1df8bae1dSRodney W. Grimes /* 2e79adb8eSGarrett Wollman * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 3df8bae1dSRodney W. Grimes * The Regents of the University of California. All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 3. All advertising materials mentioning features or use of this software 14df8bae1dSRodney W. Grimes * must display the following acknowledgement: 15df8bae1dSRodney W. Grimes * This product includes software developed by the University of 16df8bae1dSRodney W. Grimes * California, Berkeley and its contributors. 17df8bae1dSRodney W. Grimes * 4. Neither the name of the University nor the names of its contributors 18df8bae1dSRodney W. Grimes * may be used to endorse or promote products derived from this software 19df8bae1dSRodney W. Grimes * without specific prior written permission. 20df8bae1dSRodney W. Grimes * 21df8bae1dSRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24df8bae1dSRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31df8bae1dSRodney W. Grimes * SUCH DAMAGE. 32df8bae1dSRodney W. Grimes * 33e79adb8eSGarrett Wollman * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 34c3aac50fSPeter Wemm * $FreeBSD$ 35df8bae1dSRodney W. Grimes */ 36df8bae1dSRodney W. Grimes 37f9e354dfSJulian Elischer #include "opt_ipfw.h" /* for ipfw_fwd */ 38fb59c426SYoshinobu Inoue #include "opt_inet6.h" 393a2a9f79SYoshinobu Inoue #include "opt_ipsec.h" 40c488362eSRobert Watson #include "opt_mac.h" 410cc12cc5SJoerg Wunsch #include "opt_tcpdebug.h" 42e46cd3d4SDag-Erling Smørgrav #include "opt_tcp_input.h" 430cc12cc5SJoerg Wunsch 44df8bae1dSRodney W. Grimes #include <sys/param.h> 4598163b98SPoul-Henning Kamp #include <sys/kernel.h> 46c488362eSRobert Watson #include <sys/mac.h> 47df8bae1dSRodney W. Grimes #include <sys/malloc.h> 48df8bae1dSRodney W. Grimes #include <sys/mbuf.h> 49a29f300eSGarrett Wollman #include <sys/proc.h> /* for proc0 declaration */ 50df8bae1dSRodney W. Grimes #include <sys/protosw.h> 51960ed29cSSeigo Tanimura #include <sys/signalvar.h> 52df8bae1dSRodney W. Grimes #include <sys/socket.h> 53df8bae1dSRodney W. Grimes #include <sys/socketvar.h> 54960ed29cSSeigo Tanimura #include <sys/sysctl.h> 55816a3d83SPoul-Henning Kamp #include <sys/syslog.h> 56960ed29cSSeigo Tanimura #include <sys/systm.h> 57df8bae1dSRodney W. Grimes 58e79adb8eSGarrett Wollman #include <machine/cpu.h> /* before tcp_seq.h, for tcp_random18() */ 59e79adb8eSGarrett Wollman 60df8bae1dSRodney W. Grimes #include <net/if.h> 61df8bae1dSRodney W. Grimes #include <net/route.h> 62df8bae1dSRodney W. Grimes 63df8bae1dSRodney W. Grimes #include <netinet/in.h> 64960ed29cSSeigo Tanimura #include <netinet/in_pcb.h> 65df8bae1dSRodney W. Grimes #include <netinet/in_systm.h> 66960ed29cSSeigo Tanimura #include <netinet/in_var.h> 67df8bae1dSRodney W. Grimes #include <netinet/ip.h> 68686cdd19SJun-ichiro itojun Hagino #include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */ 69686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp_var.h> /* for ICMP_BANDLIM */ 70df8bae1dSRodney W. Grimes #include <netinet/ip_var.h> 71686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h> 72686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp6.h> 73686cdd19SJun-ichiro itojun Hagino #include <netinet6/in6_pcb.h> 74960ed29cSSeigo Tanimura #include <netinet6/ip6_var.h> 75960ed29cSSeigo Tanimura #include <netinet6/nd6.h> 76df8bae1dSRodney W. Grimes #include <netinet/tcp.h> 77df8bae1dSRodney W. Grimes #include <netinet/tcp_fsm.h> 78df8bae1dSRodney W. Grimes #include <netinet/tcp_seq.h> 79df8bae1dSRodney W. Grimes #include <netinet/tcp_timer.h> 80df8bae1dSRodney W. Grimes #include <netinet/tcp_var.h> 81fb59c426SYoshinobu Inoue #include <netinet6/tcp6_var.h> 82df8bae1dSRodney W. Grimes #include <netinet/tcpip.h> 83610ee2f9SDavid Greenman #ifdef TCPDEBUG 84df8bae1dSRodney W. Grimes #include <netinet/tcp_debug.h> 85fb59c426SYoshinobu Inoue #endif /* TCPDEBUG */ 86fb59c426SYoshinobu Inoue 87fb59c426SYoshinobu Inoue #ifdef IPSEC 88fb59c426SYoshinobu Inoue #include <netinet6/ipsec.h> 893a2a9f79SYoshinobu Inoue #include <netinet6/ipsec6.h> 90fb59c426SYoshinobu Inoue #include <netkey/key.h> 91fb59c426SYoshinobu Inoue #endif /*IPSEC*/ 92fb59c426SYoshinobu Inoue 93db4f9cc7SJonathan Lemon #include <machine/in_cksum.h> 94db4f9cc7SJonathan Lemon 95fb59c426SYoshinobu Inoue MALLOC_DEFINE(M_TSEGQ, "tseg_qent", "TCP segment queue entry"); 96df8bae1dSRodney W. Grimes 97c068736aSJeffrey Hsu static const int tcprexmtthresh = 3; 982f96f1f4SGarrett Wollman tcp_cc tcp_ccgen; 990312fbe9SPoul-Henning Kamp 1002f96f1f4SGarrett Wollman struct tcpstat tcpstat; 101c73d99b5SRuslan Ermilov SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW, 1023d177f46SBill Fumerola &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)"); 1030312fbe9SPoul-Henning Kamp 104d78a37adSPaul Traina static int log_in_vain = 0; 105816a3d83SPoul-Henning Kamp SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW, 1063d177f46SBill Fumerola &log_in_vain, 0, "Log all incoming TCP connections"); 107816a3d83SPoul-Henning Kamp 10816f7f31fSGeoff Rehmet static int blackhole = 0; 10916f7f31fSGeoff Rehmet SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW, 11016f7f31fSGeoff Rehmet &blackhole, 0, "Do not send RST when dropping refused connections"); 11116f7f31fSGeoff Rehmet 112f498eeeeSDavid Greenman int tcp_delack_enabled = 1; 11384e33c9eSDavid Greenman SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW, 1143d177f46SBill Fumerola &tcp_delack_enabled, 0, 1153d177f46SBill Fumerola "Delay ACK to try and piggyback it onto a data packet"); 116f498eeeeSDavid Greenman 117f8613305SDag-Erling Smørgrav #ifdef TCP_DROP_SYNFIN 118f8613305SDag-Erling Smørgrav static int drop_synfin = 0; 119f8613305SDag-Erling Smørgrav SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW, 120f8613305SDag-Erling Smørgrav &drop_synfin, 0, "Drop TCP packets with SYN+FIN set"); 121f8613305SDag-Erling Smørgrav #endif 122f8613305SDag-Erling Smørgrav 12315bd2b43SDavid Greenman struct inpcbhead tcb; 124fb59c426SYoshinobu Inoue #define tcb6 tcb /* for KAME src sync over BSD*'s */ 12515bd2b43SDavid Greenman struct inpcbinfo tcbinfo; 126f76fcf6dSJeffrey Hsu struct mtx *tcbinfo_mtx; 127df8bae1dSRodney W. Grimes 1284d77a549SAlfred Perlstein static void tcp_dooptions(struct tcpopt *, u_char *, int, int); 1294d77a549SAlfred Perlstein static void tcp_pulloutofband(struct socket *, 1304d77a549SAlfred Perlstein struct tcphdr *, struct mbuf *, int); 1314d77a549SAlfred Perlstein static int tcp_reass(struct tcpcb *, struct tcphdr *, int *, 1324d77a549SAlfred Perlstein struct mbuf *); 1334d77a549SAlfred Perlstein static void tcp_xmit_timer(struct tcpcb *, int); 134c068736aSJeffrey Hsu static void tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *); 1350312fbe9SPoul-Henning Kamp 136fb59c426SYoshinobu Inoue /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */ 137fb59c426SYoshinobu Inoue #ifdef INET6 138fb59c426SYoshinobu Inoue #define ND6_HINT(tp) \ 139fb59c426SYoshinobu Inoue do { \ 140fb59c426SYoshinobu Inoue if ((tp) && (tp)->t_inpcb && \ 141fb59c426SYoshinobu Inoue ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0 && \ 142fb59c426SYoshinobu Inoue (tp)->t_inpcb->in6p_route.ro_rt) \ 143686cdd19SJun-ichiro itojun Hagino nd6_nud_hint((tp)->t_inpcb->in6p_route.ro_rt, NULL, 0); \ 144fb59c426SYoshinobu Inoue } while (0) 145fb59c426SYoshinobu Inoue #else 146fb59c426SYoshinobu Inoue #define ND6_HINT(tp) 147fb59c426SYoshinobu Inoue #endif 148df8bae1dSRodney W. Grimes 149df8bae1dSRodney W. Grimes /* 150262c1c1aSMatthew Dillon * Indicate whether this ack should be delayed. We can delay the ack if 151262c1c1aSMatthew Dillon * - delayed acks are enabled and 152262c1c1aSMatthew Dillon * - there is no delayed ack timer in progress and 153262c1c1aSMatthew Dillon * - our last ack wasn't a 0-sized window. We never want to delay 154262c1c1aSMatthew Dillon * the ack that opens up a 0-sized window. 155d8c85a26SJonathan Lemon */ 156d8c85a26SJonathan Lemon #define DELAY_ACK(tp) \ 157262c1c1aSMatthew Dillon (tcp_delack_enabled && !callout_pending(tp->tt_delack) && \ 158262c1c1aSMatthew Dillon (tp->t_flags & TF_RXWIN0SENT) == 0) 159d8c85a26SJonathan Lemon 1600312fbe9SPoul-Henning Kamp static int 161fb59c426SYoshinobu Inoue tcp_reass(tp, th, tlenp, m) 162df8bae1dSRodney W. Grimes register struct tcpcb *tp; 163fb59c426SYoshinobu Inoue register struct tcphdr *th; 164fb59c426SYoshinobu Inoue int *tlenp; 165df8bae1dSRodney W. Grimes struct mbuf *m; 166df8bae1dSRodney W. Grimes { 167fb59c426SYoshinobu Inoue struct tseg_qent *q; 168fb59c426SYoshinobu Inoue struct tseg_qent *p = NULL; 169fb59c426SYoshinobu Inoue struct tseg_qent *nq; 170fb59c426SYoshinobu Inoue struct tseg_qent *te; 171df8bae1dSRodney W. Grimes struct socket *so = tp->t_inpcb->inp_socket; 172df8bae1dSRodney W. Grimes int flags; 173df8bae1dSRodney W. Grimes 174df8bae1dSRodney W. Grimes /* 175fb59c426SYoshinobu Inoue * Call with th==0 after become established to 176df8bae1dSRodney W. Grimes * force pre-ESTABLISHED data up to user socket. 177df8bae1dSRodney W. Grimes */ 178fb59c426SYoshinobu Inoue if (th == 0) 179df8bae1dSRodney W. Grimes goto present; 180df8bae1dSRodney W. Grimes 181fb59c426SYoshinobu Inoue /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */ 182fb59c426SYoshinobu Inoue MALLOC(te, struct tseg_qent *, sizeof (struct tseg_qent), M_TSEGQ, 183fb59c426SYoshinobu Inoue M_NOWAIT); 184fb59c426SYoshinobu Inoue if (te == NULL) { 185fb59c426SYoshinobu Inoue tcpstat.tcps_rcvmemdrop++; 186fb59c426SYoshinobu Inoue m_freem(m); 187fb59c426SYoshinobu Inoue return (0); 188fb59c426SYoshinobu Inoue } 1896effc713SDoug Rabson 190df8bae1dSRodney W. Grimes /* 191df8bae1dSRodney W. Grimes * Find a segment which begins after this one does. 192df8bae1dSRodney W. Grimes */ 193fb59c426SYoshinobu Inoue LIST_FOREACH(q, &tp->t_segq, tqe_q) { 194fb59c426SYoshinobu Inoue if (SEQ_GT(q->tqe_th->th_seq, th->th_seq)) 195df8bae1dSRodney W. Grimes break; 196fb59c426SYoshinobu Inoue p = q; 197fb59c426SYoshinobu Inoue } 198df8bae1dSRodney W. Grimes 199df8bae1dSRodney W. Grimes /* 200df8bae1dSRodney W. Grimes * If there is a preceding segment, it may provide some of 201df8bae1dSRodney W. Grimes * our data already. If so, drop the data from the incoming 202df8bae1dSRodney W. Grimes * segment. If it provides all of our data, drop us. 203df8bae1dSRodney W. Grimes */ 2046effc713SDoug Rabson if (p != NULL) { 205df8bae1dSRodney W. Grimes register int i; 206df8bae1dSRodney W. Grimes /* conversion to int (in i) handles seq wraparound */ 207fb59c426SYoshinobu Inoue i = p->tqe_th->th_seq + p->tqe_len - th->th_seq; 208df8bae1dSRodney W. Grimes if (i > 0) { 209fb59c426SYoshinobu Inoue if (i >= *tlenp) { 210df8bae1dSRodney W. Grimes tcpstat.tcps_rcvduppack++; 211fb59c426SYoshinobu Inoue tcpstat.tcps_rcvdupbyte += *tlenp; 212df8bae1dSRodney W. Grimes m_freem(m); 213fb59c426SYoshinobu Inoue FREE(te, M_TSEGQ); 214a0292f23SGarrett Wollman /* 215a0292f23SGarrett Wollman * Try to present any queued data 216a0292f23SGarrett Wollman * at the left window edge to the user. 217a0292f23SGarrett Wollman * This is needed after the 3-WHS 218a0292f23SGarrett Wollman * completes. 219a0292f23SGarrett Wollman */ 220a0292f23SGarrett Wollman goto present; /* ??? */ 221df8bae1dSRodney W. Grimes } 222df8bae1dSRodney W. Grimes m_adj(m, i); 223fb59c426SYoshinobu Inoue *tlenp -= i; 224fb59c426SYoshinobu Inoue th->th_seq += i; 225df8bae1dSRodney W. Grimes } 226df8bae1dSRodney W. Grimes } 227df8bae1dSRodney W. Grimes tcpstat.tcps_rcvoopack++; 228fb59c426SYoshinobu Inoue tcpstat.tcps_rcvoobyte += *tlenp; 229df8bae1dSRodney W. Grimes 230df8bae1dSRodney W. Grimes /* 231df8bae1dSRodney W. Grimes * While we overlap succeeding segments trim them or, 232df8bae1dSRodney W. Grimes * if they are completely covered, dequeue them. 233df8bae1dSRodney W. Grimes */ 2346effc713SDoug Rabson while (q) { 235fb59c426SYoshinobu Inoue register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq; 236df8bae1dSRodney W. Grimes if (i <= 0) 237df8bae1dSRodney W. Grimes break; 238fb59c426SYoshinobu Inoue if (i < q->tqe_len) { 239fb59c426SYoshinobu Inoue q->tqe_th->th_seq += i; 240fb59c426SYoshinobu Inoue q->tqe_len -= i; 241fb59c426SYoshinobu Inoue m_adj(q->tqe_m, i); 242df8bae1dSRodney W. Grimes break; 243df8bae1dSRodney W. Grimes } 2446effc713SDoug Rabson 245fb59c426SYoshinobu Inoue nq = LIST_NEXT(q, tqe_q); 246fb59c426SYoshinobu Inoue LIST_REMOVE(q, tqe_q); 247fb59c426SYoshinobu Inoue m_freem(q->tqe_m); 248fb59c426SYoshinobu Inoue FREE(q, M_TSEGQ); 2496effc713SDoug Rabson q = nq; 250df8bae1dSRodney W. Grimes } 251df8bae1dSRodney W. Grimes 252fb59c426SYoshinobu Inoue /* Insert the new segment queue entry into place. */ 253fb59c426SYoshinobu Inoue te->tqe_m = m; 254fb59c426SYoshinobu Inoue te->tqe_th = th; 255fb59c426SYoshinobu Inoue te->tqe_len = *tlenp; 256fb59c426SYoshinobu Inoue 2576effc713SDoug Rabson if (p == NULL) { 258fb59c426SYoshinobu Inoue LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q); 2596effc713SDoug Rabson } else { 260fb59c426SYoshinobu Inoue LIST_INSERT_AFTER(p, te, tqe_q); 2616effc713SDoug Rabson } 262df8bae1dSRodney W. Grimes 263df8bae1dSRodney W. Grimes present: 264df8bae1dSRodney W. Grimes /* 265df8bae1dSRodney W. Grimes * Present data to user, advancing rcv_nxt through 266df8bae1dSRodney W. Grimes * completed sequence space. 267df8bae1dSRodney W. Grimes */ 268a0292f23SGarrett Wollman if (!TCPS_HAVEESTABLISHED(tp->t_state)) 269df8bae1dSRodney W. Grimes return (0); 270fb59c426SYoshinobu Inoue q = LIST_FIRST(&tp->t_segq); 271fb59c426SYoshinobu Inoue if (!q || q->tqe_th->th_seq != tp->rcv_nxt) 272df8bae1dSRodney W. Grimes return (0); 273df8bae1dSRodney W. Grimes do { 274fb59c426SYoshinobu Inoue tp->rcv_nxt += q->tqe_len; 275fb59c426SYoshinobu Inoue flags = q->tqe_th->th_flags & TH_FIN; 276fb59c426SYoshinobu Inoue nq = LIST_NEXT(q, tqe_q); 277fb59c426SYoshinobu Inoue LIST_REMOVE(q, tqe_q); 2784cc20ab1SSeigo Tanimura if (so->so_state & SS_CANTRCVMORE) 279fb59c426SYoshinobu Inoue m_freem(q->tqe_m); 2804cc20ab1SSeigo Tanimura else 281fb59c426SYoshinobu Inoue sbappend(&so->so_rcv, q->tqe_m); 282fb59c426SYoshinobu Inoue FREE(q, M_TSEGQ); 2836effc713SDoug Rabson q = nq; 284fb59c426SYoshinobu Inoue } while (q && q->tqe_th->th_seq == tp->rcv_nxt); 285fb59c426SYoshinobu Inoue ND6_HINT(tp); 286df8bae1dSRodney W. Grimes sorwakeup(so); 287df8bae1dSRodney W. Grimes return (flags); 288df8bae1dSRodney W. Grimes } 289df8bae1dSRodney W. Grimes 290df8bae1dSRodney W. Grimes /* 291df8bae1dSRodney W. Grimes * TCP input routine, follows pages 65-76 of the 292df8bae1dSRodney W. Grimes * protocol specification dated September, 1981 very closely. 293df8bae1dSRodney W. Grimes */ 294fb59c426SYoshinobu Inoue #ifdef INET6 295fb59c426SYoshinobu Inoue int 296fb59c426SYoshinobu Inoue tcp6_input(mp, offp, proto) 297fb59c426SYoshinobu Inoue struct mbuf **mp; 298fb59c426SYoshinobu Inoue int *offp, proto; 299fb59c426SYoshinobu Inoue { 300fb59c426SYoshinobu Inoue register struct mbuf *m = *mp; 30133841545SHajimu UMEMOTO struct in6_ifaddr *ia6; 302fb59c426SYoshinobu Inoue 303fb59c426SYoshinobu Inoue IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE); 304fb59c426SYoshinobu Inoue 305fb59c426SYoshinobu Inoue /* 306fb59c426SYoshinobu Inoue * draft-itojun-ipv6-tcp-to-anycast 307fb59c426SYoshinobu Inoue * better place to put this in? 308fb59c426SYoshinobu Inoue */ 30933841545SHajimu UMEMOTO ia6 = ip6_getdstifaddr(m); 31033841545SHajimu UMEMOTO if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) { 311fb59c426SYoshinobu Inoue struct ip6_hdr *ip6; 312fb59c426SYoshinobu Inoue 313fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 314fb59c426SYoshinobu Inoue icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR, 315fb59c426SYoshinobu Inoue (caddr_t)&ip6->ip6_dst - (caddr_t)ip6); 316fb59c426SYoshinobu Inoue return IPPROTO_DONE; 317fb59c426SYoshinobu Inoue } 318fb59c426SYoshinobu Inoue 319f0ffb944SJulian Elischer tcp_input(m, *offp); 320fb59c426SYoshinobu Inoue return IPPROTO_DONE; 321fb59c426SYoshinobu Inoue } 322fb59c426SYoshinobu Inoue #endif 323fb59c426SYoshinobu Inoue 324df8bae1dSRodney W. Grimes void 325f0ffb944SJulian Elischer tcp_input(m, off0) 326df8bae1dSRodney W. Grimes register struct mbuf *m; 327f0ffb944SJulian Elischer int off0; 328df8bae1dSRodney W. Grimes { 329fb59c426SYoshinobu Inoue register struct tcphdr *th; 330fb59c426SYoshinobu Inoue register struct ip *ip = NULL; 331fb59c426SYoshinobu Inoue register struct ipovly *ipov; 332f76fcf6dSJeffrey Hsu register struct inpcb *inp = NULL; 333e79adb8eSGarrett Wollman u_char *optp = NULL; 33426f9a767SRodney W. Grimes int optlen = 0; 335df8bae1dSRodney W. Grimes int len, tlen, off; 336fb59c426SYoshinobu Inoue int drop_hdrlen; 337df8bae1dSRodney W. Grimes register struct tcpcb *tp = 0; 338fb59c426SYoshinobu Inoue register int thflags; 33926f9a767SRodney W. Grimes struct socket *so = 0; 340df8bae1dSRodney W. Grimes int todrop, acked, ourfinisacked, needoutput = 0; 341a0292f23SGarrett Wollman u_long tiwin; 342a0292f23SGarrett Wollman struct tcpopt to; /* options in this segment */ 343a0292f23SGarrett Wollman struct rmxp_tao *taop; /* pointer to our TAO cache entry */ 344a0292f23SGarrett Wollman struct rmxp_tao tao_noncached; /* in case there's no cached entry */ 345f76fcf6dSJeffrey Hsu int headlocked = 0; 346c068736aSJeffrey Hsu struct sockaddr_in *next_hop = NULL; 347c068736aSJeffrey Hsu int rstreason; /* For badport_bandlim accounting purposes */ 348c068736aSJeffrey Hsu 349c068736aSJeffrey Hsu struct ip6_hdr *ip6 = NULL; 350c068736aSJeffrey Hsu #ifdef INET6 351c068736aSJeffrey Hsu int isipv6; 352c068736aSJeffrey Hsu #else 353c068736aSJeffrey Hsu const int isipv6 = 0; 354c068736aSJeffrey Hsu #endif 355f76fcf6dSJeffrey Hsu 356610ee2f9SDavid Greenman #ifdef TCPDEBUG 357c068736aSJeffrey Hsu /* 358c068736aSJeffrey Hsu * The size of tcp_saveipgen must be the size of the max ip header, 359c068736aSJeffrey Hsu * now IPv6. 