue;
2261 to->to_flags |= TOF_SCALE;
2262 to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
2263 break;
2264 case TCPOPT_TIMESTAMP:
2265 if (optlen != TCPOLEN_TIMESTAMP)
2266 continue;
2267 to->to_flags |= TOF_TS;
2268 bcopy((char *)cp + 2,
2269 (char *)&to->to_tsval, sizeof(to->to_tsval));
2270 to->to_tsval = ntohl(to->to_tsval);
2271 bcopy((char *)cp + 6,
2272 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2273 to->to_tsecr = ntohl(to->to_tsecr);
2274 break;
2275 case TCPOPT_CC:
2276 if (optlen != TCPOLEN_CC)
2277 continue;
2278 to->to_flags |= TOF_CC;
2279 bcopy((char *)cp + 2,
2280 (char *)&to->to_cc, sizeof(to->to_cc));
2281 to->to_cc = ntohl(to->to_cc);
2282 break;
2283 case TCPOPT_CCNEW:
2284 if (optlen != TCPOLEN_CC)
2285 continue;
2286 if (!is_syn)
2287 continue;
2288 to->to_flags |= TOF_CCNEW;
2289 bcopy((char *)cp + 2,
2290 (char *)&to->to_cc, sizeof(to->to_cc));
2291 to->to_cc = ntohl(to->to_cc);
2292 break;
2293 case TCPOPT_CCECHO:
2294 if (optlen != TCPOLEN_CC)
2295 continue;
2296 if (!is_syn)
2297 continue;
2298 to->to_flags |= TOF_CCECHO;
2299 bcopy((char *)cp + 2,
2300 (char *)&to->to_ccecho, sizeof(to->to_ccecho));
2301 to->to_ccecho = ntohl(to->to_ccecho);
2302 break;
2303 default:
2304 continue;
2305 }
2306 }
2307}
2308
2309/*
2310 * Pull out of band byte out of a segment so
2311 * it doesn't appear in the user's data queue.
2312 * It is still reflected in the segment length for
2313 * sequencing purposes.
2314 */
2315static void
2316tcp_pulloutofband(so, th, m, off)
2317 struct socket *so;
2318 struct tcphdr *th;
2319 register struct mbuf *m;
2320 int off; /* delayed to be droped hdrlen */
2321{
2322 int cnt = off + th->th_urp - 1;
2323
2324 while (cnt >= 0) {
2325 if (m->m_len > cnt) {
2326 char *cp = mtod(m, caddr_t) + cnt;
2327 struct tcpcb *tp = sototcpcb(so);
2328
2329 tp->t_iobc = *cp;
2330 tp->t_oobflags |= TCPOOB_HAVEDATA;
2331 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2332 m->m_len--;
2333 if (m->m_flags & M_PKTHDR)
2334 m->m_pkthdr.len--;
2335 return;
2336 }
2337 cnt -= m->m_len;
2338 m = m->m_next;
2339 if (m == 0)
2340 break;
2341 }
2342 panic("tcp_pulloutofband");
2343}
2344
2345/*
2346 * Collect new round-trip time estimate
2347 * and update averages and current timeout.
2348 */
2349static void
2350tcp_xmit_timer(tp, rtt)
2351 register struct tcpcb *tp;
2352 int rtt;
2353{
2354 register int delta;
2355
2356 tcpstat.tcps_rttupdated++;
2357 tp->t_rttupdated++;
2358 if (tp->t_srtt != 0) {
2359 /*
2360 * srtt is stored as fixed point with 5 bits after the
2361 * binary point (i.e., scaled by 8). The following magic
2362 * is equivalent to the smoothing algorithm in rfc793 with
2363 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2364 * point). Adjust rtt to origin 0.
2365 */
2366 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2367 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2368
2369 if ((tp->t_srtt += delta) <= 0)
2370 tp->t_srtt = 1;
2371
2372 /*
2373 * We accumulate a smoothed rtt variance (actually, a
2374 * smoothed mean difference), then set the retransmit
2375 * timer to smoothed rtt + 4 times the smoothed variance.
2376 * rttvar is stored as fixed point with 4 bits after the
2377 * binary point (scaled by 16). The following is
2378 * equivalent to rfc793 smoothing with an alpha of .75
2379 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2380 * rfc793's wired-in beta.
2381 */
2382 if (delta < 0)
2383 delta = -delta;
2384 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2385 if ((tp->t_rttvar += delta) <= 0)
2386 tp->t_rttvar = 1;
2387 } else {
2388 /*
2389 * No rtt measurement yet - use the unsmoothed rtt.
2390 * Set the variance to half the rtt (so our first
2391 * retransmit happens at 3*rtt).
2392 */
2393 tp->t_srtt = rtt << TCP_RTT_SHIFT;
2394 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2395 }
2396 tp->t_rtttime = 0;
2397 tp->t_rxtshift = 0;
2398
2399 /*
2400 * the retransmit should happen at rtt + 4 * rttvar.
2401 * Because of the way we do the smoothing, srtt and rttvar
2402 * will each average +1/2 tick of bias. When we compute
2403 * the retransmit timer, we want 1/2 tick of rounding and
2404 * 1 extra tick because of +-1/2 tick uncertainty in the
2405 * firing of the timer. The bias will give us exactly the
2406 * 1.5 tick we need. But, because the bias is
2407 * statistical, we have to test that we don't drop below
2408 * the minimum feasible timer (which is 2 ticks).
2409 */
2410 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2411 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2412
2413 /*
2414 * We received an ack for a packet that wasn't retransmitted;
2415 * it is probably safe to discard any error indications we've
2416 * received recently. This isn't quite right, but close enough
2417 * for now (a route might have failed after we sent a segment,
2418 * and the return path might not be symmetrical).
2419 */
2420 tp->t_softerror = 0;
2421}
2422
2423/*
2424 * Determine a reasonable value for maxseg size.
2425 * If the route is known, check route for mtu.
2426 * If none, use an mss that can be handled on the outgoing
2427 * interface without forcing IP to fragment; if bigger than
2428 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2429 * to utilize large mbufs. If no route is found, route has no mtu,
2430 * or the destination isn't local, use a default, hopefully conservative
2431 * size (usually 512 or the default IP max size, but no more than the mtu
2432 * of the interface), as we can't discover anything about intervening
2433 * gateways or networks. We also initialize the congestion/slow start
2434 * window to be a single segment if the destination isn't local.
2435 * While looking at the routing entry, we also initialize other path-dependent
2436 * parameters from pre-set or cached values in the routing entry.
2437 *
2438 * Also take into account the space needed for options that we
2439 * send regularly. Make maxseg shorter by that amount to assure
2440 * that we can send maxseg amount of data even when the options
2441 * are present. Store the upper limit of the length of options plus
2442 * data in maxopd.
2443 *
2444 * NOTE that this routine is only called when we process an incoming
2445 * segment, for outgoing segments only tcp_mssopt is called.
2446 *
2447 * In case of T/TCP, we call this routine during implicit connection
2448 * setup as well (offer = -1), to initialize maxseg from the cached
2449 * MSS of our peer.
2450 */
2451void
2452tcp_mss(tp, offer)
2453 struct tcpcb *tp;
2454 int offer;
2455{
2456 register struct rtentry *rt;
2457 struct ifnet *ifp;
2458 register int rtt, mss;
2459 u_long bufsize;
2460 struct inpcb *inp;
2461 struct socket *so;
2462 struct rmxp_tao *taop;
2463 int origoffer = offer;
2464#ifdef INET6
2465 int isipv6;
2466 int min_protoh;
2467#endif
2468
2469 inp = tp->t_inpcb;
2470#ifdef INET6
2471 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2472 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
2473 : sizeof (struct tcpiphdr);
2474#else
2475#define min_protoh (sizeof (struct tcpiphdr))
2476#endif
2477#ifdef INET6
2478 if (isipv6)
2479 rt = tcp_rtlookup6(&inp->inp_inc);
2480 else
2481#endif
2482 rt = tcp_rtlookup(&inp->inp_inc);
2483 if (rt == NULL) {
2484 tp->t_maxopd = tp->t_maxseg =
2485#ifdef INET6
2486 isipv6 ? tcp_v6mssdflt :
2487#endif /* INET6 */
2488 tcp_mssdflt;
2489 return;
2490 }
2491 ifp = rt->rt_ifp;
2492 so = inp->inp_socket;
2493
2494 taop = rmx_taop(rt->rt_rmx);
2495 /*
2496 * Offer == -1 means that we didn't receive SYN yet,
2497 * use cached value in that case;
2498 */
2499 if (offer == -1)
2500 offer = taop->tao_mssopt;
2501 /*
2502 * Offer == 0 means that there was no MSS on the SYN segment,
2503 * in this case we use tcp_mssdflt.
2504 */
2505 if (offer == 0)
2506 offer =
2507#ifdef INET6
2508 isipv6 ? tcp_v6mssdflt :
2509#endif /* INET6 */
2510 tcp_mssdflt;
2511 else
2512 /*
2513 * Sanity check: make sure that maxopd will be large
2514 * enough to allow some data on segments even is the
2515 * all the option space is used (40bytes). Otherwise
2516 * funny things may happen in tcp_output.
2517 */
2518 offer = max(offer, 64);
2519 taop->tao_mssopt = offer;
2520
2521 /*
2522 * While we're here, check if there's an initial rtt
2523 * or rttvar. Convert from the route-table units
2524 * to scaled multiples of the slow timeout timer.
2525 */
2526 if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
2527 /*
2528 * XXX the lock bit for RTT indicates that the value
2529 * is also a minimum value; this is subject to time.
2530 */
2531 if (rt->rt_rmx.rmx_locks & RTV_RTT)
2532 tp->t_rttmin = rtt / (RTM_RTTUNIT / hz);
2533 tp->t_srtt = rtt / (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
2534 tcpstat.tcps_usedrtt++;
2535 if (rt->rt_rmx.rmx_rttvar) {
2536 tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
2537 (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
2538 tcpstat.tcps_usedrttvar++;
2539 } else {
2540 /* default variation is +- 1 rtt */
2541 tp->t_rttvar =
2542 tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
2543 }
2544 TCPT_RANGESET(tp->t_rxtcur,
2545 ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
2546 tp->t_rttmin, TCPTV_REXMTMAX);
2547 }
2548 /*
2549 * if there's an mtu associated with the route, use it
2550 * else, use the link mtu.
2551 */
2552 if (rt->rt_rmx.rmx_mtu)
2553 mss = rt->rt_rmx.rmx_mtu - min_protoh;
2554 else
2555 {
2556 mss =
2557#ifdef INET6
2558 (isipv6 ? nd_ifinfo[rt->rt_ifp->if_index].linkmtu :
2559#endif
2560 ifp->if_mtu
2561#ifdef INET6
2562 )
2563#endif
2564 - min_protoh;
2565#ifdef INET6
2566 if (isipv6) {
2567 if (!in6_localaddr(&inp->in6p_faddr))
2568 mss = min(mss, tcp_v6mssdflt);
2569 } else
2570#endif
2571 if (!in_localaddr(inp->inp_faddr))
2572 mss = min(mss, tcp_mssdflt);
2573 }
2574 mss = min(mss, offer);
2575 /*
2576 * maxopd stores the maximum length of data AND options
2577 * in a segment; maxseg is the amount of data in a normal
2578 * segment. We need to store this value (maxopd) apart
2579 * from maxseg, because now every segment carries options
2580 * and thus we normally have somewhat less data in segments.
2581 */
2582 tp->t_maxopd = mss;
2583
2584 /*
2585 * In case of T/TCP, origoffer==-1 indicates, that no segments
2586 * were received yet. In this case we just guess, otherwise
2587 * we do the same as before T/TCP.
2588 */
2589 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2590 (origoffer == -1 ||
2591 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
2592 mss -= TCPOLEN_TSTAMP_APPA;
2593 if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
2594 (origoffer == -1 ||
2595 (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC))
2596 mss -= TCPOLEN_CC_APPA;
2597
2598#if (MCLBYTES & (MCLBYTES - 1)) == 0
2599 if (mss > MCLBYTES)
2600 mss &= ~(MCLBYTES-1);
2601#else
2602 if (mss > MCLBYTES)
2603 mss = mss / MCLBYTES * MCLBYTES;
2604#endif
2605 /*
2606 * If there's a pipesize, change the socket buffer
2607 * to that size. Make the socket buffers an integral
2608 * number of mss units; if the mss is larger than
2609 * the socket buffer, decrease the mss.
2610 */
2611#ifdef RTV_SPIPE
2612 if ((bufsize = rt->rt_rmx.rmx_sendpipe) == 0)
2613#endif
2614 bufsize = so->so_snd.sb_hiwat;
2615 if (bufsize < mss)
2616 mss = bufsize;
2617 else {
2618 bufsize = roundup(bufsize, mss);
2619 if (bufsize > sb_max)
2620 bufsize = sb_max;
2621 (void)sbreserve(&so->so_snd, bufsize, so, NULL);
2622 }
2623 tp->t_maxseg = mss;
2624
2625#ifdef RTV_RPIPE
2626 if ((bufsize = rt->rt_rmx.rmx_recvpipe) == 0)
2627#endif
2628 bufsize = so->so_rcv.sb_hiwat;
2629 if (bufsize > mss) {
2630 bufsize = roundup(bufsize, mss);
2631 if (bufsize > sb_max)
2632 bufsize = sb_max;
2633 (void)sbreserve(&so->so_rcv, bufsize, so, NULL);
2634 }
2635
2636 /*
2637 * Set the slow-start flight size depending on whether this
2638 * is a local network or not.
