xref: /freebsd/sys/netinet/tcp_input.c (revision 5bb3134a8c21cb87b30e135ef168483f0333dabb)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  * Copyright (c) 2007-2008,2010
7  *	Swinburne University of Technology, Melbourne, Australia.
8  * Copyright (c) 2009-2010 Lawrence Stewart <lstewart@freebsd.org>
9  * Copyright (c) 2010 The FreeBSD Foundation
10  * Copyright (c) 2010-2011 Juniper Networks, Inc.
11  * All rights reserved.
12  *
13  * Portions of this software were developed at the Centre for Advanced Internet
14  * Architectures, Swinburne University of Technology, by Lawrence Stewart,
15  * James Healy and David Hayes, made possible in part by a grant from the Cisco
16  * University Research Program Fund at Community Foundation Silicon Valley.
17  *
18  * Portions of this software were developed at the Centre for Advanced
19  * Internet Architectures, Swinburne University of Technology, Melbourne,
20  * Australia by David Hayes under sponsorship from the FreeBSD Foundation.
21  *
22  * Portions of this software were developed by Robert N. M. Watson under
23  * contract to Juniper Networks, Inc.
24  *
25  * Redistribution and use in source and binary forms, with or without
26  * modification, are permitted provided that the following conditions
27  * are met:
28  * 1. Redistributions of source code must retain the above copyright
29  *    notice, this list of conditions and the following disclaimer.
30  * 2. Redistributions in binary form must reproduce the above copyright
31  *    notice, this list of conditions and the following disclaimer in the
32  *    documentation and/or other materials provided with the distribution.
33  * 3. Neither the name of the University nor the names of its contributors
34  *    may be used to endorse or promote products derived from this software
35  *    without specific prior written permission.
36  *
37  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
38  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
39  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
40  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
41  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
42  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
43  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
45  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
46  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47  * SUCH DAMAGE.
48  *
49  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
50  */
51 
52 #include <sys/cdefs.h>
53 __FBSDID("$FreeBSD$");
54 
55 #include "opt_inet.h"
56 #include "opt_inet6.h"
57 #include "opt_ipsec.h"
58 #include "opt_tcpdebug.h"
59 
60 #include <sys/param.h>
61 #include <sys/arb.h>
62 #include <sys/kernel.h>
63 #ifdef TCP_HHOOK
64 #include <sys/hhook.h>
65 #endif
66 #include <sys/malloc.h>
67 #include <sys/mbuf.h>
68 #include <sys/proc.h>		/* for proc0 declaration */
69 #include <sys/protosw.h>
70 #include <sys/qmath.h>
71 #include <sys/sdt.h>
72 #include <sys/signalvar.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/sysctl.h>
76 #include <sys/syslog.h>
77 #include <sys/systm.h>
78 #include <sys/stats.h>
79 
80 #include <machine/cpu.h>	/* before tcp_seq.h, for tcp_random18() */
81 
82 #include <vm/uma.h>
83 
84 #include <net/if.h>
85 #include <net/if_var.h>
86 #include <net/route.h>
87 #include <net/vnet.h>
88 
89 #define TCPSTATES		/* for logging */
90 
91 #include <netinet/in.h>
92 #include <netinet/in_kdtrace.h>
93 #include <netinet/in_pcb.h>
94 #include <netinet/in_systm.h>
95 #include <netinet/ip.h>
96 #include <netinet/ip_icmp.h>	/* required for icmp_var.h */
97 #include <netinet/icmp_var.h>	/* for ICMP_BANDLIM */
98 #include <netinet/ip_var.h>
99 #include <netinet/ip_options.h>
100 #include <netinet/ip6.h>
101 #include <netinet/icmp6.h>
102 #include <netinet6/in6_pcb.h>
103 #include <netinet6/in6_var.h>
104 #include <netinet6/ip6_var.h>
105 #include <netinet6/nd6.h>
106 #include <netinet/tcp.h>
107 #include <netinet/tcp_fsm.h>
108 #include <netinet/tcp_log_buf.h>
109 #include <netinet/tcp_seq.h>
110 #include <netinet/tcp_timer.h>
111 #include <netinet/tcp_var.h>
112 #include <netinet6/tcp6_var.h>
113 #include <netinet/tcpip.h>
114 #include <netinet/cc/cc.h>
115 #include <netinet/tcp_fastopen.h>
116 #ifdef TCPPCAP
117 #include <netinet/tcp_pcap.h>
118 #endif
119 #include <netinet/tcp_syncache.h>
120 #ifdef TCPDEBUG
121 #include <netinet/tcp_debug.h>
122 #endif /* TCPDEBUG */
123 #ifdef TCP_OFFLOAD
124 #include <netinet/tcp_offload.h>
125 #endif
126 #include <netinet/udp.h>
127 
128 #include <netipsec/ipsec_support.h>
129 
130 #include <machine/in_cksum.h>
131 
132 #include <security/mac/mac_framework.h>
133 
134 const int tcprexmtthresh = 3;
135 
136 VNET_DEFINE(int, tcp_log_in_vain) = 0;
137 SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_VNET | CTLFLAG_RW,
138     &VNET_NAME(tcp_log_in_vain), 0,
139     "Log all incoming TCP segments to closed ports");
140 
141 VNET_DEFINE(int, blackhole) = 0;
142 #define	V_blackhole		VNET(blackhole)
143 SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_VNET | CTLFLAG_RW,
144     &VNET_NAME(blackhole), 0,
145     "Do not send RST on segments to closed ports");
146 
147 VNET_DEFINE(bool, blackhole_local) = false;
148 #define	V_blackhole_local	VNET(blackhole_local)
149 SYSCTL_BOOL(_net_inet_tcp, OID_AUTO, blackhole_local, CTLFLAG_VNET |
150     CTLFLAG_RW, &VNET_NAME(blackhole_local), false,
151     "Enforce net.inet.tcp.blackhole for locally originated packets");
152 
153 VNET_DEFINE(int, tcp_delack_enabled) = 1;
154 SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_VNET | CTLFLAG_RW,
155     &VNET_NAME(tcp_delack_enabled), 0,
156     "Delay ACK to try and piggyback it onto a data packet");
157 
158 VNET_DEFINE(int, drop_synfin) = 0;
159 SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_VNET | CTLFLAG_RW,
160     &VNET_NAME(drop_synfin), 0,
161     "Drop TCP packets with SYN+FIN set");
162 
163 VNET_DEFINE(int, tcp_do_prr_conservative) = 0;
164 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_prr_conservative, CTLFLAG_VNET | CTLFLAG_RW,
165     &VNET_NAME(tcp_do_prr_conservative), 0,
166     "Do conservative Proportional Rate Reduction");
167 
168 VNET_DEFINE(int, tcp_do_prr) = 1;
169 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_prr, CTLFLAG_VNET | CTLFLAG_RW,
170     &VNET_NAME(tcp_do_prr), 1,
171     "Enable Proportional Rate Reduction per RFC 6937");
172 
173 VNET_DEFINE(int, tcp_do_lrd) = 0;
174 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_lrd, CTLFLAG_VNET | CTLFLAG_RW,
175     &VNET_NAME(tcp_do_lrd), 1,
176     "Perform Lost Retransmission Detection");
177 
178 VNET_DEFINE(int, tcp_do_newcwv) = 0;
179 SYSCTL_INT(_net_inet_tcp, OID_AUTO, newcwv, CTLFLAG_VNET | CTLFLAG_RW,
180     &VNET_NAME(tcp_do_newcwv), 0,
181     "Enable New Congestion Window Validation per RFC7661");
182 
183 VNET_DEFINE(int, tcp_do_rfc3042) = 1;
184 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_VNET | CTLFLAG_RW,
185     &VNET_NAME(tcp_do_rfc3042), 0,
186     "Enable RFC 3042 (Limited Transmit)");
187 
188 VNET_DEFINE(int, tcp_do_rfc3390) = 1;
189 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_VNET | CTLFLAG_RW,
190     &VNET_NAME(tcp_do_rfc3390), 0,
191     "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
192 
193 VNET_DEFINE(int, tcp_initcwnd_segments) = 10;
194 SYSCTL_INT(_net_inet_tcp, OID_AUTO, initcwnd_segments,
195     CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(tcp_initcwnd_segments), 0,
196     "Slow-start flight size (initial congestion window) in number of segments");
197 
198 VNET_DEFINE(int, tcp_do_rfc3465) = 1;
199 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3465, CTLFLAG_VNET | CTLFLAG_RW,
200     &VNET_NAME(tcp_do_rfc3465), 0,
201     "Enable RFC 3465 (Appropriate Byte Counting)");
202 
203 VNET_DEFINE(int, tcp_abc_l_var) = 2;
204 SYSCTL_INT(_net_inet_tcp, OID_AUTO, abc_l_var, CTLFLAG_VNET | CTLFLAG_RW,
205     &VNET_NAME(tcp_abc_l_var), 2,
206     "Cap the max cwnd increment during slow-start to this number of segments");
207 
208 static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, ecn,
209     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
210     "TCP ECN");
211 
212 VNET_DEFINE(int, tcp_do_ecn) = 2;
213 SYSCTL_INT(_net_inet_tcp_ecn, OID_AUTO, enable, CTLFLAG_VNET | CTLFLAG_RW,
214     &VNET_NAME(tcp_do_ecn), 0,
215     "TCP ECN support");
216 
217 VNET_DEFINE(int, tcp_ecn_maxretries) = 1;
218 SYSCTL_INT(_net_inet_tcp_ecn, OID_AUTO, maxretries, CTLFLAG_VNET | CTLFLAG_RW,
219     &VNET_NAME(tcp_ecn_maxretries), 0,
220     "Max retries before giving up on ECN");
221 
222 VNET_DEFINE(int, tcp_insecure_syn) = 0;
223 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_syn, CTLFLAG_VNET | CTLFLAG_RW,
224     &VNET_NAME(tcp_insecure_syn), 0,
225     "Follow RFC793 instead of RFC5961 criteria for accepting SYN packets");
226 
227 VNET_DEFINE(int, tcp_insecure_rst) = 0;
228 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_VNET | CTLFLAG_RW,
229     &VNET_NAME(tcp_insecure_rst), 0,
230     "Follow RFC793 instead of RFC5961 criteria for accepting RST packets");
231 
232 VNET_DEFINE(int, tcp_recvspace) = 1024*64;
233 #define	V_tcp_recvspace	VNET(tcp_recvspace)
234 SYSCTL_INT(_net_inet_tcp, TCPCTL_RECVSPACE, recvspace, CTLFLAG_VNET | CTLFLAG_RW,
235     &VNET_NAME(tcp_recvspace), 0, "Initial receive socket buffer size");
236 
237 VNET_DEFINE(int, tcp_do_autorcvbuf) = 1;
238 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_VNET | CTLFLAG_RW,
239     &VNET_NAME(tcp_do_autorcvbuf), 0,
240     "Enable automatic receive buffer sizing");
241 
242 VNET_DEFINE(int, tcp_autorcvbuf_max) = 2*1024*1024;
243 SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_max, CTLFLAG_VNET | CTLFLAG_RW,
244     &VNET_NAME(tcp_autorcvbuf_max), 0,
245     "Max size of automatic receive buffer");
246 
247 VNET_DEFINE(struct inpcbhead, tcb);
248 #define	tcb6	tcb  /* for KAME src sync over BSD*'s */
249 VNET_DEFINE(struct inpcbinfo, tcbinfo);
250 
251 /*
252  * TCP statistics are stored in an array of counter(9)s, which size matches
253  * size of struct tcpstat.  TCP running connection count is a regular array.
254  */
255 VNET_PCPUSTAT_DEFINE(struct tcpstat, tcpstat);
256 SYSCTL_VNET_PCPUSTAT(_net_inet_tcp, TCPCTL_STATS, stats, struct tcpstat,
257     tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
258 VNET_DEFINE(counter_u64_t, tcps_states[TCP_NSTATES]);
259 SYSCTL_COUNTER_U64_ARRAY(_net_inet_tcp, TCPCTL_STATES, states, CTLFLAG_RD |
260     CTLFLAG_VNET, &VNET_NAME(tcps_states)[0], TCP_NSTATES,
261     "TCP connection counts by TCP state");
262 
263 static void
264 tcp_vnet_init(const void *unused)
265 {
266 
267 	COUNTER_ARRAY_ALLOC(V_tcps_states, TCP_NSTATES, M_WAITOK);
268 	VNET_PCPUSTAT_ALLOC(tcpstat, M_WAITOK);
269 }
270 VNET_SYSINIT(tcp_vnet_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
271     tcp_vnet_init, NULL);
272 
273 #ifdef VIMAGE
274 static void
275 tcp_vnet_uninit(const void *unused)
276 {
277 
278 	COUNTER_ARRAY_FREE(V_tcps_states, TCP_NSTATES);
279 	VNET_PCPUSTAT_FREE(tcpstat);
280 }
281 VNET_SYSUNINIT(tcp_vnet_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
282     tcp_vnet_uninit, NULL);
283 #endif /* VIMAGE */
284 
285 /*
286  * Kernel module interface for updating tcpstat.  The first argument is an index
287  * into tcpstat treated as an array.
288  */
289 void
290 kmod_tcpstat_add(int statnum, int val)
291 {
292 
293 	counter_u64_add(VNET(tcpstat)[statnum], val);
294 }
295 
296 #ifdef TCP_HHOOK
297 /*
298  * Wrapper for the TCP established input helper hook.
299  */
300 void
301 hhook_run_tcp_est_in(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to)
302 {
303 	struct tcp_hhook_data hhook_data;
304 
305 	if (V_tcp_hhh[HHOOK_TCP_EST_IN]->hhh_nhooks > 0) {
306 		hhook_data.tp = tp;
307 		hhook_data.th = th;
308 		hhook_data.to = to;
309 
310 		hhook_run_hooks(V_tcp_hhh[HHOOK_TCP_EST_IN], &hhook_data,
311 		    tp->osd);
312 	}
313 }
314 #endif
315 
316 /*
317  * CC wrapper hook functions
318  */
319 void
320 cc_ack_received(struct tcpcb *tp, struct tcphdr *th, uint16_t nsegs,
321     uint16_t type)
322 {
323 #ifdef STATS
324 	int32_t gput;
325 #endif
326 
327 	INP_WLOCK_ASSERT(tp->t_inpcb);
328 
329 	tp->ccv->nsegs = nsegs;
330 	tp->ccv->bytes_this_ack = BYTES_THIS_ACK(tp, th);
331 	if ((!V_tcp_do_newcwv && (tp->snd_cwnd <= tp->snd_wnd)) ||
332 	    (V_tcp_do_newcwv && (tp->snd_cwnd <= tp->snd_wnd) &&
333 	     (tp->snd_cwnd < (tcp_compute_pipe(tp) * 2))))
334 		tp->ccv->flags |= CCF_CWND_LIMITED;
335 	else
336 		tp->ccv->flags &= ~CCF_CWND_LIMITED;
337 
338 	if (type == CC_ACK) {
339 #ifdef STATS
340 		stats_voi_update_abs_s32(tp->t_stats, VOI_TCP_CALCFRWINDIFF,
341 		    ((int32_t)tp->snd_cwnd) - tp->snd_wnd);
342 		if (!IN_RECOVERY(tp->t_flags))
343 			stats_voi_update_abs_u32(tp->t_stats, VOI_TCP_ACKLEN,
344 			   tp->ccv->bytes_this_ack / (tcp_maxseg(tp) * nsegs));
345 		if ((tp->t_flags & TF_GPUTINPROG) &&
346 		    SEQ_GEQ(th->th_ack, tp->gput_ack)) {
347 			/*
348 			 * Compute goodput in bits per millisecond.
349 			 */
350 			gput = (((int64_t)(th->th_ack - tp->gput_seq)) << 3) /
351 			    max(1, tcp_ts_getticks() - tp->gput_ts);
352 			stats_voi_update_abs_u32(tp->t_stats, VOI_TCP_GPUT,
353 			    gput);
354 			/*
355 			 * XXXLAS: This is a temporary hack, and should be
356 			 * chained off VOI_TCP_GPUT when stats(9) grows an API
357 			 * to deal with chained VOIs.
358 			 */
359 			if (tp->t_stats_gput_prev > 0)
360 				stats_voi_update_abs_s32(tp->t_stats,
361 				    VOI_TCP_GPUT_ND,
362 				    ((gput - tp->t_stats_gput_prev) * 100) /
363 				    tp->t_stats_gput_prev);
364 			tp->t_flags &= ~TF_GPUTINPROG;
365 			tp->t_stats_gput_prev = gput;
366 		}
367 #endif /* STATS */
368 		if (tp->snd_cwnd > tp->snd_ssthresh) {
369 			tp->t_bytes_acked += tp->ccv->bytes_this_ack;
370 			if (tp->t_bytes_acked >= tp->snd_cwnd) {
371 				tp->t_bytes_acked -= tp->snd_cwnd;
372 				tp->ccv->flags |= CCF_ABC_SENTAWND;
373 			}
374 		} else {
375 				tp->ccv->flags &= ~CCF_ABC_SENTAWND;
376 				tp->t_bytes_acked = 0;
377 		}
378 	}
379 
380 	if (CC_ALGO(tp)->ack_received != NULL) {
381 		/* XXXLAS: Find a way to live without this */
382 		tp->ccv->curack = th->th_ack;
383 		CC_ALGO(tp)->ack_received(tp->ccv, type);
384 	}
385 #ifdef STATS
386 	stats_voi_update_abs_ulong(tp->t_stats, VOI_TCP_LCWIN, tp->snd_cwnd);
387 #endif
388 }
389 
390 void
391 cc_conn_init(struct tcpcb *tp)
392 {
393 	struct hc_metrics_lite metrics;
394 	struct inpcb *inp = tp->t_inpcb;
395 	u_int maxseg;
396 	int rtt;
397 
398 	INP_WLOCK_ASSERT(tp->t_inpcb);
399 
400 	tcp_hc_get(&inp->inp_inc, &metrics);
401 	maxseg = tcp_maxseg(tp);
402 
403 	if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) {
404 		tp->t_srtt = rtt;
405 		tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE;
406 		TCPSTAT_INC(tcps_usedrtt);
407 		if (metrics.rmx_rttvar) {
408 			tp->t_rttvar = metrics.rmx_rttvar;
409 			TCPSTAT_INC(tcps_usedrttvar);
410 		} else {
411 			/* default variation is +- 1 rtt */
412 			tp->t_rttvar =
413 			    tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
414 		}
415 		TCPT_RANGESET(tp->t_rxtcur,
416 		    ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
417 		    tp->t_rttmin, TCPTV_REXMTMAX);
418 	}
419 	if (metrics.rmx_ssthresh) {
420 		/*
421 		 * There's some sort of gateway or interface
422 		 * buffer limit on the path.  Use this to set
423 		 * the slow start threshold, but set the
424 		 * threshold to no less than 2*mss.
425 		 */
426 		tp->snd_ssthresh = max(2 * maxseg, metrics.rmx_ssthresh);
427 		TCPSTAT_INC(tcps_usedssthresh);
428 	}
429 
430 	/*
431 	 * Set the initial slow-start flight size.
432 	 *
433 	 * If a SYN or SYN/ACK was lost and retransmitted, we have to
434 	 * reduce the initial CWND to one segment as congestion is likely
435 	 * requiring us to be cautious.
436 	 */
437 	if (tp->snd_cwnd == 1)
438 		tp->snd_cwnd = maxseg;		/* SYN(-ACK) lost */
439 	else
440 		tp->snd_cwnd = tcp_compute_initwnd(maxseg);
441 
442 	if (CC_ALGO(tp)->conn_init != NULL)
443 		CC_ALGO(tp)->conn_init(tp->ccv);
444 }
445 
446 void inline
447 cc_cong_signal(struct tcpcb *tp, struct tcphdr *th, uint32_t type)
448 {
449 	INP_WLOCK_ASSERT(tp->t_inpcb);
450 
451 #ifdef STATS
452 	stats_voi_update_abs_u32(tp->t_stats, VOI_TCP_CSIG, type);
453 #endif
454 
455 	switch(type) {
456 	case CC_NDUPACK:
457 		if (!IN_FASTRECOVERY(tp->t_flags)) {
458 			tp->snd_recover = tp->snd_max;
459 			if (tp->t_flags2 & TF2_ECN_PERMIT)
460 				tp->t_flags2 |= TF2_ECN_SND_CWR;
461 		}
462 		break;
463 	case CC_ECN:
464 		if (!IN_CONGRECOVERY(tp->t_flags) ||
465 		    /*
466 		     * Allow ECN reaction on ACK to CWR, if
467 		     * that data segment was also CE marked.