360c068736aSJeffrey Hsu */ 361410bb1bfSLuigi Rizzo u_char tcp_saveipgen[40]; 362410bb1bfSLuigi Rizzo struct tcphdr tcp_savetcp; 363610ee2f9SDavid Greenman short ostate = 0; 364610ee2f9SDavid Greenman #endif 365c068736aSJeffrey Hsu 366c488362eSRobert Watson #ifdef MAC 367c488362eSRobert Watson int error; 368c488362eSRobert Watson #endif 369df8bae1dSRodney W. Grimes 3702b25acc1SLuigi Rizzo /* Grab info from MT_TAG mbufs prepended to the chain. */ 3712b25acc1SLuigi Rizzo for (;m && m->m_type == MT_TAG; m = m->m_next) { 3722b25acc1SLuigi Rizzo if (m->m_tag_id == PACKET_TAG_IPFORWARD) 3732b25acc1SLuigi Rizzo next_hop = (struct sockaddr_in *)m->m_hdr.mh_data; 3742b25acc1SLuigi Rizzo } 375fb59c426SYoshinobu Inoue #ifdef INET6 376fb59c426SYoshinobu Inoue isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0; 377fb59c426SYoshinobu Inoue #endif 378a0292f23SGarrett Wollman bzero((char *)&to, sizeof(to)); 379a0292f23SGarrett Wollman 380df8bae1dSRodney W. Grimes tcpstat.tcps_rcvtotal++; 381fb59c426SYoshinobu Inoue 382fb59c426SYoshinobu Inoue if (isipv6) { 383fb59c426SYoshinobu Inoue /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */ 384fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 385fb59c426SYoshinobu Inoue tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0; 386fb59c426SYoshinobu Inoue if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) { 387fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbadsum++; 388fb59c426SYoshinobu Inoue goto drop; 389fb59c426SYoshinobu Inoue } 390fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip6 + off0); 39133841545SHajimu UMEMOTO 39233841545SHajimu UMEMOTO /* 39333841545SHajimu UMEMOTO * Be proactive about unspecified IPv6 address in source. 39433841545SHajimu UMEMOTO * As we use all-zero to indicate unbounded/unconnected pcb, 39533841545SHajimu UMEMOTO * unspecified IPv6 address can be used to confuse us. 39633841545SHajimu UMEMOTO * 39733841545SHajimu UMEMOTO * Note that packets with unspecified IPv6 destination is 39833841545SHajimu UMEMOTO * already dropped in ip6_input. 39933841545SHajimu UMEMOTO */ 40033841545SHajimu UMEMOTO if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 40133841545SHajimu UMEMOTO /* XXX stat */ 40233841545SHajimu UMEMOTO goto drop; 40333841545SHajimu UMEMOTO } 404c068736aSJeffrey Hsu } else { 405df8bae1dSRodney W. Grimes /* 406df8bae1dSRodney W. Grimes * Get IP and TCP header together in first mbuf. 407df8bae1dSRodney W. Grimes * Note: IP leaves IP header in first mbuf. 408df8bae1dSRodney W. Grimes */ 409fb59c426SYoshinobu Inoue if (off0 > sizeof (struct ip)) { 410df8bae1dSRodney W. Grimes ip_stripoptions(m, (struct mbuf *)0); 411fb59c426SYoshinobu Inoue off0 = sizeof(struct ip); 412fb59c426SYoshinobu Inoue } 413df8bae1dSRodney W. Grimes if (m->m_len < sizeof (struct tcpiphdr)) { 414df8bae1dSRodney W. Grimes if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { 415df8bae1dSRodney W. Grimes tcpstat.tcps_rcvshort++; 416df8bae1dSRodney W. Grimes return; 417df8bae1dSRodney W. Grimes } 418df8bae1dSRodney W. Grimes } 419fb59c426SYoshinobu Inoue ip = mtod(m, struct ip *); 420fb59c426SYoshinobu Inoue ipov = (struct ipovly *)ip; 421db4f9cc7SJonathan Lemon th = (struct tcphdr *)((caddr_t)ip + off0); 422db4f9cc7SJonathan Lemon tlen = ip->ip_len; 423df8bae1dSRodney W. Grimes 424db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) { 425db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) 426db4f9cc7SJonathan Lemon th->th_sum = m->m_pkthdr.csum_data; 427db4f9cc7SJonathan Lemon else 428db4f9cc7SJonathan Lemon th->th_sum = in_pseudo(ip->ip_src.s_addr, 429c068736aSJeffrey Hsu ip->ip_dst.s_addr, 430c068736aSJeffrey Hsu htonl(m->m_pkthdr.csum_data + 431c068736aSJeffrey Hsu ip->ip_len + 432c068736aSJeffrey Hsu IPPROTO_TCP)); 433db4f9cc7SJonathan Lemon th->th_sum ^= 0xffff; 434db4f9cc7SJonathan Lemon } else { 435df8bae1dSRodney W. Grimes /* 436df8bae1dSRodney W. Grimes * Checksum extended TCP header and data. 437df8bae1dSRodney W. Grimes */ 438df8bae1dSRodney W. Grimes len = sizeof (struct ip) + tlen; 439fb59c426SYoshinobu Inoue bzero(ipov->ih_x1, sizeof(ipov->ih_x1)); 440fb59c426SYoshinobu Inoue ipov->ih_len = (u_short)tlen; 441fd8e4ebcSMike Barcroft ipov->ih_len = htons(ipov->ih_len); 442fb59c426SYoshinobu Inoue th->th_sum = in_cksum(m, len); 443db4f9cc7SJonathan Lemon } 444fb59c426SYoshinobu Inoue if (th->th_sum) { 445df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbadsum++; 446df8bae1dSRodney W. Grimes goto drop; 447df8bae1dSRodney W. Grimes } 448fb59c426SYoshinobu Inoue #ifdef INET6 449fb59c426SYoshinobu Inoue /* Re-initialization for later version check */ 450fb59c426SYoshinobu Inoue ip->ip_v = IPVERSION; 451fb59c426SYoshinobu Inoue #endif 452fb59c426SYoshinobu Inoue } 453df8bae1dSRodney W. Grimes 454df8bae1dSRodney W. Grimes /* 455df8bae1dSRodney W. Grimes * Check that TCP offset makes sense, 456df8bae1dSRodney W. Grimes * pull out TCP options and adjust length. XXX 457df8bae1dSRodney W. Grimes */ 458fb59c426SYoshinobu Inoue off = th->th_off << 2; 459df8bae1dSRodney W. Grimes if (off < sizeof (struct tcphdr) || off > tlen) { 460df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbadoff++; 461df8bae1dSRodney W. Grimes goto drop; 462df8bae1dSRodney W. Grimes } 463fb59c426SYoshinobu Inoue tlen -= off; /* tlen is used instead of ti->ti_len */ 464df8bae1dSRodney W. Grimes if (off > sizeof (struct tcphdr)) { 465fb59c426SYoshinobu Inoue if (isipv6) { 466fb59c426SYoshinobu Inoue IP6_EXTHDR_CHECK(m, off0, off, ); 467fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 468fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip6 + off0); 469c068736aSJeffrey Hsu } else { 470df8bae1dSRodney W. Grimes if (m->m_len < sizeof(struct ip) + off) { 471c068736aSJeffrey Hsu if ((m = m_pullup(m, sizeof (struct ip) + off)) 472c068736aSJeffrey Hsu == 0) { 473df8bae1dSRodney W. Grimes tcpstat.tcps_rcvshort++; 474df8bae1dSRodney W. Grimes return; 475df8bae1dSRodney W. Grimes } 476fb59c426SYoshinobu Inoue ip = mtod(m, struct ip *); 477fb59c426SYoshinobu Inoue ipov = (struct ipovly *)ip; 478fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip + off0); 479fb59c426SYoshinobu Inoue } 480df8bae1dSRodney W. Grimes } 481df8bae1dSRodney W. Grimes optlen = off - sizeof (struct tcphdr); 482fb59c426SYoshinobu Inoue optp = (u_char *)(th + 1); 483df8bae1dSRodney W. Grimes } 484fb59c426SYoshinobu Inoue thflags = th->th_flags; 485df8bae1dSRodney W. Grimes 486e46cd3d4SDag-Erling Smørgrav #ifdef TCP_DROP_SYNFIN 487e46cd3d4SDag-Erling Smørgrav /* 488e46cd3d4SDag-Erling Smørgrav * If the drop_synfin option is enabled, drop all packets with 489e46cd3d4SDag-Erling Smørgrav * both the SYN and FIN bits set. This prevents e.g. nmap from 490e46cd3d4SDag-Erling Smørgrav * identifying the TCP/IP stack. 491e46cd3d4SDag-Erling Smørgrav * 492a589a70eSGarrett Wollman * This is a violation of the TCP specification. 493e46cd3d4SDag-Erling Smørgrav */ 494fb59c426SYoshinobu Inoue if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN)) 495e46cd3d4SDag-Erling Smørgrav goto drop; 496e46cd3d4SDag-Erling Smørgrav #endif 497e46cd3d4SDag-Erling Smørgrav 498df8bae1dSRodney W. Grimes /* 499df8bae1dSRodney W. Grimes * Convert TCP protocol specific fields to host format. 500df8bae1dSRodney W. Grimes */ 501fd8e4ebcSMike Barcroft th->th_seq = ntohl(th->th_seq); 502fd8e4ebcSMike Barcroft th->th_ack = ntohl(th->th_ack); 503fd8e4ebcSMike Barcroft th->th_win = ntohs(th->th_win); 504fd8e4ebcSMike Barcroft th->th_urp = ntohs(th->th_urp); 505df8bae1dSRodney W. Grimes 506df8bae1dSRodney W. Grimes /* 507fb59c426SYoshinobu Inoue * Delay droping TCP, IP headers, IPv6 ext headers, and TCP options, 508fb59c426SYoshinobu Inoue * until after ip6_savecontrol() is called and before other functions 509fb59c426SYoshinobu Inoue * which don't want those proto headers. 510fb59c426SYoshinobu Inoue * Because ip6_savecontrol() is going to parse the mbuf to 511fb59c426SYoshinobu Inoue * search for data to be passed up to user-land, it wants mbuf 512fb59c426SYoshinobu Inoue * parameters to be unchanged. 51388ff5695SSUZUKI Shinsuke * XXX: the call of ip6_savecontrol() has been obsoleted based on 51488ff5695SSUZUKI Shinsuke * latest version of the advanced API (20020110). 515755c1f07SAndras Olah */ 516fb59c426SYoshinobu Inoue drop_hdrlen = off0 + off; 517755c1f07SAndras Olah 518755c1f07SAndras Olah /* 519df8bae1dSRodney W. Grimes * Locate pcb for segment. 520df8bae1dSRodney W. Grimes */ 521f76fcf6dSJeffrey Hsu INP_INFO_WLOCK(&tcbinfo); 522f76fcf6dSJeffrey Hsu headlocked = 1; 523df8bae1dSRodney W. Grimes findpcb: 5242b25acc1SLuigi Rizzo /* IPFIREWALL_FORWARD section */ 525c068736aSJeffrey Hsu if (next_hop != NULL && isipv6 == 0) { /* IPv6 support is not yet */ 526f9e354dfSJulian Elischer /* 5272b25acc1SLuigi Rizzo * Transparently forwarded. Pretend to be the destination. 528f9e354dfSJulian Elischer * already got one like this? 529f9e354dfSJulian Elischer */ 530fb59c426SYoshinobu Inoue inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport, 531c068736aSJeffrey Hsu ip->ip_dst, th->th_dport, 532c068736aSJeffrey Hsu 0, m->m_pkthdr.rcvif); 533f9e354dfSJulian Elischer if (!inp) { 534c068736aSJeffrey Hsu /* It's new. Try find the ambushing socket. */ 535f9e354dfSJulian Elischer inp = in_pcblookup_hash(&tcbinfo, 536fb59c426SYoshinobu Inoue ip->ip_src, th->th_sport, 5372b25acc1SLuigi Rizzo next_hop->sin_addr, 538c068736aSJeffrey Hsu next_hop->sin_port ? 539c068736aSJeffrey Hsu ntohs(next_hop->sin_port) : 540c068736aSJeffrey Hsu th->th_dport, 541c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 542f9e354dfSJulian Elischer } 543c068736aSJeffrey Hsu } else { 544fb59c426SYoshinobu Inoue if (isipv6) 545c068736aSJeffrey Hsu inp = in6_pcblookup_hash(&tcbinfo, 546c068736aSJeffrey Hsu &ip6->ip6_src, th->th_sport, 547c068736aSJeffrey Hsu &ip6->ip6_dst, th->th_dport, 548c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 549fb59c426SYoshinobu Inoue else 550c068736aSJeffrey Hsu inp = in_pcblookup_hash(&tcbinfo, 551c068736aSJeffrey Hsu ip->ip_src, th->th_sport, 552c068736aSJeffrey Hsu ip->ip_dst, th->th_dport, 553c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 554fb59c426SYoshinobu Inoue } 555f9e354dfSJulian Elischer 556fb59c426SYoshinobu Inoue #ifdef IPSEC 557fb59c426SYoshinobu Inoue if (isipv6) { 558fb59c426SYoshinobu Inoue if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) { 559fb59c426SYoshinobu Inoue ipsec6stat.in_polvio++; 560fb59c426SYoshinobu Inoue goto drop; 561fb59c426SYoshinobu Inoue } 562c068736aSJeffrey Hsu } else { 563fb59c426SYoshinobu Inoue if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) { 564fb59c426SYoshinobu Inoue ipsecstat.in_polvio++; 565fb59c426SYoshinobu Inoue goto drop; 566fb59c426SYoshinobu Inoue } 567c068736aSJeffrey Hsu } 568c068736aSJeffrey Hsu #endif 569df8bae1dSRodney W. Grimes 570df8bae1dSRodney W. Grimes /* 571df8bae1dSRodney W. Grimes * If the state is CLOSED (i.e., TCB does not exist) then 572df8bae1dSRodney W. Grimes * all data in the incoming segment is discarded. 573df8bae1dSRodney W. Grimes * If the TCB exists but is in CLOSED state, it is embryonic, 574df8bae1dSRodney W. Grimes * but should either do a listen or a connect soon. 575df8bae1dSRodney W. Grimes */ 576816a3d83SPoul-Henning Kamp if (inp == NULL) { 5772e4e1b4cSGeoff Rehmet if (log_in_vain) { 578fb59c426SYoshinobu Inoue #ifdef INET6 579ded7008aSJuli Mallett char dbuf[INET6_ADDRSTRLEN+2], sbuf[INET6_ADDRSTRLEN+2]; 580c068736aSJeffrey Hsu #else 581fb59c426SYoshinobu Inoue char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"]; 582c068736aSJeffrey Hsu #endif 58375cfc95fSAndrey A. Chernov 584fb59c426SYoshinobu Inoue if (isipv6) { 585ded7008aSJuli Mallett strcpy(dbuf, "["); 586ded7008aSJuli Mallett strcpy(sbuf, "["); 587ded7008aSJuli Mallett strcat(dbuf, ip6_sprintf(&ip6->ip6_dst)); 588ded7008aSJuli Mallett strcat(sbuf, ip6_sprintf(&ip6->ip6_src)); 589ded7008aSJuli Mallett strcat(dbuf, "]"); 590ded7008aSJuli Mallett strcat(sbuf, "]"); 591c068736aSJeffrey Hsu } else { 592fb59c426SYoshinobu Inoue strcpy(dbuf, inet_ntoa(ip->ip_dst)); 593fb59c426SYoshinobu Inoue strcpy(sbuf, inet_ntoa(ip->ip_src)); 594fb59c426SYoshinobu Inoue } 5952e4e1b4cSGeoff Rehmet switch (log_in_vain) { 5962e4e1b4cSGeoff Rehmet case 1: 597fb59c426SYoshinobu Inoue if (thflags & TH_SYN) 598592071e8SBruce Evans log(LOG_INFO, 599c068736aSJeffrey Hsu "Connection attempt to TCP %s:%d " 600c068736aSJeffrey Hsu "from %s:%d\n", 601c068736aSJeffrey Hsu dbuf, ntohs(th->th_dport), sbuf, 602fb59c426SYoshinobu Inoue ntohs(th->th_sport)); 6032e4e1b4cSGeoff Rehmet break; 6042e4e1b4cSGeoff Rehmet case 2: 6052e4e1b4cSGeoff Rehmet log(LOG_INFO, 606c068736aSJeffrey Hsu "Connection attempt to TCP %s:%d " 607c068736aSJeffrey Hsu "from %s:%d flags:0x%x\n", 608fb59c426SYoshinobu Inoue dbuf, ntohs(th->th_dport), sbuf, 609fb59c426SYoshinobu Inoue ntohs(th->th_sport), thflags); 6102e4e1b4cSGeoff Rehmet break; 6112e4e1b4cSGeoff Rehmet default: 6122e4e1b4cSGeoff Rehmet break; 6132e4e1b4cSGeoff Rehmet } 61475cfc95fSAndrey A. Chernov } 6152e4e1b4cSGeoff Rehmet if (blackhole) { 6162e4e1b4cSGeoff Rehmet switch (blackhole) { 617828b7f40SGeoff Rehmet case 1: 618fb59c426SYoshinobu Inoue if (thflags & TH_SYN) 619828b7f40SGeoff Rehmet goto drop; 620828b7f40SGeoff Rehmet break; 621828b7f40SGeoff Rehmet case 2: 622828b7f40SGeoff Rehmet goto drop; 623828b7f40SGeoff Rehmet default: 624828b7f40SGeoff Rehmet goto drop; 6252e4e1b4cSGeoff Rehmet } 626828b7f40SGeoff Rehmet } 627a57815efSBosko Milekic rstreason = BANDLIM_RST_CLOSEDPORT; 628a57815efSBosko Milekic goto dropwithreset; 629816a3d83SPoul-Henning Kamp } 630f76fcf6dSJeffrey Hsu INP_LOCK(inp); 631df8bae1dSRodney W. Grimes tp = intotcpcb(inp); 63209f81a46SBosko Milekic if (tp == 0) { 633f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 634a57815efSBosko Milekic rstreason = BANDLIM_RST_CLOSEDPORT; 635a57815efSBosko Milekic goto dropwithreset; 63609f81a46SBosko Milekic } 637df8bae1dSRodney W. Grimes if (tp->t_state == TCPS_CLOSED) 638df8bae1dSRodney W. Grimes goto drop; 639df8bae1dSRodney W. Grimes 640df8bae1dSRodney W. Grimes /* Unscale the window into a 32-bit value. */ 641fb59c426SYoshinobu Inoue if ((thflags & TH_SYN) == 0) 642fb59c426SYoshinobu Inoue tiwin = th->th_win << tp->snd_scale; 643df8bae1dSRodney W. Grimes else 644fb59c426SYoshinobu Inoue tiwin = th->th_win; 645fb59c426SYoshinobu Inoue 646df8bae1dSRodney W. Grimes so = inp->inp_socket; 647c488362eSRobert Watson #ifdef MAC 648fb95b5d3SRobert Watson error = mac_check_socket_deliver(so, m); 649c488362eSRobert Watson if (error) 650c488362eSRobert Watson goto drop; 651c488362eSRobert Watson #endif 652df8bae1dSRodney W. Grimes if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 653be2ac88cSJonathan Lemon struct in_conninfo inc; 654610ee2f9SDavid Greenman #ifdef TCPDEBUG 655df8bae1dSRodney W. Grimes if (so->so_options & SO_DEBUG) { 656df8bae1dSRodney W. Grimes ostate = tp->t_state; 657fb59c426SYoshinobu Inoue if (isipv6) 658fb59c426SYoshinobu Inoue bcopy((char *)ip6, (char *)tcp_saveipgen, 659fb59c426SYoshinobu Inoue sizeof(*ip6)); 660fb59c426SYoshinobu Inoue else 661c068736aSJeffrey Hsu bcopy((char *)ip, (char *)tcp_saveipgen, 662c068736aSJeffrey Hsu sizeof(*ip)); 663fb59c426SYoshinobu Inoue tcp_savetcp = *th; 664df8bae1dSRodney W. Grimes } 665610ee2f9SDavid Greenman #endif 666be2ac88cSJonathan Lemon /* skip if this isn't a listen socket */ 6674cc20ab1SSeigo Tanimura if ((so->so_options & SO_ACCEPTCONN) == 0) 668be2ac88cSJonathan Lemon goto after_listen; 669fb59c426SYoshinobu Inoue #ifdef INET6 670be2ac88cSJonathan Lemon inc.inc_isipv6 = isipv6; 671c068736aSJeffrey Hsu #endif 672be2ac88cSJonathan Lemon if (isipv6) { 673be2ac88cSJonathan Lemon inc.inc6_faddr = ip6->ip6_src; 674be2ac88cSJonathan Lemon inc.inc6_laddr = ip6->ip6_dst; 675be2ac88cSJonathan Lemon inc.inc6_route.ro_rt = NULL; /* XXX */ 676c068736aSJeffrey Hsu } else { 677be2ac88cSJonathan Lemon inc.inc_faddr = ip->ip_src; 678be2ac88cSJonathan Lemon inc.inc_laddr = ip->ip_dst; 679be2ac88cSJonathan Lemon inc.inc_route.ro_rt = NULL; /* XXX */ 680be2ac88cSJonathan Lemon } 681be2ac88cSJonathan Lemon inc.inc_fport = th->th_sport; 682be2ac88cSJonathan Lemon inc.inc_lport = th->th_dport; 683be2ac88cSJonathan Lemon 684fb59c426SYoshinobu Inoue /* 685be2ac88cSJonathan Lemon * If the state is LISTEN then ignore segment if it contains 686be2ac88cSJonathan Lemon * a RST. If the segment contains an ACK then it is bad and 687be2ac88cSJonathan Lemon * send a RST. If it does not contain a SYN then it is not 688be2ac88cSJonathan Lemon * interesting; drop it. 689be2ac88cSJonathan Lemon * 690be2ac88cSJonathan Lemon * If the state is SYN_RECEIVED (syncache) and seg contains 691be2ac88cSJonathan Lemon * an ACK, but not for our SYN/ACK, send a RST. If the seg 692be2ac88cSJonathan Lemon * contains a RST, check the sequence number to see if it 693be2ac88cSJonathan Lemon * is a valid reset segment. 694fb59c426SYoshinobu Inoue */ 695fb59c426SYoshinobu Inoue if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 696be2ac88cSJonathan Lemon if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) { 697be2ac88cSJonathan Lemon if (!syncache_expand(&inc, th, &so, m)) { 6984195b4afSPaul Traina /* 699be2ac88cSJonathan Lemon * No syncache entry, or ACK was not 700be2ac88cSJonathan Lemon * for our SYN/ACK. Send a RST. 7014195b4afSPaul Traina */ 702be2ac88cSJonathan Lemon tcpstat.tcps_badsyn++; 703be2ac88cSJonathan Lemon rstreason = BANDLIM_RST_OPENPORT; 704be2ac88cSJonathan Lemon goto dropwithreset; 705be2ac88cSJonathan Lemon } 706f76fcf6dSJeffrey Hsu if (so == NULL) { 707be2ac88cSJonathan Lemon /* 708be2ac88cSJonathan Lemon * Could not complete 3-way handshake, 709be2ac88cSJonathan Lemon * connection is being closed down, and 710be2ac88cSJonathan Lemon * syncache will free mbuf. 711be2ac88cSJonathan Lemon */ 712f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 713f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 714be2ac88cSJonathan Lemon return; 715f76fcf6dSJeffrey Hsu } 716be2ac88cSJonathan Lemon /* 717be2ac88cSJonathan Lemon * Socket is created in state SYN_RECEIVED. 718be2ac88cSJonathan Lemon * Continue processing segment. 719be2ac88cSJonathan Lemon */ 720f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 721be2ac88cSJonathan Lemon inp = sotoinpcb(so); 722f76fcf6dSJeffrey Hsu INP_LOCK(inp); 723be2ac88cSJonathan Lemon tp = intotcpcb(inp); 724be2ac88cSJonathan Lemon /* 725be2ac88cSJonathan Lemon * This is what would have happened in 726e6658b12SRobert Watson * tcp_output() when the SYN,ACK was sent. 727be2ac88cSJonathan Lemon */ 728be2ac88cSJonathan Lemon tp->snd_up = tp->snd_una; 729be2ac88cSJonathan Lemon tp->snd_max = tp->snd_nxt = tp->iss + 1; 730be2ac88cSJonathan Lemon tp->last_ack_sent = tp->rcv_nxt; 731be2ac88cSJonathan Lemon /* 732be2ac88cSJonathan Lemon * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled 733be2ac88cSJonathan Lemon * until the _second_ ACK is received: 734be2ac88cSJonathan Lemon * rcv SYN (set wscale opts) --> send SYN/ACK, set snd_wnd = window. 735be2ac88cSJonathan Lemon * rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale, 736be2ac88cSJonathan Lemon * move to ESTAB, set snd_wnd to tiwin. 