xref: /freebsd/sys/netinet/tcp_reass.c (revision 6af83ee0d2941d18880b6aaa2b4facd1d30c6106)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
30  * $FreeBSD$
31  */
32 
33 #include "opt_ipfw.h"		/* for ipfw_fwd		*/
34 #include "opt_inet.h"
35 #include "opt_inet6.h"
36 #include "opt_ipsec.h"
37 #include "opt_mac.h"
38 #include "opt_tcpdebug.h"
39 #include "opt_tcp_input.h"
40 #include "opt_tcp_sack.h"
41 
42 #include <sys/param.h>
43 #include <sys/kernel.h>
44 #include <sys/mac.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/proc.h>		/* for proc0 declaration */
48 #include <sys/protosw.h>
49 #include <sys/signalvar.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sysctl.h>
53 #include <sys/syslog.h>
54 #include <sys/systm.h>
55 
56 #include <machine/cpu.h>	/* before tcp_seq.h, for tcp_random18() */
57 
58 #include <vm/uma.h>
59 
60 #include <net/if.h>
61 #include <net/route.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/in_pcb.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/in_var.h>
67 #include <netinet/ip.h>
68 #include <netinet/ip_icmp.h>	/* for ICMP_BANDLIM		*/
69 #include <netinet/icmp_var.h>	/* for ICMP_BANDLIM		*/
70 #include <netinet/ip_var.h>
71 #include <netinet/ip6.h>
72 #include <netinet/icmp6.h>
73 #include <netinet6/in6_pcb.h>
74 #include <netinet6/ip6_var.h>
75 #include <netinet6/nd6.h>
76 #include <netinet/tcp.h>
77 #include <netinet/tcp_fsm.h>
78 #include <netinet/tcp_seq.h>
79 #include <netinet/tcp_timer.h>
80 #include <netinet/tcp_var.h>
81 #include <netinet6/tcp6_var.h>
82 #include <netinet/tcpip.h>
83 #ifdef TCPDEBUG
84 #include <netinet/tcp_debug.h>
85 #endif /* TCPDEBUG */
86 
87 #ifdef FAST_IPSEC
88 #include <netipsec/ipsec.h>
89 #include <netipsec/ipsec6.h>
90 #endif /*FAST_IPSEC*/
91 
92 #ifdef IPSEC
93 #include <netinet6/ipsec.h>
94 #include <netinet6/ipsec6.h>
95 #include <netkey/key.h>
96 #endif /*IPSEC*/
97 
98 #include <machine/in_cksum.h>
99 
100 static const int tcprexmtthresh = 3;
101 
102 struct	tcpstat tcpstat;
103 SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW,
104     &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
105 
106 static int log_in_vain = 0;
107 SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
108     &log_in_vain, 0, "Log all incoming TCP connections");
109 
110 static int blackhole = 0;
111 SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
112 	&blackhole, 0, "Do not send RST when dropping refused connections");
113 
114 int tcp_delack_enabled = 1;
115 SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
116     &tcp_delack_enabled, 0,
117     "Delay ACK to try and piggyback it onto a data packet");
118 
119 #ifdef TCP_DROP_SYNFIN
120 static int drop_synfin = 0;
121 SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
122     &drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
123 #endif
124 
125 static int tcp_do_rfc3042 = 1;
126 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_RW,
127     &tcp_do_rfc3042, 0, "Enable RFC 3042 (Limited Transmit)");
128 
129 static int tcp_do_rfc3390 = 1;
130 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
131     &tcp_do_rfc3390, 0,
132     "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
133 
134 static int tcp_insecure_rst = 0;
135 SYSCTL_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_RW,
136     &tcp_insecure_rst, 0,
137     "Follow the old (insecure) criteria for accepting RST packets.");
138 
139 SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0,
140 	    "TCP Segment Reassembly Queue");
141 
142 static int tcp_reass_maxseg = 0;
143 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN,
144 	   &tcp_reass_maxseg, 0,
145 	   "Global maximum number of TCP Segments in Reassembly Queue");
146 
147 int tcp_reass_qsize = 0;
148 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, cursegments, CTLFLAG_RD,
149 	   &tcp_reass_qsize, 0,
150 	   "Global number of TCP Segments currently in Reassembly Queue");
151 
152 static int tcp_reass_maxqlen = 48;
153 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxqlen, CTLFLAG_RW,
154 	   &tcp_reass_maxqlen, 0,
155 	   "Maximum number of TCP Segments per individual Reassembly Queue");
156 
157 static int tcp_reass_overflows = 0;
158 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, CTLFLAG_RD,
159 	   &tcp_reass_overflows, 0,
160 	   "Global number of TCP Segment Reassembly Queue Overflows");
161 
162 static int tcp_sack_recovery_initburst = 3;
163 SYSCTL_INT(_net_inet_tcp_sack, OID_AUTO,
164 	   initburst, CTLFLAG_RW,
165 	   &tcp_sack_recovery_initburst, 0,
166 	   "Initial Number of Rexmits when sack recovery is set up");
167 
168 struct inpcbhead tcb;
169 #define	tcb6	tcb  /* for KAME src sync over BSD*'s */
170 struct inpcbinfo tcbinfo;
171 struct mtx	*tcbinfo_mtx;
172 
173 static void	 tcp_dooptions(struct tcpcb *, struct tcpopt *, u_char *,
174 		     int, int, struct tcphdr *);
175 
176 static void	 tcp_pulloutofband(struct socket *,
177 		     struct tcphdr *, struct mbuf *, int);
178 static int	 tcp_reass(struct tcpcb *, struct tcphdr *, int *,
179 		     struct mbuf *);
180 static void	 tcp_xmit_timer(struct tcpcb *, int);
181 static void	 tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *);
182 static int	 tcp_timewait(struct tcptw *, struct tcpopt *,
183 		     struct tcphdr *, struct mbuf *, int);
184 
185 /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
186 #ifdef INET6
187 #define ND6_HINT(tp) \
188 do { \
189 	if ((tp) && (tp)->t_inpcb && \
190 	    ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0) \
191 		nd6_nud_hint(NULL, NULL, 0); \
192 } while (0)
193 #else
194 #define ND6_HINT(tp)
195 #endif
196 
197 /*
198  * Indicate whether this ack should be delayed.  We can delay the ack if
199  *	- there is no delayed ack timer in progress and
200  *	- our last ack wasn't a 0-sized window.  We never want to delay
201  *	  the ack that opens up a 0-sized window and
202  *		- delayed acks are enabled or
203  *		- this is a half-synchronized T/TCP connection.
204  */
205 #define DELAY_ACK(tp)							\
206 	((!callout_active(tp->tt_delack) &&				\
207 	    (tp->t_flags & TF_RXWIN0SENT) == 0) &&			\
208 	    (tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN)))
209 
210 /* Initialize TCP reassembly queue */
211 uma_zone_t	tcp_reass_zone;
212 void
213 tcp_reass_init()
214 {
215 	tcp_reass_maxseg = nmbclusters / 16;
216 	TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments",
217 	    &tcp_reass_maxseg);
218 	tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent),
219 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
220 	uma_zone_set_max(tcp_reass_zone, tcp_reass_maxseg);
221 }
222 
223 static int
224 tcp_reass(tp, th, tlenp, m)
225 	register struct tcpcb *tp;
226 	register struct tcphdr *th;
227 	int *tlenp;
228 	struct mbuf *m;
229 {
230 	struct tseg_qent *q;
231 	struct tseg_qent *p = NULL;
232 	struct tseg_qent *nq;
233 	struct tseg_qent *te = NULL;
234 	struct socket *so = tp->t_inpcb->inp_socket;
235 	int flags;
236 
237 	INP_LOCK_ASSERT(tp->t_inpcb);
238 
239 	/*
240 	 * XXX: tcp_reass() is rather inefficient with its data structures
241 	 * and should be rewritten (see NetBSD for optimizations).  While
242 	 * doing that it should move to its own file tcp_reass.c.
243 	 */
244 
245 	/*
246 	 * Call with th==NULL after become established to
247 	 * force pre-ESTABLISHED data up to user socket.
248 	 */
249 	if (th == NULL)
250 		goto present;
251 
252 	/*
253 	 * Limit the number of segments in the reassembly queue to prevent
254 	 * holding on to too many segments (and thus running out of mbufs).
255 	 * Make sure to let the missing segment through which caused this
256 	 * queue.  Always keep one global queue entry spare to be able to
257 	 * process the missing segment.
258 	 */
259 	if (th->th_seq != tp->rcv_nxt &&
260 	    (tcp_reass_qsize + 1 >= tcp_reass_maxseg ||
261 	     tp->t_segqlen >= tcp_reass_maxqlen)) {
262 		tcp_reass_overflows++;
263 		tcpstat.tcps_rcvmemdrop++;
264 		m_freem(m);
265 		return (0);
266 	}
267 
268 	/*
269 	 * Allocate a new queue entry. If we can't, or hit the zone limit
270 	 * just drop the pkt.
271 	 */
272 	te = uma_zalloc(tcp_reass_zone, M_NOWAIT);
273 	if (te == NULL) {
274 		tcpstat.tcps_rcvmemdrop++;
275 		m_freem(m);
276 		return (0);
277 	}
278 	tp->t_segqlen++;
279 	tcp_reass_qsize++;
280 
281 	/*
282 	 * Find a segment which begins after this one does.
283 	 */
284 	LIST_FOREACH(q, &tp->t_segq, tqe_q) {
285 		if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
286 			break;
287 		p = q;
288 	}
289 
290 	/*
291 	 * If there is a preceding segment, it may provide some of
292 	 * our data already.  If so, drop the data from the incoming
293 	 * segment.  If it provides all of our data, drop us.
294 	 */
295 	if (p != NULL) {
296 		register int i;
297 		/* conversion to int (in i) handles seq wraparound */
298 		i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
299 		if (i > 0) {
300 			if (i >= *tlenp) {
301 				tcpstat.tcps_rcvduppack++;
302 				tcpstat.tcps_rcvdupbyte += *tlenp;
303 				m_freem(m);
304 				uma_zfree(tcp_reass_zone, te);
305 				tp->t_segqlen--;
306 				tcp_reass_qsize--;
307 				/*
308 				 * Try to present any queued data
309 				 * at the left window edge to the user.
310 				 * This is needed after the 3-WHS
311 				 * completes.
312 				 */
313 				goto present;	/* ??? */
314 			}
315 			m_adj(m, i);
316 			*tlenp -= i;
317 			th->th_seq += i;
318 		}
319 	}
320 	tcpstat.tcps_rcvoopack++;
321 	tcpstat.tcps_rcvoobyte += *tlenp;
322 
323 	/*
324 	 * While we overlap succeeding segments trim them or,
325 	 * if they are completely covered, dequeue them.
326 	 */
327 	while (q) {
328 		register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
329 		if (i <= 0)
330 			break;
331 		if (i < q->tqe_len) {
332 			q->tqe_th->th_seq += i;
333 			q->tqe_len -= i;
334 			m_adj(q->tqe_m, i);
335 			break;
336 		}
337 
338 		nq = LIST_NEXT(q, tqe_q);
339 		LIST_REMOVE(q, tqe_q);
340 		m_freem(q->tqe_m);
341 		uma_zfree(tcp_reass_zone, q);
342 		tp->t_segqlen--;
343 		tcp_reass_qsize--;
344 		q = nq;
345 	}
346 
347 	/* Insert the new segment queue entry into place. */
348 	te->tqe_m = m;
349 	te->tqe_th = th;
350 	te->tqe_len = *tlenp;
351 
352 	if (p == NULL) {
353 		LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
354 	} else {
355 		LIST_INSERT_AFTER(p, te, tqe_q);
356 	}
357 
358 present:
359 	/*
360 	 * Present data to user, advancing rcv_nxt through
361 	 * completed sequence space.
362 	 */
363 	if (!TCPS_HAVEESTABLISHED(tp->t_state))
364 		return (0);
365 	q = LIST_FIRST(&tp->t_segq);
366 	if (!q || q->tqe_th->th_seq != tp->rcv_nxt)
367 		return (0);
368 	SOCKBUF_LOCK(&so->so_rcv);
369 	do {
370 		tp->rcv_nxt += q->tqe_len;
371 		flags = q->tqe_th->th_flags & TH_FIN;
372 		nq = LIST_NEXT(q, tqe_q);
373 		LIST_REMOVE(q, tqe_q);
374 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
375 			m_freem(q->tqe_m);
376 		else
377 			sbappendstream_locked(&so->so_rcv, q->tqe_m);
378 		uma_zfree(tcp_reass_zone, q);
379 		tp->t_segqlen--;
380 		tcp_reass_qsize--;
381 		q = nq;
382 	} while (q && q->tqe_th->th_seq == tp->rcv_nxt);
383 	ND6_HINT(tp);
384 	sorwakeup_locked(so);
385 	return (flags);
386 }
387 
388 /*
389  * TCP input routine, follows pages 65-76 of the
390  * protocol specification dated September, 1981 very closely.
391  */
392 #ifdef INET6
393 int
394 tcp6_input(mp, offp, proto)
395 	struct mbuf **mp;
396 	int *offp, proto;
397 {
398 	register struct mbuf *m = *mp;
399 	struct in6_ifaddr *ia6;
400 
401 	IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
402 
403 	/*
404 	 * draft-itojun-ipv6-tcp-to-anycast
405 	 * better place to put this in?
406 	 */
407 	ia6 = ip6_getdstifaddr(m);
408 	if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
409 		struct ip6_hdr *ip6;
410 
411 		ip6 = mtod(m, struct ip6_hdr *);
412 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
413 			    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
414 		return IPPROTO_DONE;
415 	}
416 
417 	tcp_input(m, *offp);
418 	return IPPROTO_DONE;
419 }
420 #endif
421 
422 void
423 tcp_input(m, off0)
424 	register struct mbuf *m;
425 	int off0;
426 {
427 	register struct tcphdr *th;
428 	register struct ip *ip = NULL;
429 	register struct ipovly *ipov;
430 	register struct inpcb *inp = NULL;
431 	u_char *optp = NULL;
432 	int optlen = 0;
433 	int len, tlen, off;
434 	int drop_hdrlen;
435 	register struct tcpcb *tp = 0;
436 	register int thflags;
437 	struct socket *so = 0;
438 	int todrop, acked, ourfinisacked, needoutput = 0;
439 	u_long tiwin;
440 	struct tcpopt to;		/* options in this segment */
441 	int headlocked = 0;
442 #ifdef IPFIREWALL_FORWARD
443 	struct m_tag *fwd_tag;
444 #endif
445 	int rstreason; /* For badport_bandlim accounting purposes */
446 
447 	struct ip6_hdr *ip6 = NULL;
448 #ifdef INET6
449 	int isipv6;
450 #else
451 	const int isipv6 = 0;
452 #endif
453 
454 #ifdef TCPDEBUG
455 	/*
456 	 * The size of tcp_saveipgen must be the size of the max ip header,
457 	 * now IPv6.
458 	 */
459 	u_char tcp_saveipgen[40];
460 	struct tcphdr tcp_savetcp;
461 	short ostate = 0;
462 #endif
463 
464 #ifdef INET6
465 	isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
466 #endif
467 	bzero((char *)&to, sizeof(to));
468 
469 	tcpstat.tcps_rcvtotal++;
470 
471 	if (isipv6) {
472 #ifdef INET6
473 		/* IP6_EXTHDR_CHECK() is already done at tcp6_input() */
474 		ip6 = mtod(m, struct ip6_hdr *);
475 		tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
476 		if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
477 			tcpstat.tcps_rcvbadsum++;
478 			goto drop;
479 		}
480 		th = (struct tcphdr *)((caddr_t)ip6 + off0);
481 
482 		/*
483 		 * Be proactive about unspecified IPv6 address in source.
