xref: /freebsd/sys/netinet/tcp_timer.c (revision b3aaa0cc21c63d388230c7ef2a80abd631ff20d5)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet6.h"
36 #include "opt_tcpdebug.h"
37 
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/mbuf.h>
42 #include <sys/mutex.h>
43 #include <sys/protosw.h>
44 #include <sys/socket.h>
45 #include <sys/socketvar.h>
46 #include <sys/sysctl.h>
47 #include <sys/systm.h>
48 #include <sys/vimage.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_pcb.h>
55 #include <netinet/in_systm.h>
56 #ifdef INET6
57 #include <netinet6/in6_pcb.h>
58 #endif
59 #include <netinet/ip_var.h>
60 #include <netinet/tcp.h>
61 #include <netinet/tcp_fsm.h>
62 #include <netinet/tcp_timer.h>
63 #include <netinet/tcp_var.h>
64 #include <netinet/tcpip.h>
65 #ifdef TCPDEBUG
66 #include <netinet/tcp_debug.h>
67 #endif
68 #include <netinet/vinet.h>
69 
70 int	tcp_keepinit;
71 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINIT, keepinit, CTLTYPE_INT|CTLFLAG_RW,
72     &tcp_keepinit, 0, sysctl_msec_to_ticks, "I", "time to establish connection");
73 
74 int	tcp_keepidle;
75 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPIDLE, keepidle, CTLTYPE_INT|CTLFLAG_RW,
76     &tcp_keepidle, 0, sysctl_msec_to_ticks, "I", "time before keepalive probes begin");
77 
78 int	tcp_keepintvl;
79 SYSCTL_PROC(_net_inet_tcp, TCPCTL_KEEPINTVL, keepintvl, CTLTYPE_INT|CTLFLAG_RW,
80     &tcp_keepintvl, 0, sysctl_msec_to_ticks, "I", "time between keepalive probes");
81 
82 int	tcp_delacktime;
83 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DELACKTIME, delacktime, CTLTYPE_INT|CTLFLAG_RW,
84     &tcp_delacktime, 0, sysctl_msec_to_ticks, "I",
85     "Time before a delayed ACK is sent");
86 
87 int	tcp_msl;
88 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, msl, CTLTYPE_INT|CTLFLAG_RW,
89     &tcp_msl, 0, sysctl_msec_to_ticks, "I", "Maximum segment lifetime");
90 
91 int	tcp_rexmit_min;
92 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_min, CTLTYPE_INT|CTLFLAG_RW,
93     &tcp_rexmit_min, 0, sysctl_msec_to_ticks, "I",
94     "Minimum Retransmission Timeout");
95 
96 int	tcp_rexmit_slop;
97 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmit_slop, CTLTYPE_INT|CTLFLAG_RW,
98     &tcp_rexmit_slop, 0, sysctl_msec_to_ticks, "I",
99     "Retransmission Timer Slop");
100 
101 static int	always_keepalive = 1;
102 SYSCTL_INT(_net_inet_tcp, OID_AUTO, always_keepalive, CTLFLAG_RW,
103     &always_keepalive , 0, "Assume SO_KEEPALIVE on all TCP connections");
104 
105 int    tcp_fast_finwait2_recycle = 0;
106 SYSCTL_INT(_net_inet_tcp, OID_AUTO, fast_finwait2_recycle, CTLFLAG_RW,
107     &tcp_fast_finwait2_recycle, 0,
108     "Recycle closed FIN_WAIT_2 connections faster");
109 
110 int    tcp_finwait2_timeout;
111 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, finwait2_timeout, CTLTYPE_INT|CTLFLAG_RW,
112     &tcp_finwait2_timeout, 0, sysctl_msec_to_ticks, "I", "FIN-WAIT2 timeout");
113 
114 
115 static int	tcp_keepcnt = TCPTV_KEEPCNT;
116 	/* max idle probes */
117 int	tcp_maxpersistidle;
118 	/* max idle time in persist */
119 int	tcp_maxidle;
120 
121 /*
122  * Tcp protocol timeout routine called every 500 ms.
123  * Updates timestamps used for TCP
124  * causes finite state machine actions if timers expire.
