1c398230bSWarner Losh /*- 2e79adb8eSGarrett Wollman * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 3df8bae1dSRodney W. Grimes * The Regents of the University of California. All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 4. Neither the name of the University nor the names of its contributors 14df8bae1dSRodney W. Grimes * may be used to endorse or promote products derived from this software 15df8bae1dSRodney W. Grimes * without specific prior written permission. 16df8bae1dSRodney W. Grimes * 17df8bae1dSRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20df8bae1dSRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27df8bae1dSRodney W. Grimes * SUCH DAMAGE. 28df8bae1dSRodney W. Grimes * 29e79adb8eSGarrett Wollman * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 30c3aac50fSPeter Wemm * $FreeBSD$ 31df8bae1dSRodney W. Grimes */ 32df8bae1dSRodney W. Grimes 33f9e354dfSJulian Elischer #include "opt_ipfw.h" /* for ipfw_fwd */ 341cfd4b53SBruce M Simpson #include "opt_inet.h" 35fb59c426SYoshinobu Inoue #include "opt_inet6.h" 363a2a9f79SYoshinobu Inoue #include "opt_ipsec.h" 37c488362eSRobert Watson #include "opt_mac.h" 380cc12cc5SJoerg Wunsch #include "opt_tcpdebug.h" 39e46cd3d4SDag-Erling Smørgrav #include "opt_tcp_input.h" 406d90faf3SPaul Saab #include "opt_tcp_sack.h" 410cc12cc5SJoerg Wunsch 42df8bae1dSRodney W. Grimes #include <sys/param.h> 4398163b98SPoul-Henning Kamp #include <sys/kernel.h> 44c488362eSRobert Watson #include <sys/mac.h> 45df8bae1dSRodney W. Grimes #include <sys/malloc.h> 46df8bae1dSRodney W. Grimes #include <sys/mbuf.h> 47a29f300eSGarrett Wollman #include <sys/proc.h> /* for proc0 declaration */ 48df8bae1dSRodney W. Grimes #include <sys/protosw.h> 49960ed29cSSeigo Tanimura #include <sys/signalvar.h> 50df8bae1dSRodney W. Grimes #include <sys/socket.h> 51df8bae1dSRodney W. Grimes #include <sys/socketvar.h> 52960ed29cSSeigo Tanimura #include <sys/sysctl.h> 53816a3d83SPoul-Henning Kamp #include <sys/syslog.h> 54960ed29cSSeigo Tanimura #include <sys/systm.h> 55df8bae1dSRodney W. Grimes 56e79adb8eSGarrett Wollman #include <machine/cpu.h> /* before tcp_seq.h, for tcp_random18() */ 57e79adb8eSGarrett Wollman 5812e2e970SAndre Oppermann #include <vm/uma.h> 5912e2e970SAndre Oppermann 60df8bae1dSRodney W. Grimes #include <net/if.h> 61df8bae1dSRodney W. Grimes #include <net/route.h> 62df8bae1dSRodney W. Grimes 63df8bae1dSRodney W. Grimes #include <netinet/in.h> 64960ed29cSSeigo Tanimura #include <netinet/in_pcb.h> 65df8bae1dSRodney W. Grimes #include <netinet/in_systm.h> 66960ed29cSSeigo Tanimura #include <netinet/in_var.h> 67df8bae1dSRodney W. Grimes #include <netinet/ip.h> 68686cdd19SJun-ichiro itojun Hagino #include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */ 69686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp_var.h> /* for ICMP_BANDLIM */ 70df8bae1dSRodney W. Grimes #include <netinet/ip_var.h> 71ef39adf0SAndre Oppermann #include <netinet/ip_options.h> 72686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h> 73686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp6.h> 74686cdd19SJun-ichiro itojun Hagino #include <netinet6/in6_pcb.h> 75960ed29cSSeigo Tanimura #include <netinet6/ip6_var.h> 76960ed29cSSeigo Tanimura #include <netinet6/nd6.h> 77df8bae1dSRodney W. Grimes #include <netinet/tcp.h> 78df8bae1dSRodney W. Grimes #include <netinet/tcp_fsm.h> 79df8bae1dSRodney W. Grimes #include <netinet/tcp_seq.h> 80df8bae1dSRodney W. Grimes #include <netinet/tcp_timer.h> 81df8bae1dSRodney W. Grimes #include <netinet/tcp_var.h> 82fb59c426SYoshinobu Inoue #include <netinet6/tcp6_var.h> 83df8bae1dSRodney W. Grimes #include <netinet/tcpip.h> 84610ee2f9SDavid Greenman #ifdef TCPDEBUG 85df8bae1dSRodney W. Grimes #include <netinet/tcp_debug.h> 86fb59c426SYoshinobu Inoue #endif /* TCPDEBUG */ 87fb59c426SYoshinobu Inoue 88b9234fafSSam Leffler #ifdef FAST_IPSEC 89b9234fafSSam Leffler #include <netipsec/ipsec.h> 90b9234fafSSam Leffler #include <netipsec/ipsec6.h> 91b9234fafSSam Leffler #endif /*FAST_IPSEC*/ 92b9234fafSSam Leffler 93fb59c426SYoshinobu Inoue #ifdef IPSEC 94fb59c426SYoshinobu Inoue #include <netinet6/ipsec.h> 953a2a9f79SYoshinobu Inoue #include <netinet6/ipsec6.h> 96fb59c426SYoshinobu Inoue #include <netkey/key.h> 97fb59c426SYoshinobu Inoue #endif /*IPSEC*/ 98fb59c426SYoshinobu Inoue 99db4f9cc7SJonathan Lemon #include <machine/in_cksum.h> 100db4f9cc7SJonathan Lemon 101c068736aSJeffrey Hsu static const int tcprexmtthresh = 3; 1020312fbe9SPoul-Henning Kamp 1032f96f1f4SGarrett Wollman struct tcpstat tcpstat; 104c73d99b5SRuslan Ermilov SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW, 1053d177f46SBill Fumerola &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)"); 1060312fbe9SPoul-Henning Kamp 107d78a37adSPaul Traina static int log_in_vain = 0; 108816a3d83SPoul-Henning Kamp SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW, 1093d177f46SBill Fumerola &log_in_vain, 0, "Log all incoming TCP connections"); 110816a3d83SPoul-Henning Kamp 11116f7f31fSGeoff Rehmet static int blackhole = 0; 11216f7f31fSGeoff Rehmet SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW, 11316f7f31fSGeoff Rehmet &blackhole, 0, "Do not send RST when dropping refused connections"); 11416f7f31fSGeoff Rehmet 115f498eeeeSDavid Greenman int tcp_delack_enabled = 1; 11684e33c9eSDavid Greenman SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW, 1173d177f46SBill Fumerola &tcp_delack_enabled, 0, 1183d177f46SBill Fumerola "Delay ACK to try and piggyback it onto a data packet"); 119f498eeeeSDavid Greenman 120f8613305SDag-Erling Smørgrav #ifdef TCP_DROP_SYNFIN 121f8613305SDag-Erling Smørgrav static int drop_synfin = 0; 122f8613305SDag-Erling Smørgrav SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW, 123f8613305SDag-Erling Smørgrav &drop_synfin, 0, "Drop TCP packets with SYN+FIN set"); 124f8613305SDag-Erling Smørgrav #endif 125f8613305SDag-Erling Smørgrav 126dba7bc6aSAndre Oppermann static int tcp_do_rfc3042 = 1; 127582a954bSJeffrey Hsu SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_RW, 128582a954bSJeffrey Hsu &tcp_do_rfc3042, 0, "Enable RFC 3042 (Limited Transmit)"); 129582a954bSJeffrey Hsu 130dba7bc6aSAndre Oppermann static int tcp_do_rfc3390 = 1; 131da3a8a1aSJeffrey Hsu SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW, 132da3a8a1aSJeffrey Hsu &tcp_do_rfc3390, 0, 133da3a8a1aSJeffrey Hsu "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)"); 134da3a8a1aSJeffrey Hsu 135a69968eeSMike Silbersack static int tcp_insecure_rst = 0; 136a69968eeSMike Silbersack SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_RW, 137a69968eeSMike Silbersack &tcp_insecure_rst, 0, 138a69968eeSMike Silbersack "Follow the old (insecure) criteria for accepting RST packets."); 139a69968eeSMike Silbersack 14012e2e970SAndre Oppermann SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, 14112e2e970SAndre Oppermann "TCP Segment Reassembly Queue"); 14212e2e970SAndre Oppermann 14312e2e970SAndre Oppermann static int tcp_reass_maxseg = 0; 14412e2e970SAndre Oppermann SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN, 14512e2e970SAndre Oppermann &tcp_reass_maxseg, 0, 14612e2e970SAndre Oppermann "Global maximum number of TCP Segments in Reassembly Queue"); 14712e2e970SAndre Oppermann 14812e2e970SAndre Oppermann int tcp_reass_qsize = 0; 14912e2e970SAndre Oppermann SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, cursegments, CTLFLAG_RD, 15012e2e970SAndre Oppermann &tcp_reass_qsize, 0, 15112e2e970SAndre Oppermann "Global number of TCP Segments currently in Reassembly Queue"); 15212e2e970SAndre Oppermann 15312e2e970SAndre Oppermann static int tcp_reass_maxqlen = 48; 15412e2e970SAndre Oppermann SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxqlen, CTLFLAG_RW, 15512e2e970SAndre Oppermann &tcp_reass_maxqlen, 0, 15612e2e970SAndre Oppermann "Maximum number of TCP Segments per individual Reassembly Queue"); 15712e2e970SAndre Oppermann 15812e2e970SAndre Oppermann static int tcp_reass_overflows = 0; 15912e2e970SAndre Oppermann SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, CTLFLAG_RD, 16012e2e970SAndre Oppermann &tcp_reass_overflows, 0, 16112e2e970SAndre Oppermann "Global number of TCP Segment Reassembly Queue Overflows"); 16212e2e970SAndre Oppermann 16315bd2b43SDavid Greenman struct inpcbhead tcb; 164fb59c426SYoshinobu Inoue #define tcb6 tcb /* for KAME src sync over BSD*'s */ 16515bd2b43SDavid Greenman struct inpcbinfo tcbinfo; 166f76fcf6dSJeffrey Hsu struct mtx *tcbinfo_mtx; 167df8bae1dSRodney W. Grimes 1685a53ca16SPaul Saab static void tcp_dooptions(struct tcpopt *, u_char *, int, int); 1696d90faf3SPaul Saab 1704d77a549SAlfred Perlstein static void tcp_pulloutofband(struct socket *, 1714d77a549SAlfred Perlstein struct tcphdr *, struct mbuf *, int); 1724d77a549SAlfred Perlstein static int tcp_reass(struct tcpcb *, struct tcphdr *, int *, 1734d77a549SAlfred Perlstein struct mbuf *); 1744d77a549SAlfred Perlstein static void tcp_xmit_timer(struct tcpcb *, int); 175c068736aSJeffrey Hsu static void tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *); 176340c35deSJonathan Lemon static int tcp_timewait(struct tcptw *, struct tcpopt *, 177340c35deSJonathan Lemon struct tcphdr *, struct mbuf *, int); 1780312fbe9SPoul-Henning Kamp 179fb59c426SYoshinobu Inoue /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */ 180fb59c426SYoshinobu Inoue #ifdef INET6 181fb59c426SYoshinobu Inoue #define ND6_HINT(tp) \ 182fb59c426SYoshinobu Inoue do { \ 183fb59c426SYoshinobu Inoue if ((tp) && (tp)->t_inpcb && \ 18497d8d152SAndre Oppermann ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0) \ 18597d8d152SAndre Oppermann nd6_nud_hint(NULL, NULL, 0); \ 186fb59c426SYoshinobu Inoue } while (0) 187fb59c426SYoshinobu Inoue #else 188fb59c426SYoshinobu Inoue #define ND6_HINT(tp) 189fb59c426SYoshinobu Inoue #endif 190df8bae1dSRodney W. Grimes 191df8bae1dSRodney W. Grimes /* 192262c1c1aSMatthew Dillon * Indicate whether this ack should be delayed. We can delay the ack if 193262c1c1aSMatthew Dillon * - there is no delayed ack timer in progress and 194262c1c1aSMatthew Dillon * - our last ack wasn't a 0-sized window. We never want to delay 1953bfd6421SJonathan Lemon * the ack that opens up a 0-sized window and 1963bfd6421SJonathan Lemon * - delayed acks are enabled or 1973bfd6421SJonathan Lemon * - this is a half-synchronized T/TCP connection. 198d8c85a26SJonathan Lemon */ 199d8c85a26SJonathan Lemon #define DELAY_ACK(tp) \ 200a14c749fSJonathan Lemon ((!callout_active(tp->tt_delack) && \ 201a14c749fSJonathan Lemon (tp->t_flags & TF_RXWIN0SENT) == 0) && \ 2023bfd6421SJonathan Lemon (tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN))) 203d8c85a26SJonathan Lemon 20412e2e970SAndre Oppermann /* Initialize TCP reassembly queue */ 20512e2e970SAndre Oppermann uma_zone_t tcp_reass_zone; 20612e2e970SAndre Oppermann void 20712e2e970SAndre Oppermann tcp_reass_init() 20812e2e970SAndre Oppermann { 20912e2e970SAndre Oppermann tcp_reass_maxseg = nmbclusters / 16; 21012e2e970SAndre Oppermann TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments", 21112e2e970SAndre Oppermann &tcp_reass_maxseg); 21212e2e970SAndre Oppermann tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent), 21312e2e970SAndre Oppermann NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE); 21412e2e970SAndre Oppermann uma_zone_set_max(tcp_reass_zone, tcp_reass_maxseg); 21512e2e970SAndre Oppermann } 21612e2e970SAndre Oppermann 2170312fbe9SPoul-Henning Kamp static int 218fb59c426SYoshinobu Inoue tcp_reass(tp, th, tlenp, m) 219df8bae1dSRodney W. Grimes register struct tcpcb *tp; 220fb59c426SYoshinobu Inoue register struct tcphdr *th; 221fb59c426SYoshinobu Inoue int *tlenp; 222df8bae1dSRodney W. Grimes struct mbuf *m; 223df8bae1dSRodney W. Grimes { 224fb59c426SYoshinobu Inoue struct tseg_qent *q; 225fb59c426SYoshinobu Inoue struct tseg_qent *p = NULL; 226fb59c426SYoshinobu Inoue struct tseg_qent *nq; 22712e2e970SAndre Oppermann struct tseg_qent *te = NULL; 228df8bae1dSRodney W. Grimes struct socket *so = tp->t_inpcb->inp_socket; 229df8bae1dSRodney W. Grimes int flags; 230df8bae1dSRodney W. Grimes 231de30ea13SRobert Watson INP_LOCK_ASSERT(tp->t_inpcb); 232de30ea13SRobert Watson 233df8bae1dSRodney W. Grimes /* 23412e2e970SAndre Oppermann * XXX: tcp_reass() is rather inefficient with its data structures 23512e2e970SAndre Oppermann * and should be rewritten (see NetBSD for optimizations). While 23612e2e970SAndre Oppermann * doing that it should move to its own file tcp_reass.c. 23712e2e970SAndre Oppermann */ 23812e2e970SAndre Oppermann 23912e2e970SAndre Oppermann /* 240de30ea13SRobert Watson * Call with th==NULL after become established to 241df8bae1dSRodney W. Grimes * force pre-ESTABLISHED data up to user socket. 242df8bae1dSRodney W. Grimes */ 243de30ea13SRobert Watson if (th == NULL) 244df8bae1dSRodney W. Grimes goto present; 245df8bae1dSRodney W. Grimes 24612e2e970SAndre Oppermann /* 24712e2e970SAndre Oppermann * Limit the number of segments in the reassembly queue to prevent 24812e2e970SAndre Oppermann * holding on to too many segments (and thus running out of mbufs). 24912e2e970SAndre Oppermann * Make sure to let the missing segment through which caused this 25012e2e970SAndre Oppermann * queue. Always keep one global queue entry spare to be able to 25112e2e970SAndre Oppermann * process the missing segment. 25212e2e970SAndre Oppermann */ 25312e2e970SAndre Oppermann if (th->th_seq != tp->rcv_nxt && 25412e2e970SAndre Oppermann (tcp_reass_qsize + 1 >= tcp_reass_maxseg || 25512e2e970SAndre Oppermann tp->t_segqlen >= tcp_reass_maxqlen)) { 25612e2e970SAndre Oppermann tcp_reass_overflows++; 25712e2e970SAndre Oppermann tcpstat.tcps_rcvmemdrop++; 25812e2e970SAndre Oppermann m_freem(m); 259e346eeffSPaul Saab *tlenp = 0; 26012e2e970SAndre Oppermann return (0); 26112e2e970SAndre Oppermann } 26212e2e970SAndre Oppermann 26312e2e970SAndre Oppermann /* 26412e2e970SAndre Oppermann * Allocate a new queue entry. If we can't, or hit the zone limit 26512e2e970SAndre Oppermann * just drop the pkt. 26612e2e970SAndre Oppermann */ 26712e2e970SAndre Oppermann te = uma_zalloc(tcp_reass_zone, M_NOWAIT); 268fb59c426SYoshinobu Inoue if (te == NULL) { 269fb59c426SYoshinobu Inoue tcpstat.tcps_rcvmemdrop++; 270fb59c426SYoshinobu Inoue m_freem(m); 271e346eeffSPaul Saab *tlenp = 0; 272fb59c426SYoshinobu Inoue return (0); 273fb59c426SYoshinobu Inoue } 27412e2e970SAndre Oppermann tp->t_segqlen++; 27512e2e970SAndre Oppermann tcp_reass_qsize++; 2766effc713SDoug Rabson 277df8bae1dSRodney W. Grimes /* 278df8bae1dSRodney W. Grimes * Find a segment which begins after this one does. 279df8bae1dSRodney W. Grimes */ 280fb59c426SYoshinobu Inoue LIST_FOREACH(q, &tp->t_segq, tqe_q) { 281fb59c426SYoshinobu Inoue if (SEQ_GT(q->tqe_th->th_seq, th->th_seq)) 282df8bae1dSRodney W. Grimes break; 283fb59c426SYoshinobu Inoue p = q; 284fb59c426SYoshinobu Inoue } 285df8bae1dSRodney W. Grimes 286df8bae1dSRodney W. Grimes /* 287df8bae1dSRodney W. Grimes * If there is a preceding segment, it may provide some of 288df8bae1dSRodney W. Grimes * our data already. If so, drop the data from the incoming 289df8bae1dSRodney W. Grimes * segment. If it provides all of our data, drop us. 290df8bae1dSRodney W. Grimes */ 2916effc713SDoug Rabson if (p != NULL) { 292df8bae1dSRodney W. Grimes register int i; 293df8bae1dSRodney W. Grimes /* conversion to int (in i) handles seq wraparound */ 294fb59c426SYoshinobu Inoue i = p->tqe_th->th_seq + p->tqe_len - th->th_seq; 295df8bae1dSRodney W. Grimes if (i > 0) { 296fb59c426SYoshinobu Inoue if (i >= *tlenp) { 297df8bae1dSRodney W. Grimes tcpstat.tcps_rcvduppack++; 298fb59c426SYoshinobu Inoue tcpstat.tcps_rcvdupbyte += *tlenp; 299df8bae1dSRodney W. Grimes m_freem(m); 30012e2e970SAndre Oppermann uma_zfree(tcp_reass_zone, te); 30112e2e970SAndre Oppermann tp->t_segqlen--; 30212e2e970SAndre Oppermann tcp_reass_qsize--; 303a0292f23SGarrett Wollman /* 304a0292f23SGarrett Wollman * Try to present any queued data 305a0292f23SGarrett Wollman * at the left window edge to the user. 306a0292f23SGarrett Wollman * This is needed after the 3-WHS 307a0292f23SGarrett Wollman * completes. 308a0292f23SGarrett Wollman */ 309a0292f23SGarrett Wollman goto present; /* ??? */ 310df8bae1dSRodney W. Grimes } 311df8bae1dSRodney W. Grimes m_adj(m, i); 312fb59c426SYoshinobu Inoue *tlenp -= i; 313fb59c426SYoshinobu Inoue th->th_seq += i; 314df8bae1dSRodney W. Grimes } 315df8bae1dSRodney W. Grimes } 316df8bae1dSRodney W. Grimes tcpstat.tcps_rcvoopack++; 317fb59c426SYoshinobu Inoue tcpstat.tcps_rcvoobyte += *tlenp; 318df8bae1dSRodney W. Grimes 319df8bae1dSRodney W. Grimes /* 320df8bae1dSRodney W. Grimes * While we overlap succeeding segments trim them or, 321df8bae1dSRodney W. Grimes * if they are completely covered, dequeue them. 322df8bae1dSRodney W. Grimes */ 3236effc713SDoug Rabson while (q) { 324fb59c426SYoshinobu Inoue register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq; 325df8bae1dSRodney W. Grimes if (i <= 0) 326df8bae1dSRodney W. Grimes break; 327fb59c426SYoshinobu Inoue if (i < q->tqe_len) { 328fb59c426SYoshinobu Inoue q->tqe_th->th_seq += i; 329fb59c426SYoshinobu Inoue q->tqe_len -= i; 330fb59c426SYoshinobu Inoue m_adj(q->tqe_m, i); 331df8bae1dSRodney W. Grimes break; 332df8bae1dSRodney W. Grimes } 3336effc713SDoug Rabson 334fb59c426SYoshinobu Inoue nq = LIST_NEXT(q, tqe_q); 335fb59c426SYoshinobu Inoue LIST_REMOVE(q, tqe_q); 336fb59c426SYoshinobu Inoue m_freem(q->tqe_m); 33712e2e970SAndre Oppermann uma_zfree(tcp_reass_zone, q); 33812e2e970SAndre Oppermann tp->t_segqlen--; 33912e2e970SAndre Oppermann tcp_reass_qsize--; 3406effc713SDoug Rabson q = nq; 341df8bae1dSRodney W. Grimes } 342df8bae1dSRodney W. Grimes 343fb59c426SYoshinobu Inoue /* Insert the new segment queue entry into place. */ 344fb59c426SYoshinobu Inoue te->tqe_m = m; 345fb59c426SYoshinobu Inoue te->tqe_th = th; 346fb59c426SYoshinobu Inoue te->tqe_len = *tlenp; 347fb59c426SYoshinobu Inoue 3486effc713SDoug Rabson if (p == NULL) { 349fb59c426SYoshinobu Inoue LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q); 3506effc713SDoug Rabson } else { 351fb59c426SYoshinobu Inoue LIST_INSERT_AFTER(p, te, tqe_q); 3526effc713SDoug Rabson } 353df8bae1dSRodney W. Grimes 354df8bae1dSRodney W. Grimes present: 355df8bae1dSRodney W. Grimes /* 356df8bae1dSRodney W. Grimes * Present data to user, advancing rcv_nxt through 357df8bae1dSRodney W. Grimes * completed sequence space. 358df8bae1dSRodney W. Grimes */ 359a0292f23SGarrett Wollman if (!TCPS_HAVEESTABLISHED(tp->t_state)) 360df8bae1dSRodney W. Grimes return (0); 361fb59c426SYoshinobu Inoue q = LIST_FIRST(&tp->t_segq); 362fb59c426SYoshinobu Inoue if (!q || q->tqe_th->th_seq != tp->rcv_nxt) 363df8bae1dSRodney W. Grimes return (0); 3641e4d7da7SRobert Watson SOCKBUF_LOCK(&so->so_rcv); 365df8bae1dSRodney W. Grimes do { 366fb59c426SYoshinobu Inoue tp->rcv_nxt += q->tqe_len; 367fb59c426SYoshinobu Inoue flags = q->tqe_th->th_flags & TH_FIN; 368fb59c426SYoshinobu Inoue nq = LIST_NEXT(q, tqe_q); 369fb59c426SYoshinobu Inoue LIST_REMOVE(q, tqe_q); 370c0b99ffaSRobert Watson if (so->so_rcv.sb_state & SBS_CANTRCVMORE) 371fb59c426SYoshinobu Inoue m_freem(q->tqe_m); 3724cc20ab1SSeigo Tanimura else 3731e4d7da7SRobert Watson sbappendstream_locked(&so->so_rcv, q->tqe_m); 37412e2e970SAndre Oppermann uma_zfree(tcp_reass_zone, q); 37512e2e970SAndre Oppermann tp->t_segqlen--; 37612e2e970SAndre Oppermann tcp_reass_qsize--; 3776effc713SDoug Rabson q = nq; 378fb59c426SYoshinobu Inoue } while (q && q->tqe_th->th_seq == tp->rcv_nxt); 379fb59c426SYoshinobu Inoue ND6_HINT(tp); 3801e4d7da7SRobert Watson sorwakeup_locked(so); 381df8bae1dSRodney W. Grimes return (flags); 382df8bae1dSRodney W. Grimes } 383df8bae1dSRodney W. Grimes 384df8bae1dSRodney W. Grimes /* 385df8bae1dSRodney W. Grimes * TCP input routine, follows pages 65-76 of the 386df8bae1dSRodney W. Grimes * protocol specification dated September, 1981 very closely. 387df8bae1dSRodney W. Grimes */ 388fb59c426SYoshinobu Inoue #ifdef INET6 389fb59c426SYoshinobu Inoue int 390fb59c426SYoshinobu Inoue tcp6_input(mp, offp, proto) 391fb59c426SYoshinobu Inoue struct mbuf **mp; 392fb59c426SYoshinobu Inoue int *offp, proto; 393fb59c426SYoshinobu Inoue { 394fb59c426SYoshinobu Inoue register struct mbuf *m = *mp; 39533841545SHajimu UMEMOTO struct in6_ifaddr *ia6; 396fb59c426SYoshinobu Inoue 397fb59c426SYoshinobu Inoue IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE); 398fb59c426SYoshinobu Inoue 399fb59c426SYoshinobu Inoue /* 400fb59c426SYoshinobu Inoue * draft-itojun-ipv6-tcp-to-anycast 401fb59c426SYoshinobu Inoue * better place to put this in? 402fb59c426SYoshinobu Inoue */ 40333841545SHajimu UMEMOTO ia6 = ip6_getdstifaddr(m); 40433841545SHajimu UMEMOTO if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) { 405fb59c426SYoshinobu Inoue struct ip6_hdr *ip6; 406fb59c426SYoshinobu Inoue 407fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 408fb59c426SYoshinobu Inoue icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR, 409fb59c426SYoshinobu Inoue (caddr_t)&ip6->ip6_dst - (caddr_t)ip6); 410fb59c426SYoshinobu Inoue return IPPROTO_DONE; 411fb59c426SYoshinobu Inoue } 412fb59c426SYoshinobu Inoue 413f0ffb944SJulian Elischer tcp_input(m, *offp); 414fb59c426SYoshinobu Inoue return IPPROTO_DONE; 415fb59c426SYoshinobu Inoue } 416fb59c426SYoshinobu Inoue #endif 417fb59c426SYoshinobu Inoue 418df8bae1dSRodney W. Grimes void 419f0ffb944SJulian Elischer tcp_input(m, off0) 420df8bae1dSRodney W. Grimes register struct mbuf *m; 421f0ffb944SJulian Elischer int off0; 422df8bae1dSRodney W. Grimes { 423fb59c426SYoshinobu Inoue register struct tcphdr *th; 424fb59c426SYoshinobu Inoue register struct ip *ip = NULL; 425fb59c426SYoshinobu Inoue register struct ipovly *ipov; 426f76fcf6dSJeffrey Hsu register struct inpcb *inp = NULL; 427e79adb8eSGarrett Wollman u_char *optp = NULL; 42826f9a767SRodney W. Grimes int optlen = 0; 429a0194ef1SBruce M Simpson int len, tlen, off; 430fb59c426SYoshinobu Inoue int drop_hdrlen; 431df8bae1dSRodney W. Grimes register struct tcpcb *tp = 0; 432fb59c426SYoshinobu Inoue register int thflags; 43326f9a767SRodney W. Grimes struct socket *so = 0; 434df8bae1dSRodney W. Grimes int todrop, acked, ourfinisacked, needoutput = 0; 435a0292f23SGarrett Wollman u_long tiwin; 436a0292f23SGarrett Wollman struct tcpopt to; /* options in this segment */ 437f76fcf6dSJeffrey Hsu int headlocked = 0; 4389b932e9eSAndre Oppermann #ifdef IPFIREWALL_FORWARD 4399b932e9eSAndre Oppermann struct m_tag *fwd_tag; 4409b932e9eSAndre Oppermann #endif 441c068736aSJeffrey Hsu int rstreason; /* For badport_bandlim accounting purposes */ 442c068736aSJeffrey Hsu 443c068736aSJeffrey Hsu struct ip6_hdr *ip6 = NULL; 444c068736aSJeffrey Hsu #ifdef INET6 445c068736aSJeffrey Hsu int isipv6; 446c068736aSJeffrey Hsu #else 447c068736aSJeffrey Hsu const int isipv6 = 0; 448c068736aSJeffrey Hsu #endif 449f76fcf6dSJeffrey Hsu 450610ee2f9SDavid Greenman #ifdef TCPDEBUG 451c068736aSJeffrey Hsu /* 452c068736aSJeffrey Hsu * The size of tcp_saveipgen must be the size of the max ip header, 453c068736aSJeffrey Hsu * now IPv6. 