2639 */
2640 if (
2641#ifdef INET6
2642 (isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
2643 (!isipv6 &&
2644#endif
2645 in_localaddr(inp->inp_faddr)
2646#ifdef INET6
2647 )
2648#endif
2649 )
2650 tp->snd_cwnd = mss * ss_fltsz_local;
2651 else
2652 tp->snd_cwnd = mss * ss_fltsz;
2653
2654 if (rt->rt_rmx.rmx_ssthresh) {
2655 /*
2656 * There's some sort of gateway or interface
2657 * buffer limit on the path. Use this to set
2658 * the slow start threshhold, but set the
2659 * threshold to no less than 2*mss.
2660 */
2661 tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
2662 tcpstat.tcps_usedssthresh++;
2663 }
2664}
2665
2666/*
2667 * Determine the MSS option to send on an outgoing SYN.
2668 */
2669int
2670tcp_mssopt(tp)
2671 struct tcpcb *tp;
2672{
2673 struct rtentry *rt;
2674#ifdef INET6
2675 int isipv6;
2676 int min_protoh;
2677#endif
2678
2679#ifdef INET6
2680 isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2681 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
2682 : sizeof (struct tcpiphdr);
2683#else
2684#define min_protoh (sizeof (struct tcpiphdr))
2685#endif
2686#ifdef INET6
2687 if (isipv6)
2688 rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc);
2689 else
2690#endif /* INET6 */
2691 rt = tcp_rtlookup(&tp->t_inpcb->inp_inc);
2692 if (rt == NULL)
2693 return
2694#ifdef INET6
2695 isipv6 ? tcp_v6mssdflt :
2696#endif /* INET6 */
2697 tcp_mssdflt;
2698
2699 return rt->rt_ifp->if_mtu - min_protoh;
2700}
2701
2702
2703/*
2704 * Checks for partial ack. If partial ack arrives, force the retransmission
2705 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return
2706 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to
2707 * be started again. If the ack advances at least to tp->snd_recover, return 0.
2708 */
2709static int
2710tcp_newreno(tp, th)
2711 struct tcpcb *tp;
2712 struct tcphdr *th;
2713{
2714 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2715 tcp_seq onxt = tp->snd_nxt;
2716 u_long ocwnd = tp->snd_cwnd;
2717
2718 callout_stop(tp->tt_rexmt);
2719 tp->t_rtttime = 0;
2720 tp->snd_nxt = th->th_ack;
2721 /*
2722 * Set snd_cwnd to one segment beyond acknowledged offset
2723 * (tp->snd_una has not yet been updated when this function
2724 * is called)
2725 */
2726 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
2727 (void) tcp_output(tp);
2728 tp->snd_cwnd = ocwnd;
2729 if (SEQ_GT(onxt, tp->snd_nxt))
2730 tp->snd_nxt = onxt;
2731 /*
2732 * Partial window deflation. Relies on fact that tp->snd_una
2733 * not updated yet.
2734 */
2735 tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_maxseg);
2736 return (1);
2737 }
2738 return (0);
2739}
| 77#endif
78#include <netinet/tcp.h>
79#include <netinet/tcp_fsm.h>
80#include <netinet/tcp_seq.h>
81#include <netinet/tcp_timer.h>
82#include <netinet/tcp_var.h>
83#ifdef INET6
84#include <netinet6/tcp6_var.h>
85#endif
86#include <netinet/tcpip.h>
87#ifdef TCPDEBUG
88#include <netinet/tcp_debug.h>
89
90u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */
91struct tcphdr tcp_savetcp;
92#endif /* TCPDEBUG */
93
94#ifdef IPSEC
95#include <netinet6/ipsec.h>
96#ifdef INET6
97#include <netinet6/ipsec6.h>
98#endif
99#include <netkey/key.h>
100#endif /*IPSEC*/
101
102#include <machine/in_cksum.h>
103
104MALLOC_DEFINE(M_TSEGQ, "tseg_qent", "TCP segment queue entry");
105
106static int tcprexmtthresh = 3;
107tcp_cc tcp_ccgen;
108
109struct tcpstat tcpstat;
110SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW,
111 &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
112
113static int log_in_vain = 0;
114SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
115 &log_in_vain, 0, "Log all incoming TCP connections");
116
117static int blackhole = 0;
118SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
119 &blackhole, 0, "Do not send RST when dropping refused connections");
120
121int tcp_delack_enabled = 1;
122SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
123 &tcp_delack_enabled, 0,
124 "Delay ACK to try and piggyback it onto a data packet");
125
126#ifdef TCP_DROP_SYNFIN
127static int drop_synfin = 0;
128SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
129 &drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
130#endif
131
132struct inpcbhead tcb;
133#define tcb6 tcb /* for KAME src sync over BSD*'s */
134struct inpcbinfo tcbinfo;
135
136static void tcp_dooptions(struct tcpopt *, u_char *, int, int);
137static void tcp_pulloutofband(struct socket *,
138 struct tcphdr *, struct mbuf *, int);
139static int tcp_reass(struct tcpcb *, struct tcphdr *, int *,
140 struct mbuf *);
141static void tcp_xmit_timer(struct tcpcb *, int);
142static int tcp_newreno(struct tcpcb *, struct tcphdr *);
143
144/* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
145#ifdef INET6
146#define ND6_HINT(tp) \
147do { \
148 if ((tp) && (tp)->t_inpcb && \
149 ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0 && \
150 (tp)->t_inpcb->in6p_route.ro_rt) \
151 nd6_nud_hint((tp)->t_inpcb->in6p_route.ro_rt, NULL, 0); \
152} while (0)
153#else
154#define ND6_HINT(tp)
155#endif
156
157/*
158 * Indicate whether this ack should be delayed. We can delay the ack if
159 * - delayed acks are enabled and
160 * - there is no delayed ack timer in progress and
161 * - our last ack wasn't a 0-sized window. We never want to delay
162 * the ack that opens up a 0-sized window.
163 */
164#define DELAY_ACK(tp) \
165 (tcp_delack_enabled && !callout_pending(tp->tt_delack) && \
166 (tp->t_flags & TF_RXWIN0SENT) == 0)
167
168static int
169tcp_reass(tp, th, tlenp, m)
170 register struct tcpcb *tp;
171 register struct tcphdr *th;
172 int *tlenp;
173 struct mbuf *m;
174{
175 struct tseg_qent *q;
176 struct tseg_qent *p = NULL;
177 struct tseg_qent *nq;
178 struct tseg_qent *te;
179 struct socket *so = tp->t_inpcb->inp_socket;
180 int flags;
181
182 /*
183 * Call with th==0 after become established to
184 * force pre-ESTABLISHED data up to user socket.
185 */
186 if (th == 0)
187 goto present;
188
189 /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */
190 MALLOC(te, struct tseg_qent *, sizeof (struct tseg_qent), M_TSEGQ,
191 M_NOWAIT);
192 if (te == NULL) {
193 tcpstat.tcps_rcvmemdrop++;
194 m_freem(m);
195 return (0);
196 }
197
198 /*
199 * Find a segment which begins after this one does.
200 */
201 LIST_FOREACH(q, &tp->t_segq, tqe_q) {
202 if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
203 break;
204 p = q;
205 }
206
207 /*
208 * If there is a preceding segment, it may provide some of
209 * our data already. If so, drop the data from the incoming
210 * segment. If it provides all of our data, drop us.
211 */
212 if (p != NULL) {
213 register int i;
214 /* conversion to int (in i) handles seq wraparound */
215 i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
216 if (i > 0) {
217 if (i >= *tlenp) {
218 tcpstat.tcps_rcvduppack++;
219 tcpstat.tcps_rcvdupbyte += *tlenp;
220 m_freem(m);
221 FREE(te, M_TSEGQ);
222 /*
223 * Try to present any queued data
224 * at the left window edge to the user.
225 * This is needed after the 3-WHS
226 * completes.
227 */
228 goto present; /* ??? */
229 }
230 m_adj(m, i);
231 *tlenp -= i;
232 th->th_seq += i;
233 }
234 }
235 tcpstat.tcps_rcvoopack++;
236 tcpstat.tcps_rcvoobyte += *tlenp;
237
238 /*
239 * While we overlap succeeding segments trim them or,
240 * if they are completely covered, dequeue them.
241 */
242 while (q) {
243 register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
244 if (i <= 0)
245 break;
246 if (i < q->tqe_len) {
247 q->tqe_th->th_seq += i;
248 q->tqe_len -= i;
249 m_adj(q->tqe_m, i);
250 break;
251 }
252
253 nq = LIST_NEXT(q, tqe_q);
254 LIST_REMOVE(q, tqe_q);
255 m_freem(q->tqe_m);
256 FREE(q, M_TSEGQ);
257 q = nq;
258 }
259
260 /* Insert the new segment queue entry into place. */
261 te->tqe_m = m;
262 te->tqe_th = th;
263 te->tqe_len = *tlenp;
264
265 if (p == NULL) {
266 LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
267 } else {
268 LIST_INSERT_AFTER(p, te, tqe_q);
269 }
270
271present:
272 /*
273 * Present data to user, advancing rcv_nxt through
274 * completed sequence space.
275 */
276 if (!TCPS_HAVEESTABLISHED(tp->t_state))
277 return (0);
278 q = LIST_FIRST(&tp->t_segq);
279 if (!q || q->tqe_th->th_seq != tp->rcv_nxt)
280 return (0);
281 do {
282 tp->rcv_nxt += q->tqe_len;
283 flags = q->tqe_th->th_flags & TH_FIN;
284 nq = LIST_NEXT(q, tqe_q);
285 LIST_REMOVE(q, tqe_q);
286 if (so->so_state & SS_CANTRCVMORE)
287 m_freem(q->tqe_m);
288 else
289 sbappend(&so->so_rcv, q->tqe_m);
290 FREE(q, M_TSEGQ);
291 q = nq;
292 } while (q && q->tqe_th->th_seq == tp->rcv_nxt);
293 ND6_HINT(tp);
294 sorwakeup(so);
295 return (flags);
296}
297
298/*
299 * TCP input routine, follows pages 65-76 of the
300 * protocol specification dated September, 1981 very closely.
301 */
302#ifdef INET6
303int
304tcp6_input(mp, offp, proto)
305 struct mbuf **mp;
306 int *offp, proto;
307{
308 register struct mbuf *m = *mp;
309 struct in6_ifaddr *ia6;
310
311 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
312
313 /*
314 * draft-itojun-ipv6-tcp-to-anycast
315 * better place to put this in?
316 */
317 ia6 = ip6_getdstifaddr(m);
318 if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
319 struct ip6_hdr *ip6;
320
321 ip6 = mtod(m, struct ip6_hdr *);
322 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
323 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
324 return IPPROTO_DONE;
325 }
326
327 tcp_input(m, *offp);
328 return IPPROTO_DONE;
329}
330#endif
331
332void
333tcp_input(m, off0)
334 register struct mbuf *m;
335 int off0;
336{
337 register struct tcphdr *th;
338 register struct ip *ip = NULL;
339 register struct ipovly *ipov;
340 register struct inpcb *inp;
341 u_char *optp = NULL;
342 int optlen = 0;
343 int len, tlen, off;
344 int drop_hdrlen;
345 register struct tcpcb *tp = 0;
346 register int thflags;
347 struct socket *so = 0;
348 int todrop, acked, ourfinisacked, needoutput = 0;
349 u_long tiwin;
350 struct tcpopt to; /* options in this segment */
351 struct rmxp_tao *taop; /* pointer to our TAO cache entry */
352 struct rmxp_tao tao_noncached; /* in case there's no cached entry */
353#ifdef TCPDEBUG
354 short ostate = 0;
355#endif
356#ifdef INET6
357 struct ip6_hdr *ip6 = NULL;
358 int isipv6;
359#endif /* INET6 */
360 int rstreason; /* For badport_bandlim accounting purposes */
361
362#ifdef INET6
363 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
364#endif
365 bzero((char *)&to, sizeof(to));
366
367 tcpstat.tcps_rcvtotal++;
368
369#ifdef INET6
370 if (isipv6) {
371 /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */
372 ip6 = mtod(m, struct ip6_hdr *);
373 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
374 if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
375 tcpstat.tcps_rcvbadsum++;
376 goto drop;
377 }
378 th = (struct tcphdr *)((caddr_t)ip6 + off0);
379
380 /*
381 * Be proactive about unspecified IPv6 address in source.
382 * As we use all-zero to indicate unbounded/unconnected pcb,
383 * unspecified IPv6 address can be used to confuse us.
384 *
385 * Note that packets with unspecified IPv6 destination is
386 * already dropped in ip6_input.
387 */
388 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
389 /* XXX stat */
390 goto drop;
391 }
392 } else
393#endif /* INET6 */
394 {
395 /*
396 * Get IP and TCP header together in first mbuf.
397 * Note: IP leaves IP header in first mbuf.
398 */
399 if (off0 > sizeof (struct ip)) {
400 ip_stripoptions(m, (struct mbuf *)0);
401 off0 = sizeof(struct ip);
402 }
403 if (m->m_len < sizeof (struct tcpiphdr)) {
404 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
405 tcpstat.tcps_rcvshort++;
406 return;
407 }
408 }
409 ip = mtod(m, struct ip *);
410 ipov = (struct ipovly *)ip;
411 th = (struct tcphdr *)((caddr_t)ip + off0);
412 tlen = ip->ip_len;
413
414 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
415 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
416 th->th_sum = m->m_pkthdr.csum_data;
417 else
418 th->th_sum = in_pseudo(ip->ip_src.s_addr,
419 ip->ip_dst.s_addr, htonl(m->m_pkthdr.csum_data +
420 ip->ip_len + IPPROTO_TCP));
421 th->th_sum ^= 0xffff;
422 } else {
423 /*
424 * Checksum extended TCP header and data.
