]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet/tcp_input.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-517.9.4.tar.gz
[apple/xnu.git] / bsd / netinet / tcp_input.c
1 /*
2 * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * The contents of this file constitute Original Code as defined in and
7 * are subject to the Apple Public Source License Version 1.1 (the
8 * "License"). You may not use this file except in compliance with the
9 * License. Please obtain a copy of the License at
10 * http://www.apple.com/publicsource and read it before using this file.
11 *
12 * This Original Code and all software distributed under the License are
13 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
14 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
15 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
16 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
17 * License for the specific language governing rights and limitations
18 * under the License.
19 *
20 * @APPLE_LICENSE_HEADER_END@
21 */
22 /*
23 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
24 * The Regents of the University of California. All rights reserved.
25 *
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that the following conditions
28 * are met:
29 * 1. Redistributions of source code must retain the above copyright
30 * notice, this list of conditions and the following disclaimer.
31 * 2. Redistributions in binary form must reproduce the above copyright
32 * notice, this list of conditions and the following disclaimer in the
33 * documentation and/or other materials provided with the distribution.
34 * 3. All advertising materials mentioning features or use of this software
35 * must display the following acknowledgement:
36 * This product includes software developed by the University of
37 * California, Berkeley and its contributors.
38 * 4. Neither the name of the University nor the names of its contributors
39 * may be used to endorse or promote products derived from this software
40 * without specific prior written permission.
41 *
42 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
43 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
44 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
45 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
46 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
47 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
48 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
49 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
50 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
51 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
52 * SUCH DAMAGE.
53 *
54 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
55 * $FreeBSD: src/sys/netinet/tcp_input.c,v 1.107.2.16 2001/08/22 00:59:12 silby Exp $
56 */
57
58
59 #include <sys/param.h>
60 #include <sys/systm.h>
61 #include <sys/kernel.h>
62 #include <sys/sysctl.h>
63 #include <sys/malloc.h>
64 #include <sys/mbuf.h>
65 #include <sys/proc.h> /* for proc0 declaration */
66 #include <sys/protosw.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/syslog.h>
70
71 #include <kern/cpu_number.h> /* before tcp_seq.h, for tcp_random18() */
72
73 #include <net/if.h>
74 #include <net/if_types.h>
75 #include <net/route.h>
76
77 #include <netinet/in.h>
78 #include <netinet/in_systm.h>
79 #include <netinet/ip.h>
80 #include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */
81 #include <netinet/in_var.h>
82 #include <netinet/icmp_var.h> /* for ICMP_BANDLIM */
83 #include <netinet/in_pcb.h>
84 #include <netinet/ip_var.h>
85 #if INET6
86 #include <netinet/ip6.h>
87 #include <netinet/icmp6.h>
88 #include <netinet6/nd6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet6/in6_pcb.h>
91 #endif
92 #include <netinet/tcp.h>
93 #include <netinet/tcp_fsm.h>
94 #include <netinet/tcp_seq.h>
95 #include <netinet/tcp_timer.h>
96 #include <netinet/tcp_var.h>
97 #if INET6
98 #include <netinet6/tcp6_var.h>
99 #endif
100 #include <netinet/tcpip.h>
101 #if TCPDEBUG
102 #include <netinet/tcp_debug.h>