454c068736aSJeffrey Hsu */ 455410bb1bfSLuigi Rizzo u_char tcp_saveipgen[40]; 456410bb1bfSLuigi Rizzo struct tcphdr tcp_savetcp; 457610ee2f9SDavid Greenman short ostate = 0; 458610ee2f9SDavid Greenman #endif 459c068736aSJeffrey Hsu 460fb59c426SYoshinobu Inoue #ifdef INET6 461fb59c426SYoshinobu Inoue isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0; 462fb59c426SYoshinobu Inoue #endif 463a0292f23SGarrett Wollman bzero((char *)&to, sizeof(to)); 464a0292f23SGarrett Wollman 465df8bae1dSRodney W. Grimes tcpstat.tcps_rcvtotal++; 466fb59c426SYoshinobu Inoue 467fb59c426SYoshinobu Inoue if (isipv6) { 46804d3a452SHajimu UMEMOTO #ifdef INET6 469fb59c426SYoshinobu Inoue /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */ 470fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 471fb59c426SYoshinobu Inoue tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0; 472fb59c426SYoshinobu Inoue if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) { 473fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbadsum++; 474fb59c426SYoshinobu Inoue goto drop; 475fb59c426SYoshinobu Inoue } 476fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip6 + off0); 47733841545SHajimu UMEMOTO 47833841545SHajimu UMEMOTO /* 47933841545SHajimu UMEMOTO * Be proactive about unspecified IPv6 address in source. 48033841545SHajimu UMEMOTO * As we use all-zero to indicate unbounded/unconnected pcb, 48133841545SHajimu UMEMOTO * unspecified IPv6 address can be used to confuse us. 48233841545SHajimu UMEMOTO * 48333841545SHajimu UMEMOTO * Note that packets with unspecified IPv6 destination is 48433841545SHajimu UMEMOTO * already dropped in ip6_input. 48533841545SHajimu UMEMOTO */ 48633841545SHajimu UMEMOTO if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 48733841545SHajimu UMEMOTO /* XXX stat */ 48833841545SHajimu UMEMOTO goto drop; 48933841545SHajimu UMEMOTO } 49004d3a452SHajimu UMEMOTO #else 49104d3a452SHajimu UMEMOTO th = NULL; /* XXX: avoid compiler warning */ 49204d3a452SHajimu UMEMOTO #endif 493c068736aSJeffrey Hsu } else { 494df8bae1dSRodney W. Grimes /* 495df8bae1dSRodney W. Grimes * Get IP and TCP header together in first mbuf. 496df8bae1dSRodney W. Grimes * Note: IP leaves IP header in first mbuf. 497df8bae1dSRodney W. Grimes */ 498fb59c426SYoshinobu Inoue if (off0 > sizeof (struct ip)) { 499df8bae1dSRodney W. Grimes ip_stripoptions(m, (struct mbuf *)0); 500fb59c426SYoshinobu Inoue off0 = sizeof(struct ip); 501fb59c426SYoshinobu Inoue } 502df8bae1dSRodney W. Grimes if (m->m_len < sizeof (struct tcpiphdr)) { 503df8bae1dSRodney W. Grimes if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { 504df8bae1dSRodney W. Grimes tcpstat.tcps_rcvshort++; 505df8bae1dSRodney W. Grimes return; 506df8bae1dSRodney W. Grimes } 507df8bae1dSRodney W. Grimes } 508fb59c426SYoshinobu Inoue ip = mtod(m, struct ip *); 509fb59c426SYoshinobu Inoue ipov = (struct ipovly *)ip; 510db4f9cc7SJonathan Lemon th = (struct tcphdr *)((caddr_t)ip + off0); 511db4f9cc7SJonathan Lemon tlen = ip->ip_len; 512df8bae1dSRodney W. Grimes 513db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) { 514db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) 515db4f9cc7SJonathan Lemon th->th_sum = m->m_pkthdr.csum_data; 516db4f9cc7SJonathan Lemon else 517db4f9cc7SJonathan Lemon th->th_sum = in_pseudo(ip->ip_src.s_addr, 518c068736aSJeffrey Hsu ip->ip_dst.s_addr, 519c068736aSJeffrey Hsu htonl(m->m_pkthdr.csum_data + 520c068736aSJeffrey Hsu ip->ip_len + 521c068736aSJeffrey Hsu IPPROTO_TCP)); 522db4f9cc7SJonathan Lemon th->th_sum ^= 0xffff; 5233c653157SHartmut Brandt #ifdef TCPDEBUG 5243c653157SHartmut Brandt ipov->ih_len = (u_short)tlen; 5253c653157SHartmut Brandt ipov->ih_len = htons(ipov->ih_len); 5263c653157SHartmut Brandt #endif 527db4f9cc7SJonathan Lemon } else { 528df8bae1dSRodney W. Grimes /* 529df8bae1dSRodney W. Grimes * Checksum extended TCP header and data. 530df8bae1dSRodney W. Grimes */ 531df8bae1dSRodney W. Grimes len = sizeof (struct ip) + tlen; 532fb59c426SYoshinobu Inoue bzero(ipov->ih_x1, sizeof(ipov->ih_x1)); 533fb59c426SYoshinobu Inoue ipov->ih_len = (u_short)tlen; 534fd8e4ebcSMike Barcroft ipov->ih_len = htons(ipov->ih_len); 535fb59c426SYoshinobu Inoue th->th_sum = in_cksum(m, len); 536db4f9cc7SJonathan Lemon } 537fb59c426SYoshinobu Inoue if (th->th_sum) { 538df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbadsum++; 539df8bae1dSRodney W. Grimes goto drop; 540df8bae1dSRodney W. Grimes } 541fb59c426SYoshinobu Inoue #ifdef INET6 542fb59c426SYoshinobu Inoue /* Re-initialization for later version check */ 543fb59c426SYoshinobu Inoue ip->ip_v = IPVERSION; 544fb59c426SYoshinobu Inoue #endif 545fb59c426SYoshinobu Inoue } 546df8bae1dSRodney W. Grimes 547df8bae1dSRodney W. Grimes /* 548df8bae1dSRodney W. Grimes * Check that TCP offset makes sense, 549df8bae1dSRodney W. Grimes * pull out TCP options and adjust length. XXX 550df8bae1dSRodney W. Grimes */ 551fb59c426SYoshinobu Inoue off = th->th_off << 2; 552df8bae1dSRodney W. Grimes if (off < sizeof (struct tcphdr) || off > tlen) { 553df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbadoff++; 554df8bae1dSRodney W. Grimes goto drop; 555df8bae1dSRodney W. Grimes } 556fb59c426SYoshinobu Inoue tlen -= off; /* tlen is used instead of ti->ti_len */ 557df8bae1dSRodney W. Grimes if (off > sizeof (struct tcphdr)) { 558fb59c426SYoshinobu Inoue if (isipv6) { 55904d3a452SHajimu UMEMOTO #ifdef INET6 560fb59c426SYoshinobu Inoue IP6_EXTHDR_CHECK(m, off0, off, ); 561fb59c426SYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 562fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip6 + off0); 56304d3a452SHajimu UMEMOTO #endif 564c068736aSJeffrey Hsu } else { 565df8bae1dSRodney W. Grimes if (m->m_len < sizeof(struct ip) + off) { 566c068736aSJeffrey Hsu if ((m = m_pullup(m, sizeof (struct ip) + off)) 567c068736aSJeffrey Hsu == 0) { 568df8bae1dSRodney W. Grimes tcpstat.tcps_rcvshort++; 569df8bae1dSRodney W. Grimes return; 570df8bae1dSRodney W. Grimes } 571fb59c426SYoshinobu Inoue ip = mtod(m, struct ip *); 572fb59c426SYoshinobu Inoue ipov = (struct ipovly *)ip; 573fb59c426SYoshinobu Inoue th = (struct tcphdr *)((caddr_t)ip + off0); 574fb59c426SYoshinobu Inoue } 575df8bae1dSRodney W. Grimes } 576df8bae1dSRodney W. Grimes optlen = off - sizeof (struct tcphdr); 577fb59c426SYoshinobu Inoue optp = (u_char *)(th + 1); 578df8bae1dSRodney W. Grimes } 579fb59c426SYoshinobu Inoue thflags = th->th_flags; 580df8bae1dSRodney W. Grimes 581e46cd3d4SDag-Erling Smørgrav #ifdef TCP_DROP_SYNFIN 582e46cd3d4SDag-Erling Smørgrav /* 583e46cd3d4SDag-Erling Smørgrav * If the drop_synfin option is enabled, drop all packets with 584e46cd3d4SDag-Erling Smørgrav * both the SYN and FIN bits set. This prevents e.g. nmap from 585e46cd3d4SDag-Erling Smørgrav * identifying the TCP/IP stack. 586e46cd3d4SDag-Erling Smørgrav * 587a589a70eSGarrett Wollman * This is a violation of the TCP specification. 588e46cd3d4SDag-Erling Smørgrav */ 589fb59c426SYoshinobu Inoue if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN)) 590e46cd3d4SDag-Erling Smørgrav goto drop; 591e46cd3d4SDag-Erling Smørgrav #endif 592e46cd3d4SDag-Erling Smørgrav 593df8bae1dSRodney W. Grimes /* 594df8bae1dSRodney W. Grimes * Convert TCP protocol specific fields to host format. 595df8bae1dSRodney W. Grimes */ 596fd8e4ebcSMike Barcroft th->th_seq = ntohl(th->th_seq); 597fd8e4ebcSMike Barcroft th->th_ack = ntohl(th->th_ack); 598fd8e4ebcSMike Barcroft th->th_win = ntohs(th->th_win); 599fd8e4ebcSMike Barcroft th->th_urp = ntohs(th->th_urp); 600df8bae1dSRodney W. Grimes 601df8bae1dSRodney W. Grimes /* 6023bfd6421SJonathan Lemon * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options, 603fb59c426SYoshinobu Inoue * until after ip6_savecontrol() is called and before other functions 604fb59c426SYoshinobu Inoue * which don't want those proto headers. 605fb59c426SYoshinobu Inoue * Because ip6_savecontrol() is going to parse the mbuf to 606fb59c426SYoshinobu Inoue * search for data to be passed up to user-land, it wants mbuf 607fb59c426SYoshinobu Inoue * parameters to be unchanged. 60888ff5695SSUZUKI Shinsuke * XXX: the call of ip6_savecontrol() has been obsoleted based on 60988ff5695SSUZUKI Shinsuke * latest version of the advanced API (20020110). 610755c1f07SAndras Olah */ 611fb59c426SYoshinobu Inoue drop_hdrlen = off0 + off; 612755c1f07SAndras Olah 613755c1f07SAndras Olah /* 614df8bae1dSRodney W. Grimes * Locate pcb for segment. 615df8bae1dSRodney W. Grimes */ 616f76fcf6dSJeffrey Hsu INP_INFO_WLOCK(&tcbinfo); 617f76fcf6dSJeffrey Hsu headlocked = 1; 618df8bae1dSRodney W. Grimes findpcb: 619de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: findpcb: head not locked")); 6209b932e9eSAndre Oppermann #ifdef IPFIREWALL_FORWARD 6219b932e9eSAndre Oppermann /* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */ 6229b932e9eSAndre Oppermann fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 6239b932e9eSAndre Oppermann 6249b932e9eSAndre Oppermann if (fwd_tag != NULL && isipv6 == 0) { /* IPv6 support is not yet */ 6259b932e9eSAndre Oppermann struct sockaddr_in *next_hop; 6269b932e9eSAndre Oppermann 6279b932e9eSAndre Oppermann next_hop = (struct sockaddr_in *)(fwd_tag+1); 628f9e354dfSJulian Elischer /* 6292b25acc1SLuigi Rizzo * Transparently forwarded. Pretend to be the destination. 630f9e354dfSJulian Elischer * already got one like this? 631f9e354dfSJulian Elischer */ 6329b932e9eSAndre Oppermann inp = in_pcblookup_hash(&tcbinfo, 6339b932e9eSAndre Oppermann ip->ip_src, th->th_sport, 634c068736aSJeffrey Hsu ip->ip_dst, th->th_dport, 635c068736aSJeffrey Hsu 0, m->m_pkthdr.rcvif); 636f9e354dfSJulian Elischer if (!inp) { 6379b932e9eSAndre Oppermann /* It's new. Try to find the ambushing socket. */ 638f9e354dfSJulian Elischer inp = in_pcblookup_hash(&tcbinfo, 639fb59c426SYoshinobu Inoue ip->ip_src, th->th_sport, 6402b25acc1SLuigi Rizzo next_hop->sin_addr, 641c068736aSJeffrey Hsu next_hop->sin_port ? 642c068736aSJeffrey Hsu ntohs(next_hop->sin_port) : 643c068736aSJeffrey Hsu th->th_dport, 644c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 645f9e354dfSJulian Elischer } 6469b932e9eSAndre Oppermann /* Remove the tag from the packet. We don't need it anymore. */ 6479b932e9eSAndre Oppermann m_tag_delete(m, fwd_tag); 648c068736aSJeffrey Hsu } else { 6499b932e9eSAndre Oppermann #endif /* IPFIREWALL_FORWARD */ 65004d3a452SHajimu UMEMOTO if (isipv6) { 65104d3a452SHajimu UMEMOTO #ifdef INET6 652c068736aSJeffrey Hsu inp = in6_pcblookup_hash(&tcbinfo, 653c068736aSJeffrey Hsu &ip6->ip6_src, th->th_sport, 654c068736aSJeffrey Hsu &ip6->ip6_dst, th->th_dport, 655c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 65604d3a452SHajimu UMEMOTO #endif 65704d3a452SHajimu UMEMOTO } else 658c068736aSJeffrey Hsu inp = in_pcblookup_hash(&tcbinfo, 659c068736aSJeffrey Hsu ip->ip_src, th->th_sport, 660c068736aSJeffrey Hsu ip->ip_dst, th->th_dport, 661c068736aSJeffrey Hsu 1, m->m_pkthdr.rcvif); 6629b932e9eSAndre Oppermann #ifdef IPFIREWALL_FORWARD 663fb59c426SYoshinobu Inoue } 6649b932e9eSAndre Oppermann #endif /* IPFIREWALL_FORWARD */ 665f9e354dfSJulian Elischer 666da0f4099SHajimu UMEMOTO #if defined(IPSEC) || defined(FAST_IPSEC) 667d420fcdaSBruce M Simpson #ifdef INET6 668da0f4099SHajimu UMEMOTO if (isipv6) { 669da0f4099SHajimu UMEMOTO if (inp != NULL && ipsec6_in_reject(m, inp)) { 670fb59c426SYoshinobu Inoue #ifdef IPSEC 671fb59c426SYoshinobu Inoue ipsec6stat.in_polvio++; 672d420fcdaSBruce M Simpson #endif 673fb59c426SYoshinobu Inoue goto drop; 674fb59c426SYoshinobu Inoue } 675d420fcdaSBruce M Simpson } else 676d420fcdaSBruce M Simpson #endif /* INET6 */ 677d420fcdaSBruce M Simpson if (inp != NULL && ipsec4_in_reject(m, inp)) { 678da0f4099SHajimu UMEMOTO #ifdef IPSEC 679fb59c426SYoshinobu Inoue ipsecstat.in_polvio++; 680d420fcdaSBruce M Simpson #endif 681fb59c426SYoshinobu Inoue goto drop; 682fb59c426SYoshinobu Inoue } 683da0f4099SHajimu UMEMOTO #endif /*IPSEC || FAST_IPSEC*/ 684df8bae1dSRodney W. Grimes 685df8bae1dSRodney W. Grimes /* 686df8bae1dSRodney W. Grimes * If the state is CLOSED (i.e., TCB does not exist) then 687df8bae1dSRodney W. Grimes * all data in the incoming segment is discarded. 688df8bae1dSRodney W. Grimes * If the TCB exists but is in CLOSED state, it is embryonic, 689df8bae1dSRodney W. Grimes * but should either do a listen or a connect soon. 690df8bae1dSRodney W. Grimes */ 691816a3d83SPoul-Henning Kamp if (inp == NULL) { 6922e4e1b4cSGeoff Rehmet if (log_in_vain) { 693fb59c426SYoshinobu Inoue #ifdef INET6 694ded7008aSJuli Mallett char dbuf[INET6_ADDRSTRLEN+2], sbuf[INET6_ADDRSTRLEN+2]; 695c068736aSJeffrey Hsu #else 696fb59c426SYoshinobu Inoue char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"]; 697c068736aSJeffrey Hsu #endif 69875cfc95fSAndrey A. Chernov 699fb59c426SYoshinobu Inoue if (isipv6) { 70004d3a452SHajimu UMEMOTO #ifdef INET6 701ded7008aSJuli Mallett strcpy(dbuf, "["); 702ded7008aSJuli Mallett strcpy(sbuf, "["); 703ded7008aSJuli Mallett strcat(dbuf, ip6_sprintf(&ip6->ip6_dst)); 704ded7008aSJuli Mallett strcat(sbuf, ip6_sprintf(&ip6->ip6_src)); 705ded7008aSJuli Mallett strcat(dbuf, "]"); 706ded7008aSJuli Mallett strcat(sbuf, "]"); 70704d3a452SHajimu UMEMOTO #endif 708c068736aSJeffrey Hsu } else { 709fb59c426SYoshinobu Inoue strcpy(dbuf, inet_ntoa(ip->ip_dst)); 710fb59c426SYoshinobu Inoue strcpy(sbuf, inet_ntoa(ip->ip_src)); 711fb59c426SYoshinobu Inoue } 7122e4e1b4cSGeoff Rehmet switch (log_in_vain) { 7132e4e1b4cSGeoff Rehmet case 1: 71439eb27a4SCrist J. Clark if ((thflags & TH_SYN) == 0) 7152e4e1b4cSGeoff Rehmet break; 716e4d2978dSPoul-Henning Kamp /* FALLTHROUGH */ 7172e4e1b4cSGeoff Rehmet case 2: 7182e4e1b4cSGeoff Rehmet log(LOG_INFO, 719c068736aSJeffrey Hsu "Connection attempt to TCP %s:%d " 72039eb27a4SCrist J. Clark "from %s:%d flags:0x%02x\n", 721fb59c426SYoshinobu Inoue dbuf, ntohs(th->th_dport), sbuf, 722fb59c426SYoshinobu Inoue ntohs(th->th_sport), thflags); 7232e4e1b4cSGeoff Rehmet break; 7242e4e1b4cSGeoff Rehmet default: 7252e4e1b4cSGeoff Rehmet break; 7262e4e1b4cSGeoff Rehmet } 72775cfc95fSAndrey A. Chernov } 7282e4e1b4cSGeoff Rehmet if (blackhole) { 7292e4e1b4cSGeoff Rehmet switch (blackhole) { 730828b7f40SGeoff Rehmet case 1: 731fb59c426SYoshinobu Inoue if (thflags & TH_SYN) 732828b7f40SGeoff Rehmet goto drop; 733828b7f40SGeoff Rehmet break; 734828b7f40SGeoff Rehmet case 2: 735828b7f40SGeoff Rehmet goto drop; 736828b7f40SGeoff Rehmet default: 737828b7f40SGeoff Rehmet goto drop; 7382e4e1b4cSGeoff Rehmet } 739828b7f40SGeoff Rehmet } 740a57815efSBosko Milekic rstreason = BANDLIM_RST_CLOSEDPORT; 741a57815efSBosko Milekic goto dropwithreset; 742816a3d83SPoul-Henning Kamp } 743f76fcf6dSJeffrey Hsu INP_LOCK(inp); 744936cd18dSAndre Oppermann 745936cd18dSAndre Oppermann /* Check the minimum TTL for socket. */ 74634f83c52SGeorge V. Neville-Neil if (inp->inp_ip_minttl != 0) { 74734f83c52SGeorge V. Neville-Neil #ifdef INET6 74834f83c52SGeorge V. Neville-Neil if (isipv6 && inp->inp_ip_minttl > ip6->ip6_hlim) 749936cd18dSAndre Oppermann goto drop; 75002707462SAndre Oppermann else 75134f83c52SGeorge V. Neville-Neil #endif 75234f83c52SGeorge V. Neville-Neil if (inp->inp_ip_minttl > ip->ip_ttl) 75334f83c52SGeorge V. Neville-Neil goto drop; 75434f83c52SGeorge V. Neville-Neil } 755936cd18dSAndre Oppermann 756340c35deSJonathan Lemon if (inp->inp_vflag & INP_TIMEWAIT) { 757340c35deSJonathan Lemon /* 758340c35deSJonathan Lemon * The only option of relevance is TOF_CC, and only if 759340c35deSJonathan Lemon * present in a SYN segment. See tcp_timewait(). 760340c35deSJonathan Lemon */ 761340c35deSJonathan Lemon if (thflags & TH_SYN) 7625a53ca16SPaul Saab tcp_dooptions(&to, optp, optlen, 1); 763340c35deSJonathan Lemon if (tcp_timewait((struct tcptw *)inp->inp_ppcb, 764340c35deSJonathan Lemon &to, th, m, tlen)) 765340c35deSJonathan Lemon goto findpcb; 766340c35deSJonathan Lemon /* 767340c35deSJonathan Lemon * tcp_timewait unlocks inp. 768340c35deSJonathan Lemon */ 769340c35deSJonathan Lemon INP_INFO_WUNLOCK(&tcbinfo); 770340c35deSJonathan Lemon return; 771340c35deSJonathan Lemon } 772df8bae1dSRodney W. Grimes tp = intotcpcb(inp); 77309f81a46SBosko Milekic if (tp == 0) { 774f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 775a57815efSBosko Milekic rstreason = BANDLIM_RST_CLOSEDPORT; 776a57815efSBosko Milekic goto dropwithreset; 77709f81a46SBosko Milekic } 778df8bae1dSRodney W. Grimes if (tp->t_state == TCPS_CLOSED) 779df8bae1dSRodney W. Grimes goto drop; 780df8bae1dSRodney W. Grimes 781df8bae1dSRodney W. Grimes /* Unscale the window into a 32-bit value. */ 782fb59c426SYoshinobu Inoue if ((thflags & TH_SYN) == 0) 783fb59c426SYoshinobu Inoue tiwin = th->th_win << tp->snd_scale; 784df8bae1dSRodney W. Grimes else 785fb59c426SYoshinobu Inoue tiwin = th->th_win; 786fb59c426SYoshinobu Inoue 787c488362eSRobert Watson #ifdef MAC 7881f82efb3SRobert Watson INP_LOCK_ASSERT(inp); 789a557af22SRobert Watson if (mac_check_inpcb_deliver(inp, m)) 790c488362eSRobert Watson goto drop; 791c488362eSRobert Watson #endif 792a557af22SRobert Watson so = inp->inp_socket; 793610ee2f9SDavid Greenman #ifdef TCPDEBUG 794df8bae1dSRodney W. Grimes if (so->so_options & SO_DEBUG) { 795df8bae1dSRodney W. Grimes ostate = tp->t_state; 796fb59c426SYoshinobu Inoue if (isipv6) 797540e8b7eSJeffrey Hsu bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6)); 798fb59c426SYoshinobu Inoue else 799540e8b7eSJeffrey Hsu bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip)); 800fb59c426SYoshinobu Inoue tcp_savetcp = *th; 801df8bae1dSRodney W. Grimes } 802610ee2f9SDavid Greenman #endif 803540e8b7eSJeffrey Hsu if (so->so_options & SO_ACCEPTCONN) { 804540e8b7eSJeffrey Hsu struct in_conninfo inc; 805540e8b7eSJeffrey Hsu 806fb59c426SYoshinobu Inoue #ifdef INET6 807be2ac88cSJonathan Lemon inc.inc_isipv6 = isipv6; 808c068736aSJeffrey Hsu #endif 809be2ac88cSJonathan Lemon if (isipv6) { 810be2ac88cSJonathan Lemon inc.inc6_faddr = ip6->ip6_src; 811be2ac88cSJonathan Lemon inc.inc6_laddr = ip6->ip6_dst; 812c068736aSJeffrey Hsu } else { 813be2ac88cSJonathan Lemon inc.inc_faddr = ip->ip_src; 814be2ac88cSJonathan Lemon inc.inc_laddr = ip->ip_dst; 815be2ac88cSJonathan Lemon } 816be2ac88cSJonathan Lemon inc.inc_fport = th->th_sport; 817be2ac88cSJonathan Lemon inc.inc_lport = th->th_dport; 818be2ac88cSJonathan Lemon 819fb59c426SYoshinobu Inoue /* 820be2ac88cSJonathan Lemon * If the state is LISTEN then ignore segment if it contains 821be2ac88cSJonathan Lemon * a RST. If the segment contains an ACK then it is bad and 822be2ac88cSJonathan Lemon * send a RST. If it does not contain a SYN then it is not 823be2ac88cSJonathan Lemon * interesting; drop it. 824be2ac88cSJonathan Lemon * 825be2ac88cSJonathan Lemon * If the state is SYN_RECEIVED (syncache) and seg contains 826be2ac88cSJonathan Lemon * an ACK, but not for our SYN/ACK, send a RST. If the seg 827be2ac88cSJonathan Lemon * contains a RST, check the sequence number to see if it 828be2ac88cSJonathan Lemon * is a valid reset segment. 829fb59c426SYoshinobu Inoue */ 830fb59c426SYoshinobu Inoue if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 831be2ac88cSJonathan Lemon if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) { 832be2ac88cSJonathan Lemon if (!syncache_expand(&inc, th, &so, m)) { 8334195b4afSPaul Traina /* 834be2ac88cSJonathan Lemon * No syncache entry, or ACK was not 835be2ac88cSJonathan Lemon * for our SYN/ACK. Send a RST. 8364195b4afSPaul Traina */ 837be2ac88cSJonathan Lemon tcpstat.tcps_badsyn++; 838be2ac88cSJonathan Lemon rstreason = BANDLIM_RST_OPENPORT; 839be2ac88cSJonathan Lemon goto dropwithreset; 840be2ac88cSJonathan Lemon } 841f76fcf6dSJeffrey Hsu if (so == NULL) { 842be2ac88cSJonathan Lemon /* 843be2ac88cSJonathan Lemon * Could not complete 3-way handshake, 844be2ac88cSJonathan Lemon * connection is being closed down, and 845be2ac88cSJonathan Lemon * syncache will free mbuf. 846be2ac88cSJonathan Lemon */ 847f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 848f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 849be2ac88cSJonathan Lemon return; 850f76fcf6dSJeffrey Hsu } 851be2ac88cSJonathan Lemon /* 852be2ac88cSJonathan Lemon * Socket is created in state SYN_RECEIVED. 853be2ac88cSJonathan Lemon * Continue processing segment. 854be2ac88cSJonathan Lemon */ 855f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 856be2ac88cSJonathan Lemon inp = sotoinpcb(so); 857f76fcf6dSJeffrey Hsu INP_LOCK(inp); 858be2ac88cSJonathan Lemon tp = intotcpcb(inp); 859be2ac88cSJonathan Lemon /* 860be2ac88cSJonathan Lemon * This is what would have happened in 861e6658b12SRobert Watson * tcp_output() when the SYN,ACK was sent. 862be2ac88cSJonathan Lemon */ 863be2ac88cSJonathan Lemon tp->snd_up = tp->snd_una; 864be2ac88cSJonathan Lemon tp->snd_max = tp->snd_nxt = tp->iss + 1; 865be2ac88cSJonathan Lemon tp->last_ack_sent = tp->rcv_nxt; 866be2ac88cSJonathan Lemon /* 86741446225SJonathan Lemon * RFC1323: The window in SYN & SYN/ACK 86841446225SJonathan Lemon * segments is never scaled. 