tcp_timewait.c revision 94390
1/*
2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 *    must display the following acknowledgement:
15 *	This product includes software developed by the University of
16 *	California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
34 * $FreeBSD: head/sys/netinet/tcp_timewait.c 94390 2002-04-10 22:12:01Z silby $
35 */
36
37#include "opt_compat.h"
38#include "opt_inet6.h"
39#include "opt_ipsec.h"
40#include "opt_tcpdebug.h"
41
42#include <sys/param.h>
43#include <sys/systm.h>
44#include <sys/callout.h>
45#include <sys/kernel.h>
46#include <sys/sysctl.h>
47#include <sys/malloc.h>
48#include <sys/mbuf.h>
49#ifdef INET6
50#include <sys/domain.h>
51#endif
52#include <sys/proc.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/protosw.h>
56#include <sys/random.h>
57
58#include <vm/uma.h>
59
60#include <net/route.h>
61#include <net/if.h>
62
63#define _IP_VHL
64#include <netinet/in.h>
65#include <netinet/in_systm.h>
66#include <netinet/ip.h>
67#ifdef INET6
68#include <netinet/ip6.h>
69#endif
70#include <netinet/in_pcb.h>
71#ifdef INET6
72#include <netinet6/in6_pcb.h>
73#endif
74#include <netinet/in_var.h>
75#include <netinet/ip_var.h>
76#ifdef INET6
77#include <netinet6/ip6_var.h>
78#endif
79#include <netinet/tcp.h>
80#include <netinet/tcp_fsm.h>
81#include <netinet/tcp_seq.h>
82#include <netinet/tcp_timer.h>
83#include <netinet/tcp_var.h>
84#ifdef INET6
85#include <netinet6/tcp6_var.h>
86#endif
87#include <netinet/tcpip.h>
88#ifdef TCPDEBUG
89#include <netinet/tcp_debug.h>
90#endif
91#include <netinet6/ip6protosw.h>
92
93#ifdef IPSEC
94#include <netinet6/ipsec.h>
95#ifdef INET6
96#include <netinet6/ipsec6.h>
97#endif
98#endif /*IPSEC*/
99
100#include <machine/in_cksum.h>
101#include <sys/md5.h>
102
103int 	tcp_mssdflt = TCP_MSS;
104SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
105    &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");
106
107#ifdef INET6
108int	tcp_v6mssdflt = TCP6_MSS;
109SYSCTL_INT(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
110	CTLFLAG_RW, &tcp_v6mssdflt , 0,
111	"Default TCP Maximum Segment Size for IPv6");
112#endif
113
114#if 0
115static int 	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
116SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
117    &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
118#endif
119
120int	tcp_do_rfc1323 = 1;
121SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW,
122    &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
123
124int	tcp_do_rfc1644 = 0;
125SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW,
126    &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
127
128static int	tcp_tcbhashsize = 0;
129SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RD,
130     &tcp_tcbhashsize, 0, "Size of TCP control-block hashtable");
131
132static int	do_tcpdrain = 1;
133SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
134     "Enable tcp_drain routine for extra help when low on mbufs");
135
136SYSCTL_INT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_RD,
137    &tcbinfo.ipi_count, 0, "Number of active PCBs");
138
139static int	icmp_may_rst = 1;
140SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_RW, &icmp_may_rst, 0,
141    "Certain ICMP unreachable messages may abort connections in SYN_SENT");
142
143static int	tcp_isn_reseed_interval = 0;
144SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_RW,
145    &tcp_isn_reseed_interval, 0, "Seconds between reseeding of ISN secret");
146
147static void	tcp_cleartaocache(void);
148static void	tcp_notify(struct inpcb *, int);
149
150/*
151 * Target size of TCP PCB hash tables. Must be a power of two.
152 *
153 * Note that this can be overridden by the kernel environment
154 * variable net.inet.tcp.tcbhashsize
155 */
156#ifndef TCBHASHSIZE
157#define TCBHASHSIZE	512
158#endif
159
160/*
161 * This is the actual shape of what we allocate using the zone
162 * allocator.  Doing it this way allows us to protect both structures
163 * using the same generation count, and also eliminates the overhead
164 * of allocating tcpcbs separately.  By hiding the structure here,
165 * we avoid changing most of the rest of the code (although it needs
166 * to be changed, eventually, for greater efficiency).
167 */
168#define	ALIGNMENT	32
169#define	ALIGNM1		(ALIGNMENT - 1)
170struct	inp_tp {
171	union {
172		struct	inpcb inp;
173		char	align[(sizeof(struct inpcb) + ALIGNM1) & ~ALIGNM1];
174	} inp_tp_u;
175	struct	tcpcb tcb;
176	struct	callout inp_tp_rexmt, inp_tp_persist, inp_tp_keep, inp_tp_2msl;
177	struct	callout inp_tp_delack;
178};
179#undef ALIGNMENT
180#undef ALIGNM1
181
182/*
183 * Tcp initialization
184 */
185void
186tcp_init()
187{
188	int hashsize = TCBHASHSIZE;
189
190	tcp_ccgen = 1;
191	tcp_cleartaocache();
192
193	tcp_delacktime = TCPTV_DELACK;
194	tcp_keepinit = TCPTV_KEEP_INIT;
195	tcp_keepidle = TCPTV_KEEP_IDLE;
196	tcp_keepintvl = TCPTV_KEEPINTVL;
197	tcp_maxpersistidle = TCPTV_KEEP_IDLE;
198	tcp_msl = TCPTV_MSL;
199
200	LIST_INIT(&tcb);
201	tcbinfo.listhead = &tcb;
202	TUNABLE_INT_FETCH("net.inet.tcp.tcbhashsize", &hashsize);
203	if (!powerof2(hashsize)) {
204		printf("WARNING: TCB hash size not a power of 2\n");
205		hashsize = 512; /* safe default */
206	}
207	tcp_tcbhashsize = hashsize;
208	tcbinfo.hashbase = hashinit(hashsize, M_PCB, &tcbinfo.hashmask);
209	tcbinfo.porthashbase = hashinit(hashsize, M_PCB,
210					&tcbinfo.porthashmask);
211	tcbinfo.ipi_zone = uma_zcreate("tcpcb", sizeof(struct inp_tp),
212	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
213	uma_zone_set_max(tcbinfo.ipi_zone, maxsockets);
214#ifdef INET6
215#define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
216#else /* INET6 */
217#define TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
218#endif /* INET6 */
219	if (max_protohdr < TCP_MINPROTOHDR)
220		max_protohdr = TCP_MINPROTOHDR;
221	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
222		panic("tcp_init");
223#undef TCP_MINPROTOHDR
224
225	syncache_init();
226}
227
228/*
229 * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
230 * tcp_template used to store this data in mbufs, but we now recopy it out
231 * of the tcpcb each time to conserve mbufs.