103 u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */
104 struct tcphdr tcp_savetcp;
105 #endif /* TCPDEBUG */
106
107 #if IPSEC
108 #include <netinet6/ipsec.h>
109 #if INET6
110 #include <netinet6/ipsec6.h>
111 #endif
112 #include <netkey/key.h>
113 #endif /*IPSEC*/
114
115 #include <sys/kdebug.h>
116
117 #ifndef __APPLE__
118 MALLOC_DEFINE(M_TSEGQ, "tseg_qent", "TCP segment queue entry");
119 #endif
120
121 #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETTCP, 0)
122 #define DBG_LAYER_END NETDBG_CODE(DBG_NETTCP, 2)
123 #define DBG_FNC_TCP_INPUT NETDBG_CODE(DBG_NETTCP, (3 << 8))
124 #define DBG_FNC_TCP_NEWCONN NETDBG_CODE(DBG_NETTCP, (7 << 8))
125
126 static int tcprexmtthresh = 3;
127 tcp_cc tcp_ccgen;
128 extern int apple_hwcksum_rx;
129
130 #if IPSEC
131 extern int ipsec_bypass;
132 #endif
133
134 struct tcpstat tcpstat;
135 SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RD,
136 &tcpstat , tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
137
138 static int log_in_vain = 0;
139 SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
140 &log_in_vain, 0, "Log all incoming TCP connections");
141
142 static int blackhole = 0;
143 SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
144 &blackhole, 0, "Do not send RST when dropping refused connections");
145
146 int tcp_delack_enabled = 1;
147 SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
148 &tcp_delack_enabled, 0,
149 "Delay ACK to try and piggyback it onto a data packet");
150
151 int tcp_lq_overflow = 1;
152 SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcp_lq_overflow, CTLFLAG_RW,
153 &tcp_lq_overflow, 0,
154 "Listen Queue Overflow");
155
156 #if TCP_DROP_SYNFIN
157 static int drop_synfin = 1;
158 SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
159 &drop_synfin, 0, "Drop TCP packets with SYN+FIN set");
160 #endif
161
162 SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0,
163 "TCP Segment Reassembly Queue");
164
165 __private_extern__ int tcp_reass_maxseg = 0;
166 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RW,
167 &tcp_reass_maxseg, 0,
168 "Global maximum number of TCP Segments in Reassembly Queue");
169
170 __private_extern__ int tcp_reass_qsize = 0;
171 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, cursegments, CTLFLAG_RD,
172 &tcp_reass_qsize, 0,
173 "Global number of TCP Segments currently in Reassembly Queue");
174
175 static int tcp_reass_overflows = 0;
176 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, CTLFLAG_RD,
177 &tcp_reass_overflows, 0,
178 "Global number of TCP Segment Reassembly Queue Overflows");
179
180
181 __private_extern__ int slowlink_wsize = 8192;
182 SYSCTL_INT(_net_inet_tcp, OID_AUTO, slowlink_wsize, CTLFLAG_RW,
183 &slowlink_wsize, 0, "Maximum advertised window size for slowlink");
184
185
186 u_long tcp_now;
187 struct inpcbhead tcb;
188 #define tcb6 tcb /* for KAME src sync over BSD*'s */
189 struct inpcbinfo tcbinfo;
190
191 static void tcp_dooptions __P((struct tcpcb *,
192 u_char *, int, struct tcphdr *, struct tcpopt *));
193 static void tcp_pulloutofband __P((struct socket *,
194 struct tcphdr *, struct mbuf *, int));
195 static int tcp_reass __P((struct tcpcb *, struct tcphdr *, int *,
196 struct mbuf *));
197 static void tcp_xmit_timer __P((struct tcpcb *, int));
198 static int tcp_newreno __P((struct tcpcb *, struct tcphdr *));
199
200 /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
201 #if INET6
202 #define ND6_HINT(tp) \
203 do { \
204 if ((tp) && (tp)->t_inpcb && \
205 ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0 && \
206 (tp)->t_inpcb->in6p_route.ro_rt) \
207 nd6_nud_hint((tp)->t_inpcb->in6p_route.ro_rt, NULL, 0); \
208 } while (0)
209 #else
210 #define ND6_HINT(tp)
211 #endif
212
213 extern u_long *delack_bitmask;
214
215 /*
216 * Indicate whether this ack should be delayed. We can delay the ack if
217 * - delayed acks are enabled and
218 * - there is no delayed ack timer in progress and
219 * - our last ack wasn't a 0-sized window. We never want to delay
220 * the ack that opens up a 0-sized window.