468 		     */
469 		    SEQ_GEQ(th->th_ack, tp->snd_recover)) {
470 			EXIT_CONGRECOVERY(tp->t_flags);
471 			TCPSTAT_INC(tcps_ecn_rcwnd);
472 			tp->snd_recover = tp->snd_max + 1;
473 			if (tp->t_flags2 & TF2_ECN_PERMIT)
474 				tp->t_flags2 |= TF2_ECN_SND_CWR;
475 		}
476 		break;
477 	case CC_RTO:
478 		tp->t_dupacks = 0;
479 		tp->t_bytes_acked = 0;
480 		EXIT_RECOVERY(tp->t_flags);
481 		if (tp->t_flags2 & TF2_ECN_PERMIT)
482 			tp->t_flags2 |= TF2_ECN_SND_CWR;
483 		break;
484 	case CC_RTO_ERR:
485 		TCPSTAT_INC(tcps_sndrexmitbad);
486 		/* RTO was unnecessary, so reset everything. */
487 		tp->snd_cwnd = tp->snd_cwnd_prev;
488 		tp->snd_ssthresh = tp->snd_ssthresh_prev;
489 		tp->snd_recover = tp->snd_recover_prev;
490 		if (tp->t_flags & TF_WASFRECOVERY)
491 			ENTER_FASTRECOVERY(tp->t_flags);
492 		if (tp->t_flags & TF_WASCRECOVERY)
493 			ENTER_CONGRECOVERY(tp->t_flags);
494 		tp->snd_nxt = tp->snd_max;
495 		tp->t_flags &= ~TF_PREVVALID;
496 		tp->t_badrxtwin = 0;
497 		break;
498 	}
499 
500 	if (CC_ALGO(tp)->cong_signal != NULL) {
501 		if (th != NULL)
502 			tp->ccv->curack = th->th_ack;
503 		CC_ALGO(tp)->cong_signal(tp->ccv, type);
504 	}
505 }
506 
507 void inline
508 cc_post_recovery(struct tcpcb *tp, struct tcphdr *th)
509 {
510 	INP_WLOCK_ASSERT(tp->t_inpcb);
511 
512 	/* XXXLAS: KASSERT that we're in recovery? */
513 
514 	if (CC_ALGO(tp)->post_recovery != NULL) {
515 		tp->ccv->curack = th->th_ack;
516 		CC_ALGO(tp)->post_recovery(tp->ccv);
517 	}
518 	/* XXXLAS: EXIT_RECOVERY ? */
519 	tp->t_bytes_acked = 0;
520 	tp->sackhint.delivered_data = 0;
521 	tp->sackhint.prr_out = 0;
522 }
523 
524 /*
525  * Indicate whether this ack should be delayed.  We can delay the ack if
526  * following conditions are met:
527  *	- There is no delayed ack timer in progress.
528  *	- Our last ack wasn't a 0-sized window. We never want to delay
529  *	  the ack that opens up a 0-sized window.
530  *	- LRO wasn't used for this segment. We make sure by checking that the
531  *	  segment size is not larger than the MSS.
532  */
533 #define DELAY_ACK(tp, tlen)						\
534 	((!tcp_timer_active(tp, TT_DELACK) &&				\
535 	    (tp->t_flags & TF_RXWIN0SENT) == 0) &&			\
536 	    (tlen <= tp->t_maxseg) &&					\
537 	    (V_tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN)))
538 
539 void inline
540 cc_ecnpkt_handler_flags(struct tcpcb *tp, uint16_t flags, uint8_t iptos)
541 {
542 	INP_WLOCK_ASSERT(tp->t_inpcb);
543 
544 	if (CC_ALGO(tp)->ecnpkt_handler != NULL) {
545 		switch (iptos & IPTOS_ECN_MASK) {
546 		case IPTOS_ECN_CE:
547 			tp->ccv->flags |= CCF_IPHDR_CE;
548 			break;
549 		case IPTOS_ECN_ECT0:
550 			/* FALLTHROUGH */
551 		case IPTOS_ECN_ECT1:
552 			/* FALLTHROUGH */
553 		case IPTOS_ECN_NOTECT:
554 			tp->ccv->flags &= ~CCF_IPHDR_CE;
555 			break;
556 		}
557 
558 		if (flags & TH_CWR)
559 			tp->ccv->flags |= CCF_TCPHDR_CWR;
560 		else
561 			tp->ccv->flags &= ~CCF_TCPHDR_CWR;
562 
563 		CC_ALGO(tp)->ecnpkt_handler(tp->ccv);
564 
565 		if (tp->ccv->flags & CCF_ACKNOW) {
566 			tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
567 			tp->t_flags |= TF_ACKNOW;
568 		}
569 	}
570 }
571 
572 void inline
573 cc_ecnpkt_handler(struct tcpcb *tp, struct tcphdr *th, uint8_t iptos)
574 {
575 	cc_ecnpkt_handler_flags(tp, th->th_flags, iptos);
576 }
577 
578 /*
579  * TCP input handling is split into multiple parts:
580  *   tcp6_input is a thin wrapper around tcp_input for the extended
581  *	ip6_protox[] call format in ip6_input
582  *   tcp_input handles primary segment validation, inpcb lookup and
583  *	SYN processing on listen sockets
584  *   tcp_do_segment processes the ACK and text of the segment for
585  *	establishing, established and closing connections
586  */
587 #ifdef INET6
588 int
589 tcp6_input_with_port(struct mbuf **mp, int *offp, int proto, uint16_t port)
590 {
591 	struct mbuf *m;
592 	struct in6_ifaddr *ia6;
593 	struct ip6_hdr *ip6;
594 
595 	m = *mp;
596 	if (m->m_len < *offp + sizeof(struct tcphdr)) {
597 		m = m_pullup(m, *offp + sizeof(struct tcphdr));
598 		if (m == NULL) {
599 			*mp = m;
600 			TCPSTAT_INC(tcps_rcvshort);
601 			return (IPPROTO_DONE);
602 		}
603 	}
604 
605 	/*
606 	 * draft-itojun-ipv6-tcp-to-anycast
607 	 * better place to put this in?
608 	 */
609 	ip6 = mtod(m, struct ip6_hdr *);
610 	ia6 = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */, false);
611 	if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
612 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
613 			    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
614 		*mp = NULL;
615 		return (IPPROTO_DONE);
616 	}
617 
618 	*mp = m;
619 	return (tcp_input_with_port(mp, offp, proto, port));
620 }
621 
622 int
623 tcp6_input(struct mbuf **mp, int *offp, int proto)
624 {
625 
626 	return(tcp6_input_with_port(mp, offp, proto, 0));
627 }
628 #endif /* INET6 */
629 
630 int
631 tcp_input_with_port(struct mbuf **mp, int *offp, int proto, uint16_t port)
632 {
633 	struct mbuf *m = *mp;
634 	struct tcphdr *th = NULL;
635 	struct ip *ip = NULL;
636 	struct inpcb *inp = NULL;
637 	struct tcpcb *tp = NULL;
638 	struct socket *so = NULL;
639 	u_char *optp = NULL;
640 	int off0;
641 	int optlen = 0;
642 #ifdef INET
643 	int len;
644 	uint8_t ipttl;
645 #endif
646 	int tlen = 0, off;
647 	int drop_hdrlen;
648 	int thflags;
649 	int rstreason = 0;	/* For badport_bandlim accounting purposes */
650 	int lookupflag;
651 	uint8_t iptos;
652 	struct m_tag *fwd_tag = NULL;
653 #ifdef INET6
654 	struct ip6_hdr *ip6 = NULL;
655 	int isipv6;
656 #else
657 	const void *ip6 = NULL;
658 #endif /* INET6 */
659 	struct tcpopt to;		/* options in this segment */
660 	char *s = NULL;			/* address and port logging */
661 #ifdef TCPDEBUG
662 	/*
663 	 * The size of tcp_saveipgen must be the size of the max ip header,
664 	 * now IPv6.
665 	 */
666 	u_char tcp_saveipgen[IP6_HDR_LEN];
667 	struct tcphdr tcp_savetcp;
668 	short ostate = 0;
669 #endif
670 
671 	NET_EPOCH_ASSERT();
672 
673 #ifdef INET6
674 	isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
675 #endif
676 
677 	off0 = *offp;
678 	m = *mp;
679 	*mp = NULL;
680 	to.to_flags = 0;
681 	TCPSTAT_INC(tcps_rcvtotal);
682 
683 #ifdef INET6
684 	if (isipv6) {
685 		ip6 = mtod(m, struct ip6_hdr *);
686 		th = (struct tcphdr *)((caddr_t)ip6 + off0);
687 		tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
688 		if (port)
689 			goto skip6_csum;
690 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) {
691 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
692 				th->th_sum = m->m_pkthdr.csum_data;
693 			else
694 				th->th_sum = in6_cksum_pseudo(ip6, tlen,
695 				    IPPROTO_TCP, m->m_pkthdr.csum_data);
696 			th->th_sum ^= 0xffff;
697 		} else
698 			th->th_sum = in6_cksum(m, IPPROTO_TCP, off0, tlen);
699 		if (th->th_sum) {
700 			TCPSTAT_INC(tcps_rcvbadsum);
701 			goto drop;
702 		}
703 	skip6_csum:
704 		/*
705 		 * Be proactive about unspecified IPv6 address in source.
706 		 * As we use all-zero to indicate unbounded/unconnected pcb,
707 		 * unspecified IPv6 address can be used to confuse us.
708 		 *
709 		 * Note that packets with unspecified IPv6 destination is
710 		 * already dropped in ip6_input.
711 		 */
712 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
713 			/* XXX stat */
714 			goto drop;
715 		}
716 		iptos = IPV6_TRAFFIC_CLASS(ip6);
717 	}
718 #endif
719 #if defined(INET) && defined(INET6)
720 	else
721 #endif
722 #ifdef INET
723 	{
724 		/*
725 		 * Get IP and TCP header together in first mbuf.
726 		 * Note: IP leaves IP header in first mbuf.
727 		 */
728 		if (off0 > sizeof (struct ip)) {
729 			ip_stripoptions(m);
730 			off0 = sizeof(struct ip);
731 		}
732 		if (m->m_len < sizeof (struct tcpiphdr)) {
733 			if ((m = m_pullup(m, sizeof (struct tcpiphdr)))
734 			    == NULL) {
735 				TCPSTAT_INC(tcps_rcvshort);
736 				return (IPPROTO_DONE);
737 			}
738 		}
739 		ip = mtod(m, struct ip *);
740 		th = (struct tcphdr *)((caddr_t)ip + off0);
741 		tlen = ntohs(ip->ip_len) - off0;
742 
743 		iptos = ip->ip_tos;
744 		if (port)
745 			goto skip_csum;
746 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
747 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
748 				th->th_sum = m->m_pkthdr.csum_data;
749 			else
750 				th->th_sum = in_pseudo(ip->ip_src.s_addr,
751 				    ip->ip_dst.s_addr,
752 				    htonl(m->m_pkthdr.csum_data + tlen +
753 				    IPPROTO_TCP));
754 			th->th_sum ^= 0xffff;
755 		} else {
756 			struct ipovly *ipov = (struct ipovly *)ip;
757 
758 			/*
759 			 * Checksum extended TCP header and data.
760 			 */
761 			len = off0 + tlen;
762 			ipttl = ip->ip_ttl;
763 			bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
764 			ipov->ih_len = htons(tlen);
765 			th->th_sum = in_cksum(m, len);
766 			/* Reset length for SDT probes. */
767 			ip->ip_len = htons(len);
768 			/* Reset TOS bits */
769 			ip->ip_tos = iptos;
770 			/* Re-initialization for later version check */
771 			ip->ip_ttl = ipttl;
772 			ip->ip_v = IPVERSION;
773 			ip->ip_hl = off0 >> 2;
774 		}
775 	skip_csum:
776 		if (th->th_sum && (port == 0)) {
777 			TCPSTAT_INC(tcps_rcvbadsum);
778 			goto drop;
779 		}
780 	}
781 #endif /* INET */
782 
783 	/*
784 	 * Check that TCP offset makes sense,
785 	 * pull out TCP options and adjust length.		XXX
786 	 */
787 	off = th->th_off << 2;
788 	if (off < sizeof (struct tcphdr) || off > tlen) {
789 		TCPSTAT_INC(tcps_rcvbadoff);
790 		goto drop;
791 	}
792 	tlen -= off;	/* tlen is used instead of ti->ti_len */
793 	if (off > sizeof (struct tcphdr)) {
794 #ifdef INET6
795 		if (isipv6) {
796 			if (m->m_len < off0 + off) {
797 				m = m_pullup(m, off0 + off);
798 				if (m == NULL) {
799 					TCPSTAT_INC(tcps_rcvshort);
800 					return (IPPROTO_DONE);
801 				}
802 			}
803 			ip6 = mtod(m, struct ip6_hdr *);
804 			th = (struct tcphdr *)((caddr_t)ip6 + off0);
805 		}
806 #endif
807 #if defined(INET) && defined(INET6)
808 		else
809 #endif
810 #ifdef INET
811 		{
812 			if (m->m_len < sizeof(struct ip) + off) {
813 				if ((m = m_pullup(m, sizeof (struct ip) + off))
814 				    == NULL) {
815 					TCPSTAT_INC(tcps_rcvshort);
816 					return (IPPROTO_DONE);
817 				}
818 				ip = mtod(m, struct ip *);
819 				th = (struct tcphdr *)((caddr_t)ip + off0);
820 			}
821 		}
822 #endif
823 		optlen = off - sizeof (struct tcphdr);
824 		optp = (u_char *)(th + 1);
825 	}
826 	thflags = th->th_flags;
827 
828 	/*
829 	 * Convert TCP protocol specific fields to host format.
830 	 */
831 	tcp_fields_to_host(th);
832 
833 	/*
834 	 * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options.
835 	 */
836 	drop_hdrlen = off0 + off;
837 
838 	/*
839 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
840 	 */
841         if (
842 #ifdef INET6
843 	    (isipv6 && (m->m_flags & M_IP6_NEXTHOP))
844 #ifdef INET
845 	    || (!isipv6 && (m->m_flags & M_IP_NEXTHOP))
846 #endif
847 #endif
848 #if defined(INET) && !defined(INET6)
849 	    (m->m_flags & M_IP_NEXTHOP)
850 #endif
851 	    )
852 		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
853 
854 	/*
855 	 * For initial SYN packets we don't need write lock on matching
856 	 * PCB, be it a listening one or a synchronized one.  The packet
857 	 * shall not modify its state.
858 	 */
859 	lookupflag = (thflags & (TH_ACK|TH_SYN)) == TH_SYN ?
860 	    INPLOOKUP_RLOCKPCB : INPLOOKUP_WLOCKPCB;
861 findpcb:
862 #ifdef INET6
863 	if (isipv6 && fwd_tag != NULL) {
864 		struct sockaddr_in6 *next_hop6;
865 
866 		next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1);
867 		/*
868 		 * Transparently forwarded. Pretend to be the destination.
869 		 * Already got one like this?
870 		 */
871 		inp = in6_pcblookup_mbuf(&V_tcbinfo,
872 		    &ip6->ip6_src, th->th_sport, &ip6->ip6_dst, th->th_dport,
873 		    lookupflag, m->m_pkthdr.rcvif, m);
874 		if (!inp) {
875 			/*
876 			 * It's new.  Try to find the ambushing socket.
877 			 * Because we've rewritten the destination address,
878 			 * any hardware-generated hash is ignored.
879 			 */
880 			inp = in6_pcblookup(&V_tcbinfo, &ip6->ip6_src,
881 			    th->th_sport, &next_hop6->sin6_addr,
882 			    next_hop6->sin6_port ? ntohs(next_hop6->sin6_port) :
883 			    th->th_dport, INPLOOKUP_WILDCARD | lookupflag,
884 			    m->m_pkthdr.rcvif);
885 		}
886 	} else if (isipv6) {
887 		inp = in6_pcblookup_mbuf(&V_tcbinfo, &ip6->ip6_src,
888 		    th->th_sport, &ip6->ip6_dst, th->th_dport,
889 		    INPLOOKUP_WILDCARD | lookupflag, m->m_pkthdr.rcvif, m);
890 	}
891 #endif /* INET6 */
892 #if defined(INET6) && defined(INET)
893 	else
894 #endif
895 #ifdef INET
896 	if (fwd_tag != NULL) {
897 		struct sockaddr_in *next_hop;
898 
899 		next_hop = (struct sockaddr_in *)(fwd_tag+1);
900 		/*
901 		 * Transparently forwarded. Pretend to be the destination.
902 		 * already got one like this?
903 		 */
904 		inp = in_pcblookup_mbuf(&V_tcbinfo, ip->ip_src, th->th_sport,
905 		    ip->ip_dst, th->th_dport, lookupflag, m->m_pkthdr.rcvif, m);
906 		if (!inp) {
907 			/*
908 			 * It's new.  Try to find the ambushing socket.
909 			 * Because we've rewritten the destination address,
910 			 * any hardware-generated hash is ignored.
911 			 */
912 			inp = in_pcblookup(&V_tcbinfo, ip->ip_src,
913 			    th->th_sport, next_hop->sin_addr,
914 			    next_hop->sin_port ? ntohs(next_hop->sin_port) :
915 			    th->th_dport, INPLOOKUP_WILDCARD | lookupflag,
916 			    m->m_pkthdr.rcvif);
917 		}
918 	} else
919 		inp = in_pcblookup_mbuf(&V_tcbinfo, ip->ip_src,
920 		    th->th_sport, ip->ip_dst, th->th_dport,
921 		    INPLOOKUP_WILDCARD | lookupflag, m->m_pkthdr.rcvif, m);
922 #endif /* INET */
923 
924 	/*
925 	 * If the INPCB does not exist then all data in the incoming
926 	 * segment is discarded and an appropriate RST is sent back.
927 	 * XXX MRT Send RST using which routing table?
928 	 */
929 	if (inp == NULL) {
930 		/*
931 		 * Log communication attempts to ports that are not
932 		 * in use.
933 		 */
934 		if ((V_tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
935 		    V_tcp_log_in_vain == 2) {
936 			if ((s = tcp_log_vain(NULL, th, (void *)ip, ip6)))
937 				log(LOG_INFO, "%s; %s: Connection attempt "
938 				    "to closed port\n", s, __func__);
939 		}
940 		/*
941 		 * When blackholing do not respond with a RST but
942 		 * completely ignore the segment and drop it.
943 		 */
944 		if (((V_blackhole == 1 && (thflags & TH_SYN)) ||
945 		    V_blackhole == 2) && (V_blackhole_local ||
946 #ifdef INET6
947 		    isipv6 ? !in6_localaddr(&ip6->ip6_src) :
948 #endif
949 #ifdef INET
950 		    !in_localip(ip->ip_src)
951 #else
952 		    true
953 #endif
954 		    ))
955 			goto dropunlock;
956 
957 		rstreason = BANDLIM_RST_CLOSEDPORT;
958 		goto dropwithreset;
959 	}
960 	INP_LOCK_ASSERT(inp);
961 	/*
962 	 * While waiting for inp lock during the lookup, another thread
963 	 * can have dropped the inpcb, in which case we need to loop back
964 	 * and try to find a new inpcb to deliver to.
965 	 */
966 	if (inp->inp_flags & INP_DROPPED) {
967 		INP_UNLOCK(inp);
968 		inp = NULL;
969 		goto findpcb;
970 	}
971 	if ((inp->inp_flowtype == M_HASHTYPE_NONE) &&
972 	    (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) &&
973 	    ((inp->inp_socket == NULL) || !SOLISTENING(inp->inp_socket))) {
974 		inp->inp_flowid = m->m_pkthdr.flowid;
975 		inp->inp_flowtype = M_HASHTYPE_GET(m);
976 	}
977 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
978 #ifdef INET6
979 	if (isipv6 && IPSEC_ENABLED(ipv6) &&
980 	    IPSEC_CHECK_POLICY(ipv6, m, inp) != 0) {
981 		goto dropunlock;
982 	}
983 #ifdef INET
984 	else
985 #endif
986 #endif /* INET6 */
987 #ifdef INET
988 	if (IPSEC_ENABLED(ipv4) &&
989 	    IPSEC_CHECK_POLICY(ipv4, m, inp) != 0) {
990 		goto dropunlock;
991 	}
992 #endif /* INET */
993 #endif /* IPSEC */
994 
995 	/*
996 	 * Check the minimum TTL for socket.
997 	 */
998 	if (inp->inp_ip_minttl != 0) {
999 #ifdef INET6
1000 		if (isipv6) {
1001 			if (inp->inp_ip_minttl > ip6->ip6_hlim)
1002 				goto dropunlock;
1003 		} else
1004 #endif
1005 		if (inp->inp_ip_minttl > ip->ip_ttl)
1006 			goto dropunlock;
1007 	}
1008 
1009 	/*
1010 	 * A previous connection in TIMEWAIT state is supposed to catch stray
1011 	 * or duplicate segments arriving late.  If this segment was a
1012 	 * legitimate new connection attempt, the old INPCB gets removed and
1013 	 * we can try again to find a listening socket.
1014 	 */
1015 	if (inp->inp_flags & INP_TIMEWAIT) {
1016 		tcp_dooptions(&to, optp, optlen,
1017 		    (thflags & TH_SYN) ? TO_SYN : 0);
1018 		/*
1019 		 * NB: tcp_twcheck unlocks the INP and frees the mbuf.
1020 		 */
1021 		if (tcp_twcheck(inp, &to, th, m, tlen))
1022 			goto findpcb;
1023 		return (IPPROTO_DONE);
1024 	}
1025 	/*
1026 	 * The TCPCB may no longer exist if the connection is winding
1027 	 * down or it is in the CLOSED state.  Either way we drop the
1028 	 * segment and send an appropriate response.
1029 	 */
1030 	tp = intotcpcb(inp);
1031 	if (tp == NULL || tp->t_state == TCPS_CLOSED) {
1032 		rstreason = BANDLIM_RST_CLOSEDPORT;
1033 		goto dropwithreset;
1034 	}
1035 
1036 	if ((tp->t_port != port) && (tp->t_state > TCPS_LISTEN)) {
1037 		rstreason = BANDLIM_RST_CLOSEDPORT;
1038 		goto dropwithreset;
1039 	}
1040 
1041 #ifdef TCP_OFFLOAD
1042 	if (tp->t_flags & TF_TOE) {
1043 		tcp_offload_input(tp, m);
1044 		m = NULL;	/* consumed by the TOE driver */
1045 		goto dropunlock;
1046 	}
1047 #endif
1048 
1049 #ifdef MAC
1050 	if (mac_inpcb_check_deliver(inp, m))
1051 		goto dropunlock;
1052 #endif
1053 	so = inp->inp_socket;
1054 	KASSERT(so != NULL, ("%s: so == NULL", __func__));
1055 #ifdef TCPDEBUG
1056 	if (so->so_options & SO_DEBUG) {
1057 		ostate = tp->t_state;
1058 #ifdef INET6
1059 		if (isipv6) {
1060 			bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6));
1061 		} else
1062 #endif
1063 			bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
1064 		tcp_savetcp = *th;
1065 	}
1066 #endif /* TCPDEBUG */
1067 	/*
1068 	 * When the socket is accepting connections (the INPCB is in LISTEN
1069 	 * state) we look into the SYN cache if this is a new connection
1070 	 * attempt or the completion of a previous one.