737be2ac88cSJonathan Lemon */ 738be2ac88cSJonathan Lemon tp->snd_wnd = tiwin; /* unscaled */ 739be2ac88cSJonathan Lemon goto after_listen; 740be2ac88cSJonathan Lemon } 741be2ac88cSJonathan Lemon if (thflags & TH_RST) { 742be2ac88cSJonathan Lemon syncache_chkrst(&inc, th); 743be2ac88cSJonathan Lemon goto drop; 744be2ac88cSJonathan Lemon } 745fb59c426SYoshinobu Inoue if (thflags & TH_ACK) { 746be2ac88cSJonathan Lemon syncache_badack(&inc); 747ebb0cbeaSPaul Traina tcpstat.tcps_badsyn++; 748a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 749a57815efSBosko Milekic goto dropwithreset; 7504195b4afSPaul Traina } 751ebb0cbeaSPaul Traina goto drop; 752ebb0cbeaSPaul Traina } 75333841545SHajimu UMEMOTO 754be2ac88cSJonathan Lemon /* 755be2ac88cSJonathan Lemon * Segment's flags are (SYN) or (SYN|FIN). 756be2ac88cSJonathan Lemon */ 75733841545SHajimu UMEMOTO #ifdef INET6 75833841545SHajimu UMEMOTO /* 75933841545SHajimu UMEMOTO * If deprecated address is forbidden, 76033841545SHajimu UMEMOTO * we do not accept SYN to deprecated interface 76133841545SHajimu UMEMOTO * address to prevent any new inbound connection from 76233841545SHajimu UMEMOTO * getting established. 76333841545SHajimu UMEMOTO * When we do not accept SYN, we send a TCP RST, 76433841545SHajimu UMEMOTO * with deprecated source address (instead of dropping 76533841545SHajimu UMEMOTO * it). We compromise it as it is much better for peer 76633841545SHajimu UMEMOTO * to send a RST, and RST will be the final packet 76733841545SHajimu UMEMOTO * for the exchange. 76833841545SHajimu UMEMOTO * 76933841545SHajimu UMEMOTO * If we do not forbid deprecated addresses, we accept 77033841545SHajimu UMEMOTO * the SYN packet. RFC2462 does not suggest dropping 77133841545SHajimu UMEMOTO * SYN in this case. 77233841545SHajimu UMEMOTO * If we decipher RFC2462 5.5.4, it says like this: 77333841545SHajimu UMEMOTO * 1. use of deprecated addr with existing 77433841545SHajimu UMEMOTO * communication is okay - "SHOULD continue to be 77533841545SHajimu UMEMOTO * used" 77633841545SHajimu UMEMOTO * 2. use of it with new communication: 77733841545SHajimu UMEMOTO * (2a) "SHOULD NOT be used if alternate address 77833841545SHajimu UMEMOTO * with sufficient scope is available" 77933841545SHajimu UMEMOTO * (2b) nothing mentioned otherwise. 78033841545SHajimu UMEMOTO * Here we fall into (2b) case as we have no choice in 78133841545SHajimu UMEMOTO * our source address selection - we must obey the peer. 78233841545SHajimu UMEMOTO * 78333841545SHajimu UMEMOTO * The wording in RFC2462 is confusing, and there are 78433841545SHajimu UMEMOTO * multiple description text for deprecated address 78533841545SHajimu UMEMOTO * handling - worse, they are not exactly the same. 78633841545SHajimu UMEMOTO * I believe 5.5.4 is the best one, so we follow 5.5.4. 78733841545SHajimu UMEMOTO */ 78833841545SHajimu UMEMOTO if (isipv6 && !ip6_use_deprecated) { 78933841545SHajimu UMEMOTO struct in6_ifaddr *ia6; 79033841545SHajimu UMEMOTO 79133841545SHajimu UMEMOTO if ((ia6 = ip6_getdstifaddr(m)) && 79233841545SHajimu UMEMOTO (ia6->ia6_flags & IN6_IFF_DEPRECATED)) { 793f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 79433841545SHajimu UMEMOTO tp = NULL; 79533841545SHajimu UMEMOTO rstreason = BANDLIM_RST_OPENPORT; 79633841545SHajimu UMEMOTO goto dropwithreset; 79733841545SHajimu UMEMOTO } 79833841545SHajimu UMEMOTO } 79933841545SHajimu UMEMOTO #endif 80065f28919SJesper Skriver /* 801be2ac88cSJonathan Lemon * If it is from this socket, drop it, it must be forged. 802be2ac88cSJonathan Lemon * Don't bother responding if the destination was a broadcast. 80365f28919SJesper Skriver */ 804be2ac88cSJonathan Lemon if (th->th_dport == th->th_sport) { 805fb59c426SYoshinobu Inoue if (isipv6) { 806be2ac88cSJonathan Lemon if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 807be2ac88cSJonathan Lemon &ip6->ip6_src)) 808be2ac88cSJonathan Lemon goto drop; 809c068736aSJeffrey Hsu } else { 810be2ac88cSJonathan Lemon if (ip->ip_dst.s_addr == ip->ip_src.s_addr) 811be2ac88cSJonathan Lemon goto drop; 812be2ac88cSJonathan Lemon } 813c068736aSJeffrey Hsu } 814be2ac88cSJonathan Lemon /* 815be2ac88cSJonathan Lemon * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 8162ca2159fSCrist J. Clark * 81793ec91baSCrist J. Clark * Note that it is quite possible to receive unicast 81893ec91baSCrist J. Clark * link-layer packets with a broadcast IP address. Use 81993ec91baSCrist J. Clark * in_broadcast() to find them. 820be2ac88cSJonathan Lemon */ 821be2ac88cSJonathan Lemon if (m->m_flags & (M_BCAST|M_MCAST)) 822be2ac88cSJonathan Lemon goto drop; 823be2ac88cSJonathan Lemon if (isipv6) { 824be2ac88cSJonathan Lemon if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 825be2ac88cSJonathan Lemon IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) 826be2ac88cSJonathan Lemon goto drop; 827c068736aSJeffrey Hsu } else { 828be2ac88cSJonathan Lemon if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 829be2ac88cSJonathan Lemon IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 8302ca2159fSCrist J. Clark ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || 8312ca2159fSCrist J. Clark in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 832be2ac88cSJonathan Lemon goto drop; 833c068736aSJeffrey Hsu } 834be2ac88cSJonathan Lemon /* 835be2ac88cSJonathan Lemon * SYN appears to be valid; create compressed TCP state 836be2ac88cSJonathan Lemon * for syncache, or perform t/tcp connection. 837be2ac88cSJonathan Lemon */ 838be2ac88cSJonathan Lemon if (so->so_qlen <= so->so_qlimit) { 839be2ac88cSJonathan Lemon tcp_dooptions(&to, optp, optlen, 1); 840be2ac88cSJonathan Lemon if (!syncache_add(&inc, &to, th, &so, m)) 841be2ac88cSJonathan Lemon goto drop; 842f76fcf6dSJeffrey Hsu if (so == NULL) { 843be2ac88cSJonathan Lemon /* 844be2ac88cSJonathan Lemon * Entry added to syncache, mbuf used to 845be2ac88cSJonathan Lemon * send SYN,ACK packet. 846be2ac88cSJonathan Lemon */ 847f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 848f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 849f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 850be2ac88cSJonathan Lemon return; 851f76fcf6dSJeffrey Hsu } 852be2ac88cSJonathan Lemon /* 853be2ac88cSJonathan Lemon * Segment passed TAO tests. 854be2ac88cSJonathan Lemon */ 855f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 856be2ac88cSJonathan Lemon inp = sotoinpcb(so); 857f76fcf6dSJeffrey Hsu INP_LOCK(inp); 858df8bae1dSRodney W. Grimes tp = intotcpcb(inp); 859be2ac88cSJonathan Lemon tp->snd_wnd = tiwin; 860be2ac88cSJonathan Lemon tp->t_starttime = ticks; 861be2ac88cSJonathan Lemon tp->t_state = TCPS_ESTABLISHED; 862df8bae1dSRodney W. Grimes 863be2ac88cSJonathan Lemon /* 864be2ac88cSJonathan Lemon * If there is a FIN, or if there is data and the 865be2ac88cSJonathan Lemon * connection is local, then delay SYN,ACK(SYN) in 866be2ac88cSJonathan Lemon * the hope of piggy-backing it on a response 867be2ac88cSJonathan Lemon * segment. Otherwise must send ACK now in case 868be2ac88cSJonathan Lemon * the other side is slow starting. 869be2ac88cSJonathan Lemon */ 870c068736aSJeffrey Hsu if (DELAY_ACK(tp) && 871c068736aSJeffrey Hsu ((thflags & TH_FIN) || 872be2ac88cSJonathan Lemon (tlen != 0 && 873c068736aSJeffrey Hsu ((isipv6 && in6_localaddr(&inp->in6p_faddr)) || 874c068736aSJeffrey Hsu (!isipv6 && in_localaddr(inp->inp_faddr)))))) { 875be2ac88cSJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 876be2ac88cSJonathan Lemon tcp_timer_delack, tp); 877be2ac88cSJonathan Lemon tp->t_flags |= TF_NEEDSYN; 878be2ac88cSJonathan Lemon } else 879be2ac88cSJonathan Lemon tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN); 880be2ac88cSJonathan Lemon 881be2ac88cSJonathan Lemon tcpstat.tcps_connects++; 882be2ac88cSJonathan Lemon soisconnected(so); 883be2ac88cSJonathan Lemon goto trimthenstep6; 884df8bae1dSRodney W. Grimes } 885be2ac88cSJonathan Lemon goto drop; 8864cc20ab1SSeigo Tanimura } 887be2ac88cSJonathan Lemon after_listen: 888be2ac88cSJonathan Lemon 889be2ac88cSJonathan Lemon /* XXX temp debugging */ 890be2ac88cSJonathan Lemon /* should not happen - syncache should pick up these connections */ 891be2ac88cSJonathan Lemon if (tp->t_state == TCPS_LISTEN) 892be2ac88cSJonathan Lemon panic("tcp_input: TCPS_LISTEN"); 893df8bae1dSRodney W. Grimes 894df8bae1dSRodney W. Grimes /* 895df8bae1dSRodney W. Grimes * Segment received on connection. 896df8bae1dSRodney W. Grimes * Reset idle time and keep-alive timer. 897df8bae1dSRodney W. Grimes */ 8989b8b58e0SJonathan Lemon tp->t_rcvtime = ticks; 8997ff19458SPaul Traina if (TCPS_HAVEESTABLISHED(tp->t_state)) 9009b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp); 901df8bae1dSRodney W. Grimes 902df8bae1dSRodney W. Grimes /* 903be2ac88cSJonathan Lemon * Process options. 904be2ac88cSJonathan Lemon * XXX this is tradtitional behavior, may need to be cleaned up. 905df8bae1dSRodney W. Grimes */ 906be2ac88cSJonathan Lemon tcp_dooptions(&to, optp, optlen, thflags & TH_SYN); 907be2ac88cSJonathan Lemon if (thflags & TH_SYN) { 908be2ac88cSJonathan Lemon if (to.to_flags & TOF_SCALE) { 909be2ac88cSJonathan Lemon tp->t_flags |= TF_RCVD_SCALE; 910be2ac88cSJonathan Lemon tp->requested_s_scale = to.to_requested_s_scale; 911be2ac88cSJonathan Lemon } 912be2ac88cSJonathan Lemon if (to.to_flags & TOF_TS) { 913be2ac88cSJonathan Lemon tp->t_flags |= TF_RCVD_TSTMP; 914be2ac88cSJonathan Lemon tp->ts_recent = to.to_tsval; 915be2ac88cSJonathan Lemon tp->ts_recent_age = ticks; 916be2ac88cSJonathan Lemon } 917be2ac88cSJonathan Lemon if (to.to_flags & (TOF_CC|TOF_CCNEW)) 918be2ac88cSJonathan Lemon tp->t_flags |= TF_RCVD_CC; 919be2ac88cSJonathan Lemon if (to.to_flags & TOF_MSS) 920be2ac88cSJonathan Lemon tcp_mss(tp, to.to_mss); 921be2ac88cSJonathan Lemon } 922df8bae1dSRodney W. Grimes 923df8bae1dSRodney W. Grimes /* 924df8bae1dSRodney W. Grimes * Header prediction: check for the two common cases 925df8bae1dSRodney W. Grimes * of a uni-directional data xfer. If the packet has 926df8bae1dSRodney W. Grimes * no control flags, is in-sequence, the window didn't 927df8bae1dSRodney W. Grimes * change and we're not retransmitting, it's a 928df8bae1dSRodney W. Grimes * candidate. If the length is zero and the ack moved 929df8bae1dSRodney W. Grimes * forward, we're the sender side of the xfer. Just 930df8bae1dSRodney W. Grimes * free the data acked & wake any higher level process 931df8bae1dSRodney W. Grimes * that was blocked waiting for space. If the length 932df8bae1dSRodney W. Grimes * is non-zero and the ack didn't move, we're the 933df8bae1dSRodney W. Grimes * receiver side. If we're getting packets in-order 934df8bae1dSRodney W. Grimes * (the reassembly queue is empty), add the data to 935df8bae1dSRodney W. Grimes * the socket buffer and note that we need a delayed ack. 936a0292f23SGarrett Wollman * Make sure that the hidden state-flags are also off. 937a0292f23SGarrett Wollman * Since we check for TCPS_ESTABLISHED above, it can only 938a0292f23SGarrett Wollman * be TH_NEEDSYN. 939df8bae1dSRodney W. Grimes */ 940df8bae1dSRodney W. Grimes if (tp->t_state == TCPS_ESTABLISHED && 941fb59c426SYoshinobu Inoue (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 942a0292f23SGarrett Wollman ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) && 943be2ac88cSJonathan Lemon ((to.to_flags & TOF_TS) == 0 || 944a0292f23SGarrett Wollman TSTMP_GEQ(to.to_tsval, tp->ts_recent)) && 945a0292f23SGarrett Wollman /* 946a0292f23SGarrett Wollman * Using the CC option is compulsory if once started: 947a0292f23SGarrett Wollman * the segment is OK if no T/TCP was negotiated or 948a0292f23SGarrett Wollman * if the segment has a CC option equal to CCrecv 949a0292f23SGarrett Wollman */ 950a0292f23SGarrett Wollman ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) || 951be2ac88cSJonathan Lemon ((to.to_flags & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) && 952fb59c426SYoshinobu Inoue th->th_seq == tp->rcv_nxt && 953df8bae1dSRodney W. Grimes tiwin && tiwin == tp->snd_wnd && 954df8bae1dSRodney W. Grimes tp->snd_nxt == tp->snd_max) { 955df8bae1dSRodney W. Grimes 956df8bae1dSRodney W. Grimes /* 957df8bae1dSRodney W. Grimes * If last ACK falls within this segment's sequence numbers, 958df8bae1dSRodney W. Grimes * record the timestamp. 959a0292f23SGarrett Wollman * NOTE that the test is modified according to the latest 960a0292f23SGarrett Wollman * proposal of the tcplw@cray.com list (Braden 1993/04/26). 961df8bae1dSRodney W. Grimes */ 962be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && 963fb59c426SYoshinobu Inoue SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 9649b8b58e0SJonathan Lemon tp->ts_recent_age = ticks; 965a0292f23SGarrett Wollman tp->ts_recent = to.to_tsval; 966df8bae1dSRodney W. Grimes } 967df8bae1dSRodney W. Grimes 968fb59c426SYoshinobu Inoue if (tlen == 0) { 969fb59c426SYoshinobu Inoue if (SEQ_GT(th->th_ack, tp->snd_una) && 970fb59c426SYoshinobu Inoue SEQ_LEQ(th->th_ack, tp->snd_max) && 971233e8c18SGarrett Wollman tp->snd_cwnd >= tp->snd_wnd && 972233e8c18SGarrett Wollman tp->t_dupacks < tcprexmtthresh) { 973f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 974f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 975f76fcf6dSJeffrey Hsu headlocked = 0; 976df8bae1dSRodney W. Grimes /* 977df8bae1dSRodney W. Grimes * this is a pure ack for outstanding data. 978df8bae1dSRodney W. Grimes */ 979df8bae1dSRodney W. Grimes ++tcpstat.tcps_predack; 9809b8b58e0SJonathan Lemon /* 9819b8b58e0SJonathan Lemon * "bad retransmit" recovery 9829b8b58e0SJonathan Lemon */ 9839b8b58e0SJonathan Lemon if (tp->t_rxtshift == 1 && 9849b8b58e0SJonathan Lemon ticks < tp->t_badrxtwin) { 9859b8b58e0SJonathan Lemon tp->snd_cwnd = tp->snd_cwnd_prev; 9869b8b58e0SJonathan Lemon tp->snd_ssthresh = 9879b8b58e0SJonathan Lemon tp->snd_ssthresh_prev; 9889b8b58e0SJonathan Lemon tp->snd_nxt = tp->snd_max; 9899b8b58e0SJonathan Lemon tp->t_badrxtwin = 0; 9909b8b58e0SJonathan Lemon } 991be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0) 992a0292f23SGarrett Wollman tcp_xmit_timer(tp, 9939b8b58e0SJonathan Lemon ticks - to.to_tsecr + 1); 9949b8b58e0SJonathan Lemon else if (tp->t_rtttime && 995fb59c426SYoshinobu Inoue SEQ_GT(th->th_ack, tp->t_rtseq)) 996c068736aSJeffrey Hsu tcp_xmit_timer(tp, 997c068736aSJeffrey Hsu ticks - tp->t_rtttime); 9981fcc99b5SMatthew Dillon tcp_xmit_bandwidth_limit(tp, th->th_ack); 999fb59c426SYoshinobu Inoue acked = th->th_ack - tp->snd_una; 1000df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackpack++; 1001df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackbyte += acked; 1002df8bae1dSRodney W. Grimes sbdrop(&so->so_snd, acked); 1003fb59c426SYoshinobu Inoue tp->snd_una = th->th_ack; 1004b5addd85SJeffrey Hsu tp->t_dupacks = 0; 1005df8bae1dSRodney W. Grimes m_freem(m); 1006fb59c426SYoshinobu Inoue ND6_HINT(tp); /* some progress has been done */ 1007df8bae1dSRodney W. Grimes 1008df8bae1dSRodney W. Grimes /* 1009df8bae1dSRodney W. Grimes * If all outstanding data are acked, stop 1010df8bae1dSRodney W. Grimes * retransmit timer, otherwise restart timer 1011df8bae1dSRodney W. Grimes * using current (possibly backed-off) value. 1012df8bae1dSRodney W. Grimes * If process is waiting for space, 1013df8bae1dSRodney W. Grimes * wakeup/selwakeup/signal. If data 1014df8bae1dSRodney W. Grimes * are ready to send, let tcp_output 1015df8bae1dSRodney W. Grimes * decide between more output or persist. 1016df8bae1dSRodney W. Grimes */ 1017df8bae1dSRodney W. Grimes if (tp->snd_una == tp->snd_max) 10189b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 10199b8b58e0SJonathan Lemon else if (!callout_active(tp->tt_persist)) 10209b8b58e0SJonathan Lemon callout_reset(tp->tt_rexmt, 10219b8b58e0SJonathan Lemon tp->t_rxtcur, 10229b8b58e0SJonathan Lemon tcp_timer_rexmt, tp); 1023df8bae1dSRodney W. Grimes 1024df8bae1dSRodney W. Grimes sowwakeup(so); 1025df8bae1dSRodney W. Grimes if (so->so_snd.sb_cc) 1026df8bae1dSRodney W. Grimes (void) tcp_output(tp); 1027f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 1028df8bae1dSRodney W. Grimes return; 1029df8bae1dSRodney W. Grimes } 1030fb59c426SYoshinobu Inoue } else if (th->th_ack == tp->snd_una && 1031fb59c426SYoshinobu Inoue LIST_EMPTY(&tp->t_segq) && 1032fb59c426SYoshinobu Inoue tlen <= sbspace(&so->so_rcv)) { 1033f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 1034f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 1035f76fcf6dSJeffrey Hsu headlocked = 0; 1036df8bae1dSRodney W. Grimes /* 1037df8bae1dSRodney W. Grimes * this is a pure, in-sequence data packet 1038df8bae1dSRodney W. Grimes * with nothing on the reassembly queue and 1039df8bae1dSRodney W. Grimes * we have enough buffer space to take it. 1040df8bae1dSRodney W. Grimes */ 1041df8bae1dSRodney W. Grimes ++tcpstat.tcps_preddat; 1042fb59c426SYoshinobu Inoue tp->rcv_nxt += tlen; 1043df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpack++; 1044fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbyte += tlen; 1045fb59c426SYoshinobu Inoue ND6_HINT(tp); /* some progress has been done */ 1046df8bae1dSRodney W. Grimes /* 1047755c1f07SAndras Olah * Add data to socket buffer. 1048df8bae1dSRodney W. Grimes */ 1049fb59c426SYoshinobu Inoue m_adj(m, drop_hdrlen); /* delayed header drop */ 1050df8bae1dSRodney W. Grimes sbappend(&so->so_rcv, m); 1051df8bae1dSRodney W. Grimes sorwakeup(so); 1052d8c85a26SJonathan Lemon if (DELAY_ACK(tp)) { 10539b8b58e0SJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 10549b8b58e0SJonathan Lemon tcp_timer_delack, tp); 1055f498eeeeSDavid Greenman } else { 1056e612a582SDavid Greenman tp->t_flags |= TF_ACKNOW; 1057e612a582SDavid Greenman tcp_output(tp); 1058e612a582SDavid Greenman } 1059f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 1060df8bae1dSRodney W. Grimes return; 1061df8bae1dSRodney W. Grimes } 1062df8bae1dSRodney W. Grimes } 1063df8bae1dSRodney W. Grimes 1064df8bae1dSRodney W. Grimes /* 1065df8bae1dSRodney W. Grimes * Calculate amount of space in receive window, 1066df8bae1dSRodney W. Grimes * and then do TCP input processing. 1067df8bae1dSRodney W. Grimes * Receive window is amount of space in rcv queue, 1068df8bae1dSRodney W. Grimes * but not less than advertised window. 1069df8bae1dSRodney W. Grimes */ 1070df8bae1dSRodney W. Grimes { int win; 1071df8bae1dSRodney W. Grimes 1072df8bae1dSRodney W. Grimes win = sbspace(&so->so_rcv); 1073df8bae1dSRodney W. Grimes if (win < 0) 1074df8bae1dSRodney W. Grimes win = 0; 107566e39adcSJohn Polstra tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1076df8bae1dSRodney W. Grimes } 1077df8bae1dSRodney W. Grimes 1078df8bae1dSRodney W. Grimes switch (tp->t_state) { 1079df8bae1dSRodney W. Grimes 1080df8bae1dSRodney W. Grimes /* 1081764d8cefSBill Fenner * If the state is SYN_RECEIVED: 1082764d8cefSBill Fenner * if seg contains an ACK, but not for our SYN/ACK, send a RST. 1083764d8cefSBill Fenner */ 1084764d8cefSBill Fenner case TCPS_SYN_RECEIVED: 1085fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 1086fb59c426SYoshinobu Inoue (SEQ_LEQ(th->th_ack, tp->snd_una) || 1087a57815efSBosko Milekic SEQ_GT(th->th_ack, tp->snd_max))) { 1088a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 1089a57815efSBosko Milekic goto dropwithreset; 1090a57815efSBosko Milekic } 1091764d8cefSBill Fenner break; 1092764d8cefSBill Fenner 1093764d8cefSBill Fenner /* 1094df8bae1dSRodney W. Grimes * If the state is SYN_SENT: 1095df8bae1dSRodney W. Grimes * if seg contains an ACK, but not for our SYN, drop the input. 