221 */
222 #define DELAY_ACK(tp) \
223 (tcp_delack_enabled && !callout_pending(tp->tt_delack) && \
224 (tp->t_flags & TF_RXWIN0SENT) == 0)
225
226
227 static int
228 tcp_reass(tp, th, tlenp, m)
229 register struct tcpcb *tp;
230 register struct tcphdr *th;
231 int *tlenp;
232 struct mbuf *m;
233 {
234 struct tseg_qent *q;
235 struct tseg_qent *p = NULL;
236 struct tseg_qent *nq;
237 struct tseg_qent *te;
238 struct socket *so = tp->t_inpcb->inp_socket;
239 int flags;
240
241 /*
242 * Call with th==0 after become established to
243 * force pre-ESTABLISHED data up to user socket.
244 */
245 if (th == 0)
246 goto present;
247
248 /*
249 * Limit the number of segments in the reassembly queue to prevent
250 * holding on to too many segments (and thus running out of mbufs).
251 * Make sure to let the missing segment through which caused this
252 * queue. Always keep one global queue entry spare to be able to
253 * process the missing segment.
254 */
255 if (th->th_seq != tp->rcv_nxt &&
256 tcp_reass_qsize + 1 >= tcp_reass_maxseg) {
257 tcp_reass_overflows++;
258 tcpstat.tcps_rcvmemdrop++;
259 m_freem(m);
260 return (0);
261 }
262
263 /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */
264 MALLOC(te, struct tseg_qent *, sizeof (struct tseg_qent), M_TSEGQ,
265 M_NOWAIT);
266 if (te == NULL) {
267 tcpstat.tcps_rcvmemdrop++;
268 m_freem(m);
269 return (0);
270 }
271 tcp_reass_qsize++;
272
273 /*
274 * Find a segment which begins after this one does.
275 */
276 LIST_FOREACH(q, &tp->t_segq, tqe_q) {
277 if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
278 break;
279 p = q;
280 }
281
282 /*
283 * If there is a preceding segment, it may provide some of
284 * our data already. If so, drop the data from the incoming
285 * segment. If it provides all of our data, drop us.
286 */
287 if (p != NULL) {
288 register int i;
289 /* conversion to int (in i) handles seq wraparound */
290 i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
291 if (i > 0) {
292 if (i >= *tlenp) {
293 tcpstat.tcps_rcvduppack++;
294 tcpstat.tcps_rcvdupbyte += *tlenp;
295 m_freem(m);
296 FREE(te, M_TSEGQ);
297 tcp_reass_qsize--;
298 /*
299 * Try to present any queued data
300 * at the left window edge to the user.
301 * This is needed after the 3-WHS
302 * completes.
303 */
304 goto present; /* ??? */
305 }
306 m_adj(m, i);
307 *tlenp -= i;
308 th->th_seq += i;
309 }
310 }
311 tcpstat.tcps_rcvoopack++;
312 tcpstat.tcps_rcvoobyte += *tlenp;
313
314 /*
315 * While we overlap succeeding segments trim them or,
316 * if they are completely covered, dequeue them.
317 */
318 while (q) {
319 register int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
320 if (i <= 0)
321 break;
322 if (i < q->tqe_len) {
323 q->tqe_th->th_seq += i;
324 q->tqe_len -= i;
325 m_adj(q->tqe_m, i);
326 break;
327 }
328
329 nq = LIST_NEXT(q, tqe_q);
330 LIST_REMOVE(q, tqe_q);
331 m_freem(q->tqe_m);
332 FREE(q, M_TSEGQ);
333 tcp_reass_qsize--;
334 q = nq;
335 }
336
337 /* Insert the new segment queue entry into place. */
338 te->tqe_m = m;
339 te->tqe_th = th;
340 te->tqe_len = *tlenp;
341
342 if (p == NULL) {
343 LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
344 } else {
345 LIST_INSERT_AFTER(p, te, tqe_q);
346 }
347
348 present:
349 /*
350 * Present data to user, advancing rcv_nxt through
351 * completed sequence space.