484 		 * As we use all-zero to indicate unbounded/unconnected pcb,
485 		 * unspecified IPv6 address can be used to confuse us.
486 		 *
487 		 * Note that packets with unspecified IPv6 destination is
488 		 * already dropped in ip6_input.
489 		 */
490 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
491 			/* XXX stat */
492 			goto drop;
493 		}
494 #else
495 		th = NULL;		/* XXX: avoid compiler warning */
496 #endif
497 	} else {
498 		/*
499 		 * Get IP and TCP header together in first mbuf.
500 		 * Note: IP leaves IP header in first mbuf.
501 		 */
502 		if (off0 > sizeof (struct ip)) {
503 			ip_stripoptions(m, (struct mbuf *)0);
504 			off0 = sizeof(struct ip);
505 		}
506 		if (m->m_len < sizeof (struct tcpiphdr)) {
507 			if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
508 				tcpstat.tcps_rcvshort++;
509 				return;
510 			}
511 		}
512 		ip = mtod(m, struct ip *);
513 		ipov = (struct ipovly *)ip;
514 		th = (struct tcphdr *)((caddr_t)ip + off0);
515 		tlen = ip->ip_len;
516 
517 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
518 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
519 				th->th_sum = m->m_pkthdr.csum_data;
520 			else
521 				th->th_sum = in_pseudo(ip->ip_src.s_addr,
522 						ip->ip_dst.s_addr,
523 						htonl(m->m_pkthdr.csum_data +
524 							ip->ip_len +
525 							IPPROTO_TCP));
526 			th->th_sum ^= 0xffff;
527 #ifdef TCPDEBUG
528 			ipov->ih_len = (u_short)tlen;
529 			ipov->ih_len = htons(ipov->ih_len);
530 #endif
531 		} else {
532 			/*
533 			 * Checksum extended TCP header and data.
534 			 */
535 			len = sizeof (struct ip) + tlen;
536 			bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
537 			ipov->ih_len = (u_short)tlen;
538 			ipov->ih_len = htons(ipov->ih_len);
539 			th->th_sum = in_cksum(m, len);
540 		}
541 		if (th->th_sum) {
542 			tcpstat.tcps_rcvbadsum++;
543 			goto drop;
544 		}
545 #ifdef INET6
546 		/* Re-initialization for later version check */
547 		ip->ip_v = IPVERSION;
548 #endif
549 	}
550 
551 	/*
552 	 * Check that TCP offset makes sense,
553 	 * pull out TCP options and adjust length.		XXX
554 	 */
555 	off = th->th_off << 2;
556 	if (off < sizeof (struct tcphdr) || off > tlen) {
557 		tcpstat.tcps_rcvbadoff++;
558 		goto drop;
559 	}
560 	tlen -= off;	/* tlen is used instead of ti->ti_len */
561 	if (off > sizeof (struct tcphdr)) {
562 		if (isipv6) {
563 #ifdef INET6
564 			IP6_EXTHDR_CHECK(m, off0, off, );
565 			ip6 = mtod(m, struct ip6_hdr *);
566 			th = (struct tcphdr *)((caddr_t)ip6 + off0);
567 #endif
568 		} else {
569 			if (m->m_len < sizeof(struct ip) + off) {
570 				if ((m = m_pullup(m, sizeof (struct ip) + off))
571 						== 0) {
572 					tcpstat.tcps_rcvshort++;
573 					return;
574 				}
575 				ip = mtod(m, struct ip *);
576 				ipov = (struct ipovly *)ip;
577 				th = (struct tcphdr *)((caddr_t)ip + off0);
578 			}
579 		}
580 		optlen = off - sizeof (struct tcphdr);
581 		optp = (u_char *)(th + 1);
582 	}
583 	thflags = th->th_flags;
584 
585 #ifdef TCP_DROP_SYNFIN
586 	/*
587 	 * If the drop_synfin option is enabled, drop all packets with
588 	 * both the SYN and FIN bits set. This prevents e.g. nmap from
589 	 * identifying the TCP/IP stack.
590 	 *
591 	 * This is a violation of the TCP specification.
592 	 */
593 	if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN))
594 		goto drop;
595 #endif
596 
597 	/*
598 	 * Convert TCP protocol specific fields to host format.
599 	 */
600 	th->th_seq = ntohl(th->th_seq);
601 	th->th_ack = ntohl(th->th_ack);
602 	th->th_win = ntohs(th->th_win);
603 	th->th_urp = ntohs(th->th_urp);
604 
605 	/*
606 	 * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options,
607 	 * until after ip6_savecontrol() is called and before other functions
608 	 * which don't want those proto headers.
609 	 * Because ip6_savecontrol() is going to parse the mbuf to
610 	 * search for data to be passed up to user-land, it wants mbuf
611 	 * parameters to be unchanged.
612 	 * XXX: the call of ip6_savecontrol() has been obsoleted based on
613 	 * latest version of the advanced API (20020110).
614 	 */
615 	drop_hdrlen = off0 + off;
616 
617 	/*
618 	 * Locate pcb for segment.
619 	 */
620 	INP_INFO_WLOCK(&tcbinfo);
621 	headlocked = 1;
622 findpcb:
623 	KASSERT(headlocked, ("tcp_input: findpcb: head not locked"));
624 #ifdef IPFIREWALL_FORWARD
625 	/* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */
626 	fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
627 
628 	if (fwd_tag != NULL && isipv6 == 0) {	/* IPv6 support is not yet */
629 		struct sockaddr_in *next_hop;
630 
631 		next_hop = (struct sockaddr_in *)(fwd_tag+1);
632 		/*
633 		 * Transparently forwarded. Pretend to be the destination.
634 		 * already got one like this?
635 		 */
636 		inp = in_pcblookup_hash(&tcbinfo,
637 					ip->ip_src, th->th_sport,
638 					ip->ip_dst, th->th_dport,
639 					0, m->m_pkthdr.rcvif);
640 		if (!inp) {
641 			/* It's new.  Try to find the ambushing socket. */
642 			inp = in_pcblookup_hash(&tcbinfo,
643 						ip->ip_src, th->th_sport,
644 						next_hop->sin_addr,
645 						next_hop->sin_port ?
646 						    ntohs(next_hop->sin_port) :
647 						    th->th_dport,
648 						1, m->m_pkthdr.rcvif);
649 		}
650 		/* Remove the tag from the packet.  We don't need it anymore. */
651 		m_tag_delete(m, fwd_tag);
652 	} else {
653 #endif /* IPFIREWALL_FORWARD */
654 		if (isipv6) {
655 #ifdef INET6
656 			inp = in6_pcblookup_hash(&tcbinfo,
657 						 &ip6->ip6_src, th->th_sport,
658 						 &ip6->ip6_dst, th->th_dport,
659 						 1, m->m_pkthdr.rcvif);
660 #endif
661 		} else
662 			inp = in_pcblookup_hash(&tcbinfo,
663 						ip->ip_src, th->th_sport,
664 						ip->ip_dst, th->th_dport,
665 						1, m->m_pkthdr.rcvif);
666 #ifdef IPFIREWALL_FORWARD
667 	}
668 #endif /* IPFIREWALL_FORWARD */
669 
670 #if defined(IPSEC) || defined(FAST_IPSEC)
671 #ifdef INET6
672 	if (isipv6) {
673 		if (inp != NULL && ipsec6_in_reject(m, inp)) {
674 #ifdef IPSEC
675 			ipsec6stat.in_polvio++;
676 #endif
677 			goto drop;
678 		}
679 	} else
680 #endif /* INET6 */
681 	if (inp != NULL && ipsec4_in_reject(m, inp)) {
682 #ifdef IPSEC
683 		ipsecstat.in_polvio++;
684 #endif
685 		goto drop;
686 	}
687 #endif /*IPSEC || FAST_IPSEC*/
688 
689 	/*
690 	 * If the state is CLOSED (i.e., TCB does not exist) then
691 	 * all data in the incoming segment is discarded.
692 	 * If the TCB exists but is in CLOSED state, it is embryonic,
693 	 * but should either do a listen or a connect soon.
694 	 */
695 	if (inp == NULL) {
696 		if (log_in_vain) {
697 #ifdef INET6
698 			char dbuf[INET6_ADDRSTRLEN+2], sbuf[INET6_ADDRSTRLEN+2];
699 #else
700 			char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"];
701 #endif
702 
703 			if (isipv6) {
704 #ifdef INET6
705 				strcpy(dbuf, "[");
706 				strcpy(sbuf, "[");
707 				strcat(dbuf, ip6_sprintf(&ip6->ip6_dst));
708 				strcat(sbuf, ip6_sprintf(&ip6->ip6_src));
709 				strcat(dbuf, "]");
710 				strcat(sbuf, "]");
711 #endif
712 			} else {
713 				strcpy(dbuf, inet_ntoa(ip->ip_dst));
714 				strcpy(sbuf, inet_ntoa(ip->ip_src));
715 			}
716 			switch (log_in_vain) {
717 			case 1:
718 				if ((thflags & TH_SYN) == 0)
719 					break;
720 				/* FALLTHROUGH */
721 			case 2:
722 				log(LOG_INFO,
723 				    "Connection attempt to TCP %s:%d "
724 				    "from %s:%d flags:0x%02x\n",
725 				    dbuf, ntohs(th->th_dport), sbuf,
726 				    ntohs(th->th_sport), thflags);
727 				break;
728 			default:
729 				break;
730 			}
731 		}
732 		if (blackhole) {
733 			switch (blackhole) {
734 			case 1:
735 				if (thflags & TH_SYN)
736 					goto drop;
737 				break;
738 			case 2:
739 				goto drop;
740 			default:
741 				goto drop;
742 			}
743 		}
744 		rstreason = BANDLIM_RST_CLOSEDPORT;
745 		goto dropwithreset;
746 	}
747 	INP_LOCK(inp);
748 	if (inp->inp_vflag & INP_TIMEWAIT) {
749 		/*
750 		 * The only option of relevance is TOF_CC, and only if
751 		 * present in a SYN segment.  See tcp_timewait().
752 		 */
753 		if (thflags & TH_SYN)
754 			tcp_dooptions((struct tcpcb *)NULL, &to, optp, optlen, 1, th);
755 		if (tcp_timewait((struct tcptw *)inp->inp_ppcb,
756 		    &to, th, m, tlen))
757 			goto findpcb;
758 		/*
759 		 * tcp_timewait unlocks inp.
760 		 */
761 		INP_INFO_WUNLOCK(&tcbinfo);
762 		return;
763 	}
764 	tp = intotcpcb(inp);
765 	if (tp == 0) {
766 		INP_UNLOCK(inp);
767 		rstreason = BANDLIM_RST_CLOSEDPORT;
768 		goto dropwithreset;
769 	}
770 	if (tp->t_state == TCPS_CLOSED)
771 		goto drop;
772 
773 	/* Unscale the window into a 32-bit value. */
774 	if ((thflags & TH_SYN) == 0)
775 		tiwin = th->th_win << tp->snd_scale;
776 	else
777 		tiwin = th->th_win;
778 
779 #ifdef MAC
780 	INP_LOCK_ASSERT(inp);
781 	if (mac_check_inpcb_deliver(inp, m))
782 		goto drop;
783 #endif
784 	so = inp->inp_socket;
785 #ifdef TCPDEBUG
786 	if (so->so_options & SO_DEBUG) {
787 		ostate = tp->t_state;
788 		if (isipv6)
789 			bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6));
790 		else
791 			bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
792 		tcp_savetcp = *th;
793 	}
794 #endif
795 	if (so->so_options & SO_ACCEPTCONN) {
796 		struct in_conninfo inc;
797 
798 #ifdef INET6
799 		inc.inc_isipv6 = isipv6;
800 #endif
801 		if (isipv6) {
802 			inc.inc6_faddr = ip6->ip6_src;
803 			inc.inc6_laddr = ip6->ip6_dst;
804 		} else {
805 			inc.inc_faddr = ip->ip_src;
806 			inc.inc_laddr = ip->ip_dst;
807 		}
808 		inc.inc_fport = th->th_sport;
809 		inc.inc_lport = th->th_dport;
810 
811 	        /*
812 	         * If the state is LISTEN then ignore segment if it contains
813 		 * a RST.  If the segment contains an ACK then it is bad and
814 		 * send a RST.  If it does not contain a SYN then it is not
815 		 * interesting; drop it.
816 		 *
817 		 * If the state is SYN_RECEIVED (syncache) and seg contains
818 		 * an ACK, but not for our SYN/ACK, send a RST.  If the seg
819 		 * contains a RST, check the sequence number to see if it
820 		 * is a valid reset segment.
821 		 */
822 		if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
823 			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
824 				if (!syncache_expand(&inc, th, &so, m)) {
825 					/*
826 					 * No syncache entry, or ACK was not
827 					 * for our SYN/ACK.  Send a RST.
828 					 */
829 					tcpstat.tcps_badsyn++;
830 					rstreason = BANDLIM_RST_OPENPORT;
831 					goto dropwithreset;
832 				}
833 				if (so == NULL) {
834 					/*
835 					 * Could not complete 3-way handshake,
836 					 * connection is being closed down, and
837 					 * syncache will free mbuf.
838 					 */
839 					INP_UNLOCK(inp);
840 					INP_INFO_WUNLOCK(&tcbinfo);
841 					return;
842 				}
843 				/*
844 				 * Socket is created in state SYN_RECEIVED.
845 				 * Continue processing segment.
846 				 */
847 				INP_UNLOCK(inp);
848 				inp = sotoinpcb(so);
849 				INP_LOCK(inp);
850 				tp = intotcpcb(inp);
851 				/*
852 				 * This is what would have happened in
853 				 * tcp_output() when the SYN,ACK was sent.
854 				 */
855 				tp->snd_up = tp->snd_una;
856 				tp->snd_max = tp->snd_nxt = tp->iss + 1;
857 				tp->last_ack_sent = tp->rcv_nxt;
858 				/*
859 				 * RFC1323: The window in SYN & SYN/ACK
860 				 * segments is never scaled.
861 				 */
862 				tp->snd_wnd = tiwin;	/* unscaled */
863 				goto after_listen;
864 			}
865 			if (thflags & TH_RST) {
866 				syncache_chkrst(&inc, th);
867 				goto drop;
868 			}
869 			if (thflags & TH_ACK) {
870 				syncache_badack(&inc);
871 				tcpstat.tcps_badsyn++;
872 				rstreason = BANDLIM_RST_OPENPORT;
873 				goto dropwithreset;
874 			}
875 			goto drop;
876 		}
877 
878 		/*
879 		 * Segment's flags are (SYN) or (SYN|FIN).
880 		 */
881 #ifdef INET6
882 		/*
883 		 * If deprecated address is forbidden,
884 		 * we do not accept SYN to deprecated interface
885 		 * address to prevent any new inbound connection from
886 		 * getting established.
887 		 * When we do not accept SYN, we send a TCP RST,
888 		 * with deprecated source address (instead of dropping
889 		 * it).  We compromise it as it is much better for peer
890 		 * to send a RST, and RST will be the final packet
891 		 * for the exchange.