1071 	 */
1072 	KASSERT(tp->t_state == TCPS_LISTEN || !SOLISTENING(so),
1073 	    ("%s: so accepting but tp %p not listening", __func__, tp));
1074 	if (tp->t_state == TCPS_LISTEN && SOLISTENING(so)) {
1075 		struct in_conninfo inc;
1076 
1077 		bzero(&inc, sizeof(inc));
1078 #ifdef INET6
1079 		if (isipv6) {
1080 			inc.inc_flags |= INC_ISIPV6;
1081 			if (inp->inp_inc.inc_flags & INC_IPV6MINMTU)
1082 				inc.inc_flags |= INC_IPV6MINMTU;
1083 			inc.inc6_faddr = ip6->ip6_src;
1084 			inc.inc6_laddr = ip6->ip6_dst;
1085 		} else
1086 #endif
1087 		{
1088 			inc.inc_faddr = ip->ip_src;
1089 			inc.inc_laddr = ip->ip_dst;
1090 		}
1091 		inc.inc_fport = th->th_sport;
1092 		inc.inc_lport = th->th_dport;
1093 		inc.inc_fibnum = so->so_fibnum;
1094 
1095 		/*
1096 		 * Check for an existing connection attempt in syncache if
1097 		 * the flag is only ACK.  A successful lookup creates a new
1098 		 * socket appended to the listen queue in SYN_RECEIVED state.
1099 		 */
1100 		if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
1101 			/*
1102 			 * Parse the TCP options here because
1103 			 * syncookies need access to the reflected
1104 			 * timestamp.
1105 			 */
1106 			tcp_dooptions(&to, optp, optlen, 0);
1107 			/*
1108 			 * NB: syncache_expand() doesn't unlock
1109 			 * inp and tcpinfo locks.
1110 			 */
1111 			rstreason = syncache_expand(&inc, &to, th, &so, m, port);
1112 			if (rstreason < 0) {
1113 				/*
1114 				 * A failing TCP MD5 signature comparison
1115 				 * must result in the segment being dropped
1116 				 * and must not produce any response back
1117 				 * to the sender.
1118 				 */
1119 				goto dropunlock;
1120 			} else if (rstreason == 0) {
1121 				/*
1122 				 * No syncache entry or ACK was not
1123 				 * for our SYN/ACK.  Send a RST.
1124 				 * NB: syncache did its own logging
1125 				 * of the failure cause.
1126 				 */
1127 				rstreason = BANDLIM_RST_OPENPORT;
1128 				goto dropwithreset;
1129 			}
1130 tfo_socket_result:
1131 			if (so == NULL) {
1132 				/*
1133 				 * We completed the 3-way handshake
1134 				 * but could not allocate a socket
1135 				 * either due to memory shortage,
1136 				 * listen queue length limits or
1137 				 * global socket limits.  Send RST
1138 				 * or wait and have the remote end
1139 				 * retransmit the ACK for another
1140 				 * try.
1141 				 */
1142 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1143 					log(LOG_DEBUG, "%s; %s: Listen socket: "
1144 					    "Socket allocation failed due to "
1145 					    "limits or memory shortage, %s\n",
1146 					    s, __func__,
1147 					    V_tcp_sc_rst_sock_fail ?
1148 					    "sending RST" : "try again");
1149 				if (V_tcp_sc_rst_sock_fail) {
1150 					rstreason = BANDLIM_UNLIMITED;
1151 					goto dropwithreset;
1152 				} else
1153 					goto dropunlock;
1154 			}
1155 			/*
1156 			 * Socket is created in state SYN_RECEIVED.
1157 			 * Unlock the listen socket, lock the newly
1158 			 * created socket and update the tp variable.
1159 			 * If we came here via jump to tfo_socket_result,
1160 			 * then listening socket is read-locked.
1161 			 */
1162 			INP_UNLOCK(inp);	/* listen socket */
1163 			inp = sotoinpcb(so);
1164 			/*
1165 			 * New connection inpcb is already locked by
1166 			 * syncache_expand().
1167 			 */
1168 			INP_WLOCK_ASSERT(inp);
1169 			tp = intotcpcb(inp);
1170 			KASSERT(tp->t_state == TCPS_SYN_RECEIVED,
1171 			    ("%s: ", __func__));
1172 			/*
1173 			 * Process the segment and the data it
1174 			 * contains.  tcp_do_segment() consumes
1175 			 * the mbuf chain and unlocks the inpcb.
1176 			 */
1177 			TCP_PROBE5(receive, NULL, tp, m, tp, th);
1178 			tp->t_fb->tfb_tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen,
1179 			    iptos);
1180 			return (IPPROTO_DONE);
1181 		}
1182 		/*
1183 		 * Segment flag validation for new connection attempts:
1184 		 *
1185 		 * Our (SYN|ACK) response was rejected.
1186 		 * Check with syncache and remove entry to prevent
1187 		 * retransmits.
1188 		 *
1189 		 * NB: syncache_chkrst does its own logging of failure
1190 		 * causes.
1191 		 */
1192 		if (thflags & TH_RST) {
1193 			syncache_chkrst(&inc, th, m, port);
1194 			goto dropunlock;
1195 		}
1196 		/*
1197 		 * We can't do anything without SYN.
1198 		 */
1199 		if ((thflags & TH_SYN) == 0) {
1200 			if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1201 				log(LOG_DEBUG, "%s; %s: Listen socket: "
1202 				    "SYN is missing, segment ignored\n",
1203 				    s, __func__);
1204 			TCPSTAT_INC(tcps_badsyn);
1205 			goto dropunlock;
1206 		}
1207 		/*
1208 		 * (SYN|ACK) is bogus on a listen socket.
1209 		 */
1210 		if (thflags & TH_ACK) {
1211 			if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1212 				log(LOG_DEBUG, "%s; %s: Listen socket: "
1213 				    "SYN|ACK invalid, segment rejected\n",
1214 				    s, __func__);
1215 			syncache_badack(&inc, port);	/* XXX: Not needed! */
1216 			TCPSTAT_INC(tcps_badsyn);
1217 			rstreason = BANDLIM_RST_OPENPORT;
1218 			goto dropwithreset;
1219 		}
1220 		/*
1221 		 * If the drop_synfin option is enabled, drop all
1222 		 * segments with both the SYN and FIN bits set.
1223 		 * This prevents e.g. nmap from identifying the
1224 		 * TCP/IP stack.
1225 		 * XXX: Poor reasoning.  nmap has other methods
1226 		 * and is constantly refining its stack detection
1227 		 * strategies.
1228 		 * XXX: This is a violation of the TCP specification
1229 		 * and was used by RFC1644.
1230 		 */
1231 		if ((thflags & TH_FIN) && V_drop_synfin) {
1232 			if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1233 				log(LOG_DEBUG, "%s; %s: Listen socket: "
1234 				    "SYN|FIN segment ignored (based on "
1235 				    "sysctl setting)\n", s, __func__);
1236 			TCPSTAT_INC(tcps_badsyn);
1237 			goto dropunlock;
1238 		}
1239 		/*
1240 		 * Segment's flags are (SYN) or (SYN|FIN).
1241 		 *
1242 		 * TH_PUSH, TH_URG, TH_ECE, TH_CWR are ignored
1243 		 * as they do not affect the state of the TCP FSM.
1244 		 * The data pointed to by TH_URG and th_urp is ignored.
1245 		 */
1246 		KASSERT((thflags & (TH_RST|TH_ACK)) == 0,
1247 		    ("%s: Listen socket: TH_RST or TH_ACK set", __func__));
1248 		KASSERT(thflags & (TH_SYN),
1249 		    ("%s: Listen socket: TH_SYN not set", __func__));
1250 		INP_RLOCK_ASSERT(inp);
1251 #ifdef INET6
1252 		/*
1253 		 * If deprecated address is forbidden,
1254 		 * we do not accept SYN to deprecated interface
1255 		 * address to prevent any new inbound connection from
1256 		 * getting established.
1257 		 * When we do not accept SYN, we send a TCP RST,
1258 		 * with deprecated source address (instead of dropping
1259 		 * it).  We compromise it as it is much better for peer
1260 		 * to send a RST, and RST will be the final packet
1261 		 * for the exchange.
1262 		 *
1263 		 * If we do not forbid deprecated addresses, we accept
1264 		 * the SYN packet.  RFC2462 does not suggest dropping
1265 		 * SYN in this case.
1266 		 * If we decipher RFC2462 5.5.4, it says like this:
1267 		 * 1. use of deprecated addr with existing
1268 		 *    communication is okay - "SHOULD continue to be
1269 		 *    used"
1270 		 * 2. use of it with new communication:
1271 		 *   (2a) "SHOULD NOT be used if alternate address
1272 		 *        with sufficient scope is available"
1273 		 *   (2b) nothing mentioned otherwise.
1274 		 * Here we fall into (2b) case as we have no choice in
1275 		 * our source address selection - we must obey the peer.
1276 		 *
1277 		 * The wording in RFC2462 is confusing, and there are
1278 		 * multiple description text for deprecated address
1279 		 * handling - worse, they are not exactly the same.
1280 		 * I believe 5.5.4 is the best one, so we follow 5.5.4.
1281 		 */
1282 		if (isipv6 && !V_ip6_use_deprecated) {
1283 			struct in6_ifaddr *ia6;
1284 
1285 			ia6 = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */, false);
1286 			if (ia6 != NULL &&
1287 			    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1288 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1289 				    log(LOG_DEBUG, "%s; %s: Listen socket: "
1290 					"Connection attempt to deprecated "
1291 					"IPv6 address rejected\n",
1292 					s, __func__);
1293 				rstreason = BANDLIM_RST_OPENPORT;
1294 				goto dropwithreset;
1295 			}
1296 		}
1297 #endif /* INET6 */
1298 		/*
1299 		 * Basic sanity checks on incoming SYN requests:
1300 		 *   Don't respond if the destination is a link layer
1301 		 *	broadcast according to RFC1122 4.2.3.10, p. 104.
1302 		 *   If it is from this socket it must be forged.
1303 		 *   Don't respond if the source or destination is a
1304 		 *	global or subnet broad- or multicast address.
1305 		 *   Note that it is quite possible to receive unicast
1306 		 *	link-layer packets with a broadcast IP address. Use
1307 		 *	in_broadcast() to find them.
1308 		 */
1309 		if (m->m_flags & (M_BCAST|M_MCAST)) {
1310 			if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1311 			    log(LOG_DEBUG, "%s; %s: Listen socket: "
1312 				"Connection attempt from broad- or multicast "
1313 				"link layer address ignored\n", s, __func__);
1314 			goto dropunlock;
1315 		}
1316 #ifdef INET6
1317 		if (isipv6) {
1318 			if (th->th_dport == th->th_sport &&
1319 			    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) {
1320 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1321 				    log(LOG_DEBUG, "%s; %s: Listen socket: "
1322 					"Connection attempt to/from self "
1323 					"ignored\n", s, __func__);
1324 				goto dropunlock;
1325 			}
1326 			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1327 			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
1328 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1329 				    log(LOG_DEBUG, "%s; %s: Listen socket: "
1330 					"Connection attempt from/to multicast "
1331 					"address ignored\n", s, __func__);
1332 				goto dropunlock;
1333 			}
1334 		}
1335 #endif
1336 #if defined(INET) && defined(INET6)
1337 		else
1338 #endif
1339 #ifdef INET
1340 		{
1341 			if (th->th_dport == th->th_sport &&
1342 			    ip->ip_dst.s_addr == ip->ip_src.s_addr) {
1343 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1344 				    log(LOG_DEBUG, "%s; %s: Listen socket: "
1345 					"Connection attempt from/to self "
1346 					"ignored\n", s, __func__);
1347 				goto dropunlock;
1348 			}
1349 			if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
1350 			    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
1351 			    ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
1352 			    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
1353 				if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1354 				    log(LOG_DEBUG, "%s; %s: Listen socket: "
1355 					"Connection attempt from/to broad- "
1356 					"or multicast address ignored\n",
1357 					s, __func__);
1358 				goto dropunlock;
1359 			}
1360 		}
1361 #endif
1362 		/*
1363 		 * SYN appears to be valid.  Create compressed TCP state
1364 		 * for syncache.
1365 		 */
1366 #ifdef TCPDEBUG
1367 		if (so->so_options & SO_DEBUG)
1368 			tcp_trace(TA_INPUT, ostate, tp,
1369 			    (void *)tcp_saveipgen, &tcp_savetcp, 0);
1370 #endif
1371 		TCP_PROBE3(debug__input, tp, th, m);
1372 		tcp_dooptions(&to, optp, optlen, TO_SYN);
1373 		if ((so = syncache_add(&inc, &to, th, inp, so, m, NULL, NULL,
1374 		    iptos, port)) != NULL)
1375 			goto tfo_socket_result;
1376 
1377 		/*
1378 		 * Entry added to syncache and mbuf consumed.
1379 		 * Only the listen socket is unlocked by syncache_add().
1380 		 */
1381 		return (IPPROTO_DONE);
1382 	} else if (tp->t_state == TCPS_LISTEN) {
1383 		/*
1384 		 * When a listen socket is torn down the SO_ACCEPTCONN
1385 		 * flag is removed first while connections are drained
1386 		 * from the accept queue in a unlock/lock cycle of the
1387 		 * ACCEPT_LOCK, opening a race condition allowing a SYN
1388 		 * attempt go through unhandled.
1389 		 */
1390 		goto dropunlock;
1391 	}
1392 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
1393 	if (tp->t_flags & TF_SIGNATURE) {
1394 		tcp_dooptions(&to, optp, optlen, thflags);
1395 		if ((to.to_flags & TOF_SIGNATURE) == 0) {
1396 			TCPSTAT_INC(tcps_sig_err_nosigopt);
1397 			goto dropunlock;
1398 		}
1399 		if (!TCPMD5_ENABLED() ||
1400 		    TCPMD5_INPUT(m, th, to.to_signature) != 0)
1401 			goto dropunlock;
1402 	}
1403 #endif
1404 	TCP_PROBE5(receive, NULL, tp, m, tp, th);
1405 
1406 	/*
1407 	 * Segment belongs to a connection in SYN_SENT, ESTABLISHED or later
1408 	 * state.  tcp_do_segment() always consumes the mbuf chain, unlocks
1409 	 * the inpcb, and unlocks pcbinfo.
1410 	 *
1411 	 * XXXGL: in case of a pure SYN arriving on existing connection
1412 	 * TCP stacks won't need to modify the PCB, they would either drop
1413 	 * the segment silently, or send a challenge ACK.  However, we try
1414 	 * to upgrade the lock, because calling convention for stacks is
1415 	 * write-lock on PCB.  If upgrade fails, drop the SYN.
1416 	 */
1417 	if (lookupflag == INPLOOKUP_RLOCKPCB && INP_TRY_UPGRADE(inp) == 0)
1418 		goto dropunlock;
1419 
1420 	tp->t_fb->tfb_tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos);
1421 	return (IPPROTO_DONE);
1422 
1423 dropwithreset:
1424 	TCP_PROBE5(receive, NULL, tp, m, tp, th);
1425 
1426 	if (inp != NULL) {
1427 		tcp_dropwithreset(m, th, tp, tlen, rstreason);
1428 		INP_UNLOCK(inp);
1429 	} else
1430 		tcp_dropwithreset(m, th, NULL, tlen, rstreason);
1431 	m = NULL;	/* mbuf chain got consumed. */
1432 	goto drop;
1433 
1434 dropunlock:
1435 	if (m != NULL)
1436 		TCP_PROBE5(receive, NULL, tp, m, tp, th);
1437 
1438 	if (inp != NULL)
1439 		INP_UNLOCK(inp);
1440 
1441 drop:
1442 	if (s != NULL)
1443 		free(s, M_TCPLOG);
1444 	if (m != NULL)
1445 		m_freem(m);
1446 	return (IPPROTO_DONE);
1447 }
1448 
1449 /*
1450  * Automatic sizing of receive socket buffer.  Often the send
1451  * buffer size is not optimally adjusted to the actual network
1452  * conditions at hand (delay bandwidth product).  Setting the
1453  * buffer size too small limits throughput on links with high
1454  * bandwidth and high delay (eg. trans-continental/oceanic links).
1455  *
1456  * On the receive side the socket buffer memory is only rarely
1457  * used to any significant extent.  This allows us to be much
1458  * more aggressive in scaling the receive socket buffer.  For
1459  * the case that the buffer space is actually used to a large
1460  * extent and we run out of kernel memory we can simply drop
1461  * the new segments; TCP on the sender will just retransmit it
1462  * later.  Setting the buffer size too big may only consume too
1463  * much kernel memory if the application doesn't read() from
1464  * the socket or packet loss or reordering makes use of the
1465  * reassembly queue.
1466  *
1467  * The criteria to step up the receive buffer one notch are:
1468  *  1. Application has not set receive buffer size with
1469  *     SO_RCVBUF. Setting SO_RCVBUF clears SB_AUTOSIZE.
1470  *  2. the number of bytes received during 1/2 of an sRTT
1471  *     is at least 3/8 of the current socket buffer size.
1472  *  3. receive buffer size has not hit maximal automatic size;
1473  *
1474  * If all of the criteria are met we increaset the socket buffer
1475  * by a 1/2 (bounded by the max). This allows us to keep ahead
1476  * of slow-start but also makes it so our peer never gets limited
1477  * by our rwnd which we then open up causing a burst.
1478  *
1479  * This algorithm does two steps per RTT at most and only if
1480  * we receive a bulk stream w/o packet losses or reorderings.
1481  * Shrinking the buffer during idle times is not necessary as
1482  * it doesn't consume any memory when idle.
1483  *
1484  * TODO: Only step up if the application is actually serving
1485  * the buffer to better manage the socket buffer resources.
1486  */
1487 int
1488 tcp_autorcvbuf(struct mbuf *m, struct tcphdr *th, struct socket *so,
1489     struct tcpcb *tp, int tlen)
1490 {
1491 	int newsize = 0;
1492 
1493 	if (V_tcp_do_autorcvbuf && (so->so_rcv.sb_flags & SB_AUTOSIZE) &&
1494 	    tp->t_srtt != 0 && tp->rfbuf_ts != 0 &&
1495 	    TCP_TS_TO_TICKS(tcp_ts_getticks() - tp->rfbuf_ts) >
1496 	    ((tp->t_srtt >> TCP_RTT_SHIFT)/2)) {
1497 		if (tp->rfbuf_cnt > ((so->so_rcv.sb_hiwat / 2)/ 4 * 3) &&
1498 		    so->so_rcv.sb_hiwat < V_tcp_autorcvbuf_max) {
1499 			newsize = min((so->so_rcv.sb_hiwat + (so->so_rcv.sb_hiwat/2)), V_tcp_autorcvbuf_max);
1500 		}
1501 		TCP_PROBE6(receive__autoresize, NULL, tp, m, tp, th, newsize);
1502 
1503 		/* Start over with next RTT. */
1504 		tp->rfbuf_ts = 0;
1505 		tp->rfbuf_cnt = 0;
1506 	} else {
1507 		tp->rfbuf_cnt += tlen;	/* add up */
1508 	}
1509 	return (newsize);
1510 }
1511 
1512 int
1513 tcp_input(struct mbuf **mp, int *offp, int proto)
1514 {
1515 	return(tcp_input_with_port(mp, offp, proto, 0));
1516 }
1517 
1518 void
1519 tcp_handle_wakeup(struct tcpcb *tp, struct socket *so)
1520 {
1521 	/*
1522 	 * Since tp might be gone if the session entered
1523 	 * the TIME_WAIT state before coming here, we need
1524 	 * to check if the socket is still connected.
1525 	 */
1526 	if (tp == NULL) {
1527 		return;
1528 	}
1529 	if (so == NULL) {
1530 		return;
1531 	}
1532 	INP_LOCK_ASSERT(tp->t_inpcb);
1533 	if (tp->t_flags & TF_WAKESOR) {
1534 		tp->t_flags &= ~TF_WAKESOR;
1535 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1536 		sorwakeup_locked(so);
1537 	}
1538 }
1539 
1540 void
1541 tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so,
1542     struct tcpcb *tp, int drop_hdrlen, int tlen, uint8_t iptos)
1543 {
1544 	int thflags, acked, ourfinisacked, needoutput = 0, sack_changed;
1545 	int rstreason, todrop, win, incforsyn = 0;
1546 	uint32_t tiwin;
1547 	uint16_t nsegs;
1548 	char *s;
1549 	struct in_conninfo *inc;
1550 	struct mbuf *mfree;
1551 	struct tcpopt to;
1552 	int tfo_syn;
1553 	u_int maxseg;
1554 
1555 #ifdef TCPDEBUG
1556 	/*
1557 	 * The size of tcp_saveipgen must be the size of the max ip header,
1558 	 * now IPv6.