352 */
353 if (!TCPS_HAVEESTABLISHED(tp->t_state))
354 return (0);
355 q = LIST_FIRST(&tp->t_segq);
356 if (!q || q->tqe_th->th_seq != tp->rcv_nxt)
357 return (0);
358 do {
359 tp->rcv_nxt += q->tqe_len;
360 flags = q->tqe_th->th_flags & TH_FIN;
361 nq = LIST_NEXT(q, tqe_q);
362 LIST_REMOVE(q, tqe_q);
363 if (so->so_state & SS_CANTRCVMORE)
364 m_freem(q->tqe_m);
365 else
366 sbappend(&so->so_rcv, q->tqe_m);
367 FREE(q, M_TSEGQ);
368 tcp_reass_qsize--;
369 q = nq;
370 } while (q && q->tqe_th->th_seq == tp->rcv_nxt);
371 ND6_HINT(tp);
372
373 #if INET6
374 if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
375
376 KERNEL_DEBUG(DBG_LAYER_BEG,
377 ((tp->t_inpcb->inp_fport << 16) | tp->t_inpcb->inp_lport),
378 (((tp->t_inpcb->in6p_laddr.s6_addr16[0] & 0xffff) << 16) |
379 (tp->t_inpcb->in6p_faddr.s6_addr16[0] & 0xffff)),
380 0,0,0);
381 }
382 else
383 #endif
384 {
385 KERNEL_DEBUG(DBG_LAYER_BEG,
386 ((tp->t_inpcb->inp_fport << 16) | tp->t_inpcb->inp_lport),
387 (((tp->t_inpcb->inp_laddr.s_addr & 0xffff) << 16) |
388 (tp->t_inpcb->inp_faddr.s_addr & 0xffff)),
389 0,0,0);
390 }
391 sorwakeup(so);
392 return (flags);
393
394 }
395
396
397 /*
398 * TCP input routine, follows pages 65-76 of the
399 * protocol specification dated September, 1981 very closely.
400 */
401 #if INET6
402 int
403 tcp6_input(mp, offp)
404 struct mbuf **mp;
405 int *offp;
406 {
407 register struct mbuf *m = *mp;
408 struct in6_ifaddr *ia6;
409
410 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
411
412 /*
413 * draft-itojun-ipv6-tcp-to-anycast
414 * better place to put this in?
415 */
416 ia6 = ip6_getdstifaddr(m);
417 if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
418 struct ip6_hdr *ip6;
419
420 ip6 = mtod(m, struct ip6_hdr *);
421 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
422 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
423 return IPPROTO_DONE;
424 }
425
426 tcp_input(m, *offp);
427 return IPPROTO_DONE;
428 }
429 #endif
430
431 void
432 tcp_input(m, off0)
433 struct mbuf *m;
434 int off0;
435 {
436 register struct tcphdr *th;
437 register struct ip *ip = NULL;
438 register struct ipovly *ipov;
439 register struct inpcb *inp;
440 u_char *optp = NULL;
441 int optlen = 0;
442 int len, tlen, off;
443 int drop_hdrlen;
444 register struct tcpcb *tp = 0;
445 register int thflags;
446 struct socket *so = 0;
447 int todrop, acked, ourfinisacked, needoutput = 0;
448 struct in_addr laddr;
449 #if INET6
450 struct in6_addr laddr6;
451 #endif
452 int dropsocket = 0;
453 int iss = 0;
454 u_long tiwin;
455 struct tcpopt to; /* options in this segment */
456 struct rmxp_tao *taop; /* pointer to our TAO cache entry */
457 struct rmxp_tao tao_noncached; /* in case there's no cached entry */
458 #if TCPDEBUG
459 short ostate = 0;
460 #endif
461 #if INET6
462 struct ip6_hdr *ip6 = NULL;
463 int isipv6;
464 #endif /* INET6 */
465 int rstreason; /* For badport_bandlim accounting purposes */
466 struct proc *proc0=current_proc();
467
468 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_START,0,0,0,0,0);
469
470 #if INET6
471 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
472 #endif
473 bzero((char *)&to, sizeof(to));
474
475 tcpstat.tcps_rcvtotal++;
476
477
478
479 #if INET6
480 if (isipv6) {
481 /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */
482 ip6 = mtod(m, struct ip6_hdr *);
483 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
484 if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) {
485 tcpstat.tcps_rcvbadsum++;
486 goto drop;
487 }
488 th = (struct tcphdr *)((caddr_t)ip6 + off0);
489
490 KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport),
491 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
492 th->th_seq, th->th_ack, th->th_win);
493 /*
494 * Be proactive about unspecified IPv6 address in source.