892 		 *
893 		 * If we do not forbid deprecated addresses, we accept
894 		 * the SYN packet.  RFC2462 does not suggest dropping
895 		 * SYN in this case.
896 		 * If we decipher RFC2462 5.5.4, it says like this:
897 		 * 1. use of deprecated addr with existing
898 		 *    communication is okay - "SHOULD continue to be
899 		 *    used"
900 		 * 2. use of it with new communication:
901 		 *   (2a) "SHOULD NOT be used if alternate address
902 		 *        with sufficient scope is available"
903 		 *   (2b) nothing mentioned otherwise.
904 		 * Here we fall into (2b) case as we have no choice in
905 		 * our source address selection - we must obey the peer.
906 		 *
907 		 * The wording in RFC2462 is confusing, and there are
908 		 * multiple description text for deprecated address
909 		 * handling - worse, they are not exactly the same.
910 		 * I believe 5.5.4 is the best one, so we follow 5.5.4.
911 		 */
912 		if (isipv6 && !ip6_use_deprecated) {
913 			struct in6_ifaddr *ia6;
914 
915 			if ((ia6 = ip6_getdstifaddr(m)) &&
916 			    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
917 				INP_UNLOCK(inp);
918 				tp = NULL;
919 				rstreason = BANDLIM_RST_OPENPORT;
920 				goto dropwithreset;
921 			}
922 		}
923 #endif
924 		/*
925 		 * If it is from this socket, drop it, it must be forged.
926 		 * Don't bother responding if the destination was a broadcast.
927 		 */
928 		if (th->th_dport == th->th_sport) {
929 			if (isipv6) {
930 				if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
931 						       &ip6->ip6_src))
932 					goto drop;
933 			} else {
934 				if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
935 					goto drop;
936 			}
937 		}
938 		/*
939 		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
940 		 *
941 		 * Note that it is quite possible to receive unicast
942 		 * link-layer packets with a broadcast IP address. Use
943 		 * in_broadcast() to find them.
944 		 */
945 		if (m->m_flags & (M_BCAST|M_MCAST))
946 			goto drop;
947 		if (isipv6) {
948 			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
949 			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
950 				goto drop;
951 		} else {
952 			if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
953 			    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
954 			    ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
955 			    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
956 				goto drop;
957 		}
958 		/*
959 		 * SYN appears to be valid; create compressed TCP state
960 		 * for syncache, or perform t/tcp connection.
961 		 */
962 		if (so->so_qlen <= so->so_qlimit) {
963 #ifdef TCPDEBUG
964 			if (so->so_options & SO_DEBUG)
965 				tcp_trace(TA_INPUT, ostate, tp,
966 				    (void *)tcp_saveipgen, &tcp_savetcp, 0);
967 #endif
968 			tcp_dooptions(tp, &to, optp, optlen, 1, th);
969 			if (!syncache_add(&inc, &to, th, &so, m))
970 				goto drop;
971 			if (so == NULL) {
972 				/*
973 				 * Entry added to syncache, mbuf used to
974 				 * send SYN,ACK packet.
975 				 */
976 				KASSERT(headlocked, ("headlocked"));
977 				INP_UNLOCK(inp);
978 				INP_INFO_WUNLOCK(&tcbinfo);
979 				return;
980 			}
981 			/*
982 			 * Segment passed TAO tests.
983 			 */
984 			INP_UNLOCK(inp);
985 			inp = sotoinpcb(so);
986 			INP_LOCK(inp);
987 			tp = intotcpcb(inp);
988 			tp->snd_wnd = tiwin;
989 			tp->t_starttime = ticks;
990 			tp->t_state = TCPS_ESTABLISHED;
991 
992 			/*
993 			 * T/TCP logic:
994 			 * If there is a FIN or if there is data, then
995 			 * delay SYN,ACK(SYN) in the hope of piggy-backing
996 			 * it on a response segment.  Otherwise must send
997 			 * ACK now in case the other side is slow starting.
998 			 */
999 			if (thflags & TH_FIN || tlen != 0)
1000 				tp->t_flags |= (TF_DELACK | TF_NEEDSYN);
1001 			else
1002 				tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
1003 			tcpstat.tcps_connects++;
1004 			soisconnected(so);
1005 			goto trimthenstep6;
1006 		}
1007 		goto drop;
1008 	}
1009 after_listen:
1010 	KASSERT(headlocked, ("tcp_input: after_listen: head not locked"));
1011 	INP_LOCK_ASSERT(inp);
1012 
1013 	/* XXX temp debugging */
1014 	/* should not happen - syncache should pick up these connections */
1015 	if (tp->t_state == TCPS_LISTEN)
1016 		panic("tcp_input: TCPS_LISTEN");
1017 
1018 	/*
1019 	 * This is the second part of the MSS DoS prevention code (after
1020 	 * minmss on the sending side) and it deals with too many too small
1021 	 * tcp packets in a too short timeframe (1 second).
1022 	 *
1023 	 * For every full second we count the number of received packets
1024 	 * and bytes. If we get a lot of packets per second for this connection
1025 	 * (tcp_minmssoverload) we take a closer look at it and compute the
1026 	 * average packet size for the past second. If that is less than
1027 	 * tcp_minmss we get too many packets with very small payload which
1028 	 * is not good and burdens our system (and every packet generates
1029 	 * a wakeup to the process connected to our socket). We can reasonable
1030 	 * expect this to be small packet DoS attack to exhaust our CPU
1031 	 * cycles.
1032 	 *
1033 	 * Care has to be taken for the minimum packet overload value. This
1034 	 * value defines the minimum number of packets per second before we
1035 	 * start to worry. This must not be too low to avoid killing for
1036 	 * example interactive connections with many small packets like
1037 	 * telnet or SSH.
1038 	 *
1039 	 * Setting either tcp_minmssoverload or tcp_minmss to "0" disables
1040 	 * this check.
1041 	 *
1042 	 * Account for packet if payload packet, skip over ACK, etc.
1043 	 */
1044 	if (tcp_minmss && tcp_minmssoverload &&
1045 	    tp->t_state == TCPS_ESTABLISHED && tlen > 0) {
1046 		if (tp->rcv_second > ticks) {
1047 			tp->rcv_pps++;
1048 			tp->rcv_byps += tlen + off;
1049 			if (tp->rcv_pps > tcp_minmssoverload) {
1050 				if ((tp->rcv_byps / tp->rcv_pps) < tcp_minmss) {
1051 					printf("too many small tcp packets from "
1052 					       "%s:%u, av. %lubyte/packet, "
1053 					       "dropping connection\n",
1054 #ifdef INET6
1055 						isipv6 ?
1056 						ip6_sprintf(&inp->inp_inc.inc6_faddr) :
1057 #endif
1058 						inet_ntoa(inp->inp_inc.inc_faddr),
1059 						inp->inp_inc.inc_fport,
1060 						tp->rcv_byps / tp->rcv_pps);
1061 					tp = tcp_drop(tp, ECONNRESET);
1062 					tcpstat.tcps_minmssdrops++;
1063 					goto drop;
1064 				}
1065 			}
1066 		} else {
1067 			tp->rcv_second = ticks + hz;
1068 			tp->rcv_pps = 1;
1069 			tp->rcv_byps = tlen + off;
1070 		}
1071 	}
1072 
1073 	/*
1074 	 * Segment received on connection.
1075 	 * Reset idle time and keep-alive timer.
1076 	 */
1077 	tp->t_rcvtime = ticks;
1078 	if (TCPS_HAVEESTABLISHED(tp->t_state))
1079 		callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
1080 
1081 	/*
1082 	 * Process options only when we get SYN/ACK back. The SYN case
1083 	 * for incoming connections is handled in tcp_syncache.
1084 	 * XXX this is traditional behavior, may need to be cleaned up.
1085 	 */
1086 	tcp_dooptions(tp, &to, optp, optlen, thflags & TH_SYN, th);
1087 	if (thflags & TH_SYN) {
1088 		if (to.to_flags & TOF_SCALE) {
1089 			tp->t_flags |= TF_RCVD_SCALE;
1090 			tp->requested_s_scale = to.to_requested_s_scale;
1091 		}
1092 		if (to.to_flags & TOF_TS) {
1093 			tp->t_flags |= TF_RCVD_TSTMP;
1094 			tp->ts_recent = to.to_tsval;
1095 			tp->ts_recent_age = ticks;
1096 		}
1097 		if (to.to_flags & TOF_MSS)
1098 			tcp_mss(tp, to.to_mss);
1099 		if (tp->sack_enable) {
1100 			if (!(to.to_flags & TOF_SACK))
1101 				tp->sack_enable = 0;
1102 			else
1103 				tp->t_flags |= TF_SACK_PERMIT;
1104 		}
1105 
1106 	}
1107 
1108 	if (tp->sack_enable) {
1109 		/* Delete stale (cumulatively acked) SACK holes */
1110 		tcp_del_sackholes(tp, th);
1111 		tp->rcv_laststart = th->th_seq; /* last recv'd segment*/
1112 		tp->rcv_lastend = th->th_seq + tlen;
1113 	}
1114 
1115 	/*
1116 	 * Header prediction: check for the two common cases
1117 	 * of a uni-directional data xfer.  If the packet has
1118 	 * no control flags, is in-sequence, the window didn't
1119 	 * change and we're not retransmitting, it's a
1120 	 * candidate.  If the length is zero and the ack moved
1121 	 * forward, we're the sender side of the xfer.  Just
1122 	 * free the data acked & wake any higher level process
1123 	 * that was blocked waiting for space.  If the length
1124 	 * is non-zero and the ack didn't move, we're the
1125 	 * receiver side.  If we're getting packets in-order
1126 	 * (the reassembly queue is empty), add the data to
1127 	 * the socket buffer and note that we need a delayed ack.
1128 	 * Make sure that the hidden state-flags are also off.
1129 	 * Since we check for TCPS_ESTABLISHED above, it can only
1130 	 * be TH_NEEDSYN.
1131 	 */
1132 	if (tp->t_state == TCPS_ESTABLISHED &&
1133 	    (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1134 	    ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1135 	    ((to.to_flags & TOF_TS) == 0 ||
1136 	     TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
1137 	     th->th_seq == tp->rcv_nxt && tiwin && tiwin == tp->snd_wnd &&
1138 	     tp->snd_nxt == tp->snd_max) {
1139 
1140 		/*
1141 		 * If last ACK falls within this segment's sequence numbers,
1142 		 * record the timestamp.
1143 		 * NOTE that the test is modified according to the latest
1144 		 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1145 		 */
1146 		if ((to.to_flags & TOF_TS) != 0 &&
1147 		    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1148 			tp->ts_recent_age = ticks;
1149 			tp->ts_recent = to.to_tsval;
1150 		}
1151 
1152 		if (tlen == 0) {
1153 			if (SEQ_GT(th->th_ack, tp->snd_una) &&
1154 			    SEQ_LEQ(th->th_ack, tp->snd_max) &&
1155 			    tp->snd_cwnd >= tp->snd_wnd &&
1156 			    ((!tcp_do_newreno && !tp->sack_enable &&
1157 			      tp->t_dupacks < tcprexmtthresh) ||
1158 			     ((tcp_do_newreno || tp->sack_enable) &&
1159 			      !IN_FASTRECOVERY(tp)))) {
1160 				KASSERT(headlocked, ("headlocked"));
1161 				INP_INFO_WUNLOCK(&tcbinfo);
1162 				headlocked = 0;
1163 				/*
1164 				 * this is a pure ack for outstanding data.
1165 				 */
1166 				++tcpstat.tcps_predack;
1167 				/*
1168 				 * "bad retransmit" recovery
1169 				 */
1170 				if (tp->t_rxtshift == 1 &&
1171 				    ticks < tp->t_badrxtwin) {
1172 					++tcpstat.tcps_sndrexmitbad;
1173 					tp->snd_cwnd = tp->snd_cwnd_prev;
1174 					tp->snd_ssthresh =
1175 					    tp->snd_ssthresh_prev;
1176 					tp->snd_recover = tp->snd_recover_prev;
1177 					if (tp->t_flags & TF_WASFRECOVERY)
1178 					    ENTER_FASTRECOVERY(tp);
1179 					tp->snd_nxt = tp->snd_max;
1180 					tp->t_badrxtwin = 0;
1181 				}
1182 
1183 				/*
1184 				 * Recalculate the transmit timer / rtt.
1185 				 *
1186 				 * Some boxes send broken timestamp replies
1187 				 * during the SYN+ACK phase, ignore
1188 				 * timestamps of 0 or we could calculate a
1189 				 * huge RTT and blow up the retransmit timer.
1190 				 */
1191 				if ((to.to_flags & TOF_TS) != 0 &&
1192 				    to.to_tsecr) {
1193 					tcp_xmit_timer(tp,
1194 					    ticks - to.to_tsecr + 1);
1195 				} else if (tp->t_rtttime &&
1196 					    SEQ_GT(th->th_ack, tp->t_rtseq)) {
1197 					tcp_xmit_timer(tp,
1198 							ticks - tp->t_rtttime);
1199 				}
1200 				tcp_xmit_bandwidth_limit(tp, th->th_ack);
1201 				acked = th->th_ack - tp->snd_una;
1202 				tcpstat.tcps_rcvackpack++;
1203 				tcpstat.tcps_rcvackbyte += acked;
1204 				sbdrop(&so->so_snd, acked);
1205 				if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
1206 				    SEQ_LEQ(th->th_ack, tp->snd_recover))
1207 					tp->snd_recover = th->th_ack - 1;
1208 				tp->snd_una = th->th_ack;
1209 				/*
1210 				 * pull snd_wl2 up to prevent seq wrap relative
1211 				 * to th_ack.
1212 				 */
1213 				tp->snd_wl2 = th->th_ack;
1214 				tp->t_dupacks = 0;
1215 				m_freem(m);
1216 				ND6_HINT(tp); /* some progress has been done */
1217 
1218 				/*
1219 				 * If all outstanding data are acked, stop
1220 				 * retransmit timer, otherwise restart timer
1221 				 * using current (possibly backed-off) value.
1222 				 * If process is waiting for space,
1223 				 * wakeup/selwakeup/signal.  If data
1224 				 * are ready to send, let tcp_output
1225 				 * decide between more output or persist.
1226 
1227 #ifdef TCPDEBUG
1228 				if (so->so_options & SO_DEBUG)
1229 					tcp_trace(TA_INPUT, ostate, tp,
1230 					    (void *)tcp_saveipgen,
1231 					    &tcp_savetcp, 0);
1232 #endif
1233 				 */
1234 				if (tp->snd_una == tp->snd_max)
1235 					callout_stop(tp->tt_rexmt);
1236 				else if (!callout_active(tp->tt_persist))
1237 					callout_reset(tp->tt_rexmt,
1238 						      tp->t_rxtcur,
1239 						      tcp_timer_rexmt, tp);
1240 
1241 				sowwakeup(so);
1242 				if (so->so_snd.sb_cc)
1243 					(void) tcp_output(tp);
1244 				goto check_delack;
1245 			}
1246 		} else if (th->th_ack == tp->snd_una &&
1247 		    LIST_EMPTY(&tp->t_segq) &&
1248 		    tlen <= sbspace(&so->so_rcv)) {
1249 			KASSERT(headlocked, ("headlocked"));
1250 			INP_INFO_WUNLOCK(&tcbinfo);
1251 			headlocked = 0;
1252 			/*
1253 			 * this is a pure, in-sequence data packet
1254 			 * with nothing on the reassembly queue and
1255 			 * we have enough buffer space to take it.