232 */
233void
234tcp_fillheaders(tp, ip_ptr, tcp_ptr)
235	struct tcpcb *tp;
236	void *ip_ptr;
237	void *tcp_ptr;
238{
239	struct inpcb *inp = tp->t_inpcb;
240	struct tcphdr *tcp_hdr = (struct tcphdr *)tcp_ptr;
241
242#ifdef INET6
243	if ((inp->inp_vflag & INP_IPV6) != 0) {
244		struct ip6_hdr *ip6;
245
246		ip6 = (struct ip6_hdr *)ip_ptr;
247		ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
248			(inp->in6p_flowinfo & IPV6_FLOWINFO_MASK);
249		ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
250			(IPV6_VERSION & IPV6_VERSION_MASK);
251		ip6->ip6_nxt = IPPROTO_TCP;
252		ip6->ip6_plen = sizeof(struct tcphdr);
253		ip6->ip6_src = inp->in6p_laddr;
254		ip6->ip6_dst = inp->in6p_faddr;
255		tcp_hdr->th_sum = 0;
256	} else
257#endif
258	{
259	struct ip *ip = (struct ip *) ip_ptr;
260
261	ip->ip_vhl = IP_VHL_BORING;
262	ip->ip_tos = 0;
263	ip->ip_len = 0;
264	ip->ip_id = 0;
265	ip->ip_off = 0;
266	ip->ip_ttl = 0;
267	ip->ip_sum = 0;
268	ip->ip_p = IPPROTO_TCP;
269	ip->ip_src = inp->inp_laddr;
270	ip->ip_dst = inp->inp_faddr;
271	tcp_hdr->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
272		htons(sizeof(struct tcphdr) + IPPROTO_TCP));
273	}
274
275	tcp_hdr->th_sport = inp->inp_lport;
276	tcp_hdr->th_dport = inp->inp_fport;
277	tcp_hdr->th_seq = 0;
278	tcp_hdr->th_ack = 0;
279	tcp_hdr->th_x2 = 0;
280	tcp_hdr->th_off = 5;
281	tcp_hdr->th_flags = 0;
282	tcp_hdr->th_win = 0;
283	tcp_hdr->th_urp = 0;
284}
285
286/*
287 * Create template to be used to send tcp packets on a connection.
288 * Allocates an mbuf and fills in a skeletal tcp/ip header.  The only
289 * use for this function is in keepalives, which use tcp_respond.
290 */
291struct tcptemp *
292tcp_maketemplate(tp)
293	struct tcpcb *tp;
294{
295	struct mbuf *m;
296	struct tcptemp *n;
297
298	m = m_get(M_DONTWAIT, MT_HEADER);
299	if (m == NULL)
300		return (0);
301	m->m_len = sizeof(struct tcptemp);
302	n = mtod(m, struct tcptemp *);
303
304	tcp_fillheaders(tp, (void *)&n->tt_ipgen, (void *)&n->tt_t);
305	return (n);
306}
307
308/*
309 * Send a single message to the TCP at address specified by
310 * the given TCP/IP header.  If m == 0, then we make a copy
311 * of the tcpiphdr at ti and send directly to the addressed host.
312 * This is used to force keep alive messages out using the TCP
313 * template for a connection.  If flags are given then we send
314 * a message back to the TCP which originated the * segment ti,
315 * and discard the mbuf containing it and any other attached mbufs.
316 *
317 * In any case the ack and sequence number of the transmitted
318 * segment are as specified by the parameters.
319 *
320 * NOTE: If m != NULL, then ti must point to *inside* the mbuf.
321 */
322void
323tcp_respond(tp, ipgen, th, m, ack, seq, flags)
324	struct tcpcb *tp;
325	void *ipgen;
326	register struct tcphdr *th;
327	register struct mbuf *m;
328	tcp_seq ack, seq;
329	int flags;
330{
331	register int tlen;
332	int win = 0;
333	struct route *ro = 0;
334	struct route sro;
335	struct ip *ip;
336	struct tcphdr *nth;
337#ifdef INET6
338	struct route_in6 *ro6 = 0;
339	struct route_in6 sro6;
340	struct ip6_hdr *ip6;
341	int isipv6;
342#endif /* INET6 */
343	int ipflags = 0;
344
345#ifdef INET6
346	isipv6 = IP_VHL_V(((struct ip *)ipgen)->ip_vhl) == 6;
347	ip6 = ipgen;
348#endif /* INET6 */
349	ip = ipgen;
350
351	if (tp) {
352		if (!(flags & TH_RST)) {
353			win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
354			if (win > (long)TCP_MAXWIN << tp->rcv_scale)
355				win = (long)TCP_MAXWIN << tp->rcv_scale;
356		}
357#ifdef INET6
358		if (isipv6)
359			ro6 = &tp->t_inpcb->in6p_route;
360		else
361#endif /* INET6 */
362		ro = &tp->t_inpcb->inp_route;
363	} else {
364#ifdef INET6
365		if (isipv6) {
366			ro6 = &sro6;
367			bzero(ro6, sizeof *ro6);
368		} else
369#endif /* INET6 */
370	      {
371		ro = &sro;
372		bzero(ro, sizeof *ro);
373	      }
374	}
375	if (m == 0) {
376		m = m_gethdr(M_DONTWAIT, MT_HEADER);
377		if (m == NULL)
378			return;
379		tlen = 0;
380		m->m_data += max_linkhdr;
381#ifdef INET6
382		if (isipv6) {
383			bcopy((caddr_t)ip6, mtod(m, caddr_t),
384			      sizeof(struct ip6_hdr));
385			ip6 = mtod(m, struct ip6_hdr *);
386			nth = (struct tcphdr *)(ip6 + 1);
387		} else
388#endif /* INET6 */
389	      {
390		bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
391		ip = mtod(m, struct ip *);
392		nth = (struct tcphdr *)(ip + 1);
393	      }
394		bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
395		flags = TH_ACK;
396	} else {
397		m_freem(m->m_next);
398		m->m_next = 0;
399		m->m_data = (caddr_t)ipgen;
400		/* m_len is set later */
401		tlen = 0;
402#define xchg(a,b,type) { type t; t=a; a=b; b=t; }
403#ifdef INET6
404		if (isipv6) {
405			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
406			nth = (struct tcphdr *)(ip6 + 1);
407		} else
408#endif /* INET6 */
409	      {
410		xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, n_long);
411		nth = (struct tcphdr *)(ip + 1);
412	      }
413		if (th != nth) {
414			/*
415			 * this is usually a case when an extension header
416			 * exists between the IPv6 header and the
417			 * TCP header.