1559 	 */
1560 	u_char tcp_saveipgen[IP6_HDR_LEN];
1561 	struct tcphdr tcp_savetcp;
1562 	short ostate = 0;
1563 #endif
1564 	thflags = th->th_flags;
1565 	inc = &tp->t_inpcb->inp_inc;
1566 	tp->sackhint.last_sack_ack = 0;
1567 	sack_changed = 0;
1568 	nsegs = max(1, m->m_pkthdr.lro_nsegs);
1569 
1570 	NET_EPOCH_ASSERT();
1571 	INP_WLOCK_ASSERT(tp->t_inpcb);
1572 	KASSERT(tp->t_state > TCPS_LISTEN, ("%s: TCPS_LISTEN",
1573 	    __func__));
1574 	KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
1575 	    __func__));
1576 
1577 #ifdef TCPPCAP
1578 	/* Save segment, if requested. */
1579 	tcp_pcap_add(th, m, &(tp->t_inpkts));
1580 #endif
1581 	TCP_LOG_EVENT(tp, th, &so->so_rcv, &so->so_snd, TCP_LOG_IN, 0,
1582 	    tlen, NULL, true);
1583 
1584 	if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
1585 		if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1586 			log(LOG_DEBUG, "%s; %s: "
1587 			    "SYN|FIN segment ignored (based on "
1588 			    "sysctl setting)\n", s, __func__);
1589 			free(s, M_TCPLOG);
1590 		}
1591 		goto drop;
1592 	}
1593 
1594 	/*
1595 	 * If a segment with the ACK-bit set arrives in the SYN-SENT state
1596 	 * check SEQ.ACK first.
1597 	 */
1598 	if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) &&
1599 	    (SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) {
1600 		rstreason = BANDLIM_UNLIMITED;
1601 		goto dropwithreset;
1602 	}
1603 
1604 	/*
1605 	 * Segment received on connection.
1606 	 * Reset idle time and keep-alive timer.
1607 	 * XXX: This should be done after segment
1608 	 * validation to ignore broken/spoofed segs.
1609 	 */
1610 	tp->t_rcvtime = ticks;
1611 
1612 	/*
1613 	 * Scale up the window into a 32-bit value.
1614 	 * For the SYN_SENT state the scale is zero.
1615 	 */
1616 	tiwin = th->th_win << tp->snd_scale;
1617 #ifdef STATS
1618 	stats_voi_update_abs_ulong(tp->t_stats, VOI_TCP_FRWIN, tiwin);
1619 #endif
1620 
1621 	/*
1622 	 * TCP ECN processing.
1623 	 */
1624 	if (tp->t_flags2 & TF2_ECN_PERMIT) {
1625 		if (thflags & TH_CWR) {
1626 			tp->t_flags2 &= ~TF2_ECN_SND_ECE;
1627 			tp->t_flags |= TF_ACKNOW;
1628 		}
1629 		switch (iptos & IPTOS_ECN_MASK) {
1630 		case IPTOS_ECN_CE:
1631 			tp->t_flags2 |= TF2_ECN_SND_ECE;
1632 			TCPSTAT_INC(tcps_ecn_ce);
1633 			break;
1634 		case IPTOS_ECN_ECT0:
1635 			TCPSTAT_INC(tcps_ecn_ect0);
1636 			break;
1637 		case IPTOS_ECN_ECT1:
1638 			TCPSTAT_INC(tcps_ecn_ect1);
1639 			break;
1640 		}
1641 
1642 		/* Process a packet differently from RFC3168. */
1643 		cc_ecnpkt_handler(tp, th, iptos);
1644 
1645 		/* Congestion experienced. */
1646 		if (thflags & TH_ECE) {
1647 			cc_cong_signal(tp, th, CC_ECN);
1648 		}
1649 	}
1650 
1651 	/*
1652 	 * Parse options on any incoming segment.
1653 	 */
1654 	tcp_dooptions(&to, (u_char *)(th + 1),
1655 	    (th->th_off << 2) - sizeof(struct tcphdr),
1656 	    (thflags & TH_SYN) ? TO_SYN : 0);
1657 
1658 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
1659 	if ((tp->t_flags & TF_SIGNATURE) != 0 &&
1660 	    (to.to_flags & TOF_SIGNATURE) == 0) {
1661 		TCPSTAT_INC(tcps_sig_err_sigopt);
1662 		/* XXX: should drop? */
1663 	}
1664 #endif
1665 	/*
1666 	 * If echoed timestamp is later than the current time,
1667 	 * fall back to non RFC1323 RTT calculation.  Normalize
1668 	 * timestamp if syncookies were used when this connection
1669 	 * was established.
1670 	 */
1671 	if ((to.to_flags & TOF_TS) && (to.to_tsecr != 0)) {
1672 		to.to_tsecr -= tp->ts_offset;
1673 		if (TSTMP_GT(to.to_tsecr, tcp_ts_getticks()))
1674 			to.to_tsecr = 0;
1675 		else if (tp->t_flags & TF_PREVVALID &&
1676 			 tp->t_badrxtwin != 0 && SEQ_LT(to.to_tsecr, tp->t_badrxtwin))
1677 			cc_cong_signal(tp, th, CC_RTO_ERR);
1678 	}
1679 	/*
1680 	 * Process options only when we get SYN/ACK back. The SYN case
1681 	 * for incoming connections is handled in tcp_syncache.
1682 	 * According to RFC1323 the window field in a SYN (i.e., a <SYN>
1683 	 * or <SYN,ACK>) segment itself is never scaled.
1684 	 * XXX this is traditional behavior, may need to be cleaned up.
1685 	 */
1686 	if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
1687 		/* Handle parallel SYN for ECN */
1688 		if (!(thflags & TH_ACK) &&
1689 		    ((thflags & (TH_CWR | TH_ECE)) == (TH_CWR | TH_ECE)) &&
1690 		    ((V_tcp_do_ecn == 1) || (V_tcp_do_ecn == 2))) {
1691 			tp->t_flags2 |= TF2_ECN_PERMIT;
1692 			tp->t_flags2 |= TF2_ECN_SND_ECE;
1693 			TCPSTAT_INC(tcps_ecn_shs);
1694 		}
1695 		if ((to.to_flags & TOF_SCALE) &&
1696 		    (tp->t_flags & TF_REQ_SCALE) &&
1697 		    !(tp->t_flags & TF_NOOPT)) {
1698 			tp->t_flags |= TF_RCVD_SCALE;
1699 			tp->snd_scale = to.to_wscale;
1700 		} else
1701 			tp->t_flags &= ~TF_REQ_SCALE;
1702 		/*
1703 		 * Initial send window.  It will be updated with
1704 		 * the next incoming segment to the scaled value.
1705 		 */
1706 		tp->snd_wnd = th->th_win;
1707 		if ((to.to_flags & TOF_TS) &&
1708 		    (tp->t_flags & TF_REQ_TSTMP) &&
1709 		    !(tp->t_flags & TF_NOOPT)) {
1710 			tp->t_flags |= TF_RCVD_TSTMP;
1711 			tp->ts_recent = to.to_tsval;
1712 			tp->ts_recent_age = tcp_ts_getticks();
1713 		} else
1714 			tp->t_flags &= ~TF_REQ_TSTMP;
1715 		if (to.to_flags & TOF_MSS)
1716 			tcp_mss(tp, to.to_mss);
1717 		if ((tp->t_flags & TF_SACK_PERMIT) &&
1718 		    (!(to.to_flags & TOF_SACKPERM) ||
1719 		    (tp->t_flags & TF_NOOPT)))
1720 			tp->t_flags &= ~TF_SACK_PERMIT;
1721 		if (IS_FASTOPEN(tp->t_flags)) {
1722 			if ((to.to_flags & TOF_FASTOPEN) &&
1723 			    !(tp->t_flags & TF_NOOPT)) {
1724 				uint16_t mss;
1725 
1726 				if (to.to_flags & TOF_MSS)
1727 					mss = to.to_mss;
1728 				else
1729 					if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
1730 						mss = TCP6_MSS;
1731 					else
1732 						mss = TCP_MSS;
1733 				tcp_fastopen_update_cache(tp, mss,
1734 				    to.to_tfo_len, to.to_tfo_cookie);
1735 			} else
1736 				tcp_fastopen_disable_path(tp);
1737 		}
1738 	}
1739 
1740 	/*
1741 	 * If timestamps were negotiated during SYN/ACK and a
1742 	 * segment without a timestamp is received, silently drop
1743 	 * the segment, unless it is a RST segment or missing timestamps are
1744 	 * tolerated.
1745 	 * See section 3.2 of RFC 7323.
1746 	 */
1747 	if ((tp->t_flags & TF_RCVD_TSTMP) && !(to.to_flags & TOF_TS)) {
1748 		if (((thflags & TH_RST) != 0) || V_tcp_tolerate_missing_ts) {
1749 			if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1750 				log(LOG_DEBUG, "%s; %s: Timestamp missing, "
1751 				    "segment processed normally\n",
1752 				    s, __func__);
1753 				free(s, M_TCPLOG);
1754 			}
1755 		} else {
1756 			if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1757 				log(LOG_DEBUG, "%s; %s: Timestamp missing, "
1758 				    "segment silently dropped\n", s, __func__);
1759 				free(s, M_TCPLOG);
1760 			}
1761 			goto drop;
1762 		}
1763 	}
1764 	/*
1765 	 * If timestamps were not negotiated during SYN/ACK and a
1766 	 * segment with a timestamp is received, ignore the
1767 	 * timestamp and process the packet normally.
1768 	 * See section 3.2 of RFC 7323.
1769 	 */
1770 	if (!(tp->t_flags & TF_RCVD_TSTMP) && (to.to_flags & TOF_TS)) {
1771 		if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1772 			log(LOG_DEBUG, "%s; %s: Timestamp not expected, "
1773 			    "segment processed normally\n", s, __func__);
1774 			free(s, M_TCPLOG);
1775 		}
1776 	}
1777 
1778 	/*
1779 	 * Header prediction: check for the two common cases
1780 	 * of a uni-directional data xfer.  If the packet has
1781 	 * no control flags, is in-sequence, the window didn't
1782 	 * change and we're not retransmitting, it's a
1783 	 * candidate.  If the length is zero and the ack moved
1784 	 * forward, we're the sender side of the xfer.  Just
1785 	 * free the data acked & wake any higher level process
1786 	 * that was blocked waiting for space.  If the length
1787 	 * is non-zero and the ack didn't move, we're the
1788 	 * receiver side.  If we're getting packets in-order
1789 	 * (the reassembly queue is empty), add the data to
1790 	 * the socket buffer and note that we need a delayed ack.
1791 	 * Make sure that the hidden state-flags are also off.
1792 	 * Since we check for TCPS_ESTABLISHED first, it can only
1793 	 * be TH_NEEDSYN.
1794 	 */
1795 	if (tp->t_state == TCPS_ESTABLISHED &&
1796 	    th->th_seq == tp->rcv_nxt &&
1797 	    (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1798 	    tp->snd_nxt == tp->snd_max &&
1799 	    tiwin && tiwin == tp->snd_wnd &&
1800 	    ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1801 	    SEGQ_EMPTY(tp) &&
1802 	    ((to.to_flags & TOF_TS) == 0 ||
1803 	     TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) {
1804 		/*
1805 		 * If last ACK falls within this segment's sequence numbers,
1806 		 * record the timestamp.
1807 		 * NOTE that the test is modified according to the latest
1808 		 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1809 		 */
1810 		if ((to.to_flags & TOF_TS) != 0 &&
1811 		    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1812 			tp->ts_recent_age = tcp_ts_getticks();
1813 			tp->ts_recent = to.to_tsval;
1814 		}
1815 
1816 		if (tlen == 0) {
1817 			if (SEQ_GT(th->th_ack, tp->snd_una) &&
1818 			    SEQ_LEQ(th->th_ack, tp->snd_max) &&
1819 			    !IN_RECOVERY(tp->t_flags) &&
1820 			    (to.to_flags & TOF_SACK) == 0 &&
1821 			    TAILQ_EMPTY(&tp->snd_holes)) {
1822 				/*
1823 				 * This is a pure ack for outstanding data.
1824 				 */
1825 				TCPSTAT_INC(tcps_predack);
1826 
1827 				/*
1828 				 * "bad retransmit" recovery without timestamps.
1829 				 */
1830 				if ((to.to_flags & TOF_TS) == 0 &&
1831 				    tp->t_rxtshift == 1 &&
1832 				    tp->t_flags & TF_PREVVALID &&
1833 				    (int)(ticks - tp->t_badrxtwin) < 0) {
1834 					cc_cong_signal(tp, th, CC_RTO_ERR);
1835 				}
1836 
1837 				/*
1838 				 * Recalculate the transmit timer / rtt.
1839 				 *
1840 				 * Some boxes send broken timestamp replies
1841 				 * during the SYN+ACK phase, ignore
1842 				 * timestamps of 0 or we could calculate a
1843 				 * huge RTT and blow up the retransmit timer.
1844 				 */
1845 				if ((to.to_flags & TOF_TS) != 0 &&
1846 				    to.to_tsecr) {
1847 					uint32_t t;
1848 
1849 					t = tcp_ts_getticks() - to.to_tsecr;
1850 					if (!tp->t_rttlow || tp->t_rttlow > t)
1851 						tp->t_rttlow = t;
1852 					tcp_xmit_timer(tp,
1853 					    TCP_TS_TO_TICKS(t) + 1);
1854 				} else if (tp->t_rtttime &&
1855 				    SEQ_GT(th->th_ack, tp->t_rtseq)) {
1856 					if (!tp->t_rttlow ||
1857 					    tp->t_rttlow > ticks - tp->t_rtttime)
1858 						tp->t_rttlow = ticks - tp->t_rtttime;
1859 					tcp_xmit_timer(tp,
1860 							ticks - tp->t_rtttime);
1861 				}
1862 				acked = BYTES_THIS_ACK(tp, th);
1863 
1864 #ifdef TCP_HHOOK
1865 				/* Run HHOOK_TCP_ESTABLISHED_IN helper hooks. */
1866 				hhook_run_tcp_est_in(tp, th, &to);
1867 #endif
1868 
1869 				TCPSTAT_ADD(tcps_rcvackpack, nsegs);
1870 				TCPSTAT_ADD(tcps_rcvackbyte, acked);
1871 				sbdrop(&so->so_snd, acked);
1872 				if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
1873 				    SEQ_LEQ(th->th_ack, tp->snd_recover))
1874 					tp->snd_recover = th->th_ack - 1;
1875 
1876 				/*
1877 				 * Let the congestion control algorithm update
1878 				 * congestion control related information. This
1879 				 * typically means increasing the congestion
1880 				 * window.
1881 				 */
1882 				cc_ack_received(tp, th, nsegs, CC_ACK);
1883 
1884 				tp->snd_una = th->th_ack;
1885 				/*
1886 				 * Pull snd_wl2 up to prevent seq wrap relative
1887 				 * to th_ack.
1888 				 */
1889 				tp->snd_wl2 = th->th_ack;
1890 				tp->t_dupacks = 0;
1891 				m_freem(m);
1892 
1893 				/*
1894 				 * If all outstanding data are acked, stop
1895 				 * retransmit timer, otherwise restart timer
1896 				 * using current (possibly backed-off) value.
1897 				 * If process is waiting for space,
1898 				 * wakeup/selwakeup/signal.  If data
1899 				 * are ready to send, let tcp_output
1900 				 * decide between more output or persist.
1901 				 */
1902 #ifdef TCPDEBUG
1903 				if (so->so_options & SO_DEBUG)
1904 					tcp_trace(TA_INPUT, ostate, tp,
1905 					    (void *)tcp_saveipgen,
1906 					    &tcp_savetcp, 0);
1907 #endif
1908 				TCP_PROBE3(debug__input, tp, th, m);
1909 				if (tp->snd_una == tp->snd_max)
1910 					tcp_timer_activate(tp, TT_REXMT, 0);
1911 				else if (!tcp_timer_active(tp, TT_PERSIST))
1912 					tcp_timer_activate(tp, TT_REXMT,
1913 						      tp->t_rxtcur);
1914 				sowwakeup(so);
1915 				if (sbavail(&so->so_snd))
1916 					(void) tp->t_fb->tfb_tcp_output(tp);
1917 				goto check_delack;
1918 			}
1919 		} else if (th->th_ack == tp->snd_una &&
1920 		    tlen <= sbspace(&so->so_rcv)) {
1921 			int newsize = 0;	/* automatic sockbuf scaling */
1922 
1923 			/*
1924 			 * This is a pure, in-sequence data packet with
1925 			 * nothing on the reassembly queue and we have enough
1926 			 * buffer space to take it.
1927 			 */
1928 			/* Clean receiver SACK report if present */
1929 			if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
1930 				tcp_clean_sackreport(tp);
1931 			TCPSTAT_INC(tcps_preddat);
1932 			tp->rcv_nxt += tlen;
1933 			if (tlen &&
1934 			    ((tp->t_flags2 & TF2_FBYTES_COMPLETE) == 0) &&
1935 			    (tp->t_fbyte_in == 0)) {
1936 				tp->t_fbyte_in = ticks;
1937 				if (tp->t_fbyte_in == 0)
1938 					tp->t_fbyte_in = 1;
1939 				if (tp->t_fbyte_out && tp->t_fbyte_in)
1940 					tp->t_flags2 |= TF2_FBYTES_COMPLETE;
1941 			}
1942 			/*
1943 			 * Pull snd_wl1 up to prevent seq wrap relative to
1944 			 * th_seq.
1945 			 */
1946 			tp->snd_wl1 = th->th_seq;
1947 			/*
1948 			 * Pull rcv_up up to prevent seq wrap relative to
1949 			 * rcv_nxt.
1950 			 */
1951 			tp->rcv_up = tp->rcv_nxt;
1952 			TCPSTAT_ADD(tcps_rcvpack, nsegs);
1953 			TCPSTAT_ADD(tcps_rcvbyte, tlen);
1954 #ifdef TCPDEBUG
1955 			if (so->so_options & SO_DEBUG)
1956 				tcp_trace(TA_INPUT, ostate, tp,
1957 				    (void *)tcp_saveipgen, &tcp_savetcp, 0);
1958 #endif
1959 			TCP_PROBE3(debug__input, tp, th, m);
1960 
1961 			newsize = tcp_autorcvbuf(m, th, so, tp, tlen);
1962 
1963 			/* Add data to socket buffer. */
1964 			SOCKBUF_LOCK(&so->so_rcv);
1965 			if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1966 				m_freem(m);
1967 			} else {
1968 				/*
1969 				 * Set new socket buffer size.
1970 				 * Give up when limit is reached.
1971 				 */
1972 				if (newsize)
1973 					if (!sbreserve_locked(&so->so_rcv,
1974 					    newsize, so, NULL))
1975 						so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1976 				m_adj(m, drop_hdrlen);	/* delayed header drop */
1977 				sbappendstream_locked(&so->so_rcv, m, 0);
1978 			}
1979 			/* NB: sorwakeup_locked() does an implicit unlock. */
1980 			sorwakeup_locked(so);
1981 			if (DELAY_ACK(tp, tlen)) {
1982 				tp->t_flags |= TF_DELACK;
1983 			} else {
1984 				tp->t_flags |= TF_ACKNOW;
1985 				tp->t_fb->tfb_tcp_output(tp);
1986 			}
1987 			goto check_delack;
1988 		}
1989 	}
1990 
1991 	/*
1992 	 * Calculate amount of space in receive window,
1993 	 * and then do TCP input processing.
1994 	 * Receive window is amount of space in rcv queue,
1995 	 * but not less than advertised window.
1996 	 */
1997 	win = sbspace(&so->so_rcv);
1998 	if (win < 0)
1999 		win = 0;
2000 	tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2001 
2002 	switch (tp->t_state) {
2003 	/*
2004 	 * If the state is SYN_RECEIVED:
2005 	 *	if seg contains an ACK, but not for our SYN/ACK, send a RST.
2006 	 */
2007 	case TCPS_SYN_RECEIVED:
2008 		if ((thflags & TH_ACK) &&
2009 		    (SEQ_LEQ(th->th_ack, tp->snd_una) ||
2010 		     SEQ_GT(th->th_ack, tp->snd_max))) {
2011 				rstreason = BANDLIM_RST_OPENPORT;
2012 				goto dropwithreset;
2013 		}
2014 		if (IS_FASTOPEN(tp->t_flags)) {
2015 			/*
2016 			 * When a TFO connection is in SYN_RECEIVED, the
2017 			 * only valid packets are the initial SYN, a
2018 			 * retransmit/copy of the initial SYN (possibly with
2019 			 * a subset of the original data), a valid ACK, a
2020 			 * FIN, or a RST.
2021 			 */
2022 			if ((thflags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) {
2023 				rstreason = BANDLIM_RST_OPENPORT;
2024 				goto dropwithreset;
2025 			} else if (thflags & TH_SYN) {
2026 				/* non-initial SYN is ignored */
2027 				if ((tcp_timer_active(tp, TT_DELACK) ||
2028 				     tcp_timer_active(tp, TT_REXMT)))
2029 					goto drop;
2030 			} else if (!(thflags & (TH_ACK|TH_FIN|TH_RST))) {
2031 				goto drop;
2032 			}
2033 		}
2034 		break;
2035 
2036 	/*
2037 	 * If the state is SYN_SENT:
2038 	 *	if seg contains a RST with valid ACK (SEQ.ACK has already
2039 	 *	    been verified), then drop the connection.
2040 	 *	if seg contains a RST without an ACK, drop the seg.
2041 	 *	if seg does not contain SYN, then drop the seg.
2042 	 * Otherwise this is an acceptable SYN segment
2043 	 *	initialize tp->rcv_nxt and tp->irs
2044 	 *	if seg contains ack then advance tp->snd_una
2045 	 *	if seg contains an ECE and ECN support is enabled, the stream
2046 	 *	    is ECN capable.