1096df8bae1dSRodney W. Grimes * if seg contains a RST, then drop the connection. 1097df8bae1dSRodney W. Grimes * if seg does not contain SYN, then drop it. 1098df8bae1dSRodney W. Grimes * Otherwise this is an acceptable SYN segment 1099df8bae1dSRodney W. Grimes * initialize tp->rcv_nxt and tp->irs 1100df8bae1dSRodney W. Grimes * if seg contains ack then advance tp->snd_una 1101df8bae1dSRodney W. Grimes * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1102df8bae1dSRodney W. Grimes * arrange for segment to be acked (eventually) 1103df8bae1dSRodney W. Grimes * continue processing rest of data/controls, beginning with URG 1104df8bae1dSRodney W. Grimes */ 1105df8bae1dSRodney W. Grimes case TCPS_SYN_SENT: 1106be2ac88cSJonathan Lemon if ((taop = tcp_gettaocache(&inp->inp_inc)) == NULL) { 1107a0292f23SGarrett Wollman taop = &tao_noncached; 1108a0292f23SGarrett Wollman bzero(taop, sizeof(*taop)); 1109a0292f23SGarrett Wollman } 1110a0292f23SGarrett Wollman 1111fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 1112fb59c426SYoshinobu Inoue (SEQ_LEQ(th->th_ack, tp->iss) || 1113fb59c426SYoshinobu Inoue SEQ_GT(th->th_ack, tp->snd_max))) { 1114a0292f23SGarrett Wollman /* 1115a0292f23SGarrett Wollman * If we have a cached CCsent for the remote host, 1116a0292f23SGarrett Wollman * hence we haven't just crashed and restarted, 1117a0292f23SGarrett Wollman * do not send a RST. This may be a retransmission 1118a0292f23SGarrett Wollman * from the other side after our earlier ACK was lost. 1119a0292f23SGarrett Wollman * Our new SYN, when it arrives, will serve as the 1120a0292f23SGarrett Wollman * needed ACK. 1121a0292f23SGarrett Wollman */ 1122a0292f23SGarrett Wollman if (taop->tao_ccsent != 0) 1123a0292f23SGarrett Wollman goto drop; 1124a57815efSBosko Milekic else { 1125a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1126a0292f23SGarrett Wollman goto dropwithreset; 1127a0292f23SGarrett Wollman } 1128a57815efSBosko Milekic } 1129fb59c426SYoshinobu Inoue if (thflags & TH_RST) { 1130fb59c426SYoshinobu Inoue if (thflags & TH_ACK) 1131df8bae1dSRodney W. Grimes tp = tcp_drop(tp, ECONNREFUSED); 1132df8bae1dSRodney W. Grimes goto drop; 1133df8bae1dSRodney W. Grimes } 1134fb59c426SYoshinobu Inoue if ((thflags & TH_SYN) == 0) 1135df8bae1dSRodney W. Grimes goto drop; 1136fb59c426SYoshinobu Inoue tp->snd_wnd = th->th_win; /* initial send window */ 1137a0292f23SGarrett Wollman tp->cc_recv = to.to_cc; /* foreign CC */ 1138a0292f23SGarrett Wollman 1139fb59c426SYoshinobu Inoue tp->irs = th->th_seq; 1140df8bae1dSRodney W. Grimes tcp_rcvseqinit(tp); 1141fb59c426SYoshinobu Inoue if (thflags & TH_ACK) { 1142a0292f23SGarrett Wollman /* 1143a0292f23SGarrett Wollman * Our SYN was acked. If segment contains CC.ECHO 1144a0292f23SGarrett Wollman * option, check it to make sure this segment really 1145a0292f23SGarrett Wollman * matches our SYN. If not, just drop it as old 1146a0292f23SGarrett Wollman * duplicate, but send an RST if we're still playing 1147026650e5SBill Fenner * by the old rules. If no CC.ECHO option, make sure 1148026650e5SBill Fenner * we don't get fooled into using T/TCP. 1149a0292f23SGarrett Wollman */ 1150be2ac88cSJonathan Lemon if (to.to_flags & TOF_CCECHO) { 1151dfd5dee1SPeter Wemm if (tp->cc_send != to.to_ccecho) { 1152a0292f23SGarrett Wollman if (taop->tao_ccsent != 0) 1153a0292f23SGarrett Wollman goto drop; 1154a57815efSBosko Milekic else { 1155a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1156a0292f23SGarrett Wollman goto dropwithreset; 1157dfd5dee1SPeter Wemm } 1158a57815efSBosko Milekic } 1159026650e5SBill Fenner } else 1160026650e5SBill Fenner tp->t_flags &= ~TF_RCVD_CC; 1161845799c1SAndras Olah tcpstat.tcps_connects++; 1162845799c1SAndras Olah soisconnected(so); 1163c488362eSRobert Watson #ifdef MAC 1164c488362eSRobert Watson mac_set_socket_peer_from_mbuf(m, so); 1165c488362eSRobert Watson #endif 1166845799c1SAndras Olah /* Do window scaling on this connection? */ 1167845799c1SAndras Olah if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1168845799c1SAndras Olah (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1169845799c1SAndras Olah tp->snd_scale = tp->requested_s_scale; 1170845799c1SAndras Olah tp->rcv_scale = tp->request_r_scale; 1171845799c1SAndras Olah } 1172a0292f23SGarrett Wollman /* Segment is acceptable, update cache if undefined. */ 1173a0292f23SGarrett Wollman if (taop->tao_ccsent == 0) 1174a0292f23SGarrett Wollman taop->tao_ccsent = to.to_ccecho; 1175a0292f23SGarrett Wollman 1176a0292f23SGarrett Wollman tp->rcv_adv += tp->rcv_wnd; 1177a0292f23SGarrett Wollman tp->snd_una++; /* SYN is acked */ 1178a0292f23SGarrett Wollman /* 1179a0292f23SGarrett Wollman * If there's data, delay ACK; if there's also a FIN 1180a0292f23SGarrett Wollman * ACKNOW will be turned on later. 1181a0292f23SGarrett Wollman */ 1182d8c85a26SJonathan Lemon if (DELAY_ACK(tp) && tlen != 0) 11839b8b58e0SJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 11849b8b58e0SJonathan Lemon tcp_timer_delack, tp); 1185a0292f23SGarrett Wollman else 1186a0292f23SGarrett Wollman tp->t_flags |= TF_ACKNOW; 1187a0292f23SGarrett Wollman /* 1188a0292f23SGarrett Wollman * Received <SYN,ACK> in SYN_SENT[*] state. 1189a0292f23SGarrett Wollman * Transitions: 1190a0292f23SGarrett Wollman * SYN_SENT --> ESTABLISHED 1191a0292f23SGarrett Wollman * SYN_SENT* --> FIN_WAIT_1 1192a0292f23SGarrett Wollman */ 11939b8b58e0SJonathan Lemon tp->t_starttime = ticks; 1194a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDFIN) { 1195a0292f23SGarrett Wollman tp->t_state = TCPS_FIN_WAIT_1; 1196a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDFIN; 1197fb59c426SYoshinobu Inoue thflags &= ~TH_SYN; 11987ff19458SPaul Traina } else { 1199a0292f23SGarrett Wollman tp->t_state = TCPS_ESTABLISHED; 12009b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, 12019b8b58e0SJonathan Lemon tcp_timer_keep, tp); 12027ff19458SPaul Traina } 1203a0292f23SGarrett Wollman } else { 1204a0292f23SGarrett Wollman /* 1205c068736aSJeffrey Hsu * Received initial SYN in SYN-SENT[*] state => 1206c068736aSJeffrey Hsu * simultaneous open. If segment contains CC option 1207c068736aSJeffrey Hsu * and there is a cached CC, apply TAO test. 1208c068736aSJeffrey Hsu * If it succeeds, connection is * half-synchronized. 1209c068736aSJeffrey Hsu * Otherwise, do 3-way handshake: 1210a0292f23SGarrett Wollman * SYN-SENT -> SYN-RECEIVED 1211a0292f23SGarrett Wollman * SYN-SENT* -> SYN-RECEIVED* 1212a0292f23SGarrett Wollman * If there was no CC option, clear cached CC value. 1213a0292f23SGarrett Wollman */ 1214a0292f23SGarrett Wollman tp->t_flags |= TF_ACKNOW; 12159b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 1216be2ac88cSJonathan Lemon if (to.to_flags & TOF_CC) { 1217a0292f23SGarrett Wollman if (taop->tao_cc != 0 && 1218a0292f23SGarrett Wollman CC_GT(to.to_cc, taop->tao_cc)) { 1219a0292f23SGarrett Wollman /* 1220a0292f23SGarrett Wollman * update cache and make transition: 1221a0292f23SGarrett Wollman * SYN-SENT -> ESTABLISHED* 1222a0292f23SGarrett Wollman * SYN-SENT* -> FIN-WAIT-1* 1223a0292f23SGarrett Wollman */ 1224a0292f23SGarrett Wollman taop->tao_cc = to.to_cc; 12259b8b58e0SJonathan Lemon tp->t_starttime = ticks; 1226a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDFIN) { 1227a0292f23SGarrett Wollman tp->t_state = TCPS_FIN_WAIT_1; 1228a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDFIN; 12297ff19458SPaul Traina } else { 1230a0292f23SGarrett Wollman tp->t_state = TCPS_ESTABLISHED; 12319b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, 12329b8b58e0SJonathan Lemon tcp_keepidle, 12339b8b58e0SJonathan Lemon tcp_timer_keep, 12349b8b58e0SJonathan Lemon tp); 12357ff19458SPaul Traina } 1236a0292f23SGarrett Wollman tp->t_flags |= TF_NEEDSYN; 1237df8bae1dSRodney W. Grimes } else 1238df8bae1dSRodney W. Grimes tp->t_state = TCPS_SYN_RECEIVED; 1239a0292f23SGarrett Wollman } else { 1240a0292f23SGarrett Wollman /* CC.NEW or no option => invalidate cache */ 1241a0292f23SGarrett Wollman taop->tao_cc = 0; 1242a0292f23SGarrett Wollman tp->t_state = TCPS_SYN_RECEIVED; 1243a0292f23SGarrett Wollman } 1244a0292f23SGarrett Wollman } 1245df8bae1dSRodney W. Grimes 1246df8bae1dSRodney W. Grimes trimthenstep6: 1247df8bae1dSRodney W. Grimes /* 1248fb59c426SYoshinobu Inoue * Advance th->th_seq to correspond to first data byte. 1249df8bae1dSRodney W. Grimes * If data, trim to stay within window, 1250df8bae1dSRodney W. Grimes * dropping FIN if necessary. 1251df8bae1dSRodney W. Grimes */ 1252fb59c426SYoshinobu Inoue th->th_seq++; 1253fb59c426SYoshinobu Inoue if (tlen > tp->rcv_wnd) { 1254fb59c426SYoshinobu Inoue todrop = tlen - tp->rcv_wnd; 1255df8bae1dSRodney W. Grimes m_adj(m, -todrop); 1256fb59c426SYoshinobu Inoue tlen = tp->rcv_wnd; 1257fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 1258df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpackafterwin++; 1259df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbyteafterwin += todrop; 1260df8bae1dSRodney W. Grimes } 1261fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq - 1; 1262fb59c426SYoshinobu Inoue tp->rcv_up = th->th_seq; 1263a0292f23SGarrett Wollman /* 1264a0292f23SGarrett Wollman * Client side of transaction: already sent SYN and data. 1265a0292f23SGarrett Wollman * If the remote host used T/TCP to validate the SYN, 1266a0292f23SGarrett Wollman * our data will be ACK'd; if so, enter normal data segment 1267a0292f23SGarrett Wollman * processing in the middle of step 5, ack processing. 1268a0292f23SGarrett Wollman * Otherwise, goto step 6. 1269a0292f23SGarrett Wollman */ 1270fb59c426SYoshinobu Inoue if (thflags & TH_ACK) 1271a0292f23SGarrett Wollman goto process_ACK; 1272c068736aSJeffrey Hsu 1273df8bae1dSRodney W. Grimes goto step6; 1274c068736aSJeffrey Hsu 1275a0292f23SGarrett Wollman /* 1276a0292f23SGarrett Wollman * If the state is LAST_ACK or CLOSING or TIME_WAIT: 1277a0292f23SGarrett Wollman * if segment contains a SYN and CC [not CC.NEW] option: 1278a0292f23SGarrett Wollman * if state == TIME_WAIT and connection duration > MSL, 1279a0292f23SGarrett Wollman * drop packet and send RST; 1280a0292f23SGarrett Wollman * 1281a0292f23SGarrett Wollman * if SEG.CC > CCrecv then is new SYN, and can implicitly 1282a0292f23SGarrett Wollman * ack the FIN (and data) in retransmission queue. 1283a0292f23SGarrett Wollman * Complete close and delete TCPCB. Then reprocess 1284a0292f23SGarrett Wollman * segment, hoping to find new TCPCB in LISTEN state; 1285a0292f23SGarrett Wollman * 1286a0292f23SGarrett Wollman * else must be old SYN; drop it. 1287a0292f23SGarrett Wollman * else do normal processing. 1288a0292f23SGarrett Wollman */ 1289a0292f23SGarrett Wollman case TCPS_LAST_ACK: 1290a0292f23SGarrett Wollman case TCPS_CLOSING: 1291a0292f23SGarrett Wollman case TCPS_TIME_WAIT: 1292fb59c426SYoshinobu Inoue if ((thflags & TH_SYN) && 1293be2ac88cSJonathan Lemon (to.to_flags & TOF_CC) && tp->cc_recv != 0) { 1294a0292f23SGarrett Wollman if (tp->t_state == TCPS_TIME_WAIT && 1295a57815efSBosko Milekic (ticks - tp->t_starttime) > tcp_msl) { 1296a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1297a0292f23SGarrett Wollman goto dropwithreset; 1298a57815efSBosko Milekic } 1299a0292f23SGarrett Wollman if (CC_GT(to.to_cc, tp->cc_recv)) { 1300a0292f23SGarrett Wollman tp = tcp_close(tp); 1301a0292f23SGarrett Wollman goto findpcb; 1302a0292f23SGarrett Wollman } 1303a0292f23SGarrett Wollman else 1304a0292f23SGarrett Wollman goto drop; 1305a0292f23SGarrett Wollman } 1306a0292f23SGarrett Wollman break; /* continue normal processing */ 1307df8bae1dSRodney W. Grimes } 1308df8bae1dSRodney W. Grimes 1309df8bae1dSRodney W. Grimes /* 1310df8bae1dSRodney W. Grimes * States other than LISTEN or SYN_SENT. 131180ab7c0eSGarrett Wollman * First check the RST flag and sequence number since reset segments 131280ab7c0eSGarrett Wollman * are exempt from the timestamp and connection count tests. This 131380ab7c0eSGarrett Wollman * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix 131480ab7c0eSGarrett Wollman * below which allowed reset segments in half the sequence space 131580ab7c0eSGarrett Wollman * to fall though and be processed (which gives forged reset 131680ab7c0eSGarrett Wollman * segments with a random sequence number a 50 percent chance of 131780ab7c0eSGarrett Wollman * killing a connection). 131880ab7c0eSGarrett Wollman * Then check timestamp, if present. 1319a0292f23SGarrett Wollman * Then check the connection count, if present. 1320df8bae1dSRodney W. Grimes * Then check that at least some bytes of segment are within 1321df8bae1dSRodney W. Grimes * receive window. If segment begins before rcv_nxt, 1322df8bae1dSRodney W. Grimes * drop leading data (and SYN); if nothing left, just ack. 1323df8bae1dSRodney W. Grimes * 132480ab7c0eSGarrett Wollman * 132580ab7c0eSGarrett Wollman * If the RST bit is set, check the sequence number to see 132680ab7c0eSGarrett Wollman * if this is a valid reset segment. 132780ab7c0eSGarrett Wollman * RFC 793 page 37: 132880ab7c0eSGarrett Wollman * In all states except SYN-SENT, all reset (RST) segments 132980ab7c0eSGarrett Wollman * are validated by checking their SEQ-fields. A reset is 133080ab7c0eSGarrett Wollman * valid if its sequence number is in the window. 133180ab7c0eSGarrett Wollman * Note: this does not take into account delayed ACKs, so 133280ab7c0eSGarrett Wollman * we should test against last_ack_sent instead of rcv_nxt. 13331a244a61SJonathan Lemon * The sequence number in the reset segment is normally an 13341a244a61SJonathan Lemon * echo of our outgoing acknowlegement numbers, but some hosts 13351a244a61SJonathan Lemon * send a reset with the sequence number at the rightmost edge 13361a244a61SJonathan Lemon * of our receive window, and we have to handle this case. 133780ab7c0eSGarrett Wollman * If we have multiple segments in flight, the intial reset 133880ab7c0eSGarrett Wollman * segment sequence numbers will be to the left of last_ack_sent, 133980ab7c0eSGarrett Wollman * but they will eventually catch up. 134080ab7c0eSGarrett Wollman * In any case, it never made sense to trim reset segments to 134180ab7c0eSGarrett Wollman * fit the receive window since RFC 1122 says: 134280ab7c0eSGarrett Wollman * 4.2.2.12 RST Segment: RFC-793 Section 3.4 134380ab7c0eSGarrett Wollman * 134480ab7c0eSGarrett Wollman * A TCP SHOULD allow a received RST segment to include data. 134580ab7c0eSGarrett Wollman * 134680ab7c0eSGarrett Wollman * DISCUSSION 134780ab7c0eSGarrett Wollman * It has been suggested that a RST segment could contain 134880ab7c0eSGarrett Wollman * ASCII text that encoded and explained the cause of the 134980ab7c0eSGarrett Wollman * RST. No standard has yet been established for such 135080ab7c0eSGarrett Wollman * data. 135180ab7c0eSGarrett Wollman * 135280ab7c0eSGarrett Wollman * If the reset segment passes the sequence number test examine 135380ab7c0eSGarrett Wollman * the state: 135480ab7c0eSGarrett Wollman * SYN_RECEIVED STATE: 135580ab7c0eSGarrett Wollman * If passive open, return to LISTEN state. 135680ab7c0eSGarrett Wollman * If active open, inform user that connection was refused. 1357745bab7fSDima Dorfman * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES: 135880ab7c0eSGarrett Wollman * Inform user that connection was reset, and close tcb. 1359e9bd3a37SJonathan M. Bresler * CLOSING, LAST_ACK STATES: 136080ab7c0eSGarrett Wollman * Close the tcb. 1361e9bd3a37SJonathan M. Bresler * TIME_WAIT STATE: 136280ab7c0eSGarrett Wollman * Drop the segment - see Stevens, vol. 2, p. 964 and 136380ab7c0eSGarrett Wollman * RFC 1337. 136480ab7c0eSGarrett Wollman */ 1365fb59c426SYoshinobu Inoue if (thflags & TH_RST) { 1366fb59c426SYoshinobu Inoue if (SEQ_GEQ(th->th_seq, tp->last_ack_sent) && 1367fb59c426SYoshinobu Inoue SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) { 136880ab7c0eSGarrett Wollman switch (tp->t_state) { 136980ab7c0eSGarrett Wollman 137080ab7c0eSGarrett Wollman case TCPS_SYN_RECEIVED: 137180ab7c0eSGarrett Wollman so->so_error = ECONNREFUSED; 137280ab7c0eSGarrett Wollman goto close; 137380ab7c0eSGarrett Wollman 137480ab7c0eSGarrett Wollman case TCPS_ESTABLISHED: 137580ab7c0eSGarrett Wollman case TCPS_FIN_WAIT_1: 137680ab7c0eSGarrett Wollman case TCPS_FIN_WAIT_2: 137780ab7c0eSGarrett Wollman case TCPS_CLOSE_WAIT: 137880ab7c0eSGarrett Wollman so->so_error = ECONNRESET; 137980ab7c0eSGarrett Wollman close: 138080ab7c0eSGarrett Wollman tp->t_state = TCPS_CLOSED; 138180ab7c0eSGarrett Wollman tcpstat.tcps_drops++; 138280ab7c0eSGarrett Wollman tp = tcp_close(tp); 138380ab7c0eSGarrett Wollman break; 138480ab7c0eSGarrett Wollman 138580ab7c0eSGarrett Wollman case TCPS_CLOSING: 138680ab7c0eSGarrett Wollman case TCPS_LAST_ACK: 138780ab7c0eSGarrett Wollman tp = tcp_close(tp); 138880ab7c0eSGarrett Wollman break; 138980ab7c0eSGarrett Wollman 139080ab7c0eSGarrett Wollman case TCPS_TIME_WAIT: 139180ab7c0eSGarrett Wollman break; 139280ab7c0eSGarrett Wollman } 139380ab7c0eSGarrett Wollman } 139480ab7c0eSGarrett Wollman goto drop; 139580ab7c0eSGarrett Wollman } 139680ab7c0eSGarrett Wollman 139780ab7c0eSGarrett Wollman /* 1398df8bae1dSRodney W. Grimes * RFC 1323 PAWS: If we have a timestamp reply on this segment 1399df8bae1dSRodney W. Grimes * and it's less than ts_recent, drop it. 1400df8bae1dSRodney W. Grimes */ 1401be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent && 140280ab7c0eSGarrett Wollman TSTMP_LT(to.to_tsval, tp->ts_recent)) { 1403df8bae1dSRodney W. Grimes 1404df8bae1dSRodney W. Grimes /* Check to see if ts_recent is over 24 days old. */ 14059b8b58e0SJonathan Lemon if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1406df8bae1dSRodney W. Grimes /* 1407df8bae1dSRodney W. Grimes * Invalidate ts_recent. If this segment updates 1408df8bae1dSRodney W. Grimes * ts_recent, the age will be reset later and ts_recent 1409df8bae1dSRodney W. Grimes * will get a valid value. If it does not, setting 1410df8bae1dSRodney W. Grimes * ts_recent to zero will at least satisfy the 1411df8bae1dSRodney W. Grimes * requirement that zero be placed in the timestamp 1412df8bae1dSRodney W. Grimes * echo reply when ts_recent isn't valid. The 1413df8bae1dSRodney W. Grimes * age isn't reset until we get a valid ts_recent 1414df8bae1dSRodney W. Grimes * because we don't want out-of-order segments to be 1415df8bae1dSRodney W. Grimes * dropped when ts_recent is old. 1416df8bae1dSRodney W. Grimes */ 1417df8bae1dSRodney W. Grimes tp->ts_recent = 0; 1418df8bae1dSRodney W. Grimes } else { 1419df8bae1dSRodney W. Grimes tcpstat.tcps_rcvduppack++; 1420fb59c426SYoshinobu Inoue tcpstat.tcps_rcvdupbyte += tlen; 1421df8bae1dSRodney W. Grimes tcpstat.tcps_pawsdrop++; 1422df8bae1dSRodney W. Grimes goto dropafterack; 1423df8bae1dSRodney W. Grimes } 1424df8bae1dSRodney W. Grimes } 1425df8bae1dSRodney W. Grimes 1426a0292f23SGarrett Wollman /* 1427a0292f23SGarrett Wollman * T/TCP mechanism 1428a0292f23SGarrett Wollman * If T/TCP was negotiated and the segment doesn't have CC, 1429dc733423SDag-Erling Smørgrav * or if its CC is wrong then drop the segment. 