425 */
426 len = sizeof (struct ip) + tlen;
427 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
428 ipov->ih_len = (u_short)tlen;
429 ipov->ih_len = htons(ipov->ih_len);
430 th->th_sum = in_cksum(m, len);
431 }
432 if (th->th_sum) {
433 tcpstat.tcps_rcvbadsum++;
434 goto drop;
435 }
436#ifdef INET6
437 /* Re-initialization for later version check */
438 ip->ip_v = IPVERSION;
439#endif
440 }
441
442 /*
443 * Check that TCP offset makes sense,
444 * pull out TCP options and adjust length. XXX
445 */
446 off = th->th_off << 2;
447 if (off < sizeof (struct tcphdr) || off > tlen) {
448 tcpstat.tcps_rcvbadoff++;
449 goto drop;
450 }
451 tlen -= off; /* tlen is used instead of ti->ti_len */
452 if (off > sizeof (struct tcphdr)) {
453#ifdef INET6
454 if (isipv6) {
455 IP6_EXTHDR_CHECK(m, off0, off, );
456 ip6 = mtod(m, struct ip6_hdr *);
457 th = (struct tcphdr *)((caddr_t)ip6 + off0);
458 } else
459#endif /* INET6 */
460 {
461 if (m->m_len < sizeof(struct ip) + off) {
462 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
463 tcpstat.tcps_rcvshort++;
464 return;
465 }
466 ip = mtod(m, struct ip *);
467 ipov = (struct ipovly *)ip;
468 th = (struct tcphdr *)((caddr_t)ip + off0);
469 }
470 }
471 optlen = off - sizeof (struct tcphdr);
472 optp = (u_char *)(th + 1);
473 }
474 thflags = th->th_flags;
475
476#ifdef TCP_DROP_SYNFIN
477 /*
478 * If the drop_synfin option is enabled, drop all packets with
479 * both the SYN and FIN bits set. This prevents e.g. nmap from
480 * identifying the TCP/IP stack.
481 *
482 * This is a violation of the TCP specification.
483 */
484 if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN))
485 goto drop;
486#endif
487
488 /*
489 * Convert TCP protocol specific fields to host format.
490 */
491 th->th_seq = ntohl(th->th_seq);
492 th->th_ack = ntohl(th->th_ack);
493 th->th_win = ntohs(th->th_win);
494 th->th_urp = ntohs(th->th_urp);
495
496 /*
497 * Delay droping TCP, IP headers, IPv6 ext headers, and TCP options,
498 * until after ip6_savecontrol() is called and before other functions
499 * which don't want those proto headers.
500 * Because ip6_savecontrol() is going to parse the mbuf to
501 * search for data to be passed up to user-land, it wants mbuf
502 * parameters to be unchanged.
503 * XXX: the call of ip6_savecontrol() has been obsoleted based on
504 * latest version of the advanced API (20020110).
505 */
506 drop_hdrlen = off0 + off;
507
508 /*
509 * Locate pcb for segment.
510 */
511findpcb:
512#ifdef IPFIREWALL_FORWARD
513 if (ip_fw_fwd_addr != NULL
514#ifdef INET6
515 && isipv6 == NULL /* IPv6 support is not yet */
516#endif /* INET6 */
517 ) {
518 /*
519 * Diverted. Pretend to be the destination.
520 * already got one like this?
521 */
522 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
523 ip->ip_dst, th->th_dport, 0, m->m_pkthdr.rcvif);
524 if (!inp) {
525 /*
526 * No, then it's new. Try find the ambushing socket
527 */
528 if (!ip_fw_fwd_addr->sin_port) {
529 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src,
530 th->th_sport, ip_fw_fwd_addr->sin_addr,
531 th->th_dport, 1, m->m_pkthdr.rcvif);
532 } else {
533 inp = in_pcblookup_hash(&tcbinfo,
534 ip->ip_src, th->th_sport,
535 ip_fw_fwd_addr->sin_addr,
536 ntohs(ip_fw_fwd_addr->sin_port), 1,
537 m->m_pkthdr.rcvif);
538 }
539 }
540 ip_fw_fwd_addr = NULL;
541 } else
542#endif /* IPFIREWALL_FORWARD */
543 {
544#ifdef INET6
545 if (isipv6)
546 inp = in6_pcblookup_hash(&tcbinfo, &ip6->ip6_src, th->th_sport,
547 &ip6->ip6_dst, th->th_dport, 1,
548 m->m_pkthdr.rcvif);
549 else
550#endif /* INET6 */
551 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
552 ip->ip_dst, th->th_dport, 1, m->m_pkthdr.rcvif);
553 }
554
555#ifdef IPSEC
556#ifdef INET6
557 if (isipv6) {
558 if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
559 ipsec6stat.in_polvio++;
560 goto drop;
561 }
562 } else
563#endif /* INET6 */
564 if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
565 ipsecstat.in_polvio++;
566 goto drop;
567 }
568#endif /*IPSEC*/
569
570 /*
571 * If the state is CLOSED (i.e., TCB does not exist) then
572 * all data in the incoming segment is discarded.
573 * If the TCB exists but is in CLOSED state, it is embryonic,
574 * but should either do a listen or a connect soon.
575 */
576 if (inp == NULL) {
577 if (log_in_vain) {
578#ifdef INET6
579 char dbuf[INET6_ADDRSTRLEN], sbuf[INET6_ADDRSTRLEN];
580#else /* INET6 */
581 char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"];
582#endif /* INET6 */
583
584#ifdef INET6
585 if (isipv6) {
586 strcpy(dbuf, ip6_sprintf(&ip6->ip6_dst));
587 strcpy(sbuf, ip6_sprintf(&ip6->ip6_src));
588 } else
589#endif
590 {
591 strcpy(dbuf, inet_ntoa(ip->ip_dst));
592 strcpy(sbuf, inet_ntoa(ip->ip_src));
593 }
594 switch (log_in_vain) {
595 case 1:
596 if(thflags & TH_SYN)
597 log(LOG_INFO,
598 "Connection attempt to TCP %s:%d from %s:%d\n",
599 dbuf, ntohs(th->th_dport),
600 sbuf,
601 ntohs(th->th_sport));
602 break;
603 case 2:
604 log(LOG_INFO,
605 "Connection attempt to TCP %s:%d from %s:%d flags:0x%x\n",
606 dbuf, ntohs(th->th_dport), sbuf,
607 ntohs(th->th_sport), thflags);
608 break;
609 default:
610 break;
611 }
612 }
613 if (blackhole) {
614 switch (blackhole) {
615 case 1:
616 if (thflags & TH_SYN)
617 goto drop;
618 break;
619 case 2:
620 goto drop;
621 default:
622 goto drop;
623 }
624 }
625 rstreason = BANDLIM_RST_CLOSEDPORT;
626 goto dropwithreset;
627 }
628 tp = intotcpcb(inp);
629 if (tp == 0) {
630 rstreason = BANDLIM_RST_CLOSEDPORT;
631 goto dropwithreset;
632 }
633 if (tp->t_state == TCPS_CLOSED)
634 goto drop;
635
636 /* Unscale the window into a 32-bit value. */
637 if ((thflags & TH_SYN) == 0)
638 tiwin = th->th_win << tp->snd_scale;
639 else
640 tiwin = th->th_win;
641
642 so = inp->inp_socket;
643 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
644 struct in_conninfo inc;
645#ifdef TCPDEBUG
646 if (so->so_options & SO_DEBUG) {
647 ostate = tp->t_state;
648#ifdef INET6
649 if (isipv6)
650 bcopy((char *)ip6, (char *)tcp_saveipgen,
651 sizeof(*ip6));
652 else
653#endif /* INET6 */
654 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
655 tcp_savetcp = *th;
656 }
657#endif
658 /* skip if this isn't a listen socket */
659 if ((so->so_options & SO_ACCEPTCONN) == 0)
660 goto after_listen;
661#ifdef INET6
662 inc.inc_isipv6 = isipv6;
663 if (isipv6) {
664 inc.inc6_faddr = ip6->ip6_src;
665 inc.inc6_laddr = ip6->ip6_dst;
666 inc.inc6_route.ro_rt = NULL; /* XXX */
667
668 } else
669#endif /* INET6 */
670 {
671 inc.inc_faddr = ip->ip_src;
672 inc.inc_laddr = ip->ip_dst;
673 inc.inc_route.ro_rt = NULL; /* XXX */
674 }
675 inc.inc_fport = th->th_sport;
676 inc.inc_lport = th->th_dport;
677
678 /*
679 * If the state is LISTEN then ignore segment if it contains
680 * a RST. If the segment contains an ACK then it is bad and
681 * send a RST. If it does not contain a SYN then it is not
682 * interesting; drop it.
683 *
684 * If the state is SYN_RECEIVED (syncache) and seg contains
685 * an ACK, but not for our SYN/ACK, send a RST. If the seg
686 * contains a RST, check the sequence number to see if it
687 * is a valid reset segment.
688 */
689 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
690 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
691 if (!syncache_expand(&inc, th, &so, m)) {
692 /*
693 * No syncache entry, or ACK was not
694 * for our SYN/ACK. Send a RST.
695 */
696 tcpstat.tcps_badsyn++;
697 rstreason = BANDLIM_RST_OPENPORT;
698 goto dropwithreset;
699 }
700 if (so == NULL)
701 /*
702 * Could not complete 3-way handshake,
703 * connection is being closed down, and
704 * syncache will free mbuf.
705 */
706 return;
707 /*
708 * Socket is created in state SYN_RECEIVED.
709 * Continue processing segment.
710 */
711 inp = sotoinpcb(so);
712 tp = intotcpcb(inp);
713 /*
714 * This is what would have happened in
715 * tcp_output() when the SYN,ACK was sent.
716 */
717 tp->snd_up = tp->snd_una;
718 tp->snd_max = tp->snd_nxt = tp->iss + 1;
719 tp->last_ack_sent = tp->rcv_nxt;
720/*
721 * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled
722 * until the _second_ ACK is received:
723 * rcv SYN (set wscale opts) --> send SYN/ACK, set snd_wnd = window.
724 * rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale,
725 * move to ESTAB, set snd_wnd to tiwin.
726 */
727 tp->snd_wnd = tiwin; /* unscaled */
728 goto after_listen;
729 }
730 if (thflags & TH_RST) {
731 syncache_chkrst(&inc, th);
732 goto drop;
733 }
734 if (thflags & TH_ACK) {
735 syncache_badack(&inc);
736 tcpstat.tcps_badsyn++;
737 rstreason = BANDLIM_RST_OPENPORT;
738 goto dropwithreset;
739 }
740 goto drop;
741 }
742
743 /*
744 * Segment's flags are (SYN) or (SYN|FIN).
745 */
746#ifdef INET6
747 /*
748 * If deprecated address is forbidden,
749 * we do not accept SYN to deprecated interface
750 * address to prevent any new inbound connection from
751 * getting established.
752 * When we do not accept SYN, we send a TCP RST,
753 * with deprecated source address (instead of dropping
754 * it). We compromise it as it is much better for peer
755 * to send a RST, and RST will be the final packet
756 * for the exchange.
757 *
758 * If we do not forbid deprecated addresses, we accept
759 * the SYN packet. RFC2462 does not suggest dropping
760 * SYN in this case.
761 * If we decipher RFC2462 5.5.4, it says like this:
762 * 1. use of deprecated addr with existing
763 * communication is okay - "SHOULD continue to be
764 * used"
765 * 2. use of it with new communication:
766 * (2a) "SHOULD NOT be used if alternate address
767 * with sufficient scope is available"
768 * (2b) nothing mentioned otherwise.
769 * Here we fall into (2b) case as we have no choice in
770 * our source address selection - we must obey the peer.
771 *
772 * The wording in RFC2462 is confusing, and there are
773 * multiple description text for deprecated address
774 * handling - worse, they are not exactly the same.
775 * I believe 5.5.4 is the best one, so we follow 5.5.4.
776 */
777 if (isipv6 && !ip6_use_deprecated) {
778 struct in6_ifaddr *ia6;
779
780 if ((ia6 = ip6_getdstifaddr(m)) &&
781 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
782 tp = NULL;
783 rstreason = BANDLIM_RST_OPENPORT;
784 goto dropwithreset;
785 }
786 }
787#endif
788 /*
789 * If it is from this socket, drop it, it must be forged.
790 * Don't bother responding if the destination was a broadcast.
791 */
792 if (th->th_dport == th->th_sport) {
793#ifdef INET6
794 if (isipv6) {
795 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
796 &ip6->ip6_src))
797 goto drop;
798 } else
799#endif /* INET6 */
800 if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
801 goto drop;
802 }
803 /*
804 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
805 *
806 * Note that it is quite possible to receive unicast
807 * link-layer packets with a broadcast IP address. Use
808 * in_broadcast() to find them.
809 */
810 if (m->m_flags & (M_BCAST|M_MCAST))
811 goto drop;
812#ifdef INET6
813 if (isipv6) {
814 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
815 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
816 goto drop;
817 } else
818#endif
819 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
820 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
821 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
822 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
823 goto drop;
824 /*
825 * SYN appears to be valid; create compressed TCP state
826 * for syncache, or perform t/tcp connection.
827 */
828 if (so->so_qlen <= so->so_qlimit) {
829 tcp_dooptions(&to, optp, optlen, 1);
830 if (!syncache_add(&inc, &to, th, &so, m))
831 goto drop;
832 if (so == NULL)
833 /*
834 * Entry added to syncache, mbuf used to
835 * send SYN,ACK packet.
836 */
837 return;
838 /*
839 * Segment passed TAO tests.