869be2ac88cSJonathan Lemon */ 870be2ac88cSJonathan Lemon tp->snd_wnd = tiwin; /* unscaled */ 871be2ac88cSJonathan Lemon goto after_listen; 872be2ac88cSJonathan Lemon } 873be2ac88cSJonathan Lemon if (thflags & TH_RST) { 874be2ac88cSJonathan Lemon syncache_chkrst(&inc, th); 875be2ac88cSJonathan Lemon goto drop; 876be2ac88cSJonathan Lemon } 877fb59c426SYoshinobu Inoue if (thflags & TH_ACK) { 878be2ac88cSJonathan Lemon syncache_badack(&inc); 879ebb0cbeaSPaul Traina tcpstat.tcps_badsyn++; 880a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 881a57815efSBosko Milekic goto dropwithreset; 8824195b4afSPaul Traina } 883ebb0cbeaSPaul Traina goto drop; 884ebb0cbeaSPaul Traina } 88533841545SHajimu UMEMOTO 886be2ac88cSJonathan Lemon /* 887be2ac88cSJonathan Lemon * Segment's flags are (SYN) or (SYN|FIN). 888be2ac88cSJonathan Lemon */ 88933841545SHajimu UMEMOTO #ifdef INET6 89033841545SHajimu UMEMOTO /* 89133841545SHajimu UMEMOTO * If deprecated address is forbidden, 89233841545SHajimu UMEMOTO * we do not accept SYN to deprecated interface 89333841545SHajimu UMEMOTO * address to prevent any new inbound connection from 89433841545SHajimu UMEMOTO * getting established. 89533841545SHajimu UMEMOTO * When we do not accept SYN, we send a TCP RST, 89633841545SHajimu UMEMOTO * with deprecated source address (instead of dropping 89733841545SHajimu UMEMOTO * it). We compromise it as it is much better for peer 89833841545SHajimu UMEMOTO * to send a RST, and RST will be the final packet 89933841545SHajimu UMEMOTO * for the exchange. 90033841545SHajimu UMEMOTO * 90133841545SHajimu UMEMOTO * If we do not forbid deprecated addresses, we accept 90233841545SHajimu UMEMOTO * the SYN packet. RFC2462 does not suggest dropping 90333841545SHajimu UMEMOTO * SYN in this case. 90433841545SHajimu UMEMOTO * If we decipher RFC2462 5.5.4, it says like this: 90533841545SHajimu UMEMOTO * 1. use of deprecated addr with existing 90633841545SHajimu UMEMOTO * communication is okay - "SHOULD continue to be 90733841545SHajimu UMEMOTO * used" 90833841545SHajimu UMEMOTO * 2. use of it with new communication: 90933841545SHajimu UMEMOTO * (2a) "SHOULD NOT be used if alternate address 91033841545SHajimu UMEMOTO * with sufficient scope is available" 91133841545SHajimu UMEMOTO * (2b) nothing mentioned otherwise. 91233841545SHajimu UMEMOTO * Here we fall into (2b) case as we have no choice in 91333841545SHajimu UMEMOTO * our source address selection - we must obey the peer. 91433841545SHajimu UMEMOTO * 91533841545SHajimu UMEMOTO * The wording in RFC2462 is confusing, and there are 91633841545SHajimu UMEMOTO * multiple description text for deprecated address 91733841545SHajimu UMEMOTO * handling - worse, they are not exactly the same. 91833841545SHajimu UMEMOTO * I believe 5.5.4 is the best one, so we follow 5.5.4. 91933841545SHajimu UMEMOTO */ 92033841545SHajimu UMEMOTO if (isipv6 && !ip6_use_deprecated) { 92133841545SHajimu UMEMOTO struct in6_ifaddr *ia6; 92233841545SHajimu UMEMOTO 92333841545SHajimu UMEMOTO if ((ia6 = ip6_getdstifaddr(m)) && 92433841545SHajimu UMEMOTO (ia6->ia6_flags & IN6_IFF_DEPRECATED)) { 925f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 92633841545SHajimu UMEMOTO tp = NULL; 92733841545SHajimu UMEMOTO rstreason = BANDLIM_RST_OPENPORT; 92833841545SHajimu UMEMOTO goto dropwithreset; 92933841545SHajimu UMEMOTO } 93033841545SHajimu UMEMOTO } 93133841545SHajimu UMEMOTO #endif 93265f28919SJesper Skriver /* 933be2ac88cSJonathan Lemon * If it is from this socket, drop it, it must be forged. 934be2ac88cSJonathan Lemon * Don't bother responding if the destination was a broadcast. 93565f28919SJesper Skriver */ 936be2ac88cSJonathan Lemon if (th->th_dport == th->th_sport) { 937fb59c426SYoshinobu Inoue if (isipv6) { 938be2ac88cSJonathan Lemon if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 939be2ac88cSJonathan Lemon &ip6->ip6_src)) 940be2ac88cSJonathan Lemon goto drop; 941c068736aSJeffrey Hsu } else { 942be2ac88cSJonathan Lemon if (ip->ip_dst.s_addr == ip->ip_src.s_addr) 943be2ac88cSJonathan Lemon goto drop; 944be2ac88cSJonathan Lemon } 945c068736aSJeffrey Hsu } 946be2ac88cSJonathan Lemon /* 947be2ac88cSJonathan Lemon * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 9482ca2159fSCrist J. Clark * 94993ec91baSCrist J. Clark * Note that it is quite possible to receive unicast 95093ec91baSCrist J. Clark * link-layer packets with a broadcast IP address. Use 95193ec91baSCrist J. Clark * in_broadcast() to find them. 952be2ac88cSJonathan Lemon */ 953be2ac88cSJonathan Lemon if (m->m_flags & (M_BCAST|M_MCAST)) 954be2ac88cSJonathan Lemon goto drop; 955be2ac88cSJonathan Lemon if (isipv6) { 956be2ac88cSJonathan Lemon if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 957be2ac88cSJonathan Lemon IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) 958be2ac88cSJonathan Lemon goto drop; 959c068736aSJeffrey Hsu } else { 960be2ac88cSJonathan Lemon if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 961be2ac88cSJonathan Lemon IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 9622ca2159fSCrist J. Clark ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || 9632ca2159fSCrist J. Clark in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 964be2ac88cSJonathan Lemon goto drop; 965c068736aSJeffrey Hsu } 966be2ac88cSJonathan Lemon /* 967be2ac88cSJonathan Lemon * SYN appears to be valid; create compressed TCP state 968be2ac88cSJonathan Lemon * for syncache, or perform t/tcp connection. 969be2ac88cSJonathan Lemon */ 970be2ac88cSJonathan Lemon if (so->so_qlen <= so->so_qlimit) { 9713c653157SHartmut Brandt #ifdef TCPDEBUG 9723c653157SHartmut Brandt if (so->so_options & SO_DEBUG) 9733c653157SHartmut Brandt tcp_trace(TA_INPUT, ostate, tp, 9743c653157SHartmut Brandt (void *)tcp_saveipgen, &tcp_savetcp, 0); 9753c653157SHartmut Brandt #endif 9765a53ca16SPaul Saab tcp_dooptions(&to, optp, optlen, 1); 977be2ac88cSJonathan Lemon if (!syncache_add(&inc, &to, th, &so, m)) 978be2ac88cSJonathan Lemon goto drop; 979f76fcf6dSJeffrey Hsu if (so == NULL) { 980be2ac88cSJonathan Lemon /* 981be2ac88cSJonathan Lemon * Entry added to syncache, mbuf used to 982be2ac88cSJonathan Lemon * send SYN,ACK packet. 983be2ac88cSJonathan Lemon */ 984f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 985f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 986f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 987be2ac88cSJonathan Lemon return; 988f76fcf6dSJeffrey Hsu } 989be2ac88cSJonathan Lemon /* 990be2ac88cSJonathan Lemon * Segment passed TAO tests. 991be2ac88cSJonathan Lemon */ 992f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 993be2ac88cSJonathan Lemon inp = sotoinpcb(so); 994f76fcf6dSJeffrey Hsu INP_LOCK(inp); 995df8bae1dSRodney W. Grimes tp = intotcpcb(inp); 996be2ac88cSJonathan Lemon tp->snd_wnd = tiwin; 997be2ac88cSJonathan Lemon tp->t_starttime = ticks; 998be2ac88cSJonathan Lemon tp->t_state = TCPS_ESTABLISHED; 999df8bae1dSRodney W. Grimes 1000be2ac88cSJonathan Lemon /* 10013bfd6421SJonathan Lemon * T/TCP logic: 10023bfd6421SJonathan Lemon * If there is a FIN or if there is data, then 10033bfd6421SJonathan Lemon * delay SYN,ACK(SYN) in the hope of piggy-backing 10043bfd6421SJonathan Lemon * it on a response segment. Otherwise must send 10053bfd6421SJonathan Lemon * ACK now in case the other side is slow starting. 1006be2ac88cSJonathan Lemon */ 10073bfd6421SJonathan Lemon if (thflags & TH_FIN || tlen != 0) 10083bfd6421SJonathan Lemon tp->t_flags |= (TF_DELACK | TF_NEEDSYN); 10093bfd6421SJonathan Lemon else 1010f243998bSJonathan Lemon tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN); 1011be2ac88cSJonathan Lemon tcpstat.tcps_connects++; 1012be2ac88cSJonathan Lemon soisconnected(so); 1013be2ac88cSJonathan Lemon goto trimthenstep6; 1014df8bae1dSRodney W. Grimes } 1015be2ac88cSJonathan Lemon goto drop; 10164cc20ab1SSeigo Tanimura } 1017be2ac88cSJonathan Lemon after_listen: 1018de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: after_listen: head not locked")); 10197cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 1020be2ac88cSJonathan Lemon 1021a65e12b0SRobert Watson /* Syncache takes care of sockets in the listen state. */ 1022a65e12b0SRobert Watson KASSERT(tp->t_state != TCPS_LISTEN, ("tcp_input: TCPS_LISTEN")); 1023df8bae1dSRodney W. Grimes 1024df8bae1dSRodney W. Grimes /* 102553369ac9SAndre Oppermann * This is the second part of the MSS DoS prevention code (after 102653369ac9SAndre Oppermann * minmss on the sending side) and it deals with too many too small 102753369ac9SAndre Oppermann * tcp packets in a too short timeframe (1 second). 102853369ac9SAndre Oppermann * 102953369ac9SAndre Oppermann * For every full second we count the number of received packets 103053369ac9SAndre Oppermann * and bytes. If we get a lot of packets per second for this connection 103153369ac9SAndre Oppermann * (tcp_minmssoverload) we take a closer look at it and compute the 103253369ac9SAndre Oppermann * average packet size for the past second. If that is less than 103353369ac9SAndre Oppermann * tcp_minmss we get too many packets with very small payload which 103453369ac9SAndre Oppermann * is not good and burdens our system (and every packet generates 103553369ac9SAndre Oppermann * a wakeup to the process connected to our socket). We can reasonable 103653369ac9SAndre Oppermann * expect this to be small packet DoS attack to exhaust our CPU 103753369ac9SAndre Oppermann * cycles. 103853369ac9SAndre Oppermann * 103953369ac9SAndre Oppermann * Care has to be taken for the minimum packet overload value. This 104053369ac9SAndre Oppermann * value defines the minimum number of packets per second before we 104153369ac9SAndre Oppermann * start to worry. This must not be too low to avoid killing for 104253369ac9SAndre Oppermann * example interactive connections with many small packets like 104353369ac9SAndre Oppermann * telnet or SSH. 104453369ac9SAndre Oppermann * 104553369ac9SAndre Oppermann * Setting either tcp_minmssoverload or tcp_minmss to "0" disables 104653369ac9SAndre Oppermann * this check. 104753369ac9SAndre Oppermann * 104853369ac9SAndre Oppermann * Account for packet if payload packet, skip over ACK, etc. 104953369ac9SAndre Oppermann */ 105053369ac9SAndre Oppermann if (tcp_minmss && tcp_minmssoverload && 105153369ac9SAndre Oppermann tp->t_state == TCPS_ESTABLISHED && tlen > 0) { 105268d37625SStephan Uphoff if ((unsigned int)(tp->rcv_second - ticks) < hz) { 105353369ac9SAndre Oppermann tp->rcv_pps++; 105453369ac9SAndre Oppermann tp->rcv_byps += tlen + off; 105553369ac9SAndre Oppermann if (tp->rcv_pps > tcp_minmssoverload) { 105653369ac9SAndre Oppermann if ((tp->rcv_byps / tp->rcv_pps) < tcp_minmss) { 105753369ac9SAndre Oppermann printf("too many small tcp packets from " 105853369ac9SAndre Oppermann "%s:%u, av. %lubyte/packet, " 105953369ac9SAndre Oppermann "dropping connection\n", 106053369ac9SAndre Oppermann #ifdef INET6 106153369ac9SAndre Oppermann isipv6 ? 106253369ac9SAndre Oppermann ip6_sprintf(&inp->inp_inc.inc6_faddr) : 106353369ac9SAndre Oppermann #endif 106453369ac9SAndre Oppermann inet_ntoa(inp->inp_inc.inc_faddr), 106553369ac9SAndre Oppermann inp->inp_inc.inc_fport, 106653369ac9SAndre Oppermann tp->rcv_byps / tp->rcv_pps); 10671e2d989dSRobert Watson KASSERT(headlocked, ("tcp_input: " 10681e2d989dSRobert Watson "after_listen: tcp_drop: head " 10691e2d989dSRobert Watson "not locked")); 107053369ac9SAndre Oppermann tp = tcp_drop(tp, ECONNRESET); 107153369ac9SAndre Oppermann tcpstat.tcps_minmssdrops++; 107253369ac9SAndre Oppermann goto drop; 107353369ac9SAndre Oppermann } 107453369ac9SAndre Oppermann } 107553369ac9SAndre Oppermann } else { 107653369ac9SAndre Oppermann tp->rcv_second = ticks + hz; 107753369ac9SAndre Oppermann tp->rcv_pps = 1; 107853369ac9SAndre Oppermann tp->rcv_byps = tlen + off; 107953369ac9SAndre Oppermann } 108053369ac9SAndre Oppermann } 108153369ac9SAndre Oppermann 108253369ac9SAndre Oppermann /* 1083df8bae1dSRodney W. Grimes * Segment received on connection. 1084df8bae1dSRodney W. Grimes * Reset idle time and keep-alive timer. 1085df8bae1dSRodney W. Grimes */ 10869b8b58e0SJonathan Lemon tp->t_rcvtime = ticks; 10877ff19458SPaul Traina if (TCPS_HAVEESTABLISHED(tp->t_state)) 10889b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp); 1089df8bae1dSRodney W. Grimes 1090df8bae1dSRodney W. Grimes /* 109197d8d152SAndre Oppermann * Process options only when we get SYN/ACK back. The SYN case 109297d8d152SAndre Oppermann * for incoming connections is handled in tcp_syncache. 109397d8d152SAndre Oppermann * XXX this is traditional behavior, may need to be cleaned up. 1094df8bae1dSRodney W. Grimes */ 10955a53ca16SPaul Saab tcp_dooptions(&to, optp, optlen, thflags & TH_SYN); 10960a389eabSSimon L. B. Nielsen if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) { 1097be2ac88cSJonathan Lemon if (to.to_flags & TOF_SCALE) { 1098be2ac88cSJonathan Lemon tp->t_flags |= TF_RCVD_SCALE; 1099be2ac88cSJonathan Lemon tp->requested_s_scale = to.to_requested_s_scale; 1100be2ac88cSJonathan Lemon } 1101be2ac88cSJonathan Lemon if (to.to_flags & TOF_TS) { 1102be2ac88cSJonathan Lemon tp->t_flags |= TF_RCVD_TSTMP; 1103be2ac88cSJonathan Lemon tp->ts_recent = to.to_tsval; 1104be2ac88cSJonathan Lemon tp->ts_recent_age = ticks; 1105be2ac88cSJonathan Lemon } 1106be2ac88cSJonathan Lemon if (to.to_flags & TOF_MSS) 1107be2ac88cSJonathan Lemon tcp_mss(tp, to.to_mss); 11086d90faf3SPaul Saab if (tp->sack_enable) { 11096d90faf3SPaul Saab if (!(to.to_flags & TOF_SACK)) 11106d90faf3SPaul Saab tp->sack_enable = 0; 11116d90faf3SPaul Saab else 11126d90faf3SPaul Saab tp->t_flags |= TF_SACK_PERMIT; 11136d90faf3SPaul Saab } 11146d90faf3SPaul Saab 11156d90faf3SPaul Saab } 11166d90faf3SPaul Saab 1117df8bae1dSRodney W. Grimes /* 1118df8bae1dSRodney W. Grimes * Header prediction: check for the two common cases 1119df8bae1dSRodney W. Grimes * of a uni-directional data xfer. If the packet has 1120df8bae1dSRodney W. Grimes * no control flags, is in-sequence, the window didn't 1121df8bae1dSRodney W. Grimes * change and we're not retransmitting, it's a 1122df8bae1dSRodney W. Grimes * candidate. If the length is zero and the ack moved 1123df8bae1dSRodney W. Grimes * forward, we're the sender side of the xfer. Just 1124df8bae1dSRodney W. Grimes * free the data acked & wake any higher level process 1125df8bae1dSRodney W. Grimes * that was blocked waiting for space. If the length 1126df8bae1dSRodney W. Grimes * is non-zero and the ack didn't move, we're the 1127df8bae1dSRodney W. Grimes * receiver side. If we're getting packets in-order 1128df8bae1dSRodney W. Grimes * (the reassembly queue is empty), add the data to 1129df8bae1dSRodney W. Grimes * the socket buffer and note that we need a delayed ack. 1130a0292f23SGarrett Wollman * Make sure that the hidden state-flags are also off. 1131a0292f23SGarrett Wollman * Since we check for TCPS_ESTABLISHED above, it can only 1132a0292f23SGarrett Wollman * be TH_NEEDSYN. 1133df8bae1dSRodney W. Grimes */ 1134df8bae1dSRodney W. Grimes if (tp->t_state == TCPS_ESTABLISHED && 1135fb59c426SYoshinobu Inoue (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 1136a0292f23SGarrett Wollman ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) && 1137be2ac88cSJonathan Lemon ((to.to_flags & TOF_TS) == 0 || 1138a0292f23SGarrett Wollman TSTMP_GEQ(to.to_tsval, tp->ts_recent)) && 1139c94c54e4SAndre Oppermann th->th_seq == tp->rcv_nxt && tiwin && tiwin == tp->snd_wnd && 1140df8bae1dSRodney W. Grimes tp->snd_nxt == tp->snd_max) { 1141df8bae1dSRodney W. Grimes 1142df8bae1dSRodney W. Grimes /* 1143df8bae1dSRodney W. Grimes * If last ACK falls within this segment's sequence numbers, 1144df8bae1dSRodney W. Grimes * record the timestamp. 1145a0292f23SGarrett Wollman * NOTE that the test is modified according to the latest 1146a0292f23SGarrett Wollman * proposal of the tcplw@cray.com list (Braden 1993/04/26). 1147df8bae1dSRodney W. Grimes */ 1148be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && 1149fb59c426SYoshinobu Inoue SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 11509b8b58e0SJonathan Lemon tp->ts_recent_age = ticks; 1151a0292f23SGarrett Wollman tp->ts_recent = to.to_tsval; 1152df8bae1dSRodney W. Grimes } 1153df8bae1dSRodney W. Grimes 1154fb59c426SYoshinobu Inoue if (tlen == 0) { 1155fb59c426SYoshinobu Inoue if (SEQ_GT(th->th_ack, tp->snd_una) && 1156fb59c426SYoshinobu Inoue SEQ_LEQ(th->th_ack, tp->snd_max) && 1157233e8c18SGarrett Wollman tp->snd_cwnd >= tp->snd_wnd && 11586d90faf3SPaul Saab ((!tcp_do_newreno && !tp->sack_enable && 1159cb942153SJeffrey Hsu tp->t_dupacks < tcprexmtthresh) || 11606d90faf3SPaul Saab ((tcp_do_newreno || tp->sack_enable) && 1161482ac968SPaul Saab !IN_FASTRECOVERY(tp) && to.to_nsacks == 0 && 1162482ac968SPaul Saab TAILQ_EMPTY(&tp->snd_holes)))) { 1163f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 1164e0bef1cbSRobert Watson INP_INFO_WUNLOCK(&tcbinfo); 1165e0bef1cbSRobert Watson headlocked = 0; 1166df8bae1dSRodney W. Grimes /* 1167df8bae1dSRodney W. Grimes * this is a pure ack for outstanding data. 1168df8bae1dSRodney W. Grimes */ 1169df8bae1dSRodney W. Grimes ++tcpstat.tcps_predack; 11709b8b58e0SJonathan Lemon /* 11719b8b58e0SJonathan Lemon * "bad retransmit" recovery 11729b8b58e0SJonathan Lemon */ 11739b8b58e0SJonathan Lemon if (tp->t_rxtshift == 1 && 11749b8b58e0SJonathan Lemon ticks < tp->t_badrxtwin) { 1175cb942153SJeffrey Hsu ++tcpstat.tcps_sndrexmitbad; 11769b8b58e0SJonathan Lemon tp->snd_cwnd = tp->snd_cwnd_prev; 11779b8b58e0SJonathan Lemon tp->snd_ssthresh = 11789b8b58e0SJonathan Lemon tp->snd_ssthresh_prev; 11799d11646dSJeffrey Hsu tp->snd_recover = tp->snd_recover_prev; 11809d11646dSJeffrey Hsu if (tp->t_flags & TF_WASFRECOVERY) 11819d11646dSJeffrey Hsu ENTER_FASTRECOVERY(tp); 11829b8b58e0SJonathan Lemon tp->snd_nxt = tp->snd_max; 11839b8b58e0SJonathan Lemon tp->t_badrxtwin = 0; 11849b8b58e0SJonathan Lemon } 1185fa55172bSMatthew Dillon 1186fa55172bSMatthew Dillon /* 1187fa55172bSMatthew Dillon * Recalculate the transmit timer / rtt. 1188fa55172bSMatthew Dillon * 1189fa55172bSMatthew Dillon * Some boxes send broken timestamp replies 1190fa55172bSMatthew Dillon * during the SYN+ACK phase, ignore 1191fa55172bSMatthew Dillon * timestamps of 0 or we could calculate a 1192fa55172bSMatthew Dillon * huge RTT and blow up the retransmit timer. 1193fa55172bSMatthew Dillon */ 1194fa55172bSMatthew Dillon if ((to.to_flags & TOF_TS) != 0 && 1195fa55172bSMatthew Dillon to.to_tsecr) { 1196eaf80179SAndre Oppermann if (!tp->t_rttlow || 1197eaf80179SAndre Oppermann tp->t_rttlow > ticks - to.to_tsecr) 1198eaf80179SAndre Oppermann tp->t_rttlow = ticks - to.to_tsecr; 1199a0292f23SGarrett Wollman tcp_xmit_timer(tp, 12009b8b58e0SJonathan Lemon ticks - to.to_tsecr + 1); 1201fa55172bSMatthew Dillon } else if (tp->t_rtttime && 1202fa55172bSMatthew Dillon SEQ_GT(th->th_ack, tp->t_rtseq)) { 1203eaf80179SAndre Oppermann if (!tp->t_rttlow || 1204eaf80179SAndre Oppermann tp->t_rttlow > ticks - tp->t_rtttime) 1205eaf80179SAndre Oppermann tp->t_rttlow = ticks - tp->t_rtttime; 1206c068736aSJeffrey Hsu tcp_xmit_timer(tp, 1207c068736aSJeffrey Hsu ticks - tp->t_rtttime); 1208fa55172bSMatthew Dillon } 12091fcc99b5SMatthew Dillon tcp_xmit_bandwidth_limit(tp, th->th_ack); 1210fb59c426SYoshinobu Inoue acked = th->th_ack - tp->snd_una; 1211df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackpack++; 1212df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackbyte += acked; 1213df8bae1dSRodney W. Grimes sbdrop(&so->so_snd, acked); 12149d11646dSJeffrey Hsu if (SEQ_GT(tp->snd_una, tp->snd_recover) && 12159d11646dSJeffrey Hsu SEQ_LEQ(th->th_ack, tp->snd_recover)) 12169d11646dSJeffrey Hsu tp->snd_recover = th->th_ack - 1; 12179d11646dSJeffrey Hsu tp->snd_una = th->th_ack; 12181645d090SJeff Roberson /* 12191645d090SJeff Roberson * pull snd_wl2 up to prevent seq wrap relative 12201645d090SJeff Roberson * to th_ack. 12211645d090SJeff Roberson */ 1222cb942153SJeffrey Hsu tp->snd_wl2 = th->th_ack; 1223b5addd85SJeffrey Hsu tp->t_dupacks = 0; 1224df8bae1dSRodney W. Grimes m_freem(m); 1225fb59c426SYoshinobu Inoue ND6_HINT(tp); /* some progress has been done */ 1226df8bae1dSRodney W. Grimes 1227df8bae1dSRodney W. Grimes /* 1228df8bae1dSRodney W. Grimes * If all outstanding data are acked, stop 1229df8bae1dSRodney W. Grimes * retransmit timer, otherwise restart timer 1230df8bae1dSRodney W. Grimes * using current (possibly backed-off) value. 1231df8bae1dSRodney W. Grimes * If process is waiting for space, 1232df8bae1dSRodney W. Grimes * wakeup/selwakeup/signal. If data 1233df8bae1dSRodney W. Grimes * are ready to send, let tcp_output 1234df8bae1dSRodney W. Grimes * decide between more output or persist. 