1256 			 */
1257 			/* Clean receiver SACK report if present */
1258 			if (tp->sack_enable && tp->rcv_numsacks)
1259 				tcp_clean_sackreport(tp);
1260 			++tcpstat.tcps_preddat;
1261 			tp->rcv_nxt += tlen;
1262 			/*
1263 			 * Pull snd_wl1 up to prevent seq wrap relative to
1264 			 * th_seq.
1265 			 */
1266 			tp->snd_wl1 = th->th_seq;
1267 			/*
1268 			 * Pull rcv_up up to prevent seq wrap relative to
1269 			 * rcv_nxt.
1270 			 */
1271 			tp->rcv_up = tp->rcv_nxt;
1272 			tcpstat.tcps_rcvpack++;
1273 			tcpstat.tcps_rcvbyte += tlen;
1274 			ND6_HINT(tp);	/* some progress has been done */
1275 			/*
1276 #ifdef TCPDEBUG
1277 			if (so->so_options & SO_DEBUG)
1278 				tcp_trace(TA_INPUT, ostate, tp,
1279 				    (void *)tcp_saveipgen, &tcp_savetcp, 0);
1280 #endif
1281 			 * Add data to socket buffer.
1282 			 */
1283 			SOCKBUF_LOCK(&so->so_rcv);
1284 			if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1285 				m_freem(m);
1286 			} else {
1287 				m_adj(m, drop_hdrlen);	/* delayed header drop */
1288 				sbappendstream_locked(&so->so_rcv, m);
1289 			}
1290 			sorwakeup_locked(so);
1291 			if (DELAY_ACK(tp)) {
1292 				tp->t_flags |= TF_DELACK;
1293 			} else {
1294 				tp->t_flags |= TF_ACKNOW;
1295 				tcp_output(tp);
1296 			}
1297 			goto check_delack;
1298 		}
1299 	}
1300 
1301 	/*
1302 	 * Calculate amount of space in receive window,
1303 	 * and then do TCP input processing.
1304 	 * Receive window is amount of space in rcv queue,
1305 	 * but not less than advertised window.
1306 	 */
1307 	{ int win;
1308 
1309 	win = sbspace(&so->so_rcv);
1310 	if (win < 0)
1311 		win = 0;
1312 	tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1313 	}
1314 
1315 	switch (tp->t_state) {
1316 
1317 	/*
1318 	 * If the state is SYN_RECEIVED:
1319 	 *	if seg contains an ACK, but not for our SYN/ACK, send a RST.
1320 	 */
1321 	case TCPS_SYN_RECEIVED:
1322 		if ((thflags & TH_ACK) &&
1323 		    (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1324 		     SEQ_GT(th->th_ack, tp->snd_max))) {
1325 				rstreason = BANDLIM_RST_OPENPORT;
1326 				goto dropwithreset;
1327 		}
1328 		break;
1329 
1330 	/*
1331 	 * If the state is SYN_SENT:
1332 	 *	if seg contains an ACK, but not for our SYN, drop the input.
1333 	 *	if seg contains a RST, then drop the connection.
1334 	 *	if seg does not contain SYN, then drop it.
1335 	 * Otherwise this is an acceptable SYN segment
1336 	 *	initialize tp->rcv_nxt and tp->irs
1337 	 *	if seg contains ack then advance tp->snd_una
1338 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1339 	 *	arrange for segment to be acked (eventually)
1340 	 *	continue processing rest of data/controls, beginning with URG
1341 	 */
1342 	case TCPS_SYN_SENT:
1343 		if ((thflags & TH_ACK) &&
1344 		    (SEQ_LEQ(th->th_ack, tp->iss) ||
1345 		     SEQ_GT(th->th_ack, tp->snd_max))) {
1346 			rstreason = BANDLIM_UNLIMITED;
1347 			goto dropwithreset;
1348 		}
1349 		if (thflags & TH_RST) {
1350 			if (thflags & TH_ACK)
1351 				tp = tcp_drop(tp, ECONNREFUSED);
1352 			goto drop;
1353 		}
1354 		if ((thflags & TH_SYN) == 0)
1355 			goto drop;
1356 		tp->snd_wnd = th->th_win;	/* initial send window */
1357 
1358 		tp->irs = th->th_seq;
1359 		tcp_rcvseqinit(tp);
1360 		if (thflags & TH_ACK) {
1361 			tcpstat.tcps_connects++;
1362 			soisconnected(so);
1363 #ifdef MAC
1364 			SOCK_LOCK(so);
1365 			mac_set_socket_peer_from_mbuf(m, so);
1366 			SOCK_UNLOCK(so);
1367 #endif
1368 			/* Do window scaling on this connection? */
1369 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1370 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
1371 				tp->snd_scale = tp->requested_s_scale;
1372 				tp->rcv_scale = tp->request_r_scale;
1373 			}
1374 			tp->rcv_adv += tp->rcv_wnd;
1375 			tp->snd_una++;		/* SYN is acked */
1376 			/*
1377 			 * If there's data, delay ACK; if there's also a FIN
1378 			 * ACKNOW will be turned on later.
1379 			 */
1380 			if (DELAY_ACK(tp) && tlen != 0)
1381 				callout_reset(tp->tt_delack, tcp_delacktime,
1382 				    tcp_timer_delack, tp);
1383 			else
1384 				tp->t_flags |= TF_ACKNOW;
1385 			/*
1386 			 * Received <SYN,ACK> in SYN_SENT[*] state.
1387 			 * Transitions:
1388 			 *	SYN_SENT  --> ESTABLISHED
1389 			 *	SYN_SENT* --> FIN_WAIT_1
1390 			 */
1391 			tp->t_starttime = ticks;
1392 			if (tp->t_flags & TF_NEEDFIN) {
1393 				tp->t_state = TCPS_FIN_WAIT_1;
1394 				tp->t_flags &= ~TF_NEEDFIN;
1395 				thflags &= ~TH_SYN;
1396 			} else {
1397 				tp->t_state = TCPS_ESTABLISHED;
1398 				callout_reset(tp->tt_keep, tcp_keepidle,
1399 					      tcp_timer_keep, tp);
1400 			}
1401 		} else {
1402 			/*
1403 			 * Received initial SYN in SYN-SENT[*] state =>
1404 			 * simultaneous open.  If segment contains CC option
1405 			 * and there is a cached CC, apply TAO test.
1406 			 * If it succeeds, connection is * half-synchronized.
1407 			 * Otherwise, do 3-way handshake:
1408 			 *        SYN-SENT -> SYN-RECEIVED
1409 			 *        SYN-SENT* -> SYN-RECEIVED*
1410 			 * If there was no CC option, clear cached CC value.
1411 			 */
1412 			tp->t_flags |= TF_ACKNOW;
1413 			callout_stop(tp->tt_rexmt);
1414 			tp->t_state = TCPS_SYN_RECEIVED;
1415 		}
1416 
1417 trimthenstep6:
1418 		KASSERT(headlocked, ("tcp_input: trimthenstep6: head not "
1419 		    "locked"));
1420 		INP_LOCK_ASSERT(inp);
1421 
1422 		/*
1423 		 * Advance th->th_seq to correspond to first data byte.
1424 		 * If data, trim to stay within window,
1425 		 * dropping FIN if necessary.
1426 		 */
1427 		th->th_seq++;
1428 		if (tlen > tp->rcv_wnd) {
1429 			todrop = tlen - tp->rcv_wnd;
1430 			m_adj(m, -todrop);
1431 			tlen = tp->rcv_wnd;
1432 			thflags &= ~TH_FIN;
1433 			tcpstat.tcps_rcvpackafterwin++;
1434 			tcpstat.tcps_rcvbyteafterwin += todrop;
1435 		}
1436 		tp->snd_wl1 = th->th_seq - 1;
1437 		tp->rcv_up = th->th_seq;
1438 		/*
1439 		 * Client side of transaction: already sent SYN and data.
1440 		 * If the remote host used T/TCP to validate the SYN,
1441 		 * our data will be ACK'd; if so, enter normal data segment
1442 		 * processing in the middle of step 5, ack processing.
1443 		 * Otherwise, goto step 6.
1444 		 */
1445 		if (thflags & TH_ACK)
1446 			goto process_ACK;
1447 
1448 		goto step6;
1449 
1450 	/*
1451 	 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1452 	 *      do normal processing.
1453 	 *
1454 	 * NB: Leftover from RFC1644 T/TCP.  Cases to be reused later.
1455 	 */
1456 	case TCPS_LAST_ACK:
1457 	case TCPS_CLOSING:
1458 	case TCPS_TIME_WAIT:
1459 		KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait"));
1460 		break;  /* continue normal processing */
1461 	}
1462 
1463 	/*
1464 	 * States other than LISTEN or SYN_SENT.
1465 	 * First check the RST flag and sequence number since reset segments
1466 	 * are exempt from the timestamp and connection count tests.  This
1467 	 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1468 	 * below which allowed reset segments in half the sequence space
1469 	 * to fall though and be processed (which gives forged reset
1470 	 * segments with a random sequence number a 50 percent chance of
1471 	 * killing a connection).
1472 	 * Then check timestamp, if present.
1473 	 * Then check the connection count, if present.
1474 	 * Then check that at least some bytes of segment are within
1475 	 * receive window.  If segment begins before rcv_nxt,
1476 	 * drop leading data (and SYN); if nothing left, just ack.
1477 	 *
1478 	 *
1479 	 * If the RST bit is set, check the sequence number to see
1480 	 * if this is a valid reset segment.
1481 	 * RFC 793 page 37:
1482 	 *   In all states except SYN-SENT, all reset (RST) segments
1483 	 *   are validated by checking their SEQ-fields.  A reset is
1484 	 *   valid if its sequence number is in the window.
1485 	 * Note: this does not take into account delayed ACKs, so
1486 	 *   we should test against last_ack_sent instead of rcv_nxt.
1487 	 *   The sequence number in the reset segment is normally an
1488 	 *   echo of our outgoing acknowlegement numbers, but some hosts
1489 	 *   send a reset with the sequence number at the rightmost edge
1490 	 *   of our receive window, and we have to handle this case.
1491 	 * Note 2: Paul Watson's paper "Slipping in the Window" has shown
1492 	 *   that brute force RST attacks are possible.  To combat this,
1493 	 *   we use a much stricter check while in the ESTABLISHED state,
1494 	 *   only accepting RSTs where the sequence number is equal to
1495 	 *   last_ack_sent.  In all other states (the states in which a
1496 	 *   RST is more likely), the more permissive check is used.
1497 	 * If we have multiple segments in flight, the intial reset
1498 	 * segment sequence numbers will be to the left of last_ack_sent,
1499 	 * but they will eventually catch up.
1500 	 * In any case, it never made sense to trim reset segments to
1501 	 * fit the receive window since RFC 1122 says:
1502 	 *   4.2.2.12  RST Segment: RFC-793 Section 3.4
1503 	 *
1504 	 *    A TCP SHOULD allow a received RST segment to include data.
1505 	 *
1506 	 *    DISCUSSION
1507 	 *         It has been suggested that a RST segment could contain
1508 	 *         ASCII text that encoded and explained the cause of the
1509 	 *         RST.  No standard has yet been established for such
1510 	 *         data.
1511 	 *
1512 	 * If the reset segment passes the sequence number test examine
1513 	 * the state:
1514 	 *    SYN_RECEIVED STATE:
1515 	 *	If passive open, return to LISTEN state.
1516 	 *	If active open, inform user that connection was refused.
1517 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
1518 	 *	Inform user that connection was reset, and close tcb.
1519 	 *    CLOSING, LAST_ACK STATES:
1520 	 *	Close the tcb.
1521 	 *    TIME_WAIT STATE:
1522 	 *	Drop the segment - see Stevens, vol. 2, p. 964 and
1523 	 *      RFC 1337.
1524 	 */
1525 	if (thflags & TH_RST) {
1526 		if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
1527 		    SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) ||
1528 		    (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) {
1529 			switch (tp->t_state) {
1530 
1531 			case TCPS_SYN_RECEIVED:
1532 				so->so_error = ECONNREFUSED;
1533 				goto close;
1534 
1535 			case TCPS_ESTABLISHED:
1536 				if (tp->last_ack_sent != th->th_seq &&
1537 			 	    tcp_insecure_rst == 0) {
1538 					tcpstat.tcps_badrst++;
1539 					goto drop;
1540 				}
1541 			case TCPS_FIN_WAIT_1:
1542 			case TCPS_FIN_WAIT_2:
1543 			case TCPS_CLOSE_WAIT:
1544 				so->so_error = ECONNRESET;
1545 			close:
1546 				tp->t_state = TCPS_CLOSED;
1547 				tcpstat.tcps_drops++;
1548 				tp = tcp_close(tp);
1549 				break;
1550 
1551 			case TCPS_CLOSING:
1552 			case TCPS_LAST_ACK:
1553 				tp = tcp_close(tp);
1554 				break;
1555 
1556 			case TCPS_TIME_WAIT:
1557 				KASSERT(tp->t_state != TCPS_TIME_WAIT,
1558 				    ("timewait"));
1559 				break;
1560 			}
1561 		}
1562 		goto drop;
1563 	}
1564 
1565 	/*
1566 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1567 	 * and it's less than ts_recent, drop it.
1568 	 */
1569 	if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
1570 	    TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1571 
1572 		/* Check to see if ts_recent is over 24 days old.  */
1573 		if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1574 			/*
1575 			 * Invalidate ts_recent.  If this segment updates
1576 			 * ts_recent, the age will be reset later and ts_recent
1577 			 * will get a valid value.  If it does not, setting
1578 			 * ts_recent to zero will at least satisfy the
1579 			 * requirement that zero be placed in the timestamp
1580 			 * echo reply when ts_recent isn't valid.  The
1581 			 * age isn't reset until we get a valid ts_recent
1582 			 * because we don't want out-of-order segments to be
1583 			 * dropped when ts_recent is old.
1584 			 */
1585 			tp->ts_recent = 0;
1586 		} else {
1587 			tcpstat.tcps_rcvduppack++;
1588 			tcpstat.tcps_rcvdupbyte += tlen;
1589 			tcpstat.tcps_pawsdrop++;
1590 			if (tlen)
1591 				goto dropafterack;
1592 			goto drop;
1593 		}
1594 	}
1595 
1596 	/*
1597 	 * In the SYN-RECEIVED state, validate that the packet belongs to
1598 	 * this connection before trimming the data to fit the receive
1599 	 * window.  Check the sequence number versus IRS since we know
1600 	 * the sequence numbers haven't wrapped.  This is a partial fix
1601 	 * for the "LAND" DoS attack.
1602 	 */
1603 	if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1604 		rstreason = BANDLIM_RST_OPENPORT;
1605 		goto dropwithreset;
1606 	}
1607 
1608 	todrop = tp->rcv_nxt - th->th_seq;
1609 	if (todrop > 0) {
1610 		if (thflags & TH_SYN) {
1611 			thflags &= ~TH_SYN;
1612 			th->th_seq++;
1613 			if (th->th_urp > 1)
1614 				th->th_urp--;
1615 			else
1616 				thflags &= ~TH_URG;
1617 			todrop--;
1618 		}
1619 		/*
1620 		 * Following if statement from Stevens, vol. 2, p. 960.
1621 		 */
1622 		if (todrop > tlen
1623 		    || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1624 			/*
1625 			 * Any valid FIN must be to the left of the window.