495 * As we use all-zero to indicate unbounded/unconnected pcb,
496 * unspecified IPv6 address can be used to confuse us.
497 *
498 * Note that packets with unspecified IPv6 destination is
499 * already dropped in ip6_input.
500 */
501 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
502 /* XXX stat */
503 goto drop;
504 }
505 } else
506 #endif /* INET6 */
507 {
508 /*
509 * Get IP and TCP header together in first mbuf.
510 * Note: IP leaves IP header in first mbuf.
511 */
512 if (off0 > sizeof (struct ip)) {
513 ip_stripoptions(m, (struct mbuf *)0);
514 off0 = sizeof(struct ip);
515 if (m->m_pkthdr.csum_flags & CSUM_TCP_SUM16)
516 m->m_pkthdr.csum_flags = 0; /* invalidate hwcksuming */
517
518 }
519 if (m->m_len < sizeof (struct tcpiphdr)) {
520 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
521 tcpstat.tcps_rcvshort++;
522 return;
523 }
524 }
525 ip = mtod(m, struct ip *);
526 ipov = (struct ipovly *)ip;
527 th = (struct tcphdr *)((caddr_t)ip + off0);
528 tlen = ip->ip_len;
529
530 KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport),
531 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
532 th->th_seq, th->th_ack, th->th_win);
533
534 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
535 if (apple_hwcksum_rx && (m->m_pkthdr.csum_flags & CSUM_TCP_SUM16)) {
536 u_short pseudo;
537 char b[9];
538 *(uint32_t*)&b[0] = *(uint32_t*)&ipov->ih_x1[0];
539 *(uint32_t*)&b[4] = *(uint32_t*)&ipov->ih_x1[4];
540 *(uint8_t*)&b[8] = *(uint8_t*)&ipov->ih_x1[8];
541
542 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
543 ipov->ih_len = (u_short)tlen;
544 HTONS(ipov->ih_len);
545 pseudo = in_cksum(m, sizeof (struct ip));
546
547 *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];
548 *(uint32_t*)&ipov->ih_x1[4] = *(uint32_t*)&b[4];
549 *(uint8_t*)&ipov->ih_x1[8] = *(uint8_t*)&b[8];
550
551 th->th_sum = in_addword(pseudo, (m->m_pkthdr.csum_data & 0xFFFF));
552 } else {
553 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
554 th->th_sum = m->m_pkthdr.csum_data;
555 else
556 th->th_sum = in_pseudo(ip->ip_src.s_addr,
557 ip->ip_dst.s_addr, htonl(m->m_pkthdr.csum_data +
558 ip->ip_len + IPPROTO_TCP));
559 }
560 th->th_sum ^= 0xffff;
561 } else {
562 char b[9];
563 /*
564 * Checksum extended TCP header and data.