418			 */
419			nth->th_sport = th->th_sport;
420			nth->th_dport = th->th_dport;
421		}
422		xchg(nth->th_dport, nth->th_sport, n_short);
423#undef xchg
424	}
425#ifdef INET6
426	if (isipv6) {
427		ip6->ip6_flow = 0;
428		ip6->ip6_vfc = IPV6_VERSION;
429		ip6->ip6_nxt = IPPROTO_TCP;
430		ip6->ip6_plen = htons((u_short)(sizeof (struct tcphdr) +
431						tlen));
432		tlen += sizeof (struct ip6_hdr) + sizeof (struct tcphdr);
433	} else
434#endif
435      {
436	tlen += sizeof (struct tcpiphdr);
437	ip->ip_len = tlen;
438	ip->ip_ttl = ip_defttl;
439      }
440	m->m_len = tlen;
441	m->m_pkthdr.len = tlen;
442	m->m_pkthdr.rcvif = (struct ifnet *) 0;
443	nth->th_seq = htonl(seq);
444	nth->th_ack = htonl(ack);
445	nth->th_x2 = 0;
446	nth->th_off = sizeof (struct tcphdr) >> 2;
447	nth->th_flags = flags;
448	if (tp)
449		nth->th_win = htons((u_short) (win >> tp->rcv_scale));
450	else
451		nth->th_win = htons((u_short)win);
452	nth->th_urp = 0;
453#ifdef INET6
454	if (isipv6) {
455		nth->th_sum = 0;
456		nth->th_sum = in6_cksum(m, IPPROTO_TCP,
457					sizeof(struct ip6_hdr),
458					tlen - sizeof(struct ip6_hdr));
459		ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL,
460					       ro6 && ro6->ro_rt ?
461					       ro6->ro_rt->rt_ifp :
462					       NULL);
463	} else
464#endif /* INET6 */
465      {
466        nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
467	    htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
468        m->m_pkthdr.csum_flags = CSUM_TCP;
469        m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
470      }
471#ifdef TCPDEBUG
472	if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
473		tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
474#endif
475#ifdef IPSEC
476	if (ipsec_setsocket(m, tp ? tp->t_inpcb->inp_socket : NULL) != 0) {
477		m_freem(m);
478		return;
479	}
480#endif
481#ifdef INET6
482	if (isipv6) {
483		(void)ip6_output(m, NULL, ro6, ipflags, NULL, NULL);
484		if (ro6 == &sro6 && ro6->ro_rt) {
485			RTFREE(ro6->ro_rt);
486			ro6->ro_rt = NULL;
487		}
488	} else
489#endif /* INET6 */
490      {
491	(void) ip_output(m, NULL, ro, ipflags, NULL);
492	if (ro == &sro && ro->ro_rt) {
493		RTFREE(ro->ro_rt);
494		ro->ro_rt = NULL;
495	}
496      }
497}
498
499/*
500 * Create a new TCP control block, making an
501 * empty reassembly queue and hooking it to the argument
502 * protocol control block.  The `inp' parameter must have
503 * come from the zone allocator set up in tcp_init().
504 */
505struct tcpcb *
506tcp_newtcpcb(inp)
507	struct inpcb *inp;
508{
509	struct inp_tp *it;
510	register struct tcpcb *tp;
511#ifdef INET6
512	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
513#endif /* INET6 */
514
515	it = (struct inp_tp *)inp;
516	tp = &it->tcb;
517	bzero((char *) tp, sizeof(struct tcpcb));
518	LIST_INIT(&tp->t_segq);
519	tp->t_maxseg = tp->t_maxopd =
520#ifdef INET6
521		isipv6 ? tcp_v6mssdflt :
522#endif /* INET6 */
523		tcp_mssdflt;
524
525	/* Set up our timeouts. */
526	callout_init(tp->tt_rexmt = &it->inp_tp_rexmt, 0);
527	callout_init(tp->tt_persist = &it->inp_tp_persist, 0);
528	callout_init(tp->tt_keep = &it->inp_tp_keep, 0);
529	callout_init(tp->tt_2msl = &it->inp_tp_2msl, 0);
530	callout_init(tp->tt_delack = &it->inp_tp_delack, 0);
531
532	if (tcp_do_rfc1323)
533		tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
534	if (tcp_do_rfc1644)
535		tp->t_flags |= TF_REQ_CC;
536	tp->t_inpcb = inp;	/* XXX */
537	/*
538	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
539	 * rtt estimate.  Set rttvar so that srtt + 4 * rttvar gives
540	 * reasonable initial retransmit time.
541	 */
542	tp->t_srtt = TCPTV_SRTTBASE;
543	tp->t_rttvar = ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
544	tp->t_rttmin = TCPTV_MIN;
545	tp->t_rxtcur = TCPTV_RTOBASE;
546	tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
547	tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
548	tp->t_rcvtime = ticks;
549        /*
550	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
551	 * because the socket may be bound to an IPv6 wildcard address,
552	 * which may match an IPv4-mapped IPv6 address.
553	 */
554	inp->inp_ip_ttl = ip_defttl;
555	inp->inp_ppcb = (caddr_t)tp;
556	return (tp);		/* XXX */
557}
558
559/*
560 * Drop a TCP connection, reporting
561 * the specified error.  If connection is synchronized,
562 * then send a RST to peer.