12353c653157SHartmut Brandt 12363c653157SHartmut Brandt #ifdef TCPDEBUG 12373c653157SHartmut Brandt if (so->so_options & SO_DEBUG) 12383c653157SHartmut Brandt tcp_trace(TA_INPUT, ostate, tp, 12393c653157SHartmut Brandt (void *)tcp_saveipgen, 12403c653157SHartmut Brandt &tcp_savetcp, 0); 12413c653157SHartmut Brandt #endif 1242df8bae1dSRodney W. Grimes */ 1243df8bae1dSRodney W. Grimes if (tp->snd_una == tp->snd_max) 12449b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 12459b8b58e0SJonathan Lemon else if (!callout_active(tp->tt_persist)) 12469b8b58e0SJonathan Lemon callout_reset(tp->tt_rexmt, 12479b8b58e0SJonathan Lemon tp->t_rxtcur, 12489b8b58e0SJonathan Lemon tcp_timer_rexmt, tp); 1249df8bae1dSRodney W. Grimes 1250df8bae1dSRodney W. Grimes sowwakeup(so); 1251df8bae1dSRodney W. Grimes if (so->so_snd.sb_cc) 1252df8bae1dSRodney W. Grimes (void) tcp_output(tp); 1253a14c749fSJonathan Lemon goto check_delack; 1254df8bae1dSRodney W. Grimes } 1255fb59c426SYoshinobu Inoue } else if (th->th_ack == tp->snd_una && 1256fb59c426SYoshinobu Inoue LIST_EMPTY(&tp->t_segq) && 1257fb59c426SYoshinobu Inoue tlen <= sbspace(&so->so_rcv)) { 1258f76fcf6dSJeffrey Hsu KASSERT(headlocked, ("headlocked")); 1259e0bef1cbSRobert Watson INP_INFO_WUNLOCK(&tcbinfo); 1260e0bef1cbSRobert Watson headlocked = 0; 1261df8bae1dSRodney W. Grimes /* 1262df8bae1dSRodney W. Grimes * this is a pure, in-sequence data packet 1263df8bae1dSRodney W. Grimes * with nothing on the reassembly queue and 1264df8bae1dSRodney W. Grimes * we have enough buffer space to take it. 1265df8bae1dSRodney W. Grimes */ 12666d90faf3SPaul Saab /* Clean receiver SACK report if present */ 12676d90faf3SPaul Saab if (tp->sack_enable && tp->rcv_numsacks) 12686d90faf3SPaul Saab tcp_clean_sackreport(tp); 1269df8bae1dSRodney W. Grimes ++tcpstat.tcps_preddat; 1270fb59c426SYoshinobu Inoue tp->rcv_nxt += tlen; 12711645d090SJeff Roberson /* 12721645d090SJeff Roberson * Pull snd_wl1 up to prevent seq wrap relative to 12731645d090SJeff Roberson * th_seq. 12741645d090SJeff Roberson */ 12751645d090SJeff Roberson tp->snd_wl1 = th->th_seq; 12761645d090SJeff Roberson /* 12771645d090SJeff Roberson * Pull rcv_up up to prevent seq wrap relative to 12781645d090SJeff Roberson * rcv_nxt. 12791645d090SJeff Roberson */ 12801645d090SJeff Roberson tp->rcv_up = tp->rcv_nxt; 1281df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpack++; 1282fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbyte += tlen; 1283fb59c426SYoshinobu Inoue ND6_HINT(tp); /* some progress has been done */ 1284df8bae1dSRodney W. Grimes /* 12853c653157SHartmut Brandt #ifdef TCPDEBUG 12863c653157SHartmut Brandt if (so->so_options & SO_DEBUG) 12873c653157SHartmut Brandt tcp_trace(TA_INPUT, ostate, tp, 12883c653157SHartmut Brandt (void *)tcp_saveipgen, &tcp_savetcp, 0); 12893c653157SHartmut Brandt #endif 1290755c1f07SAndras Olah * Add data to socket buffer. 1291df8bae1dSRodney W. Grimes */ 12921e4d7da7SRobert Watson SOCKBUF_LOCK(&so->so_rcv); 1293c0b99ffaSRobert Watson if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 1294c1c36a2cSMike Silbersack m_freem(m); 1295c1c36a2cSMike Silbersack } else { 1296fb59c426SYoshinobu Inoue m_adj(m, drop_hdrlen); /* delayed header drop */ 12971e4d7da7SRobert Watson sbappendstream_locked(&so->so_rcv, m); 1298c1c36a2cSMike Silbersack } 12991e4d7da7SRobert Watson sorwakeup_locked(so); 1300d8c85a26SJonathan Lemon if (DELAY_ACK(tp)) { 13013bfd6421SJonathan Lemon tp->t_flags |= TF_DELACK; 1302f498eeeeSDavid Greenman } else { 1303e612a582SDavid Greenman tp->t_flags |= TF_ACKNOW; 1304e612a582SDavid Greenman tcp_output(tp); 1305e612a582SDavid Greenman } 1306a14c749fSJonathan Lemon goto check_delack; 1307df8bae1dSRodney W. Grimes } 1308df8bae1dSRodney W. Grimes } 1309df8bae1dSRodney W. Grimes 1310df8bae1dSRodney W. Grimes /* 1311df8bae1dSRodney W. Grimes * Calculate amount of space in receive window, 1312df8bae1dSRodney W. Grimes * and then do TCP input processing. 1313df8bae1dSRodney W. Grimes * Receive window is amount of space in rcv queue, 1314df8bae1dSRodney W. Grimes * but not less than advertised window. 1315df8bae1dSRodney W. Grimes */ 1316df8bae1dSRodney W. Grimes { int win; 1317df8bae1dSRodney W. Grimes 1318df8bae1dSRodney W. Grimes win = sbspace(&so->so_rcv); 1319df8bae1dSRodney W. Grimes if (win < 0) 1320df8bae1dSRodney W. Grimes win = 0; 132166e39adcSJohn Polstra tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1322df8bae1dSRodney W. Grimes } 1323df8bae1dSRodney W. Grimes 1324df8bae1dSRodney W. Grimes switch (tp->t_state) { 1325df8bae1dSRodney W. Grimes 1326df8bae1dSRodney W. Grimes /* 1327764d8cefSBill Fenner * If the state is SYN_RECEIVED: 1328764d8cefSBill Fenner * if seg contains an ACK, but not for our SYN/ACK, send a RST. 1329764d8cefSBill Fenner */ 1330764d8cefSBill Fenner case TCPS_SYN_RECEIVED: 1331fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 1332fb59c426SYoshinobu Inoue (SEQ_LEQ(th->th_ack, tp->snd_una) || 1333a57815efSBosko Milekic SEQ_GT(th->th_ack, tp->snd_max))) { 1334a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 1335a57815efSBosko Milekic goto dropwithreset; 1336a57815efSBosko Milekic } 1337764d8cefSBill Fenner break; 1338764d8cefSBill Fenner 1339764d8cefSBill Fenner /* 1340df8bae1dSRodney W. Grimes * If the state is SYN_SENT: 1341df8bae1dSRodney W. Grimes * if seg contains an ACK, but not for our SYN, drop the input. 1342df8bae1dSRodney W. Grimes * if seg contains a RST, then drop the connection. 1343df8bae1dSRodney W. Grimes * if seg does not contain SYN, then drop it. 1344df8bae1dSRodney W. Grimes * Otherwise this is an acceptable SYN segment 1345df8bae1dSRodney W. Grimes * initialize tp->rcv_nxt and tp->irs 1346df8bae1dSRodney W. Grimes * if seg contains ack then advance tp->snd_una 1347df8bae1dSRodney W. Grimes * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1348df8bae1dSRodney W. Grimes * arrange for segment to be acked (eventually) 1349df8bae1dSRodney W. Grimes * continue processing rest of data/controls, beginning with URG 1350df8bae1dSRodney W. Grimes */ 1351df8bae1dSRodney W. Grimes case TCPS_SYN_SENT: 1352fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 1353fb59c426SYoshinobu Inoue (SEQ_LEQ(th->th_ack, tp->iss) || 1354fb59c426SYoshinobu Inoue SEQ_GT(th->th_ack, tp->snd_max))) { 1355a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1356a0292f23SGarrett Wollman goto dropwithreset; 1357a0292f23SGarrett Wollman } 1358fb59c426SYoshinobu Inoue if (thflags & TH_RST) { 13591e2d989dSRobert Watson if (thflags & TH_ACK) { 13601e2d989dSRobert Watson KASSERT(headlocked, ("tcp_input: after_listen" 13611e2d989dSRobert Watson ": tcp_drop.2: head not locked")); 1362df8bae1dSRodney W. Grimes tp = tcp_drop(tp, ECONNREFUSED); 13631e2d989dSRobert Watson } 1364df8bae1dSRodney W. Grimes goto drop; 1365df8bae1dSRodney W. Grimes } 1366fb59c426SYoshinobu Inoue if ((thflags & TH_SYN) == 0) 1367df8bae1dSRodney W. Grimes goto drop; 1368fb59c426SYoshinobu Inoue tp->snd_wnd = th->th_win; /* initial send window */ 1369a0292f23SGarrett Wollman 1370fb59c426SYoshinobu Inoue tp->irs = th->th_seq; 1371df8bae1dSRodney W. Grimes tcp_rcvseqinit(tp); 1372fb59c426SYoshinobu Inoue if (thflags & TH_ACK) { 1373845799c1SAndras Olah tcpstat.tcps_connects++; 1374845799c1SAndras Olah soisconnected(so); 1375c488362eSRobert Watson #ifdef MAC 1376310e7cebSRobert Watson SOCK_LOCK(so); 1377c488362eSRobert Watson mac_set_socket_peer_from_mbuf(m, so); 1378310e7cebSRobert Watson SOCK_UNLOCK(so); 1379c488362eSRobert Watson #endif 1380845799c1SAndras Olah /* Do window scaling on this connection? */ 1381845799c1SAndras Olah if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1382845799c1SAndras Olah (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1383845799c1SAndras Olah tp->snd_scale = tp->requested_s_scale; 1384845799c1SAndras Olah tp->rcv_scale = tp->request_r_scale; 1385845799c1SAndras Olah } 1386a0292f23SGarrett Wollman tp->rcv_adv += tp->rcv_wnd; 1387a0292f23SGarrett Wollman tp->snd_una++; /* SYN is acked */ 1388a0292f23SGarrett Wollman /* 1389a0292f23SGarrett Wollman * If there's data, delay ACK; if there's also a FIN 1390a0292f23SGarrett Wollman * ACKNOW will be turned on later. 1391a0292f23SGarrett Wollman */ 1392d8c85a26SJonathan Lemon if (DELAY_ACK(tp) && tlen != 0) 13939b8b58e0SJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 13949b8b58e0SJonathan Lemon tcp_timer_delack, tp); 1395a0292f23SGarrett Wollman else 1396a0292f23SGarrett Wollman tp->t_flags |= TF_ACKNOW; 1397a0292f23SGarrett Wollman /* 1398a0292f23SGarrett Wollman * Received <SYN,ACK> in SYN_SENT[*] state. 1399a0292f23SGarrett Wollman * Transitions: 1400a0292f23SGarrett Wollman * SYN_SENT --> ESTABLISHED 1401a0292f23SGarrett Wollman * SYN_SENT* --> FIN_WAIT_1 1402a0292f23SGarrett Wollman */ 14039b8b58e0SJonathan Lemon tp->t_starttime = ticks; 1404a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDFIN) { 1405a0292f23SGarrett Wollman tp->t_state = TCPS_FIN_WAIT_1; 1406a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDFIN; 1407fb59c426SYoshinobu Inoue thflags &= ~TH_SYN; 14087ff19458SPaul Traina } else { 1409a0292f23SGarrett Wollman tp->t_state = TCPS_ESTABLISHED; 14109b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, 14119b8b58e0SJonathan Lemon tcp_timer_keep, tp); 14127ff19458SPaul Traina } 1413a0292f23SGarrett Wollman } else { 1414a0292f23SGarrett Wollman /* 1415c068736aSJeffrey Hsu * Received initial SYN in SYN-SENT[*] state => 1416c068736aSJeffrey Hsu * simultaneous open. If segment contains CC option 1417c068736aSJeffrey Hsu * and there is a cached CC, apply TAO test. 1418c068736aSJeffrey Hsu * If it succeeds, connection is * half-synchronized. 1419c068736aSJeffrey Hsu * Otherwise, do 3-way handshake: 1420a0292f23SGarrett Wollman * SYN-SENT -> SYN-RECEIVED 1421a0292f23SGarrett Wollman * SYN-SENT* -> SYN-RECEIVED* 1422a0292f23SGarrett Wollman * If there was no CC option, clear cached CC value. 1423a0292f23SGarrett Wollman */ 1424a0292f23SGarrett Wollman tp->t_flags |= TF_ACKNOW; 14259b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 1426df8bae1dSRodney W. Grimes tp->t_state = TCPS_SYN_RECEIVED; 1427a0292f23SGarrett Wollman } 1428df8bae1dSRodney W. Grimes 1429df8bae1dSRodney W. Grimes trimthenstep6: 1430de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: trimthenstep6: head not " 1431de30ea13SRobert Watson "locked")); 14327cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 14337cfc6904SRobert Watson 1434df8bae1dSRodney W. Grimes /* 1435fb59c426SYoshinobu Inoue * Advance th->th_seq to correspond to first data byte. 1436df8bae1dSRodney W. Grimes * If data, trim to stay within window, 1437df8bae1dSRodney W. Grimes * dropping FIN if necessary. 1438df8bae1dSRodney W. Grimes */ 1439fb59c426SYoshinobu Inoue th->th_seq++; 1440fb59c426SYoshinobu Inoue if (tlen > tp->rcv_wnd) { 1441fb59c426SYoshinobu Inoue todrop = tlen - tp->rcv_wnd; 1442df8bae1dSRodney W. Grimes m_adj(m, -todrop); 1443fb59c426SYoshinobu Inoue tlen = tp->rcv_wnd; 1444fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 1445df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpackafterwin++; 1446df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbyteafterwin += todrop; 1447df8bae1dSRodney W. Grimes } 1448fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq - 1; 1449fb59c426SYoshinobu Inoue tp->rcv_up = th->th_seq; 1450a0292f23SGarrett Wollman /* 1451a0292f23SGarrett Wollman * Client side of transaction: already sent SYN and data. 1452a0292f23SGarrett Wollman * If the remote host used T/TCP to validate the SYN, 1453a0292f23SGarrett Wollman * our data will be ACK'd; if so, enter normal data segment 1454a0292f23SGarrett Wollman * processing in the middle of step 5, ack processing. 1455a0292f23SGarrett Wollman * Otherwise, goto step 6. 1456a0292f23SGarrett Wollman */ 1457fb59c426SYoshinobu Inoue if (thflags & TH_ACK) 1458a0292f23SGarrett Wollman goto process_ACK; 1459c068736aSJeffrey Hsu 1460df8bae1dSRodney W. Grimes goto step6; 1461c068736aSJeffrey Hsu 1462a0292f23SGarrett Wollman /* 1463a0292f23SGarrett Wollman * If the state is LAST_ACK or CLOSING or TIME_WAIT: 1464c94c54e4SAndre Oppermann * do normal processing. 1465a0292f23SGarrett Wollman * 1466c94c54e4SAndre Oppermann * NB: Leftover from RFC1644 T/TCP. Cases to be reused later. 1467a0292f23SGarrett Wollman */ 1468a0292f23SGarrett Wollman case TCPS_LAST_ACK: 1469a0292f23SGarrett Wollman case TCPS_CLOSING: 1470a0292f23SGarrett Wollman case TCPS_TIME_WAIT: 1471340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait")); 1472a0292f23SGarrett Wollman break; /* continue normal processing */ 1473df8bae1dSRodney W. Grimes } 1474df8bae1dSRodney W. Grimes 1475df8bae1dSRodney W. Grimes /* 1476df8bae1dSRodney W. Grimes * States other than LISTEN or SYN_SENT. 147780ab7c0eSGarrett Wollman * First check the RST flag and sequence number since reset segments 147880ab7c0eSGarrett Wollman * are exempt from the timestamp and connection count tests. This 147980ab7c0eSGarrett Wollman * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix 148080ab7c0eSGarrett Wollman * below which allowed reset segments in half the sequence space 148180ab7c0eSGarrett Wollman * to fall though and be processed (which gives forged reset 148280ab7c0eSGarrett Wollman * segments with a random sequence number a 50 percent chance of 148380ab7c0eSGarrett Wollman * killing a connection). 148480ab7c0eSGarrett Wollman * Then check timestamp, if present. 1485a0292f23SGarrett Wollman * Then check the connection count, if present. 1486df8bae1dSRodney W. Grimes * Then check that at least some bytes of segment are within 1487df8bae1dSRodney W. Grimes * receive window. If segment begins before rcv_nxt, 1488df8bae1dSRodney W. Grimes * drop leading data (and SYN); if nothing left, just ack. 1489df8bae1dSRodney W. Grimes * 149080ab7c0eSGarrett Wollman * 149180ab7c0eSGarrett Wollman * If the RST bit is set, check the sequence number to see 149280ab7c0eSGarrett Wollman * if this is a valid reset segment. 149380ab7c0eSGarrett Wollman * RFC 793 page 37: 149480ab7c0eSGarrett Wollman * In all states except SYN-SENT, all reset (RST) segments 149580ab7c0eSGarrett Wollman * are validated by checking their SEQ-fields. A reset is 149680ab7c0eSGarrett Wollman * valid if its sequence number is in the window. 149780ab7c0eSGarrett Wollman * Note: this does not take into account delayed ACKs, so 149880ab7c0eSGarrett Wollman * we should test against last_ack_sent instead of rcv_nxt. 14991a244a61SJonathan Lemon * The sequence number in the reset segment is normally an 15001a244a61SJonathan Lemon * echo of our outgoing acknowlegement numbers, but some hosts 15011a244a61SJonathan Lemon * send a reset with the sequence number at the rightmost edge 15021a244a61SJonathan Lemon * of our receive window, and we have to handle this case. 150380dd2a81SMike Silbersack * Note 2: Paul Watson's paper "Slipping in the Window" has shown 150480dd2a81SMike Silbersack * that brute force RST attacks are possible. To combat this, 150580dd2a81SMike Silbersack * we use a much stricter check while in the ESTABLISHED state, 150680dd2a81SMike Silbersack * only accepting RSTs where the sequence number is equal to 150780dd2a81SMike Silbersack * last_ack_sent. In all other states (the states in which a 150880dd2a81SMike Silbersack * RST is more likely), the more permissive check is used. 150980ab7c0eSGarrett Wollman * If we have multiple segments in flight, the intial reset 151080ab7c0eSGarrett Wollman * segment sequence numbers will be to the left of last_ack_sent, 151180ab7c0eSGarrett Wollman * but they will eventually catch up. 151280ab7c0eSGarrett Wollman * In any case, it never made sense to trim reset segments to 151380ab7c0eSGarrett Wollman * fit the receive window since RFC 1122 says: 151480ab7c0eSGarrett Wollman * 4.2.2.12 RST Segment: RFC-793 Section 3.4 151580ab7c0eSGarrett Wollman * 151680ab7c0eSGarrett Wollman * A TCP SHOULD allow a received RST segment to include data. 151780ab7c0eSGarrett Wollman * 151880ab7c0eSGarrett Wollman * DISCUSSION 151980ab7c0eSGarrett Wollman * It has been suggested that a RST segment could contain 152080ab7c0eSGarrett Wollman * ASCII text that encoded and explained the cause of the 152180ab7c0eSGarrett Wollman * RST. No standard has yet been established for such 152280ab7c0eSGarrett Wollman * data. 152380ab7c0eSGarrett Wollman * 152480ab7c0eSGarrett Wollman * If the reset segment passes the sequence number test examine 152580ab7c0eSGarrett Wollman * the state: 152680ab7c0eSGarrett Wollman * SYN_RECEIVED STATE: 152780ab7c0eSGarrett Wollman * If passive open, return to LISTEN state. 152880ab7c0eSGarrett Wollman * If active open, inform user that connection was refused. 1529745bab7fSDima Dorfman * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES: 153080ab7c0eSGarrett Wollman * Inform user that connection was reset, and close tcb. 1531e9bd3a37SJonathan M. Bresler * CLOSING, LAST_ACK STATES: 153280ab7c0eSGarrett Wollman * Close the tcb. 1533e9bd3a37SJonathan M. Bresler * TIME_WAIT STATE: 153480ab7c0eSGarrett Wollman * Drop the segment - see Stevens, vol. 2, p. 964 and 153580ab7c0eSGarrett Wollman * RFC 1337. 153680ab7c0eSGarrett Wollman */ 1537fb59c426SYoshinobu Inoue if (thflags & TH_RST) { 15386a220ed8SMike Silbersack if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) && 15396a220ed8SMike Silbersack SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) || 15406a220ed8SMike Silbersack (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) { 154180ab7c0eSGarrett Wollman switch (tp->t_state) { 154280ab7c0eSGarrett Wollman 154380ab7c0eSGarrett Wollman case TCPS_SYN_RECEIVED: 154480ab7c0eSGarrett Wollman so->so_error = ECONNREFUSED; 154580ab7c0eSGarrett Wollman goto close; 154680ab7c0eSGarrett Wollman 154780ab7c0eSGarrett Wollman case TCPS_ESTABLISHED: 1548a69968eeSMike Silbersack if (tp->last_ack_sent != th->th_seq && 1549a69968eeSMike Silbersack tcp_insecure_rst == 0) { 155080dd2a81SMike Silbersack tcpstat.tcps_badrst++; 155180dd2a81SMike Silbersack goto drop; 155280dd2a81SMike Silbersack } 155380ab7c0eSGarrett Wollman case TCPS_FIN_WAIT_1: 155480ab7c0eSGarrett Wollman case TCPS_FIN_WAIT_2: 155580ab7c0eSGarrett Wollman case TCPS_CLOSE_WAIT: 155680ab7c0eSGarrett Wollman so->so_error = ECONNRESET; 155780ab7c0eSGarrett Wollman close: 155880ab7c0eSGarrett Wollman tp->t_state = TCPS_CLOSED; 155980ab7c0eSGarrett Wollman tcpstat.tcps_drops++; 1560416738a7SRobert Watson KASSERT(headlocked, ("tcp_input: " 1561416738a7SRobert Watson "trimthenstep6: tcp_close: head not " 1562416738a7SRobert Watson "locked")); 156380ab7c0eSGarrett Wollman tp = tcp_close(tp); 156480ab7c0eSGarrett Wollman break; 156580ab7c0eSGarrett Wollman 156680ab7c0eSGarrett Wollman case TCPS_CLOSING: 156780ab7c0eSGarrett Wollman case TCPS_LAST_ACK: 1568416738a7SRobert Watson KASSERT(headlocked, ("trimthenstep6: " 1569416738a7SRobert Watson "tcp_close.2: head not locked")); 157080ab7c0eSGarrett Wollman tp = tcp_close(tp); 157180ab7c0eSGarrett Wollman break; 157280ab7c0eSGarrett Wollman 157380ab7c0eSGarrett Wollman case TCPS_TIME_WAIT: 1574340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, 1575340c35deSJonathan Lemon ("timewait")); 157680ab7c0eSGarrett Wollman break; 157780ab7c0eSGarrett Wollman } 157880ab7c0eSGarrett Wollman } 157980ab7c0eSGarrett Wollman goto drop; 158080ab7c0eSGarrett Wollman } 158180ab7c0eSGarrett Wollman 158280ab7c0eSGarrett Wollman /* 1583df8bae1dSRodney W. Grimes * RFC 1323 PAWS: If we have a timestamp reply on this segment 1584df8bae1dSRodney W. Grimes * and it's less than ts_recent, drop it. 1585df8bae1dSRodney W. Grimes */ 1586be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent && 158780ab7c0eSGarrett Wollman TSTMP_LT(to.to_tsval, tp->ts_recent)) { 1588df8bae1dSRodney W. Grimes 1589df8bae1dSRodney W. Grimes /* Check to see if ts_recent is over 24 days old. */ 15909b8b58e0SJonathan Lemon if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1591df8bae1dSRodney W. Grimes /* 1592df8bae1dSRodney W. Grimes * Invalidate ts_recent. If this segment updates 1593df8bae1dSRodney W. Grimes * ts_recent, the age will be reset later and ts_recent 1594df8bae1dSRodney W. Grimes * will get a valid value. If it does not, setting 1595df8bae1dSRodney W. Grimes * ts_recent to zero will at least satisfy the 1596df8bae1dSRodney W. Grimes * requirement that zero be placed in the timestamp 1597df8bae1dSRodney W. Grimes * echo reply when ts_recent isn't valid. The 1598df8bae1dSRodney W. Grimes * age isn't reset until we get a valid ts_recent 1599df8bae1dSRodney W. Grimes * because we don't want out-of-order segments to be 1600df8bae1dSRodney W. Grimes * dropped when ts_recent is old. 1601df8bae1dSRodney W. Grimes */ 1602df8bae1dSRodney W. Grimes tp->ts_recent = 0; 1603df8bae1dSRodney W. Grimes } else { 1604df8bae1dSRodney W. Grimes tcpstat.tcps_rcvduppack++; 1605fb59c426SYoshinobu Inoue tcpstat.tcps_rcvdupbyte += tlen; 1606df8bae1dSRodney W. Grimes tcpstat.tcps_pawsdrop++; 160707fd333dSMatthew Dillon if (tlen) 1608df8bae1dSRodney W. Grimes goto dropafterack; 16091ab4789dSMatthew Dillon goto drop; 16101ab4789dSMatthew Dillon } 1611df8bae1dSRodney W. Grimes } 1612df8bae1dSRodney W. Grimes 1613a0292f23SGarrett Wollman /* 161480ab7c0eSGarrett Wollman * In the SYN-RECEIVED state, validate that the packet belongs to 161580ab7c0eSGarrett Wollman * this connection before trimming the data to fit the receive 161680ab7c0eSGarrett Wollman * window. Check the sequence number versus IRS since we know 161780ab7c0eSGarrett Wollman * the sequence numbers haven't wrapped. This is a partial fix 161880ab7c0eSGarrett Wollman * for the "LAND" DoS attack. 161980ab7c0eSGarrett Wollman */ 1620a57815efSBosko Milekic if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) { 1621a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 1622a57815efSBosko Milekic goto dropwithreset; 1623a57815efSBosko Milekic } 162480ab7c0eSGarrett Wollman 1625fb59c426SYoshinobu Inoue todrop = tp->rcv_nxt - th->th_seq; 1626df8bae1dSRodney W. Grimes if (todrop > 0) { 1627fb59c426SYoshinobu Inoue if (thflags & TH_SYN) { 1628fb59c426SYoshinobu Inoue thflags &= ~TH_SYN; 1629fb59c426SYoshinobu Inoue th->th_seq++; 1630fb59c426SYoshinobu Inoue if (th->th_urp > 1) 1631fb59c426SYoshinobu Inoue th->th_urp--; 1632df8bae1dSRodney W. Grimes else 1633fb59c426SYoshinobu Inoue thflags &= ~TH_URG; 1634df8bae1dSRodney W. Grimes todrop--; 1635df8bae1dSRodney W. Grimes } 1636df8bae1dSRodney W. Grimes /* 1637dac20301SGarrett Wollman * Following if statement from Stevens, vol. 2, p. 960. 1638df8bae1dSRodney W. Grimes */ 1639fb59c426SYoshinobu Inoue if (todrop > tlen 1640fb59c426SYoshinobu Inoue || (todrop == tlen && (thflags & TH_FIN) == 0)) { 1641dac20301SGarrett Wollman /* 1642dac20301SGarrett Wollman * Any valid FIN must be to the left of the window. 