2047 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2048 	 *	arrange for segment to be acked (eventually)
2049 	 *	continue processing rest of data/controls, beginning with URG
2050 	 */
2051 	case TCPS_SYN_SENT:
2052 		if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) {
2053 			TCP_PROBE5(connect__refused, NULL, tp,
2054 			    m, tp, th);
2055 			tp = tcp_drop(tp, ECONNREFUSED);
2056 		}
2057 		if (thflags & TH_RST)
2058 			goto drop;
2059 		if (!(thflags & TH_SYN))
2060 			goto drop;
2061 
2062 		tp->irs = th->th_seq;
2063 		tcp_rcvseqinit(tp);
2064 		if (thflags & TH_ACK) {
2065 			int tfo_partial_ack = 0;
2066 
2067 			TCPSTAT_INC(tcps_connects);
2068 			soisconnected(so);
2069 #ifdef MAC
2070 			mac_socketpeer_set_from_mbuf(m, so);
2071 #endif
2072 			/* Do window scaling on this connection? */
2073 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2074 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
2075 				tp->rcv_scale = tp->request_r_scale;
2076 			}
2077 			tp->rcv_adv += min(tp->rcv_wnd,
2078 			    TCP_MAXWIN << tp->rcv_scale);
2079 			tp->snd_una++;		/* SYN is acked */
2080 			/*
2081 			 * If not all the data that was sent in the TFO SYN
2082 			 * has been acked, resend the remainder right away.
2083 			 */
2084 			if (IS_FASTOPEN(tp->t_flags) &&
2085 			    (tp->snd_una != tp->snd_max)) {
2086 				tp->snd_nxt = th->th_ack;
2087 				tfo_partial_ack = 1;
2088 			}
2089 			/*
2090 			 * If there's data, delay ACK; if there's also a FIN
2091 			 * ACKNOW will be turned on later.
2092 			 */
2093 			if (DELAY_ACK(tp, tlen) && tlen != 0 && !tfo_partial_ack)
2094 				tcp_timer_activate(tp, TT_DELACK,
2095 				    tcp_delacktime);
2096 			else
2097 				tp->t_flags |= TF_ACKNOW;
2098 
2099 			if (((thflags & (TH_CWR | TH_ECE)) == TH_ECE) &&
2100 			    (V_tcp_do_ecn == 1)) {
2101 				tp->t_flags2 |= TF2_ECN_PERMIT;
2102 				TCPSTAT_INC(tcps_ecn_shs);
2103 			}
2104 
2105 			/*
2106 			 * Received <SYN,ACK> in SYN_SENT[*] state.
2107 			 * Transitions:
2108 			 *	SYN_SENT  --> ESTABLISHED
2109 			 *	SYN_SENT* --> FIN_WAIT_1
2110 			 */
2111 			tp->t_starttime = ticks;
2112 			if (tp->t_flags & TF_NEEDFIN) {
2113 				tcp_state_change(tp, TCPS_FIN_WAIT_1);
2114 				tp->t_flags &= ~TF_NEEDFIN;
2115 				thflags &= ~TH_SYN;
2116 			} else {
2117 				tcp_state_change(tp, TCPS_ESTABLISHED);
2118 				TCP_PROBE5(connect__established, NULL, tp,
2119 				    m, tp, th);
2120 				cc_conn_init(tp);
2121 				tcp_timer_activate(tp, TT_KEEP,
2122 				    TP_KEEPIDLE(tp));
2123 			}
2124 		} else {
2125 			/*
2126 			 * Received initial SYN in SYN-SENT[*] state =>
2127 			 * simultaneous open.
2128 			 * If it succeeds, connection is * half-synchronized.
2129 			 * Otherwise, do 3-way handshake:
2130 			 *        SYN-SENT -> SYN-RECEIVED
2131 			 *        SYN-SENT* -> SYN-RECEIVED*
2132 			 */
2133 			tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
2134 			tcp_timer_activate(tp, TT_REXMT, 0);
2135 			tcp_state_change(tp, TCPS_SYN_RECEIVED);
2136 		}
2137 
2138 		INP_WLOCK_ASSERT(tp->t_inpcb);
2139 
2140 		/*
2141 		 * Advance th->th_seq to correspond to first data byte.
2142 		 * If data, trim to stay within window,
2143 		 * dropping FIN if necessary.
2144 		 */
2145 		th->th_seq++;
2146 		if (tlen > tp->rcv_wnd) {
2147 			todrop = tlen - tp->rcv_wnd;
2148 			m_adj(m, -todrop);
2149 			tlen = tp->rcv_wnd;
2150 			thflags &= ~TH_FIN;
2151 			TCPSTAT_INC(tcps_rcvpackafterwin);
2152 			TCPSTAT_ADD(tcps_rcvbyteafterwin, todrop);
2153 		}
2154 		tp->snd_wl1 = th->th_seq - 1;
2155 		tp->rcv_up = th->th_seq;
2156 		/*
2157 		 * Client side of transaction: already sent SYN and data.
2158 		 * If the remote host used T/TCP to validate the SYN,
2159 		 * our data will be ACK'd; if so, enter normal data segment
2160 		 * processing in the middle of step 5, ack processing.
2161 		 * Otherwise, goto step 6.
2162 		 */
2163 		if (thflags & TH_ACK)
2164 			goto process_ACK;
2165 
2166 		goto step6;
2167 
2168 	/*
2169 	 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
2170 	 *      do normal processing.
2171 	 *
2172 	 * NB: Leftover from RFC1644 T/TCP.  Cases to be reused later.
2173 	 */
2174 	case TCPS_LAST_ACK:
2175 	case TCPS_CLOSING:
2176 		break;  /* continue normal processing */
2177 	}
2178 
2179 	/*
2180 	 * States other than LISTEN or SYN_SENT.
2181 	 * First check the RST flag and sequence number since reset segments
2182 	 * are exempt from the timestamp and connection count tests.  This
2183 	 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
2184 	 * below which allowed reset segments in half the sequence space
2185 	 * to fall though and be processed (which gives forged reset
2186 	 * segments with a random sequence number a 50 percent chance of
2187 	 * killing a connection).
2188 	 * Then check timestamp, if present.
2189 	 * Then check the connection count, if present.
2190 	 * Then check that at least some bytes of segment are within
2191 	 * receive window.  If segment begins before rcv_nxt,
2192 	 * drop leading data (and SYN); if nothing left, just ack.
2193 	 */
2194 	if (thflags & TH_RST) {
2195 		/*
2196 		 * RFC5961 Section 3.2
2197 		 *
2198 		 * - RST drops connection only if SEG.SEQ == RCV.NXT.
2199 		 * - If RST is in window, we send challenge ACK.
2200 		 *
2201 		 * Note: to take into account delayed ACKs, we should
2202 		 *   test against last_ack_sent instead of rcv_nxt.
2203 		 * Note 2: we handle special case of closed window, not
2204 		 *   covered by the RFC.
2205 		 */
2206 		if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
2207 		    SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) ||
2208 		    (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) {
2209 			KASSERT(tp->t_state != TCPS_SYN_SENT,
2210 			    ("%s: TH_RST for TCPS_SYN_SENT th %p tp %p",
2211 			    __func__, th, tp));
2212 
2213 			if (V_tcp_insecure_rst ||
2214 			    tp->last_ack_sent == th->th_seq) {
2215 				TCPSTAT_INC(tcps_drops);
2216 				/* Drop the connection. */
2217 				switch (tp->t_state) {
2218 				case TCPS_SYN_RECEIVED:
2219 					so->so_error = ECONNREFUSED;
2220 					goto close;
2221 				case TCPS_ESTABLISHED:
2222 				case TCPS_FIN_WAIT_1:
2223 				case TCPS_FIN_WAIT_2:
2224 				case TCPS_CLOSE_WAIT:
2225 				case TCPS_CLOSING:
2226 				case TCPS_LAST_ACK:
2227 					so->so_error = ECONNRESET;
2228 				close:
2229 					/* FALLTHROUGH */
2230 				default:
2231 					tp = tcp_close(tp);
2232 				}
2233 			} else {
2234 				TCPSTAT_INC(tcps_badrst);
2235 				/* Send challenge ACK. */
2236 				tcp_respond(tp, mtod(m, void *), th, m,
2237 				    tp->rcv_nxt, tp->snd_nxt, TH_ACK);
2238 				tp->last_ack_sent = tp->rcv_nxt;
2239 				m = NULL;
2240 			}
2241 		}
2242 		goto drop;
2243 	}
2244 
2245 	/*
2246 	 * RFC5961 Section 4.2
2247 	 * Send challenge ACK for any SYN in synchronized state.
2248 	 */
2249 	if ((thflags & TH_SYN) && tp->t_state != TCPS_SYN_SENT &&
2250 	    tp->t_state != TCPS_SYN_RECEIVED) {
2251 		TCPSTAT_INC(tcps_badsyn);
2252 		if (V_tcp_insecure_syn &&
2253 		    SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
2254 		    SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
2255 			tp = tcp_drop(tp, ECONNRESET);
2256 			rstreason = BANDLIM_UNLIMITED;
2257 		} else {
2258 			/* Send challenge ACK. */
2259 			tcp_respond(tp, mtod(m, void *), th, m, tp->rcv_nxt,
2260 			    tp->snd_nxt, TH_ACK);
2261 			tp->last_ack_sent = tp->rcv_nxt;
2262 			m = NULL;
2263 		}
2264 		goto drop;
2265 	}
2266 
2267 	/*
2268 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
2269 	 * and it's less than ts_recent, drop it.
2270 	 */
2271 	if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
2272 	    TSTMP_LT(to.to_tsval, tp->ts_recent)) {
2273 		/* Check to see if ts_recent is over 24 days old.  */
2274 		if (tcp_ts_getticks() - tp->ts_recent_age > TCP_PAWS_IDLE) {
2275 			/*
2276 			 * Invalidate ts_recent.  If this segment updates
2277 			 * ts_recent, the age will be reset later and ts_recent
2278 			 * will get a valid value.  If it does not, setting
2279 			 * ts_recent to zero will at least satisfy the
2280 			 * requirement that zero be placed in the timestamp
2281 			 * echo reply when ts_recent isn't valid.  The
2282 			 * age isn't reset until we get a valid ts_recent
2283 			 * because we don't want out-of-order segments to be
2284 			 * dropped when ts_recent is old.
2285 			 */
2286 			tp->ts_recent = 0;
2287 		} else {
2288 			TCPSTAT_INC(tcps_rcvduppack);
2289 			TCPSTAT_ADD(tcps_rcvdupbyte, tlen);
2290 			TCPSTAT_INC(tcps_pawsdrop);
2291 			if (tlen)
2292 				goto dropafterack;
2293 			goto drop;
2294 		}
2295 	}
2296 
2297 	/*
2298 	 * In the SYN-RECEIVED state, validate that the packet belongs to
2299 	 * this connection before trimming the data to fit the receive
2300 	 * window.  Check the sequence number versus IRS since we know
2301 	 * the sequence numbers haven't wrapped.  This is a partial fix
2302 	 * for the "LAND" DoS attack.
2303 	 */
2304 	if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
2305 		rstreason = BANDLIM_RST_OPENPORT;
2306 		goto dropwithreset;
2307 	}
2308 
2309 	todrop = tp->rcv_nxt - th->th_seq;
2310 	if (todrop > 0) {
2311 		if (thflags & TH_SYN) {
2312 			thflags &= ~TH_SYN;
2313 			th->th_seq++;
2314 			if (th->th_urp > 1)
2315 				th->th_urp--;
2316 			else
2317 				thflags &= ~TH_URG;
2318 			todrop--;
2319 		}
2320 		/*
2321 		 * Following if statement from Stevens, vol. 2, p. 960.
2322 		 */
2323 		if (todrop > tlen
2324 		    || (todrop == tlen && (thflags & TH_FIN) == 0)) {
2325 			/*
2326 			 * Any valid FIN must be to the left of the window.
2327 			 * At this point the FIN must be a duplicate or out
2328 			 * of sequence; drop it.
2329 			 */
2330 			thflags &= ~TH_FIN;
2331 
2332 			/*
2333 			 * Send an ACK to resynchronize and drop any data.
2334 			 * But keep on processing for RST or ACK.
2335 			 */
2336 			tp->t_flags |= TF_ACKNOW;
2337 			todrop = tlen;
2338 			TCPSTAT_INC(tcps_rcvduppack);
2339 			TCPSTAT_ADD(tcps_rcvdupbyte, todrop);
2340 		} else {
2341 			TCPSTAT_INC(tcps_rcvpartduppack);
2342 			TCPSTAT_ADD(tcps_rcvpartdupbyte, todrop);
2343 		}
2344 		/*
2345 		 * DSACK - add SACK block for dropped range
2346 		 */
2347 		if ((todrop > 0) && (tp->t_flags & TF_SACK_PERMIT)) {
2348 			tcp_update_sack_list(tp, th->th_seq,
2349 			    th->th_seq + todrop);
2350 			/*
2351 			 * ACK now, as the next in-sequence segment
2352 			 * will clear the DSACK block again
2353 			 */
2354 			tp->t_flags |= TF_ACKNOW;
2355 		}
2356 		drop_hdrlen += todrop;	/* drop from the top afterwards */
2357 		th->th_seq += todrop;
2358 		tlen -= todrop;
2359 		if (th->th_urp > todrop)
2360 			th->th_urp -= todrop;
2361 		else {
2362 			thflags &= ~TH_URG;
2363 			th->th_urp = 0;
2364 		}
2365 	}
2366 
2367 	/*
2368 	 * If new data are received on a connection after the
2369 	 * user processes are gone, then RST the other end.
2370 	 */
2371 	if ((so->so_state & SS_NOFDREF) &&
2372 	    tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2373 		if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
2374 			log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data "
2375 			    "after socket was closed, "
2376 			    "sending RST and removing tcpcb\n",
2377 			    s, __func__, tcpstates[tp->t_state], tlen);
2378 			free(s, M_TCPLOG);
2379 		}
2380 		tp = tcp_close(tp);
2381 		TCPSTAT_INC(tcps_rcvafterclose);
2382 		rstreason = BANDLIM_UNLIMITED;
2383 		goto dropwithreset;
2384 	}
2385 
2386 	/*
2387 	 * If segment ends after window, drop trailing data
2388 	 * (and PUSH and FIN); if nothing left, just ACK.
2389 	 */
2390 	todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
2391 	if (todrop > 0) {
2392 		TCPSTAT_INC(tcps_rcvpackafterwin);
2393 		if (todrop >= tlen) {
2394 			TCPSTAT_ADD(tcps_rcvbyteafterwin, tlen);
2395 			/*
2396 			 * If window is closed can only take segments at
2397 			 * window edge, and have to drop data and PUSH from
2398 			 * incoming segments.  Continue processing, but
2399 			 * remember to ack.  Otherwise, drop segment
2400 			 * and ack.
2401 			 */
2402 			if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2403 				tp->t_flags |= TF_ACKNOW;
2404 				TCPSTAT_INC(tcps_rcvwinprobe);
2405 			} else
2406 				goto dropafterack;
2407 		} else
2408 			TCPSTAT_ADD(tcps_rcvbyteafterwin, todrop);
2409 		m_adj(m, -todrop);
2410 		tlen -= todrop;
2411 		thflags &= ~(TH_PUSH|TH_FIN);
2412 	}
2413 
2414 	/*
2415 	 * If last ACK falls within this segment's sequence numbers,
2416 	 * record its timestamp.
2417 	 * NOTE:
2418 	 * 1) That the test incorporates suggestions from the latest
2419 	 *    proposal of the tcplw@cray.com list (Braden 1993/04/26).
2420 	 * 2) That updating only on newer timestamps interferes with
2421 	 *    our earlier PAWS tests, so this check should be solely
2422 	 *    predicated on the sequence space of this segment.
2423 	 * 3) That we modify the segment boundary check to be
2424 	 *        Last.ACK.Sent <= SEG.SEQ + SEG.Len
2425 	 *    instead of RFC1323's
2426 	 *        Last.ACK.Sent < SEG.SEQ + SEG.Len,
2427 	 *    This modified check allows us to overcome RFC1323's
2428 	 *    limitations as described in Stevens TCP/IP Illustrated
2429 	 *    Vol. 2 p.869. In such cases, we can still calculate the
2430 	 *    RTT correctly when RCV.NXT == Last.ACK.Sent.
2431 	 */
2432 	if ((to.to_flags & TOF_TS) != 0 &&
2433 	    SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2434 	    SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2435 		((thflags & (TH_SYN|TH_FIN)) != 0))) {
2436 		tp->ts_recent_age = tcp_ts_getticks();
2437 		tp->ts_recent = to.to_tsval;
2438 	}
2439 
2440 	/*
2441 	 * If the ACK bit is off:  if in SYN-RECEIVED state or SENDSYN
2442 	 * flag is on (half-synchronized state), then queue data for
2443 	 * later processing; else drop segment and return.
2444 	 */
2445 	if ((thflags & TH_ACK) == 0) {
2446 		if (tp->t_state == TCPS_SYN_RECEIVED ||
2447 		    (tp->t_flags & TF_NEEDSYN)) {
2448 			if (tp->t_state == TCPS_SYN_RECEIVED &&
2449 			    IS_FASTOPEN(tp->t_flags)) {
2450 				tp->snd_wnd = tiwin;
2451 				cc_conn_init(tp);
2452 			}
2453 			goto step6;
2454 		} else if (tp->t_flags & TF_ACKNOW)
2455 			goto dropafterack;
2456 		else
2457 			goto drop;
2458 	}
2459 
2460 	/*
2461 	 * Ack processing.
2462 	 */
2463 	switch (tp->t_state) {
2464 	/*
2465 	 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
2466 	 * ESTABLISHED state and continue processing.
2467 	 * The ACK was checked above.
2468 	 */
2469 	case TCPS_SYN_RECEIVED:
2470 
2471 		TCPSTAT_INC(tcps_connects);
2472 		soisconnected(so);
2473 		/* Do window scaling? */
2474 		if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2475 			(TF_RCVD_SCALE|TF_REQ_SCALE)) {
2476 			tp->rcv_scale = tp->request_r_scale;
2477 		}
2478 		tp->snd_wnd = tiwin;
2479 		/*
2480 		 * Make transitions:
2481 		 *      SYN-RECEIVED  -> ESTABLISHED
2482 		 *      SYN-RECEIVED* -> FIN-WAIT-1
2483 		 */
2484 		tp->t_starttime = ticks;
2485 		if (IS_FASTOPEN(tp->t_flags) && tp->t_tfo_pending) {
2486 			tcp_fastopen_decrement_counter(tp->t_tfo_pending);
2487 			tp->t_tfo_pending = NULL;
2488 		}
2489 		if (tp->t_flags & TF_NEEDFIN) {
2490 			tcp_state_change(tp, TCPS_FIN_WAIT_1);
2491 			tp->t_flags &= ~TF_NEEDFIN;
2492 		} else {
2493 			tcp_state_change(tp, TCPS_ESTABLISHED);
2494 			TCP_PROBE5(accept__established, NULL, tp,
2495 			    m, tp, th);
2496 			/*
2497 			 * TFO connections call cc_conn_init() during SYN
2498 			 * processing.  Calling it again here for such
2499 			 * connections is not harmless as it would undo the
2500 			 * snd_cwnd reduction that occurs when a TFO SYN|ACK
2501 			 * is retransmitted.
2502 			 */
2503 			if (!IS_FASTOPEN(tp->t_flags))
2504 				cc_conn_init(tp);
2505 			tcp_timer_activate(tp, TT_KEEP, TP_KEEPIDLE(tp));
2506 		}
2507 		/*
2508 		 * Account for the ACK of our SYN prior to
2509 		 * regular ACK processing below, except for
2510 		 * simultaneous SYN, which is handled later.
2511 		 */
2512 		if (SEQ_GT(th->th_ack, tp->snd_una) && !(tp->t_flags & TF_NEEDSYN))
2513 			incforsyn = 1;
2514 		/*
2515 		 * If segment contains data or ACK, will call tcp_reass()
2516 		 * later; if not, do so now to pass queued data to user.
2517 		 */
2518 		if (tlen == 0 && (thflags & TH_FIN) == 0) {
2519 			(void) tcp_reass(tp, (struct tcphdr *)0, NULL, 0,
2520 			    (struct mbuf *)0);
2521 			tcp_handle_wakeup(tp, so);
2522 		}
2523 		tp->snd_wl1 = th->th_seq - 1;
2524 		/* FALLTHROUGH */
2525 
2526 	/*
2527 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2528 	 * ACKs.  If the ack is in the range
2529 	 *	tp->snd_una < th->th_ack <= tp->snd_max
2530 	 * then advance tp->snd_una to th->th_ack and drop
2531 	 * data from the retransmission queue.  If this ACK reflects
2532 	 * more up to date window information we update our window information.
2533 	 */
2534 	case TCPS_ESTABLISHED:
2535 	case TCPS_FIN_WAIT_1:
2536 	case TCPS_FIN_WAIT_2:
2537 	case TCPS_CLOSE_WAIT:
2538 	case TCPS_CLOSING:
2539 	case TCPS_LAST_ACK:
2540 		if (SEQ_GT(th->th_ack, tp->snd_max)) {
2541 			TCPSTAT_INC(tcps_rcvacktoomuch);
2542 			goto dropafterack;
2543 		}
2544 		if ((tp->t_flags & TF_SACK_PERMIT) &&
2545 		    ((to.to_flags & TOF_SACK) ||
2546 		     !TAILQ_EMPTY(&tp->snd_holes))) {
2547 			if (((sack_changed = tcp_sack_doack(tp, &to, th->th_ack)) != 0) &&
2548 			    (tp->t_flags & TF_LRD)) {
2549 				tcp_sack_lost_retransmission(tp, th);
2550 			}
2551 		} else
2552 			/*
2553 			 * Reset the value so that previous (valid) value
2554 			 * from the last ack with SACK doesn't get used.