1626 			 * At this point the FIN must be a duplicate or out
1627 			 * of sequence; drop it.
1628 			 */
1629 			thflags &= ~TH_FIN;
1630 
1631 			/*
1632 			 * Send an ACK to resynchronize and drop any data.
1633 			 * But keep on processing for RST or ACK.
1634 			 */
1635 			tp->t_flags |= TF_ACKNOW;
1636 			todrop = tlen;
1637 			tcpstat.tcps_rcvduppack++;
1638 			tcpstat.tcps_rcvdupbyte += todrop;
1639 		} else {
1640 			tcpstat.tcps_rcvpartduppack++;
1641 			tcpstat.tcps_rcvpartdupbyte += todrop;
1642 		}
1643 		drop_hdrlen += todrop;	/* drop from the top afterwards */
1644 		th->th_seq += todrop;
1645 		tlen -= todrop;
1646 		if (th->th_urp > todrop)
1647 			th->th_urp -= todrop;
1648 		else {
1649 			thflags &= ~TH_URG;
1650 			th->th_urp = 0;
1651 		}
1652 	}
1653 
1654 	/*
1655 	 * If new data are received on a connection after the
1656 	 * user processes are gone, then RST the other end.
1657 	 */
1658 	if ((so->so_state & SS_NOFDREF) &&
1659 	    tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1660 		tp = tcp_close(tp);
1661 		tcpstat.tcps_rcvafterclose++;
1662 		rstreason = BANDLIM_UNLIMITED;
1663 		goto dropwithreset;
1664 	}
1665 
1666 	/*
1667 	 * If segment ends after window, drop trailing data
1668 	 * (and PUSH and FIN); if nothing left, just ACK.
1669 	 */
1670 	todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1671 	if (todrop > 0) {
1672 		tcpstat.tcps_rcvpackafterwin++;
1673 		if (todrop >= tlen) {
1674 			tcpstat.tcps_rcvbyteafterwin += tlen;
1675 			/*
1676 			 * If a new connection request is received
1677 			 * while in TIME_WAIT, drop the old connection
1678 			 * and start over if the sequence numbers
1679 			 * are above the previous ones.
1680 			 */
1681 			KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait"));
1682 			if (thflags & TH_SYN &&
1683 			    tp->t_state == TCPS_TIME_WAIT &&
1684 			    SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1685 				tp = tcp_close(tp);
1686 				goto findpcb;
1687 			}
1688 			/*
1689 			 * If window is closed can only take segments at
1690 			 * window edge, and have to drop data and PUSH from
1691 			 * incoming segments.  Continue processing, but
1692 			 * remember to ack.  Otherwise, drop segment
1693 			 * and ack.
1694 			 */
1695 			if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1696 				tp->t_flags |= TF_ACKNOW;
1697 				tcpstat.tcps_rcvwinprobe++;
1698 			} else
1699 				goto dropafterack;
1700 		} else
1701 			tcpstat.tcps_rcvbyteafterwin += todrop;
1702 		m_adj(m, -todrop);
1703 		tlen -= todrop;
1704 		thflags &= ~(TH_PUSH|TH_FIN);
1705 	}
1706 
1707 	/*
1708 	 * If last ACK falls within this segment's sequence numbers,
1709 	 * record its timestamp.
1710 	 * NOTE that the test is modified according to the latest
1711 	 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1712 	 */
1713 	if ((to.to_flags & TOF_TS) != 0 &&
1714 	    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1715 		tp->ts_recent_age = ticks;
1716 		tp->ts_recent = to.to_tsval;
1717 	}
1718 
1719 	/*
1720 	 * If a SYN is in the window, then this is an
1721 	 * error and we send an RST and drop the connection.
1722 	 */
1723 	if (thflags & TH_SYN) {
1724 		tp = tcp_drop(tp, ECONNRESET);
1725 		rstreason = BANDLIM_UNLIMITED;
1726 		goto drop;
1727 	}
1728 
1729 	/*
1730 	 * If the ACK bit is off:  if in SYN-RECEIVED state or SENDSYN
1731 	 * flag is on (half-synchronized state), then queue data for
1732 	 * later processing; else drop segment and return.
1733 	 */
1734 	if ((thflags & TH_ACK) == 0) {
1735 		if (tp->t_state == TCPS_SYN_RECEIVED ||
1736 		    (tp->t_flags & TF_NEEDSYN))
1737 			goto step6;
1738 		else
1739 			goto drop;
1740 	}
1741 
1742 	/*
1743 	 * Ack processing.
1744 	 */
1745 	switch (tp->t_state) {
1746 
1747 	/*
1748 	 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1749 	 * ESTABLISHED state and continue processing.
1750 	 * The ACK was checked above.
1751 	 */
1752 	case TCPS_SYN_RECEIVED:
1753 
1754 		tcpstat.tcps_connects++;
1755 		soisconnected(so);
1756 		/* Do window scaling? */
1757 		if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1758 			(TF_RCVD_SCALE|TF_REQ_SCALE)) {
1759 			tp->snd_scale = tp->requested_s_scale;
1760 			tp->rcv_scale = tp->request_r_scale;
1761 		}
1762 		/*
1763 		 * Make transitions:
1764 		 *      SYN-RECEIVED  -> ESTABLISHED
1765 		 *      SYN-RECEIVED* -> FIN-WAIT-1
1766 		 */
1767 		tp->t_starttime = ticks;
1768 		if (tp->t_flags & TF_NEEDFIN) {
1769 			tp->t_state = TCPS_FIN_WAIT_1;
1770 			tp->t_flags &= ~TF_NEEDFIN;
1771 		} else {
1772 			tp->t_state = TCPS_ESTABLISHED;
1773 			callout_reset(tp->tt_keep, tcp_keepidle,
1774 				      tcp_timer_keep, tp);
1775 		}
1776 		/*
1777 		 * If segment contains data or ACK, will call tcp_reass()
1778 		 * later; if not, do so now to pass queued data to user.
1779 		 */
1780 		if (tlen == 0 && (thflags & TH_FIN) == 0)
1781 			(void) tcp_reass(tp, (struct tcphdr *)0, 0,
1782 			    (struct mbuf *)0);
1783 		tp->snd_wl1 = th->th_seq - 1;
1784 		/* FALLTHROUGH */
1785 
1786 	/*
1787 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1788 	 * ACKs.  If the ack is in the range
1789 	 *	tp->snd_una < th->th_ack <= tp->snd_max
1790 	 * then advance tp->snd_una to th->th_ack and drop
1791 	 * data from the retransmission queue.  If this ACK reflects
1792 	 * more up to date window information we update our window information.
1793 	 */
1794 	case TCPS_ESTABLISHED:
1795 	case TCPS_FIN_WAIT_1:
1796 	case TCPS_FIN_WAIT_2:
1797 	case TCPS_CLOSE_WAIT:
1798 	case TCPS_CLOSING:
1799 	case TCPS_LAST_ACK:
1800 	case TCPS_TIME_WAIT:
1801 		KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait"));
1802 		if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1803 			if (tlen == 0 && tiwin == tp->snd_wnd) {
1804 				tcpstat.tcps_rcvdupack++;
1805 				/*
1806 				 * If we have outstanding data (other than
1807 				 * a window probe), this is a completely
1808 				 * duplicate ack (ie, window info didn't
1809 				 * change), the ack is the biggest we've
1810 				 * seen and we've seen exactly our rexmt
1811 				 * threshhold of them, assume a packet
1812 				 * has been dropped and retransmit it.
1813 				 * Kludge snd_nxt & the congestion
1814 				 * window so we send only this one
1815 				 * packet.
1816 				 *
1817 				 * We know we're losing at the current
1818 				 * window size so do congestion avoidance
1819 				 * (set ssthresh to half the current window
1820 				 * and pull our congestion window back to
1821 				 * the new ssthresh).
1822 				 *
1823 				 * Dup acks mean that packets have left the
1824 				 * network (they're now cached at the receiver)
1825 				 * so bump cwnd by the amount in the receiver
1826 				 * to keep a constant cwnd packets in the
1827 				 * network.
1828 				 */
1829 				if (!callout_active(tp->tt_rexmt) ||
1830 				    th->th_ack != tp->snd_una)
1831 					tp->t_dupacks = 0;
1832 				else if (++tp->t_dupacks > tcprexmtthresh ||
1833 					 ((tcp_do_newreno || tp->sack_enable) &&
1834 					  IN_FASTRECOVERY(tp))) {
1835 					tp->snd_cwnd += tp->t_maxseg;
1836 					(void) tcp_output(tp);
1837 					goto drop;
1838 				} else if (tp->t_dupacks == tcprexmtthresh) {
1839 					tcp_seq onxt = tp->snd_nxt;
1840 					u_int win;
1841 
1842 					/*
1843 					 * If we're doing sack, check to
1844 					 * see if we're already in sack
1845 					 * recovery. If we're not doing sack,
1846 					 * check to see if we're in newreno
1847 					 * recovery.
1848 					 */
1849 					if (tp->sack_enable) {
1850 						if (IN_FASTRECOVERY(tp)) {
1851 							tp->t_dupacks = 0;
1852 							break;
1853 						}
1854 					} else if (tcp_do_newreno) {
1855 						if (SEQ_LEQ(th->th_ack,
1856 						    tp->snd_recover)) {
1857 							tp->t_dupacks = 0;
1858 							break;
1859 						}
1860 					}
1861 					win = min(tp->snd_wnd, tp->snd_cwnd) /
1862 					    2 / tp->t_maxseg;
1863 					if (win < 2)
1864 						win = 2;
1865 					tp->snd_ssthresh = win * tp->t_maxseg;
1866 					ENTER_FASTRECOVERY(tp);
1867 					tp->snd_recover = tp->snd_max;
1868 					callout_stop(tp->tt_rexmt);
1869 					tp->t_rtttime = 0;
1870 					if (tp->sack_enable) {
1871 						tcpstat.tcps_sack_recovery_episode++;
1872 						tp->sack_newdata = tp->snd_nxt;
1873 						tp->snd_cwnd =
1874 							tp->t_maxseg * tcp_sack_recovery_initburst;
1875 						(void) tcp_output(tp);
1876 						tp->snd_cwnd +=
1877 						    tp->snd_ssthresh;
1878 						goto drop;
1879 					}
1880 
1881 					tp->snd_nxt = th->th_ack;
1882 					tp->snd_cwnd = tp->t_maxseg;
1883 					(void) tcp_output(tp);
1884 					KASSERT(tp->snd_limited <= 2,
1885 					    ("tp->snd_limited too big"));
1886 					tp->snd_cwnd = tp->snd_ssthresh +
1887 					     tp->t_maxseg *
1888 					     (tp->t_dupacks - tp->snd_limited);
1889 					if (SEQ_GT(onxt, tp->snd_nxt))
1890 						tp->snd_nxt = onxt;
1891 					goto drop;
1892 				} else if (tcp_do_rfc3042) {
1893 					u_long oldcwnd = tp->snd_cwnd;
1894 					tcp_seq oldsndmax = tp->snd_max;
1895 					u_int sent;
1896 
1897 					KASSERT(tp->t_dupacks == 1 ||
1898 					    tp->t_dupacks == 2,
1899 					    ("dupacks not 1 or 2"));
1900 					if (tp->t_dupacks == 1)
1901 						tp->snd_limited = 0;
1902 					tp->snd_cwnd =
1903 					    (tp->snd_nxt - tp->snd_una) +
1904 					    (tp->t_dupacks - tp->snd_limited) *
1905 					    tp->t_maxseg;
1906 					(void) tcp_output(tp);
1907 					sent = tp->snd_max - oldsndmax;
1908 					if (sent > tp->t_maxseg) {
1909 						KASSERT((tp->t_dupacks == 2 &&
1910 						    tp->snd_limited == 0) ||
1911 						   (sent == tp->t_maxseg + 1 &&
1912 						    tp->t_flags & TF_SENTFIN),
1913 						    ("sent too much"));
1914 						tp->snd_limited = 2;
1915 					} else if (sent > 0)
1916 						++tp->snd_limited;
1917 					tp->snd_cwnd = oldcwnd;
1918 					goto drop;
1919 				}
1920 			} else
1921 				tp->t_dupacks = 0;
1922 			break;
1923 		}
1924 
1925 		KASSERT(SEQ_GT(th->th_ack, tp->snd_una), ("th_ack <= snd_una"));
1926 
1927 		/*
1928 		 * If the congestion window was inflated to account
1929 		 * for the other side's cached packets, retract it.
1930 		 */
1931 		if (tcp_do_newreno || tp->sack_enable) {
1932 			if (IN_FASTRECOVERY(tp)) {
1933 				if (SEQ_LT(th->th_ack, tp->snd_recover)) {
1934 					if (tp->sack_enable)
1935 						tcp_sack_partialack(tp, th);
1936 					else
1937 						tcp_newreno_partial_ack(tp, th);
1938 				} else {
1939 					/*
1940 					 * Out of fast recovery.
1941 					 * Window inflation should have left us
1942 					 * with approximately snd_ssthresh
1943 					 * outstanding data.
1944 					 * But in case we would be inclined to
1945 					 * send a burst, better to do it via
1946 					 * the slow start mechanism.
1947 					 */
1948 					if (SEQ_GT(th->th_ack +
1949 							tp->snd_ssthresh,
1950 						   tp->snd_max))
1951 						tp->snd_cwnd = tp->snd_max -
1952 								th->th_ack +
1953 								tp->t_maxseg;
1954 					else
1955 						tp->snd_cwnd = tp->snd_ssthresh;
1956 				}
1957 			}
1958 		} else {
1959 			if (tp->t_dupacks >= tcprexmtthresh &&
1960 			    tp->snd_cwnd > tp->snd_ssthresh)
1961 				tp->snd_cwnd = tp->snd_ssthresh;
1962 		}
1963 		tp->t_dupacks = 0;
1964 		if (SEQ_GT(th->th_ack, tp->snd_max)) {
1965 			tcpstat.tcps_rcvacktoomuch++;
1966 			goto dropafterack;
1967 		}
1968 		/*
1969 		 * If we reach this point, ACK is not a duplicate,
1970 		 *     i.e., it ACKs something we sent.
1971 		 */
1972 		if (tp->t_flags & TF_NEEDSYN) {
1973 			/*
1974 			 * T/TCP: Connection was half-synchronized, and our
1975 			 * SYN has been ACK'd (so connection is now fully
1976 			 * synchronized).  Go to non-starred state,
1977 			 * increment snd_una for ACK of SYN, and check if
1978 			 * we can do window scaling.
1979 			 */
1980 			tp->t_flags &= ~TF_NEEDSYN;
1981 			tp->snd_una++;
1982 			/* Do window scaling? */
1983 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1984 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
1985 				tp->snd_scale = tp->requested_s_scale;
1986 				tp->rcv_scale = tp->request_r_scale;
1987 			}
1988 		}
1989 
1990 process_ACK:
1991 		KASSERT(headlocked, ("tcp_input: process_ACK: head not "
1992 		    "locked"));
1993 		INP_LOCK_ASSERT(inp);
1994 
1995 		acked = th->th_ack - tp->snd_una;
1996 		tcpstat.tcps_rcvackpack++;
1997 		tcpstat.tcps_rcvackbyte += acked;
1998 
1999 		/*
2000 		 * If we just performed our first retransmit, and the ACK
2001 		 * arrives within our recovery window, then it was a mistake
2002 		 * to do the retransmit in the first place.  Recover our
2003 		 * original cwnd and ssthresh, and proceed to transmit where
2004 		 * we left off.