1643dac20301SGarrett Wollman * At this point the FIN must be a duplicate or out 1644dac20301SGarrett Wollman * of sequence; drop it. 1645dac20301SGarrett Wollman */ 1646fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 1647dac20301SGarrett Wollman 1648df8bae1dSRodney W. Grimes /* 1649dac20301SGarrett Wollman * Send an ACK to resynchronize and drop any data. 1650dac20301SGarrett Wollman * But keep on processing for RST or ACK. 1651df8bae1dSRodney W. Grimes */ 1652dac20301SGarrett Wollman tp->t_flags |= TF_ACKNOW; 1653fb59c426SYoshinobu Inoue todrop = tlen; 1654dac20301SGarrett Wollman tcpstat.tcps_rcvduppack++; 1655dac20301SGarrett Wollman tcpstat.tcps_rcvdupbyte += todrop; 1656df8bae1dSRodney W. Grimes } else { 1657df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpartduppack++; 1658df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpartdupbyte += todrop; 1659df8bae1dSRodney W. Grimes } 1660fb59c426SYoshinobu Inoue drop_hdrlen += todrop; /* drop from the top afterwards */ 1661fb59c426SYoshinobu Inoue th->th_seq += todrop; 1662fb59c426SYoshinobu Inoue tlen -= todrop; 1663fb59c426SYoshinobu Inoue if (th->th_urp > todrop) 1664fb59c426SYoshinobu Inoue th->th_urp -= todrop; 1665df8bae1dSRodney W. Grimes else { 1666fb59c426SYoshinobu Inoue thflags &= ~TH_URG; 1667fb59c426SYoshinobu Inoue th->th_urp = 0; 1668df8bae1dSRodney W. Grimes } 1669df8bae1dSRodney W. Grimes } 1670df8bae1dSRodney W. Grimes 1671df8bae1dSRodney W. Grimes /* 1672df8bae1dSRodney W. Grimes * If new data are received on a connection after the 1673df8bae1dSRodney W. Grimes * user processes are gone, then RST the other end. 1674df8bae1dSRodney W. Grimes */ 1675df8bae1dSRodney W. Grimes if ((so->so_state & SS_NOFDREF) && 1676fb59c426SYoshinobu Inoue tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1677416738a7SRobert Watson KASSERT(headlocked, ("trimthenstep6: tcp_close.3: head not " 1678416738a7SRobert Watson "locked")); 1679df8bae1dSRodney W. Grimes tp = tcp_close(tp); 1680df8bae1dSRodney W. Grimes tcpstat.tcps_rcvafterclose++; 1681a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1682df8bae1dSRodney W. Grimes goto dropwithreset; 1683df8bae1dSRodney W. Grimes } 1684df8bae1dSRodney W. Grimes 1685df8bae1dSRodney W. Grimes /* 1686df8bae1dSRodney W. Grimes * If segment ends after window, drop trailing data 1687df8bae1dSRodney W. Grimes * (and PUSH and FIN); if nothing left, just ACK. 1688df8bae1dSRodney W. Grimes */ 1689fb59c426SYoshinobu Inoue todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1690df8bae1dSRodney W. Grimes if (todrop > 0) { 1691df8bae1dSRodney W. Grimes tcpstat.tcps_rcvpackafterwin++; 1692fb59c426SYoshinobu Inoue if (todrop >= tlen) { 1693fb59c426SYoshinobu Inoue tcpstat.tcps_rcvbyteafterwin += tlen; 1694df8bae1dSRodney W. Grimes /* 1695df8bae1dSRodney W. Grimes * If a new connection request is received 1696df8bae1dSRodney W. Grimes * while in TIME_WAIT, drop the old connection 1697df8bae1dSRodney W. Grimes * and start over if the sequence numbers 1698df8bae1dSRodney W. Grimes * are above the previous ones. 1699df8bae1dSRodney W. Grimes */ 1700340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait")); 1701fb59c426SYoshinobu Inoue if (thflags & TH_SYN && 1702df8bae1dSRodney W. Grimes tp->t_state == TCPS_TIME_WAIT && 1703fb59c426SYoshinobu Inoue SEQ_GT(th->th_seq, tp->rcv_nxt)) { 1704416738a7SRobert Watson KASSERT(headlocked, ("trimthenstep6: " 1705416738a7SRobert Watson "tcp_close.4: head not locked")); 1706df8bae1dSRodney W. Grimes tp = tcp_close(tp); 1707df8bae1dSRodney W. Grimes goto findpcb; 1708df8bae1dSRodney W. Grimes } 1709df8bae1dSRodney W. Grimes /* 1710df8bae1dSRodney W. Grimes * If window is closed can only take segments at 1711df8bae1dSRodney W. Grimes * window edge, and have to drop data and PUSH from 1712df8bae1dSRodney W. Grimes * incoming segments. Continue processing, but 1713df8bae1dSRodney W. Grimes * remember to ack. Otherwise, drop segment 1714df8bae1dSRodney W. Grimes * and ack. 1715df8bae1dSRodney W. Grimes */ 1716fb59c426SYoshinobu Inoue if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1717df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 1718df8bae1dSRodney W. Grimes tcpstat.tcps_rcvwinprobe++; 1719df8bae1dSRodney W. Grimes } else 1720df8bae1dSRodney W. Grimes goto dropafterack; 1721df8bae1dSRodney W. Grimes } else 1722df8bae1dSRodney W. Grimes tcpstat.tcps_rcvbyteafterwin += todrop; 1723df8bae1dSRodney W. Grimes m_adj(m, -todrop); 1724fb59c426SYoshinobu Inoue tlen -= todrop; 1725fb59c426SYoshinobu Inoue thflags &= ~(TH_PUSH|TH_FIN); 1726df8bae1dSRodney W. Grimes } 1727df8bae1dSRodney W. Grimes 1728df8bae1dSRodney W. Grimes /* 1729df8bae1dSRodney W. Grimes * If last ACK falls within this segment's sequence numbers, 1730df8bae1dSRodney W. Grimes * record its timestamp. 1731cf09195bSPaul Saab * NOTE: 1732cf09195bSPaul Saab * 1) That the test incorporates suggestions from the latest 1733a0292f23SGarrett Wollman * proposal of the tcplw@cray.com list (Braden 1993/04/26). 1734cf09195bSPaul Saab * 2) That updating only on newer timestamps interferes with 1735cf09195bSPaul Saab * our earlier PAWS tests, so this check should be solely 1736cf09195bSPaul Saab * predicated on the sequence space of this segment. 1737cf09195bSPaul Saab * 3) That we modify the segment boundary check to be 1738cf09195bSPaul Saab * Last.ACK.Sent <= SEG.SEQ + SEG.Len 1739cf09195bSPaul Saab * instead of RFC1323's 1740cf09195bSPaul Saab * Last.ACK.Sent < SEG.SEQ + SEG.Len, 1741cf09195bSPaul Saab * This modified check allows us to overcome RFC1323's 1742cf09195bSPaul Saab * limitations as described in Stevens TCP/IP Illustrated 1743cf09195bSPaul Saab * Vol. 2 p.869. In such cases, we can still calculate the 1744cf09195bSPaul Saab * RTT correctly when RCV.NXT == Last.ACK.Sent. 1745df8bae1dSRodney W. Grimes */ 1746be2ac88cSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && 1747cf09195bSPaul Saab SEQ_LEQ(th->th_seq, tp->last_ack_sent) && 1748cf09195bSPaul Saab SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen + 1749cf09195bSPaul Saab ((thflags & (TH_SYN|TH_FIN)) != 0))) { 17509b8b58e0SJonathan Lemon tp->ts_recent_age = ticks; 1751a0292f23SGarrett Wollman tp->ts_recent = to.to_tsval; 1752df8bae1dSRodney W. Grimes } 1753df8bae1dSRodney W. Grimes 1754df8bae1dSRodney W. Grimes /* 1755df8bae1dSRodney W. Grimes * If a SYN is in the window, then this is an 1756df8bae1dSRodney W. Grimes * error and we send an RST and drop the connection. 1757df8bae1dSRodney W. Grimes */ 1758fb59c426SYoshinobu Inoue if (thflags & TH_SYN) { 17591e2d989dSRobert Watson KASSERT(headlocked, ("tcp_input: tcp_drop: trimthenstep6: " 17601e2d989dSRobert Watson "head not locked")); 1761df8bae1dSRodney W. Grimes tp = tcp_drop(tp, ECONNRESET); 1762a57815efSBosko Milekic rstreason = BANDLIM_UNLIMITED; 1763122aad88SAndre Oppermann goto drop; 1764df8bae1dSRodney W. Grimes } 1765df8bae1dSRodney W. Grimes 1766a0292f23SGarrett Wollman /* 1767a0292f23SGarrett Wollman * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN 1768a0292f23SGarrett Wollman * flag is on (half-synchronized state), then queue data for 1769a0292f23SGarrett Wollman * later processing; else drop segment and return. 1770a0292f23SGarrett Wollman */ 1771fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) == 0) { 1772a0292f23SGarrett Wollman if (tp->t_state == TCPS_SYN_RECEIVED || 1773a0292f23SGarrett Wollman (tp->t_flags & TF_NEEDSYN)) 1774a0292f23SGarrett Wollman goto step6; 1775a0292f23SGarrett Wollman else 1776a0292f23SGarrett Wollman goto drop; 1777a0292f23SGarrett Wollman } 1778df8bae1dSRodney W. Grimes 1779df8bae1dSRodney W. Grimes /* 1780df8bae1dSRodney W. Grimes * Ack processing. 1781df8bae1dSRodney W. Grimes */ 1782df8bae1dSRodney W. Grimes switch (tp->t_state) { 1783df8bae1dSRodney W. Grimes 1784df8bae1dSRodney W. Grimes /* 1785764d8cefSBill Fenner * In SYN_RECEIVED state, the ack ACKs our SYN, so enter 1786764d8cefSBill Fenner * ESTABLISHED state and continue processing. 1787764d8cefSBill Fenner * The ACK was checked above. 1788df8bae1dSRodney W. Grimes */ 1789df8bae1dSRodney W. Grimes case TCPS_SYN_RECEIVED: 1790a0292f23SGarrett Wollman 1791df8bae1dSRodney W. Grimes tcpstat.tcps_connects++; 1792df8bae1dSRodney W. Grimes soisconnected(so); 1793df8bae1dSRodney W. Grimes /* Do window scaling? */ 1794df8bae1dSRodney W. Grimes if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1795df8bae1dSRodney W. Grimes (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1796df8bae1dSRodney W. Grimes tp->snd_scale = tp->requested_s_scale; 1797df8bae1dSRodney W. Grimes tp->rcv_scale = tp->request_r_scale; 1798df8bae1dSRodney W. Grimes } 1799a0292f23SGarrett Wollman /* 1800a0292f23SGarrett Wollman * Make transitions: 1801a0292f23SGarrett Wollman * SYN-RECEIVED -> ESTABLISHED 1802a0292f23SGarrett Wollman * SYN-RECEIVED* -> FIN-WAIT-1 1803a0292f23SGarrett Wollman */ 18049b8b58e0SJonathan Lemon tp->t_starttime = ticks; 1805a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDFIN) { 1806a0292f23SGarrett Wollman tp->t_state = TCPS_FIN_WAIT_1; 1807a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDFIN; 18087ff19458SPaul Traina } else { 1809a0292f23SGarrett Wollman tp->t_state = TCPS_ESTABLISHED; 18109b8b58e0SJonathan Lemon callout_reset(tp->tt_keep, tcp_keepidle, 18119b8b58e0SJonathan Lemon tcp_timer_keep, tp); 18127ff19458SPaul Traina } 1813a0292f23SGarrett Wollman /* 1814a0292f23SGarrett Wollman * If segment contains data or ACK, will call tcp_reass() 1815a0292f23SGarrett Wollman * later; if not, do so now to pass queued data to user. 1816a0292f23SGarrett Wollman */ 1817fb59c426SYoshinobu Inoue if (tlen == 0 && (thflags & TH_FIN) == 0) 1818fb59c426SYoshinobu Inoue (void) tcp_reass(tp, (struct tcphdr *)0, 0, 1819a0292f23SGarrett Wollman (struct mbuf *)0); 1820fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq - 1; 182193b0017fSPhilippe Charnier /* FALLTHROUGH */ 1822df8bae1dSRodney W. Grimes 1823df8bae1dSRodney W. Grimes /* 1824df8bae1dSRodney W. Grimes * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1825df8bae1dSRodney W. Grimes * ACKs. If the ack is in the range 1826fb59c426SYoshinobu Inoue * tp->snd_una < th->th_ack <= tp->snd_max 1827fb59c426SYoshinobu Inoue * then advance tp->snd_una to th->th_ack and drop 1828df8bae1dSRodney W. Grimes * data from the retransmission queue. If this ACK reflects 1829df8bae1dSRodney W. Grimes * more up to date window information we update our window information. 1830df8bae1dSRodney W. Grimes */ 1831df8bae1dSRodney W. Grimes case TCPS_ESTABLISHED: 1832df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 1833df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_2: 1834df8bae1dSRodney W. Grimes case TCPS_CLOSE_WAIT: 1835df8bae1dSRodney W. Grimes case TCPS_CLOSING: 1836df8bae1dSRodney W. Grimes case TCPS_LAST_ACK: 1837df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 1838340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait")); 18395a53ca16SPaul Saab if (SEQ_GT(th->th_ack, tp->snd_max)) { 18405a53ca16SPaul Saab tcpstat.tcps_rcvacktoomuch++; 18415a53ca16SPaul Saab goto dropafterack; 18425a53ca16SPaul Saab } 1843482ac968SPaul Saab if (tp->sack_enable && 1844482ac968SPaul Saab (to.to_nsacks > 0 || !TAILQ_EMPTY(&tp->snd_holes))) 18455a53ca16SPaul Saab tcp_sack_doack(tp, &to, th->th_ack); 1846fb59c426SYoshinobu Inoue if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1847fb59c426SYoshinobu Inoue if (tlen == 0 && tiwin == tp->snd_wnd) { 1848df8bae1dSRodney W. Grimes tcpstat.tcps_rcvdupack++; 1849df8bae1dSRodney W. Grimes /* 1850df8bae1dSRodney W. Grimes * If we have outstanding data (other than 1851df8bae1dSRodney W. Grimes * a window probe), this is a completely 1852df8bae1dSRodney W. Grimes * duplicate ack (ie, window info didn't 1853df8bae1dSRodney W. Grimes * change), the ack is the biggest we've 1854df8bae1dSRodney W. Grimes * seen and we've seen exactly our rexmt 1855df8bae1dSRodney W. Grimes * threshhold of them, assume a packet 1856df8bae1dSRodney W. Grimes * has been dropped and retransmit it. 1857df8bae1dSRodney W. Grimes * Kludge snd_nxt & the congestion 1858df8bae1dSRodney W. Grimes * window so we send only this one 1859df8bae1dSRodney W. Grimes * packet. 1860df8bae1dSRodney W. Grimes * 1861df8bae1dSRodney W. Grimes * We know we're losing at the current 1862df8bae1dSRodney W. Grimes * window size so do congestion avoidance 1863df8bae1dSRodney W. Grimes * (set ssthresh to half the current window 1864df8bae1dSRodney W. Grimes * and pull our congestion window back to 1865df8bae1dSRodney W. Grimes * the new ssthresh). 1866df8bae1dSRodney W. Grimes * 1867df8bae1dSRodney W. Grimes * Dup acks mean that packets have left the 1868df8bae1dSRodney W. Grimes * network (they're now cached at the receiver) 1869df8bae1dSRodney W. Grimes * so bump cwnd by the amount in the receiver 1870df8bae1dSRodney W. Grimes * to keep a constant cwnd packets in the 1871df8bae1dSRodney W. Grimes * network. 1872df8bae1dSRodney W. Grimes */ 18739b8b58e0SJonathan Lemon if (!callout_active(tp->tt_rexmt) || 1874fb59c426SYoshinobu Inoue th->th_ack != tp->snd_una) 1875df8bae1dSRodney W. Grimes tp->t_dupacks = 0; 1876cb942153SJeffrey Hsu else if (++tp->t_dupacks > tcprexmtthresh || 18776d90faf3SPaul Saab ((tcp_do_newreno || tp->sack_enable) && 18789d11646dSJeffrey Hsu IN_FASTRECOVERY(tp))) { 187925e6f9edSPaul Saab if (tp->sack_enable && IN_FASTRECOVERY(tp)) { 1880808f11b7SPaul Saab int awnd; 188125e6f9edSPaul Saab 188225e6f9edSPaul Saab /* 188325e6f9edSPaul Saab * Compute the amount of data in flight first. 188425e6f9edSPaul Saab * We can inject new data into the pipe iff 188525e6f9edSPaul Saab * we have less than 1/2 the original window's 188625e6f9edSPaul Saab * worth of data in flight. 188725e6f9edSPaul Saab */ 1888808f11b7SPaul Saab awnd = (tp->snd_nxt - tp->snd_fack) + 18890077b016SPaul Saab tp->sackhint.sack_bytes_rexmit; 1890808f11b7SPaul Saab if (awnd < tp->snd_ssthresh) { 189125e6f9edSPaul Saab tp->snd_cwnd += tp->t_maxseg; 189225e6f9edSPaul Saab if (tp->snd_cwnd > tp->snd_ssthresh) 189325e6f9edSPaul Saab tp->snd_cwnd = tp->snd_ssthresh; 189425e6f9edSPaul Saab } 189525e6f9edSPaul Saab } else 189646f58482SJonathan Lemon tp->snd_cwnd += tp->t_maxseg; 189746f58482SJonathan Lemon (void) tcp_output(tp); 189846f58482SJonathan Lemon goto drop; 1899cb942153SJeffrey Hsu } else if (tp->t_dupacks == tcprexmtthresh) { 1900cb942153SJeffrey Hsu tcp_seq onxt = tp->snd_nxt; 1901cb942153SJeffrey Hsu u_int win; 1902a0445c2eSJayanth Vijayaraghavan 1903a0445c2eSJayanth Vijayaraghavan /* 1904a0445c2eSJayanth Vijayaraghavan * If we're doing sack, check to 1905a0445c2eSJayanth Vijayaraghavan * see if we're already in sack 1906a0445c2eSJayanth Vijayaraghavan * recovery. If we're not doing sack, 1907a0445c2eSJayanth Vijayaraghavan * check to see if we're in newreno 1908a0445c2eSJayanth Vijayaraghavan * recovery. 1909a0445c2eSJayanth Vijayaraghavan */ 1910a0445c2eSJayanth Vijayaraghavan if (tp->sack_enable) { 1911a0445c2eSJayanth Vijayaraghavan if (IN_FASTRECOVERY(tp)) { 1912a0445c2eSJayanth Vijayaraghavan tp->t_dupacks = 0; 1913a0445c2eSJayanth Vijayaraghavan break; 1914a0445c2eSJayanth Vijayaraghavan } 1915a0445c2eSJayanth Vijayaraghavan } else if (tcp_do_newreno) { 1916a0445c2eSJayanth Vijayaraghavan if (SEQ_LEQ(th->th_ack, 19179d11646dSJeffrey Hsu tp->snd_recover)) { 1918cb942153SJeffrey Hsu tp->t_dupacks = 0; 1919cb942153SJeffrey Hsu break; 192046f58482SJonathan Lemon } 1921a0445c2eSJayanth Vijayaraghavan } 1922cb942153SJeffrey Hsu win = min(tp->snd_wnd, tp->snd_cwnd) / 1923cb942153SJeffrey Hsu 2 / tp->t_maxseg; 1924df8bae1dSRodney W. Grimes if (win < 2) 1925df8bae1dSRodney W. Grimes win = 2; 1926df8bae1dSRodney W. Grimes tp->snd_ssthresh = win * tp->t_maxseg; 19279d11646dSJeffrey Hsu ENTER_FASTRECOVERY(tp); 192846f58482SJonathan Lemon tp->snd_recover = tp->snd_max; 19299b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 19309b8b58e0SJonathan Lemon tp->t_rtttime = 0; 19316d90faf3SPaul Saab if (tp->sack_enable) { 19326d90faf3SPaul Saab tcpstat.tcps_sack_recovery_episode++; 1933a55db2b6SPaul Saab tp->sack_newdata = tp->snd_nxt; 19348db456bfSPaul Saab tp->snd_cwnd = tp->t_maxseg; 19356d90faf3SPaul Saab (void) tcp_output(tp); 19366d90faf3SPaul Saab goto drop; 19376d90faf3SPaul Saab } 1938fb59c426SYoshinobu Inoue tp->snd_nxt = th->th_ack; 1939df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->t_maxseg; 1940df8bae1dSRodney W. Grimes (void) tcp_output(tp); 194148d2549cSJeffrey Hsu KASSERT(tp->snd_limited <= 2, 194248d2549cSJeffrey Hsu ("tp->snd_limited too big")); 1943df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->snd_ssthresh + 194448d2549cSJeffrey Hsu tp->t_maxseg * 194548d2549cSJeffrey Hsu (tp->t_dupacks - tp->snd_limited); 1946df8bae1dSRodney W. Grimes if (SEQ_GT(onxt, tp->snd_nxt)) 1947df8bae1dSRodney W. Grimes tp->snd_nxt = onxt; 1948df8bae1dSRodney W. Grimes goto drop; 1949582a954bSJeffrey Hsu } else if (tcp_do_rfc3042) { 1950582a954bSJeffrey Hsu u_long oldcwnd = tp->snd_cwnd; 195148d2549cSJeffrey Hsu tcp_seq oldsndmax = tp->snd_max; 195248d2549cSJeffrey Hsu u_int sent; 195389c02376SJeffrey Hsu 1954582a954bSJeffrey Hsu KASSERT(tp->t_dupacks == 1 || 1955582a954bSJeffrey Hsu tp->t_dupacks == 2, 1956582a954bSJeffrey Hsu ("dupacks not 1 or 2")); 195761a36e3dSJeffrey Hsu if (tp->t_dupacks == 1) 195848d2549cSJeffrey Hsu tp->snd_limited = 0; 195961a36e3dSJeffrey Hsu tp->snd_cwnd = 196061a36e3dSJeffrey Hsu (tp->snd_nxt - tp->snd_una) + 196161a36e3dSJeffrey Hsu (tp->t_dupacks - tp->snd_limited) * 196261a36e3dSJeffrey Hsu tp->t_maxseg; 1963582a954bSJeffrey Hsu (void) tcp_output(tp); 196448d2549cSJeffrey Hsu sent = tp->snd_max - oldsndmax; 196548d2549cSJeffrey Hsu if (sent > tp->t_maxseg) { 196689c02376SJeffrey Hsu KASSERT((tp->t_dupacks == 2 && 196789c02376SJeffrey Hsu tp->snd_limited == 0) || 196889c02376SJeffrey Hsu (sent == tp->t_maxseg + 1 && 196989c02376SJeffrey Hsu tp->t_flags & TF_SENTFIN), 197048d2549cSJeffrey Hsu ("sent too much")); 197148d2549cSJeffrey Hsu tp->snd_limited = 2; 197248d2549cSJeffrey Hsu } else if (sent > 0) 197348d2549cSJeffrey Hsu ++tp->snd_limited; 1974582a954bSJeffrey Hsu tp->snd_cwnd = oldcwnd; 1975582a954bSJeffrey Hsu goto drop; 1976df8bae1dSRodney W. Grimes } 1977df8bae1dSRodney W. Grimes } else 1978df8bae1dSRodney W. Grimes tp->t_dupacks = 0; 1979df8bae1dSRodney W. Grimes break; 1980df8bae1dSRodney W. Grimes } 1981cb942153SJeffrey Hsu 1982cb942153SJeffrey Hsu KASSERT(SEQ_GT(th->th_ack, tp->snd_una), ("th_ack <= snd_una")); 1983cb942153SJeffrey Hsu 1984df8bae1dSRodney W. Grimes /* 1985df8bae1dSRodney W. Grimes * If the congestion window was inflated to account 1986df8bae1dSRodney W. Grimes * for the other side's cached packets, retract it. 1987df8bae1dSRodney W. Grimes */ 19886d90faf3SPaul Saab if (tcp_do_newreno || tp->sack_enable) { 19899d11646dSJeffrey Hsu if (IN_FASTRECOVERY(tp)) { 1990cb942153SJeffrey Hsu if (SEQ_LT(th->th_ack, tp->snd_recover)) { 19916d90faf3SPaul Saab if (tp->sack_enable) 19926d90faf3SPaul Saab tcp_sack_partialack(tp, th); 19936d90faf3SPaul Saab else 1994c068736aSJeffrey Hsu tcp_newreno_partial_ack(tp, th); 1995c068736aSJeffrey Hsu } else { 1996c068736aSJeffrey Hsu /* 19976d90faf3SPaul Saab * Out of fast recovery. 1998c068736aSJeffrey Hsu * Window inflation should have left us 1999c068736aSJeffrey Hsu * with approximately snd_ssthresh 2000c068736aSJeffrey Hsu * outstanding data. 2001c068736aSJeffrey Hsu * But in case we would be inclined to 2002c068736aSJeffrey Hsu * send a burst, better to do it via 2003c068736aSJeffrey Hsu * the slow start mechanism. 2004c068736aSJeffrey Hsu */ 2005c068736aSJeffrey Hsu if (SEQ_GT(th->th_ack + 2006c068736aSJeffrey Hsu tp->snd_ssthresh, 2007c068736aSJeffrey Hsu tp->snd_max)) 2008c068736aSJeffrey Hsu tp->snd_cwnd = tp->snd_max - 2009c068736aSJeffrey Hsu th->th_ack + 2010c068736aSJeffrey Hsu tp->t_maxseg; 2011c068736aSJeffrey Hsu else 2012c068736aSJeffrey Hsu tp->snd_cwnd = tp->snd_ssthresh; 2013c068736aSJeffrey Hsu } 2014c068736aSJeffrey Hsu } 2015c068736aSJeffrey Hsu } else { 2016233e8c18SGarrett Wollman if (tp->t_dupacks >= tcprexmtthresh && 2017df8bae1dSRodney W. Grimes tp->snd_cwnd > tp->snd_ssthresh) 2018df8bae1dSRodney W. Grimes tp->snd_cwnd = tp->snd_ssthresh; 201946f58482SJonathan Lemon } 2020cb942153SJeffrey Hsu tp->t_dupacks = 0; 2021a0292f23SGarrett Wollman /* 2022a0292f23SGarrett Wollman * If we reach this point, ACK is not a duplicate, 2023a0292f23SGarrett Wollman * i.e., it ACKs something we sent. 2024a0292f23SGarrett Wollman */ 2025a0292f23SGarrett Wollman if (tp->t_flags & TF_NEEDSYN) { 2026a0292f23SGarrett Wollman /* 2027a0292f23SGarrett Wollman * T/TCP: Connection was half-synchronized, and our 2028a0292f23SGarrett Wollman * SYN has been ACK'd (so connection is now fully 202907e43e10SAndras Olah * synchronized). Go to non-starred state, 203007e43e10SAndras Olah * increment snd_una for ACK of SYN, and check if 203107e43e10SAndras Olah * we can do window scaling. 2032a0292f23SGarrett Wollman */ 2033a0292f23SGarrett Wollman tp->t_flags &= ~TF_NEEDSYN; 2034a0292f23SGarrett Wollman tp->snd_una++; 203507e43e10SAndras Olah /* Do window scaling? */ 203607e43e10SAndras Olah if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 203707e43e10SAndras Olah (TF_RCVD_SCALE|TF_REQ_SCALE)) { 203807e43e10SAndras Olah tp->snd_scale = tp->requested_s_scale; 203907e43e10SAndras Olah tp->rcv_scale = tp->request_r_scale; 204007e43e10SAndras Olah } 2041a0292f23SGarrett Wollman } 2042a0292f23SGarrett Wollman 2043a0292f23SGarrett Wollman process_ACK: 2044de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: process_ACK: head not " 2045de30ea13SRobert Watson "locked")); 20467cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 20477cfc6904SRobert Watson 2048fb59c426SYoshinobu Inoue acked = th->th_ack - tp->snd_una; 2049df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackpack++; 2050df8bae1dSRodney W. Grimes tcpstat.tcps_rcvackbyte += acked; 2051df8bae1dSRodney W. Grimes 2052df8bae1dSRodney W. Grimes /* 20539b8b58e0SJonathan Lemon * If we just performed our first retransmit, and the ACK 20549b8b58e0SJonathan Lemon * arrives within our recovery window, then it was a mistake 20559b8b58e0SJonathan Lemon * to do the retransmit in the first place. Recover our 20569b8b58e0SJonathan Lemon * original cwnd and ssthresh, and proceed to transmit where 20579b8b58e0SJonathan Lemon * we left off. 20589b8b58e0SJonathan Lemon */ 20599b8b58e0SJonathan Lemon if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) { 2060d65bf08aSMatthew Dillon ++tcpstat.tcps_sndrexmitbad; 20619b8b58e0SJonathan Lemon tp->snd_cwnd = tp->snd_cwnd_prev; 20629b8b58e0SJonathan Lemon tp->snd_ssthresh = tp->snd_ssthresh_prev; 20639d11646dSJeffrey Hsu tp->snd_recover = tp->snd_recover_prev; 20649d11646dSJeffrey Hsu if (tp->t_flags & TF_WASFRECOVERY) 20659d11646dSJeffrey Hsu ENTER_FASTRECOVERY(tp); 20669b8b58e0SJonathan Lemon tp->snd_nxt = tp->snd_max; 20679b8b58e0SJonathan Lemon tp->t_badrxtwin = 0; /* XXX probably not required */ 20689b8b58e0SJonathan Lemon } 20699b8b58e0SJonathan Lemon 20709b8b58e0SJonathan Lemon /* 2071df8bae1dSRodney W. Grimes * If we have a timestamp reply, update smoothed 2072df8bae1dSRodney W. Grimes * round trip time. If no timestamp is present but 2073df8bae1dSRodney W. Grimes * transmit timer is running and timed sequence 2074df8bae1dSRodney W. Grimes * number was acked, update smoothed round trip time. 2075df8bae1dSRodney W. Grimes * Since we now have an rtt measurement, cancel the 2076df8bae1dSRodney W. Grimes * timer backoff (cf., Phil Karn's retransmit alg.). 