565 */
566 *(uint32_t*)&b[0] = *(uint32_t*)&ipov->ih_x1[0];
567 *(uint32_t*)&b[4] = *(uint32_t*)&ipov->ih_x1[4];
568 *(uint8_t*)&b[8] = *(uint8_t*)&ipov->ih_x1[8];
569
570 len = sizeof (struct ip) + tlen;
571 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
572 ipov->ih_len = (u_short)tlen;
573 HTONS(ipov->ih_len);
574 th->th_sum = in_cksum(m, len);
575
576 *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];
577 *(uint32_t*)&ipov->ih_x1[4] = *(uint32_t*)&b[4];
578 *(uint8_t*)&ipov->ih_x1[8] = *(uint8_t*)&b[8];
579 }
580 if (th->th_sum) {
581 tcpstat.tcps_rcvbadsum++;
582 goto drop;
583 }
584 #if INET6
585 /* Re-initialization for later version check */
586 ip->ip_v = IPVERSION;
587 #endif
588 }
589
590 /*
591 * Check that TCP offset makes sense,
592 * pull out TCP options and adjust length. XXX
593 */
594 off = th->th_off << 2;
595 if (off < sizeof (struct tcphdr) || off > tlen) {
596 tcpstat.tcps_rcvbadoff++;
597 goto drop;
598 }
599 tlen -= off; /* tlen is used instead of ti->ti_len */
600 if (off > sizeof (struct tcphdr)) {
601 #if INET6
602 if (isipv6) {
603 IP6_EXTHDR_CHECK(m, off0, off, );
604 ip6 = mtod(m, struct ip6_hdr *);
605 th = (struct tcphdr *)((caddr_t)ip6 + off0);
606 } else
607 #endif /* INET6 */
608 {
609 if (m->m_len < sizeof(struct ip) + off) {
610 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
611 tcpstat.tcps_rcvshort++;
612 return;
613 }
614 ip = mtod(m, struct ip *);
615 ipov = (struct ipovly *)ip;
616 th = (struct tcphdr *)((caddr_t)ip + off0);
617 }
618 }
619 optlen = off - sizeof (struct tcphdr);
620 optp = (u_char *)(th + 1);
621 /*
622 * Do quick retrieval of timestamp options ("options
623 * prediction?"). If timestamp is the only option and it's
624 * formatted as recommended in RFC 1323 appendix A, we
625 * quickly get the values now and not bother calling
626 * tcp_dooptions(), etc.
627 */
628 if ((optlen == TCPOLEN_TSTAMP_APPA ||
629 (optlen > TCPOLEN_TSTAMP_APPA &&
630 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
631 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
632 (th->th_flags & TH_SYN) == 0) {
633 to.to_flag |= TOF_TS;
634 to.to_tsval = ntohl(*(u_int32_t *)(optp + 4));
635 to.to_tsecr = ntohl(*(u_int32_t *)(optp + 8));
636 optp = NULL; /* we've parsed the options */
637 }
638 }
639 thflags = th->th_flags;
640
641 #if TCP_DROP_SYNFIN
642 /*
643 * If the drop_synfin option is enabled, drop all packets with
644 * both the SYN and FIN bits set. This prevents e.g. nmap from
645 * identifying the TCP/IP stack.
646 *
647 * This is incompatible with RFC1644 extensions (T/TCP).
648 */
649 if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN))
650 goto drop;
651 #endif
652
653 /*
654 * Convert TCP protocol specific fields to host format.
655 */
656 NTOHL(th->th_seq);
657 NTOHL(th->th_ack);
658 NTOHS(th->th_win);
659 NTOHS(th->th_urp);
660
661 /*
662 * Delay droping TCP, IP headers, IPv6 ext headers, and TCP options,
663 * until after ip6_savecontrol() is called and before other functions
664 * which don't want those proto headers.
665 * Because ip6_savecontrol() is going to parse the mbuf to
666 * search for data to be passed up to user-land, it wants mbuf
667 * parameters to be unchanged.
668 */
669 drop_hdrlen = off0 + off;
670
671 /*
672 * Locate pcb for segment.
673 */
674 findpcb:
675 #if IPFIREWALL_FORWARD
676 if (ip_fw_fwd_addr != NULL
677 #if INET6
678 && isipv6 == NULL /* IPv6 support is not yet */
679 #endif /* INET6 */
680 ) {
681 /*
682 * Diverted. Pretend to be the destination.
683 * already got one like this?