563 */
564struct tcpcb *
565tcp_drop(tp, errno)
566	register struct tcpcb *tp;
567	int errno;
568{
569	struct socket *so = tp->t_inpcb->inp_socket;
570
571	if (TCPS_HAVERCVDSYN(tp->t_state)) {
572		tp->t_state = TCPS_CLOSED;
573		(void) tcp_output(tp);
574		tcpstat.tcps_drops++;
575	} else
576		tcpstat.tcps_conndrops++;
577	if (errno == ETIMEDOUT && tp->t_softerror)
578		errno = tp->t_softerror;
579	so->so_error = errno;
580	return (tcp_close(tp));
581}
582
583/*
584 * Close a TCP control block:
585 *	discard all space held by the tcp
586 *	discard internet protocol block
587 *	wake up any sleepers
588 */
589struct tcpcb *
590tcp_close(tp)
591	register struct tcpcb *tp;
592{
593	register struct tseg_qent *q;
594	struct inpcb *inp = tp->t_inpcb;
595	struct socket *so = inp->inp_socket;
596#ifdef INET6
597	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
598#endif /* INET6 */
599	register struct rtentry *rt;
600	int dosavessthresh;
601
602	/*
603	 * Make sure that all of our timers are stopped before we
604	 * delete the PCB.
605	 */
606	callout_stop(tp->tt_rexmt);
607	callout_stop(tp->tt_persist);
608	callout_stop(tp->tt_keep);
609	callout_stop(tp->tt_2msl);
610	callout_stop(tp->tt_delack);
611
612	/*
613	 * If we got enough samples through the srtt filter,
614	 * save the rtt and rttvar in the routing entry.
615	 * 'Enough' is arbitrarily defined as the 16 samples.
616	 * 16 samples is enough for the srtt filter to converge
617	 * to within 5% of the correct value; fewer samples and
618	 * we could save a very bogus rtt.
619	 *
620	 * Don't update the default route's characteristics and don't
621	 * update anything that the user "locked".
622	 */
623	if (tp->t_rttupdated >= 16) {
624		register u_long i = 0;
625#ifdef INET6
626		if (isipv6) {
627			struct sockaddr_in6 *sin6;
628
629			if ((rt = inp->in6p_route.ro_rt) == NULL)
630				goto no_valid_rt;
631			sin6 = (struct sockaddr_in6 *)rt_key(rt);
632			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
633				goto no_valid_rt;
634		}
635		else
636#endif /* INET6 */
637		if ((rt = inp->inp_route.ro_rt) == NULL ||
638		    ((struct sockaddr_in *)rt_key(rt))->sin_addr.s_addr
639		    == INADDR_ANY)
640			goto no_valid_rt;
641
642		if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
643			i = tp->t_srtt *
644			    (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
645			if (rt->rt_rmx.rmx_rtt && i)
646				/*
647				 * filter this update to half the old & half
648				 * the new values, converting scale.
649				 * See route.h and tcp_var.h for a
650				 * description of the scaling constants.
651				 */
652				rt->rt_rmx.rmx_rtt =
653				    (rt->rt_rmx.rmx_rtt + i) / 2;
654			else
655				rt->rt_rmx.rmx_rtt = i;
656			tcpstat.tcps_cachedrtt++;
657		}
658		if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
659			i = tp->t_rttvar *
660			    (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
661			if (rt->rt_rmx.rmx_rttvar && i)
662				rt->rt_rmx.rmx_rttvar =
663				    (rt->rt_rmx.rmx_rttvar + i) / 2;
664			else
665				rt->rt_rmx.rmx_rttvar = i;
666			tcpstat.tcps_cachedrttvar++;
667		}
668		/*
669		 * The old comment here said:
670		 * update the pipelimit (ssthresh) if it has been updated
671		 * already or if a pipesize was specified & the threshhold
672		 * got below half the pipesize.  I.e., wait for bad news
673		 * before we start updating, then update on both good
674		 * and bad news.
675		 *
676		 * But we want to save the ssthresh even if no pipesize is
677		 * specified explicitly in the route, because such
678		 * connections still have an implicit pipesize specified
679		 * by the global tcp_sendspace.  In the absence of a reliable
680		 * way to calculate the pipesize, it will have to do.
681		 */
682		i = tp->snd_ssthresh;
683		if (rt->rt_rmx.rmx_sendpipe != 0)
684			dosavessthresh = (i < rt->rt_rmx.rmx_sendpipe / 2);
685		else
686			dosavessthresh = (i < so->so_snd.sb_hiwat / 2);
687		if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
688		     i != 0 && rt->rt_rmx.rmx_ssthresh != 0)
689		    || dosavessthresh) {
690			/*
691			 * convert the limit from user data bytes to
692			 * packets then to packet data bytes.
693			 */
694			i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
695			if (i < 2)
696				i = 2;
697			i *= (u_long)(tp->t_maxseg +
698#ifdef INET6
699				      (isipv6 ? sizeof (struct ip6_hdr) +
700					       sizeof (struct tcphdr) :
701#endif
702				       sizeof (struct tcpiphdr)
703#ifdef INET6
704				       )
705#endif
706				      );
707			if (rt->rt_rmx.rmx_ssthresh)
708				rt->rt_rmx.rmx_ssthresh =
709				    (rt->rt_rmx.rmx_ssthresh + i) / 2;
710			else
711				rt->rt_rmx.rmx_ssthresh = i;
712			tcpstat.tcps_cachedssthresh++;
713		}
714	}
715    no_valid_rt:
716	/* free the reassembly queue, if any */
717	while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
718		LIST_REMOVE(q, tqe_q);
719		m_freem(q->tqe_m);
720		FREE(q, M_TSEGQ);
721	}
722	inp->inp_ppcb = NULL;
723	soisdisconnected(so);
724#ifdef INET6
725	if (INP_CHECK_SOCKAF(so, AF_INET6))
726		in6_pcbdetach(inp);
727	else
728#endif /* INET6 */
729	in_pcbdetach(inp);
730	tcpstat.tcps_closed++;
731	return ((struct tcpcb *)0);
732}
733
734void
735tcp_drain()
736{
737	if (do_tcpdrain)
738	{
739		struct inpcb *inpb;
740		struct tcpcb *tcpb;
741		struct tseg_qent *te;
742
743	/*
744	 * Walk the tcpbs, if existing, and flush the reassembly queue,
745	 * if there is one...