125  */
126 void
127 tcp_slowtimo(void)
128 {
129 	VNET_ITERATOR_DECL(vnet_iter);
130 
131 	VNET_LIST_RLOCK();
132 	VNET_FOREACH(vnet_iter) {
133 		CURVNET_SET(vnet_iter);
134 		INIT_VNET_INET(vnet_iter);
135 		tcp_maxidle = tcp_keepcnt * tcp_keepintvl;
136 		INP_INFO_WLOCK(&V_tcbinfo);
137 		(void) tcp_tw_2msl_scan(0);
138 		INP_INFO_WUNLOCK(&V_tcbinfo);
139 		CURVNET_RESTORE();
140 	}
141 	VNET_LIST_RUNLOCK();
142 }
143 
144 int	tcp_syn_backoff[TCP_MAXRXTSHIFT + 1] =
145     { 1, 1, 1, 1, 1, 2, 4, 8, 16, 32, 64, 64, 64 };
146 
147 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
148     { 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 512, 512, 512 };
149 
150 static int tcp_totbackoff = 2559;	/* sum of tcp_backoff[] */
151 
152 static int tcp_timer_race;
153 SYSCTL_INT(_net_inet_tcp, OID_AUTO, timer_race, CTLFLAG_RD, &tcp_timer_race,
154     0, "Count of t_inpcb races on tcp_discardcb");
155 
156 /*
157  * TCP timer processing.
158  */
159 
160 void
161 tcp_timer_delack(void *xtp)
162 {
163 	struct tcpcb *tp = xtp;
164 	struct inpcb *inp;
165 	CURVNET_SET(tp->t_vnet);
166 	INIT_VNET_INET(tp->t_vnet);
167 
168 	INP_INFO_RLOCK(&V_tcbinfo);
169 	inp = tp->t_inpcb;
170 	/*
171 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
172 	 * tear-down mean we need it as a work-around for races between
173 	 * timers and tcp_discardcb().
174 	 *
175 	 * KASSERT(inp != NULL, ("tcp_timer_delack: inp == NULL"));
176 	 */
177 	if (inp == NULL) {
178 		tcp_timer_race++;
179 		INP_INFO_RUNLOCK(&V_tcbinfo);
180 		CURVNET_RESTORE();
181 		return;
182 	}
183 	INP_WLOCK(inp);
184 	INP_INFO_RUNLOCK(&V_tcbinfo);
185 	if ((inp->inp_vflag & INP_DROPPED) || callout_pending(&tp->t_timers->tt_delack)
186 	    || !callout_active(&tp->t_timers->tt_delack)) {
187 		INP_WUNLOCK(inp);
188 		CURVNET_RESTORE();
189 		return;
190 	}
191 	callout_deactivate(&tp->t_timers->tt_delack);
192 
193 	tp->t_flags |= TF_ACKNOW;
194 	V_tcpstat.tcps_delack++;
195 	(void) tcp_output(tp);
196 	INP_WUNLOCK(inp);
197 	CURVNET_RESTORE();
198 }
199 
200 void
201 tcp_timer_2msl(void *xtp)
202 {
203 	struct tcpcb *tp = xtp;
204 	struct inpcb *inp;
205 	CURVNET_SET(tp->t_vnet);
206 	INIT_VNET_INET(tp->t_vnet);
207 #ifdef TCPDEBUG
208 	int ostate;
209 
210 	ostate = tp->t_state;
211 #endif
212 	/*
213 	 * XXXRW: Does this actually happen?
214 	 */
215 	INP_INFO_WLOCK(&V_tcbinfo);
216 	inp = tp->t_inpcb;
217 	/*
218 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
219 	 * tear-down mean we need it as a work-around for races between
220 	 * timers and tcp_discardcb().
221 	 *
222 	 * KASSERT(inp != NULL, ("tcp_timer_2msl: inp == NULL"));
223 	 */
224 	if (inp == NULL) {
225 		tcp_timer_race++;
226 		INP_INFO_WUNLOCK(&V_tcbinfo);
227 		CURVNET_RESTORE();
228 		return;
229 	}
230 	INP_WLOCK(inp);
231 	tcp_free_sackholes(tp);
232 	if ((inp->inp_vflag & INP_DROPPED) || callout_pending(&tp->t_timers->tt_2msl) ||
233 	    !callout_active(&tp->t_timers->tt_2msl)) {
234 		INP_WUNLOCK(tp->t_inpcb);
235 		INP_INFO_WUNLOCK(&V_tcbinfo);
236 		CURVNET_RESTORE();
237 		return;
238 	}
239 	callout_deactivate(&tp->t_timers->tt_2msl);
240 	/*
241 	 * 2 MSL timeout in shutdown went off.  If we're closed but
242 	 * still waiting for peer to close and connection has been idle
243 	 * too long, or if 2MSL time is up from TIME_WAIT, delete connection
244 	 * control block.  Otherwise, check again in a bit.