684 */
685 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
686 ip->ip_dst, th->th_dport, 0, m->m_pkthdr.rcvif);
687 if (!inp) {
688 /*
689 * No, then it's new. Try find the ambushing socket
690 */
691 if (!ip_fw_fwd_addr->sin_port) {
692 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src,
693 th->th_sport, ip_fw_fwd_addr->sin_addr,
694 th->th_dport, 1, m->m_pkthdr.rcvif);
695 } else {
696 inp = in_pcblookup_hash(&tcbinfo,
697 ip->ip_src, th->th_sport,
698 ip_fw_fwd_addr->sin_addr,
699 ntohs(ip_fw_fwd_addr->sin_port), 1,
700 m->m_pkthdr.rcvif);
701 }
702 }
703 ip_fw_fwd_addr = NULL;
704 } else
705 #endif /* IPFIREWALL_FORWARD */
706 {
707 #if INET6
708 if (isipv6)
709 inp = in6_pcblookup_hash(&tcbinfo, &ip6->ip6_src, th->th_sport,
710 &ip6->ip6_dst, th->th_dport, 1,
711 m->m_pkthdr.rcvif);
712 else
713 #endif /* INET6 */
714 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
715 ip->ip_dst, th->th_dport, 1, m->m_pkthdr.rcvif);
716 }
717
718 #if IPSEC
719 #if INET6
720 if (isipv6) {
721 if (ipsec_bypass == 0 && inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
722 ipsec6stat.in_polvio++;
723 goto drop;
724 }
725 } else
726 #endif /* INET6 */
727 if (ipsec_bypass == 0 && inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
728 ipsecstat.in_polvio++;
729 goto drop;
730 }
731 #endif /*IPSEC*/
732
733 /*
734 * If the state is CLOSED (i.e., TCB does not exist) then
735 * all data in the incoming segment is discarded.
736 * If the TCB exists but is in CLOSED state, it is embryonic,
737 * but should either do a listen or a connect soon.
738 */
739 if (inp == NULL) {
740 if (log_in_vain) {
741 #if INET6
742 char dbuf[INET6_ADDRSTRLEN], sbuf[INET6_ADDRSTRLEN];
743 #else /* INET6 */
744 char dbuf[4*sizeof "123"], sbuf[4*sizeof "123"];
745 #endif /* INET6 */
746
747 #if INET6
748 if (isipv6) {
749 strcpy(dbuf, ip6_sprintf(&ip6->ip6_dst));
750 strcpy(sbuf, ip6_sprintf(&ip6->ip6_src));
751 } else
752 #endif
753 {
754 strcpy(dbuf, inet_ntoa(ip->ip_dst));
755 strcpy(sbuf, inet_ntoa(ip->ip_src));
756 }
757 switch (log_in_vain) {
758 case 1:
759 if(thflags & TH_SYN)
760 log(LOG_INFO,
761 "Connection attempt to TCP %s:%d from %s:%d\n",
762 dbuf, ntohs(th->th_dport),
763 sbuf,
764 ntohs(th->th_sport));
765 break;
766 case 2:
767 log(LOG_INFO,
768 "Connection attempt to TCP %s:%d from %s:%d flags:0x%x\n",
769 dbuf, ntohs(th->th_dport), sbuf,
770 ntohs(th->th_sport), thflags);
771 break;
772 default:
773 break;
774 }
775 }
776 if (blackhole) {
777 switch (blackhole) {
778 case 1:
779 if (thflags & TH_SYN)
780 goto drop;
781 break;
782 case 2:
783 goto drop;
784 default:
785 goto drop;
786 }
787 }
788 rstreason = BANDLIM_RST_CLOSEDPORT;
789 goto dropwithreset;
790 }
791 tp = intotcpcb(inp);
792 if (tp == 0) {
793 rstreason = BANDLIM_RST_CLOSEDPORT;
794 goto dropwithreset;
795 }
796 if (tp->t_state == TCPS_CLOSED)
797 goto drop;
798
799 #ifdef __APPLE__
800 /*
801 * Bogus state when listening port owned by SharedIP with loopback as the
802 * only configured interface: BlueBox does not filters loopback
803 */
804 if (tp->t_state == TCP_NSTATES)
805 goto drop;
806 #endif
807
808 /* Unscale the window into a 32-bit value. */
809 if ((thflags & TH_SYN) == 0)
810 tiwin = th->th_win << tp->snd_scale;
811 else
812 tiwin = th->th_win;
813
814 so = inp->inp_socket;
815 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
816 #if TCPDEBUG
817 if (so->so_options & SO_DEBUG) {
818 ostate = tp->t_state;
819 #if INET6
820 if (isipv6)
821 bcopy((char *)ip6, (char *)tcp_saveipgen,
822 sizeof(*ip6));
823 else
824 #endif /* INET6 */
825 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
826 tcp_savetcp = *th;
827 }
828 #endif
829 if (so->so_options & SO_ACCEPTCONN) {
830 register struct tcpcb *tp0 = tp;
831 struct socket *so2;
832 #if IPSEC
833 struct socket *oso;
834 #endif
835 #if INET6
836 struct inpcb *oinp = sotoinpcb(so);
837 #endif /* INET6 */
838 int ogencnt = so->so_gencnt;
839
840 #if !IPSEC
841 /*
842 * Current IPsec implementation makes incorrect IPsec
843 * cache if this check is done here.