840 */
841 inp = sotoinpcb(so);
842 tp = intotcpcb(inp);
843 tp->snd_wnd = tiwin;
844 tp->t_starttime = ticks;
845 tp->t_state = TCPS_ESTABLISHED;
846
847 /*
848 * If there is a FIN, or if there is data and the
849 * connection is local, then delay SYN,ACK(SYN) in
850 * the hope of piggy-backing it on a response
851 * segment. Otherwise must send ACK now in case
852 * the other side is slow starting.
853 */
854 if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
855 (tlen != 0 &&
856#ifdef INET6
857 ((isipv6 && in6_localaddr(&inp->in6p_faddr))
858 ||
859 (!isipv6 &&
860#endif
861 in_localaddr(inp->inp_faddr)
862#ifdef INET6
863 ))
864#endif
865 ))) {
866 callout_reset(tp->tt_delack, tcp_delacktime,
867 tcp_timer_delack, tp);
868 tp->t_flags |= TF_NEEDSYN;
869 } else
870 tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
871
872 tcpstat.tcps_connects++;
873 soisconnected(so);
874 goto trimthenstep6;
875 }
876 goto drop;
877 }
878after_listen:
879
880/* XXX temp debugging */
881 /* should not happen - syncache should pick up these connections */
882 if (tp->t_state == TCPS_LISTEN)
883 panic("tcp_input: TCPS_LISTEN");
884
885 /*
886 * Segment received on connection.
887 * Reset idle time and keep-alive timer.
888 */
889 tp->t_rcvtime = ticks;
890 if (TCPS_HAVEESTABLISHED(tp->t_state))
891 callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
892
893 /*
894 * Process options.
895 * XXX this is tradtitional behavior, may need to be cleaned up.
896 */
897 tcp_dooptions(&to, optp, optlen, thflags & TH_SYN);
898 if (thflags & TH_SYN) {
899 if (to.to_flags & TOF_SCALE) {
900 tp->t_flags |= TF_RCVD_SCALE;
901 tp->requested_s_scale = to.to_requested_s_scale;
902 }
903 if (to.to_flags & TOF_TS) {
904 tp->t_flags |= TF_RCVD_TSTMP;
905 tp->ts_recent = to.to_tsval;
906 tp->ts_recent_age = ticks;
907 }
908 if (to.to_flags & (TOF_CC|TOF_CCNEW))
909 tp->t_flags |= TF_RCVD_CC;
910 if (to.to_flags & TOF_MSS)
911 tcp_mss(tp, to.to_mss);
912 }
913
914 /*
915 * Header prediction: check for the two common cases
916 * of a uni-directional data xfer. If the packet has
917 * no control flags, is in-sequence, the window didn't
918 * change and we're not retransmitting, it's a
919 * candidate. If the length is zero and the ack moved
920 * forward, we're the sender side of the xfer. Just
921 * free the data acked & wake any higher level process
922 * that was blocked waiting for space. If the length
923 * is non-zero and the ack didn't move, we're the
924 * receiver side. If we're getting packets in-order
925 * (the reassembly queue is empty), add the data to
926 * the socket buffer and note that we need a delayed ack.
927 * Make sure that the hidden state-flags are also off.
928 * Since we check for TCPS_ESTABLISHED above, it can only
929 * be TH_NEEDSYN.
930 */
931 if (tp->t_state == TCPS_ESTABLISHED &&
932 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
933 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
934 ((to.to_flags & TOF_TS) == 0 ||
935 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
936 /*
937 * Using the CC option is compulsory if once started:
938 * the segment is OK if no T/TCP was negotiated or
939 * if the segment has a CC option equal to CCrecv
940 */
941 ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) ||
942 ((to.to_flags & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
943 th->th_seq == tp->rcv_nxt &&
944 tiwin && tiwin == tp->snd_wnd &&
945 tp->snd_nxt == tp->snd_max) {
946
947 /*
948 * If last ACK falls within this segment's sequence numbers,
949 * record the timestamp.
950 * NOTE that the test is modified according to the latest
951 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
952 */
953 if ((to.to_flags & TOF_TS) != 0 &&
954 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
955 tp->ts_recent_age = ticks;
956 tp->ts_recent = to.to_tsval;
957 }
958
959 if (tlen == 0) {
960 if (SEQ_GT(th->th_ack, tp->snd_una) &&
961 SEQ_LEQ(th->th_ack, tp->snd_max) &&
962 tp->snd_cwnd >= tp->snd_wnd &&
963 tp->t_dupacks < tcprexmtthresh) {
964 /*
965 * this is a pure ack for outstanding data.
966 */
967 ++tcpstat.tcps_predack;
968 /*
969 * "bad retransmit" recovery
970 */
971 if (tp->t_rxtshift == 1 &&
972 ticks < tp->t_badrxtwin) {
973 tp->snd_cwnd = tp->snd_cwnd_prev;
974 tp->snd_ssthresh =
975 tp->snd_ssthresh_prev;
976 tp->snd_nxt = tp->snd_max;
977 tp->t_badrxtwin = 0;
978 }
979 if ((to.to_flags & TOF_TS) != 0)
980 tcp_xmit_timer(tp,
981 ticks - to.to_tsecr + 1);
982 else if (tp->t_rtttime &&
983 SEQ_GT(th->th_ack, tp->t_rtseq))
984 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
985 acked = th->th_ack - tp->snd_una;
986 tcpstat.tcps_rcvackpack++;
987 tcpstat.tcps_rcvackbyte += acked;
988 sbdrop(&so->so_snd, acked);
989 tp->snd_una = th->th_ack;
990 m_freem(m);
991 ND6_HINT(tp); /* some progress has been done */
992
993 /*
994 * If all outstanding data are acked, stop
995 * retransmit timer, otherwise restart timer
996 * using current (possibly backed-off) value.
997 * If process is waiting for space,
998 * wakeup/selwakeup/signal. If data
999 * are ready to send, let tcp_output
1000 * decide between more output or persist.
1001 */
1002 if (tp->snd_una == tp->snd_max)
1003 callout_stop(tp->tt_rexmt);
1004 else if (!callout_active(tp->tt_persist))
1005 callout_reset(tp->tt_rexmt,
1006 tp->t_rxtcur,
1007 tcp_timer_rexmt, tp);
1008
1009 sowwakeup(so);
1010 if (so->so_snd.sb_cc)
1011 (void) tcp_output(tp);
1012 return;
1013 }
1014 } else if (th->th_ack == tp->snd_una &&
1015 LIST_EMPTY(&tp->t_segq) &&
1016 tlen <= sbspace(&so->so_rcv)) {
1017 /*
1018 * this is a pure, in-sequence data packet
1019 * with nothing on the reassembly queue and
1020 * we have enough buffer space to take it.
1021 */
1022 ++tcpstat.tcps_preddat;
1023 tp->rcv_nxt += tlen;
1024 tcpstat.tcps_rcvpack++;
1025 tcpstat.tcps_rcvbyte += tlen;
1026 ND6_HINT(tp); /* some progress has been done */
1027 /*
1028 * Add data to socket buffer.
1029 */
1030 m_adj(m, drop_hdrlen); /* delayed header drop */
1031 sbappend(&so->so_rcv, m);
1032 sorwakeup(so);
1033 if (DELAY_ACK(tp)) {
1034 callout_reset(tp->tt_delack, tcp_delacktime,
1035 tcp_timer_delack, tp);
1036 } else {
1037 tp->t_flags |= TF_ACKNOW;
1038 tcp_output(tp);
1039 }
1040 return;
1041 }
1042 }
1043
1044 /*
1045 * Calculate amount of space in receive window,
1046 * and then do TCP input processing.
1047 * Receive window is amount of space in rcv queue,
1048 * but not less than advertised window.
1049 */
1050 { int win;
1051
1052 win = sbspace(&so->so_rcv);
1053 if (win < 0)
1054 win = 0;
1055 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1056 }
1057
1058 switch (tp->t_state) {
1059
1060 /*
1061 * If the state is SYN_RECEIVED:
1062 * if seg contains an ACK, but not for our SYN/ACK, send a RST.
1063 */
1064 case TCPS_SYN_RECEIVED:
1065 if ((thflags & TH_ACK) &&
1066 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1067 SEQ_GT(th->th_ack, tp->snd_max))) {
1068 rstreason = BANDLIM_RST_OPENPORT;
1069 goto dropwithreset;
1070 }
1071 break;
1072
1073 /*
1074 * If the state is SYN_SENT:
1075 * if seg contains an ACK, but not for our SYN, drop the input.
1076 * if seg contains a RST, then drop the connection.
1077 * if seg does not contain SYN, then drop it.
1078 * Otherwise this is an acceptable SYN segment
1079 * initialize tp->rcv_nxt and tp->irs
1080 * if seg contains ack then advance tp->snd_una
1081 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1082 * arrange for segment to be acked (eventually)
1083 * continue processing rest of data/controls, beginning with URG
1084 */
1085 case TCPS_SYN_SENT:
1086 if ((taop = tcp_gettaocache(&inp->inp_inc)) == NULL) {
1087 taop = &tao_noncached;
1088 bzero(taop, sizeof(*taop));
1089 }
1090
1091 if ((thflags & TH_ACK) &&
1092 (SEQ_LEQ(th->th_ack, tp->iss) ||
1093 SEQ_GT(th->th_ack, tp->snd_max))) {
1094 /*
1095 * If we have a cached CCsent for the remote host,
1096 * hence we haven't just crashed and restarted,
1097 * do not send a RST. This may be a retransmission
1098 * from the other side after our earlier ACK was lost.
1099 * Our new SYN, when it arrives, will serve as the
1100 * needed ACK.
1101 */
1102 if (taop->tao_ccsent != 0)
1103 goto drop;
1104 else {
1105 rstreason = BANDLIM_UNLIMITED;
1106 goto dropwithreset;
1107 }
1108 }
1109 if (thflags & TH_RST) {
1110 if (thflags & TH_ACK)
1111 tp = tcp_drop(tp, ECONNREFUSED);
1112 goto drop;
1113 }
1114 if ((thflags & TH_SYN) == 0)
1115 goto drop;
1116 tp->snd_wnd = th->th_win; /* initial send window */
1117 tp->cc_recv = to.to_cc; /* foreign CC */
1118
1119 tp->irs = th->th_seq;
1120 tcp_rcvseqinit(tp);
1121 if (thflags & TH_ACK) {
1122 /*
1123 * Our SYN was acked. If segment contains CC.ECHO
1124 * option, check it to make sure this segment really
1125 * matches our SYN. If not, just drop it as old
1126 * duplicate, but send an RST if we're still playing
1127 * by the old rules. If no CC.ECHO option, make sure
1128 * we don't get fooled into using T/TCP.
1129 */
1130 if (to.to_flags & TOF_CCECHO) {
1131 if (tp->cc_send != to.to_ccecho) {
1132 if (taop->tao_ccsent != 0)
1133 goto drop;
1134 else {
1135 rstreason = BANDLIM_UNLIMITED;
1136 goto dropwithreset;
1137 }
1138 }
1139 } else
1140 tp->t_flags &= ~TF_RCVD_CC;
1141 tcpstat.tcps_connects++;
1142 soisconnected(so);
1143 /* Do window scaling on this connection? */
1144 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1145 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1146 tp->snd_scale = tp->requested_s_scale;
1147 tp->rcv_scale = tp->request_r_scale;
1148 }
1149 /* Segment is acceptable, update cache if undefined. */
1150 if (taop->tao_ccsent == 0)
1151 taop->tao_ccsent = to.to_ccecho;
1152
1153 tp->rcv_adv += tp->rcv_wnd;
1154 tp->snd_una++; /* SYN is acked */
1155 /*
1156 * If there's data, delay ACK; if there's also a FIN
1157 * ACKNOW will be turned on later.
1158 */
1159 if (DELAY_ACK(tp) && tlen != 0)
1160 callout_reset(tp->tt_delack, tcp_delacktime,
1161 tcp_timer_delack, tp);
1162 else
1163 tp->t_flags |= TF_ACKNOW;
1164 /*
1165 * Received <SYN,ACK> in SYN_SENT[*] state.
1166 * Transitions:
1167 * SYN_SENT --> ESTABLISHED
1168 * SYN_SENT* --> FIN_WAIT_1
1169 */
1170 tp->t_starttime = ticks;
1171 if (tp->t_flags & TF_NEEDFIN) {
1172 tp->t_state = TCPS_FIN_WAIT_1;
1173 tp->t_flags &= ~TF_NEEDFIN;
1174 thflags &= ~TH_SYN;
1175 } else {
1176 tp->t_state = TCPS_ESTABLISHED;
1177 callout_reset(tp->tt_keep, tcp_keepidle,
1178 tcp_timer_keep, tp);
1179 }
1180 } else {
1181 /*
1182 * Received initial SYN in SYN-SENT[*] state => simul-
1183 * taneous open. If segment contains CC option and there is
1184 * a cached CC, apply TAO test; if it succeeds, connection is
1185 * half-synchronized. Otherwise, do 3-way handshake:
1186 * SYN-SENT -> SYN-RECEIVED
1187 * SYN-SENT* -> SYN-RECEIVED*
1188 * If there was no CC option, clear cached CC value.