746	 * XXX: The "Net/3" implementation doesn't imply that the TCP
747	 *      reassembly queue should be flushed, but in a situation
748	 * 	where we're really low on mbufs, this is potentially
749	 *  	usefull.
750	 */
751		LIST_FOREACH(inpb, tcbinfo.listhead, inp_list) {
752			if ((tcpb = intotcpcb(inpb))) {
753				while ((te = LIST_FIRST(&tcpb->t_segq))
754			            != NULL) {
755					LIST_REMOVE(te, tqe_q);
756					m_freem(te->tqe_m);
757					FREE(te, M_TSEGQ);
758				}
759			}
760		}
761	}
762}
763
764/*
765 * Notify a tcp user of an asynchronous error;
766 * store error as soft error, but wake up user
767 * (for now, won't do anything until can select for soft error).
768 *
769 * Do not wake up user since there currently is no mechanism for
770 * reporting soft errors (yet - a kqueue filter may be added).
771 */
772static void
773tcp_notify(inp, error)
774	struct inpcb *inp;
775	int error;
776{
777	struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
778
779	/*
780	 * Ignore some errors if we are hooked up.
781	 * If connection hasn't completed, has retransmitted several times,
782	 * and receives a second error, give up now.  This is better
783	 * than waiting a long time to establish a connection that
784	 * can never complete.
785	 */
786	if (tp->t_state == TCPS_ESTABLISHED &&
787	     (error == EHOSTUNREACH || error == ENETUNREACH ||
788	      error == EHOSTDOWN)) {
789		return;
790	} else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
791	    tp->t_softerror)
792		tcp_drop(tp, error);
793	else
794		tp->t_softerror = error;
795#if 0
796	wakeup((caddr_t) &so->so_timeo);
797	sorwakeup(so);
798	sowwakeup(so);
799#endif
800}
801
802static int
803tcp_pcblist(SYSCTL_HANDLER_ARGS)
804{
805	int error, i, n, s;
806	struct inpcb *inp, **inp_list;
807	inp_gen_t gencnt;
808	struct xinpgen xig;
809
810	/*
811	 * The process of preparing the TCB list is too time-consuming and
812	 * resource-intensive to repeat twice on every request.
813	 */
814	if (req->oldptr == 0) {
815		n = tcbinfo.ipi_count;
816		req->oldidx = 2 * (sizeof xig)
817			+ (n + n/8) * sizeof(struct xtcpcb);
818		return 0;
819	}
820
821	if (req->newptr != 0)
822		return EPERM;
823
824	/*
825	 * OK, now we're committed to doing something.
826	 */
827	s = splnet();
828	gencnt = tcbinfo.ipi_gencnt;
829	n = tcbinfo.ipi_count;
830	splx(s);
831
832	xig.xig_len = sizeof xig;
833	xig.xig_count = n;
834	xig.xig_gen = gencnt;
835	xig.xig_sogen = so_gencnt;
836	error = SYSCTL_OUT(req, &xig, sizeof xig);
837	if (error)
838		return error;
839
840	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
841	if (inp_list == 0)
842		return ENOMEM;
843
844	s = splnet();
845	for (inp = LIST_FIRST(tcbinfo.listhead), i = 0; inp && i < n;
846	     inp = LIST_NEXT(inp, inp_list)) {
847		if (inp->inp_gencnt <= gencnt) {
848			if (cr_canseesocket(req->td->td_ucred,
849			    inp->inp_socket))
850				continue;
851			inp_list[i++] = inp;
852		}
853	}
854	splx(s);
855	n = i;
856
857	error = 0;
858	for (i = 0; i < n; i++) {
859		inp = inp_list[i];
860		if (inp->inp_gencnt <= gencnt) {
861			struct xtcpcb xt;
862			caddr_t inp_ppcb;
863			xt.xt_len = sizeof xt;
864			/* XXX should avoid extra copy */
865			bcopy(inp, &xt.xt_inp, sizeof *inp);
866			inp_ppcb = inp->inp_ppcb;
867			if (inp_ppcb != NULL)
868				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
869			else
870				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
871			if (inp->inp_socket)
872				sotoxsocket(inp->inp_socket, &xt.xt_socket);
873			error = SYSCTL_OUT(req, &xt, sizeof xt);
874		}
875	}
876	if (!error) {
877		/*
878		 * Give the user an updated idea of our state.
879		 * If the generation differs from what we told
880		 * her before, she knows that something happened
881		 * while we were processing this request, and it
882		 * might be necessary to retry.