2555 			 */
2556 			tp->sackhint.sacked_bytes = 0;
2557 
2558 #ifdef TCP_HHOOK
2559 		/* Run HHOOK_TCP_ESTABLISHED_IN helper hooks. */
2560 		hhook_run_tcp_est_in(tp, th, &to);
2561 #endif
2562 
2563 		if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2564 			maxseg = tcp_maxseg(tp);
2565 			if (tlen == 0 &&
2566 			    (tiwin == tp->snd_wnd ||
2567 			    (tp->t_flags & TF_SACK_PERMIT))) {
2568 				/*
2569 				 * If this is the first time we've seen a
2570 				 * FIN from the remote, this is not a
2571 				 * duplicate and it needs to be processed
2572 				 * normally.  This happens during a
2573 				 * simultaneous close.
2574 				 */
2575 				if ((thflags & TH_FIN) &&
2576 				    (TCPS_HAVERCVDFIN(tp->t_state) == 0)) {
2577 					tp->t_dupacks = 0;
2578 					break;
2579 				}
2580 				TCPSTAT_INC(tcps_rcvdupack);
2581 				/*
2582 				 * If we have outstanding data (other than
2583 				 * a window probe), this is a completely
2584 				 * duplicate ack (ie, window info didn't
2585 				 * change and FIN isn't set),
2586 				 * the ack is the biggest we've
2587 				 * seen and we've seen exactly our rexmt
2588 				 * threshold of them, assume a packet
2589 				 * has been dropped and retransmit it.
2590 				 * Kludge snd_nxt & the congestion
2591 				 * window so we send only this one
2592 				 * packet.
2593 				 *
2594 				 * We know we're losing at the current
2595 				 * window size so do congestion avoidance
2596 				 * (set ssthresh to half the current window
2597 				 * and pull our congestion window back to
2598 				 * the new ssthresh).
2599 				 *
2600 				 * Dup acks mean that packets have left the
2601 				 * network (they're now cached at the receiver)
2602 				 * so bump cwnd by the amount in the receiver
2603 				 * to keep a constant cwnd packets in the
2604 				 * network.
2605 				 *
2606 				 * When using TCP ECN, notify the peer that
2607 				 * we reduced the cwnd.
2608 				 */
2609 				/*
2610 				 * Following 2 kinds of acks should not affect
2611 				 * dupack counting:
2612 				 * 1) Old acks
2613 				 * 2) Acks with SACK but without any new SACK
2614 				 * information in them. These could result from
2615 				 * any anomaly in the network like a switch
2616 				 * duplicating packets or a possible DoS attack.
2617 				 */
2618 				if (th->th_ack != tp->snd_una ||
2619 				    ((tp->t_flags & TF_SACK_PERMIT) &&
2620 				    (to.to_flags & TOF_SACK) &&
2621 				    !sack_changed))
2622 					break;
2623 				else if (!tcp_timer_active(tp, TT_REXMT))
2624 					tp->t_dupacks = 0;
2625 				else if (++tp->t_dupacks > tcprexmtthresh ||
2626 				     IN_FASTRECOVERY(tp->t_flags)) {
2627 					cc_ack_received(tp, th, nsegs,
2628 					    CC_DUPACK);
2629 					if (V_tcp_do_prr &&
2630 					    IN_FASTRECOVERY(tp->t_flags)) {
2631 						tcp_do_prr_ack(tp, th, &to);
2632 					} else if ((tp->t_flags & TF_SACK_PERMIT) &&
2633 					    (to.to_flags & TOF_SACK) &&
2634 					    IN_FASTRECOVERY(tp->t_flags)) {
2635 						int awnd;
2636 
2637 						/*
2638 						 * Compute the amount of data in flight first.
2639 						 * We can inject new data into the pipe iff
2640 						 * we have less than 1/2 the original window's
2641 						 * worth of data in flight.
2642 						 */
2643 						if (V_tcp_do_newsack)
2644 							awnd = tcp_compute_pipe(tp);
2645 						else
2646 							awnd = (tp->snd_nxt - tp->snd_fack) +
2647 								tp->sackhint.sack_bytes_rexmit;
2648 
2649 						if (awnd < tp->snd_ssthresh) {
2650 							tp->snd_cwnd += maxseg;
2651 							if (tp->snd_cwnd > tp->snd_ssthresh)
2652 								tp->snd_cwnd = tp->snd_ssthresh;
2653 						}
2654 					} else
2655 						tp->snd_cwnd += maxseg;
2656 					(void) tp->t_fb->tfb_tcp_output(tp);
2657 					goto drop;
2658 				} else if (tp->t_dupacks == tcprexmtthresh ||
2659 					    (tp->t_flags & TF_SACK_PERMIT &&
2660 					     V_tcp_do_newsack &&
2661 					     tp->sackhint.sacked_bytes >
2662 					     (tcprexmtthresh - 1) * maxseg)) {
2663 enter_recovery:
2664 					/*
2665 					 * Above is the RFC6675 trigger condition of
2666 					 * more than (dupthresh-1)*maxseg sacked data.
2667 					 * If the count of holes in the
2668 					 * scoreboard is >= dupthresh, we could
2669 					 * also enter loss recovery, but don't
2670 					 * have that value readily available.
2671 					 */
2672 					tp->t_dupacks = tcprexmtthresh;
2673 					tcp_seq onxt = tp->snd_nxt;
2674 
2675 					/*
2676 					 * If we're doing sack, or prr, check
2677 					 * to see if we're already in sack
2678 					 * recovery. If we're not doing sack,
2679 					 * check to see if we're in newreno
2680 					 * recovery.
2681 					 */
2682 					if (V_tcp_do_prr ||
2683 					    (tp->t_flags & TF_SACK_PERMIT)) {
2684 						if (IN_FASTRECOVERY(tp->t_flags)) {
2685 							tp->t_dupacks = 0;
2686 							break;
2687 						}
2688 					} else {
2689 						if (SEQ_LEQ(th->th_ack,
2690 						    tp->snd_recover)) {
2691 							tp->t_dupacks = 0;
2692 							break;
2693 						}
2694 					}
2695 					/* Congestion signal before ack. */
2696 					cc_cong_signal(tp, th, CC_NDUPACK);
2697 					cc_ack_received(tp, th, nsegs,
2698 					    CC_DUPACK);
2699 					tcp_timer_activate(tp, TT_REXMT, 0);
2700 					tp->t_rtttime = 0;
2701 					if (V_tcp_do_prr) {
2702 						/*
2703 						 * snd_ssthresh is already updated by
2704 						 * cc_cong_signal.
2705 						 */
2706 						if ((tp->t_flags & TF_SACK_PERMIT) &&
2707 						    (to.to_flags & TOF_SACK)) {
2708 							tp->sackhint.prr_delivered =
2709 							    tp->sackhint.sacked_bytes;
2710 						} else {
2711 							tp->sackhint.prr_delivered =
2712 							    imin(tp->snd_max - tp->snd_una,
2713 							    imin(INT_MAX / 65536,
2714 								tp->t_dupacks) * maxseg);
2715 						}
2716 						tp->sackhint.recover_fs = max(1,
2717 						    tp->snd_nxt - tp->snd_una);
2718 					}
2719 					if ((tp->t_flags & TF_SACK_PERMIT) &&
2720 					    (to.to_flags & TOF_SACK)) {
2721 						TCPSTAT_INC(
2722 						    tcps_sack_recovery_episode);
2723 						tp->snd_recover = tp->snd_nxt;
2724 						tp->snd_cwnd = maxseg;
2725 						(void) tp->t_fb->tfb_tcp_output(tp);
2726 						if (SEQ_GT(th->th_ack, tp->snd_una))
2727 							goto resume_partialack;
2728 						goto drop;
2729 					}
2730 					tp->snd_nxt = th->th_ack;
2731 					tp->snd_cwnd = maxseg;
2732 					(void) tp->t_fb->tfb_tcp_output(tp);
2733 					KASSERT(tp->snd_limited <= 2,
2734 					    ("%s: tp->snd_limited too big",
2735 					    __func__));
2736 					tp->snd_cwnd = tp->snd_ssthresh +
2737 					     maxseg *
2738 					     (tp->t_dupacks - tp->snd_limited);
2739 					if (SEQ_GT(onxt, tp->snd_nxt))
2740 						tp->snd_nxt = onxt;
2741 					goto drop;
2742 				} else if (V_tcp_do_rfc3042) {
2743 					/*
2744 					 * Process first and second duplicate
2745 					 * ACKs. Each indicates a segment
2746 					 * leaving the network, creating room
2747 					 * for more. Make sure we can send a
2748 					 * packet on reception of each duplicate
2749 					 * ACK by increasing snd_cwnd by one
2750 					 * segment. Restore the original
2751 					 * snd_cwnd after packet transmission.
2752 					 */
2753 					cc_ack_received(tp, th, nsegs,
2754 					    CC_DUPACK);
2755 					uint32_t oldcwnd = tp->snd_cwnd;
2756 					tcp_seq oldsndmax = tp->snd_max;
2757 					u_int sent;
2758 					int avail;
2759 
2760 					KASSERT(tp->t_dupacks == 1 ||
2761 					    tp->t_dupacks == 2,
2762 					    ("%s: dupacks not 1 or 2",
2763 					    __func__));
2764 					if (tp->t_dupacks == 1)
2765 						tp->snd_limited = 0;
2766 					tp->snd_cwnd =
2767 					    (tp->snd_nxt - tp->snd_una) +
2768 					    (tp->t_dupacks - tp->snd_limited) *
2769 					    maxseg;
2770 					/*
2771 					 * Only call tcp_output when there
2772 					 * is new data available to be sent.
2773 					 * Otherwise we would send pure ACKs.
2774 					 */
2775 					SOCKBUF_LOCK(&so->so_snd);
2776 					avail = sbavail(&so->so_snd) -
2777 					    (tp->snd_nxt - tp->snd_una);
2778 					SOCKBUF_UNLOCK(&so->so_snd);
2779 					if (avail > 0)
2780 						(void) tp->t_fb->tfb_tcp_output(tp);
2781 					sent = tp->snd_max - oldsndmax;
2782 					if (sent > maxseg) {
2783 						KASSERT((tp->t_dupacks == 2 &&
2784 						    tp->snd_limited == 0) ||
2785 						   (sent == maxseg + 1 &&
2786 						    tp->t_flags & TF_SENTFIN),
2787 						    ("%s: sent too much",
2788 						    __func__));
2789 						tp->snd_limited = 2;
2790 					} else if (sent > 0)
2791 						++tp->snd_limited;
2792 					tp->snd_cwnd = oldcwnd;
2793 					goto drop;
2794 				}
2795 			}
2796 			break;
2797 		} else {
2798 			/*
2799 			 * This ack is advancing the left edge, reset the
2800 			 * counter.
2801 			 */
2802 			tp->t_dupacks = 0;
2803 			/*
2804 			 * If this ack also has new SACK info, increment the
2805 			 * counter as per rfc6675. The variable
2806 			 * sack_changed tracks all changes to the SACK
2807 			 * scoreboard, including when partial ACKs without
2808 			 * SACK options are received, and clear the scoreboard
2809 			 * from the left side. Such partial ACKs should not be
2810 			 * counted as dupacks here.
2811 			 */
2812 			if ((tp->t_flags & TF_SACK_PERMIT) &&
2813 			    (to.to_flags & TOF_SACK) &&
2814 			    sack_changed) {
2815 				tp->t_dupacks++;
2816 				/* limit overhead by setting maxseg last */
2817 				if (!IN_FASTRECOVERY(tp->t_flags) &&
2818 				    (tp->sackhint.sacked_bytes >
2819 				    ((tcprexmtthresh - 1) *
2820 				    (maxseg = tcp_maxseg(tp))))) {
2821 					goto enter_recovery;
2822 				}
2823 			}
2824 		}
2825 
2826 resume_partialack:
2827 		KASSERT(SEQ_GT(th->th_ack, tp->snd_una),
2828 		    ("%s: th_ack <= snd_una", __func__));
2829 
2830 		/*
2831 		 * If the congestion window was inflated to account
2832 		 * for the other side's cached packets, retract it.
2833 		 */
2834 		if (IN_FASTRECOVERY(tp->t_flags)) {
2835 			if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2836 				if (tp->t_flags & TF_SACK_PERMIT)
2837 					if (V_tcp_do_prr && to.to_flags & TOF_SACK) {
2838 						tcp_timer_activate(tp, TT_REXMT, 0);
2839 						tp->t_rtttime = 0;
2840 						tcp_do_prr_ack(tp, th, &to);
2841 						tp->t_flags |= TF_ACKNOW;
2842 						(void) tcp_output(tp);
2843 					} else
2844 						tcp_sack_partialack(tp, th);
2845 				else
2846 					tcp_newreno_partial_ack(tp, th);
2847 			} else
2848 				cc_post_recovery(tp, th);
2849 		} else if (IN_CONGRECOVERY(tp->t_flags)) {
2850 			if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2851 				if (V_tcp_do_prr) {
2852 					tp->sackhint.delivered_data = BYTES_THIS_ACK(tp, th);
2853 					tp->snd_fack = th->th_ack;
2854 					tcp_do_prr_ack(tp, th, &to);
2855 					(void) tcp_output(tp);
2856 				}
2857 			} else
2858 				cc_post_recovery(tp, th);
2859 		}
2860 		/*
2861 		 * If we reach this point, ACK is not a duplicate,
2862 		 *     i.e., it ACKs something we sent.
2863 		 */
2864 		if (tp->t_flags & TF_NEEDSYN) {
2865 			/*
2866 			 * T/TCP: Connection was half-synchronized, and our
2867 			 * SYN has been ACK'd (so connection is now fully
2868 			 * synchronized).  Go to non-starred state,
2869 			 * increment snd_una for ACK of SYN, and check if
2870 			 * we can do window scaling.
2871 			 */
2872 			tp->t_flags &= ~TF_NEEDSYN;
2873 			tp->snd_una++;
2874 			/* Do window scaling? */
2875 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2876 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
2877 				tp->rcv_scale = tp->request_r_scale;
2878 				/* Send window already scaled. */
2879 			}
2880 		}
2881 
2882 process_ACK:
2883 		INP_WLOCK_ASSERT(tp->t_inpcb);
2884 
2885 		/*
2886 		 * Adjust for the SYN bit in sequence space,
2887 		 * but don't account for it in cwnd calculations.
2888 		 * This is for the SYN_RECEIVED, non-simultaneous
2889 		 * SYN case. SYN_SENT and simultaneous SYN are
2890 		 * treated elsewhere.
2891 		 */
2892 		if (incforsyn)
2893 			tp->snd_una++;
2894 		acked = BYTES_THIS_ACK(tp, th);
2895 		KASSERT(acked >= 0, ("%s: acked unexepectedly negative "
2896 		    "(tp->snd_una=%u, th->th_ack=%u, tp=%p, m=%p)", __func__,
2897 		    tp->snd_una, th->th_ack, tp, m));
2898 		TCPSTAT_ADD(tcps_rcvackpack, nsegs);
2899 		TCPSTAT_ADD(tcps_rcvackbyte, acked);
2900 
2901 		/*
2902 		 * If we just performed our first retransmit, and the ACK
2903 		 * arrives within our recovery window, then it was a mistake
2904 		 * to do the retransmit in the first place.  Recover our
2905 		 * original cwnd and ssthresh, and proceed to transmit where
2906 		 * we left off.
2907 		 */
2908 		if (tp->t_rxtshift == 1 &&
2909 		    tp->t_flags & TF_PREVVALID &&
2910 		    tp->t_badrxtwin &&
2911 		    SEQ_LT(to.to_tsecr, tp->t_badrxtwin))
2912 			cc_cong_signal(tp, th, CC_RTO_ERR);
2913 
2914 		/*
2915 		 * If we have a timestamp reply, update smoothed
2916 		 * round trip time.  If no timestamp is present but
2917 		 * transmit timer is running and timed sequence
2918 		 * number was acked, update smoothed round trip time.
2919 		 * Since we now have an rtt measurement, cancel the
2920 		 * timer backoff (cf., Phil Karn's retransmit alg.).
2921 		 * Recompute the initial retransmit timer.
2922 		 *
2923 		 * Some boxes send broken timestamp replies
2924 		 * during the SYN+ACK phase, ignore
2925 		 * timestamps of 0 or we could calculate a
2926 		 * huge RTT and blow up the retransmit timer.
2927 		 */
2928 		if ((to.to_flags & TOF_TS) != 0 && to.to_tsecr) {
2929 			uint32_t t;
2930 
2931 			t = tcp_ts_getticks() - to.to_tsecr;
2932 			if (!tp->t_rttlow || tp->t_rttlow > t)
2933 				tp->t_rttlow = t;
2934 			tcp_xmit_timer(tp, TCP_TS_TO_TICKS(t) + 1);
2935 		} else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) {
2936 			if (!tp->t_rttlow || tp->t_rttlow > ticks - tp->t_rtttime)
2937 				tp->t_rttlow = ticks - tp->t_rtttime;
2938 			tcp_xmit_timer(tp, ticks - tp->t_rtttime);
2939 		}
2940 
2941 		/*
2942 		 * If all outstanding data is acked, stop retransmit
2943 		 * timer and remember to restart (more output or persist).
2944 		 * If there is more data to be acked, restart retransmit
2945 		 * timer, using current (possibly backed-off) value.
2946 		 */
2947 		if (th->th_ack == tp->snd_max) {
2948 			tcp_timer_activate(tp, TT_REXMT, 0);
2949 			needoutput = 1;
2950 		} else if (!tcp_timer_active(tp, TT_PERSIST))
2951 			tcp_timer_activate(tp, TT_REXMT, tp->t_rxtcur);
2952 
2953 		/*
2954 		 * If no data (only SYN) was ACK'd,
2955 		 *    skip rest of ACK processing.
2956 		 */
2957 		if (acked == 0)
2958 			goto step6;
2959 
2960 		/*
2961 		 * Let the congestion control algorithm update congestion
2962 		 * control related information. This typically means increasing
2963 		 * the congestion window.
2964 		 */
2965 		cc_ack_received(tp, th, nsegs, CC_ACK);
2966 
2967 		SOCKBUF_LOCK(&so->so_snd);
2968 		if (acked > sbavail(&so->so_snd)) {
2969 			if (tp->snd_wnd >= sbavail(&so->so_snd))
2970 				tp->snd_wnd -= sbavail(&so->so_snd);
2971 			else
2972 				tp->snd_wnd = 0;
2973 			mfree = sbcut_locked(&so->so_snd,
2974 			    (int)sbavail(&so->so_snd));
2975 			ourfinisacked = 1;
2976 		} else {
2977 			mfree = sbcut_locked(&so->so_snd, acked);
2978 			if (tp->snd_wnd >= (uint32_t) acked)
2979 				tp->snd_wnd -= acked;
2980 			else
2981 				tp->snd_wnd = 0;
2982 			ourfinisacked = 0;
2983 		}
2984 		/* NB: sowwakeup_locked() does an implicit unlock. */
2985 		sowwakeup_locked(so);
2986 		m_freem(mfree);
2987 		/* Detect una wraparound. */
2988 		if (!IN_RECOVERY(tp->t_flags) &&
2989 		    SEQ_GT(tp->snd_una, tp->snd_recover) &&
2990 		    SEQ_LEQ(th->th_ack, tp->snd_recover))
2991 			tp->snd_recover = th->th_ack - 1;
2992 		/* XXXLAS: Can this be moved up into cc_post_recovery? */
2993 		if (IN_RECOVERY(tp->t_flags) &&
2994 		    SEQ_GEQ(th->th_ack, tp->snd_recover)) {
2995 			EXIT_RECOVERY(tp->t_flags);
2996 		}
2997 		tp->snd_una = th->th_ack;
2998 		if (tp->t_flags & TF_SACK_PERMIT) {
2999 			if (SEQ_GT(tp->snd_una, tp->snd_recover))
3000 				tp->snd_recover = tp->snd_una;
3001 		}
3002 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
3003 			tp->snd_nxt = tp->snd_una;
3004 
3005 		switch (tp->t_state) {
3006 		/*
3007 		 * In FIN_WAIT_1 STATE in addition to the processing
3008 		 * for the ESTABLISHED state if our FIN is now acknowledged
3009 		 * then enter FIN_WAIT_2.
3010 		 */
3011 		case TCPS_FIN_WAIT_1:
3012 			if (ourfinisacked) {
3013 				/*
3014 				 * If we can't receive any more
3015 				 * data, then closing user can proceed.
3016 				 * Starting the timer is contrary to the
3017 				 * specification, but if we don't get a FIN
3018 				 * we'll hang forever.
3019 				 *
3020 				 * XXXjl:
3021 				 * we should release the tp also, and use a
3022 				 * compressed state.
3023 				 */
3024 				if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
3025 					soisdisconnected(so);
3026 					tcp_timer_activate(tp, TT_2MSL,
3027 					    (tcp_fast_finwait2_recycle ?
3028 					    tcp_finwait2_timeout :
3029 					    TP_MAXIDLE(tp)));
3030 				}
3031 				tcp_state_change(tp, TCPS_FIN_WAIT_2);
3032 			}
3033 			break;
3034 
3035 		/*
3036 		 * In CLOSING STATE in addition to the processing for
3037 		 * the ESTABLISHED state if the ACK acknowledges our FIN
3038 		 * then enter the TIME-WAIT state, otherwise ignore
3039 		 * the segment.