1189 */
1190 tp->t_flags |= TF_ACKNOW;
1191 callout_stop(tp->tt_rexmt);
1192 if (to.to_flags & TOF_CC) {
1193 if (taop->tao_cc != 0 &&
1194 CC_GT(to.to_cc, taop->tao_cc)) {
1195 /*
1196 * update cache and make transition:
1197 * SYN-SENT -> ESTABLISHED*
1198 * SYN-SENT* -> FIN-WAIT-1*
1199 */
1200 taop->tao_cc = to.to_cc;
1201 tp->t_starttime = ticks;
1202 if (tp->t_flags & TF_NEEDFIN) {
1203 tp->t_state = TCPS_FIN_WAIT_1;
1204 tp->t_flags &= ~TF_NEEDFIN;
1205 } else {
1206 tp->t_state = TCPS_ESTABLISHED;
1207 callout_reset(tp->tt_keep,
1208 tcp_keepidle,
1209 tcp_timer_keep,
1210 tp);
1211 }
1212 tp->t_flags |= TF_NEEDSYN;
1213 } else
1214 tp->t_state = TCPS_SYN_RECEIVED;
1215 } else {
1216 /* CC.NEW or no option => invalidate cache */
1217 taop->tao_cc = 0;
1218 tp->t_state = TCPS_SYN_RECEIVED;
1219 }
1220 }
1221
1222trimthenstep6:
1223 /*
1224 * Advance th->th_seq to correspond to first data byte.
1225 * If data, trim to stay within window,
1226 * dropping FIN if necessary.
1227 */
1228 th->th_seq++;
1229 if (tlen > tp->rcv_wnd) {
1230 todrop = tlen - tp->rcv_wnd;
1231 m_adj(m, -todrop);
1232 tlen = tp->rcv_wnd;
1233 thflags &= ~TH_FIN;
1234 tcpstat.tcps_rcvpackafterwin++;
1235 tcpstat.tcps_rcvbyteafterwin += todrop;
1236 }
1237 tp->snd_wl1 = th->th_seq - 1;
1238 tp->rcv_up = th->th_seq;
1239 /*
1240 * Client side of transaction: already sent SYN and data.
1241 * If the remote host used T/TCP to validate the SYN,
1242 * our data will be ACK'd; if so, enter normal data segment
1243 * processing in the middle of step 5, ack processing.
1244 * Otherwise, goto step 6.
1245 */
1246 if (thflags & TH_ACK)
1247 goto process_ACK;
1248 goto step6;
1249 /*
1250 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1251 * if segment contains a SYN and CC [not CC.NEW] option:
1252 * if state == TIME_WAIT and connection duration > MSL,
1253 * drop packet and send RST;
1254 *
1255 * if SEG.CC > CCrecv then is new SYN, and can implicitly
1256 * ack the FIN (and data) in retransmission queue.
1257 * Complete close and delete TCPCB. Then reprocess
1258 * segment, hoping to find new TCPCB in LISTEN state;
1259 *
1260 * else must be old SYN; drop it.
1261 * else do normal processing.
1262 */
1263 case TCPS_LAST_ACK:
1264 case TCPS_CLOSING:
1265 case TCPS_TIME_WAIT:
1266 if ((thflags & TH_SYN) &&
1267 (to.to_flags & TOF_CC) && tp->cc_recv != 0) {
1268 if (tp->t_state == TCPS_TIME_WAIT &&
1269 (ticks - tp->t_starttime) > tcp_msl) {
1270 rstreason = BANDLIM_UNLIMITED;
1271 goto dropwithreset;
1272 }
1273 if (CC_GT(to.to_cc, tp->cc_recv)) {
1274 tp = tcp_close(tp);
1275 goto findpcb;
1276 }
1277 else
1278 goto drop;
1279 }
1280 break; /* continue normal processing */
1281 }
1282
1283 /*
1284 * States other than LISTEN or SYN_SENT.
1285 * First check the RST flag and sequence number since reset segments
1286 * are exempt from the timestamp and connection count tests. This
1287 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1288 * below which allowed reset segments in half the sequence space
1289 * to fall though and be processed (which gives forged reset
1290 * segments with a random sequence number a 50 percent chance of
1291 * killing a connection).
1292 * Then check timestamp, if present.
1293 * Then check the connection count, if present.
1294 * Then check that at least some bytes of segment are within
1295 * receive window. If segment begins before rcv_nxt,
1296 * drop leading data (and SYN); if nothing left, just ack.
1297 *
1298 *
1299 * If the RST bit is set, check the sequence number to see
1300 * if this is a valid reset segment.
1301 * RFC 793 page 37:
1302 * In all states except SYN-SENT, all reset (RST) segments
1303 * are validated by checking their SEQ-fields. A reset is
1304 * valid if its sequence number is in the window.
1305 * Note: this does not take into account delayed ACKs, so
1306 * we should test against last_ack_sent instead of rcv_nxt.
1307 * The sequence number in the reset segment is normally an
1308 * echo of our outgoing acknowlegement numbers, but some hosts
1309 * send a reset with the sequence number at the rightmost edge
1310 * of our receive window, and we have to handle this case.
1311 * If we have multiple segments in flight, the intial reset
1312 * segment sequence numbers will be to the left of last_ack_sent,
1313 * but they will eventually catch up.
1314 * In any case, it never made sense to trim reset segments to
1315 * fit the receive window since RFC 1122 says:
1316 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
1317 *
1318 * A TCP SHOULD allow a received RST segment to include data.
1319 *
1320 * DISCUSSION
1321 * It has been suggested that a RST segment could contain
1322 * ASCII text that encoded and explained the cause of the
1323 * RST. No standard has yet been established for such
1324 * data.
1325 *
1326 * If the reset segment passes the sequence number test examine
1327 * the state:
1328 * SYN_RECEIVED STATE:
1329 * If passive open, return to LISTEN state.
1330 * If active open, inform user that connection was refused.
1331 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
1332 * Inform user that connection was reset, and close tcb.
1333 * CLOSING, LAST_ACK STATES:
1334 * Close the tcb.
1335 * TIME_WAIT STATE:
1336 * Drop the segment - see Stevens, vol. 2, p. 964 and
1337 * RFC 1337.
1338 */
1339 if (thflags & TH_RST) {
1340 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
1341 SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
1342 switch (tp->t_state) {
1343
1344 case TCPS_SYN_RECEIVED:
1345 so->so_error = ECONNREFUSED;
1346 goto close;
1347
1348 case TCPS_ESTABLISHED:
1349 case TCPS_FIN_WAIT_1:
1350 case TCPS_FIN_WAIT_2:
1351 case TCPS_CLOSE_WAIT:
1352 so->so_error = ECONNRESET;
1353 close:
1354 tp->t_state = TCPS_CLOSED;
1355 tcpstat.tcps_drops++;
1356 tp = tcp_close(tp);
1357 break;
1358
1359 case TCPS_CLOSING:
1360 case TCPS_LAST_ACK:
1361 tp = tcp_close(tp);
1362 break;
1363
1364 case TCPS_TIME_WAIT:
1365 break;
1366 }
1367 }
1368 goto drop;
1369 }
1370
1371 /*
1372 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1373 * and it's less than ts_recent, drop it.
1374 */
1375 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
1376 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1377
1378 /* Check to see if ts_recent is over 24 days old. */
1379 if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1380 /*
1381 * Invalidate ts_recent. If this segment updates
1382 * ts_recent, the age will be reset later and ts_recent
1383 * will get a valid value. If it does not, setting
1384 * ts_recent to zero will at least satisfy the
1385 * requirement that zero be placed in the timestamp
1386 * echo reply when ts_recent isn't valid. The
1387 * age isn't reset until we get a valid ts_recent
1388 * because we don't want out-of-order segments to be
1389 * dropped when ts_recent is old.
1390 */
1391 tp->ts_recent = 0;
1392 } else {
1393 tcpstat.tcps_rcvduppack++;
1394 tcpstat.tcps_rcvdupbyte += tlen;
1395 tcpstat.tcps_pawsdrop++;
1396 goto dropafterack;
1397 }
1398 }
1399
1400 /*
1401 * T/TCP mechanism
1402 * If T/TCP was negotiated and the segment doesn't have CC,
1403 * or if its CC is wrong then drop the segment.
1404 * RST segments do not have to comply with this.
1405 */
1406 if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) &&
1407 ((to.to_flags & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
1408 goto dropafterack;
1409
1410 /*
1411 * In the SYN-RECEIVED state, validate that the packet belongs to
1412 * this connection before trimming the data to fit the receive
1413 * window. Check the sequence number versus IRS since we know
1414 * the sequence numbers haven't wrapped. This is a partial fix
1415 * for the "LAND" DoS attack.
1416 */
1417 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1418 rstreason = BANDLIM_RST_OPENPORT;
1419 goto dropwithreset;
1420 }
1421
1422 todrop = tp->rcv_nxt - th->th_seq;
1423 if (todrop > 0) {
1424 if (thflags & TH_SYN) {
1425 thflags &= ~TH_SYN;
1426 th->th_seq++;
1427 if (th->th_urp > 1)
1428 th->th_urp--;
1429 else
1430 thflags &= ~TH_URG;
1431 todrop--;
1432 }
1433 /*
1434 * Following if statement from Stevens, vol. 2, p. 960.
1435 */
1436 if (todrop > tlen
1437 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1438 /*
1439 * Any valid FIN must be to the left of the window.
1440 * At this point the FIN must be a duplicate or out
1441 * of sequence; drop it.
1442 */
1443 thflags &= ~TH_FIN;
1444
1445 /*
1446 * Send an ACK to resynchronize and drop any data.
1447 * But keep on processing for RST or ACK.
1448 */
1449 tp->t_flags |= TF_ACKNOW;
1450 todrop = tlen;
1451 tcpstat.tcps_rcvduppack++;
1452 tcpstat.tcps_rcvdupbyte += todrop;
1453 } else {
1454 tcpstat.tcps_rcvpartduppack++;
1455 tcpstat.tcps_rcvpartdupbyte += todrop;
1456 }
1457 drop_hdrlen += todrop; /* drop from the top afterwards */
1458 th->th_seq += todrop;
1459 tlen -= todrop;
1460 if (th->th_urp > todrop)
1461 th->th_urp -= todrop;
1462 else {
1463 thflags &= ~TH_URG;
1464 th->th_urp = 0;
1465 }
1466 }
1467
1468 /*
1469 * If new data are received on a connection after the
1470 * user processes are gone, then RST the other end.
1471 */
1472 if ((so->so_state & SS_NOFDREF) &&
1473 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1474 tp = tcp_close(tp);
1475 tcpstat.tcps_rcvafterclose++;
1476 rstreason = BANDLIM_UNLIMITED;
1477 goto dropwithreset;
1478 }
1479
1480 /*
1481 * If segment ends after window, drop trailing data
1482 * (and PUSH and FIN); if nothing left, just ACK.
1483 */
1484 todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1485 if (todrop > 0) {
1486 tcpstat.tcps_rcvpackafterwin++;
1487 if (todrop >= tlen) {
1488 tcpstat.tcps_rcvbyteafterwin += tlen;
1489 /*
1490 * If a new connection request is received
1491 * while in TIME_WAIT, drop the old connection
1492 * and start over if the sequence numbers
1493 * are above the previous ones.
1494 */
1495 if (thflags & TH_SYN &&
1496 tp->t_state == TCPS_TIME_WAIT &&
1497 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1498 tp = tcp_close(tp);
1499 goto findpcb;
1500 }
1501 /*
1502 * If window is closed can only take segments at
1503 * window edge, and have to drop data and PUSH from
1504 * incoming segments. Continue processing, but
1505 * remember to ack. Otherwise, drop segment
1506 * and ack.
1507 */
1508 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1509 tp->t_flags |= TF_ACKNOW;
1510 tcpstat.tcps_rcvwinprobe++;
1511 } else
1512 goto dropafterack;
1513 } else
1514 tcpstat.tcps_rcvbyteafterwin += todrop;
1515 m_adj(m, -todrop);
1516 tlen -= todrop;
1517 thflags &= ~(TH_PUSH|TH_FIN);
1518 }
1519
1520 /*
1521 * If last ACK falls within this segment's sequence numbers,
1522 * record its timestamp.
1523 * NOTE that the test is modified according to the latest
1524 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1525 */
1526 if ((to.to_flags & TOF_TS) != 0 &&
1527 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1528 tp->ts_recent_age = ticks;
1529 tp->ts_recent = to.to_tsval;
1530 }
1531
1532 /*
1533 * If a SYN is in the window, then this is an
1534 * error and we send an RST and drop the connection.
1535 */
1536 if (thflags & TH_SYN) {
1537 tp = tcp_drop(tp, ECONNRESET);
1538 rstreason = BANDLIM_UNLIMITED;
1539 goto dropwithreset;
1540 }
1541
1542 /*
1543 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
1544 * flag is on (half-synchronized state), then queue data for
1545 * later processing; else drop segment and return.
1546 */
1547 if ((thflags & TH_ACK) == 0) {
1548 if (tp->t_state == TCPS_SYN_RECEIVED ||
1549 (tp->t_flags & TF_NEEDSYN))
1550 goto step6;
1551 else
1552 goto drop;
1553 }
1554
1555 /*
1556 * Ack processing.
1557 */
1558 switch (tp->t_state) {
1559
1560 /*
1561 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1562 * ESTABLISHED state and continue processing.
1563 * The ACK was checked above.
1564 */
1565 case TCPS_SYN_RECEIVED:
1566
1567 tcpstat.tcps_connects++;
1568 soisconnected(so);
1569 /* Do window scaling? */
1570 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1571 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1572 tp->snd_scale = tp->requested_s_scale;
1573 tp->rcv_scale = tp->request_r_scale;
1574 }
1575 /*
1576 * Upon successful completion of 3-way handshake,
1577 * update cache.CC if it was undefined, pass any queued
1578 * data to the user, and advance state appropriately.