883		 */
884		s = splnet();
885		xig.xig_gen = tcbinfo.ipi_gencnt;
886		xig.xig_sogen = so_gencnt;
887		xig.xig_count = tcbinfo.ipi_count;
888		splx(s);
889		error = SYSCTL_OUT(req, &xig, sizeof xig);
890	}
891	free(inp_list, M_TEMP);
892	return error;
893}
894
895SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
896	    tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
897
898static int
899tcp_getcred(SYSCTL_HANDLER_ARGS)
900{
901	struct xucred xuc;
902	struct sockaddr_in addrs[2];
903	struct inpcb *inp;
904	int error, s;
905
906	error = suser_cred(req->td->td_ucred, PRISON_ROOT);
907	if (error)
908		return (error);
909	error = SYSCTL_IN(req, addrs, sizeof(addrs));
910	if (error)
911		return (error);
912	s = splnet();
913	inp = in_pcblookup_hash(&tcbinfo, addrs[1].sin_addr, addrs[1].sin_port,
914	    addrs[0].sin_addr, addrs[0].sin_port, 0, NULL);
915	if (inp == NULL || inp->inp_socket == NULL) {
916		error = ENOENT;
917		goto out;
918	}
919	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
920	if (error)
921		goto out;
922	cru2x(inp->inp_socket->so_cred, &xuc);
923	error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
924out:
925	splx(s);
926	return (error);
927}
928
929SYSCTL_PROC(_net_inet_tcp, OID_AUTO, getcred,
930    CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
931    tcp_getcred, "S,xucred", "Get the xucred of a TCP connection");
932
933#ifdef INET6
934static int
935tcp6_getcred(SYSCTL_HANDLER_ARGS)
936{
937	struct xucred xuc;
938	struct sockaddr_in6 addrs[2];
939	struct inpcb *inp;
940	int error, s, mapped = 0;
941
942	error = suser_cred(req->td->td_ucred, PRISON_ROOT);
943	if (error)
944		return (error);
945	error = SYSCTL_IN(req, addrs, sizeof(addrs));
946	if (error)
947		return (error);
948	if (IN6_IS_ADDR_V4MAPPED(&addrs[0].sin6_addr)) {
949		if (IN6_IS_ADDR_V4MAPPED(&addrs[1].sin6_addr))
950			mapped = 1;
951		else
952			return (EINVAL);
953	}
954	s = splnet();
955	if (mapped == 1)
956		inp = in_pcblookup_hash(&tcbinfo,
957			*(struct in_addr *)&addrs[1].sin6_addr.s6_addr[12],
958			addrs[1].sin6_port,
959			*(struct in_addr *)&addrs[0].sin6_addr.s6_addr[12],
960			addrs[0].sin6_port,
961			0, NULL);
962	else
963		inp = in6_pcblookup_hash(&tcbinfo, &addrs[1].sin6_addr,
964				 addrs[1].sin6_port,
965				 &addrs[0].sin6_addr, addrs[0].sin6_port,
966				 0, NULL);
967	if (inp == NULL || inp->inp_socket == NULL) {
968		error = ENOENT;
969		goto out;
970	}
971	error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
972	if (error)
973		goto out;
974	cru2x(inp->inp_socket->so_cred, &xuc);
975	error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
976out:
977	splx(s);
978	return (error);
979}
980
981SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred,
982    CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
983    tcp6_getcred, "S,xucred", "Get the xucred of a TCP6 connection");
984#endif
985
986
987void
988tcp_ctlinput(cmd, sa, vip)
989	int cmd;
990	struct sockaddr *sa;
991	void *vip;
992{
993	struct ip *ip = vip;
994	struct tcphdr *th;
995	struct in_addr faddr;
996	struct inpcb *inp;
997	struct tcpcb *tp;
998	void (*notify)(struct inpcb *, int) = tcp_notify;
999	tcp_seq icmp_seq;
1000	int s;
1001
1002	faddr = ((struct sockaddr_in *)sa)->sin_addr;
1003	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1004		return;
1005
1006	if (cmd == PRC_QUENCH)
1007		notify = tcp_quench;
1008	else if (icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||
1009		cmd == PRC_UNREACH_PORT) && ip)
1010		notify = tcp_drop_syn_sent;
1011	else if (cmd == PRC_MSGSIZE)
1012		notify = tcp_mtudisc;
1013	else if (PRC_IS_REDIRECT(cmd)) {
1014		ip = 0;
1015		notify = in_rtchange;
1016	} else if (cmd == PRC_HOSTDEAD)
1017		ip = 0;
1018	else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
1019		return;
1020	if (ip) {
1021		s = splnet();
1022		th = (struct tcphdr *)((caddr_t)ip
1023				       + (IP_VHL_HL(ip->ip_vhl) << 2));
1024		inp = in_pcblookup_hash(&tcbinfo, faddr, th->th_dport,
1025		    ip->ip_src, th->th_sport, 0, NULL);
1026		if (inp != NULL && inp->inp_socket != NULL) {
1027			icmp_seq = htonl(th->th_seq);
1028			tp = intotcpcb(inp);
1029			if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
1030			    SEQ_LT(icmp_seq, tp->snd_max))
1031				(*notify)(inp, inetctlerrmap[cmd]);
1032		} else {
1033			struct in_conninfo inc;
1034
1035			inc.inc_fport = th->th_dport;
1036			inc.inc_lport = th->th_sport;
1037			inc.inc_faddr = faddr;
1038			inc.inc_laddr = ip->ip_src;
1039#ifdef INET6
1040			inc.inc_isipv6 = 0;
1041#endif
1042			syncache_unreach(&inc, th);
1043		}
1044		splx(s);
1045	} else
1046		in_pcbnotifyall(&tcb, faddr, inetctlerrmap[cmd], notify);
1047}
1048
1049#ifdef INET6
1050void
1051tcp6_ctlinput(cmd, sa, d)
1052	int cmd;
1053	struct sockaddr *sa;
1054	void *d;
1055{
1056	struct tcphdr th;
1057	void (*notify)(struct inpcb *, int) = tcp_notify;
1058	struct ip6_hdr *ip6;
1059	struct mbuf *m;
1060	struct ip6ctlparam *ip6cp = NULL;
1061	const struct sockaddr_in6 *sa6_src = NULL;
1062	int off;
1063	struct tcp_portonly {
1064		u_int16_t th_sport;
1065		u_int16_t th_dport;
1066	} *thp;
1067
1068	if (sa->sa_family != AF_INET6 ||
1069	    sa->sa_len != sizeof(struct sockaddr_in6))
1070		return;
1071
1072	if (cmd == PRC_QUENCH)
1073		notify = tcp_quench;
1074	else if (cmd == PRC_MSGSIZE)
1075		notify = tcp_mtudisc;
1076	else if (!PRC_IS_REDIRECT(cmd) &&
1077		 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1078		return;
1079
1080	/* if the parameter is from icmp6, decode it. */
1081	if (d != NULL) {
1082		ip6cp = (struct ip6ctlparam *)d;
1083		m = ip6cp->ip6c_m;
1084		ip6 = ip6cp->ip6c_ip6;
1085		off = ip6cp->ip6c_off;
1086		sa6_src = ip6cp->ip6c_src;
1087	} else {
1088		m = NULL;
1089		ip6 = NULL;
1090		off = 0;	/* fool gcc */
1091		sa6_src = &sa6_any;
1092	}
1093
1094	if (ip6) {
1095		struct in_conninfo inc;
1096		/*
1097		 * XXX: We assume that when IPV6 is non NULL,
1098		 * M and OFF are valid.