3040 		 */
3041 		case TCPS_CLOSING:
3042 			if (ourfinisacked) {
3043 				tcp_twstart(tp);
3044 				m_freem(m);
3045 				return;
3046 			}
3047 			break;
3048 
3049 		/*
3050 		 * In LAST_ACK, we may still be waiting for data to drain
3051 		 * and/or to be acked, as well as for the ack of our FIN.
3052 		 * If our FIN is now acknowledged, delete the TCB,
3053 		 * enter the closed state and return.
3054 		 */
3055 		case TCPS_LAST_ACK:
3056 			if (ourfinisacked) {
3057 				tp = tcp_close(tp);
3058 				goto drop;
3059 			}
3060 			break;
3061 		}
3062 	}
3063 
3064 step6:
3065 	INP_WLOCK_ASSERT(tp->t_inpcb);
3066 
3067 	/*
3068 	 * Update window information.
3069 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
3070 	 */
3071 	if ((thflags & TH_ACK) &&
3072 	    (SEQ_LT(tp->snd_wl1, th->th_seq) ||
3073 	    (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
3074 	     (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
3075 		/* keep track of pure window updates */
3076 		if (tlen == 0 &&
3077 		    tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
3078 			TCPSTAT_INC(tcps_rcvwinupd);
3079 		tp->snd_wnd = tiwin;
3080 		tp->snd_wl1 = th->th_seq;
3081 		tp->snd_wl2 = th->th_ack;
3082 		if (tp->snd_wnd > tp->max_sndwnd)
3083 			tp->max_sndwnd = tp->snd_wnd;
3084 		needoutput = 1;
3085 	}
3086 
3087 	/*
3088 	 * Process segments with URG.
3089 	 */
3090 	if ((thflags & TH_URG) && th->th_urp &&
3091 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
3092 		/*
3093 		 * This is a kludge, but if we receive and accept
3094 		 * random urgent pointers, we'll crash in
3095 		 * soreceive.  It's hard to imagine someone
3096 		 * actually wanting to send this much urgent data.
3097 		 */
3098 		SOCKBUF_LOCK(&so->so_rcv);
3099 		if (th->th_urp + sbavail(&so->so_rcv) > sb_max) {
3100 			th->th_urp = 0;			/* XXX */
3101 			thflags &= ~TH_URG;		/* XXX */
3102 			SOCKBUF_UNLOCK(&so->so_rcv);	/* XXX */
3103 			goto dodata;			/* XXX */
3104 		}
3105 		/*
3106 		 * If this segment advances the known urgent pointer,
3107 		 * then mark the data stream.  This should not happen
3108 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
3109 		 * a FIN has been received from the remote side.
3110 		 * In these states we ignore the URG.
3111 		 *
3112 		 * According to RFC961 (Assigned Protocols),
3113 		 * the urgent pointer points to the last octet
3114 		 * of urgent data.  We continue, however,
3115 		 * to consider it to indicate the first octet
3116 		 * of data past the urgent section as the original
3117 		 * spec states (in one of two places).
3118 		 */
3119 		if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
3120 			tp->rcv_up = th->th_seq + th->th_urp;
3121 			so->so_oobmark = sbavail(&so->so_rcv) +
3122 			    (tp->rcv_up - tp->rcv_nxt) - 1;
3123 			if (so->so_oobmark == 0)
3124 				so->so_rcv.sb_state |= SBS_RCVATMARK;
3125 			sohasoutofband(so);
3126 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
3127 		}
3128 		SOCKBUF_UNLOCK(&so->so_rcv);
3129 		/*
3130 		 * Remove out of band data so doesn't get presented to user.
3131 		 * This can happen independent of advancing the URG pointer,
3132 		 * but if two URG's are pending at once, some out-of-band
3133 		 * data may creep in... ick.
3134 		 */
3135 		if (th->th_urp <= (uint32_t)tlen &&
3136 		    !(so->so_options & SO_OOBINLINE)) {
3137 			/* hdr drop is delayed */
3138 			tcp_pulloutofband(so, th, m, drop_hdrlen);
3139 		}
3140 	} else {
3141 		/*
3142 		 * If no out of band data is expected,
3143 		 * pull receive urgent pointer along
3144 		 * with the receive window.
3145 		 */
3146 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
3147 			tp->rcv_up = tp->rcv_nxt;
3148 	}
3149 dodata:							/* XXX */
3150 	INP_WLOCK_ASSERT(tp->t_inpcb);
3151 
3152 	/*
3153 	 * Process the segment text, merging it into the TCP sequencing queue,
3154 	 * and arranging for acknowledgment of receipt if necessary.
3155 	 * This process logically involves adjusting tp->rcv_wnd as data
3156 	 * is presented to the user (this happens in tcp_usrreq.c,
3157 	 * case PRU_RCVD).  If a FIN has already been received on this
3158 	 * connection then we just ignore the text.
3159 	 */
3160 	tfo_syn = ((tp->t_state == TCPS_SYN_RECEIVED) &&
3161 		   IS_FASTOPEN(tp->t_flags));
3162 	if ((tlen || (thflags & TH_FIN) || (tfo_syn && tlen > 0)) &&
3163 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
3164 		tcp_seq save_start = th->th_seq;
3165 		tcp_seq save_rnxt  = tp->rcv_nxt;
3166 		int     save_tlen  = tlen;
3167 		m_adj(m, drop_hdrlen);	/* delayed header drop */
3168 		/*
3169 		 * Insert segment which includes th into TCP reassembly queue
3170 		 * with control block tp.  Set thflags to whether reassembly now
3171 		 * includes a segment with FIN.  This handles the common case
3172 		 * inline (segment is the next to be received on an established
3173 		 * connection, and the queue is empty), avoiding linkage into
3174 		 * and removal from the queue and repetition of various
3175 		 * conversions.
3176 		 * Set DELACK for segments received in order, but ack
3177 		 * immediately when segments are out of order (so
3178 		 * fast retransmit can work).
3179 		 */
3180 		if (th->th_seq == tp->rcv_nxt &&
3181 		    SEGQ_EMPTY(tp) &&
3182 		    (TCPS_HAVEESTABLISHED(tp->t_state) ||
3183 		     tfo_syn)) {
3184 			if (DELAY_ACK(tp, tlen) || tfo_syn)
3185 				tp->t_flags |= TF_DELACK;
3186 			else
3187 				tp->t_flags |= TF_ACKNOW;
3188 			tp->rcv_nxt += tlen;
3189 			if (tlen &&
3190 			    ((tp->t_flags2 & TF2_FBYTES_COMPLETE) == 0) &&
3191 			    (tp->t_fbyte_in == 0)) {
3192 				tp->t_fbyte_in = ticks;
3193 				if (tp->t_fbyte_in == 0)
3194 					tp->t_fbyte_in = 1;
3195 				if (tp->t_fbyte_out && tp->t_fbyte_in)
3196 					tp->t_flags2 |= TF2_FBYTES_COMPLETE;
3197 			}
3198 			thflags = th->th_flags & TH_FIN;
3199 			TCPSTAT_INC(tcps_rcvpack);
3200 			TCPSTAT_ADD(tcps_rcvbyte, tlen);
3201 			SOCKBUF_LOCK(&so->so_rcv);
3202 			if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
3203 				m_freem(m);
3204 			else
3205 				sbappendstream_locked(&so->so_rcv, m, 0);
3206 			tp->t_flags |= TF_WAKESOR;
3207 		} else {
3208 			/*
3209 			 * XXX: Due to the header drop above "th" is
3210 			 * theoretically invalid by now.  Fortunately
3211 			 * m_adj() doesn't actually frees any mbufs
3212 			 * when trimming from the head.
3213 			 */
3214 			tcp_seq temp = save_start;
3215 
3216 			thflags = tcp_reass(tp, th, &temp, &tlen, m);
3217 			tp->t_flags |= TF_ACKNOW;
3218 		}
3219 		if ((tp->t_flags & TF_SACK_PERMIT) &&
3220 		    (save_tlen > 0) &&
3221 		    TCPS_HAVEESTABLISHED(tp->t_state)) {
3222 			if ((tlen == 0) && (SEQ_LT(save_start, save_rnxt))) {
3223 				/*
3224 				 * DSACK actually handled in the fastpath
3225 				 * above.
3226 				 */
3227 				tcp_update_sack_list(tp, save_start,
3228 				    save_start + save_tlen);
3229 			} else if ((tlen > 0) && SEQ_GT(tp->rcv_nxt, save_rnxt)) {
3230 				if ((tp->rcv_numsacks >= 1) &&
3231 				    (tp->sackblks[0].end == save_start)) {
3232 					/*
3233 					 * Partial overlap, recorded at todrop
3234 					 * above.
3235 					 */
3236 					tcp_update_sack_list(tp,
3237 					    tp->sackblks[0].start,
3238 					    tp->sackblks[0].end);
3239 				} else {
3240 					tcp_update_dsack_list(tp, save_start,
3241 					    save_start + save_tlen);
3242 				}
3243 			} else if (tlen >= save_tlen) {
3244 				/* Update of sackblks. */
3245 				tcp_update_dsack_list(tp, save_start,
3246 				    save_start + save_tlen);
3247 			} else if (tlen > 0) {
3248 				tcp_update_dsack_list(tp, save_start,
3249 				    save_start + tlen);
3250 			}
3251 		}
3252 		tcp_handle_wakeup(tp, so);
3253 #if 0
3254 		/*
3255 		 * Note the amount of data that peer has sent into
3256 		 * our window, in order to estimate the sender's
3257 		 * buffer size.
3258 		 * XXX: Unused.
3259 		 */
3260 		if (SEQ_GT(tp->rcv_adv, tp->rcv_nxt))
3261 			len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
3262 		else
3263 			len = so->so_rcv.sb_hiwat;
3264 #endif
3265 	} else {
3266 		m_freem(m);
3267 		thflags &= ~TH_FIN;
3268 	}
3269 
3270 	/*
3271 	 * If FIN is received ACK the FIN and let the user know
3272 	 * that the connection is closing.
3273 	 */
3274 	if (thflags & TH_FIN) {
3275 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
3276 			/* The socket upcall is handled by socantrcvmore. */
3277 			socantrcvmore(so);
3278 			/*
3279 			 * If connection is half-synchronized
3280 			 * (ie NEEDSYN flag on) then delay ACK,
3281 			 * so it may be piggybacked when SYN is sent.
3282 			 * Otherwise, since we received a FIN then no
3283 			 * more input can be expected, send ACK now.
3284 			 */
3285 			if (tp->t_flags & TF_NEEDSYN)
3286 				tp->t_flags |= TF_DELACK;
3287 			else
3288 				tp->t_flags |= TF_ACKNOW;
3289 			tp->rcv_nxt++;
3290 		}
3291 		switch (tp->t_state) {
3292 		/*
3293 		 * In SYN_RECEIVED and ESTABLISHED STATES
3294 		 * enter the CLOSE_WAIT state.
3295 		 */
3296 		case TCPS_SYN_RECEIVED:
3297 			tp->t_starttime = ticks;
3298 			/* FALLTHROUGH */
3299 		case TCPS_ESTABLISHED:
3300 			tcp_state_change(tp, TCPS_CLOSE_WAIT);
3301 			break;
3302 
3303 		/*
3304 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
3305 		 * enter the CLOSING state.
3306 		 */
3307 		case TCPS_FIN_WAIT_1:
3308 			tcp_state_change(tp, TCPS_CLOSING);
3309 			break;
3310 
3311 		/*
3312 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
3313 		 * starting the time-wait timer, turning off the other
3314 		 * standard timers.
3315 		 */
3316 		case TCPS_FIN_WAIT_2:
3317 			tcp_twstart(tp);
3318 			return;
3319 		}
3320 	}
3321 #ifdef TCPDEBUG
3322 	if (so->so_options & SO_DEBUG)
3323 		tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
3324 			  &tcp_savetcp, 0);
3325 #endif
3326 	TCP_PROBE3(debug__input, tp, th, m);
3327 
3328 	/*
3329 	 * Return any desired output.
3330 	 */
3331 	if (needoutput || (tp->t_flags & TF_ACKNOW))
3332 		(void) tp->t_fb->tfb_tcp_output(tp);
3333 
3334 check_delack:
3335 	INP_WLOCK_ASSERT(tp->t_inpcb);
3336 
3337 	if (tp->t_flags & TF_DELACK) {
3338 		tp->t_flags &= ~TF_DELACK;
3339 		tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
3340 	}
3341 	INP_WUNLOCK(tp->t_inpcb);
3342 	return;
3343 
3344 dropafterack:
3345 	/*
3346 	 * Generate an ACK dropping incoming segment if it occupies
3347 	 * sequence space, where the ACK reflects our state.
3348 	 *
3349 	 * We can now skip the test for the RST flag since all
3350 	 * paths to this code happen after packets containing
3351 	 * RST have been dropped.
3352 	 *
3353 	 * In the SYN-RECEIVED state, don't send an ACK unless the
3354 	 * segment we received passes the SYN-RECEIVED ACK test.
3355 	 * If it fails send a RST.  This breaks the loop in the
3356 	 * "LAND" DoS attack, and also prevents an ACK storm
3357 	 * between two listening ports that have been sent forged
3358 	 * SYN segments, each with the source address of the other.
3359 	 */
3360 	if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
3361 	    (SEQ_GT(tp->snd_una, th->th_ack) ||
3362 	     SEQ_GT(th->th_ack, tp->snd_max)) ) {
3363 		rstreason = BANDLIM_RST_OPENPORT;
3364 		goto dropwithreset;
3365 	}
3366 #ifdef TCPDEBUG
3367 	if (so->so_options & SO_DEBUG)
3368 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
3369 			  &tcp_savetcp, 0);
3370 #endif
3371 	TCP_PROBE3(debug__input, tp, th, m);
3372 	tp->t_flags |= TF_ACKNOW;
3373 	(void) tp->t_fb->tfb_tcp_output(tp);
3374 	INP_WUNLOCK(tp->t_inpcb);
3375 	m_freem(m);
3376 	return;
3377 
3378 dropwithreset:
3379 	if (tp != NULL) {
3380 		tcp_dropwithreset(m, th, tp, tlen, rstreason);
3381 		INP_WUNLOCK(tp->t_inpcb);
3382 	} else
3383 		tcp_dropwithreset(m, th, NULL, tlen, rstreason);
3384 	return;
3385 
3386 drop:
3387 	/*
3388 	 * Drop space held by incoming segment and return.
3389 	 */
3390 #ifdef TCPDEBUG
3391 	if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
3392 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
3393 			  &tcp_savetcp, 0);
3394 #endif
3395 	TCP_PROBE3(debug__input, tp, th, m);
3396 	if (tp != NULL) {
3397 		INP_WUNLOCK(tp->t_inpcb);
3398 	}
3399 	m_freem(m);
3400 }
3401 
3402 /*
3403  * Issue RST and make ACK acceptable to originator of segment.
3404  * The mbuf must still include the original packet header.
3405  * tp may be NULL.
3406  */
3407 void
3408 tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
3409     int tlen, int rstreason)
3410 {
3411 #ifdef INET
3412 	struct ip *ip;
3413 #endif
3414 #ifdef INET6
3415 	struct ip6_hdr *ip6;
3416 #endif
3417 
3418 	if (tp != NULL) {
3419 		INP_LOCK_ASSERT(tp->t_inpcb);
3420 	}
3421 
3422 	/* Don't bother if destination was broadcast/multicast. */
3423 	if ((th->th_flags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
3424 		goto drop;
3425 #ifdef INET6
3426 	if (mtod(m, struct ip *)->ip_v == 6) {
3427 		ip6 = mtod(m, struct ip6_hdr *);
3428 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
3429 		    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
3430 			goto drop;
3431 		/* IPv6 anycast check is done at tcp6_input() */
3432 	}
3433 #endif
3434 #if defined(INET) && defined(INET6)
3435 	else
3436 #endif
3437 #ifdef INET
3438 	{
3439 		ip = mtod(m, struct ip *);
3440 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
3441 		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
3442 		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
3443 		    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
3444 			goto drop;
3445 	}
3446 #endif
3447 
3448 	/* Perform bandwidth limiting. */
3449 	if (badport_bandlim(rstreason) < 0)
3450 		goto drop;
3451 
3452 	/* tcp_respond consumes the mbuf chain. */
3453 	if (th->th_flags & TH_ACK) {
3454 		tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0,
3455 		    th->th_ack, TH_RST);
3456 	} else {
3457 		if (th->th_flags & TH_SYN)
3458 			tlen++;
3459 		if (th->th_flags & TH_FIN)
3460 			tlen++;
3461 		tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
3462 		    (tcp_seq)0, TH_RST|TH_ACK);
3463 	}
3464 	return;
3465 drop:
3466 	m_freem(m);
3467 }
3468 
3469 /*
3470  * Parse TCP options and place in tcpopt.
3471  */
3472 void
3473 tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, int flags)
3474 {
3475 	int opt, optlen;
3476 
3477 	to->to_flags = 0;
3478 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
3479 		opt = cp[0];
3480 		if (opt == TCPOPT_EOL)
3481 			break;
3482 		if (opt == TCPOPT_NOP)
3483 			optlen = 1;
3484 		else {
3485 			if (cnt < 2)
3486 				break;
3487 			optlen = cp[1];
3488 			if (optlen < 2 || optlen > cnt)
3489 				break;
3490 		}
3491 		switch (opt) {
3492 		case TCPOPT_MAXSEG:
3493 			if (optlen != TCPOLEN_MAXSEG)
3494 				continue;
3495 			if (!(flags & TO_SYN))
3496 				continue;
3497 			to->to_flags |= TOF_MSS;
3498 			bcopy((char *)cp + 2,
3499 			    (char *)&to->to_mss, sizeof(to->to_mss));
3500 			to->to_mss = ntohs(to->to_mss);
3501 			break;
3502 		case TCPOPT_WINDOW:
3503 			if (optlen != TCPOLEN_WINDOW)
3504 				continue;
3505 			if (!(flags & TO_SYN))
3506 				continue;
3507 			to->to_flags |= TOF_SCALE;
3508 			to->to_wscale = min(cp[2], TCP_MAX_WINSHIFT);
3509 			break;
3510 		case TCPOPT_TIMESTAMP:
3511 			if (optlen != TCPOLEN_TIMESTAMP)
3512 				continue;
3513 			to->to_flags |= TOF_TS;
3514 			bcopy((char *)cp + 2,
3515 			    (char *)&to->to_tsval, sizeof(to->to_tsval));
3516 			to->to_tsval = ntohl(to->to_tsval);
3517 			bcopy((char *)cp + 6,
3518 			    (char *)&to->to_tsecr, sizeof(to->to_tsecr));
3519 			to->to_tsecr = ntohl(to->to_tsecr);
3520 			break;
3521 		case TCPOPT_SIGNATURE:
3522 			/*
3523 			 * In order to reply to a host which has set the
3524 			 * TCP_SIGNATURE option in its initial SYN, we have
3525 			 * to record the fact that the option was observed
3526 			 * here for the syncache code to perform the correct
3527 			 * response.
3528 			 */
3529 			if (optlen != TCPOLEN_SIGNATURE)
3530 				continue;
3531 			to->to_flags |= TOF_SIGNATURE;
3532 			to->to_signature = cp + 2;
3533 			break;
3534 		case TCPOPT_SACK_PERMITTED:
3535 			if (optlen != TCPOLEN_SACK_PERMITTED)
3536 				continue;
3537 			if (!(flags & TO_SYN))
3538 				continue;
3539 			if (!V_tcp_do_sack)
3540 				continue;
3541 			to->to_flags |= TOF_SACKPERM;
3542 			break;
3543 		case TCPOPT_SACK:
3544 			if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
3545 				continue;
3546 			if (flags & TO_SYN)
3547 				continue;
3548 			to->to_flags |= TOF_SACK;
3549 			to->to_nsacks = (optlen - 2) / TCPOLEN_SACK;
3550 			to->to_sacks = cp + 2;
3551 			TCPSTAT_INC(tcps_sack_rcv_blocks);
3552 			break;
3553 		case TCPOPT_FAST_OPEN:
3554 			/*
3555 			 * Cookie length validation is performed by the
3556 			 * server side cookie checking code or the client
3557 			 * side cookie cache update code.
3558 			 */
3559 			if (!(flags & TO_SYN))
3560 				continue;
3561 			if (!V_tcp_fastopen_client_enable &&
3562 			    !V_tcp_fastopen_server_enable)
3563 				continue;
3564 			to->to_flags |= TOF_FASTOPEN;
3565 			to->to_tfo_len = optlen - 2;
3566 			to->to_tfo_cookie = to->to_tfo_len ? cp + 2 : NULL;
3567 			break;
3568 		default:
3569 			continue;
3570 		}
3571 	}
3572 }
3573 
3574 /*
3575  * Pull out of band byte out of a segment so
3576  * it doesn't appear in the user's data queue.
3577  * It is still reflected in the segment length for
3578  * sequencing purposes.
3579  */
3580 void
3581 tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m,
3582     int off)
3583 {
3584 	int cnt = off + th->th_urp - 1;
3585 
3586 	while (cnt >= 0) {
3587 		if (m->m_len > cnt) {
3588 			char *cp = mtod(m, caddr_t) + cnt;
3589 			struct tcpcb *tp = sototcpcb(so);
3590 
3591 			INP_WLOCK_ASSERT(tp->t_inpcb);
3592 
3593 			tp->t_iobc = *cp;
3594 			tp->t_oobflags |= TCPOOB_HAVEDATA;
3595 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3596 			m->m_len--;
3597 			if (m->m_flags & M_PKTHDR)
3598 				m->m_pkthdr.len--;
3599 			return;
3600 		}
3601 		cnt -= m->m_len;
3602 		m = m->m_next;
3603 		if (m == NULL)
3604 			break;
3605 	}
3606 	panic("tcp_pulloutofband");
3607 }
3608 
3609 /*
3610  * Collect new round-trip time estimate
3611  * and update averages and current timeout.