245 	 *
246 	 * If fastrecycle of FIN_WAIT_2, in FIN_WAIT_2 and receiver has closed,
247 	 * there's no point in hanging onto FIN_WAIT_2 socket. Just close it.
248 	 * Ignore fact that there were recent incoming segments.
249 	 */
250 	if (tcp_fast_finwait2_recycle && tp->t_state == TCPS_FIN_WAIT_2 &&
251 	    tp->t_inpcb && tp->t_inpcb->inp_socket &&
252 	    (tp->t_inpcb->inp_socket->so_rcv.sb_state & SBS_CANTRCVMORE)) {
253 		V_tcpstat.tcps_finwait2_drops++;
254 		tp = tcp_close(tp);
255 	} else {
256 		if (tp->t_state != TCPS_TIME_WAIT &&
257 		   (ticks - tp->t_rcvtime) <= tcp_maxidle)
258 		       callout_reset(&tp->t_timers->tt_2msl, tcp_keepintvl,
259 				     tcp_timer_2msl, tp);
260 	       else
261 		       tp = tcp_close(tp);
262        }
263 
264 #ifdef TCPDEBUG
265 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
266 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
267 			  PRU_SLOWTIMO);
268 #endif
269 	if (tp != NULL)
270 		INP_WUNLOCK(inp);
271 	INP_INFO_WUNLOCK(&V_tcbinfo);
272 	CURVNET_RESTORE();
273 }
274 
275 void
276 tcp_timer_keep(void *xtp)
277 {
278 	struct tcpcb *tp = xtp;
279 	struct tcptemp *t_template;
280 	struct inpcb *inp;
281 	CURVNET_SET(tp->t_vnet);
282 	INIT_VNET_INET(tp->t_vnet);
283 #ifdef TCPDEBUG
284 	int ostate;
285 
286 	ostate = tp->t_state;
287 #endif
288 	INP_INFO_WLOCK(&V_tcbinfo);
289 	inp = tp->t_inpcb;
290 	/*
291 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
292 	 * tear-down mean we need it as a work-around for races between
293 	 * timers and tcp_discardcb().
294 	 *
295 	 * KASSERT(inp != NULL, ("tcp_timer_keep: inp == NULL"));
296 	 */
297 	if (inp == NULL) {
298 		tcp_timer_race++;
299 		INP_INFO_WUNLOCK(&V_tcbinfo);
300 		CURVNET_RESTORE();
301 		return;
302 	}
303 	INP_WLOCK(inp);
304 	if ((inp->inp_vflag & INP_DROPPED) || callout_pending(&tp->t_timers->tt_keep)
305 	    || !callout_active(&tp->t_timers->tt_keep)) {
306 		INP_WUNLOCK(inp);
307 		INP_INFO_WUNLOCK(&V_tcbinfo);
308 		CURVNET_RESTORE();
309 		return;
310 	}
311 	callout_deactivate(&tp->t_timers->tt_keep);
312 	/*
313 	 * Keep-alive timer went off; send something
314 	 * or drop connection if idle for too long.
315 	 */
316 	V_tcpstat.tcps_keeptimeo++;
317 	if (tp->t_state < TCPS_ESTABLISHED)
318 		goto dropit;
319 	if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
320 	    tp->t_state <= TCPS_CLOSING) {
321 		if ((ticks - tp->t_rcvtime) >= tcp_keepidle + tcp_maxidle)
322 			goto dropit;
323 		/*
324 		 * Send a packet designed to force a response
325 		 * if the peer is up and reachable:
326 		 * either an ACK if the connection is still alive,
327 		 * or an RST if the peer has closed the connection
328 		 * due to timeout or reboot.
329 		 * Using sequence number tp->snd_una-1
330 		 * causes the transmitted zero-length segment
331 		 * to lie outside the receive window;
332 		 * by the protocol spec, this requires the
333 		 * correspondent TCP to respond.