1430a0292f23SGarrett Wollman * RST segments do not have to comply with this. 1431a0292f23SGarrett Wollman */ 1432a0292f23SGarrett Wollman if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) && 1433be2ac88cSJonathan Lemon ((to.to_flags & TOF_CC) == 0 || tp->cc_recv != to.to_cc)) 1434a0292f23SGarrett Wollman goto dropafterack; 1435a0292f23SGarrett Wollman 143680ab7c0eSGarrett Wollman /* 143780ab7c0eSGarrett Wollman * In the SYN-RECEIVED state, validate that the packet belongs to 143880ab7c0eSGarrett Wollman * this connection before trimming the data to fit the receive 143980ab7c0eSGarrett Wollman * window. Check the sequence number versus IRS since we know 144080ab7c0eSGarrett Wollman * the sequence numbers haven't wrapped. This is a partial fix 144180ab7c0eSGarrett Wollman * for the "LAND" DoS attack. 144280ab7c0eSGarrett Wollman */ 1443a57815efSBosko Milekic if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) { 1444a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 1445a57815efSBosko Milekic goto dropwithreset; 1446a57815efSBosko Milekic } 144780ab7c0eSGarrett Wollman 1448fb59c426SYoshinobu Inoue todrop = tp->rcv_nxt - th->th_seq; 1449df8bae1dSRodney W. Grimes if (todrop > 0) { 1450fb59c426SYoshinobu Inoue if (thflags & TH_SYN) { 1451fb59c426SYoshinobu Inoue thflags &= ~TH_SYN; 1452fb59c426SYoshinobu Inoue th->th_seq++; 1453fb59c426SYoshinobu Inoue if (th->th_urp > 1) 1454fb59c426SYoshinobu Inoue th->th_urp--; 1455df8bae1dSRodney W. Grimes else 1456fb59c426SYoshinobu Inoue thflags &= ~TH_URG; 1457df8bae1dSRodney W. Grimes todrop--; 1458df8bae1dSRodney W. Grimes } 1459df8bae1dSRodney W. Grimes /* 1460dac20301SGarrett Wollman * Following if statement from Stevens, vol. 2, p. 960. 1461df8bae1dSRodney W. Grimes */ 1462fb59c426SYoshinobu Inoue if (todrop > tlen 1463fb59c426SYoshinobu Inoue || (todrop == tlen && (thflags & TH_FIN) == 0)) { 1464dac20301SGarrett Wollman /* 1465dac20301SGarrett Wollman * Any valid FIN must be to the left of the window. 1466dac20301SGarrett Wollman * At this point the FIN must be a duplicate or out 1467dac20301SGarrett Wollman * of sequence; drop it. 1468dac20301SGarrett Wollman */ 1469fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 1470dac20301SGarrett Wollman 1471df8bae1dSRodney W. Grimes /* 1472dac20301SGarrett Wollman * Send an ACK to resynchronize and drop any data. 1473dac20301SGarrett Wollman * But keep on processing for RST or ACK. 1474df8bae1dSRodney W. Grimes */ 1475dac20301SGarrett Wollman tp->t_flags |= TF_ACKNOW; 1476fb59c426SYoshinobu Inoue todrop = tlen; 1477dac20301SGarrett Wollman tcpstat.tcps_rcvduppack++; 1478dac20301SGarrett Wollman tcpstat.tcps_rcvdupbyte += todrop; 1479df8bae1dSRodney W. Grimes } else { 1480df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpartduppack++; 1481df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpartdupbyte += todrop; 1482df8bae1dSRodney W. Grimes } 1483fb59c426SYoshinobu Inoue drop_hdrlen += todrop; /* drop from the top afterwards */ 1484fb59c426SYoshinobu Inoue th->th_seq += todrop; 1485fb59c426SYoshinobu Inoue tlen -= todrop; 1486fb59c426SYoshinobu Inoue if (th->th_urp > todrop) 1487fb59c426SYoshinobu Inoue th->th_urp -= todrop; 1488df8bae1dSRodney W. Grimes else { 1489fb59c426SYoshinobu Inoue thflags &= ~TH_URG; 1490fb59c426SYoshinobu Inoue th->th_urp = 0; 1491df8bae1dSRodney W. Grimes } 1492df8bae1dSRodney W. Grimes } 1493df8bae1dSRodney W. Grimes 1494df8bae1dSRodney W. Grimes /* 1495df8bae1dSRodney W. Grimes * If new data are received on a connection after the 1496df8bae1dSRodney W. Grimes * user processes are gone, then RST the other end. 1497df8bae1dSRodney W. Grimes */ 1498df8bae1dSRodney W. Grimes if ((so->so_state & SS_NOFDREF) && 1499fb59c426SYoshinobu Inoue tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1500df8bae1dSRodney W. Grimes tp = tcp_close(tp); 1501df8bae1dSRodney W. Grimes tcpstat.tcps_rcvafterclose++; 1502a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1503df8bae1dSRodney W. Grimes goto dropwithreset; 1504df8bae1dSRodney W. Grimes } 1505df8bae1dSRodney W. Grimes 1506df8bae1dSRodney W. Grimes /* 1507df8bae1dSRodney W. Grimes * If segment ends after window, drop trailing data 1508df8bae1dSRodney W. Grimes * (and PUSH and FIN); if nothing left, just ACK. 1509df8bae1dSRodney W. Grimes */ 1510fb59c426SYoshinobu Inoue todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1511df8bae1dSRodney W. Grimes if (todrop > 0) { 1512df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpackafterwin++; 1513fb59c426SYoshinobu Inoue if (todrop >= tlen) { 1514fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbyteafterwin += tlen; 1515df8bae1dSRodney W. Grimes /* 1516df8bae1dSRodney W. Grimes * If a new connection request is received 1517df8bae1dSRodney W. Grimes * while in TIME_WAIT, drop the old connection 1518df8bae1dSRodney W. Grimes * and start over if the sequence numbers 1519df8bae1dSRodney W. Grimes * are above the previous ones. 1520df8bae1dSRodney W. Grimes */ 1521fb59c426SYoshinobu Inoue if (thflags & TH_SYN && 1522df8bae1dSRodney W. Grimes tp->t_state == TCPS_TIME_WAIT && 1523fb59c426SYoshinobu Inoue SEQ_GT(th->th_seq, tp->rcv_nxt)) { 1524df8bae1dSRodney W. Grimes tp = tcp_close(tp); 1525df8bae1dSRodney W. Grimes goto findpcb; 1526df8bae1dSRodney W. Grimes } 1527df8bae1dSRodney W. Grimes /* 1528df8bae1dSRodney W. Grimes * If window is closed can only take segments at 1529df8bae1dSRodney W. Grimes * window edge, and have to drop data and PUSH from 1530df8bae1dSRodney W. Grimes * incoming segments. Continue processing, but 1531df8bae1dSRodney W. Grimes * remember to ack. Otherwise, drop segment 1532df8bae1dSRodney W. Grimes * and ack. 1533df8bae1dSRodney W. Grimes */ 1534fb59c426SYoshinobu Inoue if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1535df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 1536df8bae1dSRodney W. Grimes tcpstat.tcps_rcvwinprobe++; 1537df8bae1dSRodney W. Grimes } else 1538df8bae1dSRodney W. Grimes goto dropafterack; 1539df8bae1dSRodney W. Grimes } else 1540df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbyteafterwin += todrop; 1541df8bae1dSRodney W. Grimes m_adj(m, -todrop); 1542fb59c426SYoshinobu Inoue tlen -= todrop; 1543fb59c426SYoshinobu Inoue thflags &= ~(TH_PUSH|TH_FIN); 1544df8bae1dSRodney W. Grimes } 1545df8bae1dSRodney W. Grimes 1546df8bae1dSRodney W. Grimes /* 1547df8bae1dSRodney W. Grimes * If last ACK falls within this segment's sequence numbers, 1548df8bae1dSRodney W. Grimes * record its timestamp. 1549a0292f23SGarrett Wollman * NOTE that the test is modified according to the latest 1550a0292f23SGarrett Wollman * proposal of the tcplw@cray.com list (Braden 1993/04/26). 1551df8bae1dSRodney W. Grimes */ 1552be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && 1553fb59c426SYoshinobu Inoue SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 15549b8b58e0SJonathan Lemon tp->ts_recent_age = ticks; 1555a0292f23SGarrett Wollman tp->ts_recent = to.to_tsval; 1556df8bae1dSRodney W. Grimes } 1557df8bae1dSRodney W. Grimes 1558df8bae1dSRodney W. Grimes /* 1559df8bae1dSRodney W. Grimes * If a SYN is in the window, then this is an 1560df8bae1dSRodney W. Grimes * error and we send an RST and drop the connection. 1561df8bae1dSRodney W. Grimes */ 1562fb59c426SYoshinobu Inoue if (thflags & TH_SYN) { 1563df8bae1dSRodney W. Grimes tp = tcp_drop(tp, ECONNRESET); 1564a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1565df8bae1dSRodney W. Grimes goto dropwithreset; 1566df8bae1dSRodney W. Grimes } 1567df8bae1dSRodney W. Grimes 1568a0292f23SGarrett Wollman /* 1569a0292f23SGarrett Wollman * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN 1570a0292f23SGarrett Wollman * flag is on (half-synchronized state), then queue data for 1571a0292f23SGarrett Wollman * later processing; else drop segment and return. 1572a0292f23SGarrett Wollman */ 1573fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) == 0) { 1574a0292f23SGarrett Wollman if (tp->t_state == TCPS_SYN_RECEIVED || 1575a0292f23SGarrett Wollman (tp->t_flags & TF_NEEDSYN)) 1576a0292f23SGarrett Wollman goto step6; 1577a0292f23SGarrett Wollman else 1578a0292f23SGarrett Wollman goto drop; 1579a0292f23SGarrett Wollman } 1580df8bae1dSRodney W. Grimes 1581df8bae1dSRodney W. Grimes /* 1582df8bae1dSRodney W. Grimes * Ack processing. 1583df8bae1dSRodney W. Grimes */ 1584df8bae1dSRodney W. Grimes switch (tp->t_state) { 1585df8bae1dSRodney W. Grimes 1586df8bae1dSRodney W. Grimes /* 1587764d8cefSBill Fenner * In SYN_RECEIVED state, the ack ACKs our SYN, so enter 1588764d8cefSBill Fenner * ESTABLISHED state and continue processing. 1589764d8cefSBill Fenner * The ACK was checked above. 1590df8bae1dSRodney W. Grimes */ 1591df8bae1dSRodney W. Grimes case TCPS_SYN_RECEIVED: 1592a0292f23SGarrett Wollman 1593df8bae1dSRodney W. Grimes tcpstat.tcps_connects++; 1594df8bae1dSRodney W. Grimes soisconnected(so); 1595df8bae1dSRodney W. Grimes /* Do window scaling? */ 1596df8bae1dSRodney W. Grimes if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1597df8bae1dSRodney W. Grimes (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1598df8bae1dSRodney W. Grimes tp->snd_scale = tp->requested_s_scale; 1599df8bae1dSRodney W. Grimes tp->rcv_scale = tp->request_r_scale; 1600df8bae1dSRodney W. Grimes } 1601a0292f23SGarrett Wollman /* 1602a0292f23SGarrett Wollman * Upon successful completion of 3-way handshake, 1603a0292f23SGarrett Wollman * update cache.CC if it was undefined, pass any queued 1604a0292f23SGarrett Wollman * data to the user, and advance state appropriately. 1605a0292f23SGarrett Wollman */ 1606be2ac88cSJonathan Lemon if ((taop = tcp_gettaocache(&inp->inp_inc)) != NULL && 1607a0292f23SGarrett Wollman taop->tao_cc == 0) 1608a0292f23SGarrett Wollman taop->tao_cc = tp->cc_recv; 1609a0292f23SGarrett Wollman 1610a0292f23SGarrett Wollman /* 1611a0292f23SGarrett Wollman * Make transitions: 1612a0292f23SGarrett Wollman * SYN-RECEIVED -> ESTABLISHED 1613a0292f23SGarrett Wollman * SYN-RECEIVED* -> FIN-WAIT-1 1614a0292f23SGarrett Wollman */ 16159b8b58e0SJonathan Lemon tp->t_starttime = ticks; 1616a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDFIN) { 1617a0292f23SGarrett Wollman tp->t_state = TCPS_FIN_WAIT_1; 1618a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDFIN; 16197ff19458SPaul Traina } else { 1620a0292f23SGarrett Wollman tp->t_state = TCPS_ESTABLISHED; 16219b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, 16229b8b58e0SJonathan Lemon tcp_timer_keep, tp); 16237ff19458SPaul Traina } 1624a0292f23SGarrett Wollman /* 1625a0292f23SGarrett Wollman * If segment contains data or ACK, will call tcp_reass() 1626a0292f23SGarrett Wollman * later; if not, do so now to pass queued data to user. 1627a0292f23SGarrett Wollman */ 1628fb59c426SYoshinobu Inoue if (tlen == 0 && (thflags & TH_FIN) == 0) 1629fb59c426SYoshinobu Inoue (void) tcp_reass(tp, (struct tcphdr *)0, 0, 1630a0292f23SGarrett Wollman (struct mbuf *)0); 1631fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq - 1; 163293b0017fSPhilippe Charnier /* FALLTHROUGH */ 1633df8bae1dSRodney W. Grimes 1634df8bae1dSRodney W. Grimes /* 1635df8bae1dSRodney W. Grimes * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1636df8bae1dSRodney W. Grimes * ACKs. If the ack is in the range 1637fb59c426SYoshinobu Inoue * tp->snd_una < th->th_ack <= tp->snd_max 1638fb59c426SYoshinobu Inoue * then advance tp->snd_una to th->th_ack and drop 1639df8bae1dSRodney W. Grimes * data from the retransmission queue. If this ACK reflects 1640df8bae1dSRodney W. Grimes * more up to date window information we update our window information. 1641df8bae1dSRodney W. Grimes */ 1642df8bae1dSRodney W. Grimes case TCPS_ESTABLISHED: 1643df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 1644df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_2: 1645df8bae1dSRodney W. Grimes case TCPS_CLOSE_WAIT: 1646df8bae1dSRodney W. Grimes case TCPS_CLOSING: 1647df8bae1dSRodney W. Grimes case TCPS_LAST_ACK: 1648df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 1649df8bae1dSRodney W. Grimes 1650fb59c426SYoshinobu Inoue if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1651fb59c426SYoshinobu Inoue if (tlen == 0 && tiwin == tp->snd_wnd) { 1652df8bae1dSRodney W. Grimes tcpstat.tcps_rcvdupack++; 1653df8bae1dSRodney W. Grimes /* 1654df8bae1dSRodney W. Grimes * If we have outstanding data (other than 1655df8bae1dSRodney W. Grimes * a window probe), this is a completely 1656df8bae1dSRodney W. Grimes * duplicate ack (ie, window info didn't 1657df8bae1dSRodney W. Grimes * change), the ack is the biggest we've 1658df8bae1dSRodney W. Grimes * seen and we've seen exactly our rexmt 1659df8bae1dSRodney W. Grimes * threshhold of them, assume a packet 1660df8bae1dSRodney W. Grimes * has been dropped and retransmit it. 1661df8bae1dSRodney W. Grimes * Kludge snd_nxt & the congestion 1662df8bae1dSRodney W. Grimes * window so we send only this one 1663df8bae1dSRodney W. Grimes * packet. 1664df8bae1dSRodney W. Grimes * 1665df8bae1dSRodney W. Grimes * We know we're losing at the current 1666df8bae1dSRodney W. Grimes * window size so do congestion avoidance 1667df8bae1dSRodney W. Grimes * (set ssthresh to half the current window 1668df8bae1dSRodney W. Grimes * and pull our congestion window back to 1669df8bae1dSRodney W. Grimes * the new ssthresh). 1670df8bae1dSRodney W. Grimes * 1671df8bae1dSRodney W. Grimes * Dup acks mean that packets have left the 1672df8bae1dSRodney W. Grimes * network (they're now cached at the receiver) 1673df8bae1dSRodney W. Grimes * so bump cwnd by the amount in the receiver 1674df8bae1dSRodney W. Grimes * to keep a constant cwnd packets in the 1675df8bae1dSRodney W. Grimes * network. 1676df8bae1dSRodney W. Grimes */ 16779b8b58e0SJonathan Lemon if (!callout_active(tp->tt_rexmt) || 1678fb59c426SYoshinobu Inoue th->th_ack != tp->snd_una) 1679df8bae1dSRodney W. Grimes tp->t_dupacks = 0; 1680df8bae1dSRodney W. Grimes else if (++tp->t_dupacks == tcprexmtthresh) { 1681df8bae1dSRodney W. Grimes tcp_seq onxt = tp->snd_nxt; 1682df8bae1dSRodney W. Grimes u_int win = 1683df8bae1dSRodney W. Grimes min(tp->snd_wnd, tp->snd_cwnd) / 2 / 1684df8bae1dSRodney W. Grimes tp->t_maxseg; 1685c068736aSJeffrey Hsu if (tcp_do_newreno && 1686c068736aSJeffrey Hsu SEQ_LT(th->th_ack, 168746f58482SJonathan Lemon tp->snd_recover)) { 168846f58482SJonathan Lemon /* False retransmit, should not 168946f58482SJonathan Lemon * cut window 169046f58482SJonathan Lemon */ 169146f58482SJonathan Lemon tp->snd_cwnd += tp->t_maxseg; 169246f58482SJonathan Lemon tp->t_dupacks = 0; 169346f58482SJonathan Lemon (void) tcp_output(tp); 169446f58482SJonathan Lemon goto drop; 169546f58482SJonathan Lemon } 1696df8bae1dSRodney W. Grimes if (win < 2) 1697df8bae1dSRodney W. Grimes win = 2; 1698df8bae1dSRodney W. Grimes tp->snd_ssthresh = win * tp->t_maxseg; 169946f58482SJonathan Lemon tp->snd_recover = tp->snd_max; 17009b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 17019b8b58e0SJonathan Lemon tp->t_rtttime = 0; 1702fb59c426SYoshinobu Inoue tp->snd_nxt = th->th_ack; 1703df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->t_maxseg; 1704df8bae1dSRodney W. Grimes (void) tcp_output(tp); 1705df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->snd_ssthresh + 1706df8bae1dSRodney W. Grimes tp->t_maxseg * tp->t_dupacks; 1707df8bae1dSRodney W. Grimes if (SEQ_GT(onxt, tp->snd_nxt)) 1708df8bae1dSRodney W. Grimes tp->snd_nxt = onxt; 1709df8bae1dSRodney W. Grimes goto drop; 1710df8bae1dSRodney W. Grimes } else if (tp->t_dupacks > tcprexmtthresh) { 1711df8bae1dSRodney W. Grimes tp->snd_cwnd += tp->t_maxseg; 1712df8bae1dSRodney W. Grimes (void) tcp_output(tp); 1713df8bae1dSRodney W. Grimes goto drop; 1714df8bae1dSRodney W. Grimes } 1715df8bae1dSRodney W. Grimes } else 1716df8bae1dSRodney W. Grimes tp->t_dupacks = 0; 1717df8bae1dSRodney W. Grimes break; 1718df8bae1dSRodney W. Grimes } 1719df8bae1dSRodney W. Grimes /* 1720df8bae1dSRodney W. Grimes * If the congestion window was inflated to account 1721df8bae1dSRodney W. Grimes * for the other side's cached packets, retract it. 1722df8bae1dSRodney W. Grimes */ 1723c068736aSJeffrey Hsu if (tcp_do_newreno) { 1724c068736aSJeffrey Hsu int is_partialack = SEQ_LT(th->th_ack, tp->snd_recover); 1725c068736aSJeffrey Hsu if (tp->t_dupacks >= tcprexmtthresh) { 1726c068736aSJeffrey Hsu if (is_partialack) { 1727c068736aSJeffrey Hsu tcp_newreno_partial_ack(tp, th); 1728c068736aSJeffrey Hsu } else { 1729c068736aSJeffrey Hsu /* 1730c068736aSJeffrey Hsu * Window inflation should have left us 1731c068736aSJeffrey Hsu * with approximately snd_ssthresh 1732c068736aSJeffrey Hsu * outstanding data. 1733c068736aSJeffrey Hsu * But in case we would be inclined to 1734c068736aSJeffrey Hsu * send a burst, better to do it via 1735c068736aSJeffrey Hsu * the slow start mechanism. 1736c068736aSJeffrey Hsu */ 1737c068736aSJeffrey Hsu if (SEQ_GT(th->th_ack + 1738c068736aSJeffrey Hsu tp->snd_ssthresh, 1739c068736aSJeffrey Hsu tp->snd_max)) 1740c068736aSJeffrey Hsu tp->snd_cwnd = tp->snd_max - 1741c068736aSJeffrey Hsu th->th_ack + 1742c068736aSJeffrey Hsu tp->t_maxseg; 1743c068736aSJeffrey Hsu else 1744c068736aSJeffrey Hsu tp->snd_cwnd = tp->snd_ssthresh; 1745c068736aSJeffrey Hsu } 1746c068736aSJeffrey Hsu } 1747c068736aSJeffrey Hsu /* 1748c068736aSJeffrey Hsu * Reset dupacks, except on partial acks in 1749c068736aSJeffrey Hsu * fast recovery. 1750c068736aSJeffrey Hsu */ 1751c068736aSJeffrey Hsu if (!