1579 */
1580 if ((taop = tcp_gettaocache(&inp->inp_inc)) != NULL &&
1581 taop->tao_cc == 0)
1582 taop->tao_cc = tp->cc_recv;
1583
1584 /*
1585 * Make transitions:
1586 * SYN-RECEIVED -> ESTABLISHED
1587 * SYN-RECEIVED* -> FIN-WAIT-1
1588 */
1589 tp->t_starttime = ticks;
1590 if (tp->t_flags & TF_NEEDFIN) {
1591 tp->t_state = TCPS_FIN_WAIT_1;
1592 tp->t_flags &= ~TF_NEEDFIN;
1593 } else {
1594 tp->t_state = TCPS_ESTABLISHED;
1595 callout_reset(tp->tt_keep, tcp_keepidle,
1596 tcp_timer_keep, tp);
1597 }
1598 /*
1599 * If segment contains data or ACK, will call tcp_reass()
1600 * later; if not, do so now to pass queued data to user.
1601 */
1602 if (tlen == 0 && (thflags & TH_FIN) == 0)
1603 (void) tcp_reass(tp, (struct tcphdr *)0, 0,
1604 (struct mbuf *)0);
1605 tp->snd_wl1 = th->th_seq - 1;
1606 /* fall into ... */
1607
1608 /*
1609 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1610 * ACKs. If the ack is in the range
1611 * tp->snd_una < th->th_ack <= tp->snd_max
1612 * then advance tp->snd_una to th->th_ack and drop
1613 * data from the retransmission queue. If this ACK reflects
1614 * more up to date window information we update our window information.
1615 */
1616 case TCPS_ESTABLISHED:
1617 case TCPS_FIN_WAIT_1:
1618 case TCPS_FIN_WAIT_2:
1619 case TCPS_CLOSE_WAIT:
1620 case TCPS_CLOSING:
1621 case TCPS_LAST_ACK:
1622 case TCPS_TIME_WAIT:
1623
1624 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1625 if (tlen == 0 && tiwin == tp->snd_wnd) {
1626 tcpstat.tcps_rcvdupack++;
1627 /*
1628 * If we have outstanding data (other than
1629 * a window probe), this is a completely
1630 * duplicate ack (ie, window info didn't
1631 * change), the ack is the biggest we've
1632 * seen and we've seen exactly our rexmt
1633 * threshhold of them, assume a packet
1634 * has been dropped and retransmit it.
1635 * Kludge snd_nxt & the congestion
1636 * window so we send only this one
1637 * packet.
1638 *
1639 * We know we're losing at the current
1640 * window size so do congestion avoidance
1641 * (set ssthresh to half the current window
1642 * and pull our congestion window back to
1643 * the new ssthresh).
1644 *
1645 * Dup acks mean that packets have left the
1646 * network (they're now cached at the receiver)
1647 * so bump cwnd by the amount in the receiver
1648 * to keep a constant cwnd packets in the
1649 * network.
1650 */
1651 if (!callout_active(tp->tt_rexmt) ||
1652 th->th_ack != tp->snd_una)
1653 tp->t_dupacks = 0;
1654 else if (++tp->t_dupacks == tcprexmtthresh) {
1655 tcp_seq onxt = tp->snd_nxt;
1656 u_int win =
1657 min(tp->snd_wnd, tp->snd_cwnd) / 2 /
1658 tp->t_maxseg;
1659 if (tcp_do_newreno && SEQ_LT(th->th_ack,
1660 tp->snd_recover)) {
1661 /* False retransmit, should not
1662 * cut window
1663 */
1664 tp->snd_cwnd += tp->t_maxseg;
1665 tp->t_dupacks = 0;
1666 (void) tcp_output(tp);
1667 goto drop;
1668 }
1669 if (win < 2)
1670 win = 2;
1671 tp->snd_ssthresh = win * tp->t_maxseg;
1672 tp->snd_recover = tp->snd_max;
1673 callout_stop(tp->tt_rexmt);
1674 tp->t_rtttime = 0;
1675 tp->snd_nxt = th->th_ack;
1676 tp->snd_cwnd = tp->t_maxseg;
1677 (void) tcp_output(tp);
1678 tp->snd_cwnd = tp->snd_ssthresh +
1679 tp->t_maxseg * tp->t_dupacks;
1680 if (SEQ_GT(onxt, tp->snd_nxt))
1681 tp->snd_nxt = onxt;
1682 goto drop;
1683 } else if (tp->t_dupacks > tcprexmtthresh) {
1684 tp->snd_cwnd += tp->t_maxseg;
1685 (void) tcp_output(tp);
1686 goto drop;
1687 }
1688 } else
1689 tp->t_dupacks = 0;
1690 break;
1691 }
1692 /*
1693 * If the congestion window was inflated to account
1694 * for the other side's cached packets, retract it.
1695 */
1696 if (tcp_do_newreno == 0) {
1697 if (tp->t_dupacks >= tcprexmtthresh &&
1698 tp->snd_cwnd > tp->snd_ssthresh)
1699 tp->snd_cwnd = tp->snd_ssthresh;
1700 tp->t_dupacks = 0;
1701 } else if (tp->t_dupacks >= tcprexmtthresh &&
1702 !tcp_newreno(tp, th)) {
1703 /*
1704 * Window inflation should have left us with approx.
1705 * snd_ssthresh outstanding data. But in case we
1706 * would be inclined to send a burst, better to do
1707 * it via the slow start mechanism.
1708 */
1709 if (SEQ_GT(th->th_ack + tp->snd_ssthresh, tp->snd_max))
1710 tp->snd_cwnd =
1711 tp->snd_max - th->th_ack + tp->t_maxseg;
1712 else
1713 tp->snd_cwnd = tp->snd_ssthresh;
1714 tp->t_dupacks = 0;
1715 }
1716 if (tp->t_dupacks < tcprexmtthresh)
1717 tp->t_dupacks = 0;
1718 if (SEQ_GT(th->th_ack, tp->snd_max)) {
1719 tcpstat.tcps_rcvacktoomuch++;
1720 goto dropafterack;
1721 }
1722 /*
1723 * If we reach this point, ACK is not a duplicate,
1724 * i.e., it ACKs something we sent.
1725 */
1726 if (tp->t_flags & TF_NEEDSYN) {
1727 /*
1728 * T/TCP: Connection was half-synchronized, and our
1729 * SYN has been ACK'd (so connection is now fully
1730 * synchronized). Go to non-starred state,
1731 * increment snd_una for ACK of SYN, and check if
1732 * we can do window scaling.
1733 */
1734 tp->t_flags &= ~TF_NEEDSYN;
1735 tp->snd_una++;
1736 /* Do window scaling? */
1737 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1738 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1739 tp->snd_scale = tp->requested_s_scale;
1740 tp->rcv_scale = tp->request_r_scale;
1741 }
1742 }
1743
1744process_ACK:
1745 acked = th->th_ack - tp->snd_una;
1746 tcpstat.tcps_rcvackpack++;
1747 tcpstat.tcps_rcvackbyte += acked;
1748
1749 /*
1750 * If we just performed our first retransmit, and the ACK
1751 * arrives within our recovery window, then it was a mistake
1752 * to do the retransmit in the first place. Recover our
1753 * original cwnd and ssthresh, and proceed to transmit where
1754 * we left off.
1755 */
1756 if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) {
1757 tp->snd_cwnd = tp->snd_cwnd_prev;
1758 tp->snd_ssthresh = tp->snd_ssthresh_prev;
1759 tp->snd_nxt = tp->snd_max;
1760 tp->t_badrxtwin = 0; /* XXX probably not required */
1761 }
1762
1763 /*
1764 * If we have a timestamp reply, update smoothed
1765 * round trip time. If no timestamp is present but
1766 * transmit timer is running and timed sequence
1767 * number was acked, update smoothed round trip time.
1768 * Since we now have an rtt measurement, cancel the
1769 * timer backoff (cf., Phil Karn's retransmit alg.).
1770 * Recompute the initial retransmit timer.
1771 */
1772 if (to.to_flags & TOF_TS)
1773 tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
1774 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
1775 tcp_xmit_timer(tp, ticks - tp->t_rtttime);
1776
1777 /*
1778 * If all outstanding data is acked, stop retransmit
1779 * timer and remember to restart (more output or persist).
1780 * If there is more data to be acked, restart retransmit
1781 * timer, using current (possibly backed-off) value.
1782 */
1783 if (th->th_ack == tp->snd_max) {
1784 callout_stop(tp->tt_rexmt);
1785 needoutput = 1;
1786 } else if (!callout_active(tp->tt_persist))
1787 callout_reset(tp->tt_rexmt, tp->t_rxtcur,
1788 tcp_timer_rexmt, tp);
1789
1790 /*
1791 * If no data (only SYN) was ACK'd,
1792 * skip rest of ACK processing.
1793 */
1794 if (acked == 0)
1795 goto step6;
1796
1797 /*
1798 * When new data is acked, open the congestion window.
1799 * If the window gives us less than ssthresh packets
1800 * in flight, open exponentially (maxseg per packet).
1801 * Otherwise open linearly: maxseg per window
1802 * (maxseg^2 / cwnd per packet).
1803 */
1804 {
1805 register u_int cw = tp->snd_cwnd;
1806 register u_int incr = tp->t_maxseg;
1807
1808 if (cw > tp->snd_ssthresh)
1809 incr = incr * incr / cw;
1810 /*
1811 * If t_dupacks != 0 here, it indicates that we are still
1812 * in NewReno fast recovery mode, so we leave the congestion
1813 * window alone.
1814 */
1815 if (tcp_do_newreno == 0 || tp->t_dupacks == 0)
1816 tp->snd_cwnd = min(cw + incr,TCP_MAXWIN<<tp->snd_scale);
1817 }
1818 if (acked > so->so_snd.sb_cc) {
1819 tp->snd_wnd -= so->so_snd.sb_cc;
1820 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
1821 ourfinisacked = 1;
1822 } else {
1823 sbdrop(&so->so_snd, acked);
1824 tp->snd_wnd -= acked;
1825 ourfinisacked = 0;
1826 }
1827 sowwakeup(so);
1828 tp->snd_una = th->th_ack;
1829 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1830 tp->snd_nxt = tp->snd_una;
1831
1832 switch (tp->t_state) {
1833
1834 /*
1835 * In FIN_WAIT_1 STATE in addition to the processing
1836 * for the ESTABLISHED state if our FIN is now acknowledged
1837 * then enter FIN_WAIT_2.
1838 */
1839 case TCPS_FIN_WAIT_1:
1840 if (ourfinisacked) {
1841 /*
1842 * If we can't receive any more
1843 * data, then closing user can proceed.
1844 * Starting the timer is contrary to the
1845 * specification, but if we don't get a FIN
1846 * we'll hang forever.
1847 */
1848 SIGIO_SLOCK();
1849 if (so->so_state & SS_CANTRCVMORE) {
1850 soisdisconnected_locked(so);
1851 SIGIO_SUNLOCK();
1852 callout_reset(tp->tt_2msl, tcp_maxidle,
1853 tcp_timer_2msl, tp);
1854 } else {
1855 SIGIO_SUNLOCK();
1856 }
1857 tp->t_state = TCPS_FIN_WAIT_2;
1858 }
1859 break;
1860
1861 /*
1862 * In CLOSING STATE in addition to the processing for
1863 * the ESTABLISHED state if the ACK acknowledges our FIN
1864 * then enter the TIME-WAIT state, otherwise ignore
1865 * the segment.
1866 */
1867 case TCPS_CLOSING:
1868 if (ourfinisacked) {
1869 tp->t_state = TCPS_TIME_WAIT;
1870 tcp_canceltimers(tp);
1871 /* Shorten TIME_WAIT [RFC-1644, p.28] */
1872 if (tp->cc_recv != 0 &&
1873 (ticks - tp->t_starttime) < tcp_msl)
1874 callout_reset(tp->tt_2msl,
1875 tp->t_rxtcur *
1876 TCPTV_TWTRUNC,
1877 tcp_timer_2msl, tp);
1878 else
1879 callout_reset(tp->tt_2msl, 2 * tcp_msl,
1880 tcp_timer_2msl, tp);
1881 soisdisconnected(so);
1882 }
1883 break;
1884
1885 /*
1886 * In LAST_ACK, we may still be waiting for data to drain
1887 * and/or to be acked, as well as for the ack of our FIN.
1888 * If our FIN is now acknowledged, delete the TCB,
1889 * enter the closed state and return.
1890 */
1891 case TCPS_LAST_ACK:
1892 if (ourfinisacked) {
1893 tp = tcp_close(tp);
1894 goto drop;
1895 }
1896 break;
1897
1898 /*
1899 * In TIME_WAIT state the only thing that should arrive
1900 * is a retransmission of the remote FIN. Acknowledge
1901 * it and restart the finack timer.
1902 */
1903 case TCPS_TIME_WAIT:
1904 callout_reset(tp->tt_2msl, 2 * tcp_msl,
1905 tcp_timer_2msl, tp);
1906 goto dropafterack;
1907 }
1908 }
1909
1910step6:
1911 /*
1912 * Update window information.
1913 * Don't look at window if no ACK: TAC's send garbage on first SYN.
1914 */
1915 if ((thflags & TH_ACK) &&
1916 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
1917 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
1918 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
1919 /* keep track of pure window updates */
1920 if (tlen == 0 &&
1921 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
1922 tcpstat.tcps_rcvwinupd++;
1923 tp->snd_wnd = tiwin;
1924 tp->snd_wl1 = th->th_seq;
1925 tp->snd_wl2 = th->th_ack;
1926 if (tp->snd_wnd > tp->max_sndwnd)
1927 tp->max_sndwnd = tp->snd_wnd;
1928 needoutput = 1;
1929 }
1930
1931 /*
1932 * Process segments with URG.
1933 */
1934 if ((thflags & TH_URG) && th->th_urp &&
1935 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1936 /*
1937 * This is a kludge, but if we receive and accept
1938 * random urgent pointers, we'll crash in
1939 * soreceive. It's hard to imagine someone
1940 * actually wanting to send this much urgent data.