2005 		 */
2006 		if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) {
2007 			++tcpstat.tcps_sndrexmitbad;
2008 			tp->snd_cwnd = tp->snd_cwnd_prev;
2009 			tp->snd_ssthresh = tp->snd_ssthresh_prev;
2010 			tp->snd_recover = tp->snd_recover_prev;
2011 			if (tp->t_flags & TF_WASFRECOVERY)
2012 				ENTER_FASTRECOVERY(tp);
2013 			tp->snd_nxt = tp->snd_max;
2014 			tp->t_badrxtwin = 0;	/* XXX probably not required */
2015 		}
2016 
2017 		/*
2018 		 * If we have a timestamp reply, update smoothed
2019 		 * round trip time.  If no timestamp is present but
2020 		 * transmit timer is running and timed sequence
2021 		 * number was acked, update smoothed round trip time.
2022 		 * Since we now have an rtt measurement, cancel the
2023 		 * timer backoff (cf., Phil Karn's retransmit alg.).
2024 		 * Recompute the initial retransmit timer.
2025 		 *
2026 		 * Some boxes send broken timestamp replies
2027 		 * during the SYN+ACK phase, ignore
2028 		 * timestamps of 0 or we could calculate a
2029 		 * huge RTT and blow up the retransmit timer.
2030 		 */
2031 		if ((to.to_flags & TOF_TS) != 0 &&
2032 		    to.to_tsecr) {
2033 			tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
2034 		} else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) {
2035 			tcp_xmit_timer(tp, ticks - tp->t_rtttime);
2036 		}
2037 		tcp_xmit_bandwidth_limit(tp, th->th_ack);
2038 
2039 		/*
2040 		 * If all outstanding data is acked, stop retransmit
2041 		 * timer and remember to restart (more output or persist).
2042 		 * If there is more data to be acked, restart retransmit
2043 		 * timer, using current (possibly backed-off) value.
2044 		 */
2045 		if (th->th_ack == tp->snd_max) {
2046 			callout_stop(tp->tt_rexmt);
2047 			needoutput = 1;
2048 		} else if (!callout_active(tp->tt_persist))
2049 			callout_reset(tp->tt_rexmt, tp->t_rxtcur,
2050 				      tcp_timer_rexmt, tp);
2051 
2052 		/*
2053 		 * If no data (only SYN) was ACK'd,
2054 		 *    skip rest of ACK processing.
2055 		 */
2056 		if (acked == 0)
2057 			goto step6;
2058 
2059 		/*
2060 		 * When new data is acked, open the congestion window.
2061 		 * If the window gives us less than ssthresh packets
2062 		 * in flight, open exponentially (maxseg per packet).
2063 		 * Otherwise open linearly: maxseg per window
2064 		 * (maxseg^2 / cwnd per packet).
2065 		 */
2066 		if ((!tcp_do_newreno && !tp->sack_enable) ||
2067 		    !IN_FASTRECOVERY(tp)) {
2068 			register u_int cw = tp->snd_cwnd;
2069 			register u_int incr = tp->t_maxseg;
2070 			if (cw > tp->snd_ssthresh)
2071 				incr = incr * incr / cw;
2072 			tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale);
2073 		}
2074 		SOCKBUF_LOCK(&so->so_snd);
2075 		if (acked > so->so_snd.sb_cc) {
2076 			tp->snd_wnd -= so->so_snd.sb_cc;
2077 			sbdrop_locked(&so->so_snd, (int)so->so_snd.sb_cc);
2078 			ourfinisacked = 1;
2079 		} else {
2080 			sbdrop_locked(&so->so_snd, acked);
2081 			tp->snd_wnd -= acked;
2082 			ourfinisacked = 0;
2083 		}
2084 		sowwakeup_locked(so);
2085 		/* detect una wraparound */
2086 		if ((tcp_do_newreno || tp->sack_enable) &&
2087 		    !IN_FASTRECOVERY(tp) &&
2088 		    SEQ_GT(tp->snd_una, tp->snd_recover) &&
2089 		    SEQ_LEQ(th->th_ack, tp->snd_recover))
2090 			tp->snd_recover = th->th_ack - 1;
2091 		if ((tcp_do_newreno || tp->sack_enable) &&
2092 		    IN_FASTRECOVERY(tp) &&
2093 		    SEQ_GEQ(th->th_ack, tp->snd_recover))
2094 			EXIT_FASTRECOVERY(tp);
2095 		tp->snd_una = th->th_ack;
2096 		if (tp->sack_enable) {
2097 			if (SEQ_GT(tp->snd_una, tp->snd_recover))
2098 				tp->snd_recover = tp->snd_una;
2099 		}
2100 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2101 			tp->snd_nxt = tp->snd_una;
2102 
2103 		switch (tp->t_state) {
2104 
2105 		/*
2106 		 * In FIN_WAIT_1 STATE in addition to the processing
2107 		 * for the ESTABLISHED state if our FIN is now acknowledged
2108 		 * then enter FIN_WAIT_2.
2109 		 */
2110 		case TCPS_FIN_WAIT_1:
2111 			if (ourfinisacked) {
2112 				/*
2113 				 * If we can't receive any more
2114 				 * data, then closing user can proceed.
2115 				 * Starting the timer is contrary to the
2116 				 * specification, but if we don't get a FIN
2117 				 * we'll hang forever.
2118 				 */
2119 		/* XXXjl
2120 		 * we should release the tp also, and use a
2121 		 * compressed state.
2122 		 */
2123 				if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
2124 					soisdisconnected(so);
2125 					callout_reset(tp->tt_2msl, tcp_maxidle,
2126 						      tcp_timer_2msl, tp);
2127 				}
2128 				tp->t_state = TCPS_FIN_WAIT_2;
2129 			}
2130 			break;
2131 
2132 		/*
2133 		 * In CLOSING STATE in addition to the processing for
2134 		 * the ESTABLISHED state if the ACK acknowledges our FIN
2135 		 * then enter the TIME-WAIT state, otherwise ignore
2136 		 * the segment.
2137 		 */
2138 		case TCPS_CLOSING:
2139 			if (ourfinisacked) {
2140 				KASSERT(headlocked, ("tcp_input: process_ACK: "
2141 				    "head not locked"));
2142 				tcp_twstart(tp);
2143 				INP_INFO_WUNLOCK(&tcbinfo);
2144 				m_freem(m);
2145 				return;
2146 			}
2147 			break;
2148 
2149 		/*
2150 		 * In LAST_ACK, we may still be waiting for data to drain
2151 		 * and/or to be acked, as well as for the ack of our FIN.
2152 		 * If our FIN is now acknowledged, delete the TCB,
2153 		 * enter the closed state and return.
2154 		 */
2155 		case TCPS_LAST_ACK:
2156 			if (ourfinisacked) {
2157 				tp = tcp_close(tp);
2158 				goto drop;
2159 			}
2160 			break;
2161 
2162 		/*
2163 		 * In TIME_WAIT state the only thing that should arrive
2164 		 * is a retransmission of the remote FIN.  Acknowledge
2165 		 * it and restart the finack timer.
2166 		 */
2167 		case TCPS_TIME_WAIT:
2168 			KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait"));
2169 			callout_reset(tp->tt_2msl, 2 * tcp_msl,
2170 				      tcp_timer_2msl, tp);
2171 			goto dropafterack;
2172 		}
2173 	}
2174 
2175 step6:
2176 	KASSERT(headlocked, ("tcp_input: step6: head not locked"));
2177 	INP_LOCK_ASSERT(inp);
2178 
2179 	/*
2180 	 * Update window information.
2181 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2182 	 */
2183 	if ((thflags & TH_ACK) &&
2184 	    (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2185 	    (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2186 	     (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2187 		/* keep track of pure window updates */
2188 		if (tlen == 0 &&
2189 		    tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2190 			tcpstat.tcps_rcvwinupd++;
2191 		tp->snd_wnd = tiwin;
2192 		tp->snd_wl1 = th->th_seq;
2193 		tp->snd_wl2 = th->th_ack;
2194 		if (tp->snd_wnd > tp->max_sndwnd)
2195 			tp->max_sndwnd = tp->snd_wnd;
2196 		needoutput = 1;
2197 	}
2198 
2199 	/*
2200 	 * Process segments with URG.
2201 	 */
2202 	if ((thflags & TH_URG) && th->th_urp &&
2203 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2204 		/*
2205 		 * This is a kludge, but if we receive and accept
2206 		 * random urgent pointers, we'll crash in
2207 		 * soreceive.  It's hard to imagine someone
2208 		 * actually wanting to send this much urgent data.
2209 		 */
2210 		SOCKBUF_LOCK(&so->so_rcv);
2211 		if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2212 			th->th_urp = 0;			/* XXX */
2213 			thflags &= ~TH_URG;		/* XXX */
2214 			SOCKBUF_UNLOCK(&so->so_rcv);	/* XXX */
2215 			goto dodata;			/* XXX */
2216 		}
2217 		/*
2218 		 * If this segment advances the known urgent pointer,
2219 		 * then mark the data stream.  This should not happen
2220 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2221 		 * a FIN has been received from the remote side.
2222 		 * In these states we ignore the URG.
2223 		 *
2224 		 * According to RFC961 (Assigned Protocols),
2225 		 * the urgent pointer points to the last octet
2226 		 * of urgent data.  We continue, however,
2227 		 * to consider it to indicate the first octet
2228 		 * of data past the urgent section as the original
2229 		 * spec states (in one of two places).
2230 		 */
2231 		if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2232 			tp->rcv_up = th->th_seq + th->th_urp;
2233 			so->so_oobmark = so->so_rcv.sb_cc +
2234 			    (tp->rcv_up - tp->rcv_nxt) - 1;
2235 			if (so->so_oobmark == 0)
2236 				so->so_rcv.sb_state |= SBS_RCVATMARK;
2237 			sohasoutofband(so);
2238 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2239 		}
2240 		SOCKBUF_UNLOCK(&so->so_rcv);
2241 		/*
2242 		 * Remove out of band data so doesn't get presented to user.
2243 		 * This can happen independent of advancing the URG pointer,
2244 		 * but if two URG's are pending at once, some out-of-band
2245 		 * data may creep in... ick.
2246 		 */
2247 		if (th->th_urp <= (u_long)tlen &&
2248 		    !(so->so_options & SO_OOBINLINE)) {
2249 			/* hdr drop is delayed */
2250 			tcp_pulloutofband(so, th, m, drop_hdrlen);
2251 		}
2252 	} else {
2253 		/*
2254 		 * If no out of band data is expected,
2255 		 * pull receive urgent pointer along
2256 		 * with the receive window.
2257 		 */
2258 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2259 			tp->rcv_up = tp->rcv_nxt;
2260 	}
2261 dodata:							/* XXX */
2262 	KASSERT(headlocked, ("tcp_input: dodata: head not locked"));
2263 	INP_LOCK_ASSERT(inp);
2264 
2265 	/*
2266 	 * Process the segment text, merging it into the TCP sequencing queue,
2267 	 * and arranging for acknowledgment of receipt if necessary.
2268 	 * This process logically involves adjusting tp->rcv_wnd as data
2269 	 * is presented to the user (this happens in tcp_usrreq.c,
2270 	 * case PRU_RCVD).  If a FIN has already been received on this
2271 	 * connection then we just ignore the text.
2272 	 */
2273 	if ((tlen || (thflags & TH_FIN)) &&
2274 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2275 		m_adj(m, drop_hdrlen);	/* delayed header drop */
2276 		/*
2277 		 * Insert segment which includes th into TCP reassembly queue
2278 		 * with control block tp.  Set thflags to whether reassembly now
2279 		 * includes a segment with FIN.  This handles the common case
2280 		 * inline (segment is the next to be received on an established
2281 		 * connection, and the queue is empty), avoiding linkage into
2282 		 * and removal from the queue and repetition of various
2283 		 * conversions.
2284 		 * Set DELACK for segments received in order, but ack
2285 		 * immediately when segments are out of order (so
2286 		 * fast retransmit can work).
2287 		 */
2288 		if (th->th_seq == tp->rcv_nxt &&
2289 		    LIST_EMPTY(&tp->t_segq) &&
2290 		    TCPS_HAVEESTABLISHED(tp->t_state)) {
2291 			if (DELAY_ACK(tp))
2292 				tp->t_flags |= TF_DELACK;
2293 			else
2294 				tp->t_flags |= TF_ACKNOW;
2295 			tp->rcv_nxt += tlen;
2296 			thflags = th->th_flags & TH_FIN;
2297 			tcpstat.tcps_rcvpack++;
2298 			tcpstat.tcps_rcvbyte += tlen;
2299 			ND6_HINT(tp);
2300 			SOCKBUF_LOCK(&so->so_rcv);
2301 			if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
2302 				m_freem(m);
2303 			else
2304 				sbappendstream_locked(&so->so_rcv, m);
2305 			sorwakeup_locked(so);
2306 		} else {
2307 			thflags = tcp_reass(tp, th, &tlen, m);
2308 			tp->t_flags |= TF_ACKNOW;
2309 		}
2310 			if (tp->sack_enable)
2311 				tcp_update_sack_list(tp);
2312 		/*
2313 		 * Note the amount of data that peer has sent into
2314 		 * our window, in order to estimate the sender's
2315 		 * buffer size.
2316 		 */
2317 		len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2318 	} else {
2319 		m_freem(m);
2320 		thflags &= ~TH_FIN;
2321 	}
2322 
2323 	/*
2324 	 * If FIN is received ACK the FIN and let the user know
2325 	 * that the connection is closing.
2326 	 */
2327 	if (thflags & TH_FIN) {
2328 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2329 			socantrcvmore(so);
2330 			/*
2331 			 * If connection is half-synchronized
2332 			 * (ie NEEDSYN flag on) then delay ACK,
2333 			 * so it may be piggybacked when SYN is sent.
2334 			 * Otherwise, since we received a FIN then no
2335 			 * more input can be expected, send ACK now.
2336 			 */
2337 			if (tp->t_flags & TF_NEEDSYN)
2338 				tp->t_flags |= TF_DELACK;
2339 			else
2340 				tp->t_flags |= TF_ACKNOW;
2341 			tp->rcv_nxt++;
2342 		}
2343 		switch (tp->t_state) {
2344 
2345 		/*
2346 		 * In SYN_RECEIVED and ESTABLISHED STATES
2347 		 * enter the CLOSE_WAIT state.
2348 		 */
2349 		case TCPS_SYN_RECEIVED:
2350 			tp->t_starttime = ticks;
2351 			/*FALLTHROUGH*/
2352 		case TCPS_ESTABLISHED:
2353 			tp->t_state = TCPS_CLOSE_WAIT;
2354 			break;
2355 
2356 		/*
2357 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2358 		 * enter the CLOSING state.
2359 		 */
2360 		case TCPS_FIN_WAIT_1:
2361 			tp->t_state = TCPS_CLOSING;
2362 			break;
2363 
2364 		/*
2365 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2366 		 * starting the time-wait timer, turning off the other
2367 		 * standard timers.