1099		 */
1100
1101		/* check if we can safely examine src and dst ports */
1102		if (m->m_pkthdr.len < off + sizeof(*thp))
1103			return;
1104
1105		bzero(&th, sizeof(th));
1106		m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
1107
1108		in6_pcbnotify(&tcb, sa, th.th_dport,
1109		    (struct sockaddr *)ip6cp->ip6c_src,
1110		    th.th_sport, cmd, notify);
1111
1112		inc.inc_fport = th.th_dport;
1113		inc.inc_lport = th.th_sport;
1114		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
1115		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
1116		inc.inc_isipv6 = 1;
1117		syncache_unreach(&inc, &th);
1118	} else
1119		in6_pcbnotify(&tcb, sa, 0, (const struct sockaddr *)sa6_src,
1120			      0, cmd, notify);
1121}
1122#endif /* INET6 */
1123
1124
1125/*
1126 * Following is where TCP initial sequence number generation occurs.
1127 *
1128 * There are two places where we must use initial sequence numbers:
1129 * 1.  In SYN-ACK packets.
1130 * 2.  In SYN packets.
1131 *
1132 * All ISNs for SYN-ACK packets are generated by the syncache.  See
1133 * tcp_syncache.c for details.
1134 *
1135 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
1136 * depends on this property.  In addition, these ISNs should be
1137 * unguessable so as to prevent connection hijacking.  To satisfy
1138 * the requirements of this situation, the algorithm outlined in
1139 * RFC 1948 is used to generate sequence numbers.
1140 *
1141 * Implementation details:
1142 *
1143 * Time is based off the system timer, and is corrected so that it
1144 * increases by one megabyte per second.  This allows for proper
1145 * recycling on high speed LANs while still leaving over an hour
1146 * before rollover.
1147 *
1148 * net.inet.tcp.isn_reseed_interval controls the number of seconds
1149 * between seeding of isn_secret.  This is normally set to zero,
1150 * as reseeding should not be necessary.
1151 *
1152 */
1153
1154#define ISN_BYTES_PER_SECOND 1048576
1155
1156u_char isn_secret[32];
1157int isn_last_reseed;
1158MD5_CTX isn_ctx;
1159
1160tcp_seq
1161tcp_new_isn(tp)
1162	struct tcpcb *tp;
1163{
1164	u_int32_t md5_buffer[4];
1165	tcp_seq new_isn;
1166
1167	/* Seed if this is the first use, reseed if requested. */
1168	if ((isn_last_reseed == 0) || ((tcp_isn_reseed_interval > 0) &&
1169	     (((u_int)isn_last_reseed + (u_int)tcp_isn_reseed_interval*hz)
1170		< (u_int)ticks))) {
1171		read_random(&isn_secret, sizeof(isn_secret));
1172		isn_last_reseed = ticks;
1173	}
1174
1175	/* Compute the md5 hash and return the ISN. */
1176	MD5Init(&isn_ctx);
1177	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_fport, sizeof(u_short));
1178	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_lport, sizeof(u_short));
1179#ifdef INET6
1180	if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
1181		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
1182			  sizeof(struct in6_addr));
1183		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
1184			  sizeof(struct in6_addr));
1185	} else
1186#endif
1187	{
1188		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
1189			  sizeof(struct in_addr));
1190		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
1191			  sizeof(struct in_addr));
1192	}
1193	MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret));
1194	MD5Final((u_char *) &md5_buffer, &isn_ctx);
1195	new_isn = (tcp_seq) md5_buffer[0];
1196	new_isn += ticks * (ISN_BYTES_PER_SECOND / hz);
1197	return new_isn;
1198}
1199
1200/*
1201 * When a source quench is received, close congestion window
1202 * to one segment.  We will gradually open it again as we proceed.
1203 */
1204void
1205tcp_quench(inp, errno)
1206	struct inpcb *inp;
1207	int errno;
1208{
1209	struct tcpcb *tp = intotcpcb(inp);
1210
1211	if (tp)
1212		tp->snd_cwnd = tp->t_maxseg;
1213}
1214
1215/*
1216 * When a specific ICMP unreachable message is received and the
1217 * connection state is SYN-SENT, drop the connection.  This behavior
1218 * is controlled by the icmp_may_rst sysctl.
1219 */
1220void
1221tcp_drop_syn_sent(inp, errno)
1222	struct inpcb *inp;
1223	int errno;
1224{
1225	struct tcpcb *tp = intotcpcb(inp);
1226
1227	if (tp && tp->t_state == TCPS_SYN_SENT)
1228		tcp_drop(tp, errno);
1229}
1230
1231/*
1232 * When `need fragmentation' ICMP is received, update our idea of the MSS
1233 * based on the new value in the route.  Also nudge TCP to send something,
1234 * since we know the packet we just sent was dropped.
1235 * This duplicates some code in the tcp_mss() function in tcp_input.c.
1236 */
1237void
1238tcp_mtudisc(inp, errno)
1239	struct inpcb *inp;
1240	int errno;
1241{
1242	struct tcpcb *tp = intotcpcb(inp);
1243	struct rtentry *rt;
1244	struct rmxp_tao *taop;
1245	struct socket *so = inp->inp_socket;
1246	int offered;
1247	int mss;
1248#ifdef INET6
1249	int isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0;
1250#endif /* INET6 */
1251
1252	if (tp) {
1253#ifdef INET6
1254		if (isipv6)
1255			rt = tcp_rtlookup6(&inp->inp_inc);
1256		else
1257#endif /* INET6 */
1258		rt = tcp_rtlookup(&inp->inp_inc);
1259		if (!rt || !rt->rt_rmx.rmx_mtu) {
1260			tp->t_maxopd = tp->t_maxseg =
1261#ifdef INET6
1262				isipv6 ? tcp_v6mssdflt :
1263#endif /* INET6 */
1264				tcp_mssdflt;
1265			return;
1266		}
1267		taop = rmx_taop(rt->rt_rmx);
1268		offered = taop->tao_mssopt;
1269		mss = rt->rt_rmx.rmx_mtu -
1270#ifdef INET6
1271			(isipv6 ?