2077df8bae1dSRodney W. Grimes * Recompute the initial retransmit timer. 2078fa55172bSMatthew Dillon * 2079fa55172bSMatthew Dillon * Some boxes send broken timestamp replies 2080fa55172bSMatthew Dillon * during the SYN+ACK phase, ignore 2081fa55172bSMatthew Dillon * timestamps of 0 or we could calculate a 2082fa55172bSMatthew Dillon * huge RTT and blow up the retransmit timer. 2083df8bae1dSRodney W. Grimes */ 2084fa55172bSMatthew Dillon if ((to.to_flags & TOF_TS) != 0 && 2085fa55172bSMatthew Dillon to.to_tsecr) { 2086eaf80179SAndre Oppermann if (!tp->t_rttlow || tp->t_rttlow > ticks - to.to_tsecr) 2087eaf80179SAndre Oppermann tp->t_rttlow = ticks - to.to_tsecr; 20889b8b58e0SJonathan Lemon tcp_xmit_timer(tp, ticks - to.to_tsecr + 1); 2089fa55172bSMatthew Dillon } else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) { 2090eaf80179SAndre Oppermann if (!tp->t_rttlow || tp->t_rttlow > ticks - tp->t_rtttime) 2091eaf80179SAndre Oppermann tp->t_rttlow = ticks - tp->t_rtttime; 20929b8b58e0SJonathan Lemon tcp_xmit_timer(tp, ticks - tp->t_rtttime); 2093fa55172bSMatthew Dillon } 20941fcc99b5SMatthew Dillon tcp_xmit_bandwidth_limit(tp, th->th_ack); 2095df8bae1dSRodney W. Grimes 2096df8bae1dSRodney W. Grimes /* 2097df8bae1dSRodney W. Grimes * If all outstanding data is acked, stop retransmit 2098df8bae1dSRodney W. Grimes * timer and remember to restart (more output or persist). 2099df8bae1dSRodney W. Grimes * If there is more data to be acked, restart retransmit 2100df8bae1dSRodney W. Grimes * timer, using current (possibly backed-off) value. 2101df8bae1dSRodney W. Grimes */ 2102fb59c426SYoshinobu Inoue if (th->th_ack == tp->snd_max) { 21039b8b58e0SJonathan Lemon callout_stop(tp->tt_rexmt); 2104df8bae1dSRodney W. Grimes needoutput = 1; 21059b8b58e0SJonathan Lemon } else if (!callout_active(tp->tt_persist)) 21069b8b58e0SJonathan Lemon callout_reset(tp->tt_rexmt, tp->t_rxtcur, 21079b8b58e0SJonathan Lemon tcp_timer_rexmt, tp); 2108a0292f23SGarrett Wollman 2109a0292f23SGarrett Wollman /* 2110a0292f23SGarrett Wollman * If no data (only SYN) was ACK'd, 2111a0292f23SGarrett Wollman * skip rest of ACK processing. 2112a0292f23SGarrett Wollman */ 2113a0292f23SGarrett Wollman if (acked == 0) 2114a0292f23SGarrett Wollman goto step6; 2115a0292f23SGarrett Wollman 2116df8bae1dSRodney W. Grimes /* 2117df8bae1dSRodney W. Grimes * When new data is acked, open the congestion window. 2118df8bae1dSRodney W. Grimes * If the window gives us less than ssthresh packets 2119df8bae1dSRodney W. Grimes * in flight, open exponentially (maxseg per packet). 2120df8bae1dSRodney W. Grimes * Otherwise open linearly: maxseg per window 212110be5648SGarrett Wollman * (maxseg^2 / cwnd per packet). 2122df8bae1dSRodney W. Grimes */ 21236d90faf3SPaul Saab if ((!tcp_do_newreno && !tp->sack_enable) || 21246d90faf3SPaul Saab !IN_FASTRECOVERY(tp)) { 2125df8bae1dSRodney W. Grimes register u_int cw = tp->snd_cwnd; 2126df8bae1dSRodney W. Grimes register u_int incr = tp->t_maxseg; 2127df8bae1dSRodney W. Grimes if (cw > tp->snd_ssthresh) 212810be5648SGarrett Wollman incr = incr * incr / cw; 2129df8bae1dSRodney W. Grimes tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale); 2130df8bae1dSRodney W. Grimes } 21315905999bSRobert Watson SOCKBUF_LOCK(&so->so_snd); 2132df8bae1dSRodney W. Grimes if (acked > so->so_snd.sb_cc) { 2133df8bae1dSRodney W. Grimes tp->snd_wnd -= so->so_snd.sb_cc; 21345905999bSRobert Watson sbdrop_locked(&so->so_snd, (int)so->so_snd.sb_cc); 2135df8bae1dSRodney W. Grimes ourfinisacked = 1; 2136df8bae1dSRodney W. Grimes } else { 21375905999bSRobert Watson sbdrop_locked(&so->so_snd, acked); 2138df8bae1dSRodney W. Grimes tp->snd_wnd -= acked; 2139df8bae1dSRodney W. Grimes ourfinisacked = 0; 2140df8bae1dSRodney W. Grimes } 21411e4d7da7SRobert Watson sowwakeup_locked(so); 2142cb942153SJeffrey Hsu /* detect una wraparound */ 21436d90faf3SPaul Saab if ((tcp_do_newreno || tp->sack_enable) && 21446d90faf3SPaul Saab !IN_FASTRECOVERY(tp) && 21459d11646dSJeffrey Hsu SEQ_GT(tp->snd_una, tp->snd_recover) && 21469d11646dSJeffrey Hsu SEQ_LEQ(th->th_ack, tp->snd_recover)) 21479d11646dSJeffrey Hsu tp->snd_recover = th->th_ack - 1; 21486d90faf3SPaul Saab if ((tcp_do_newreno || tp->sack_enable) && 21496d90faf3SPaul Saab IN_FASTRECOVERY(tp) && 21509d11646dSJeffrey Hsu SEQ_GEQ(th->th_ack, tp->snd_recover)) 21519d11646dSJeffrey Hsu EXIT_FASTRECOVERY(tp); 2152fb59c426SYoshinobu Inoue tp->snd_una = th->th_ack; 21536d90faf3SPaul Saab if (tp->sack_enable) { 21546d90faf3SPaul Saab if (SEQ_GT(tp->snd_una, tp->snd_recover)) 21556d90faf3SPaul Saab tp->snd_recover = tp->snd_una; 21566d90faf3SPaul Saab } 2157df8bae1dSRodney W. Grimes if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 2158df8bae1dSRodney W. Grimes tp->snd_nxt = tp->snd_una; 2159df8bae1dSRodney W. Grimes 2160df8bae1dSRodney W. Grimes switch (tp->t_state) { 2161df8bae1dSRodney W. Grimes 2162df8bae1dSRodney W. Grimes /* 2163df8bae1dSRodney W. Grimes * In FIN_WAIT_1 STATE in addition to the processing 2164df8bae1dSRodney W. Grimes * for the ESTABLISHED state if our FIN is now acknowledged 2165df8bae1dSRodney W. Grimes * then enter FIN_WAIT_2. 2166df8bae1dSRodney W. Grimes */ 2167df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 2168df8bae1dSRodney W. Grimes if (ourfinisacked) { 2169df8bae1dSRodney W. Grimes /* 2170df8bae1dSRodney W. Grimes * If we can't receive any more 2171df8bae1dSRodney W. Grimes * data, then closing user can proceed. 2172df8bae1dSRodney W. Grimes * Starting the timer is contrary to the 2173df8bae1dSRodney W. Grimes * specification, but if we don't get a FIN 2174df8bae1dSRodney W. Grimes * we'll hang forever. 2175df8bae1dSRodney W. Grimes */ 2176340c35deSJonathan Lemon /* XXXjl 2177340c35deSJonathan Lemon * we should release the tp also, and use a 2178340c35deSJonathan Lemon * compressed state. 2179340c35deSJonathan Lemon */ 2180c0b99ffaSRobert Watson if (so->so_rcv.sb_state & SBS_CANTRCVMORE) { 218103e49181SSeigo Tanimura soisdisconnected(so); 21829b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, tcp_maxidle, 21839b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 21844cc20ab1SSeigo Tanimura } 2185df8bae1dSRodney W. Grimes tp->t_state = TCPS_FIN_WAIT_2; 2186df8bae1dSRodney W. Grimes } 2187df8bae1dSRodney W. Grimes break; 2188df8bae1dSRodney W. Grimes 2189df8bae1dSRodney W. Grimes /* 2190df8bae1dSRodney W. Grimes * In CLOSING STATE in addition to the processing for 2191df8bae1dSRodney W. Grimes * the ESTABLISHED state if the ACK acknowledges our FIN 2192df8bae1dSRodney W. Grimes * then enter the TIME-WAIT state, otherwise ignore 2193df8bae1dSRodney W. Grimes * the segment. 2194df8bae1dSRodney W. Grimes */ 2195df8bae1dSRodney W. Grimes case TCPS_CLOSING: 2196df8bae1dSRodney W. Grimes if (ourfinisacked) { 2197de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: process_ACK: " 2198de30ea13SRobert Watson "head not locked")); 219911a20fb8SJeffrey Hsu tcp_twstart(tp); 2200340c35deSJonathan Lemon INP_INFO_WUNLOCK(&tcbinfo); 2201340c35deSJonathan Lemon m_freem(m); 2202340c35deSJonathan Lemon return; 2203df8bae1dSRodney W. Grimes } 2204df8bae1dSRodney W. Grimes break; 2205df8bae1dSRodney W. Grimes 2206df8bae1dSRodney W. Grimes /* 2207df8bae1dSRodney W. Grimes * In LAST_ACK, we may still be waiting for data to drain 2208df8bae1dSRodney W. Grimes * and/or to be acked, as well as for the ack of our FIN. 2209df8bae1dSRodney W. Grimes * If our FIN is now acknowledged, delete the TCB, 2210df8bae1dSRodney W. Grimes * enter the closed state and return. 2211df8bae1dSRodney W. Grimes */ 2212df8bae1dSRodney W. Grimes case TCPS_LAST_ACK: 2213df8bae1dSRodney W. Grimes if (ourfinisacked) { 2214416738a7SRobert Watson KASSERT(headlocked, ("tcp_input: process_ACK:" 2215416738a7SRobert Watson " tcp_close: head not locked")); 2216df8bae1dSRodney W. Grimes tp = tcp_close(tp); 2217df8bae1dSRodney W. Grimes goto drop; 2218df8bae1dSRodney W. Grimes } 2219df8bae1dSRodney W. Grimes break; 2220df8bae1dSRodney W. Grimes 2221df8bae1dSRodney W. Grimes /* 2222df8bae1dSRodney W. Grimes * In TIME_WAIT state the only thing that should arrive 2223df8bae1dSRodney W. Grimes * is a retransmission of the remote FIN. Acknowledge 2224df8bae1dSRodney W. Grimes * it and restart the finack timer. 2225df8bae1dSRodney W. Grimes */ 2226df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 2227340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait")); 22289b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 22299b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 2230df8bae1dSRodney W. Grimes goto dropafterack; 2231df8bae1dSRodney W. Grimes } 2232df8bae1dSRodney W. Grimes } 2233df8bae1dSRodney W. Grimes 2234df8bae1dSRodney W. Grimes step6: 2235de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: step6: head not locked")); 22367cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 22377cfc6904SRobert Watson 2238df8bae1dSRodney W. Grimes /* 2239df8bae1dSRodney W. Grimes * Update window information. 2240df8bae1dSRodney W. Grimes * Don't look at window if no ACK: TAC's send garbage on first SYN. 2241df8bae1dSRodney W. Grimes */ 2242fb59c426SYoshinobu Inoue if ((thflags & TH_ACK) && 2243fb59c426SYoshinobu Inoue (SEQ_LT(tp->snd_wl1, th->th_seq) || 2244fb59c426SYoshinobu Inoue (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) || 2245fb59c426SYoshinobu Inoue (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 2246df8bae1dSRodney W. Grimes /* keep track of pure window updates */ 2247fb59c426SYoshinobu Inoue if (tlen == 0 && 2248fb59c426SYoshinobu Inoue tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 2249df8bae1dSRodney W. Grimes tcpstat.tcps_rcvwinupd++; 2250df8bae1dSRodney W. Grimes tp->snd_wnd = tiwin; 2251fb59c426SYoshinobu Inoue tp->snd_wl1 = th->th_seq; 2252fb59c426SYoshinobu Inoue tp->snd_wl2 = th->th_ack; 2253df8bae1dSRodney W. Grimes if (tp->snd_wnd > tp->max_sndwnd) 2254df8bae1dSRodney W. Grimes tp->max_sndwnd = tp->snd_wnd; 2255df8bae1dSRodney W. Grimes needoutput = 1; 2256df8bae1dSRodney W. Grimes } 2257df8bae1dSRodney W. Grimes 2258df8bae1dSRodney W. Grimes /* 2259df8bae1dSRodney W. Grimes * Process segments with URG. 2260df8bae1dSRodney W. Grimes */ 2261fb59c426SYoshinobu Inoue if ((thflags & TH_URG) && th->th_urp && 2262df8bae1dSRodney W. Grimes TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2263df8bae1dSRodney W. Grimes /* 2264df8bae1dSRodney W. Grimes * This is a kludge, but if we receive and accept 2265df8bae1dSRodney W. Grimes * random urgent pointers, we'll crash in 2266df8bae1dSRodney W. Grimes * soreceive. It's hard to imagine someone 2267df8bae1dSRodney W. Grimes * actually wanting to send this much urgent data. 2268df8bae1dSRodney W. Grimes */ 226918ad5842SRobert Watson SOCKBUF_LOCK(&so->so_rcv); 2270fb59c426SYoshinobu Inoue if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 2271fb59c426SYoshinobu Inoue th->th_urp = 0; /* XXX */ 2272fb59c426SYoshinobu Inoue thflags &= ~TH_URG; /* XXX */ 227318ad5842SRobert Watson SOCKBUF_UNLOCK(&so->so_rcv); /* XXX */ 2274df8bae1dSRodney W. Grimes goto dodata; /* XXX */ 2275df8bae1dSRodney W. Grimes } 2276df8bae1dSRodney W. Grimes /* 2277df8bae1dSRodney W. Grimes * If this segment advances the known urgent pointer, 2278df8bae1dSRodney W. Grimes * then mark the data stream. This should not happen 2279df8bae1dSRodney W. Grimes * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 2280df8bae1dSRodney W. Grimes * a FIN has been received from the remote side. 2281df8bae1dSRodney W. Grimes * In these states we ignore the URG. 2282df8bae1dSRodney W. Grimes * 2283df8bae1dSRodney W. Grimes * According to RFC961 (Assigned Protocols), 2284df8bae1dSRodney W. Grimes * the urgent pointer points to the last octet 2285df8bae1dSRodney W. Grimes * of urgent data. We continue, however, 2286df8bae1dSRodney W. Grimes * to consider it to indicate the first octet 2287df8bae1dSRodney W. Grimes * of data past the urgent section as the original 2288df8bae1dSRodney W. Grimes * spec states (in one of two places). 2289df8bae1dSRodney W. Grimes */ 2290fb59c426SYoshinobu Inoue if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 2291fb59c426SYoshinobu Inoue tp->rcv_up = th->th_seq + th->th_urp; 2292df8bae1dSRodney W. Grimes so->so_oobmark = so->so_rcv.sb_cc + 2293df8bae1dSRodney W. Grimes (tp->rcv_up - tp->rcv_nxt) - 1; 2294927c5ceaSRobert Watson if (so->so_oobmark == 0) 2295c0b99ffaSRobert Watson so->so_rcv.sb_state |= SBS_RCVATMARK; 2296df8bae1dSRodney W. Grimes sohasoutofband(so); 2297df8bae1dSRodney W. Grimes tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 2298df8bae1dSRodney W. Grimes } 229918ad5842SRobert Watson SOCKBUF_UNLOCK(&so->so_rcv); 2300df8bae1dSRodney W. Grimes /* 2301df8bae1dSRodney W. Grimes * Remove out of band data so doesn't get presented to user. 2302df8bae1dSRodney W. Grimes * This can happen independent of advancing the URG pointer, 2303df8bae1dSRodney W. Grimes * but if two URG's are pending at once, some out-of-band 2304df8bae1dSRodney W. Grimes * data may creep in... ick. 2305df8bae1dSRodney W. Grimes */ 230630613f56SJeffrey Hsu if (th->th_urp <= (u_long)tlen && 230730613f56SJeffrey Hsu !(so->so_options & SO_OOBINLINE)) { 230830613f56SJeffrey Hsu /* hdr drop is delayed */ 230930613f56SJeffrey Hsu tcp_pulloutofband(so, th, m, drop_hdrlen); 231030613f56SJeffrey Hsu } 2311c068736aSJeffrey Hsu } else { 2312df8bae1dSRodney W. Grimes /* 2313df8bae1dSRodney W. Grimes * If no out of band data is expected, 2314df8bae1dSRodney W. Grimes * pull receive urgent pointer along 2315df8bae1dSRodney W. Grimes * with the receive window. 2316df8bae1dSRodney W. Grimes */ 2317df8bae1dSRodney W. Grimes if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 2318df8bae1dSRodney W. Grimes tp->rcv_up = tp->rcv_nxt; 2319c068736aSJeffrey Hsu } 2320df8bae1dSRodney W. Grimes dodata: /* XXX */ 2321de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: dodata: head not locked")); 23227cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 23237cfc6904SRobert Watson 2324df8bae1dSRodney W. Grimes /* 2325df8bae1dSRodney W. Grimes * Process the segment text, merging it into the TCP sequencing queue, 2326df8bae1dSRodney W. Grimes * and arranging for acknowledgment of receipt if necessary. 2327df8bae1dSRodney W. Grimes * This process logically involves adjusting tp->rcv_wnd as data 2328df8bae1dSRodney W. Grimes * is presented to the user (this happens in tcp_usrreq.c, 2329df8bae1dSRodney W. Grimes * case PRU_RCVD). If a FIN has already been received on this 2330df8bae1dSRodney W. Grimes * connection then we just ignore the text. 2331df8bae1dSRodney W. Grimes */ 2332fb59c426SYoshinobu Inoue if ((tlen || (thflags & TH_FIN)) && 2333df8bae1dSRodney W. Grimes TCPS_HAVERCVDFIN(tp->t_state) == 0) { 233469e03620SPaul Saab tcp_seq save_start = th->th_seq; 233569e03620SPaul Saab tcp_seq save_end = th->th_seq + tlen; 2336fb59c426SYoshinobu Inoue m_adj(m, drop_hdrlen); /* delayed header drop */ 2337e4b64281SJesper Skriver /* 2338c068736aSJeffrey Hsu * Insert segment which includes th into TCP reassembly queue 2339c068736aSJeffrey Hsu * with control block tp. Set thflags to whether reassembly now 2340c068736aSJeffrey Hsu * includes a segment with FIN. This handles the common case 2341c068736aSJeffrey Hsu * inline (segment is the next to be received on an established 2342c068736aSJeffrey Hsu * connection, and the queue is empty), avoiding linkage into 2343c068736aSJeffrey Hsu * and removal from the queue and repetition of various 2344c068736aSJeffrey Hsu * conversions. 2345c068736aSJeffrey Hsu * Set DELACK for segments received in order, but ack 2346c068736aSJeffrey Hsu * immediately when segments are out of order (so 2347c068736aSJeffrey Hsu * fast retransmit can work). 2348e4b64281SJesper Skriver */ 2349e4b64281SJesper Skriver if (th->th_seq == tp->rcv_nxt && 2350e4b64281SJesper Skriver LIST_EMPTY(&tp->t_segq) && 2351e4b64281SJesper Skriver TCPS_HAVEESTABLISHED(tp->t_state)) { 2352e4b64281SJesper Skriver if (DELAY_ACK(tp)) 23533bfd6421SJonathan Lemon tp->t_flags |= TF_DELACK; 2354e4b64281SJesper Skriver else 2355e4b64281SJesper Skriver tp->t_flags |= TF_ACKNOW; 2356e4b64281SJesper Skriver tp->rcv_nxt += tlen; 2357e4b64281SJesper Skriver thflags = th->th_flags & TH_FIN; 2358e4b64281SJesper Skriver tcpstat.tcps_rcvpack++; 2359e4b64281SJesper Skriver tcpstat.tcps_rcvbyte += tlen; 2360e4b64281SJesper Skriver ND6_HINT(tp); 23611e4d7da7SRobert Watson SOCKBUF_LOCK(&so->so_rcv); 2362c0b99ffaSRobert Watson if (so->so_rcv.sb_state & SBS_CANTRCVMORE) 2363c1c36a2cSMike Silbersack m_freem(m); 2364c1c36a2cSMike Silbersack else 23651e4d7da7SRobert Watson sbappendstream_locked(&so->so_rcv, m); 23661e4d7da7SRobert Watson sorwakeup_locked(so); 2367e4b64281SJesper Skriver } else { 2368e4b64281SJesper Skriver thflags = tcp_reass(tp, th, &tlen, m); 2369e4b64281SJesper Skriver tp->t_flags |= TF_ACKNOW; 2370e4b64281SJesper Skriver } 2371e346eeffSPaul Saab if (tlen > 0 && tp->sack_enable) 237269e03620SPaul Saab tcp_update_sack_list(tp, save_start, save_end); 2373df8bae1dSRodney W. Grimes /* 2374df8bae1dSRodney W. Grimes * Note the amount of data that peer has sent into 2375df8bae1dSRodney W. Grimes * our window, in order to estimate the sender's 2376df8bae1dSRodney W. Grimes * buffer size. 2377df8bae1dSRodney W. Grimes */ 2378df8bae1dSRodney W. Grimes len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 2379df8bae1dSRodney W. Grimes } else { 2380df8bae1dSRodney W. Grimes m_freem(m); 2381fb59c426SYoshinobu Inoue thflags &= ~TH_FIN; 2382df8bae1dSRodney W. Grimes } 2383df8bae1dSRodney W. Grimes 2384df8bae1dSRodney W. Grimes /* 2385df8bae1dSRodney W. Grimes * If FIN is received ACK the FIN and let the user know 2386df8bae1dSRodney W. Grimes * that the connection is closing. 2387df8bae1dSRodney W. Grimes */ 2388fb59c426SYoshinobu Inoue if (thflags & TH_FIN) { 2389df8bae1dSRodney W. Grimes if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2390df8bae1dSRodney W. Grimes socantrcvmore(so); 2391a0292f23SGarrett Wollman /* 2392a0292f23SGarrett Wollman * If connection is half-synchronized 2393d3eede9dSAndras Olah * (ie NEEDSYN flag on) then delay ACK, 2394a0292f23SGarrett Wollman * so it may be piggybacked when SYN is sent. 2395a0292f23SGarrett Wollman * Otherwise, since we received a FIN then no 2396a0292f23SGarrett Wollman * more input can be expected, send ACK now. 2397a0292f23SGarrett Wollman */ 23983bfd6421SJonathan Lemon if (tp->t_flags & TF_NEEDSYN) 23993bfd6421SJonathan Lemon tp->t_flags |= TF_DELACK; 2400a0292f23SGarrett Wollman else 2401df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 2402df8bae1dSRodney W. Grimes tp->rcv_nxt++; 2403df8bae1dSRodney W. Grimes } 2404df8bae1dSRodney W. Grimes switch (tp->t_state) { 2405df8bae1dSRodney W. Grimes 2406df8bae1dSRodney W. Grimes /* 2407df8bae1dSRodney W. Grimes * In SYN_RECEIVED and ESTABLISHED STATES 2408df8bae1dSRodney W. Grimes * enter the CLOSE_WAIT state. 2409df8bae1dSRodney W. Grimes */ 2410df8bae1dSRodney W. Grimes case TCPS_SYN_RECEIVED: 24119b8b58e0SJonathan Lemon tp->t_starttime = ticks; 24129b8b58e0SJonathan Lemon /*FALLTHROUGH*/ 2413df8bae1dSRodney W. Grimes case TCPS_ESTABLISHED: 2414df8bae1dSRodney W. Grimes tp->t_state = TCPS_CLOSE_WAIT; 2415df8bae1dSRodney W. Grimes break; 2416df8bae1dSRodney W. Grimes 2417df8bae1dSRodney W. Grimes /* 2418df8bae1dSRodney W. Grimes * If still in FIN_WAIT_1 STATE FIN has not been acked so 2419df8bae1dSRodney W. Grimes * enter the CLOSING state. 2420df8bae1dSRodney W. Grimes */ 2421df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_1: 2422df8bae1dSRodney W. Grimes tp->t_state = TCPS_CLOSING; 2423df8bae1dSRodney W. Grimes break; 2424df8bae1dSRodney W. Grimes 2425df8bae1dSRodney W. Grimes /* 2426df8bae1dSRodney W. Grimes * In FIN_WAIT_2 state enter the TIME_WAIT state, 2427df8bae1dSRodney W. Grimes * starting the time-wait timer, turning off the other 2428df8bae1dSRodney W. Grimes * standard timers. 2429df8bae1dSRodney W. Grimes */ 2430df8bae1dSRodney W. Grimes case TCPS_FIN_WAIT_2: 2431de30ea13SRobert Watson KASSERT(headlocked == 1, ("tcp_input: dodata: " 2432de30ea13SRobert Watson "TCP_FIN_WAIT_2: head not locked")); 2433340c35deSJonathan Lemon tcp_twstart(tp); 243411a20fb8SJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2435340c35deSJonathan Lemon return; 2436df8bae1dSRodney W. Grimes 2437df8bae1dSRodney W. Grimes /* 2438df8bae1dSRodney W. Grimes * In TIME_WAIT state restart the 2 MSL time_wait timer. 2439df8bae1dSRodney W. Grimes */ 2440df8bae1dSRodney W. Grimes case TCPS_TIME_WAIT: 2441340c35deSJonathan Lemon KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait")); 24429b8b58e0SJonathan Lemon callout_reset(tp->tt_2msl, 2 * tcp_msl, 24439b8b58e0SJonathan Lemon tcp_timer_2msl, tp); 2444df8bae1dSRodney W. Grimes break; 2445df8bae1dSRodney W. Grimes } 2446df8bae1dSRodney W. Grimes } 2447e0bef1cbSRobert Watson INP_INFO_WUNLOCK(&tcbinfo); 2448e0bef1cbSRobert Watson headlocked = 0; 2449610ee2f9SDavid Greenman #ifdef TCPDEBUG 24504cc20ab1SSeigo Tanimura if (so->so_options & SO_DEBUG) 2451fb59c426SYoshinobu Inoue tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen, 2452fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2453610ee2f9SDavid Greenman #endif 2454df8bae1dSRodney W. Grimes 2455df8bae1dSRodney W. Grimes /* 2456df8bae1dSRodney W. Grimes * Return any desired output. 