(tp->t_dupacks >= tcprexmtthresh && is_partialack)) 1752c068736aSJeffrey Hsu tp->t_dupacks = 0; 1753c068736aSJeffrey Hsu } else { 1754233e8c18SGarrett Wollman if (tp->t_dupacks >= tcprexmtthresh && 1755df8bae1dSRodney W. Grimes tp->snd_cwnd > tp->snd_ssthresh) 1756df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->snd_ssthresh; 1757df8bae1dSRodney W. Grimes tp->t_dupacks = 0; 175846f58482SJonathan Lemon } 1759fb59c426SYoshinobu Inoue if (SEQ_GT(th->th_ack, tp->snd_max)) { 1760df8bae1dSRodney W. Grimes tcpstat.tcps_rcvacktoomuch++; 1761df8bae1dSRodney W. Grimes goto dropafterack; 1762df8bae1dSRodney W. Grimes } 1763a0292f23SGarrett Wollman /* 1764a0292f23SGarrett Wollman * If we reach this point, ACK is not a duplicate, 1765a0292f23SGarrett Wollman * i.e., it ACKs something we sent. 1766a0292f23SGarrett Wollman */ 1767a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDSYN) { 1768a0292f23SGarrett Wollman /* 1769a0292f23SGarrett Wollman * T/TCP: Connection was half-synchronized, and our 1770a0292f23SGarrett Wollman * SYN has been ACK'd (so connection is now fully 177107e43e10SAndras Olah * synchronized). Go to non-starred state, 177207e43e10SAndras Olah * increment snd_una for ACK of SYN, and check if 177307e43e10SAndras Olah * we can do window scaling. 1774a0292f23SGarrett Wollman */ 1775a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDSYN; 1776a0292f23SGarrett Wollman tp->snd_una++; 177707e43e10SAndras Olah /* Do window scaling? */ 177807e43e10SAndras Olah if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 177907e43e10SAndras Olah (TF_RCVD_SCALE|TF_REQ_SCALE)) { 178007e43e10SAndras Olah tp->snd_scale = tp->requested_s_scale; 178107e43e10SAndras Olah tp->rcv_scale = tp->request_r_scale; 178207e43e10SAndras Olah } 1783a0292f23SGarrett Wollman } 1784a0292f23SGarrett Wollman 1785a0292f23SGarrett Wollman process_ACK: 1786fb59c426SYoshinobu Inoue acked = th->th_ack - tp->snd_una; 1787df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackpack++; 1788df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackbyte += acked; 1789df8bae1dSRodney W. Grimes 1790df8bae1dSRodney W. Grimes /* 17919b8b58e0SJonathan Lemon * If we just performed our first retransmit, and the ACK 17929b8b58e0SJonathan Lemon * arrives within our recovery window, then it was a mistake 17939b8b58e0SJonathan Lemon * to do the retransmit in the first place. Recover our 17949b8b58e0SJonathan Lemon * original cwnd and ssthresh, and proceed to transmit where 17959b8b58e0SJonathan Lemon * we left off. 17969b8b58e0SJonathan Lemon */ 17979b8b58e0SJonathan Lemon if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) { 1798d65bf08aSMatthew Dillon ++tcpstat.tcps_sndrexmitbad; 17999b8b58e0SJonathan Lemon tp->snd_cwnd = tp->snd_cwnd_prev; 18009b8b58e0SJonathan Lemon tp->snd_ssthresh = tp->snd_ssthresh_prev; 18019b8b58e0SJonathan Lemon tp->snd_nxt = tp->snd_max; 18029b8b58e0SJonathan Lemon tp->t_badrxtwin = 0; /* XXX probably not required */ 18039b8b58e0SJonathan Lemon } 18049b8b58e0SJonathan Lemon 18059b8b58e0SJonathan Lemon /* 1806df8bae1dSRodney W. Grimes * If we have a timestamp reply, update smoothed 1807df8bae1dSRodney W. Grimes * round trip time. If no timestamp is present but 1808df8bae1dSRodney W. Grimes * transmit timer is running and timed sequence 1809df8bae1dSRodney W. Grimes * number was acked, update smoothed round trip time. 1810df8bae1dSRodney W. Grimes * Since we now have an rtt measurement, cancel the 1811df8bae1dSRodney W. Grimes * timer backoff (cf., Phil Karn's retransmit alg.). 1812df8bae1dSRodney W. Grimes * Recompute the initial retransmit timer. 1813df8bae1dSRodney W. Grimes */ 1814be2ac88cSJonathan Lemon if (to.to_flags & TOF_TS) 18159b8b58e0SJonathan Lemon tcp_xmit_timer(tp, ticks - to.to_tsecr + 1); 1816fb59c426SYoshinobu Inoue else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) 18179b8b58e0SJonathan Lemon tcp_xmit_timer(tp, ticks - tp->t_rtttime); 18181fcc99b5SMatthew Dillon tcp_xmit_bandwidth_limit(tp, th->th_ack); 1819df8bae1dSRodney W. Grimes 1820df8bae1dSRodney W. Grimes /* 1821df8bae1dSRodney W. Grimes * If all outstanding data is acked, stop retransmit 1822df8bae1dSRodney W. Grimes * timer and remember to restart (more output or persist). 1823df8bae1dSRodney W. Grimes * If there is more data to be acked, restart retransmit 1824df8bae1dSRodney W. Grimes * timer, using current (possibly backed-off) value. 1825df8bae1dSRodney W. Grimes */ 1826fb59c426SYoshinobu Inoue if (th->th_ack == tp->snd_max) { 18279b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 1828df8bae1dSRodney W. Grimes needoutput = 1; 18299b8b58e0SJonathan Lemon } else if (!callout_active(tp->tt_persist)) 18309b8b58e0SJonathan Lemon callout_reset(tp->tt_rexmt, tp->t_rxtcur, 18319b8b58e0SJonathan Lemon tcp_timer_rexmt, tp); 1832a0292f23SGarrett Wollman 1833a0292f23SGarrett Wollman /* 1834a0292f23SGarrett Wollman * If no data (only SYN) was ACK'd, 1835a0292f23SGarrett Wollman * skip rest of ACK processing. 1836a0292f23SGarrett Wollman */ 1837a0292f23SGarrett Wollman if (acked == 0) 1838a0292f23SGarrett Wollman goto step6; 1839a0292f23SGarrett Wollman 1840df8bae1dSRodney W. Grimes /* 1841df8bae1dSRodney W. Grimes * When new data is acked, open the congestion window. 1842df8bae1dSRodney W. Grimes * If the window gives us less than ssthresh packets 1843df8bae1dSRodney W. Grimes * in flight, open exponentially (maxseg per packet). 1844df8bae1dSRodney W. Grimes * Otherwise open linearly: maxseg per window 184510be5648SGarrett Wollman * (maxseg^2 / cwnd per packet). 1846df8bae1dSRodney W. Grimes */ 1847df8bae1dSRodney W. Grimes { 1848df8bae1dSRodney W. Grimes register u_int cw = tp->snd_cwnd; 1849df8bae1dSRodney W. Grimes register u_int incr = tp->t_maxseg; 1850df8bae1dSRodney W. Grimes 1851df8bae1dSRodney W. Grimes if (cw > tp->snd_ssthresh) 185210be5648SGarrett Wollman incr = incr * incr / cw; 18538735719eSJonathan Lemon /* 18548735719eSJonathan Lemon * If t_dupacks != 0 here, it indicates that we are still 18558735719eSJonathan Lemon * in NewReno fast recovery mode, so we leave the congestion 18568735719eSJonathan Lemon * window alone. 18578735719eSJonathan Lemon */ 1858c068736aSJeffrey Hsu if (!tcp_do_newreno || tp->t_dupacks == 0) 1859df8bae1dSRodney W. Grimes tp->snd_cwnd = min(cw + incr,TCP_MAXWIN<<tp->snd_scale); 1860df8bae1dSRodney W. Grimes } 1861df8bae1dSRodney W. Grimes if (acked > so->so_snd.sb_cc) { 1862df8bae1dSRodney W. Grimes tp->snd_wnd -= so->so_snd.sb_cc; 1863df8bae1dSRodney W. Grimes sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1864df8bae1dSRodney W. Grimes ourfinisacked = 1; 1865df8bae1dSRodney W. Grimes } else { 1866df8bae1dSRodney W. Grimes sbdrop(&so->so_snd, acked); 1867df8bae1dSRodney W. Grimes tp->snd_wnd -= acked; 1868df8bae1dSRodney W. Grimes ourfinisacked = 0; 1869df8bae1dSRodney W. Grimes } 1870df8bae1dSRodney W. Grimes sowwakeup(so); 1871fb59c426SYoshinobu Inoue tp->snd_una = th->th_ack; 1872df8bae1dSRodney W. Grimes if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1873df8bae1dSRodney W. Grimes tp->snd_nxt = tp->snd_una; 1874df8bae1dSRodney W. Grimes 1875df8bae1dSRodney W. Grimes switch (tp->t_state) { 1876df8bae1dSRodney W. Grimes 1877df8bae1dSRodney W. Grimes /* 1878df8bae1dSRodney W. Grimes * In FIN_WAIT_1 STATE in addition to the processing 1879df8bae1dSRodney W. Grimes * for the ESTABLISHED state if our FIN is now acknowledged 1880df8bae1dSRodney W. Grimes * then enter FIN_WAIT_2. 1881df8bae1dSRodney W. Grimes */ 1882df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 1883df8bae1dSRodney W. Grimes if (ourfinisacked) { 1884df8bae1dSRodney W. Grimes /* 1885df8bae1dSRodney W. Grimes * If we can't receive any more 1886df8bae1dSRodney W. Grimes * data, then closing user can proceed. 1887df8bae1dSRodney W. Grimes * Starting the timer is contrary to the 1888df8bae1dSRodney W. Grimes * specification, but if we don't get a FIN 1889df8bae1dSRodney W. Grimes * we'll hang forever. 1890df8bae1dSRodney W. Grimes */ 1891df8bae1dSRodney W. Grimes if (so->so_state & SS_CANTRCVMORE) { 189203e49181SSeigo Tanimura soisdisconnected(so); 18939b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, tcp_maxidle, 18949b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 18954cc20ab1SSeigo Tanimura } 1896df8bae1dSRodney W. Grimes tp->t_state = TCPS_FIN_WAIT_2; 1897df8bae1dSRodney W. Grimes } 1898df8bae1dSRodney W. Grimes break; 1899df8bae1dSRodney W. Grimes 1900df8bae1dSRodney W. Grimes /* 1901df8bae1dSRodney W. Grimes * In CLOSING STATE in addition to the processing for 1902df8bae1dSRodney W. Grimes * the ESTABLISHED state if the ACK acknowledges our FIN 1903df8bae1dSRodney W. Grimes * then enter the TIME-WAIT state, otherwise ignore 1904df8bae1dSRodney W. Grimes * the segment. 1905df8bae1dSRodney W. Grimes */ 1906df8bae1dSRodney W. Grimes case TCPS_CLOSING: 1907df8bae1dSRodney W. Grimes if (ourfinisacked) { 1908df8bae1dSRodney W. Grimes tp->t_state = TCPS_TIME_WAIT; 1909df8bae1dSRodney W. Grimes tcp_canceltimers(tp); 1910a0292f23SGarrett Wollman /* Shorten TIME_WAIT [RFC-1644, p.28] */ 1911a0292f23SGarrett Wollman if (tp->cc_recv != 0 && 19129b8b58e0SJonathan Lemon (ticks - tp->t_starttime) < tcp_msl) 19139b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 19149b8b58e0SJonathan Lemon tp->t_rxtcur * 19159b8b58e0SJonathan Lemon TCPTV_TWTRUNC, 19169b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 1917a0292f23SGarrett Wollman else 19189b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 19199b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 1920df8bae1dSRodney W. Grimes soisdisconnected(so); 1921df8bae1dSRodney W. Grimes } 1922df8bae1dSRodney W. Grimes break; 1923df8bae1dSRodney W. Grimes 1924df8bae1dSRodney W. Grimes /* 1925df8bae1dSRodney W. Grimes * In LAST_ACK, we may still be waiting for data to drain 1926df8bae1dSRodney W. Grimes * and/or to be acked, as well as for the ack of our FIN. 1927df8bae1dSRodney W. Grimes * If our FIN is now acknowledged, delete the TCB, 1928df8bae1dSRodney W. Grimes * enter the closed state and return. 1929df8bae1dSRodney W. Grimes */ 1930df8bae1dSRodney W. Grimes case TCPS_LAST_ACK: 1931df8bae1dSRodney W. Grimes if (ourfinisacked) { 1932df8bae1dSRodney W. Grimes tp = tcp_close(tp); 1933df8bae1dSRodney W. Grimes goto drop; 1934df8bae1dSRodney W. Grimes } 1935df8bae1dSRodney W. Grimes break; 1936df8bae1dSRodney W. Grimes 1937df8bae1dSRodney W. Grimes /* 1938df8bae1dSRodney W. Grimes * In TIME_WAIT state the only thing that should arrive 1939df8bae1dSRodney W. Grimes * is a retransmission of the remote FIN. Acknowledge 1940df8bae1dSRodney W. Grimes * it and restart the finack timer. 1941df8bae1dSRodney W. Grimes */ 1942df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 19439b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 19449b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 1945df8bae1dSRodney W. Grimes goto dropafterack; 1946df8bae1dSRodney W. Grimes } 1947df8bae1dSRodney W. Grimes } 1948df8bae1dSRodney W. Grimes 1949df8bae1dSRodney W. Grimes step6: 1950df8bae1dSRodney W. Grimes /* 1951df8bae1dSRodney W. Grimes * Update window information. 1952df8bae1dSRodney W. Grimes * Don't look at window if no ACK: TAC's send garbage on first SYN. 1953df8bae1dSRodney W. Grimes */ 1954fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 1955fb59c426SYoshinobu Inoue (SEQ_LT(tp->snd_wl1, th->th_seq) || 1956fb59c426SYoshinobu Inoue (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) || 1957fb59c426SYoshinobu Inoue (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 1958df8bae1dSRodney W. Grimes /* keep track of pure window updates */ 1959fb59c426SYoshinobu Inoue if (tlen == 0 && 1960fb59c426SYoshinobu Inoue tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 1961df8bae1dSRodney W. Grimes tcpstat.tcps_rcvwinupd++; 1962df8bae1dSRodney W. Grimes tp->snd_wnd = tiwin; 1963fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq; 1964fb59c426SYoshinobu Inoue tp->snd_wl2 = th->th_ack; 1965df8bae1dSRodney W. Grimes if (tp->snd_wnd > tp->max_sndwnd) 1966df8bae1dSRodney W. Grimes tp->max_sndwnd = tp->snd_wnd; 1967df8bae1dSRodney W. Grimes needoutput = 1; 1968df8bae1dSRodney W. Grimes } 1969df8bae1dSRodney W. Grimes 1970df8bae1dSRodney W. Grimes /* 1971df8bae1dSRodney W. Grimes * Process segments with URG. 1972df8bae1dSRodney W. Grimes */ 1973fb59c426SYoshinobu Inoue if ((thflags & TH_URG) && th->th_urp && 1974df8bae1dSRodney W. Grimes TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1975df8bae1dSRodney W. Grimes /* 1976df8bae1dSRodney W. Grimes * This is a kludge, but if we receive and accept 1977df8bae1dSRodney W. Grimes * random urgent pointers, we'll crash in 1978df8bae1dSRodney W. Grimes * soreceive. It's hard to imagine someone 1979df8bae1dSRodney W. Grimes * actually wanting to send this much urgent data. 1980df8bae1dSRodney W. Grimes */ 1981fb59c426SYoshinobu Inoue if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 1982fb59c426SYoshinobu Inoue th->th_urp = 0; /* XXX */ 1983fb59c426SYoshinobu Inoue thflags &= ~TH_URG; /* XXX */ 1984df8bae1dSRodney W. Grimes goto dodata; /* XXX */ 1985df8bae1dSRodney W. Grimes } 1986df8bae1dSRodney W. Grimes /* 1987df8bae1dSRodney W. Grimes * If this segment advances the known urgent pointer, 1988df8bae1dSRodney W. Grimes * then mark the data stream. This should not happen 1989df8bae1dSRodney W. Grimes * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 1990df8bae1dSRodney W. Grimes * a FIN has been received from the remote side. 1991df8bae1dSRodney W. Grimes * In these states we ignore the URG. 1992df8bae1dSRodney W. Grimes * 1993df8bae1dSRodney W. Grimes * According to RFC961 (Assigned Protocols), 1994df8bae1dSRodney W. Grimes * the urgent pointer points to the last octet 1995df8bae1dSRodney W. Grimes * of urgent data. We continue, however, 1996df8bae1dSRodney W. Grimes * to consider it to indicate the first octet 1997df8bae1dSRodney W. Grimes * of data past the urgent section as the original 1998df8bae1dSRodney W. Grimes * spec states (in one of two places). 1999df8bae1dSRodney W. Grimes */ 2000fb59c426SYoshinobu Inoue if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 2001fb59c426SYoshinobu Inoue tp->rcv_up = th->th_seq + th->th_urp; 2002df8bae1dSRodney W. Grimes so->so_oobmark = so->so_rcv.sb_cc + 2003df8bae1dSRodney W. Grimes (tp->rcv_up - tp->rcv_nxt) - 1; 20044cc20ab1SSeigo Tanimura if (so->so_oobmark == 0) 2005df8bae1dSRodney W. Grimes so->so_state |= SS_RCVATMARK; 2006df8bae1dSRodney W. Grimes sohasoutofband(so); 2007df8bae1dSRodney W. Grimes tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 2008df8bae1dSRodney W. Grimes } 2009df8bae1dSRodney W. Grimes /* 2010df8bae1dSRodney W. Grimes * Remove out of band data so doesn't get presented to user. 2011df8bae1dSRodney W. Grimes * This can happen independent of advancing the URG pointer, 2012df8bae1dSRodney W. Grimes * but if two URG's are pending at once, some out-of-band 2013df8bae1dSRodney W. Grimes * data may creep in... ick. 2014df8bae1dSRodney W. Grimes */ 20154cc20ab1SSeigo Tanimura if (th->th_urp <= (u_long)tlen 2016df8bae1dSRodney W. Grimes #ifdef SO_OOBINLINE 20174cc20ab1SSeigo Tanimura && (so->so_options & SO_OOBINLINE) == 0 2018df8bae1dSRodney W. Grimes #endif 20194cc20ab1SSeigo Tanimura ) 2020fb59c426SYoshinobu Inoue tcp_pulloutofband(so, th, m, 2021fb59c426SYoshinobu Inoue drop_hdrlen); /* hdr drop is delayed */ 2022c068736aSJeffrey Hsu } else { 2023df8bae1dSRodney W. Grimes /* 2024df8bae1dSRodney W. Grimes * If no out of band data is expected, 2025df8bae1dSRodney W. Grimes * pull receive urgent pointer along 2026df8bae1dSRodney W. Grimes * with the receive window. 2027df8bae1dSRodney W. Grimes */ 2028df8bae1dSRodney W. Grimes if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 2029df8bae1dSRodney W. Grimes tp->rcv_up = tp->rcv_nxt; 2030c068736aSJeffrey Hsu } 2031df8bae1dSRodney W. Grimes dodata: /* XXX */ 2032f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 2033f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2034f76fcf6dSJeffrey Hsu headlocked = 0; 2035df8bae1dSRodney W. Grimes /* 2036df8bae1dSRodney W. Grimes * Process the segment text, merging it into the TCP sequencing queue, 2037df8bae1dSRodney W. Grimes * and arranging for acknowledgment of receipt if necessary. 2038df8bae1dSRodney W. Grimes * This process logically involves adjusting tp->rcv_wnd as data 2039df8bae1dSRodney W. Grimes * is presented to the user (this happens in tcp_usrreq.c, 2040df8bae1dSRodney W. Grimes * case PRU_RCVD). If a FIN has already been received on this 2041df8bae1dSRodney W. Grimes * connection then we just ignore the text. 2042df8bae1dSRodney W. Grimes */ 2043fb59c426SYoshinobu Inoue if ((tlen || (thflags & TH_FIN)) && 2044df8bae1dSRodney W. Grimes TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2045fb59c426SYoshinobu Inoue m_adj(m, drop_hdrlen); /* delayed header drop */ 2046e4b64281SJesper Skriver /* 2047c068736aSJeffrey Hsu * Insert segment which includes th into TCP reassembly queue 2048c068736aSJeffrey Hsu * with control block tp. Set thflags to whether reassembly now 2049c068736aSJeffrey Hsu * includes a segment with FIN. This handles the common case 2050c068736aSJeffrey Hsu * inline (segment is the next to be received on an established 2051c068736aSJeffrey Hsu * connection, and the queue is empty), avoiding linkage into 2052c068736aSJeffrey Hsu * and removal from the queue and repetition of various 2053c068736aSJeffrey Hsu * conversions. 2054c068736aSJeffrey Hsu * Set DELACK for segments received in order, but ack 2055c068736aSJeffrey Hsu * immediately when segments are out of order (so 2056c068736aSJeffrey Hsu * fast retransmit can work). 2057e4b64281SJesper Skriver */ 2058e4b64281SJesper Skriver if (th->th_seq == tp->rcv_nxt && 2059e4b64281SJesper Skriver LIST_EMPTY(&tp->t_segq) && 2060e4b64281SJesper Skriver TCPS_HAVEESTABLISHED(tp->t_state)) { 2061e4b64281SJesper Skriver if (DELAY_ACK(tp)) 2062e4b64281SJesper Skriver callout_reset(tp->tt_delack, tcp_delacktime, 2063e4b64281SJesper Skriver tcp_timer_delack, tp); 2064e4b64281SJesper Skriver else 2065e4b64281SJesper Skriver tp->t_flags |= TF_ACKNOW; 2066e4b64281SJesper Skriver tp->rcv_nxt += tlen; 2067e4b64281SJesper Skriver thflags = th->th_flags & TH_FIN; 2068e4b64281SJesper Skriver tcpstat.tcps_rcvpack++; 2069e4b64281SJesper Skriver tcpstat.tcps_rcvbyte += tlen; 2070e4b64281SJesper Skriver ND6_HINT(tp); 2071e4b64281SJesper Skriver sbappend(&so->so_rcv, m); 2072e4b64281SJesper Skriver sorwakeup(so); 2073e4b64281SJesper Skriver } else { 2074e4b64281SJesper Skriver thflags = tcp_reass(tp, th, &tlen, m); 2075e4b64281SJesper Skriver tp->t_flags |= TF_ACKNOW; 2076e4b64281SJesper Skriver } 2077e4b64281SJesper Skriver 2078df8bae1dSRodney W. Grimes /* 2079df8bae1dSRodney W. Grimes * Note the amount of data that peer has sent into 2080df8bae1dSRodney W. Grimes * our window, in order to estimate the sender's 2081df8bae1dSRodney W. Grimes * buffer size. 2082df8bae1dSRodney W. Grimes */ 2083df8bae1dSRodney W. Grimes len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 2084df8bae1dSRodney W. Grimes } else { 2085df8bae1dSRodney W. Grimes m_freem(m); 2086fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 2087df8bae1dSRodney W. Grimes } 2088df8bae1dSRodney W. Grimes 2089df8bae1dSRodney W. Grimes /* 2090df8bae1dSRodney W. Grimes * If FIN is received ACK the FIN and let the user know 2091df8bae1dSRodney W. Grimes * that the connection is closing. 