2368 		 */
2369 		case TCPS_FIN_WAIT_2:
2370 			KASSERT(headlocked == 1, ("tcp_input: dodata: "
2371 			    "TCP_FIN_WAIT_2: head not locked"));
2372 			tcp_twstart(tp);
2373 			INP_INFO_WUNLOCK(&tcbinfo);
2374 			return;
2375 
2376 		/*
2377 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2378 		 */
2379 		case TCPS_TIME_WAIT:
2380 			KASSERT(tp->t_state != TCPS_TIME_WAIT, ("timewait"));
2381 			callout_reset(tp->tt_2msl, 2 * tcp_msl,
2382 				      tcp_timer_2msl, tp);
2383 			break;
2384 		}
2385 	}
2386 	INP_INFO_WUNLOCK(&tcbinfo);
2387 	headlocked = 0;
2388 #ifdef TCPDEBUG
2389 	if (so->so_options & SO_DEBUG)
2390 		tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2391 			  &tcp_savetcp, 0);
2392 #endif
2393 
2394 	/*
2395 	 * Return any desired output.
2396 	 */
2397 	if (needoutput || (tp->t_flags & TF_ACKNOW))
2398 		(void) tcp_output(tp);
2399 
2400 check_delack:
2401 	KASSERT(headlocked == 0, ("tcp_input: check_delack: head locked"));
2402 	INP_LOCK_ASSERT(inp);
2403 	if (tp->t_flags & TF_DELACK) {
2404 		tp->t_flags &= ~TF_DELACK;
2405 		callout_reset(tp->tt_delack, tcp_delacktime,
2406 		    tcp_timer_delack, tp);
2407 	}
2408 	INP_UNLOCK(inp);
2409 	return;
2410 
2411 dropafterack:
2412 	KASSERT(headlocked, ("tcp_input: dropafterack: head not locked"));
2413 	/*
2414 	 * Generate an ACK dropping incoming segment if it occupies
2415 	 * sequence space, where the ACK reflects our state.
2416 	 *
2417 	 * We can now skip the test for the RST flag since all
2418 	 * paths to this code happen after packets containing
2419 	 * RST have been dropped.
2420 	 *
2421 	 * In the SYN-RECEIVED state, don't send an ACK unless the
2422 	 * segment we received passes the SYN-RECEIVED ACK test.
2423 	 * If it fails send a RST.  This breaks the loop in the
2424 	 * "LAND" DoS attack, and also prevents an ACK storm
2425 	 * between two listening ports that have been sent forged
2426 	 * SYN segments, each with the source address of the other.
2427 	 */
2428 	if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2429 	    (SEQ_GT(tp->snd_una, th->th_ack) ||
2430 	     SEQ_GT(th->th_ack, tp->snd_max)) ) {
2431 		rstreason = BANDLIM_RST_OPENPORT;
2432 		goto dropwithreset;
2433 	}
2434 #ifdef TCPDEBUG
2435 	if (so->so_options & SO_DEBUG)
2436 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2437 			  &tcp_savetcp, 0);
2438 #endif
2439 	KASSERT(headlocked, ("headlocked should be 1"));
2440 	INP_INFO_WUNLOCK(&tcbinfo);
2441 	tp->t_flags |= TF_ACKNOW;
2442 	(void) tcp_output(tp);
2443 	INP_UNLOCK(inp);
2444 	m_freem(m);
2445 	return;
2446 
2447 dropwithreset:
2448 	KASSERT(headlocked, ("tcp_input: dropwithreset: head not locked"));
2449 	/*
2450 	 * Generate a RST, dropping incoming segment.
2451 	 * Make ACK acceptable to originator of segment.
2452 	 * Don't bother to respond if destination was broadcast/multicast.
2453 	 */
2454 	if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2455 		goto drop;
2456 	if (isipv6) {
2457 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2458 		    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2459 			goto drop;
2460 	} else {
2461 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2462 		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2463 		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2464 		    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2465 			goto drop;
2466 	}
2467 	/* IPv6 anycast check is done at tcp6_input() */
2468 
2469 	/*
2470 	 * Perform bandwidth limiting.
2471 	 */
2472 	if (badport_bandlim(rstreason) < 0)
2473 		goto drop;
2474 
2475 #ifdef TCPDEBUG
2476 	if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2477 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2478 			  &tcp_savetcp, 0);
2479 #endif
2480 
2481 	if (thflags & TH_ACK)
2482 		/* mtod() below is safe as long as hdr dropping is delayed */
2483 		tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack,
2484 			    TH_RST);
2485 	else {
2486 		if (thflags & TH_SYN)
2487 			tlen++;
2488 		/* mtod() below is safe as long as hdr dropping is delayed */
2489 		tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2490 			    (tcp_seq)0, TH_RST|TH_ACK);
2491 	}
2492 
2493 	if (tp)
2494 		INP_UNLOCK(inp);
2495 	if (headlocked)
2496 		INP_INFO_WUNLOCK(&tcbinfo);
2497 	return;
2498 
2499 drop:
2500 	/*
2501 	 * Drop space held by incoming segment and return.
2502 	 */
2503 #ifdef TCPDEBUG
2504 	if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2505 		tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2506 			  &tcp_savetcp, 0);
2507 #endif
2508 	if (tp)
2509 		INP_UNLOCK(inp);
2510 	if (headlocked)
2511 		INP_INFO_WUNLOCK(&tcbinfo);
2512 	m_freem(m);
2513 	return;
2514 }
2515 
2516 /*
2517  * Parse TCP options and place in tcpopt.
2518  */
2519 static void
2520 tcp_dooptions(tp, to, cp, cnt, is_syn, th)
2521 	struct tcpcb *tp;
2522 	struct tcpopt *to;
2523 	u_char *cp;
2524 	int cnt;
2525 	int is_syn;
2526 	struct tcphdr *th;
2527 {
2528 	int opt, optlen;
2529 
2530 	to->to_flags = 0;
2531 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
2532 		opt = cp[0];
2533 		if (opt == TCPOPT_EOL)
2534 			break;
2535 		if (opt == TCPOPT_NOP)
2536 			optlen = 1;
2537 		else {
2538 			if (cnt < 2)
2539 				break;
2540 			optlen = cp[1];
2541 			if (optlen < 2 || optlen > cnt)
2542 				break;
2543 		}
2544 		switch (opt) {
2545 		case TCPOPT_MAXSEG:
2546 			if (optlen != TCPOLEN_MAXSEG)
2547 				continue;
2548 			if (!is_syn)
2549 				continue;
2550 			to->to_flags |= TOF_MSS;
2551 			bcopy((char *)cp + 2,
2552 			    (char *)&to->to_mss, sizeof(to->to_mss));
2553 			to->to_mss = ntohs(to->to_mss);
2554 			break;
2555 		case TCPOPT_WINDOW:
2556 			if (optlen != TCPOLEN_WINDOW)
2557 				continue;
2558 			if (! is_syn)
2559 				continue;
2560 			to->to_flags |= TOF_SCALE;
2561 			to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
2562 			break;
2563 		case TCPOPT_TIMESTAMP:
2564 			if (optlen != TCPOLEN_TIMESTAMP)
2565 				continue;
2566 			to->to_flags |= TOF_TS;
2567 			bcopy((char *)cp + 2,
2568 			    (char *)&to->to_tsval, sizeof(to->to_tsval));
2569 			to->to_tsval = ntohl(to->to_tsval);
2570 			bcopy((char *)cp + 6,
2571 			    (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2572 			to->to_tsecr = ntohl(to->to_tsecr);
2573 			break;
2574 #ifdef TCP_SIGNATURE
2575 		/*
2576 		 * XXX In order to reply to a host which has set the
2577 		 * TCP_SIGNATURE option in its initial SYN, we have to
2578 		 * record the fact that the option was observed here
2579 		 * for the syncache code to perform the correct response.
2580 		 */
2581 		case TCPOPT_SIGNATURE:
2582 			if (optlen != TCPOLEN_SIGNATURE)
2583 				continue;
2584 			to->to_flags |= (TOF_SIGNATURE | TOF_SIGLEN);
2585 			break;
2586 #endif
2587 		case TCPOPT_SACK_PERMITTED:
2588 			if (!tcp_do_sack ||
2589 			    optlen != TCPOLEN_SACK_PERMITTED)
2590 				continue;
2591 			if (is_syn) {
2592 				/* MUST only be set on SYN */
2593 				to->to_flags |= TOF_SACK;
2594 			}
2595 			break;
2596 
2597 		case TCPOPT_SACK:
2598 			if (!tp || tcp_sack_option(tp, th, cp, optlen))
2599 				continue;
2600 			break;
2601 		default:
2602 			continue;
2603 		}
2604 	}
2605 }
2606 
2607 /*
2608  * Pull out of band byte out of a segment so
2609  * it doesn't appear in the user's data queue.
2610  * It is still reflected in the segment length for
2611  * sequencing purposes.
2612  */
2613 static void
2614 tcp_pulloutofband(so, th, m, off)
2615 	struct socket *so;
2616 	struct tcphdr *th;
2617 	register struct mbuf *m;
2618 	int off;		/* delayed to be droped hdrlen */
2619 {
2620 	int cnt = off + th->th_urp - 1;
2621 
2622 	while (cnt >= 0) {
2623 		if (m->m_len > cnt) {
2624 			char *cp = mtod(m, caddr_t) + cnt;
2625 			struct tcpcb *tp = sototcpcb(so);
2626 
2627 			tp->t_iobc = *cp;
2628 			tp->t_oobflags |= TCPOOB_HAVEDATA;
2629 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2630 			m->m_len--;
2631 			if (m->m_flags & M_PKTHDR)
2632 				m->m_pkthdr.len--;
2633 			return;
2634 		}
2635 		cnt -= m->m_len;
2636 		m = m->m_next;
2637 		if (m == 0)
2638 			break;
2639 	}
2640 	panic("tcp_pulloutofband");
2641 }
2642 
2643 /*
2644  * Collect new round-trip time estimate
2645  * and update averages and current timeout.
2646  */
2647 static void
2648 tcp_xmit_timer(tp, rtt)
2649 	register struct tcpcb *tp;
2650 	int rtt;
2651 {
2652 	register int delta;
2653 
2654 	INP_LOCK_ASSERT(tp->t_inpcb);
2655 
2656 	tcpstat.tcps_rttupdated++;
2657 	tp->t_rttupdated++;
2658 	if (tp->t_srtt != 0) {
2659 		/*
2660 		 * srtt is stored as fixed point with 5 bits after the
2661 		 * binary point (i.e., scaled by 8).  The following magic
2662 		 * is equivalent to the smoothing algorithm in rfc793 with
2663 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2664 		 * point).  Adjust rtt to origin 0.
2665 		 */
2666 		delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2667 			- (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2668 
2669 		if ((tp->t_srtt += delta) <= 0)
2670 			tp->t_srtt = 1;
2671 
2672 		/*
2673 		 * We accumulate a smoothed rtt variance (actually, a
2674 		 * smoothed mean difference), then set the retransmit
2675 		 * timer to smoothed rtt + 4 times the smoothed variance.
2676 		 * rttvar is stored as fixed point with 4 bits after the
2677 		 * binary point (scaled by 16).  The following is
2678 		 * equivalent to rfc793 smoothing with an alpha of .75
2679 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
2680 		 * rfc793's wired-in beta.
2681 		 */
2682 		if (delta < 0)
2683 			delta = -delta;
2684 		delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2685 		if ((tp->t_rttvar += delta) <= 0)
2686 			tp->t_rttvar = 1;
2687 		if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar)
2688 		    tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2689 	} else {
2690 		/*
2691 		 * No rtt measurement yet - use the unsmoothed rtt.
2692 		 * Set the variance to half the rtt (so our first
2693 		 * retransmit happens at 3*rtt).
2694 		 */
2695 		tp->t_srtt = rtt << TCP_RTT_SHIFT;
2696 		tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2697 		tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
2698 	}
2699 	tp->t_rtttime = 0;
2700 	tp->t_rxtshift = 0;
2701 
2702 	/*
2703 	 * the retransmit should happen at rtt + 4 * rttvar.
2704 	 * Because of the way we do the smoothing, srtt and rttvar
2705 	 * will each average +1/2 tick of bias.  When we compute
2706 	 * the retransmit timer, we want 1/2 tick of rounding and
2707 	 * 1 extra tick because of +-1/2 tick uncertainty in the
2708 	 * firing of the timer.  The bias will give us exactly the
2709 	 * 1.5 tick we need.  But, because the bias is
2710 	 * statistical, we have to test that we don't drop below
2711 	 * the minimum feasible timer (which is 2 ticks).
2712 	 */
2713 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2714 		      max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2715 
2716 	/*
2717 	 * We received an ack for a packet that wasn't retransmitted;
2718 	 * it is probably safe to discard any error indications we've
2719 	 * received recently.  This isn't quite right, but close enough
2720 	 * for now (a route might have failed after we sent a segment,
2721 	 * and the return path might not be symmetrical).
2722 	 */
2723 	tp->t_softerror = 0;
2724 }
2725 
2726 /*
2727  * Determine a reasonable value for maxseg size.
2728  * If the route is known, check route for mtu.
2729  * If none, use an mss that can be handled on the outgoing
2730  * interface without forcing IP to fragment; if bigger than
2731  * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2732  * to utilize large mbufs.  If no route is found, route has no mtu,
2733  * or the destination isn't local, use a default, hopefully conservative
2734  * size (usually 512 or the default IP max size, but no more than the mtu
2735  * of the interface), as we can't discover anything about intervening
2736  * gateways or networks.  We also initialize the congestion/slow start
2737  * window to be a single segment if the destination isn't local.
2738  * While looking at the routing entry, we also initialize other path-dependent
2739  * parameters from pre-set or cached values in the routing entry.
2740  *
2741  * Also take into account the space needed for options that we
2742  * send regularly.  Make maxseg shorter by that amount to assure
2743  * that we can send maxseg amount of data even when the options
2744  * are present.  Store the upper limit of the length of options plus
2745  * data in maxopd.
2746  *
2747  *
2748  * In case of T/TCP, we call this routine during implicit connection
2749  * setup as well (offer = -1), to initialize maxseg from the cached
2750  * MSS of our peer.
2751  *
2752  * NOTE that this routine is only called when we process an incoming
2753  * segment. Outgoing SYN/ACK MSS settings are handled in tcp_mssopt().
2754  */
2755 void
2756 tcp_mss(tp, offer)
2757 	struct tcpcb *tp;
2758 	int offer;
2759 {
2760 	int rtt, mss;
2761 	u_long bufsize;
2762 	u_long maxmtu;
2763 	struct inpcb *inp = tp->t_inpcb;
2764 	struct socket *so;
2765 	struct hc_metrics_lite metrics;
2766 	int origoffer = offer;
2767 #ifdef INET6
2768 	int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2769 	size_t min_protoh = isipv6 ?
2770 			    sizeof (struct ip6_hdr) + sizeof (struct tcphdr) :
2771 			    sizeof (struct tcpiphdr);
2772 #else
2773 	const size_t min_protoh = sizeof(struct tcpiphdr);
2774 #endif
2775 
2776 	/* initialize */
2777 #ifdef INET6
2778 	if (isipv6) {
2779 		maxmtu = tcp_maxmtu6(&inp->inp_inc);
2780 		tp->t_maxopd = tp->t_maxseg = tcp_v6mssdflt;
2781 	} else
2782 #endif
2783 	{
2784 		maxmtu = tcp_maxmtu(&inp->inp_inc);
2785 		tp->t_maxopd = tp->t_maxseg = tcp_mssdflt;
2786 	}
2787 	so = inp->inp_socket;
2788 
2789 	/*
2790 	 * no route to sender, stay with default mss and return
2791 	 */
2792 	if (maxmtu == 0)
2793 		return;
2794 
2795 	/* what have we got? */
2796 	switch (offer) {
2797 		case 0:
2798 			/*
2799 			 * Offer == 0 means that there was no MSS on the SYN
2800 			 * segment, in this case we use tcp_mssdflt.