334 		 */
335 		V_tcpstat.tcps_keepprobe++;
336 		t_template = tcpip_maketemplate(inp);
337 		if (t_template) {
338 			tcp_respond(tp, t_template->tt_ipgen,
339 				    &t_template->tt_t, (struct mbuf *)NULL,
340 				    tp->rcv_nxt, tp->snd_una - 1, 0);
341 			free(t_template, M_TEMP);
342 		}
343 		callout_reset(&tp->t_timers->tt_keep, tcp_keepintvl, tcp_timer_keep, tp);
344 	} else
345 		callout_reset(&tp->t_timers->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
346 
347 #ifdef TCPDEBUG
348 	if (inp->inp_socket->so_options & SO_DEBUG)
349 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
350 			  PRU_SLOWTIMO);
351 #endif
352 	INP_WUNLOCK(inp);
353 	INP_INFO_WUNLOCK(&V_tcbinfo);
354 	CURVNET_RESTORE();
355 	return;
356 
357 dropit:
358 	V_tcpstat.tcps_keepdrops++;
359 	tp = tcp_drop(tp, ETIMEDOUT);
360 
361 #ifdef TCPDEBUG
362 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
363 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
364 			  PRU_SLOWTIMO);
365 #endif
366 	if (tp != NULL)
367 		INP_WUNLOCK(tp->t_inpcb);
368 	INP_INFO_WUNLOCK(&V_tcbinfo);
369 	CURVNET_RESTORE();
370 }
371 
372 void
373 tcp_timer_persist(void *xtp)
374 {
375 	struct tcpcb *tp = xtp;
376 	struct inpcb *inp;
377 	CURVNET_SET(tp->t_vnet);
378 	INIT_VNET_INET(tp->t_vnet);
379 #ifdef TCPDEBUG
380 	int ostate;
381 
382 	ostate = tp->t_state;
383 #endif
384 	INP_INFO_WLOCK(&V_tcbinfo);
385 	inp = tp->t_inpcb;
386 	/*
387 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
388 	 * tear-down mean we need it as a work-around for races between
389 	 * timers and tcp_discardcb().
390 	 *
391 	 * KASSERT(inp != NULL, ("tcp_timer_persist: inp == NULL"));
392 	 */
393 	if (inp == NULL) {
394 		tcp_timer_race++;
395 		INP_INFO_WUNLOCK(&V_tcbinfo);
396 		CURVNET_RESTORE();
397 		return;
398 	}
399 	INP_WLOCK(inp);
400 	if ((inp->inp_vflag & INP_DROPPED) || callout_pending(&tp->t_timers->tt_persist)
401 	    || !callout_active(&tp->t_timers->tt_persist)) {
402 		INP_WUNLOCK(inp);
403 		INP_INFO_WUNLOCK(&V_tcbinfo);
404 		CURVNET_RESTORE();
405 		return;
406 	}
407 	callout_deactivate(&tp->t_timers->tt_persist);
408 	/*
409 	 * Persistance timer into zero window.
410 	 * Force a byte to be output, if possible.
411 	 */
412 	V_tcpstat.tcps_persisttimeo++;
413 	/*
414 	 * Hack: if the peer is dead/unreachable, we do not
415 	 * time out if the window is closed.  After a full
416 	 * backoff, drop the connection if the idle time
417 	 * (no responses to probes) reaches the maximum
418 	 * backoff that we would use if retransmitting.
419 	 */
420 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
421 	    ((ticks - tp->t_rcvtime) >= tcp_maxpersistidle ||
422 	     (ticks - tp->t_rcvtime) >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
423 		V_tcpstat.tcps_persistdrop++;
424 		tp = tcp_drop(tp, ETIMEDOUT);
425 		goto out;
426 	}
427 	tcp_setpersist(tp);
428 	tp->t_flags |= TF_FORCEDATA;
429 	(void) tcp_output(tp);
430 	tp->t_flags &= ~TF_FORCEDATA;
431 
432 out:
433 #ifdef TCPDEBUG
434 	if (tp != NULL && tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
435 		tcp_trace(TA_USER, ostate, tp, NULL, NULL, PRU_SLOWTIMO);
436 #endif
437 	if (tp != NULL)
438 		INP_WUNLOCK(inp);
439 	INP_INFO_WUNLOCK(&V_tcbinfo);
440 	CURVNET_RESTORE();
441 }
442 
443 void
444 tcp_timer_rexmt(void * xtp)
445 {
446 	struct tcpcb *tp = xtp;
447 	CURVNET_SET(tp->t_vnet);
448 	INIT_VNET_INET(tp->t_vnet);
449 	int rexmt;
450 	int headlocked;
451 	struct inpcb *inp;
452 #ifdef TCPDEBUG
453 	int ostate;
454 
455 	ostate = tp->t_state;
456 #endif
457 	INP_INFO_WLOCK(&V_tcbinfo);
458 	headlocked = 1;
459 	inp = tp->t_inpcb;
460 	/*
461 	 * XXXRW: While this assert is in fact correct, bugs in the tcpcb
462 	 * tear-down mean we need it as a work-around for races between
463 	 * timers and tcp_discardcb().