2092df8bae1dSRodney W. Grimes */ 2093fb59c426SYoshinobu Inoue if (thflags & TH_FIN) { 2094df8bae1dSRodney W. Grimes if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2095df8bae1dSRodney W. Grimes socantrcvmore(so); 2096a0292f23SGarrett Wollman /* 2097a0292f23SGarrett Wollman * If connection is half-synchronized 2098d3eede9dSAndras Olah * (ie NEEDSYN flag on) then delay ACK, 2099a0292f23SGarrett Wollman * so it may be piggybacked when SYN is sent. 2100a0292f23SGarrett Wollman * Otherwise, since we received a FIN then no 2101a0292f23SGarrett Wollman * more input can be expected, send ACK now. 2102a0292f23SGarrett Wollman */ 2103d8c85a26SJonathan Lemon if (DELAY_ACK(tp) && (tp->t_flags & TF_NEEDSYN)) 21049b8b58e0SJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 21059b8b58e0SJonathan Lemon tcp_timer_delack, tp); 2106a0292f23SGarrett Wollman else 2107df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 2108df8bae1dSRodney W. Grimes tp->rcv_nxt++; 2109df8bae1dSRodney W. Grimes } 2110df8bae1dSRodney W. Grimes switch (tp->t_state) { 2111df8bae1dSRodney W. Grimes 2112df8bae1dSRodney W. Grimes /* 2113df8bae1dSRodney W. Grimes * In SYN_RECEIVED and ESTABLISHED STATES 2114df8bae1dSRodney W. Grimes * enter the CLOSE_WAIT state. 2115df8bae1dSRodney W. Grimes */ 2116df8bae1dSRodney W. Grimes case TCPS_SYN_RECEIVED: 21179b8b58e0SJonathan Lemon tp->t_starttime = ticks; 21189b8b58e0SJonathan Lemon /*FALLTHROUGH*/ 2119df8bae1dSRodney W. Grimes case TCPS_ESTABLISHED: 2120df8bae1dSRodney W. Grimes tp->t_state = TCPS_CLOSE_WAIT; 2121df8bae1dSRodney W. Grimes break; 2122df8bae1dSRodney W. Grimes 2123df8bae1dSRodney W. Grimes /* 2124df8bae1dSRodney W. Grimes * If still in FIN_WAIT_1 STATE FIN has not been acked so 2125df8bae1dSRodney W. Grimes * enter the CLOSING state. 2126df8bae1dSRodney W. Grimes */ 2127df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 2128df8bae1dSRodney W. Grimes tp->t_state = TCPS_CLOSING; 2129df8bae1dSRodney W. Grimes break; 2130df8bae1dSRodney W. Grimes 2131df8bae1dSRodney W. Grimes /* 2132df8bae1dSRodney W. Grimes * In FIN_WAIT_2 state enter the TIME_WAIT state, 2133df8bae1dSRodney W. Grimes * starting the time-wait timer, turning off the other 2134df8bae1dSRodney W. Grimes * standard timers. 2135df8bae1dSRodney W. Grimes */ 2136df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_2: 2137df8bae1dSRodney W. Grimes tp->t_state = TCPS_TIME_WAIT; 2138df8bae1dSRodney W. Grimes tcp_canceltimers(tp); 2139a0292f23SGarrett Wollman /* Shorten TIME_WAIT [RFC-1644, p.28] */ 2140a0292f23SGarrett Wollman if (tp->cc_recv != 0 && 21419b8b58e0SJonathan Lemon (ticks - tp->t_starttime) < tcp_msl) { 21429b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 21439b8b58e0SJonathan Lemon tp->t_rxtcur * TCPTV_TWTRUNC, 21449b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 2145a0292f23SGarrett Wollman /* For transaction client, force ACK now. */ 2146a0292f23SGarrett Wollman tp->t_flags |= TF_ACKNOW; 2147a0292f23SGarrett Wollman } 2148a0292f23SGarrett Wollman else 21499b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 21509b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 2151df8bae1dSRodney W. Grimes soisdisconnected(so); 2152df8bae1dSRodney W. Grimes break; 2153df8bae1dSRodney W. Grimes 2154df8bae1dSRodney W. Grimes /* 2155df8bae1dSRodney W. Grimes * In TIME_WAIT state restart the 2 MSL time_wait timer. 2156df8bae1dSRodney W. Grimes */ 2157df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 21589b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 21599b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 2160df8bae1dSRodney W. Grimes break; 2161df8bae1dSRodney W. Grimes } 2162df8bae1dSRodney W. Grimes } 2163610ee2f9SDavid Greenman #ifdef TCPDEBUG 21644cc20ab1SSeigo Tanimura if (so->so_options & SO_DEBUG) 2165fb59c426SYoshinobu Inoue tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen, 2166fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2167610ee2f9SDavid Greenman #endif 2168df8bae1dSRodney W. Grimes 2169df8bae1dSRodney W. Grimes /* 2170df8bae1dSRodney W. Grimes * Return any desired output. 2171df8bae1dSRodney W. Grimes */ 2172df8bae1dSRodney W. Grimes if (needoutput || (tp->t_flags & TF_ACKNOW)) 2173df8bae1dSRodney W. Grimes (void) tcp_output(tp); 2174f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2175df8bae1dSRodney W. Grimes return; 2176df8bae1dSRodney W. Grimes 2177df8bae1dSRodney W. Grimes dropafterack: 2178df8bae1dSRodney W. Grimes /* 2179df8bae1dSRodney W. Grimes * Generate an ACK dropping incoming segment if it occupies 2180df8bae1dSRodney W. Grimes * sequence space, where the ACK reflects our state. 218180ab7c0eSGarrett Wollman * 218280ab7c0eSGarrett Wollman * We can now skip the test for the RST flag since all 218380ab7c0eSGarrett Wollman * paths to this code happen after packets containing 218480ab7c0eSGarrett Wollman * RST have been dropped. 218580ab7c0eSGarrett Wollman * 218680ab7c0eSGarrett Wollman * In the SYN-RECEIVED state, don't send an ACK unless the 218780ab7c0eSGarrett Wollman * segment we received passes the SYN-RECEIVED ACK test. 218880ab7c0eSGarrett Wollman * If it fails send a RST. This breaks the loop in the 218980ab7c0eSGarrett Wollman * "LAND" DoS attack, and also prevents an ACK storm 219080ab7c0eSGarrett Wollman * between two listening ports that have been sent forged 219180ab7c0eSGarrett Wollman * SYN segments, each with the source address of the other. 2192df8bae1dSRodney W. Grimes */ 2193fb59c426SYoshinobu Inoue if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) && 2194fb59c426SYoshinobu Inoue (SEQ_GT(tp->snd_una, th->th_ack) || 2195a57815efSBosko Milekic SEQ_GT(th->th_ack, tp->snd_max)) ) { 2196a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 2197a57815efSBosko Milekic goto dropwithreset; 2198a57815efSBosko Milekic } 2199a0292f23SGarrett Wollman #ifdef TCPDEBUG 22004cc20ab1SSeigo Tanimura if (so->so_options & SO_DEBUG) 2201fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2202fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2203a0292f23SGarrett Wollman #endif 2204f76fcf6dSJeffrey Hsu if (headlocked) 2205f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2206df8bae1dSRodney W. Grimes m_freem(m); 2207df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 2208df8bae1dSRodney W. Grimes (void) tcp_output(tp); 2209f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2210df8bae1dSRodney W. Grimes return; 2211df8bae1dSRodney W. Grimes 2212df8bae1dSRodney W. Grimes dropwithreset: 2213df8bae1dSRodney W. Grimes /* 2214df8bae1dSRodney W. Grimes * Generate a RST, dropping incoming segment. 2215df8bae1dSRodney W. Grimes * Make ACK acceptable to originator of segment. 2216df8bae1dSRodney W. Grimes * Don't bother to respond if destination was broadcast/multicast. 2217df8bae1dSRodney W. Grimes */ 2218fb59c426SYoshinobu Inoue if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST)) 2219df8bae1dSRodney W. Grimes goto drop; 2220fb59c426SYoshinobu Inoue if (isipv6) { 2221173c0f9fSWarner Losh if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 2222173c0f9fSWarner Losh IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) 2223fb59c426SYoshinobu Inoue goto drop; 2224c068736aSJeffrey Hsu } else { 2225173c0f9fSWarner Losh if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 2226173c0f9fSWarner Losh IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 22272ca2159fSCrist J. Clark ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || 22282ca2159fSCrist J. Clark in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 2229fb59c426SYoshinobu Inoue goto drop; 2230c068736aSJeffrey Hsu } 2231fb59c426SYoshinobu Inoue /* IPv6 anycast check is done at tcp6_input() */ 2232a57815efSBosko Milekic 2233a57815efSBosko Milekic /* 2234c59319bfSDag-Erling Smørgrav * Perform bandwidth limiting. 2235a57815efSBosko Milekic */ 2236a57815efSBosko Milekic if (badport_bandlim(rstreason) < 0) 2237a57815efSBosko Milekic goto drop; 2238a57815efSBosko Milekic 2239a0292f23SGarrett Wollman #ifdef TCPDEBUG 22404cc20ab1SSeigo Tanimura if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 2241fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2242fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2243a0292f23SGarrett Wollman #endif 22446fd22cafSJeffrey Hsu 22456fd22cafSJeffrey Hsu if (tp) 22466fd22cafSJeffrey Hsu INP_UNLOCK(inp); 22476fd22cafSJeffrey Hsu 2248fb59c426SYoshinobu Inoue if (thflags & TH_ACK) 2249fb59c426SYoshinobu Inoue /* mtod() below is safe as long as hdr dropping is delayed */ 2250fb59c426SYoshinobu Inoue tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack, 2251fb59c426SYoshinobu Inoue TH_RST); 2252df8bae1dSRodney W. Grimes else { 2253fb59c426SYoshinobu Inoue if (thflags & TH_SYN) 2254fb59c426SYoshinobu Inoue tlen++; 2255fb59c426SYoshinobu Inoue /* mtod() below is safe as long as hdr dropping is delayed */ 2256fb59c426SYoshinobu Inoue tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen, 2257fb59c426SYoshinobu Inoue (tcp_seq)0, TH_RST|TH_ACK); 2258df8bae1dSRodney W. Grimes } 2259f76fcf6dSJeffrey Hsu if (headlocked) 2260f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2261df8bae1dSRodney W. Grimes return; 2262df8bae1dSRodney W. Grimes 2263df8bae1dSRodney W. Grimes drop: 2264df8bae1dSRodney W. Grimes /* 2265df8bae1dSRodney W. Grimes * Drop space held by incoming segment and return. 2266df8bae1dSRodney W. Grimes */ 2267610ee2f9SDavid Greenman #ifdef TCPDEBUG 22684cc20ab1SSeigo Tanimura if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 2269fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2270fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2271a0292f23SGarrett Wollman #endif 2272f76fcf6dSJeffrey Hsu if (tp) 2273f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2274df8bae1dSRodney W. Grimes m_freem(m); 2275f76fcf6dSJeffrey Hsu if (headlocked) 2276f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2277df8bae1dSRodney W. Grimes return; 2278df8bae1dSRodney W. Grimes } 2279df8bae1dSRodney W. Grimes 2280be2ac88cSJonathan Lemon /* 2281be2ac88cSJonathan Lemon * Parse TCP options and place in tcpopt. 2282be2ac88cSJonathan Lemon */ 22830312fbe9SPoul-Henning Kamp static void 2284be2ac88cSJonathan Lemon tcp_dooptions(to, cp, cnt, is_syn) 2285be2ac88cSJonathan Lemon struct tcpopt *to; 2286df8bae1dSRodney W. Grimes u_char *cp; 2287df8bae1dSRodney W. Grimes int cnt; 2288df8bae1dSRodney W. Grimes { 2289df8bae1dSRodney W. Grimes int opt, optlen; 2290df8bae1dSRodney W. Grimes 2291be2ac88cSJonathan Lemon to->to_flags = 0; 2292df8bae1dSRodney W. Grimes for (; cnt > 0; cnt -= optlen, cp += optlen) { 2293df8bae1dSRodney W. Grimes opt = cp[0]; 2294df8bae1dSRodney W. Grimes if (opt == TCPOPT_EOL) 2295df8bae1dSRodney W. Grimes break; 2296df8bae1dSRodney W. Grimes if (opt == TCPOPT_NOP) 2297df8bae1dSRodney W. Grimes optlen = 1; 2298df8bae1dSRodney W. Grimes else { 2299b474779fSJun-ichiro itojun Hagino if (cnt < 2) 2300b474779fSJun-ichiro itojun Hagino break; 2301df8bae1dSRodney W. Grimes optlen = cp[1]; 2302b474779fSJun-ichiro itojun Hagino if (optlen < 2 || optlen > cnt) 2303df8bae1dSRodney W. Grimes break; 2304df8bae1dSRodney W. Grimes } 2305df8bae1dSRodney W. Grimes switch (opt) { 2306df8bae1dSRodney W. Grimes case TCPOPT_MAXSEG: 2307df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_MAXSEG) 2308df8bae1dSRodney W. Grimes continue; 2309be2ac88cSJonathan Lemon if (!is_syn) 2310df8bae1dSRodney W. Grimes continue; 2311be2ac88cSJonathan Lemon to->to_flags |= TOF_MSS; 2312be2ac88cSJonathan Lemon bcopy((char *)cp + 2, 2313be2ac88cSJonathan Lemon (char *)&to->to_mss, sizeof(to->to_mss)); 2314fd8e4ebcSMike Barcroft to->to_mss = ntohs(to->to_mss); 2315df8bae1dSRodney W. Grimes break; 2316df8bae1dSRodney W. Grimes case TCPOPT_WINDOW: 2317df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_WINDOW) 2318df8bae1dSRodney W. Grimes continue; 2319be2ac88cSJonathan Lemon if (! is_syn) 2320df8bae1dSRodney W. Grimes continue; 2321be2ac88cSJonathan Lemon to->to_flags |= TOF_SCALE; 2322be2ac88cSJonathan Lemon to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); 2323df8bae1dSRodney W. Grimes break; 2324df8bae1dSRodney W. Grimes case TCPOPT_TIMESTAMP: 2325df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_TIMESTAMP) 2326df8bae1dSRodney W. Grimes continue; 2327be2ac88cSJonathan Lemon to->to_flags |= TOF_TS; 2328a0292f23SGarrett Wollman bcopy((char *)cp + 2, 2329a0292f23SGarrett Wollman (char *)&to->to_tsval, sizeof(to->to_tsval)); 2330fd8e4ebcSMike Barcroft to->to_tsval = ntohl(to->to_tsval); 2331a0292f23SGarrett Wollman bcopy((char *)cp + 6, 2332a0292f23SGarrett Wollman (char *)&to->to_tsecr, sizeof(to->to_tsecr)); 2333fd8e4ebcSMike Barcroft to->to_tsecr = ntohl(to->to_tsecr); 2334df8bae1dSRodney W. Grimes break; 2335a0292f23SGarrett Wollman case TCPOPT_CC: 2336a0292f23SGarrett Wollman if (optlen != TCPOLEN_CC) 2337a0292f23SGarrett Wollman continue; 2338be2ac88cSJonathan Lemon to->to_flags |= TOF_CC; 2339a0292f23SGarrett Wollman bcopy((char *)cp + 2, 2340a0292f23SGarrett Wollman (char *)&to->to_cc, sizeof(to->to_cc)); 2341fd8e4ebcSMike Barcroft to->to_cc = ntohl(to->to_cc); 2342a0292f23SGarrett Wollman break; 2343a0292f23SGarrett Wollman case TCPOPT_CCNEW: 2344a0292f23SGarrett Wollman if (optlen != TCPOLEN_CC) 2345a0292f23SGarrett Wollman continue; 2346be2ac88cSJonathan Lemon if (!is_syn) 2347a0292f23SGarrett Wollman continue; 2348be2ac88cSJonathan Lemon to->to_flags |= TOF_CCNEW; 2349a0292f23SGarrett Wollman bcopy((char *)cp + 2, 2350a0292f23SGarrett Wollman (char *)&to->to_cc, sizeof(to->to_cc)); 2351fd8e4ebcSMike Barcroft to->to_cc = ntohl(to->to_cc); 2352a0292f23SGarrett Wollman break; 2353a0292f23SGarrett Wollman case TCPOPT_CCECHO: 2354a0292f23SGarrett Wollman if (optlen != TCPOLEN_CC) 2355a0292f23SGarrett Wollman continue; 2356be2ac88cSJonathan Lemon if (!is_syn) 2357a0292f23SGarrett Wollman continue; 2358be2ac88cSJonathan Lemon to->to_flags |= TOF_CCECHO; 2359a0292f23SGarrett Wollman bcopy((char *)cp + 2, 2360a0292f23SGarrett Wollman (char *)&to->to_ccecho, sizeof(to->to_ccecho)); 2361fd8e4ebcSMike Barcroft to->to_ccecho = ntohl(to->to_ccecho); 2362a0292f23SGarrett Wollman break; 2363be2ac88cSJonathan Lemon default: 2364be2ac88cSJonathan Lemon continue; 2365df8bae1dSRodney W. Grimes } 2366df8bae1dSRodney W. Grimes } 2367df8bae1dSRodney W. Grimes } 2368df8bae1dSRodney W. Grimes 2369df8bae1dSRodney W. Grimes /* 2370df8bae1dSRodney W. Grimes * Pull out of band byte out of a segment so 2371df8bae1dSRodney W. Grimes * it doesn't appear in the user's data queue. 2372df8bae1dSRodney W. Grimes * It is still reflected in the segment length for 2373df8bae1dSRodney W. Grimes * sequencing purposes. 2374df8bae1dSRodney W. Grimes */ 23750312fbe9SPoul-Henning Kamp static void 2376fb59c426SYoshinobu Inoue tcp_pulloutofband(so, th, m, off) 2377df8bae1dSRodney W. Grimes struct socket *so; 2378fb59c426SYoshinobu Inoue struct tcphdr *th; 2379df8bae1dSRodney W. Grimes register struct mbuf *m; 2380fb59c426SYoshinobu Inoue int off; /* delayed to be droped hdrlen */ 2381df8bae1dSRodney W. Grimes { 2382fb59c426SYoshinobu Inoue int cnt = off + th->th_urp - 1; 2383df8bae1dSRodney W. Grimes 2384df8bae1dSRodney W. Grimes while (cnt >= 0) { 2385df8bae1dSRodney W. Grimes if (m->m_len > cnt) { 2386df8bae1dSRodney W. Grimes char *cp = mtod(m, caddr_t) + cnt; 2387df8bae1dSRodney W. Grimes struct tcpcb *tp = sototcpcb(so); 2388df8bae1dSRodney W. Grimes 2389df8bae1dSRodney W. Grimes tp->t_iobc = *cp; 2390df8bae1dSRodney W. Grimes tp->t_oobflags |= TCPOOB_HAVEDATA; 2391df8bae1dSRodney W. Grimes bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 2392df8bae1dSRodney W. Grimes m->m_len--; 239369a34685SYoshinobu Inoue if (m->m_flags & M_PKTHDR) 239469a34685SYoshinobu Inoue m->m_pkthdr.len--; 2395df8bae1dSRodney W. Grimes return; 2396df8bae1dSRodney W. Grimes } 2397df8bae1dSRodney W. Grimes cnt -= m->m_len; 2398df8bae1dSRodney W. Grimes m = m->m_next; 2399df8bae1dSRodney W. Grimes if (m == 0) 2400df8bae1dSRodney W. Grimes break; 2401df8bae1dSRodney W. Grimes } 2402df8bae1dSRodney W. Grimes panic("tcp_pulloutofband"); 2403df8bae1dSRodney W. Grimes } 2404df8bae1dSRodney W. Grimes 2405df8bae1dSRodney W. Grimes /* 2406df8bae1dSRodney W. Grimes * Collect new round-trip time estimate 2407df8bae1dSRodney W. Grimes * and update averages and current timeout. 2408df8bae1dSRodney W. Grimes */ 24090312fbe9SPoul-Henning Kamp static void 2410df8bae1dSRodney W. Grimes tcp_xmit_timer(tp, rtt) 2411df8bae1dSRodney W. Grimes register struct tcpcb *tp; 24129b8b58e0SJonathan Lemon int rtt; 2413df8bae1dSRodney W. Grimes { 2414233e8c18SGarrett Wollman register int delta; 2415233e8c18SGarrett Wollman 2416233e8c18SGarrett Wollman tcpstat.tcps_rttupdated++; 2417233e8c18SGarrett Wollman tp->t_rttupdated++; 2418233e8c18SGarrett Wollman if (tp->t_srtt != 0) { 2419233e8c18SGarrett Wollman /* 2420233e8c18SGarrett Wollman * srtt is stored as fixed point with 5 bits after the 2421233e8c18SGarrett Wollman * binary point (i.e., scaled by 8). The following magic 2422233e8c18SGarrett Wollman * is equivalent to the smoothing algorithm in rfc793 with 2423233e8c18SGarrett Wollman * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2424233e8c18SGarrett Wollman * point). Adjust rtt to origin 0. 2425233e8c18SGarrett Wollman */ 2426233e8c18SGarrett Wollman delta = ((rtt - 1) << TCP_DELTA_SHIFT) 2427233e8c18SGarrett Wollman - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT)); 2428233e8c18SGarrett Wollman 2429233e8c18SGarrett Wollman if ((tp->t_srtt += delta) <= 0) 2430233e8c18SGarrett Wollman tp->t_srtt = 1; 2431233e8c18SGarrett Wollman 2432233e8c18SGarrett Wollman /* 2433233e8c18SGarrett Wollman * We accumulate a smoothed rtt variance (actually, a 2434233e8c18SGarrett Wollman * smoothed mean difference), then set the retransmit 2435233e8c18SGarrett Wollman * timer to smoothed rtt + 4 times the smoothed variance. 