2801 			 */
2802 			offer =
2803 #ifdef INET6
2804 				isipv6 ? tcp_v6mssdflt :
2805 #endif
2806 				tcp_mssdflt;
2807 			break;
2808 
2809 		case -1:
2810 			/*
2811 			 * Offer == -1 means that we didn't receive SYN yet.
2812 			 */
2813 			/* FALLTHROUGH */
2814 
2815 		default:
2816 			/*
2817 			 * Prevent DoS attack with too small MSS. Round up
2818 			 * to at least minmss.
2819 			 */
2820 			offer = max(offer, tcp_minmss);
2821 			/*
2822 			 * Sanity check: make sure that maxopd will be large
2823 			 * enough to allow some data on segments even if the
2824 			 * all the option space is used (40bytes).  Otherwise
2825 			 * funny things may happen in tcp_output.
2826 			 */
2827 			offer = max(offer, 64);
2828 	}
2829 
2830 	/*
2831 	 * rmx information is now retrieved from tcp_hostcache
2832 	 */
2833 	tcp_hc_get(&inp->inp_inc, &metrics);
2834 
2835 	/*
2836 	 * if there's a discovered mtu int tcp hostcache, use it
2837 	 * else, use the link mtu.
2838 	 */
2839 	if (metrics.rmx_mtu)
2840 		mss = min(metrics.rmx_mtu, maxmtu) - min_protoh;
2841 	else {
2842 #ifdef INET6
2843 		if (isipv6) {
2844 			mss = maxmtu - min_protoh;
2845 			if (!path_mtu_discovery &&
2846 			    !in6_localaddr(&inp->in6p_faddr))
2847 				mss = min(mss, tcp_v6mssdflt);
2848 		} else
2849 #endif
2850 		{
2851 			mss = maxmtu - min_protoh;
2852 			if (!path_mtu_discovery &&
2853 			    !in_localaddr(inp->inp_faddr))
2854 				mss = min(mss, tcp_mssdflt);
2855 		}
2856 	}
2857 	mss = min(mss, offer);
2858 
2859 	/*
2860 	 * maxopd stores the maximum length of data AND options
2861 	 * in a segment; maxseg is the amount of data in a normal
2862 	 * segment.  We need to store this value (maxopd) apart
2863 	 * from maxseg, because now every segment carries options
2864 	 * and thus we normally have somewhat less data in segments.
2865 	 */
2866 	tp->t_maxopd = mss;
2867 
2868 	/*
2869 	 * origoffer==-1 indicates, that no segments were received yet.
2870 	 * In this case we just guess.
2871 	 */
2872 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2873 	    (origoffer == -1 ||
2874 	     (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
2875 		mss -= TCPOLEN_TSTAMP_APPA;
2876 	tp->t_maxseg = mss;
2877 
2878 #if	(MCLBYTES & (MCLBYTES - 1)) == 0
2879 		if (mss > MCLBYTES)
2880 			mss &= ~(MCLBYTES-1);
2881 #else
2882 		if (mss > MCLBYTES)
2883 			mss = mss / MCLBYTES * MCLBYTES;
2884 #endif
2885 	tp->t_maxseg = mss;
2886 
2887 	/*
2888 	 * If there's a pipesize, change the socket buffer to that size,
2889 	 * don't change if sb_hiwat is different than default (then it
2890 	 * has been changed on purpose with setsockopt).
2891 	 * Make the socket buffers an integral number of mss units;
2892 	 * if the mss is larger than the socket buffer, decrease the mss.
2893 	 */
2894 	SOCKBUF_LOCK(&so->so_snd);
2895 	if ((so->so_snd.sb_hiwat == tcp_sendspace) && metrics.rmx_sendpipe)
2896 		bufsize = metrics.rmx_sendpipe;
2897 	else
2898 		bufsize = so->so_snd.sb_hiwat;
2899 	if (bufsize < mss)
2900 		mss = bufsize;
2901 	else {
2902 		bufsize = roundup(bufsize, mss);
2903 		if (bufsize > sb_max)
2904 			bufsize = sb_max;
2905 		if (bufsize > so->so_snd.sb_hiwat)
2906 			(void)sbreserve_locked(&so->so_snd, bufsize, so, NULL);
2907 	}
2908 	SOCKBUF_UNLOCK(&so->so_snd);
2909 	tp->t_maxseg = mss;
2910 
2911 	SOCKBUF_LOCK(&so->so_rcv);
2912 	if ((so->so_rcv.sb_hiwat == tcp_recvspace) && metrics.rmx_recvpipe)
2913 		bufsize = metrics.rmx_recvpipe;
2914 	else
2915 		bufsize = so->so_rcv.sb_hiwat;
2916 	if (bufsize > mss) {
2917 		bufsize = roundup(bufsize, mss);
2918 		if (bufsize > sb_max)
2919 			bufsize = sb_max;
2920 		if (bufsize > so->so_rcv.sb_hiwat)
2921 			(void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL);
2922 	}
2923 	SOCKBUF_UNLOCK(&so->so_rcv);
2924 	/*
2925 	 * While we're here, check the others too
2926 	 */
2927 	if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) {
2928 		tp->t_srtt = rtt;
2929 		tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE;
2930 		tcpstat.tcps_usedrtt++;
2931 		if (metrics.rmx_rttvar) {
2932 			tp->t_rttvar = metrics.rmx_rttvar;
2933 			tcpstat.tcps_usedrttvar++;
2934 		} else {
2935 			/* default variation is +- 1 rtt */
2936 			tp->t_rttvar =
2937 			    tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
2938 		}
2939 		TCPT_RANGESET(tp->t_rxtcur,
2940 			      ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
2941 			      tp->t_rttmin, TCPTV_REXMTMAX);
2942 	}
2943 	if (metrics.rmx_ssthresh) {
2944 		/*
2945 		 * There's some sort of gateway or interface
2946 		 * buffer limit on the path.  Use this to set
2947 		 * the slow start threshhold, but set the
2948 		 * threshold to no less than 2*mss.
2949 		 */
2950 		tp->snd_ssthresh = max(2 * mss, metrics.rmx_ssthresh);
2951 		tcpstat.tcps_usedssthresh++;
2952 	}
2953 	if (metrics.rmx_bandwidth)
2954 		tp->snd_bandwidth = metrics.rmx_bandwidth;
2955 
2956 	/*
2957 	 * Set the slow-start flight size depending on whether this
2958 	 * is a local network or not.
2959 	 *
2960 	 * Extend this so we cache the cwnd too and retrieve it here.
2961 	 * Make cwnd even bigger than RFC3390 suggests but only if we
2962 	 * have previous experience with the remote host. Be careful
2963 	 * not make cwnd bigger than remote receive window or our own
2964 	 * send socket buffer. Maybe put some additional upper bound
2965 	 * on the retrieved cwnd. Should do incremental updates to
2966 	 * hostcache when cwnd collapses so next connection doesn't
2967 	 * overloads the path again.
2968 	 *
2969 	 * RFC3390 says only do this if SYN or SYN/ACK didn't got lost.
2970 	 * We currently check only in syncache_socket for that.
2971 	 */
2972 #define TCP_METRICS_CWND
2973 #ifdef TCP_METRICS_CWND
2974 	if (metrics.rmx_cwnd)
2975 		tp->snd_cwnd = max(mss,
2976 				min(metrics.rmx_cwnd / 2,
2977 				 min(tp->snd_wnd, so->so_snd.sb_hiwat)));
2978 	else
2979 #endif
2980 	if (tcp_do_rfc3390)
2981 		tp->snd_cwnd = min(4 * mss, max(2 * mss, 4380));
2982 #ifdef INET6
2983 	else if ((isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
2984 		 (!isipv6 && in_localaddr(inp->inp_faddr)))
2985 #else
2986 	else if (in_localaddr(inp->inp_faddr))
2987 #endif
2988 		tp->snd_cwnd = mss * ss_fltsz_local;
2989 	else
2990 		tp->snd_cwnd = mss * ss_fltsz;
2991 }
2992 
2993 /*
2994  * Determine the MSS option to send on an outgoing SYN.
2995  */
2996 int
2997 tcp_mssopt(inc)
2998 	struct in_conninfo *inc;
2999 {
3000 	int mss = 0;
3001 	u_long maxmtu = 0;
3002 	u_long thcmtu = 0;
3003 	size_t min_protoh;
3004 #ifdef INET6
3005 	int isipv6 = inc->inc_isipv6 ? 1 : 0;
3006 #endif
3007 
3008 	KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer"));
3009 
3010 #ifdef INET6
3011 	if (isipv6) {
3012 		mss = tcp_v6mssdflt;
3013 		maxmtu = tcp_maxmtu6(inc);
3014 		thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3015 		min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
3016 	} else
3017 #endif
3018 	{
3019 		mss = tcp_mssdflt;
3020 		maxmtu = tcp_maxmtu(inc);
3021 		thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3022 		min_protoh = sizeof(struct tcpiphdr);
3023 	}
3024 	if (maxmtu && thcmtu)
3025 		mss = min(maxmtu, thcmtu) - min_protoh;
3026 	else if (maxmtu || thcmtu)
3027 		mss = max(maxmtu, thcmtu) - min_protoh;
3028 
3029 	return (mss);
3030 }
3031 
3032 
3033 /*
3034  * On a partial ack arrives, force the retransmission of the
3035  * next unacknowledged segment.  Do not clear tp->t_dupacks.
3036  * By setting snd_nxt to ti_ack, this forces retransmission timer to
3037  * be started again.
3038  */
3039 static void
3040 tcp_newreno_partial_ack(tp, th)
3041 	struct tcpcb *tp;
3042 	struct tcphdr *th;
3043 {
3044 	tcp_seq onxt = tp->snd_nxt;
3045 	u_long  ocwnd = tp->snd_cwnd;
3046 
3047 	callout_stop(tp->tt_rexmt);
3048 	tp->t_rtttime = 0;
3049 	tp->snd_nxt = th->th_ack;
3050 	/*
3051 	 * Set snd_cwnd to one segment beyond acknowledged offset.
3052 	 * (tp->snd_una has not yet been updated when this function is called.)
3053 	 */
3054 	tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
3055 	tp->t_flags |= TF_ACKNOW;
3056 	(void) tcp_output(tp);
3057 	tp->snd_cwnd = ocwnd;
3058 	if (SEQ_GT(onxt, tp->snd_nxt))
3059 		tp->snd_nxt = onxt;
3060 	/*
3061 	 * Partial window deflation.  Relies on fact that tp->snd_una
3062 	 * not updated yet.
3063 	 */
3064 	tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_maxseg);
3065 }
3066 
3067 /*
3068  * Returns 1 if the TIME_WAIT state was killed and we should start over,
3069  * looking for a pcb in the listen state.  Returns 0 otherwise.
3070  */
3071 static int
3072 tcp_timewait(tw, to, th, m, tlen)
3073 	struct tcptw *tw;
3074 	struct tcpopt *to;
3075 	struct tcphdr *th;
3076 	struct mbuf *m;
3077 	int tlen;
3078 {
3079 	int thflags;
3080 	tcp_seq seq;
3081 #ifdef INET6
3082 	int isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
3083 #else
3084 	const int isipv6 = 0;
3085 #endif
3086 
3087 	/* tcbinfo lock required for tcp_twclose(), tcp_2msl_reset. */
3088 	INP_INFO_WLOCK_ASSERT(&tcbinfo);
3089 	INP_LOCK_ASSERT(tw->tw_inpcb);
3090 
3091 	thflags = th->th_flags;
3092 
3093 	/*
3094 	 * NOTE: for FIN_WAIT_2 (to be added later),
3095 	 * must validate sequence number before accepting RST
3096 	 */
3097 
3098 	/*
3099 	 * If the segment contains RST:
3100 	 *	Drop the segment - see Stevens, vol. 2, p. 964 and
3101 	 *      RFC 1337.
3102 	 */
3103 	if (thflags & TH_RST)
3104 		goto drop;
3105 
3106 #if 0
3107 /* PAWS not needed at the moment */
3108 	/*
3109 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
3110 	 * and it's less than ts_recent, drop it.
3111 	 */
3112 	if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
3113 	    TSTMP_LT(to.to_tsval, tp->ts_recent)) {
3114 		if ((thflags & TH_ACK) == 0)
3115 			goto drop;
3116 		goto ack;
3117 	}
3118 	/*
3119 	 * ts_recent is never updated because we never accept new segments.
3120 	 */
3121 #endif
3122 
3123 	/*
3124 	 * If a new connection request is received
3125 	 * while in TIME_WAIT, drop the old connection
3126 	 * and start over if the sequence numbers
3127 	 * are above the previous ones.
3128 	 */
3129 	if ((thflags & TH_SYN) && SEQ_GT(th->th_seq, tw->rcv_nxt)) {
3130 		(void) tcp_twclose(tw, 0);
3131 		return (1);
3132 	}
3133 
3134 	/*
3135 	 * Drop the the segment if it does not contain an ACK.
3136 	 */
3137 	if ((thflags & TH_ACK) == 0)
3138 		goto drop;
3139 
3140 	/*
3141 	 * Reset the 2MSL timer if this is a duplicate FIN.
3142 	 */
3143 	if (thflags & TH_FIN) {
3144 		seq = th->th_seq + tlen + (thflags & TH_SYN ? 1 : 0);
3145 		if (seq + 1 == tw->rcv_nxt)
3146 			tcp_timer_2msl_reset(tw, 2 * tcp_msl);
3147 	}
3148 
3149 	/*
3150 	 * Acknowledge the segment if it has data or is not a duplicate ACK.
3151 	 */
3152 	if (thflags != TH_ACK || tlen != 0 ||
3153 	    th->th_seq != tw->rcv_nxt || th->th_ack != tw->snd_nxt)
3154 		tcp_twrespond(tw, TH_ACK);
3155 	goto drop;
3156 
3157 	/*
3158 	 * Generate a RST, dropping incoming segment.
3159 	 * Make ACK acceptable to originator of segment.
3160 	 * Don't bother to respond if destination was broadcast/multicast.
3161 	 */
3162 	if (m->m_flags & (M_BCAST|M_MCAST))
3163 		goto drop;
3164 	if (isipv6) {
3165 		struct ip6_hdr *ip6;
3166 
3167 		/* IPv6 anycast check is done at tcp6_input() */
3168 		ip6 = mtod(m, struct ip6_hdr *);
3169 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
3170 		    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
3171 			goto drop;
3172 	} else {
3173 		struct ip *ip;
3174 
3175 		ip = mtod(m, struct ip *);
3176 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
3177 		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
3178 		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
3179 		    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
3180 			goto drop;
3181 	}
3182 	if (thflags & TH_ACK) {
3183 		tcp_respond(NULL,
3184 		    mtod(m, void *), th, m, 0, th->th_ack, TH_RST);
3185 	} else {
3186 		seq = th->th_seq + (thflags & TH_SYN ? 1 : 0);
3187 		tcp_respond(NULL,
3188 		    mtod(m, void *), th, m, seq, 0, TH_RST|TH_ACK);
3189 	}
3190 	INP_UNLOCK(tw->tw_inpcb);
3191 	return (0);
3192 
3193 drop:
3194 	INP_UNLOCK(tw->tw_inpcb);
3195 	m_freem(m);
3196 	return (0);
3197 }
3198