464 	 *
465 	 * KASSERT(inp != NULL, ("tcp_timer_rexmt: inp == NULL"));
466 	 */
467 	if (inp == NULL) {
468 		tcp_timer_race++;
469 		INP_INFO_WUNLOCK(&V_tcbinfo);
470 		CURVNET_RESTORE();
471 		return;
472 	}
473 	INP_WLOCK(inp);
474 	if ((inp->inp_vflag & INP_DROPPED) || callout_pending(&tp->t_timers->tt_rexmt)
475 	    || !callout_active(&tp->t_timers->tt_rexmt)) {
476 		INP_WUNLOCK(inp);
477 		INP_INFO_WUNLOCK(&V_tcbinfo);
478 		CURVNET_RESTORE();
479 		return;
480 	}
481 	callout_deactivate(&tp->t_timers->tt_rexmt);
482 	tcp_free_sackholes(tp);
483 	/*
484 	 * Retransmission timer went off.  Message has not
485 	 * been acked within retransmit interval.  Back off
486 	 * to a longer retransmit interval and retransmit one segment.
487 	 */
488 	if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) {
489 		tp->t_rxtshift = TCP_MAXRXTSHIFT;
490 		V_tcpstat.tcps_timeoutdrop++;
491 		tp = tcp_drop(tp, tp->t_softerror ?
492 			      tp->t_softerror : ETIMEDOUT);
493 		goto out;
494 	}
495 	INP_INFO_WUNLOCK(&V_tcbinfo);
496 	headlocked = 0;
497 	if (tp->t_rxtshift == 1) {
498 		/*
499 		 * first retransmit; record ssthresh and cwnd so they can
500 		 * be recovered if this turns out to be a "bad" retransmit.
501 		 * A retransmit is considered "bad" if an ACK for this
502 		 * segment is received within RTT/2 interval; the assumption
503 		 * here is that the ACK was already in flight.  See
504 		 * "On Estimating End-to-End Network Path Properties" by
505 		 * Allman and Paxson for more details.
506 		 */
507 		tp->snd_cwnd_prev = tp->snd_cwnd;
508 		tp->snd_ssthresh_prev = tp->snd_ssthresh;
509 		tp->snd_recover_prev = tp->snd_recover;
510 		if (IN_FASTRECOVERY(tp))
511 		  tp->t_flags |= TF_WASFRECOVERY;
512 		else
513 		  tp->t_flags &= ~TF_WASFRECOVERY;
514 		tp->t_badrxtwin = ticks + (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
515 	}
516 	V_tcpstat.tcps_rexmttimeo++;
517 	if (tp->t_state == TCPS_SYN_SENT)
518 		rexmt = TCP_REXMTVAL(tp) * tcp_syn_backoff[tp->t_rxtshift];
519 	else
520 		rexmt = TCP_REXMTVAL(tp) * tcp_backoff[tp->t_rxtshift];
521 	TCPT_RANGESET(tp->t_rxtcur, rexmt,
522 		      tp->t_rttmin, TCPTV_REXMTMAX);
523 	/*
524 	 * Disable rfc1323 if we havn't got any response to
525 	 * our third SYN to work-around some broken terminal servers
526 	 * (most of which have hopefully been retired) that have bad VJ
527 	 * header compression code which trashes TCP segments containing
528 	 * unknown-to-them TCP options.
529 	 */
530 	if ((tp->t_state == TCPS_SYN_SENT) && (tp->t_rxtshift == 3))
531 		tp->t_flags &= ~(TF_REQ_SCALE|TF_REQ_TSTMP);
532 	/*
533 	 * If we backed off this far, our srtt estimate is probably bogus.
534 	 * Clobber it so we'll take the next rtt measurement as our srtt;
535 	 * move the current srtt into rttvar to keep the current
536 	 * retransmit times until then.
537 	 */
538 	if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) {
539 #ifdef INET6
540 		if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0)
541 			in6_losing(tp->t_inpcb);
542 		else
543 #endif
544 		tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT);
545 		tp->t_srtt = 0;
546 	}
547 	tp->snd_nxt = tp->snd_una;
548 	tp->snd_recover = tp->snd_max;
549 	/*
550 	 * Force a segment to be sent.