2457df8bae1dSRodney W. Grimes */ 2458df8bae1dSRodney W. Grimes if (needoutput || (tp->t_flags & TF_ACKNOW)) 2459df8bae1dSRodney W. Grimes (void) tcp_output(tp); 24607792ea27SJeffrey Hsu 2461a14c749fSJonathan Lemon check_delack: 2462e0bef1cbSRobert Watson KASSERT(headlocked == 0, ("tcp_input: check_delack: head locked")); 24637cfc6904SRobert Watson INP_LOCK_ASSERT(inp); 2464a14c749fSJonathan Lemon if (tp->t_flags & TF_DELACK) { 24653bfd6421SJonathan Lemon tp->t_flags &= ~TF_DELACK; 24663bfd6421SJonathan Lemon callout_reset(tp->tt_delack, tcp_delacktime, 24673bfd6421SJonathan Lemon tcp_timer_delack, tp); 24683bfd6421SJonathan Lemon } 2469f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2470df8bae1dSRodney W. Grimes return; 2471df8bae1dSRodney W. Grimes 2472df8bae1dSRodney W. Grimes dropafterack: 2473de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: dropafterack: head not locked")); 2474df8bae1dSRodney W. Grimes /* 2475df8bae1dSRodney W. Grimes * Generate an ACK dropping incoming segment if it occupies 2476df8bae1dSRodney W. Grimes * sequence space, where the ACK reflects our state. 247780ab7c0eSGarrett Wollman * 247880ab7c0eSGarrett Wollman * We can now skip the test for the RST flag since all 247980ab7c0eSGarrett Wollman * paths to this code happen after packets containing 248080ab7c0eSGarrett Wollman * RST have been dropped. 248180ab7c0eSGarrett Wollman * 248280ab7c0eSGarrett Wollman * In the SYN-RECEIVED state, don't send an ACK unless the 248380ab7c0eSGarrett Wollman * segment we received passes the SYN-RECEIVED ACK test. 248480ab7c0eSGarrett Wollman * If it fails send a RST. This breaks the loop in the 248580ab7c0eSGarrett Wollman * "LAND" DoS attack, and also prevents an ACK storm 248680ab7c0eSGarrett Wollman * between two listening ports that have been sent forged 248780ab7c0eSGarrett Wollman * SYN segments, each with the source address of the other. 2488df8bae1dSRodney W. Grimes */ 2489fb59c426SYoshinobu Inoue if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) && 2490fb59c426SYoshinobu Inoue (SEQ_GT(tp->snd_una, th->th_ack) || 2491a57815efSBosko Milekic SEQ_GT(th->th_ack, tp->snd_max)) ) { 2492a57815efSBosko Milekic rstreason = BANDLIM_RST_OPENPORT; 2493a57815efSBosko Milekic goto dropwithreset; 2494a57815efSBosko Milekic } 2495a0292f23SGarrett Wollman #ifdef TCPDEBUG 24964cc20ab1SSeigo Tanimura if (so->so_options & SO_DEBUG) 2497fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2498fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2499a0292f23SGarrett Wollman #endif 250085e8b243SJeffrey Hsu KASSERT(headlocked, ("headlocked should be 1")); 250142cf3289SRobert Watson INP_INFO_WUNLOCK(&tcbinfo); 2502df8bae1dSRodney W. Grimes tp->t_flags |= TF_ACKNOW; 2503df8bae1dSRodney W. Grimes (void) tcp_output(tp); 2504f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2505d6915262SRobert Watson m_freem(m); 2506df8bae1dSRodney W. Grimes return; 2507df8bae1dSRodney W. Grimes 2508df8bae1dSRodney W. Grimes dropwithreset: 2509de30ea13SRobert Watson KASSERT(headlocked, ("tcp_input: dropwithreset: head not locked")); 2510df8bae1dSRodney W. Grimes /* 2511df8bae1dSRodney W. Grimes * Generate a RST, dropping incoming segment. 2512df8bae1dSRodney W. Grimes * Make ACK acceptable to originator of segment. 2513df8bae1dSRodney W. Grimes * Don't bother to respond if destination was broadcast/multicast. 2514df8bae1dSRodney W. Grimes */ 2515fb59c426SYoshinobu Inoue if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST)) 2516df8bae1dSRodney W. Grimes goto drop; 2517fb59c426SYoshinobu Inoue if (isipv6) { 2518173c0f9fSWarner Losh if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 2519173c0f9fSWarner Losh IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) 2520fb59c426SYoshinobu Inoue goto drop; 2521c068736aSJeffrey Hsu } else { 2522173c0f9fSWarner Losh if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 2523173c0f9fSWarner Losh IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 25242ca2159fSCrist J. Clark ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || 25252ca2159fSCrist J. Clark in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 2526fb59c426SYoshinobu Inoue goto drop; 2527c068736aSJeffrey Hsu } 2528fb59c426SYoshinobu Inoue /* IPv6 anycast check is done at tcp6_input() */ 2529a57815efSBosko Milekic 2530a57815efSBosko Milekic /* 2531c59319bfSDag-Erling Smørgrav * Perform bandwidth limiting. 2532a57815efSBosko Milekic */ 2533a57815efSBosko Milekic if (badport_bandlim(rstreason) < 0) 2534a57815efSBosko Milekic goto drop; 2535a57815efSBosko Milekic 2536a0292f23SGarrett Wollman #ifdef TCPDEBUG 25374cc20ab1SSeigo Tanimura if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 2538fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2539fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2540a0292f23SGarrett Wollman #endif 25416fd22cafSJeffrey Hsu 2542fb59c426SYoshinobu Inoue if (thflags & TH_ACK) 2543fb59c426SYoshinobu Inoue /* mtod() below is safe as long as hdr dropping is delayed */ 2544fb59c426SYoshinobu Inoue tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack, 2545fb59c426SYoshinobu Inoue TH_RST); 2546df8bae1dSRodney W. Grimes else { 2547fb59c426SYoshinobu Inoue if (thflags & TH_SYN) 2548fb59c426SYoshinobu Inoue tlen++; 2549fb59c426SYoshinobu Inoue /* mtod() below is safe as long as hdr dropping is delayed */ 2550fb59c426SYoshinobu Inoue tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen, 2551fb59c426SYoshinobu Inoue (tcp_seq)0, TH_RST|TH_ACK); 2552df8bae1dSRodney W. Grimes } 2553c29afad6SSam Leffler 2554c29afad6SSam Leffler if (tp) 2555c29afad6SSam Leffler INP_UNLOCK(inp); 2556f76fcf6dSJeffrey Hsu if (headlocked) 2557f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2558df8bae1dSRodney W. Grimes return; 2559df8bae1dSRodney W. Grimes 2560df8bae1dSRodney W. Grimes drop: 2561df8bae1dSRodney W. Grimes /* 2562df8bae1dSRodney W. Grimes * Drop space held by incoming segment and return. 2563df8bae1dSRodney W. Grimes */ 2564610ee2f9SDavid Greenman #ifdef TCPDEBUG 25654cc20ab1SSeigo Tanimura if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 2566fb59c426SYoshinobu Inoue tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, 2567fb59c426SYoshinobu Inoue &tcp_savetcp, 0); 2568a0292f23SGarrett Wollman #endif 2569f76fcf6dSJeffrey Hsu if (tp) 2570f76fcf6dSJeffrey Hsu INP_UNLOCK(inp); 2571f76fcf6dSJeffrey Hsu if (headlocked) 2572f76fcf6dSJeffrey Hsu INP_INFO_WUNLOCK(&tcbinfo); 2573d6915262SRobert Watson m_freem(m); 2574df8bae1dSRodney W. Grimes return; 2575df8bae1dSRodney W. Grimes } 2576df8bae1dSRodney W. Grimes 2577be2ac88cSJonathan Lemon /* 2578be2ac88cSJonathan Lemon * Parse TCP options and place in tcpopt. 2579be2ac88cSJonathan Lemon */ 25800312fbe9SPoul-Henning Kamp static void 25815a53ca16SPaul Saab tcp_dooptions(to, cp, cnt, is_syn) 2582be2ac88cSJonathan Lemon struct tcpopt *to; 2583df8bae1dSRodney W. Grimes u_char *cp; 2584df8bae1dSRodney W. Grimes int cnt; 2585152385d1SDavid E. O'Brien int is_syn; 2586df8bae1dSRodney W. Grimes { 2587df8bae1dSRodney W. Grimes int opt, optlen; 2588df8bae1dSRodney W. Grimes 2589be2ac88cSJonathan Lemon to->to_flags = 0; 2590df8bae1dSRodney W. Grimes for (; cnt > 0; cnt -= optlen, cp += optlen) { 2591df8bae1dSRodney W. Grimes opt = cp[0]; 2592df8bae1dSRodney W. Grimes if (opt == TCPOPT_EOL) 2593df8bae1dSRodney W. Grimes break; 2594df8bae1dSRodney W. Grimes if (opt == TCPOPT_NOP) 2595df8bae1dSRodney W. Grimes optlen = 1; 2596df8bae1dSRodney W. Grimes else { 2597b474779fSJun-ichiro itojun Hagino if (cnt < 2) 2598b474779fSJun-ichiro itojun Hagino break; 2599df8bae1dSRodney W. Grimes optlen = cp[1]; 2600b474779fSJun-ichiro itojun Hagino if (optlen < 2 || optlen > cnt) 2601df8bae1dSRodney W. Grimes break; 2602df8bae1dSRodney W. Grimes } 2603df8bae1dSRodney W. Grimes switch (opt) { 2604df8bae1dSRodney W. Grimes case TCPOPT_MAXSEG: 2605df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_MAXSEG) 2606df8bae1dSRodney W. Grimes continue; 2607be2ac88cSJonathan Lemon if (!is_syn) 2608df8bae1dSRodney W. Grimes continue; 2609be2ac88cSJonathan Lemon to->to_flags |= TOF_MSS; 2610be2ac88cSJonathan Lemon bcopy((char *)cp + 2, 2611be2ac88cSJonathan Lemon (char *)&to->to_mss, sizeof(to->to_mss)); 2612fd8e4ebcSMike Barcroft to->to_mss = ntohs(to->to_mss); 2613df8bae1dSRodney W. Grimes break; 2614df8bae1dSRodney W. Grimes case TCPOPT_WINDOW: 2615df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_WINDOW) 2616df8bae1dSRodney W. Grimes continue; 2617be2ac88cSJonathan Lemon if (! is_syn) 2618df8bae1dSRodney W. Grimes continue; 2619be2ac88cSJonathan Lemon to->to_flags |= TOF_SCALE; 2620be2ac88cSJonathan Lemon to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); 2621df8bae1dSRodney W. Grimes break; 2622df8bae1dSRodney W. Grimes case TCPOPT_TIMESTAMP: 2623df8bae1dSRodney W. Grimes if (optlen != TCPOLEN_TIMESTAMP) 2624df8bae1dSRodney W. Grimes continue; 2625be2ac88cSJonathan Lemon to->to_flags |= TOF_TS; 2626a0292f23SGarrett Wollman bcopy((char *)cp + 2, 2627a0292f23SGarrett Wollman (char *)&to->to_tsval, sizeof(to->to_tsval)); 2628fd8e4ebcSMike Barcroft to->to_tsval = ntohl(to->to_tsval); 2629a0292f23SGarrett Wollman bcopy((char *)cp + 6, 2630a0292f23SGarrett Wollman (char *)&to->to_tsecr, sizeof(to->to_tsecr)); 2631fd8e4ebcSMike Barcroft to->to_tsecr = ntohl(to->to_tsecr); 2632cf09195bSPaul Saab /* 2633cf09195bSPaul Saab * If echoed timestamp is later than the current time, 2634cf09195bSPaul Saab * fall back to non RFC1323 RTT calculation. 2635cf09195bSPaul Saab */ 2636cf09195bSPaul Saab if ((to->to_tsecr != 0) && TSTMP_GT(to->to_tsecr, ticks)) 2637cf09195bSPaul Saab to->to_tsecr = 0; 2638df8bae1dSRodney W. Grimes break; 26391cfd4b53SBruce M Simpson #ifdef TCP_SIGNATURE 26401cfd4b53SBruce M Simpson /* 26411cfd4b53SBruce M Simpson * XXX In order to reply to a host which has set the 26421cfd4b53SBruce M Simpson * TCP_SIGNATURE option in its initial SYN, we have to 26431cfd4b53SBruce M Simpson * record the fact that the option was observed here 26441cfd4b53SBruce M Simpson * for the syncache code to perform the correct response. 26451cfd4b53SBruce M Simpson */ 26461cfd4b53SBruce M Simpson case TCPOPT_SIGNATURE: 26471cfd4b53SBruce M Simpson if (optlen != TCPOLEN_SIGNATURE) 26481cfd4b53SBruce M Simpson continue; 26491cfd4b53SBruce M Simpson to->to_flags |= (TOF_SIGNATURE | TOF_SIGLEN); 26501cfd4b53SBruce M Simpson break; 2651265ed012SBruce M Simpson #endif 26526d90faf3SPaul Saab case TCPOPT_SACK_PERMITTED: 26536d90faf3SPaul Saab if (!tcp_do_sack || 26546d90faf3SPaul Saab optlen != TCPOLEN_SACK_PERMITTED) 26556d90faf3SPaul Saab continue; 26566d90faf3SPaul Saab if (is_syn) { 26576d90faf3SPaul Saab /* MUST only be set on SYN */ 26586d90faf3SPaul Saab to->to_flags |= TOF_SACK; 26596d90faf3SPaul Saab } 26606d90faf3SPaul Saab break; 26616d90faf3SPaul Saab case TCPOPT_SACK: 26625a53ca16SPaul Saab if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0) 26636d90faf3SPaul Saab continue; 26645a53ca16SPaul Saab to->to_nsacks = (optlen - 2) / TCPOLEN_SACK; 26655a53ca16SPaul Saab to->to_sacks = cp + 2; 26665a53ca16SPaul Saab tcpstat.tcps_sack_rcv_blocks++; 26676d90faf3SPaul Saab break; 2668be2ac88cSJonathan Lemon default: 2669be2ac88cSJonathan Lemon continue; 2670df8bae1dSRodney W. Grimes } 2671df8bae1dSRodney W. Grimes } 2672df8bae1dSRodney W. Grimes } 2673df8bae1dSRodney W. Grimes 2674df8bae1dSRodney W. Grimes /* 2675df8bae1dSRodney W. Grimes * Pull out of band byte out of a segment so 2676df8bae1dSRodney W. Grimes * it doesn't appear in the user's data queue. 2677df8bae1dSRodney W. Grimes * It is still reflected in the segment length for 2678df8bae1dSRodney W. Grimes * sequencing purposes. 2679df8bae1dSRodney W. Grimes */ 26800312fbe9SPoul-Henning Kamp static void 2681fb59c426SYoshinobu Inoue tcp_pulloutofband(so, th, m, off) 2682df8bae1dSRodney W. Grimes struct socket *so; 2683fb59c426SYoshinobu Inoue struct tcphdr *th; 2684df8bae1dSRodney W. Grimes register struct mbuf *m; 2685fb59c426SYoshinobu Inoue int off; /* delayed to be droped hdrlen */ 2686df8bae1dSRodney W. Grimes { 2687fb59c426SYoshinobu Inoue int cnt = off + th->th_urp - 1; 2688df8bae1dSRodney W. Grimes 2689df8bae1dSRodney W. Grimes while (cnt >= 0) { 2690df8bae1dSRodney W. Grimes if (m->m_len > cnt) { 2691df8bae1dSRodney W. Grimes char *cp = mtod(m, caddr_t) + cnt; 2692df8bae1dSRodney W. Grimes struct tcpcb *tp = sototcpcb(so); 2693df8bae1dSRodney W. Grimes 2694df8bae1dSRodney W. Grimes tp->t_iobc = *cp; 2695df8bae1dSRodney W. Grimes tp->t_oobflags |= TCPOOB_HAVEDATA; 2696df8bae1dSRodney W. Grimes bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 2697df8bae1dSRodney W. Grimes m->m_len--; 269869a34685SYoshinobu Inoue if (m->m_flags & M_PKTHDR) 269969a34685SYoshinobu Inoue m->m_pkthdr.len--; 2700df8bae1dSRodney W. Grimes return; 2701df8bae1dSRodney W. Grimes } 2702df8bae1dSRodney W. Grimes cnt -= m->m_len; 2703df8bae1dSRodney W. Grimes m = m->m_next; 2704df8bae1dSRodney W. Grimes if (m == 0) 2705df8bae1dSRodney W. Grimes break; 2706df8bae1dSRodney W. Grimes } 2707df8bae1dSRodney W. Grimes panic("tcp_pulloutofband"); 2708df8bae1dSRodney W. Grimes } 2709df8bae1dSRodney W. Grimes 2710df8bae1dSRodney W. Grimes /* 2711df8bae1dSRodney W. Grimes * Collect new round-trip time estimate 2712df8bae1dSRodney W. Grimes * and update averages and current timeout. 2713df8bae1dSRodney W. Grimes */ 27140312fbe9SPoul-Henning Kamp static void 2715df8bae1dSRodney W. Grimes tcp_xmit_timer(tp, rtt) 2716df8bae1dSRodney W. Grimes register struct tcpcb *tp; 27179b8b58e0SJonathan Lemon int rtt; 2718df8bae1dSRodney W. Grimes { 2719233e8c18SGarrett Wollman register int delta; 2720233e8c18SGarrett Wollman 27212be3bf22SRobert Watson INP_LOCK_ASSERT(tp->t_inpcb); 27222be3bf22SRobert Watson 2723233e8c18SGarrett Wollman tcpstat.tcps_rttupdated++; 2724233e8c18SGarrett Wollman tp->t_rttupdated++; 2725233e8c18SGarrett Wollman if (tp->t_srtt != 0) { 2726233e8c18SGarrett Wollman /* 2727233e8c18SGarrett Wollman * srtt is stored as fixed point with 5 bits after the 2728233e8c18SGarrett Wollman * binary point (i.e., scaled by 8). The following magic 2729233e8c18SGarrett Wollman * is equivalent to the smoothing algorithm in rfc793 with 2730233e8c18SGarrett Wollman * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2731233e8c18SGarrett Wollman * point). Adjust rtt to origin 0. 2732233e8c18SGarrett Wollman */ 2733233e8c18SGarrett Wollman delta = ((rtt - 1) << TCP_DELTA_SHIFT) 2734233e8c18SGarrett Wollman - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT)); 2735233e8c18SGarrett Wollman 2736233e8c18SGarrett Wollman if ((tp->t_srtt += delta) <= 0) 2737233e8c18SGarrett Wollman tp->t_srtt = 1; 2738233e8c18SGarrett Wollman 2739233e8c18SGarrett Wollman /* 2740233e8c18SGarrett Wollman * We accumulate a smoothed rtt variance (actually, a 2741233e8c18SGarrett Wollman * smoothed mean difference), then set the retransmit 2742233e8c18SGarrett Wollman * timer to smoothed rtt + 4 times the smoothed variance. 2743233e8c18SGarrett Wollman * rttvar is stored as fixed point with 4 bits after the 2744233e8c18SGarrett Wollman * binary point (scaled by 16). The following is 2745233e8c18SGarrett Wollman * equivalent to rfc793 smoothing with an alpha of .75 2746233e8c18SGarrett Wollman * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2747233e8c18SGarrett Wollman * rfc793's wired-in beta. 2748233e8c18SGarrett Wollman */ 2749233e8c18SGarrett Wollman if (delta < 0) 2750233e8c18SGarrett Wollman delta = -delta; 2751233e8c18SGarrett Wollman delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT); 2752233e8c18SGarrett Wollman if ((tp->t_rttvar += delta) <= 0) 2753233e8c18SGarrett Wollman tp->t_rttvar = 1; 27541fcc99b5SMatthew Dillon if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar) 27551fcc99b5SMatthew Dillon tp->t_rttbest = tp->t_srtt + tp->t_rttvar; 2756233e8c18SGarrett Wollman } else { 2757233e8c18SGarrett Wollman /* 2758233e8c18SGarrett Wollman * No rtt measurement yet - use the unsmoothed rtt. 2759233e8c18SGarrett Wollman * Set the variance to half the rtt (so our first 2760233e8c18SGarrett Wollman * retransmit happens at 3*rtt). 2761233e8c18SGarrett Wollman */ 2762233e8c18SGarrett Wollman tp->t_srtt = rtt << TCP_RTT_SHIFT; 2763233e8c18SGarrett Wollman tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1); 27641fcc99b5SMatthew Dillon tp->t_rttbest = tp->t_srtt + tp->t_rttvar; 2765233e8c18SGarrett Wollman } 27669b8b58e0SJonathan Lemon tp->t_rtttime = 0; 2767df8bae1dSRodney W. Grimes tp->t_rxtshift = 0; 2768df8bae1dSRodney W. Grimes 2769df8bae1dSRodney W. Grimes /* 2770df8bae1dSRodney W. Grimes * the retransmit should happen at rtt + 4 * rttvar. 2771df8bae1dSRodney W. Grimes * Because of the way we do the smoothing, srtt and rttvar 2772df8bae1dSRodney W. Grimes * will each average +1/2 tick of bias. When we compute 2773df8bae1dSRodney W. Grimes * the retransmit timer, we want 1/2 tick of rounding and 2774df8bae1dSRodney W. Grimes * 1 extra tick because of +-1/2 tick uncertainty in the 2775df8bae1dSRodney W. Grimes * firing of the timer. The bias will give us exactly the 2776df8bae1dSRodney W. Grimes * 1.5 tick we need. But, because the bias is 2777df8bae1dSRodney W. Grimes * statistical, we have to test that we don't drop below 2778df8bae1dSRodney W. Grimes * the minimum feasible timer (which is 2 ticks). 2779df8bae1dSRodney W. Grimes */ 2780233e8c18SGarrett Wollman TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), 27819e2874b0SGarrett Wollman max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX); 2782df8bae1dSRodney W. Grimes 2783df8bae1dSRodney W. Grimes /* 2784df8bae1dSRodney W. Grimes * We received an ack for a packet that wasn't retransmitted; 2785df8bae1dSRodney W. Grimes * it is probably safe to discard any error indications we've 2786df8bae1dSRodney W. Grimes * received recently. This isn't quite right, but close enough 2787df8bae1dSRodney W. Grimes * for now (a route might have failed after we sent a segment, 2788df8bae1dSRodney W. Grimes * and the return path might not be symmetrical). 2789df8bae1dSRodney W. Grimes */ 2790df8bae1dSRodney W. Grimes tp->t_softerror = 0; 2791df8bae1dSRodney W. Grimes } 2792df8bae1dSRodney W. Grimes 2793df8bae1dSRodney W. Grimes /* 2794df8bae1dSRodney W. Grimes * Determine a reasonable value for maxseg size. 2795df8bae1dSRodney W. Grimes * If the route is known, check route for mtu. 2796df8bae1dSRodney W. Grimes * If none, use an mss that can be handled on the outgoing 2797df8bae1dSRodney W. Grimes * interface without forcing IP to fragment; if bigger than 2798df8bae1dSRodney W. Grimes * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES 2799df8bae1dSRodney W. Grimes * to utilize large mbufs. If no route is found, route has no mtu, 2800df8bae1dSRodney W. Grimes * or the destination isn't local, use a default, hopefully conservative 2801df8bae1dSRodney W. Grimes * size (usually 512 or the default IP max size, but no more than the mtu 2802df8bae1dSRodney W. Grimes * of the interface), as we can't discover anything about intervening 2803df8bae1dSRodney W. Grimes * gateways or networks. We also initialize the congestion/slow start 2804df8bae1dSRodney W. Grimes * window to be a single segment if the destination isn't local. 2805df8bae1dSRodney W. Grimes * While looking at the routing entry, we also initialize other path-dependent 2806df8bae1dSRodney W. Grimes * parameters from pre-set or cached values in the routing entry. 2807a0292f23SGarrett Wollman * 2808a0292f23SGarrett Wollman * Also take into account the space needed for options that we 2809a0292f23SGarrett Wollman * send regularly. Make maxseg shorter by that amount to assure 2810a0292f23SGarrett Wollman * that we can send maxseg amount of data even when the options 2811a0292f23SGarrett Wollman * are present. Store the upper limit of the length of options plus 2812a0292f23SGarrett Wollman * data in maxopd. 2813a0292f23SGarrett Wollman * 2814a0292f23SGarrett Wollman * 2815a0292f23SGarrett Wollman * In case of T/TCP, we call this routine during implicit connection 2816a0292f23SGarrett Wollman * setup as well (offer = -1), to initialize maxseg from the cached 2817a0292f23SGarrett Wollman * MSS of our peer. 281897d8d152SAndre Oppermann * 281997d8d152SAndre Oppermann * NOTE that this routine is only called when we process an incoming 282097d8d152SAndre Oppermann * segment. Outgoing SYN/ACK MSS settings are handled in tcp_mssopt(). 2821df8bae1dSRodney W. Grimes */ 2822a0292f23SGarrett Wollman void 2823df8bae1dSRodney W. Grimes tcp_mss(tp, offer) 2824a0292f23SGarrett Wollman struct tcpcb *tp; 2825a0292f23SGarrett Wollman int offer; 2826df8bae1dSRodney W. Grimes { 282797d8d152SAndre Oppermann int rtt, mss; 2828df8bae1dSRodney W. Grimes u_long bufsize; 282997d8d152SAndre Oppermann u_long maxmtu; 2830c068736aSJeffrey Hsu struct inpcb *inp = tp->t_inpcb; 2831df8bae1dSRodney W. Grimes struct socket *so; 283297d8d152SAndre Oppermann struct hc_metrics_lite metrics; 2833a0292f23SGarrett Wollman int origoffer = offer; 2834fb59c426SYoshinobu Inoue #ifdef INET6 2835c068736aSJeffrey Hsu int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0; 2836c068736aSJeffrey Hsu size_t min_protoh = isipv6 ? 