1272			 sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
1273#endif /* INET6 */
1274			 sizeof(struct tcpiphdr)
1275#ifdef INET6
1276			 )
1277#endif /* INET6 */
1278			;
1279
1280		if (offered)
1281			mss = min(mss, offered);
1282		/*
1283		 * XXX - The above conditional probably violates the TCP
1284		 * spec.  The problem is that, since we don't know the
1285		 * other end's MSS, we are supposed to use a conservative
1286		 * default.  But, if we do that, then MTU discovery will
1287		 * never actually take place, because the conservative
1288		 * default is much less than the MTUs typically seen
1289		 * on the Internet today.  For the moment, we'll sweep
1290		 * this under the carpet.
1291		 *
1292		 * The conservative default might not actually be a problem
1293		 * if the only case this occurs is when sending an initial
1294		 * SYN with options and data to a host we've never talked
1295		 * to before.  Then, they will reply with an MSS value which
1296		 * will get recorded and the new parameters should get
1297		 * recomputed.  For Further Study.
1298		 */
1299		if (tp->t_maxopd <= mss)
1300			return;
1301		tp->t_maxopd = mss;
1302
1303		if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
1304		    (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
1305			mss -= TCPOLEN_TSTAMP_APPA;
1306		if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
1307		    (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)
1308			mss -= TCPOLEN_CC_APPA;
1309#if	(MCLBYTES & (MCLBYTES - 1)) == 0
1310		if (mss > MCLBYTES)
1311			mss &= ~(MCLBYTES-1);
1312#else
1313		if (mss > MCLBYTES)
1314			mss = mss / MCLBYTES * MCLBYTES;
1315#endif
1316		if (so->so_snd.sb_hiwat < mss)
1317			mss = so->so_snd.sb_hiwat;
1318
1319		tp->t_maxseg = mss;
1320
1321		tcpstat.tcps_mturesent++;
1322		tp->t_rtttime = 0;
1323		tp->snd_nxt = tp->snd_una;
1324		tcp_output(tp);
1325	}
1326}
1327
1328/*
1329 * Look-up the routing entry to the peer of this inpcb.  If no route
1330 * is found and it cannot be allocated the return NULL.  This routine
1331 * is called by TCP routines that access the rmx structure and by tcp_mss
1332 * to get the interface MTU.
1333 */
1334struct rtentry *
1335tcp_rtlookup(inc)
1336	struct in_conninfo *inc;
1337{
1338	struct route *ro;
1339	struct rtentry *rt;
1340
1341	ro = &inc->inc_route;
1342	rt = ro->ro_rt;
1343	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1344		/* No route yet, so try to acquire one */
1345		if (inc->inc_faddr.s_addr != INADDR_ANY) {
1346			ro->ro_dst.sa_family = AF_INET;
1347			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
1348			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1349			    inc->inc_faddr;
1350			rtalloc(ro);
1351			rt = ro->ro_rt;
1352		}
1353	}
1354	return rt;
1355}
1356
1357#ifdef INET6
1358struct rtentry *
1359tcp_rtlookup6(inc)
1360	struct in_conninfo *inc;
1361{
1362	struct route_in6 *ro6;
1363	struct rtentry *rt;
1364
1365	ro6 = &inc->inc6_route;
1366	rt = ro6->ro_rt;
1367	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1368		/* No route yet, so try to acquire one */
1369		if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
1370			ro6->ro_dst.sin6_family = AF_INET6;
1371			ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
1372			ro6->ro_dst.sin6_addr = inc->inc6_faddr;
1373			rtalloc((struct route *)ro6);
1374			rt = ro6->ro_rt;
1375		}
1376	}
1377	return rt;
1378}
1379#endif /* INET6 */
1380
1381#ifdef IPSEC
1382/* compute ESP/AH header size for TCP, including outer IP header. */
1383size_t
1384ipsec_hdrsiz_tcp(tp)
1385	struct tcpcb *tp;
1386{
1387	struct inpcb *inp;
1388	struct mbuf *m;
1389	size_t hdrsiz;
1390	struct ip *ip;
1391#ifdef INET6
1392	struct ip6_hdr *ip6;
1393#endif /* INET6 */
1394	struct tcphdr *th;
1395
1396	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
1397		return 0;
1398	MGETHDR(m, M_DONTWAIT, MT_DATA);
1399	if (!m)
1400		return 0;
1401
1402#ifdef INET6
1403	if ((inp->inp_vflag & INP_IPV6) != 0) {
1404		ip6 = mtod(m, struct ip6_hdr *);
1405		th = (struct tcphdr *)(ip6 + 1);
1406		m->m_pkthdr.len = m->m_len =
1407			sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
1408		tcp_fillheaders(tp, ip6, th);
1409		hdrsiz = ipsec6_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1410	} else
1411#endif /* INET6 */
1412      {
1413	ip = mtod(m, struct ip *);
1414	th = (struct tcphdr *)(ip + 1);
1415	m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
1416	tcp_fillheaders(tp, ip, th);
1417	hdrsiz = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1418      }
1419
1420	m_free(m);
1421	return hdrsiz;
1422}
1423#endif /*IPSEC*/
1424
1425/*
1426 * Return a pointer to the cached information about the remote host.
1427 * The cached information is stored in the protocol specific part of
1428 * the route metrics.
1429 */
1430struct rmxp_tao *
1431tcp_gettaocache(inc)
1432	struct in_conninfo *inc;
1433{
1434	struct rtentry *rt;
1435
1436#ifdef INET6
1437	if (inc->inc_isipv6)
1438		rt = tcp_rtlookup6(inc);
1439	else
1440#endif /* INET6 */
1441	rt = tcp_rtlookup(inc);
1442
1443	/* Make sure this is a host route and is up. */
1444	if (rt == NULL ||
1445	    (rt->rt_flags & (RTF_UP|RTF_HOST)) != (RTF_UP|RTF_HOST))
1446		return NULL;
1447
1448	return rmx_taop(rt->rt_rmx);
1449}
1450
1451/*
1452 * Clear all the TAO cache entries, called from tcp_init.
1453 *
1454 * XXX
1455 * This routine is just an empty one, because we assume that the routing
1456 * routing tables are initialized at the same time when TCP, so there is
1457 * nothing in the cache left over.
1458 */
1459static void
1460tcp_cleartaocache()
1461{
1462}
1463