551 	 */
552 	tp->t_flags |= TF_ACKNOW;
553 	/*
554 	 * If timing a segment in this window, stop the timer.
555 	 */
556 	tp->t_rtttime = 0;
557 	/*
558 	 * Close the congestion window down to one segment
559 	 * (we'll open it by one segment for each ack we get).
560 	 * Since we probably have a window's worth of unacked
561 	 * data accumulated, this "slow start" keeps us from
562 	 * dumping all that data as back-to-back packets (which
563 	 * might overwhelm an intermediate gateway).
564 	 *
565 	 * There are two phases to the opening: Initially we
566 	 * open by one mss on each ack.  This makes the window
567 	 * size increase exponentially with time.  If the
568 	 * window is larger than the path can handle, this
569 	 * exponential growth results in dropped packet(s)
570 	 * almost immediately.  To get more time between
571 	 * drops but still "push" the network to take advantage
572 	 * of improving conditions, we switch from exponential
573 	 * to linear window opening at some threshhold size.
574 	 * For a threshhold, we use half the current window
575 	 * size, truncated to a multiple of the mss.
576 	 *
577 	 * (the minimum cwnd that will give us exponential
578 	 * growth is 2 mss.  We don't allow the threshhold
579 	 * to go below this.)
580 	 */
581 	{
582 		u_int win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg;
583 		if (win < 2)
584 			win = 2;
585 		tp->snd_cwnd = tp->t_maxseg;
586 		tp->snd_ssthresh = win * tp->t_maxseg;
587 		tp->t_dupacks = 0;
588 	}
589 	EXIT_FASTRECOVERY(tp);
590 	tp->t_bytes_acked = 0;
591 	(void) tcp_output(tp);
592 
593 out:
594 #ifdef TCPDEBUG
595 	if (tp != NULL && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
596 		tcp_trace(TA_USER, ostate, tp, (void *)0, (struct tcphdr *)0,
597 			  PRU_SLOWTIMO);
598 #endif
599 	if (tp != NULL)
600 		INP_WUNLOCK(inp);
601 	if (headlocked)
602 		INP_INFO_WUNLOCK(&V_tcbinfo);
603 	CURVNET_RESTORE();
604 }
605 
606 void
607 tcp_timer_activate(struct tcpcb *tp, int timer_type, u_int delta)
608 {
609 	struct callout *t_callout;
610 	void *f_callout;
611 
612 	switch (timer_type) {
613 		case TT_DELACK:
614 			t_callout = &tp->t_timers->tt_delack;
615 			f_callout = tcp_timer_delack;
616 			break;
617 		case TT_REXMT:
618 			t_callout = &tp->t_timers->tt_rexmt;
619 			f_callout = tcp_timer_rexmt;
620 			break;
621 		case TT_PERSIST:
622 			t_callout = &tp->t_timers->tt_persist;
623 			f_callout = tcp_timer_persist;
624 			break;
625 		case TT_KEEP:
626 			t_callout = &tp->t_timers->tt_keep;
627 			f_callout = tcp_timer_keep;
628 			break;
629 		case TT_2MSL:
630 			t_callout = &tp->t_timers->tt_2msl;
631 			f_callout = tcp_timer_2msl;
632 			break;
633 		default:
634 			panic("bad timer_type");
635 		}
636 	if (delta == 0) {
637 		callout_stop(t_callout);
638 	} else {
639 		callout_reset(t_callout, delta, f_callout, tp);
640 	}
641 }
642 
643 int
644 tcp_timer_active(struct tcpcb *tp, int timer_type)
645 {
646 	struct callout *t_callout;
647 
648 	switch (timer_type) {
649 		case TT_DELACK:
650 			t_callout = &tp->t_timers->tt_delack;
651 			break;
652 		case TT_REXMT:
653 			t_callout = &tp->t_timers->tt_rexmt;
654 			break;
655 		case TT_PERSIST:
656 			t_callout = &tp->t_timers->tt_persist;
657 			break;
658 		case TT_KEEP:
659 			t_callout = &tp->t_timers->tt_keep;
660 			break;
661 		case TT_2MSL:
662 			t_callout = &tp->t_timers->tt_2msl;
663 			break;
664 		default:
665 			panic("bad timer_type");
666 		}
667 	return callout_active(t_callout);
668 }
669