2837c068736aSJeffrey Hsu sizeof (struct ip6_hdr) + sizeof (struct tcphdr) : 2838c068736aSJeffrey Hsu sizeof (struct tcpiphdr); 2839c068736aSJeffrey Hsu #else 2840c068736aSJeffrey Hsu const size_t min_protoh = sizeof(struct tcpiphdr); 2841fb59c426SYoshinobu Inoue #endif 2842df8bae1dSRodney W. Grimes 284397d8d152SAndre Oppermann /* initialize */ 284497d8d152SAndre Oppermann #ifdef INET6 284597d8d152SAndre Oppermann if (isipv6) { 284697d8d152SAndre Oppermann maxmtu = tcp_maxmtu6(&inp->inp_inc); 284797d8d152SAndre Oppermann tp->t_maxopd = tp->t_maxseg = tcp_v6mssdflt; 284897d8d152SAndre Oppermann } else 284997d8d152SAndre Oppermann #endif 285097d8d152SAndre Oppermann { 285197d8d152SAndre Oppermann maxmtu = tcp_maxmtu(&inp->inp_inc); 285297d8d152SAndre Oppermann tp->t_maxopd = tp->t_maxseg = tcp_mssdflt; 2853df8bae1dSRodney W. Grimes } 2854df8bae1dSRodney W. Grimes so = inp->inp_socket; 2855df8bae1dSRodney W. Grimes 285697d8d152SAndre Oppermann /* 28572d166c02SAndre Oppermann * no route to sender, stay with default mss and return 285897d8d152SAndre Oppermann */ 285997d8d152SAndre Oppermann if (maxmtu == 0) 286097d8d152SAndre Oppermann return; 286197d8d152SAndre Oppermann 286297d8d152SAndre Oppermann /* what have we got? */ 286397d8d152SAndre Oppermann switch (offer) { 286497d8d152SAndre Oppermann case 0: 286597d8d152SAndre Oppermann /* 286697d8d152SAndre Oppermann * Offer == 0 means that there was no MSS on the SYN 286797d8d152SAndre Oppermann * segment, in this case we use tcp_mssdflt. 286897d8d152SAndre Oppermann */ 286997d8d152SAndre Oppermann offer = 287097d8d152SAndre Oppermann #ifdef INET6 287197d8d152SAndre Oppermann isipv6 ? tcp_v6mssdflt : 287297d8d152SAndre Oppermann #endif 287397d8d152SAndre Oppermann tcp_mssdflt; 287497d8d152SAndre Oppermann break; 287597d8d152SAndre Oppermann 287697d8d152SAndre Oppermann case -1: 2877a0292f23SGarrett Wollman /* 2878c94c54e4SAndre Oppermann * Offer == -1 means that we didn't receive SYN yet. 2879a0292f23SGarrett Wollman */ 288097d8d152SAndre Oppermann /* FALLTHROUGH */ 288197d8d152SAndre Oppermann 288297d8d152SAndre Oppermann default: 2883a0292f23SGarrett Wollman /* 288453369ac9SAndre Oppermann * Prevent DoS attack with too small MSS. Round up 288553369ac9SAndre Oppermann * to at least minmss. 288653369ac9SAndre Oppermann */ 288753369ac9SAndre Oppermann offer = max(offer, tcp_minmss); 288853369ac9SAndre Oppermann /* 2889a0292f23SGarrett Wollman * Sanity check: make sure that maxopd will be large 289097d8d152SAndre Oppermann * enough to allow some data on segments even if the 2891a0292f23SGarrett Wollman * all the option space is used (40bytes). Otherwise 2892a0292f23SGarrett Wollman * funny things may happen in tcp_output. 2893a0292f23SGarrett Wollman */ 2894a0292f23SGarrett Wollman offer = max(offer, 64); 289597d8d152SAndre Oppermann } 2896a0292f23SGarrett Wollman 2897df8bae1dSRodney W. Grimes /* 289897d8d152SAndre Oppermann * rmx information is now retrieved from tcp_hostcache 2899df8bae1dSRodney W. Grimes */ 290097d8d152SAndre Oppermann tcp_hc_get(&inp->inp_inc, &metrics); 290197d8d152SAndre Oppermann 2902df8bae1dSRodney W. Grimes /* 290397d8d152SAndre Oppermann * if there's a discovered mtu int tcp hostcache, use it 2904fb59c426SYoshinobu Inoue * else, use the link mtu. 2905df8bae1dSRodney W. Grimes */ 290697d8d152SAndre Oppermann if (metrics.rmx_mtu) 29072d166c02SAndre Oppermann mss = min(metrics.rmx_mtu, maxmtu) - min_protoh; 2908c068736aSJeffrey Hsu else { 290931b3783cSHajimu UMEMOTO #ifdef INET6 2910fb59c426SYoshinobu Inoue if (isipv6) { 291197d8d152SAndre Oppermann mss = maxmtu - min_protoh; 291297d8d152SAndre Oppermann if (!path_mtu_discovery && 291397d8d152SAndre Oppermann !in6_localaddr(&inp->in6p_faddr)) 2914fb59c426SYoshinobu Inoue mss = min(mss, tcp_v6mssdflt); 2915b3399803SHajimu UMEMOTO } else 2916b3399803SHajimu UMEMOTO #endif 291797d8d152SAndre Oppermann { 291897d8d152SAndre Oppermann mss = maxmtu - min_protoh; 291997d8d152SAndre Oppermann if (!path_mtu_discovery && 292097d8d152SAndre Oppermann !in_localaddr(inp->inp_faddr)) 2921a0292f23SGarrett Wollman mss = min(mss, tcp_mssdflt); 2922a0292f23SGarrett Wollman } 292397d8d152SAndre Oppermann } 2924a0292f23SGarrett Wollman mss = min(mss, offer); 292597d8d152SAndre Oppermann 2926a0292f23SGarrett Wollman /* 2927a0292f23SGarrett Wollman * maxopd stores the maximum length of data AND options 2928a0292f23SGarrett Wollman * in a segment; maxseg is the amount of data in a normal 2929a0292f23SGarrett Wollman * segment. We need to store this value (maxopd) apart 2930a0292f23SGarrett Wollman * from maxseg, because now every segment carries options 2931a0292f23SGarrett Wollman * and thus we normally have somewhat less data in segments. 2932a0292f23SGarrett Wollman */ 2933a0292f23SGarrett Wollman tp->t_maxopd = mss; 2934a0292f23SGarrett Wollman 2935a0292f23SGarrett Wollman /* 2936c94c54e4SAndre Oppermann * origoffer==-1 indicates, that no segments were received yet. 2937c94c54e4SAndre Oppermann * In this case we just guess. 2938a0292f23SGarrett Wollman */ 2939a0292f23SGarrett Wollman if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 2940a0292f23SGarrett Wollman (origoffer == -1 || 2941a0292f23SGarrett Wollman (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)) 2942a0292f23SGarrett Wollman mss -= TCPOLEN_TSTAMP_APPA; 294397d8d152SAndre Oppermann tp->t_maxseg = mss; 2944a0292f23SGarrett Wollman 2945df8bae1dSRodney W. Grimes #if (MCLBYTES & (MCLBYTES - 1)) == 0 2946df8bae1dSRodney W. Grimes if (mss > MCLBYTES) 2947df8bae1dSRodney W. Grimes mss &= ~(MCLBYTES-1); 2948df8bae1dSRodney W. Grimes #else 2949df8bae1dSRodney W. Grimes if (mss > MCLBYTES) 2950df8bae1dSRodney W. Grimes mss = mss / MCLBYTES * MCLBYTES; 2951df8bae1dSRodney W. Grimes #endif 295297d8d152SAndre Oppermann tp->t_maxseg = mss; 295397d8d152SAndre Oppermann 2954df8bae1dSRodney W. Grimes /* 295597d8d152SAndre Oppermann * If there's a pipesize, change the socket buffer to that size, 295697d8d152SAndre Oppermann * don't change if sb_hiwat is different than default (then it 295797d8d152SAndre Oppermann * has been changed on purpose with setsockopt). 295897d8d152SAndre Oppermann * Make the socket buffers an integral number of mss units; 295997d8d152SAndre Oppermann * if the mss is larger than the socket buffer, decrease the mss. 2960df8bae1dSRodney W. Grimes */ 29613f11a2f3SRobert Watson SOCKBUF_LOCK(&so->so_snd); 296297d8d152SAndre Oppermann if ((so->so_snd.sb_hiwat == tcp_sendspace) && metrics.rmx_sendpipe) 296397d8d152SAndre Oppermann bufsize = metrics.rmx_sendpipe; 296497d8d152SAndre Oppermann else 2965df8bae1dSRodney W. Grimes bufsize = so->so_snd.sb_hiwat; 2966df8bae1dSRodney W. Grimes if (bufsize < mss) 2967df8bae1dSRodney W. Grimes mss = bufsize; 2968df8bae1dSRodney W. Grimes else { 2969df8bae1dSRodney W. Grimes bufsize = roundup(bufsize, mss); 2970df8bae1dSRodney W. Grimes if (bufsize > sb_max) 2971df8bae1dSRodney W. Grimes bufsize = sb_max; 297288c39af3SRuslan Ermilov if (bufsize > so->so_snd.sb_hiwat) 29733f11a2f3SRobert Watson (void)sbreserve_locked(&so->so_snd, bufsize, so, NULL); 2974df8bae1dSRodney W. Grimes } 29753f11a2f3SRobert Watson SOCKBUF_UNLOCK(&so->so_snd); 2976df8bae1dSRodney W. Grimes tp->t_maxseg = mss; 2977df8bae1dSRodney W. Grimes 29783f11a2f3SRobert Watson SOCKBUF_LOCK(&so->so_rcv); 297997d8d152SAndre Oppermann if ((so->so_rcv.sb_hiwat == tcp_recvspace) && metrics.rmx_recvpipe) 298097d8d152SAndre Oppermann bufsize = metrics.rmx_recvpipe; 298197d8d152SAndre Oppermann else 2982df8bae1dSRodney W. Grimes bufsize = so->so_rcv.sb_hiwat; 2983df8bae1dSRodney W. Grimes if (bufsize > mss) { 2984df8bae1dSRodney W. Grimes bufsize = roundup(bufsize, mss); 2985df8bae1dSRodney W. Grimes if (bufsize > sb_max) 2986df8bae1dSRodney W. Grimes bufsize = sb_max; 298788c39af3SRuslan Ermilov if (bufsize > so->so_rcv.sb_hiwat) 29883f11a2f3SRobert Watson (void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL); 2989df8bae1dSRodney W. Grimes } 29903f11a2f3SRobert Watson SOCKBUF_UNLOCK(&so->so_rcv); 2991a0292f23SGarrett Wollman /* 299297d8d152SAndre Oppermann * While we're here, check the others too 2993a0292f23SGarrett Wollman */ 299497d8d152SAndre Oppermann if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) { 299597d8d152SAndre Oppermann tp->t_srtt = rtt; 299697d8d152SAndre Oppermann tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE; 299797d8d152SAndre Oppermann tcpstat.tcps_usedrtt++; 299897d8d152SAndre Oppermann if (metrics.rmx_rttvar) { 299997d8d152SAndre Oppermann tp->t_rttvar = metrics.rmx_rttvar; 300097d8d152SAndre Oppermann tcpstat.tcps_usedrttvar++; 300197d8d152SAndre Oppermann } else { 300297d8d152SAndre Oppermann /* default variation is +- 1 rtt */ 300397d8d152SAndre Oppermann tp->t_rttvar = 300497d8d152SAndre Oppermann tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE; 300597d8d152SAndre Oppermann } 300697d8d152SAndre Oppermann TCPT_RANGESET(tp->t_rxtcur, 300797d8d152SAndre Oppermann ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1, 300897d8d152SAndre Oppermann tp->t_rttmin, TCPTV_REXMTMAX); 300997d8d152SAndre Oppermann } 301097d8d152SAndre Oppermann if (metrics.rmx_ssthresh) { 3011df8bae1dSRodney W. Grimes /* 3012df8bae1dSRodney W. Grimes * There's some sort of gateway or interface 3013df8bae1dSRodney W. Grimes * buffer limit on the path. Use this to set 3014df8bae1dSRodney W. Grimes * the slow start threshhold, but set the 3015df8bae1dSRodney W. Grimes * threshold to no less than 2*mss. 3016df8bae1dSRodney W. Grimes */ 301797d8d152SAndre Oppermann tp->snd_ssthresh = max(2 * mss, metrics.rmx_ssthresh); 3018dd224982SGarrett Wollman tcpstat.tcps_usedssthresh++; 3019df8bae1dSRodney W. Grimes } 302097d8d152SAndre Oppermann if (metrics.rmx_bandwidth) 302197d8d152SAndre Oppermann tp->snd_bandwidth = metrics.rmx_bandwidth; 302297d8d152SAndre Oppermann 302397d8d152SAndre Oppermann /* 302497d8d152SAndre Oppermann * Set the slow-start flight size depending on whether this 302597d8d152SAndre Oppermann * is a local network or not. 302697d8d152SAndre Oppermann * 302797d8d152SAndre Oppermann * Extend this so we cache the cwnd too and retrieve it here. 302897d8d152SAndre Oppermann * Make cwnd even bigger than RFC3390 suggests but only if we 302997d8d152SAndre Oppermann * have previous experience with the remote host. Be careful 303097d8d152SAndre Oppermann * not make cwnd bigger than remote receive window or our own 303197d8d152SAndre Oppermann * send socket buffer. Maybe put some additional upper bound 303297d8d152SAndre Oppermann * on the retrieved cwnd. Should do incremental updates to 303397d8d152SAndre Oppermann * hostcache when cwnd collapses so next connection doesn't 303497d8d152SAndre Oppermann * overloads the path again. 303597d8d152SAndre Oppermann * 303697d8d152SAndre Oppermann * RFC3390 says only do this if SYN or SYN/ACK didn't got lost. 303797d8d152SAndre Oppermann * We currently check only in syncache_socket for that. 303897d8d152SAndre Oppermann */ 303997d8d152SAndre Oppermann #define TCP_METRICS_CWND 304097d8d152SAndre Oppermann #ifdef TCP_METRICS_CWND 304197d8d152SAndre Oppermann if (metrics.rmx_cwnd) 304297d8d152SAndre Oppermann tp->snd_cwnd = max(mss, 304397d8d152SAndre Oppermann min(metrics.rmx_cwnd / 2, 304497d8d152SAndre Oppermann min(tp->snd_wnd, so->so_snd.sb_hiwat))); 304597d8d152SAndre Oppermann else 304697d8d152SAndre Oppermann #endif 304797d8d152SAndre Oppermann if (tcp_do_rfc3390) 304897d8d152SAndre Oppermann tp->snd_cwnd = min(4 * mss, max(2 * mss, 4380)); 304997d8d152SAndre Oppermann #ifdef INET6 305097d8d152SAndre Oppermann else if ((isipv6 && in6_localaddr(&inp->in6p_faddr)) || 305197d8d152SAndre Oppermann (!isipv6 && in_localaddr(inp->inp_faddr))) 3052943ae302SAndre Oppermann #else 3053943ae302SAndre Oppermann else if (in_localaddr(inp->inp_faddr)) 305497d8d152SAndre Oppermann #endif 3055943ae302SAndre Oppermann tp->snd_cwnd = mss * ss_fltsz_local; 305697d8d152SAndre Oppermann else 305797d8d152SAndre Oppermann tp->snd_cwnd = mss * ss_fltsz; 3058a0292f23SGarrett Wollman } 3059a0292f23SGarrett Wollman 3060a0292f23SGarrett Wollman /* 3061a0292f23SGarrett Wollman * Determine the MSS option to send on an outgoing SYN. 3062a0292f23SGarrett Wollman */ 3063a0292f23SGarrett Wollman int 306497d8d152SAndre Oppermann tcp_mssopt(inc) 306597d8d152SAndre Oppermann struct in_conninfo *inc; 3066a0292f23SGarrett Wollman { 306797d8d152SAndre Oppermann int mss = 0; 306897d8d152SAndre Oppermann u_long maxmtu = 0; 306997d8d152SAndre Oppermann u_long thcmtu = 0; 307097d8d152SAndre Oppermann size_t min_protoh; 3071fb59c426SYoshinobu Inoue #ifdef INET6 307297d8d152SAndre Oppermann int isipv6 = inc->inc_isipv6 ? 1 : 0; 3073fb59c426SYoshinobu Inoue #endif 3074a0292f23SGarrett Wollman 307597d8d152SAndre Oppermann KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer")); 3076a0292f23SGarrett Wollman 307731b3783cSHajimu UMEMOTO #ifdef INET6 307897d8d152SAndre Oppermann if (isipv6) { 307997d8d152SAndre Oppermann mss = tcp_v6mssdflt; 308097d8d152SAndre Oppermann maxmtu = tcp_maxmtu6(inc); 308197d8d152SAndre Oppermann thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */ 308297d8d152SAndre Oppermann min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); 308397d8d152SAndre Oppermann } else 308431b3783cSHajimu UMEMOTO #endif 308597d8d152SAndre Oppermann { 308697d8d152SAndre Oppermann mss = tcp_mssdflt; 308797d8d152SAndre Oppermann maxmtu = tcp_maxmtu(inc); 308897d8d152SAndre Oppermann thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */ 308997d8d152SAndre Oppermann min_protoh = sizeof(struct tcpiphdr); 309097d8d152SAndre Oppermann } 309197d8d152SAndre Oppermann if (maxmtu && thcmtu) 309297d8d152SAndre Oppermann mss = min(maxmtu, thcmtu) - min_protoh; 309397d8d152SAndre Oppermann else if (maxmtu || thcmtu) 309497d8d152SAndre Oppermann mss = max(maxmtu, thcmtu) - min_protoh; 309597d8d152SAndre Oppermann 309697d8d152SAndre Oppermann return (mss); 3097df8bae1dSRodney W. Grimes } 309846f58482SJonathan Lemon 309946f58482SJonathan Lemon 310046f58482SJonathan Lemon /* 3101c068736aSJeffrey Hsu * On a partial ack arrives, force the retransmission of the 3102c068736aSJeffrey Hsu * next unacknowledged segment. Do not clear tp->t_dupacks. 3103c068736aSJeffrey Hsu * By setting snd_nxt to ti_ack, this forces retransmission timer to 3104c068736aSJeffrey Hsu * be started again. 310546f58482SJonathan Lemon */ 3106c068736aSJeffrey Hsu static void 3107c068736aSJeffrey Hsu tcp_newreno_partial_ack(tp, th) 310846f58482SJonathan Lemon struct tcpcb *tp; 310946f58482SJonathan Lemon struct tcphdr *th; 311046f58482SJonathan Lemon { 311146f58482SJonathan Lemon tcp_seq onxt = tp->snd_nxt; 311246f58482SJonathan Lemon u_long ocwnd = tp->snd_cwnd; 311346f58482SJonathan Lemon 311446f58482SJonathan Lemon callout_stop(tp->tt_rexmt); 311546f58482SJonathan Lemon tp->t_rtttime = 0; 311646f58482SJonathan Lemon tp->snd_nxt = th->th_ack; 31176b2a5f92SJayanth Vijayaraghavan /* 3118c068736aSJeffrey Hsu * Set snd_cwnd to one segment beyond acknowledged offset. 3119c068736aSJeffrey Hsu * (tp->snd_una has not yet been updated when this function is called.) 31206b2a5f92SJayanth Vijayaraghavan */ 31216b2a5f92SJayanth Vijayaraghavan tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una); 3122a84db8f4SMatthew Dillon tp->t_flags |= TF_ACKNOW; 31236b2a5f92SJayanth Vijayaraghavan (void) tcp_output(tp); 312446f58482SJonathan Lemon tp->snd_cwnd = ocwnd; 312546f58482SJonathan Lemon if (SEQ_GT(onxt, tp->snd_nxt)) 312646f58482SJonathan Lemon tp->snd_nxt = onxt; 312746f58482SJonathan Lemon /* 312846f58482SJonathan Lemon * Partial window deflation. Relies on fact that tp->snd_una 312946f58482SJonathan Lemon * not updated yet. 313046f58482SJonathan Lemon */ 3131d7587117SPaul Saab if (tp->snd_cwnd > th->th_ack - tp->snd_una) 3132d7587117SPaul Saab tp->snd_cwnd -= th->th_ack - tp->snd_una; 3133d7587117SPaul Saab else 3134d7587117SPaul Saab tp->snd_cwnd = 0; 3135d7587117SPaul Saab tp->snd_cwnd += tp->t_maxseg; 313646f58482SJonathan Lemon } 3137340c35deSJonathan Lemon 3138340c35deSJonathan Lemon /* 3139340c35deSJonathan Lemon * Returns 1 if the TIME_WAIT state was killed and we should start over, 3140340c35deSJonathan Lemon * looking for a pcb in the listen state. Returns 0 otherwise. 3141340c35deSJonathan Lemon */ 3142340c35deSJonathan Lemon static int 3143340c35deSJonathan Lemon tcp_timewait(tw, to, th, m, tlen) 3144340c35deSJonathan Lemon struct tcptw *tw; 3145340c35deSJonathan Lemon struct tcpopt *to; 3146340c35deSJonathan Lemon struct tcphdr *th; 3147340c35deSJonathan Lemon struct mbuf *m; 3148340c35deSJonathan Lemon int tlen; 3149340c35deSJonathan Lemon { 3150340c35deSJonathan Lemon int thflags; 3151340c35deSJonathan Lemon tcp_seq seq; 3152340c35deSJonathan Lemon #ifdef INET6 3153340c35deSJonathan Lemon int isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0; 3154340c35deSJonathan Lemon #else 3155340c35deSJonathan Lemon const int isipv6 = 0; 3156340c35deSJonathan Lemon #endif 3157340c35deSJonathan Lemon 3158cce83ffbSRobert Watson /* tcbinfo lock required for tcp_twclose(), tcp_2msl_reset. */ 3159cce83ffbSRobert Watson INP_INFO_WLOCK_ASSERT(&tcbinfo); 3160cce83ffbSRobert Watson INP_LOCK_ASSERT(tw->tw_inpcb); 3161cce83ffbSRobert Watson 3162340c35deSJonathan Lemon thflags = th->th_flags; 3163340c35deSJonathan Lemon 3164340c35deSJonathan Lemon /* 3165340c35deSJonathan Lemon * NOTE: for FIN_WAIT_2 (to be added later), 3166340c35deSJonathan Lemon * must validate sequence number before accepting RST 3167340c35deSJonathan Lemon */ 3168340c35deSJonathan Lemon 3169340c35deSJonathan Lemon /* 3170340c35deSJonathan Lemon * If the segment contains RST: 3171340c35deSJonathan Lemon * Drop the segment - see Stevens, vol. 2, p. 964 and 3172340c35deSJonathan Lemon * RFC 1337. 3173340c35deSJonathan Lemon */ 3174340c35deSJonathan Lemon if (thflags & TH_RST) 3175340c35deSJonathan Lemon goto drop; 3176340c35deSJonathan Lemon 3177340c35deSJonathan Lemon #if 0 3178340c35deSJonathan Lemon /* PAWS not needed at the moment */ 3179340c35deSJonathan Lemon /* 3180340c35deSJonathan Lemon * RFC 1323 PAWS: If we have a timestamp reply on this segment 3181340c35deSJonathan Lemon * and it's less than ts_recent, drop it. 3182340c35deSJonathan Lemon */ 3183340c35deSJonathan Lemon if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent && 3184340c35deSJonathan Lemon TSTMP_LT(to.to_tsval, tp->ts_recent)) { 3185340c35deSJonathan Lemon if ((thflags & TH_ACK) == 0) 3186340c35deSJonathan Lemon goto drop; 3187340c35deSJonathan Lemon goto ack; 3188340c35deSJonathan Lemon } 3189340c35deSJonathan Lemon /* 3190340c35deSJonathan Lemon * ts_recent is never updated because we never accept new segments. 3191340c35deSJonathan Lemon */ 3192340c35deSJonathan Lemon #endif 3193340c35deSJonathan Lemon 3194340c35deSJonathan Lemon /* 3195340c35deSJonathan Lemon * If a new connection request is received 3196340c35deSJonathan Lemon * while in TIME_WAIT, drop the old connection 3197340c35deSJonathan Lemon * and start over if the sequence numbers 3198340c35deSJonathan Lemon * are above the previous ones. 3199340c35deSJonathan Lemon */ 3200340c35deSJonathan Lemon if ((thflags & TH_SYN) && SEQ_GT(th->th_seq, tw->rcv_nxt)) { 3201607b0b0cSJonathan Lemon (void) tcp_twclose(tw, 0); 3202340c35deSJonathan Lemon return (1); 3203340c35deSJonathan Lemon } 3204340c35deSJonathan Lemon 3205340c35deSJonathan Lemon /* 3206340c35deSJonathan Lemon * Drop the the segment if it does not contain an ACK. 3207340c35deSJonathan Lemon */ 3208340c35deSJonathan Lemon if ((thflags & TH_ACK) == 0) 3209340c35deSJonathan Lemon goto drop; 3210340c35deSJonathan Lemon 3211340c35deSJonathan Lemon /* 3212340c35deSJonathan Lemon * Reset the 2MSL timer if this is a duplicate FIN. 3213340c35deSJonathan Lemon */ 3214340c35deSJonathan Lemon if (thflags & TH_FIN) { 3215340c35deSJonathan Lemon seq = th->th_seq + tlen + (thflags & TH_SYN ? 1 : 0); 3216340c35deSJonathan Lemon if (seq + 1 == tw->rcv_nxt) 3217607b0b0cSJonathan Lemon tcp_timer_2msl_reset(tw, 2 * tcp_msl); 3218340c35deSJonathan Lemon } 3219340c35deSJonathan Lemon 3220340c35deSJonathan Lemon /* 3221272c5dfeSJonathan Lemon * Acknowledge the segment if it has data or is not a duplicate ACK. 3222340c35deSJonathan Lemon */ 3223272c5dfeSJonathan Lemon if (thflags != TH_ACK || tlen != 0 || 3224272c5dfeSJonathan Lemon th->th_seq != tw->rcv_nxt || th->th_ack != tw->snd_nxt) 3225a7b6a14aSRobert Watson tcp_twrespond(tw, TH_ACK); 3226340c35deSJonathan Lemon goto drop; 3227340c35deSJonathan Lemon 3228340c35deSJonathan Lemon /* 3229340c35deSJonathan Lemon * Generate a RST, dropping incoming segment. 3230340c35deSJonathan Lemon * Make ACK acceptable to originator of segment. 3231340c35deSJonathan Lemon * Don't bother to respond if destination was broadcast/multicast. 3232340c35deSJonathan Lemon */ 3233340c35deSJonathan Lemon if (m->m_flags & (M_BCAST|M_MCAST)) 3234340c35deSJonathan Lemon goto drop; 3235340c35deSJonathan Lemon if (isipv6) { 3236340c35deSJonathan Lemon struct ip6_hdr *ip6; 3237340c35deSJonathan Lemon 3238340c35deSJonathan Lemon /* IPv6 anycast check is done at tcp6_input() */ 3239340c35deSJonathan Lemon ip6 = mtod(m, struct ip6_hdr *); 3240340c35deSJonathan Lemon if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 3241340c35deSJonathan Lemon IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) 3242340c35deSJonathan Lemon goto drop; 3243340c35deSJonathan Lemon } else { 3244340c35deSJonathan Lemon struct ip *ip; 3245340c35deSJonathan Lemon 3246340c35deSJonathan Lemon ip = mtod(m, struct ip *); 3247340c35deSJonathan Lemon if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 3248340c35deSJonathan Lemon IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 3249340c35deSJonathan Lemon ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || 3250340c35deSJonathan Lemon in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 3251340c35deSJonathan Lemon goto drop; 3252340c35deSJonathan Lemon } 3253340c35deSJonathan Lemon if (thflags & TH_ACK) { 3254340c35deSJonathan Lemon tcp_respond(NULL, 3255340c35deSJonathan Lemon mtod(m, void *), th, m, 0, th->th_ack, TH_RST); 3256340c35deSJonathan Lemon } else { 3257340c35deSJonathan Lemon seq = th->th_seq + (thflags & TH_SYN ? 1 : 0); 3258340c35deSJonathan Lemon tcp_respond(NULL, 3259340c35deSJonathan Lemon mtod(m, void *), th, m, seq, 0, TH_RST|TH_ACK); 3260340c35deSJonathan Lemon } 3261340c35deSJonathan Lemon INP_UNLOCK(tw->tw_inpcb); 3262340c35deSJonathan Lemon return (0); 3263340c35deSJonathan Lemon 3264340c35deSJonathan Lemon drop: 3265340c35deSJonathan Lemon INP_UNLOCK(tw->tw_inpcb); 3266340c35deSJonathan Lemon m_freem(m); 3267340c35deSJonathan Lemon return (0); 3268340c35deSJonathan Lemon } 3269