1941 */
1942 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
1943 th->th_urp = 0; /* XXX */
1944 thflags &= ~TH_URG; /* XXX */
1945 goto dodata; /* XXX */
1946 }
1947 /*
1948 * If this segment advances the known urgent pointer,
1949 * then mark the data stream. This should not happen
1950 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1951 * a FIN has been received from the remote side.
1952 * In these states we ignore the URG.
1953 *
1954 * According to RFC961 (Assigned Protocols),
1955 * the urgent pointer points to the last octet
1956 * of urgent data. We continue, however,
1957 * to consider it to indicate the first octet
1958 * of data past the urgent section as the original
1959 * spec states (in one of two places).
1960 */
1961 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
1962 tp->rcv_up = th->th_seq + th->th_urp;
1963 so->so_oobmark = so->so_rcv.sb_cc +
1964 (tp->rcv_up - tp->rcv_nxt) - 1;
1965 if (so->so_oobmark == 0)
1966 so->so_state |= SS_RCVATMARK;
1967 sohasoutofband(so);
1968 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1969 }
1970 /*
1971 * Remove out of band data so doesn't get presented to user.
1972 * This can happen independent of advancing the URG pointer,
1973 * but if two URG's are pending at once, some out-of-band
1974 * data may creep in... ick.
1975 */
1976 if (th->th_urp <= (u_long)tlen
1977#ifdef SO_OOBINLINE
1978 && (so->so_options & SO_OOBINLINE) == 0
1979#endif
1980 )
1981 tcp_pulloutofband(so, th, m,
1982 drop_hdrlen); /* hdr drop is delayed */
1983 } else
1984 /*
1985 * If no out of band data is expected,
1986 * pull receive urgent pointer along
1987 * with the receive window.
1988 */
1989 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1990 tp->rcv_up = tp->rcv_nxt;
1991dodata: /* XXX */
1992
1993 /*
1994 * Process the segment text, merging it into the TCP sequencing queue,
1995 * and arranging for acknowledgment of receipt if necessary.
1996 * This process logically involves adjusting tp->rcv_wnd as data
1997 * is presented to the user (this happens in tcp_usrreq.c,
1998 * case PRU_RCVD). If a FIN has already been received on this
1999 * connection then we just ignore the text.
2000 */
2001 if ((tlen || (thflags&TH_FIN)) &&
2002 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2003 m_adj(m, drop_hdrlen); /* delayed header drop */
2004 /*
2005 * Insert segment which inludes th into reassembly queue of tcp with
2006 * control block tp. Return TH_FIN if reassembly now includes
2007 * a segment with FIN. This handle the common case inline (segment
2008 * is the next to be received on an established connection, and the
2009 * queue is empty), avoiding linkage into and removal from the queue
2010 * and repetition of various conversions.
2011 * Set DELACK for segments received in order, but ack immediately
2012 * when segments are out of order (so fast retransmit can work).
2013 */
2014 if (th->th_seq == tp->rcv_nxt &&
2015 LIST_EMPTY(&tp->t_segq) &&
2016 TCPS_HAVEESTABLISHED(tp->t_state)) {
2017 if (DELAY_ACK(tp))
2018 callout_reset(tp->tt_delack, tcp_delacktime,
2019 tcp_timer_delack, tp);
2020 else
2021 tp->t_flags |= TF_ACKNOW;
2022 tp->rcv_nxt += tlen;
2023 thflags = th->th_flags & TH_FIN;
2024 tcpstat.tcps_rcvpack++;
2025 tcpstat.tcps_rcvbyte += tlen;
2026 ND6_HINT(tp);
2027 sbappend(&so->so_rcv, m);
2028 sorwakeup(so);
2029 } else {
2030 thflags = tcp_reass(tp, th, &tlen, m);
2031 tp->t_flags |= TF_ACKNOW;
2032 }
2033
2034 /*
2035 * Note the amount of data that peer has sent into
2036 * our window, in order to estimate the sender's
2037 * buffer size.
2038 */
2039 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2040 } else {
2041 m_freem(m);
2042 thflags &= ~TH_FIN;
2043 }
2044
2045 /*
2046 * If FIN is received ACK the FIN and let the user know
2047 * that the connection is closing.
2048 */
2049 if (thflags & TH_FIN) {
2050 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2051 socantrcvmore(so);
2052 /*
2053 * If connection is half-synchronized
2054 * (ie NEEDSYN flag on) then delay ACK,
2055 * so it may be piggybacked when SYN is sent.
2056 * Otherwise, since we received a FIN then no
2057 * more input can be expected, send ACK now.
2058 */
2059 if (DELAY_ACK(tp) && (tp->t_flags & TF_NEEDSYN))
2060 callout_reset(tp->tt_delack, tcp_delacktime,
2061 tcp_timer_delack, tp);
2062 else
2063 tp->t_flags |= TF_ACKNOW;
2064 tp->rcv_nxt++;
2065 }
2066 switch (tp->t_state) {
2067
2068 /*
2069 * In SYN_RECEIVED and ESTABLISHED STATES
2070 * enter the CLOSE_WAIT state.
2071 */
2072 case TCPS_SYN_RECEIVED:
2073 tp->t_starttime = ticks;
2074 /*FALLTHROUGH*/
2075 case TCPS_ESTABLISHED:
2076 tp->t_state = TCPS_CLOSE_WAIT;
2077 break;
2078
2079 /*
2080 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2081 * enter the CLOSING state.
2082 */
2083 case TCPS_FIN_WAIT_1:
2084 tp->t_state = TCPS_CLOSING;
2085 break;
2086
2087 /*
2088 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2089 * starting the time-wait timer, turning off the other
2090 * standard timers.
2091 */
2092 case TCPS_FIN_WAIT_2:
2093 tp->t_state = TCPS_TIME_WAIT;
2094 tcp_canceltimers(tp);
2095 /* Shorten TIME_WAIT [RFC-1644, p.28] */
2096 if (tp->cc_recv != 0 &&
2097 (ticks - tp->t_starttime) < tcp_msl) {
2098 callout_reset(tp->tt_2msl,
2099 tp->t_rxtcur * TCPTV_TWTRUNC,
2100 tcp_timer_2msl, tp);
2101 /* For transaction client, force ACK now. */
2102 tp->t_flags |= TF_ACKNOW;
2103 }
2104 else
2105 callout_reset(tp->tt_2msl, 2 * tcp_msl,
2106 tcp_timer_2msl, tp);
2107 soisdisconnected(so);
2108 break;
2109
2110 /*
2111 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2112 */
2113 case TCPS_TIME_WAIT:
2114 callout_reset(tp->tt_2msl, 2 * tcp_msl,
2115 tcp_timer_2msl, tp);
2116 break;
2117 }
2118 }
2119#ifdef TCPDEBUG
2120 if (so->so_options & SO_DEBUG)
2121 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2122 &tcp_savetcp, 0);
2123#endif
2124
2125 /*
2126 * Return any desired output.
2127 */
2128 if (needoutput || (tp->t_flags & TF_ACKNOW))
2129 (void) tcp_output(tp);
2130 return;
2131
2132dropafterack:
2133 /*
2134 * Generate an ACK dropping incoming segment if it occupies
2135 * sequence space, where the ACK reflects our state.
2136 *
2137 * We can now skip the test for the RST flag since all
2138 * paths to this code happen after packets containing
2139 * RST have been dropped.
2140 *
2141 * In the SYN-RECEIVED state, don't send an ACK unless the
2142 * segment we received passes the SYN-RECEIVED ACK test.
2143 * If it fails send a RST. This breaks the loop in the
2144 * "LAND" DoS attack, and also prevents an ACK storm
2145 * between two listening ports that have been sent forged
2146 * SYN segments, each with the source address of the other.
2147 */
2148 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2149 (SEQ_GT(tp->snd_una, th->th_ack) ||
2150 SEQ_GT(th->th_ack, tp->snd_max)) ) {
2151 rstreason = BANDLIM_RST_OPENPORT;
2152 goto dropwithreset;
2153 }
2154#ifdef TCPDEBUG
2155 if (so->so_options & SO_DEBUG)
2156 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2157 &tcp_savetcp, 0);
2158#endif
2159 m_freem(m);
2160 tp->t_flags |= TF_ACKNOW;
2161 (void) tcp_output(tp);
2162 return;
2163
2164dropwithreset:
2165 /*
2166 * Generate a RST, dropping incoming segment.
2167 * Make ACK acceptable to originator of segment.
2168 * Don't bother to respond if destination was broadcast/multicast.
2169 */
2170 if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2171 goto drop;
2172#ifdef INET6
2173 if (isipv6) {
2174 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2175 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2176 goto drop;
2177 } else
2178#endif /* INET6 */
2179 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2180 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2181 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2182 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2183 goto drop;
2184 /* IPv6 anycast check is done at tcp6_input() */
2185
2186 /*
2187 * Perform bandwidth limiting.
2188 */
2189 if (badport_bandlim(rstreason) < 0)
2190 goto drop;
2191
2192#ifdef TCPDEBUG
2193 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2194 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2195 &tcp_savetcp, 0);
2196#endif
2197 if (thflags & TH_ACK)
2198 /* mtod() below is safe as long as hdr dropping is delayed */
2199 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack,
2200 TH_RST);
2201 else {
2202 if (thflags & TH_SYN)
2203 tlen++;
2204 /* mtod() below is safe as long as hdr dropping is delayed */
2205 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2206 (tcp_seq)0, TH_RST|TH_ACK);
2207 }
2208 return;
2209
2210drop:
2211 /*
2212 * Drop space held by incoming segment and return.
2213 */
2214#ifdef TCPDEBUG
2215 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2216 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2217 &tcp_savetcp, 0);
2218#endif
2219 m_freem(m);
2220 return;
2221}
2222
2223/*
2224 * Parse TCP options and place in tcpopt.
2225 */
2226static void
2227tcp_dooptions(to, cp, cnt, is_syn)
2228 struct tcpopt *to;
2229 u_char *cp;
2230 int cnt;
2231{
2232 int opt, optlen;
2233
2234 to->to_flags = 0;
2235 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2236 opt = cp[0];
2237 if (opt == TCPOPT_EOL)
2238 break;
2239 if (opt == TCPOPT_NOP)
2240 optlen = 1;
2241 else {
2242 if (cnt < 2)
2243 break;
2244 optlen = cp[1];
2245 if (optlen < 2 || optlen > cnt)
2246 break;
2247 }
2248 switch (opt) {
2249 case TCPOPT_MAXSEG:
2250 if (optlen != TCPOLEN_MAXSEG)
2251 continue;
2252 if (!is_syn)
2253 continue;
2254 to->to_flags |= TOF_MSS;
2255 bcopy((char *)cp + 2,
2256 (char *)&to->to_mss, sizeof(to->to_mss));
2257 to->to_mss = ntohs(to->to_mss);
2258 break;
2259 case TCPOPT_WINDOW:
2260 if (optlen != TCPOLEN_WINDOW)
2261 continue;
2262 if (! is_syn)
2263 continue;
2264 to->to_flags |= TOF_SCALE;
2265 to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
2266 break;
2267 case TCPOPT_TIMESTAMP:
2268 if (optlen != TCPOLEN_TIMESTAMP)
2269 continue;
2270 to->to_flags |= TOF_TS;
2271 bcopy((char *)cp + 2,
2272 (char *)&to->to_tsval, sizeof(to->to_tsval));
2273 to->to_tsval = ntohl(to->to_tsval);
2274 bcopy((char *)cp + 6,
2275 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2276 to->to_tsecr = ntohl(to->to_tsecr);
2277 break;
2278 case TCPOPT_CC:
2279 if (optlen != TCPOLEN_CC)
2280 continue;
2281 to->to_flags |= TOF_CC;
2282 bcopy((char *)cp + 2,
2283 (char *)&to->to_cc, sizeof(to->to_cc));
2284 to->to_cc = ntohl(to->to_cc);
2285 break;
2286 case TCPOPT_CCNEW:
2287 if (optlen != TCPOLEN_CC)
2288 continue;
2289 if (!is_syn)
2290 continue;
2291 to->to_flags |= TOF_CCNEW;
2292 bcopy((char *)cp + 2,
2293 (char *)&to->to_cc, sizeof(to->to_cc));
2294 to->to_cc = ntohl(to->to_cc);
2295 break;
2296 case TCPOPT_CCECHO:
2297 if (optlen != TCPOLEN_CC)
2298 continue;
2299 if (!is_syn)
2300 continue;
2301 to->to_flags |= TOF_CCECHO;
2302 bcopy((char *)cp + 2,
2303 (char *)&to->to_ccecho, sizeof(to->to_ccecho));
2304 to->to_ccecho = ntohl(to->to_ccecho);
2305 break;
2306 default:
2307 continue;
2308 }
2309 }
2310}
2311
2312/*
2313 * Pull out of band byte out of a segment so
2314 * it doesn't appear in the user's data queue.
2315 * It is still reflected in the segment length for
2316 * sequencing purposes.
2317 */
2318static void
2319tcp_pulloutofband(so, th, m, off)
2320 struct socket *so;
2321 struct tcphdr *th;
2322 register struct mbuf *m;
2323 int off; /* delayed to be droped hdrlen */
2324{
2325 int cnt = off + th->th_urp - 1;
2326
2327 while (cnt >= 0) {
2328 if (m->m_len > cnt) {
2329 char *cp = mtod(m, caddr_t) + cnt;
2330 struct tcpcb *tp = sototcpcb(so);
2331
2332 tp->t_iobc = *cp;
2333 tp->t_oobflags |= TCPOOB_HAVEDATA;
2334 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2335 m->m_len--;
2336 if (m->m_flags & M_PKTHDR)
2337 m->m_pkthdr.len--;
2338 return;
2339 }
2340 cnt -= m->m_len;
2341 m = m->m_next;
2342 if (m == 0)
2343 break;
2344 }
2345 panic("tcp_pulloutofband");
2346}
2347
2348/*
2349 * Collect new round-trip time estimate
2350 * and update averages and current timeout.