3612  */
3613 void
3614 tcp_xmit_timer(struct tcpcb *tp, int rtt)
3615 {
3616 	int delta;
3617 
3618 	INP_WLOCK_ASSERT(tp->t_inpcb);
3619 
3620 	TCPSTAT_INC(tcps_rttupdated);
3621 	tp->t_rttupdated++;
3622 #ifdef STATS
3623 	stats_voi_update_abs_u32(tp->t_stats, VOI_TCP_RTT,
3624 	    imax(0, rtt * 1000 / hz));
3625 #endif
3626 	if ((tp->t_srtt != 0) && (tp->t_rxtshift <= TCP_RTT_INVALIDATE)) {
3627 		/*
3628 		 * srtt is stored as fixed point with 5 bits after the
3629 		 * binary point (i.e., scaled by 8).  The following magic
3630 		 * is equivalent to the smoothing algorithm in rfc793 with
3631 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
3632 		 * point).  Adjust rtt to origin 0.
3633 		 */
3634 		delta = ((rtt - 1) << TCP_DELTA_SHIFT)
3635 			- (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
3636 
3637 		if ((tp->t_srtt += delta) <= 0)
3638 			tp->t_srtt = 1;
3639 
3640 		/*
3641 		 * We accumulate a smoothed rtt variance (actually, a
3642 		 * smoothed mean difference), then set the retransmit
3643 		 * timer to smoothed rtt + 4 times the smoothed variance.
3644 		 * rttvar is stored as fixed point with 4 bits after the
3645 		 * binary point (scaled by 16).  The following is
3646 		 * equivalent to rfc793 smoothing with an alpha of .75
3647 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
3648 		 * rfc793's wired-in beta.
3649 		 */
3650 		if (delta < 0)
3651 			delta = -delta;
3652 		delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
3653 		if ((tp->t_rttvar += delta) <= 0)
3654 			tp->t_rttvar = 1;
3655 		if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar)
3656 		    tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
3657 	} else {
3658 		/*
3659 		 * No rtt measurement yet - use the unsmoothed rtt.
3660 		 * Set the variance to half the rtt (so our first
3661 		 * retransmit happens at 3*rtt).
3662 		 */
3663 		tp->t_srtt = rtt << TCP_RTT_SHIFT;
3664 		tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
3665 		tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
3666 	}
3667 	tp->t_rtttime = 0;
3668 	tp->t_rxtshift = 0;
3669 
3670 	/*
3671 	 * the retransmit should happen at rtt + 4 * rttvar.
3672 	 * Because of the way we do the smoothing, srtt and rttvar
3673 	 * will each average +1/2 tick of bias.  When we compute
3674 	 * the retransmit timer, we want 1/2 tick of rounding and
3675 	 * 1 extra tick because of +-1/2 tick uncertainty in the
3676 	 * firing of the timer.  The bias will give us exactly the
3677 	 * 1.5 tick we need.  But, because the bias is
3678 	 * statistical, we have to test that we don't drop below
3679 	 * the minimum feasible timer (which is 2 ticks).
3680 	 */
3681 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3682 		      max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3683 
3684 	/*
3685 	 * We received an ack for a packet that wasn't retransmitted;
3686 	 * it is probably safe to discard any error indications we've
3687 	 * received recently.  This isn't quite right, but close enough
3688 	 * for now (a route might have failed after we sent a segment,
3689 	 * and the return path might not be symmetrical).
3690 	 */
3691 	tp->t_softerror = 0;
3692 }
3693 
3694 /*
3695  * Determine a reasonable value for maxseg size.
3696  * If the route is known, check route for mtu.
3697  * If none, use an mss that can be handled on the outgoing interface
3698  * without forcing IP to fragment.  If no route is found, route has no mtu,
3699  * or the destination isn't local, use a default, hopefully conservative
3700  * size (usually 512 or the default IP max size, but no more than the mtu
3701  * of the interface), as we can't discover anything about intervening
3702  * gateways or networks.  We also initialize the congestion/slow start
3703  * window to be a single segment if the destination isn't local.
3704  * While looking at the routing entry, we also initialize other path-dependent
3705  * parameters from pre-set or cached values in the routing entry.
3706  *
3707  * NOTE that resulting t_maxseg doesn't include space for TCP options or
3708  * IP options, e.g. IPSEC data, since length of this data may vary, and
3709  * thus it is calculated for every segment separately in tcp_output().
3710  *
3711  * NOTE that this routine is only called when we process an incoming
3712  * segment, or an ICMP need fragmentation datagram. Outgoing SYN/ACK MSS
3713  * settings are handled in tcp_mssopt().
3714  */
3715 void
3716 tcp_mss_update(struct tcpcb *tp, int offer, int mtuoffer,
3717     struct hc_metrics_lite *metricptr, struct tcp_ifcap *cap)
3718 {
3719 	int mss = 0;
3720 	uint32_t maxmtu = 0;
3721 	struct inpcb *inp = tp->t_inpcb;
3722 	struct hc_metrics_lite metrics;
3723 #ifdef INET6
3724 	int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
3725 	size_t min_protoh = isipv6 ?
3726 			    sizeof (struct ip6_hdr) + sizeof (struct tcphdr) :
3727 			    sizeof (struct tcpiphdr);
3728 #else
3729 	 size_t min_protoh = sizeof(struct tcpiphdr);
3730 #endif
3731 
3732 	INP_WLOCK_ASSERT(tp->t_inpcb);
3733 
3734 	if (tp->t_port)
3735 		min_protoh += V_tcp_udp_tunneling_overhead;
3736 	if (mtuoffer != -1) {
3737 		KASSERT(offer == -1, ("%s: conflict", __func__));
3738 		offer = mtuoffer - min_protoh;
3739 	}
3740 
3741 	/* Initialize. */
3742 #ifdef INET6
3743 	if (isipv6) {
3744 		maxmtu = tcp_maxmtu6(&inp->inp_inc, cap);
3745 		tp->t_maxseg = V_tcp_v6mssdflt;
3746 	}
3747 #endif
3748 #if defined(INET) && defined(INET6)
3749 	else
3750 #endif
3751 #ifdef INET
3752 	{
3753 		maxmtu = tcp_maxmtu(&inp->inp_inc, cap);
3754 		tp->t_maxseg = V_tcp_mssdflt;
3755 	}
3756 #endif
3757 
3758 	/*
3759 	 * No route to sender, stay with default mss and return.
3760 	 */
3761 	if (maxmtu == 0) {
3762 		/*
3763 		 * In case we return early we need to initialize metrics
3764 		 * to a defined state as tcp_hc_get() would do for us
3765 		 * if there was no cache hit.
3766 		 */
3767 		if (metricptr != NULL)
3768 			bzero(metricptr, sizeof(struct hc_metrics_lite));
3769 		return;
3770 	}
3771 
3772 	/* What have we got? */
3773 	switch (offer) {
3774 		case 0:
3775 			/*
3776 			 * Offer == 0 means that there was no MSS on the SYN
3777 			 * segment, in this case we use tcp_mssdflt as
3778 			 * already assigned to t_maxseg above.
3779 			 */
3780 			offer = tp->t_maxseg;
3781 			break;
3782 
3783 		case -1:
3784 			/*
3785 			 * Offer == -1 means that we didn't receive SYN yet.
3786 			 */
3787 			/* FALLTHROUGH */
3788 
3789 		default:
3790 			/*
3791 			 * Prevent DoS attack with too small MSS. Round up
3792 			 * to at least minmss.
3793 			 */
3794 			offer = max(offer, V_tcp_minmss);
3795 	}
3796 
3797 	/*
3798 	 * rmx information is now retrieved from tcp_hostcache.
3799 	 */
3800 	tcp_hc_get(&inp->inp_inc, &metrics);
3801 	if (metricptr != NULL)
3802 		bcopy(&metrics, metricptr, sizeof(struct hc_metrics_lite));
3803 
3804 	/*
3805 	 * If there's a discovered mtu in tcp hostcache, use it.
3806 	 * Else, use the link mtu.
3807 	 */
3808 	if (metrics.rmx_mtu)
3809 		mss = min(metrics.rmx_mtu, maxmtu) - min_protoh;
3810 	else {
3811 #ifdef INET6
3812 		if (isipv6) {
3813 			mss = maxmtu - min_protoh;
3814 			if (!V_path_mtu_discovery &&
3815 			    !in6_localaddr(&inp->in6p_faddr))
3816 				mss = min(mss, V_tcp_v6mssdflt);
3817 		}
3818 #endif
3819 #if defined(INET) && defined(INET6)
3820 		else
3821 #endif
3822 #ifdef INET
3823 		{
3824 			mss = maxmtu - min_protoh;
3825 			if (!V_path_mtu_discovery &&
3826 			    !in_localaddr(inp->inp_faddr))
3827 				mss = min(mss, V_tcp_mssdflt);
3828 		}
3829 #endif
3830 		/*
3831 		 * XXX - The above conditional (mss = maxmtu - min_protoh)
3832 		 * probably violates the TCP spec.
3833 		 * The problem is that, since we don't know the
3834 		 * other end's MSS, we are supposed to use a conservative
3835 		 * default.  But, if we do that, then MTU discovery will
3836 		 * never actually take place, because the conservative
3837 		 * default is much less than the MTUs typically seen
3838 		 * on the Internet today.  For the moment, we'll sweep
3839 		 * this under the carpet.
3840 		 *
3841 		 * The conservative default might not actually be a problem
3842 		 * if the only case this occurs is when sending an initial
3843 		 * SYN with options and data to a host we've never talked
3844 		 * to before.  Then, they will reply with an MSS value which
3845 		 * will get recorded and the new parameters should get
3846 		 * recomputed.  For Further Study.
3847 		 */
3848 	}
3849 	mss = min(mss, offer);
3850 
3851 	/*
3852 	 * Sanity check: make sure that maxseg will be large
3853 	 * enough to allow some data on segments even if the
3854 	 * all the option space is used (40bytes).  Otherwise
3855 	 * funny things may happen in tcp_output.
3856 	 *
3857 	 * XXXGL: shouldn't we reserve space for IP/IPv6 options?
3858 	 */
3859 	mss = max(mss, 64);
3860 
3861 	tp->t_maxseg = mss;
3862 }
3863 
3864 void
3865 tcp_mss(struct tcpcb *tp, int offer)
3866 {
3867 	int mss;
3868 	uint32_t bufsize;
3869 	struct inpcb *inp;
3870 	struct socket *so;
3871 	struct hc_metrics_lite metrics;
3872 	struct tcp_ifcap cap;
3873 
3874 	KASSERT(tp != NULL, ("%s: tp == NULL", __func__));
3875 
3876 	bzero(&cap, sizeof(cap));
3877 	tcp_mss_update(tp, offer, -1, &metrics, &cap);
3878 
3879 	mss = tp->t_maxseg;
3880 	inp = tp->t_inpcb;
3881 
3882 	/*
3883 	 * If there's a pipesize, change the socket buffer to that size,
3884 	 * don't change if sb_hiwat is different than default (then it
3885 	 * has been changed on purpose with setsockopt).
3886 	 * Make the socket buffers an integral number of mss units;
3887 	 * if the mss is larger than the socket buffer, decrease the mss.
3888 	 */
3889 	so = inp->inp_socket;
3890 	SOCKBUF_LOCK(&so->so_snd);
3891 	if ((so->so_snd.sb_hiwat == V_tcp_sendspace) && metrics.rmx_sendpipe)
3892 		bufsize = metrics.rmx_sendpipe;
3893 	else
3894 		bufsize = so->so_snd.sb_hiwat;
3895 	if (bufsize < mss)
3896 		mss = bufsize;
3897 	else {
3898 		bufsize = roundup(bufsize, mss);
3899 		if (bufsize > sb_max)
3900 			bufsize = sb_max;
3901 		if (bufsize > so->so_snd.sb_hiwat)
3902 			(void)sbreserve_locked(&so->so_snd, bufsize, so, NULL);
3903 	}
3904 	SOCKBUF_UNLOCK(&so->so_snd);
3905 	/*
3906 	 * Sanity check: make sure that maxseg will be large
3907 	 * enough to allow some data on segments even if the
3908 	 * all the option space is used (40bytes).  Otherwise
3909 	 * funny things may happen in tcp_output.
3910 	 *
3911 	 * XXXGL: shouldn't we reserve space for IP/IPv6 options?
3912 	 */
3913 	tp->t_maxseg = max(mss, 64);
3914 
3915 	SOCKBUF_LOCK(&so->so_rcv);
3916 	if ((so->so_rcv.sb_hiwat == V_tcp_recvspace) && metrics.rmx_recvpipe)
3917 		bufsize = metrics.rmx_recvpipe;
3918 	else
3919 		bufsize = so->so_rcv.sb_hiwat;
3920 	if (bufsize > mss) {
3921 		bufsize = roundup(bufsize, mss);
3922 		if (bufsize > sb_max)
3923 			bufsize = sb_max;
3924 		if (bufsize > so->so_rcv.sb_hiwat)
3925 			(void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL);
3926 	}
3927 	SOCKBUF_UNLOCK(&so->so_rcv);
3928 
3929 	/* Check the interface for TSO capabilities. */
3930 	if (cap.ifcap & CSUM_TSO) {
3931 		tp->t_flags |= TF_TSO;
3932 		tp->t_tsomax = cap.tsomax;
3933 		tp->t_tsomaxsegcount = cap.tsomaxsegcount;
3934 		tp->t_tsomaxsegsize = cap.tsomaxsegsize;
3935 	}
3936 }
3937 
3938 /*
3939  * Determine the MSS option to send on an outgoing SYN.
3940  */
3941 int
3942 tcp_mssopt(struct in_conninfo *inc)
3943 {
3944 	int mss = 0;
3945 	uint32_t thcmtu = 0;
3946 	uint32_t maxmtu = 0;
3947 	size_t min_protoh;
3948 
3949 	KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer"));
3950 
3951 #ifdef INET6
3952 	if (inc->inc_flags & INC_ISIPV6) {
3953 		mss = V_tcp_v6mssdflt;
3954 		maxmtu = tcp_maxmtu6(inc, NULL);
3955 		min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
3956 	}
3957 #endif
3958 #if defined(INET) && defined(INET6)
3959 	else
3960 #endif
3961 #ifdef INET
3962 	{
3963 		mss = V_tcp_mssdflt;
3964 		maxmtu = tcp_maxmtu(inc, NULL);
3965 		min_protoh = sizeof(struct tcpiphdr);
3966 	}
3967 #endif
3968 #if defined(INET6) || defined(INET)
3969 	thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3970 #endif
3971 
3972 	if (maxmtu && thcmtu)
3973 		mss = min(maxmtu, thcmtu) - min_protoh;
3974 	else if (maxmtu || thcmtu)
3975 		mss = max(maxmtu, thcmtu) - min_protoh;
3976 
3977 	return (mss);
3978 }
3979 
3980 void
3981 tcp_do_prr_ack(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to)
3982 {
3983 	int snd_cnt = 0, limit = 0, del_data = 0, pipe = 0;
3984 	int maxseg = tcp_maxseg(tp);
3985 
3986 	INP_WLOCK_ASSERT(tp->t_inpcb);
3987 
3988 	/*
3989 	 * Compute the amount of data that this ACK is indicating
3990 	 * (del_data) and an estimate of how many bytes are in the
3991 	 * network.
3992 	 */
3993 	if (((tp->t_flags & TF_SACK_PERMIT) &&
3994 	    (to->to_flags & TOF_SACK)) ||
3995 	    (IN_CONGRECOVERY(tp->t_flags) &&
3996 	     !IN_FASTRECOVERY(tp->t_flags))) {
3997 		del_data = tp->sackhint.delivered_data;
3998 		if (V_tcp_do_newsack)
3999 			pipe = tcp_compute_pipe(tp);
4000 		else
4001 			pipe = (tp->snd_nxt - tp->snd_fack) +
4002 				tp->sackhint.sack_bytes_rexmit;
4003 	} else {
4004 		if (tp->sackhint.prr_delivered < (tcprexmtthresh * maxseg +
4005 					     tp->snd_recover - tp->snd_una))
4006 			del_data = maxseg;
4007 		pipe = imax(0, tp->snd_max - tp->snd_una -
4008 			    imin(INT_MAX / 65536, tp->t_dupacks) * maxseg);
4009 	}
4010 	tp->sackhint.prr_delivered += del_data;
4011 	/*
4012 	 * Proportional Rate Reduction
4013 	 */
4014 	if (pipe >= tp->snd_ssthresh) {
4015 		if (tp->sackhint.recover_fs == 0)
4016 			tp->sackhint.recover_fs =
4017 			    imax(1, tp->snd_nxt - tp->snd_una);
4018 		snd_cnt = howmany((long)tp->sackhint.prr_delivered *
4019 			    tp->snd_ssthresh, tp->sackhint.recover_fs) -
4020 			    tp->sackhint.prr_out;
4021 	} else {
4022 		if (V_tcp_do_prr_conservative || (del_data == 0))
4023 			limit = tp->sackhint.prr_delivered -
4024 				tp->sackhint.prr_out;
4025 		else
4026 			limit = imax(tp->sackhint.prr_delivered -
4027 				    tp->sackhint.prr_out, del_data) +
4028 				    maxseg;
4029 		snd_cnt = imin((tp->snd_ssthresh - pipe), limit);
4030 	}
4031 	snd_cnt = imax(snd_cnt, 0) / maxseg;
4032 	/*
4033 	 * Send snd_cnt new data into the network in response to this ack.
4034 	 * If there is going to be a SACK retransmission, adjust snd_cwnd
4035 	 * accordingly.
4036 	 */
4037 	if (IN_FASTRECOVERY(tp->t_flags)) {
4038 		if ((tp->t_flags & TF_SACK_PERMIT) &&
4039 		    (to->to_flags & TOF_SACK)) {
4040 			tp->snd_cwnd = tp->snd_nxt - tp->snd_recover +
4041 					    tp->sackhint.sack_bytes_rexmit +
4042 					    (snd_cnt * maxseg);
4043 		} else {
4044 			tp->snd_cwnd = (tp->snd_max - tp->snd_una) +
4045 					    (snd_cnt * maxseg);
4046 		}
4047 	} else if (IN_CONGRECOVERY(tp->t_flags))
4048 		tp->snd_cwnd = pipe - del_data + (snd_cnt * maxseg);
4049 	tp->snd_cwnd = imax(maxseg, tp->snd_cwnd);
4050 }
4051 
4052 /*
4053  * On a partial ack arrives, force the retransmission of the
4054  * next unacknowledged segment.  Do not clear tp->t_dupacks.
4055  * By setting snd_nxt to ti_ack, this forces retransmission timer to
4056  * be started again.
4057  */
4058 void
4059 tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th)
4060 {
4061 	tcp_seq onxt = tp->snd_nxt;
4062 	uint32_t ocwnd = tp->snd_cwnd;
4063 	u_int maxseg = tcp_maxseg(tp);
4064 
4065 	INP_WLOCK_ASSERT(tp->t_inpcb);
4066 
4067 	tcp_timer_activate(tp, TT_REXMT, 0);
4068 	tp->t_rtttime = 0;
4069 	tp->snd_nxt = th->th_ack;
4070 	/*
4071 	 * Set snd_cwnd to one segment beyond acknowledged offset.
4072 	 * (tp->snd_una has not yet been updated when this function is called.)
4073 	 */
4074 	tp->snd_cwnd = maxseg + BYTES_THIS_ACK(tp, th);
4075 	tp->t_flags |= TF_ACKNOW;
4076 	(void) tp->t_fb->tfb_tcp_output(tp);
4077 	tp->snd_cwnd = ocwnd;
4078 	if (SEQ_GT(onxt, tp->snd_nxt))
4079 		tp->snd_nxt = onxt;
4080 	/*
4081 	 * Partial window deflation.  Relies on fact that tp->snd_una
4082 	 * not updated yet.
4083 	 */
4084 	if (tp->snd_cwnd > BYTES_THIS_ACK(tp, th))
4085 		tp->snd_cwnd -= BYTES_THIS_ACK(tp, th);
4086 	else
4087 		tp->snd_cwnd = 0;
4088 	tp->snd_cwnd += maxseg;
4089 }
4090 
4091 int
4092 tcp_compute_pipe(struct tcpcb *tp)
4093 {
4094 	return (tp->snd_max - tp->snd_una +
4095 		tp->sackhint.sack_bytes_rexmit -
4096 		tp->sackhint.sacked_bytes);
4097 }
4098 
4099 uint32_t
4100 tcp_compute_initwnd(uint32_t maxseg)
4101 {
4102 	/*
4103 	 * Calculate the Initial Window, also used as Restart Window
4104 	 *
4105 	 * RFC5681 Section 3.1 specifies the default conservative values.
4106 	 * RFC3390 specifies slightly more aggressive values.
4107 	 * RFC6928 increases it to ten segments.
4108 	 * Support for user specified value for initial flight size.
4109 	 */
4110 	if (V_tcp_initcwnd_segments)
4111 		return min(V_tcp_initcwnd_segments * maxseg,
4112 		    max(2 * maxseg, V_tcp_initcwnd_segments * 1460));
4113 	else if (V_tcp_do_rfc3390)
4114 		return min(4 * maxseg, max(2 * maxseg, 4380));
4115 	else {
4116 		/* Per RFC5681 Section 3.1 */
4117 		if (maxseg > 2190)
4118 			return (2 * maxseg);
4119 		else if (maxseg > 1095)
4120 			return (3 * maxseg);
4121 		else
4122 			return (4 * maxseg);
4123 	}
4124 }
4125