2436233e8c18SGarrett Wollman * rttvar is stored as fixed point with 4 bits after the 2437233e8c18SGarrett Wollman * binary point (scaled by 16). The following is 2438233e8c18SGarrett Wollman * equivalent to rfc793 smoothing with an alpha of .75 2439233e8c18SGarrett Wollman * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2440233e8c18SGarrett Wollman * rfc793's wired-in beta. 2441233e8c18SGarrett Wollman */ 2442233e8c18SGarrett Wollman if (delta < 0) 2443233e8c18SGarrett Wollman delta = -delta; 2444233e8c18SGarrett Wollman delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT); 2445233e8c18SGarrett Wollman if ((tp->t_rttvar += delta) <= 0) 2446233e8c18SGarrett Wollman tp->t_rttvar = 1; 24471fcc99b5SMatthew Dillon if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar) 24481fcc99b5SMatthew Dillon tp->t_rttbest = tp->t_srtt + tp->t_rttvar; 2449233e8c18SGarrett Wollman } else { 2450233e8c18SGarrett Wollman /* 2451233e8c18SGarrett Wollman * No rtt measurement yet - use the unsmoothed rtt. 2452233e8c18SGarrett Wollman * Set the variance to half the rtt (so our first 2453233e8c18SGarrett Wollman * retransmit happens at 3*rtt). 2454233e8c18SGarrett Wollman */ 2455233e8c18SGarrett Wollman tp->t_srtt = rtt << TCP_RTT_SHIFT; 2456233e8c18SGarrett Wollman tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1); 24571fcc99b5SMatthew Dillon tp->t_rttbest = tp->t_srtt + tp->t_rttvar; 2458233e8c18SGarrett Wollman } 24599b8b58e0SJonathan Lemon tp->t_rtttime = 0; 2460df8bae1dSRodney W. Grimes tp->t_rxtshift = 0; 2461df8bae1dSRodney W. Grimes 2462df8bae1dSRodney W. Grimes /* 2463df8bae1dSRodney W. Grimes * the retransmit should happen at rtt + 4 * rttvar. 2464df8bae1dSRodney W. Grimes * Because of the way we do the smoothing, srtt and rttvar 2465df8bae1dSRodney W. Grimes * will each average +1/2 tick of bias. When we compute 2466df8bae1dSRodney W. Grimes * the retransmit timer, we want 1/2 tick of rounding and 2467df8bae1dSRodney W. Grimes * 1 extra tick because of +-1/2 tick uncertainty in the 2468df8bae1dSRodney W. Grimes * firing of the timer. The bias will give us exactly the 2469df8bae1dSRodney W. Grimes * 1.5 tick we need. But, because the bias is 2470df8bae1dSRodney W. Grimes * statistical, we have to test that we don't drop below 2471df8bae1dSRodney W. Grimes * the minimum feasible timer (which is 2 ticks). 2472df8bae1dSRodney W. Grimes */ 2473233e8c18SGarrett Wollman TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), 24749e2874b0SGarrett Wollman max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX); 2475df8bae1dSRodney W. Grimes 2476df8bae1dSRodney W. Grimes /* 2477df8bae1dSRodney W. Grimes * We received an ack for a packet that wasn't retransmitted; 2478df8bae1dSRodney W. Grimes * it is probably safe to discard any error indications we've 2479df8bae1dSRodney W. Grimes * received recently. This isn't quite right, but close enough 2480df8bae1dSRodney W. Grimes * for now (a route might have failed after we sent a segment, 2481df8bae1dSRodney W. Grimes * and the return path might not be symmetrical). 2482df8bae1dSRodney W. Grimes */ 2483df8bae1dSRodney W. Grimes tp->t_softerror = 0; 2484df8bae1dSRodney W. Grimes } 2485df8bae1dSRodney W. Grimes 2486df8bae1dSRodney W. Grimes /* 2487df8bae1dSRodney W. Grimes * Determine a reasonable value for maxseg size. 2488df8bae1dSRodney W. Grimes * If the route is known, check route for mtu. 2489df8bae1dSRodney W. Grimes * If none, use an mss that can be handled on the outgoing 2490df8bae1dSRodney W. Grimes * interface without forcing IP to fragment; if bigger than 2491df8bae1dSRodney W. Grimes * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES 2492df8bae1dSRodney W. Grimes * to utilize large mbufs. If no route is found, route has no mtu, 2493df8bae1dSRodney W. Grimes * or the destination isn't local, use a default, hopefully conservative 2494df8bae1dSRodney W. Grimes * size (usually 512 or the default IP max size, but no more than the mtu 2495df8bae1dSRodney W. Grimes * of the interface), as we can't discover anything about intervening 2496df8bae1dSRodney W. Grimes * gateways or networks. We also initialize the congestion/slow start 2497df8bae1dSRodney W. Grimes * window to be a single segment if the destination isn't local. 2498df8bae1dSRodney W. Grimes * While looking at the routing entry, we also initialize other path-dependent 2499df8bae1dSRodney W. Grimes * parameters from pre-set or cached values in the routing entry. 2500a0292f23SGarrett Wollman * 2501a0292f23SGarrett Wollman * Also take into account the space needed for options that we 2502a0292f23SGarrett Wollman * send regularly. Make maxseg shorter by that amount to assure 2503a0292f23SGarrett Wollman * that we can send maxseg amount of data even when the options 2504a0292f23SGarrett Wollman * are present. Store the upper limit of the length of options plus 2505a0292f23SGarrett Wollman * data in maxopd. 2506a0292f23SGarrett Wollman * 2507a0292f23SGarrett Wollman * NOTE that this routine is only called when we process an incoming 2508a0292f23SGarrett Wollman * segment, for outgoing segments only tcp_mssopt is called. 2509a0292f23SGarrett Wollman * 2510a0292f23SGarrett Wollman * In case of T/TCP, we call this routine during implicit connection 2511a0292f23SGarrett Wollman * setup as well (offer = -1), to initialize maxseg from the cached 2512a0292f23SGarrett Wollman * MSS of our peer. 2513df8bae1dSRodney W. Grimes */ 2514a0292f23SGarrett Wollman void 2515df8bae1dSRodney W. Grimes tcp_mss(tp, offer) 2516a0292f23SGarrett Wollman struct tcpcb *tp; 2517a0292f23SGarrett Wollman int offer; 2518df8bae1dSRodney W. Grimes { 2519df8bae1dSRodney W. Grimes register struct rtentry *rt; 2520df8bae1dSRodney W. Grimes struct ifnet *ifp; 2521df8bae1dSRodney W. Grimes register int rtt, mss; 2522df8bae1dSRodney W. Grimes u_long bufsize; 2523c068736aSJeffrey Hsu struct inpcb *inp = tp->t_inpcb; 2524df8bae1dSRodney W. Grimes struct socket *so; 2525a0292f23SGarrett Wollman struct rmxp_tao *taop; 2526a0292f23SGarrett Wollman int origoffer = offer; 2527fb59c426SYoshinobu Inoue #ifdef INET6 2528c068736aSJeffrey Hsu int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0; 2529c068736aSJeffrey Hsu size_t min_protoh = isipv6 ? 2530c068736aSJeffrey Hsu sizeof (struct ip6_hdr) + sizeof (struct tcphdr) : 2531c068736aSJeffrey Hsu sizeof (struct tcpiphdr); 2532c068736aSJeffrey Hsu #else 2533c068736aSJeffrey Hsu const int isipv6 = 0; 2534c068736aSJeffrey Hsu const size_t min_protoh = sizeof (struct tcpiphdr); 2535fb59c426SYoshinobu Inoue #endif 2536df8bae1dSRodney W. Grimes 2537fb59c426SYoshinobu Inoue if (isipv6) 2538be2ac88cSJonathan Lemon rt = tcp_rtlookup6(&inp->inp_inc); 2539fb59c426SYoshinobu Inoue else 2540be2ac88cSJonathan Lemon rt = tcp_rtlookup(&inp->inp_inc); 2541fb59c426SYoshinobu Inoue if (rt == NULL) { 2542fb59c426SYoshinobu Inoue tp->t_maxopd = tp->t_maxseg = 2543c068736aSJeffrey Hsu isipv6 ? tcp_v6mssdflt : tcp_mssdflt; 2544a0292f23SGarrett Wollman return; 2545df8bae1dSRodney W. Grimes } 2546df8bae1dSRodney W. Grimes ifp = rt->rt_ifp; 2547df8bae1dSRodney W. Grimes so = inp->inp_socket; 2548df8bae1dSRodney W. Grimes 2549a0292f23SGarrett Wollman taop = rmx_taop(rt->rt_rmx); 2550a0292f23SGarrett Wollman /* 2551a0292f23SGarrett Wollman * Offer == -1 means that we didn't receive SYN yet, 2552a0292f23SGarrett Wollman * use cached value in that case; 2553a0292f23SGarrett Wollman */ 2554a0292f23SGarrett Wollman if (offer == -1) 2555a0292f23SGarrett Wollman offer = taop->tao_mssopt; 2556a0292f23SGarrett Wollman /* 2557a0292f23SGarrett Wollman * Offer == 0 means that there was no MSS on the SYN segment, 2558a0292f23SGarrett Wollman * in this case we use tcp_mssdflt. 2559a0292f23SGarrett Wollman */ 2560a0292f23SGarrett Wollman if (offer == 0) 2561c068736aSJeffrey Hsu offer = isipv6 ? tcp_v6mssdflt : tcp_mssdflt; 2562a0292f23SGarrett Wollman else 2563a0292f23SGarrett Wollman /* 2564a0292f23SGarrett Wollman * Sanity check: make sure that maxopd will be large 2565a0292f23SGarrett Wollman * enough to allow some data on segments even is the 2566a0292f23SGarrett Wollman * all the option space is used (40bytes). Otherwise 2567a0292f23SGarrett Wollman * funny things may happen in tcp_output. 2568a0292f23SGarrett Wollman */ 2569a0292f23SGarrett Wollman offer = max(offer, 64); 2570a0292f23SGarrett Wollman taop->tao_mssopt = offer; 2571a0292f23SGarrett Wollman 2572df8bae1dSRodney W. Grimes /* 2573df8bae1dSRodney W. Grimes * While we're here, check if there's an initial rtt 2574df8bae1dSRodney W. Grimes * or rttvar. Convert from the route-table units 2575df8bae1dSRodney W. Grimes * to scaled multiples of the slow timeout timer. 2576df8bae1dSRodney W. Grimes */ 2577df8bae1dSRodney W. Grimes if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) { 2578df8bae1dSRodney W. Grimes /* 2579a0292f23SGarrett Wollman * XXX the lock bit for RTT indicates that the value 2580df8bae1dSRodney W. Grimes * is also a minimum value; this is subject to time. 2581df8bae1dSRodney W. Grimes */ 2582df8bae1dSRodney W. Grimes if (rt->rt_rmx.rmx_locks & RTV_RTT) 25839b8b58e0SJonathan Lemon tp->t_rttmin = rtt / (RTM_RTTUNIT / hz); 25849b8b58e0SJonathan Lemon tp->t_srtt = rtt / (RTM_RTTUNIT / (hz * TCP_RTT_SCALE)); 25851fcc99b5SMatthew Dillon tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE; 2586dd224982SGarrett Wollman tcpstat.tcps_usedrtt++; 2587dd224982SGarrett Wollman if (rt->rt_rmx.rmx_rttvar) { 2588df8bae1dSRodney W. Grimes tp->t_rttvar = rt->rt_rmx.rmx_rttvar / 25899b8b58e0SJonathan Lemon (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE)); 2590dd224982SGarrett Wollman tcpstat.tcps_usedrttvar++; 2591dd224982SGarrett Wollman } else { 2592df8bae1dSRodney W. Grimes /* default variation is +- 1 rtt */ 2593df8bae1dSRodney W. Grimes tp->t_rttvar = 2594df8bae1dSRodney W. Grimes tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE; 2595dd224982SGarrett Wollman } 2596df8bae1dSRodney W. Grimes TCPT_RANGESET(tp->t_rxtcur, 2597df8bae1dSRodney W. Grimes ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1, 2598df8bae1dSRodney W. Grimes tp->t_rttmin, TCPTV_REXMTMAX); 2599df8bae1dSRodney W. Grimes } 2600df8bae1dSRodney W. Grimes /* 2601df8bae1dSRodney W. Grimes * if there's an mtu associated with the route, use it 2602fb59c426SYoshinobu Inoue * else, use the link mtu. 2603df8bae1dSRodney W. Grimes */ 2604df8bae1dSRodney W. Grimes if (rt->rt_rmx.rmx_mtu) 2605fb59c426SYoshinobu Inoue mss = rt->rt_rmx.rmx_mtu - min_protoh; 2606c068736aSJeffrey Hsu else { 2607fb59c426SYoshinobu Inoue if (isipv6) { 2608c068736aSJeffrey Hsu mss = nd_ifinfo[rt->rt_ifp->if_index].linkmtu - 2609c068736aSJeffrey Hsu min_protoh; 2610fb59c426SYoshinobu Inoue if (!in6_localaddr(&inp->in6p_faddr)) 2611fb59c426SYoshinobu Inoue mss = min(mss, tcp_v6mssdflt); 2612c068736aSJeffrey Hsu } else { 2613c068736aSJeffrey Hsu mss = ifp->if_mtu - min_protoh; 2614a0292f23SGarrett Wollman if (!in_localaddr(inp->inp_faddr)) 2615a0292f23SGarrett Wollman mss = min(mss, tcp_mssdflt); 2616a0292f23SGarrett Wollman } 2617c068736aSJeffrey Hsu } 2618a0292f23SGarrett Wollman mss = min(mss, offer); 2619a0292f23SGarrett Wollman /* 2620a0292f23SGarrett Wollman * maxopd stores the maximum length of data AND options 2621a0292f23SGarrett Wollman * in a segment; maxseg is the amount of data in a normal 2622a0292f23SGarrett Wollman * segment. We need to store this value (maxopd) apart 2623a0292f23SGarrett Wollman * from maxseg, because now every segment carries options 2624a0292f23SGarrett Wollman * and thus we normally have somewhat less data in segments. 2625a0292f23SGarrett Wollman */ 2626a0292f23SGarrett Wollman tp->t_maxopd = mss; 2627a0292f23SGarrett Wollman 2628a0292f23SGarrett Wollman /* 2629a0292f23SGarrett Wollman * In case of T/TCP, origoffer==-1 indicates, that no segments 2630a0292f23SGarrett Wollman * were received yet. In this case we just guess, otherwise 2631a0292f23SGarrett Wollman * we do the same as before T/TCP. 2632a0292f23SGarrett Wollman */ 2633a0292f23SGarrett Wollman if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 2634a0292f23SGarrett Wollman (origoffer == -1 || 2635a0292f23SGarrett Wollman (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)) 2636a0292f23SGarrett Wollman mss -= TCPOLEN_TSTAMP_APPA; 2637a0292f23SGarrett Wollman if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC && 2638a0292f23SGarrett Wollman (origoffer == -1 || 2639a0292f23SGarrett Wollman (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)) 2640a0292f23SGarrett Wollman mss -= TCPOLEN_CC_APPA; 2641a0292f23SGarrett Wollman 2642df8bae1dSRodney W. Grimes #if (MCLBYTES & (MCLBYTES - 1)) == 0 2643df8bae1dSRodney W. Grimes if (mss > MCLBYTES) 2644df8bae1dSRodney W. Grimes mss &= ~(MCLBYTES-1); 2645df8bae1dSRodney W. Grimes #else 2646df8bae1dSRodney W. Grimes if (mss > MCLBYTES) 2647df8bae1dSRodney W. Grimes mss = mss / MCLBYTES * MCLBYTES; 2648df8bae1dSRodney W. Grimes #endif 2649df8bae1dSRodney W. Grimes /* 2650df8bae1dSRodney W. Grimes * If there's a pipesize, change the socket buffer 2651df8bae1dSRodney W. Grimes * to that size. Make the socket buffers an integral 2652df8bae1dSRodney W. Grimes * number of mss units; if the mss is larger than 2653df8bae1dSRodney W. Grimes * the socket buffer, decrease the mss. 2654df8bae1dSRodney W. Grimes */ 2655df8bae1dSRodney W. Grimes #ifdef RTV_SPIPE 2656df8bae1dSRodney W. Grimes if ((bufsize = rt->rt_rmx.rmx_sendpipe) == 0) 2657df8bae1dSRodney W. Grimes #endif 2658df8bae1dSRodney W. Grimes bufsize = so->so_snd.sb_hiwat; 2659df8bae1dSRodney W. Grimes if (bufsize < mss) 2660df8bae1dSRodney W. Grimes mss = bufsize; 2661df8bae1dSRodney W. Grimes else { 2662df8bae1dSRodney W. Grimes bufsize = roundup(bufsize, mss); 2663df8bae1dSRodney W. Grimes if (bufsize > sb_max) 2664df8bae1dSRodney W. Grimes bufsize = sb_max; 266588c39af3SRuslan Ermilov if (bufsize > so->so_snd.sb_hiwat) 2666ecf72308SBrian Feldman (void)sbreserve(&so->so_snd, bufsize, so, NULL); 2667df8bae1dSRodney W. Grimes } 2668df8bae1dSRodney W. Grimes tp->t_maxseg = mss; 2669df8bae1dSRodney W. Grimes 2670df8bae1dSRodney W. Grimes #ifdef RTV_RPIPE 2671df8bae1dSRodney W. Grimes if ((bufsize = rt->rt_rmx.rmx_recvpipe) == 0) 2672df8bae1dSRodney W. Grimes #endif 2673df8bae1dSRodney W. Grimes bufsize = so->so_rcv.sb_hiwat; 2674df8bae1dSRodney W. Grimes if (bufsize > mss) { 2675df8bae1dSRodney W. Grimes bufsize = roundup(bufsize, mss); 2676df8bae1dSRodney W. Grimes if (bufsize > sb_max) 2677df8bae1dSRodney W. Grimes bufsize = sb_max; 267888c39af3SRuslan Ermilov if (bufsize > so->so_rcv.sb_hiwat) 2679ecf72308SBrian Feldman (void)sbreserve(&so->so_rcv, bufsize, so, NULL); 2680df8bae1dSRodney W. Grimes } 26819b8b58e0SJonathan Lemon 2682a0292f23SGarrett Wollman /* 26839b8b58e0SJonathan Lemon * Set the slow-start flight size depending on whether this 26849b8b58e0SJonathan Lemon * is a local network or not. 2685a0292f23SGarrett Wollman */ 2686c068736aSJeffrey Hsu if ((isipv6 && in6_localaddr(&inp->in6p_faddr)) || 2687c068736aSJeffrey Hsu (!isipv6 && in_localaddr(inp->inp_faddr))) 26889b8b58e0SJonathan Lemon tp->snd_cwnd = mss * ss_fltsz_local; 26899b8b58e0SJonathan Lemon else 26909b8b58e0SJonathan Lemon tp->snd_cwnd = mss * ss_fltsz; 2691df8bae1dSRodney W. Grimes 2692df8bae1dSRodney W. Grimes if (rt->rt_rmx.rmx_ssthresh) { 2693df8bae1dSRodney W. Grimes /* 2694df8bae1dSRodney W. Grimes * There's some sort of gateway or interface 2695df8bae1dSRodney W. Grimes * buffer limit on the path. Use this to set 2696df8bae1dSRodney W. Grimes * the slow start threshhold, but set the 2697df8bae1dSRodney W. Grimes * threshold to no less than 2*mss. 2698df8bae1dSRodney W. Grimes */ 2699df8bae1dSRodney W. Grimes tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh); 2700dd224982SGarrett Wollman tcpstat.tcps_usedssthresh++; 2701df8bae1dSRodney W. Grimes } 2702a0292f23SGarrett Wollman } 2703a0292f23SGarrett Wollman 2704a0292f23SGarrett Wollman /* 2705a0292f23SGarrett Wollman * Determine the MSS option to send on an outgoing SYN. 2706a0292f23SGarrett Wollman */ 2707a0292f23SGarrett Wollman int 2708a0292f23SGarrett Wollman tcp_mssopt(tp) 2709a0292f23SGarrett Wollman struct tcpcb *tp; 2710a0292f23SGarrett Wollman { 2711a0292f23SGarrett Wollman struct rtentry *rt; 2712fb59c426SYoshinobu Inoue #ifdef INET6 2713c068736aSJeffrey Hsu int isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0; 2714c068736aSJeffrey Hsu size_t min_protoh = isipv6 ? 2715c068736aSJeffrey Hsu sizeof (struct ip6_hdr) + sizeof (struct tcphdr) : 2716c068736aSJeffrey Hsu sizeof (struct tcpiphdr); 2717c068736aSJeffrey Hsu #else 2718c068736aSJeffrey Hsu const int isipv6 = 0; 2719c068736aSJeffrey Hsu const size_t min_protoh = sizeof (struct tcpiphdr); 2720fb59c426SYoshinobu Inoue #endif 2721a0292f23SGarrett Wollman 2722fb59c426SYoshinobu Inoue if (isipv6) 2723be2ac88cSJonathan Lemon rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc); 2724fb59c426SYoshinobu Inoue else 2725be2ac88cSJonathan Lemon rt = tcp_rtlookup(&tp->t_inpcb->inp_inc); 2726a0292f23SGarrett Wollman if (rt == NULL) 2727c068736aSJeffrey Hsu return (isipv6 ? tcp_v6mssdflt : tcp_mssdflt); 2728a0292f23SGarrett Wollman 2729c068736aSJeffrey Hsu return (rt->rt_ifp->if_mtu - min_protoh); 2730df8bae1dSRodney W. Grimes } 273146f58482SJonathan Lemon 273246f58482SJonathan Lemon 273346f58482SJonathan Lemon /* 2734c068736aSJeffrey Hsu * On a partial ack arrives, force the retransmission of the 2735c068736aSJeffrey Hsu * next unacknowledged segment. Do not clear tp->t_dupacks. 2736c068736aSJeffrey Hsu * By setting snd_nxt to ti_ack, this forces retransmission timer to 2737c068736aSJeffrey Hsu * be started again. 273846f58482SJonathan Lemon */ 2739c068736aSJeffrey Hsu static void 2740c068736aSJeffrey Hsu tcp_newreno_partial_ack(tp, th) 274146f58482SJonathan Lemon struct tcpcb *tp; 274246f58482SJonathan Lemon struct tcphdr *th; 274346f58482SJonathan Lemon { 274446f58482SJonathan Lemon tcp_seq onxt = tp->snd_nxt; 274546f58482SJonathan Lemon u_long ocwnd = tp->snd_cwnd; 274646f58482SJonathan Lemon 274746f58482SJonathan Lemon callout_stop(tp->tt_rexmt); 274846f58482SJonathan Lemon tp->t_rtttime = 0; 274946f58482SJonathan Lemon tp->snd_nxt = th->th_ack; 27506b2a5f92SJayanth Vijayaraghavan /* 2751c068736aSJeffrey Hsu * Set snd_cwnd to one segment beyond acknowledged offset. 2752c068736aSJeffrey Hsu * (tp->snd_una has not yet been updated when this function is called.) 27536b2a5f92SJayanth Vijayaraghavan */ 27546b2a5f92SJayanth Vijayaraghavan tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una); 27556b2a5f92SJayanth Vijayaraghavan (void) tcp_output(tp); 275646f58482SJonathan Lemon tp->snd_cwnd = ocwnd; 275746f58482SJonathan Lemon if (SEQ_GT(onxt, tp->snd_nxt)) 275846f58482SJonathan Lemon tp->snd_nxt = onxt; 275946f58482SJonathan Lemon /* 276046f58482SJonathan Lemon * Partial window deflation. Relies on fact that tp->snd_una 276146f58482SJonathan Lemon * not updated yet. 276246f58482SJonathan Lemon */ 276346f58482SJonathan Lemon tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_maxseg); 276446f58482SJonathan Lemon } 2765