2351 */
2352static void
2353tcp_xmit_timer(tp, rtt)
2354 register struct tcpcb *tp;
2355 int rtt;
2356{
2357 register int delta;
2358
2359 tcpstat.tcps_rttupdated++;
2360 tp->t_rttupdated++;
2361 if (tp->t_srtt != 0) {
2362 /*
2363 * srtt is stored as fixed point with 5 bits after the
2364 * binary point (i.e., scaled by 8). The following magic
2365 * is equivalent to the smoothing algorithm in rfc793 with
2366 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2367 * point). Adjust rtt to origin 0.
2368 */
2369 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2370 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2371
2372 if ((tp->t_srtt += delta) <= 0)
2373 tp->t_srtt = 1;
2374
2375 /*
2376 * We accumulate a smoothed rtt variance (actually, a
2377 * smoothed mean difference), then set the retransmit
2378 * timer to smoothed rtt + 4 times the smoothed variance.
2379 * rttvar is stored as fixed point with 4 bits after the
2380 * binary point (scaled by 16). The following is
2381 * equivalent to rfc793 smoothing with an alpha of .75
2382 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2383 * rfc793's wired-in beta.
2384 */
2385 if (delta < 0)
2386 delta = -delta;
2387 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2388 if ((tp->t_rttvar += delta) <= 0)
2389 tp->t_rttvar = 1;
2390 } else {
2391 /*
2392 * No rtt measurement yet - use the unsmoothed rtt.
2393 * Set the variance to half the rtt (so our first
2394 * retransmit happens at 3*rtt).
2395 */
2396 tp->t_srtt = rtt << TCP_RTT_SHIFT;
2397 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2398 }
2399 tp->t_rtttime = 0;
2400 tp->t_rxtshift = 0;
2401
2402 /*
2403 * the retransmit should happen at rtt + 4 * rttvar.
2404 * Because of the way we do the smoothing, srtt and rttvar
2405 * will each average +1/2 tick of bias. When we compute
2406 * the retransmit timer, we want 1/2 tick of rounding and
2407 * 1 extra tick because of +-1/2 tick uncertainty in the
2408 * firing of the timer. The bias will give us exactly the
2409 * 1.5 tick we need. But, because the bias is
2410 * statistical, we have to test that we don't drop below
2411 * the minimum feasible timer (which is 2 ticks).
2412 */
2413 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2414 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2415
2416 /*
2417 * We received an ack for a packet that wasn't retransmitted;
2418 * it is probably safe to discard any error indications we've
2419 * received recently. This isn't quite right, but close enough
2420 * for now (a route might have failed after we sent a segment,
2421 * and the return path might not be symmetrical).
2422 */
2423 tp->t_softerror = 0;
2424}
2425
2426/*
2427 * Determine a reasonable value for maxseg size.
2428 * If the route is known, check route for mtu.
2429 * If none, use an mss that can be handled on the outgoing
2430 * interface without forcing IP to fragment; if bigger than
2431 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2432 * to utilize large mbufs. If no route is found, route has no mtu,
2433 * or the destination isn't local, use a default, hopefully conservative
2434 * size (usually 512 or the default IP max size, but no more than the mtu
2435 * of the interface), as we can't discover anything about intervening
2436 * gateways or networks. We also initialize the congestion/slow start
2437 * window to be a single segment if the destination isn't local.
2438 * While looking at the routing entry, we also initialize other path-dependent
2439 * parameters from pre-set or cached values in the routing entry.
2440 *
2441 * Also take into account the space needed for options that we
2442 * send regularly. Make maxseg shorter by that amount to assure
2443 * that we can send maxseg amount of data even when the options
2444 * are present. Store the upper limit of the length of options plus
2445 * data in maxopd.
2446 *
2447 * NOTE that this routine is only called when we process an incoming
2448 * segment, for outgoing segments only tcp_mssopt is called.
2449 *
2450 * In case of T/TCP, we call this routine during implicit connection
2451 * setup as well (offer = -1), to initialize maxseg from the cached
2452 * MSS of our peer.
2453 */
2454void
2455tcp_mss(tp, offer)
2456 struct tcpcb *tp;
2457 int offer;
2458{
2459 register struct rtentry *rt;
2460 struct ifnet *ifp;
2461 register int rtt, mss;
2462 u_long bufsize;
2463 struct inpcb *inp;
2464 struct socket *so;
2465 struct rmxp_tao *taop;
2466 int origoffer = offer;
2467#ifdef INET6
2468 int isipv6;
2469 int min_protoh;
2470#endif
2471
2472 inp = tp->t_inpcb;
2473#ifdef INET6
2474 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2475 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
2476 : sizeof (struct tcpiphdr);
2477#else
2478#define min_protoh (sizeof (struct tcpiphdr))
2479#endif
2480#ifdef INET6
2481 if (isipv6)
2482 rt = tcp_rtlookup6(&inp->inp_inc);
2483 else
2484#endif
2485 rt = tcp_rtlookup(&inp->inp_inc);
2486 if (rt == NULL) {
2487 tp->t_maxopd = tp->t_maxseg =
2488#ifdef INET6
2489 isipv6 ? tcp_v6mssdflt :
2490#endif /* INET6 */
2491 tcp_mssdflt;
2492 return;
2493 }
2494 ifp = rt->rt_ifp;
2495 so = inp->inp_socket;
2496
2497 taop = rmx_taop(rt->rt_rmx);
2498 /*
2499 * Offer == -1 means that we didn't receive SYN yet,
2500 * use cached value in that case;
2501 */
2502 if (offer == -1)
2503 offer = taop->tao_mssopt;
2504 /*
2505 * Offer == 0 means that there was no MSS on the SYN segment,
2506 * in this case we use tcp_mssdflt.
2507 */
2508 if (offer == 0)
2509 offer =
2510#ifdef INET6
2511 isipv6 ? tcp_v6mssdflt :
2512#endif /* INET6 */
2513 tcp_mssdflt;
2514 else
2515 /*
2516 * Sanity check: make sure that maxopd will be large
2517 * enough to allow some data on segments even is the
2518 * all the option space is used (40bytes). Otherwise
2519 * funny things may happen in tcp_output.
2520 */
2521 offer = max(offer, 64);
2522 taop->tao_mssopt = offer;
2523
2524 /*
2525 * While we're here, check if there's an initial rtt
2526 * or rttvar. Convert from the route-table units
2527 * to scaled multiples of the slow timeout timer.
2528 */
2529 if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
2530 /*
2531 * XXX the lock bit for RTT indicates that the value
2532 * is also a minimum value; this is subject to time.
2533 */
2534 if (rt->rt_rmx.rmx_locks & RTV_RTT)
2535 tp->t_rttmin = rtt / (RTM_RTTUNIT / hz);
2536 tp->t_srtt = rtt / (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
2537 tcpstat.tcps_usedrtt++;
2538 if (rt->rt_rmx.rmx_rttvar) {
2539 tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
2540 (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
2541 tcpstat.tcps_usedrttvar++;
2542 } else {
2543 /* default variation is +- 1 rtt */
2544 tp->t_rttvar =
2545 tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
2546 }
2547 TCPT_RANGESET(tp->t_rxtcur,
2548 ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
2549 tp->t_rttmin, TCPTV_REXMTMAX);
2550 }
2551 /*
2552 * if there's an mtu associated with the route, use it
2553 * else, use the link mtu.
2554 */
2555 if (rt->rt_rmx.rmx_mtu)
2556 mss = rt->rt_rmx.rmx_mtu - min_protoh;
2557 else
2558 {
2559 mss =
2560#ifdef INET6
2561 (isipv6 ? nd_ifinfo[rt->rt_ifp->if_index].linkmtu :
2562#endif
2563 ifp->if_mtu
2564#ifdef INET6
2565 )
2566#endif
2567 - min_protoh;
2568#ifdef INET6
2569 if (isipv6) {
2570 if (!in6_localaddr(&inp->in6p_faddr))
2571 mss = min(mss, tcp_v6mssdflt);
2572 } else
2573#endif
2574 if (!in_localaddr(inp->inp_faddr))
2575 mss = min(mss, tcp_mssdflt);
2576 }
2577 mss = min(mss, offer);
2578 /*
2579 * maxopd stores the maximum length of data AND options
2580 * in a segment; maxseg is the amount of data in a normal
2581 * segment. We need to store this value (maxopd) apart
2582 * from maxseg, because now every segment carries options
2583 * and thus we normally have somewhat less data in segments.
2584 */
2585 tp->t_maxopd = mss;
2586
2587 /*
2588 * In case of T/TCP, origoffer==-1 indicates, that no segments
2589 * were received yet. In this case we just guess, otherwise
2590 * we do the same as before T/TCP.
2591 */
2592 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2593 (origoffer == -1 ||
2594 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
2595 mss -= TCPOLEN_TSTAMP_APPA;
2596 if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
2597 (origoffer == -1 ||
2598 (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC))
2599 mss -= TCPOLEN_CC_APPA;
2600
2601#if (MCLBYTES & (MCLBYTES - 1)) == 0
2602 if (mss > MCLBYTES)
2603 mss &= ~(MCLBYTES-1);
2604#else
2605 if (mss > MCLBYTES)
2606 mss = mss / MCLBYTES * MCLBYTES;
2607#endif
2608 /*
2609 * If there's a pipesize, change the socket buffer
2610 * to that size. Make the socket buffers an integral
2611 * number of mss units; if the mss is larger than
2612 * the socket buffer, decrease the mss.
2613 */
2614#ifdef RTV_SPIPE
2615 if ((bufsize = rt->rt_rmx.rmx_sendpipe) == 0)
2616#endif
2617 bufsize = so->so_snd.sb_hiwat;
2618 if (bufsize < mss)
2619 mss = bufsize;
2620 else {
2621 bufsize = roundup(bufsize, mss);
2622 if (bufsize > sb_max)
2623 bufsize = sb_max;
2624 (void)sbreserve(&so->so_snd, bufsize, so, NULL);
2625 }
2626 tp->t_maxseg = mss;
2627
2628#ifdef RTV_RPIPE
2629 if ((bufsize = rt->rt_rmx.rmx_recvpipe) == 0)
2630#endif
2631 bufsize = so->so_rcv.sb_hiwat;
2632 if (bufsize > mss) {
2633 bufsize = roundup(bufsize, mss);
2634 if (bufsize > sb_max)
2635 bufsize = sb_max;
2636 (void)sbreserve(&so->so_rcv, bufsize, so, NULL);
2637 }
2638
2639 /*
2640 * Set the slow-start flight size depending on whether this
2641 * is a local network or not.
2642 */
2643 if (
2644#ifdef INET6
2645 (isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
2646 (!isipv6 &&
2647#endif
2648 in_localaddr(inp->inp_faddr)
2649#ifdef INET6
2650 )
2651#endif
2652 )
2653 tp->snd_cwnd = mss * ss_fltsz_local;
2654 else
2655 tp->snd_cwnd = mss * ss_fltsz;
2656
2657 if (rt->rt_rmx.rmx_ssthresh) {
2658 /*
2659 * There's some sort of gateway or interface
2660 * buffer limit on the path. Use this to set
2661 * the slow start threshhold, but set the
2662 * threshold to no less than 2*mss.
2663 */
2664 tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
2665 tcpstat.tcps_usedssthresh++;
2666 }
2667}
2668
2669/*
2670 * Determine the MSS option to send on an outgoing SYN.
2671 */
2672int
2673tcp_mssopt(tp)
2674 struct tcpcb *tp;
2675{
2676 struct rtentry *rt;
2677#ifdef INET6
2678 int isipv6;
2679 int min_protoh;
2680#endif
2681
2682#ifdef INET6
2683 isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2684 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
2685 : sizeof (struct tcpiphdr);
2686#else
2687#define min_protoh (sizeof (struct tcpiphdr))
2688#endif
2689#ifdef INET6
2690 if (isipv6)
2691 rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc);
2692 else
2693#endif /* INET6 */
2694 rt = tcp_rtlookup(&tp->t_inpcb->inp_inc);
2695 if (rt == NULL)
2696 return
2697#ifdef INET6
2698 isipv6 ? tcp_v6mssdflt :
2699#endif /* INET6 */
2700 tcp_mssdflt;
2701
2702 return rt->rt_ifp->if_mtu - min_protoh;
2703}
2704
2705
2706/*
2707 * Checks for partial ack. If partial ack arrives, force the retransmission
2708 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return
2709 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to
2710 * be started again. If the ack advances at least to tp->snd_recover, return 0.
2711 */
2712static int
2713tcp_newreno(tp, th)
2714 struct tcpcb *tp;
2715 struct tcphdr *th;
2716{
2717 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2718 tcp_seq onxt = tp->snd_nxt;
2719 u_long ocwnd = tp->snd_cwnd;
2720
2721 callout_stop(tp->tt_rexmt);
2722 tp->t_rtttime = 0;
2723 tp->snd_nxt = th->th_ack;
2724 /*
2725 * Set snd_cwnd to one segment beyond acknowledged offset
2726 * (tp->snd_una has not yet been updated when this function
2727 * is called)
2728 */
2729 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
2730 (void) tcp_output(tp);
2731 tp->snd_cwnd = ocwnd;
2732 if (SEQ_GT(onxt, tp->snd_nxt))
2733 tp->snd_nxt = onxt;
2734 /*
2735 * Partial window deflation. Relies on fact that tp->snd_una
2736 * not updated yet.
2737 */
2738 tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_maxseg);
2739 return (1);
2740 }
2741 return (0);
2742}
|