844 * So delay this until duplicated socket is created.
845 */
846 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
847 /*
848 * Note: dropwithreset makes sure we don't
849 * send a RST in response to a RST.
850 */
851 if (thflags & TH_ACK) {
852 tcpstat.tcps_badsyn++;
853 rstreason = BANDLIM_RST_OPENPORT;
854 goto dropwithreset;
855 }
856 goto drop;
857 }
858 #endif
859 KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_START,0,0,0,0,0);
860
861 #if INET6
862 /*
863 * If deprecated address is forbidden,
864 * we do not accept SYN to deprecated interface
865 * address to prevent any new inbound connection from
866 * getting established.
867 * When we do not accept SYN, we send a TCP RST,
868 * with deprecated source address (instead of dropping
869 * it). We compromise it as it is much better for peer
870 * to send a RST, and RST will be the final packet
871 * for the exchange.
872 *
873 * If we do not forbid deprecated addresses, we accept
874 * the SYN packet. RFC2462 does not suggest dropping
875 * SYN in this case.
876 * If we decipher RFC2462 5.5.4, it says like this:
877 * 1. use of deprecated addr with existing
878 * communication is okay - "SHOULD continue to be
879 * used"
880 * 2. use of it with new communication:
881 * (2a) "SHOULD NOT be used if alternate address
882 * with sufficient scope is available"
883 * (2b) nothing mentioned otherwise.
884 * Here we fall into (2b) case as we have no choice in
885 * our source address selection - we must obey the peer.
886 *
887 * The wording in RFC2462 is confusing, and there are
888 * multiple description text for deprecated address
889 * handling - worse, they are not exactly the same.
890 * I believe 5.5.4 is the best one, so we follow 5.5.4.
891 */
892 if (isipv6 && !ip6_use_deprecated) {
893 struct in6_ifaddr *ia6;
894
895 if ((ia6 = ip6_getdstifaddr(m)) &&
896 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
897 tp = NULL;
898 rstreason = BANDLIM_RST_OPENPORT;
899 goto dropwithreset;
900 }
901 }
902 #endif
903
904 so2 = sonewconn(so, 0);
905 if (so2 == 0) {
906 tcpstat.tcps_listendrop++;
907 so2 = sodropablereq(so);
908 if (so2) {
909 if (tcp_lq_overflow)
910 sototcpcb(so2)->t_flags |=
911 TF_LQ_OVERFLOW;
912 tcp_drop(sototcpcb(so2), ETIMEDOUT);
913 so2 = sonewconn(so, 0);
914 }
915 if (!so2)
916 goto drop;
917 }
918 /*
919 * Make sure listening socket did not get closed during socket allocation,
920 * not only this is incorrect but it is know to cause panic
921 */
922 if (so->so_gencnt != ogencnt)
923 goto drop;
924 #if IPSEC
925 oso = so;
926 #endif
927 so = so2;
928 /*
929 * This is ugly, but ....
930 *
931 * Mark socket as temporary until we're
932 * committed to keeping it. The code at
933 * ``drop'' and ``dropwithreset'' check the
934 * flag dropsocket to see if the temporary
935 * socket created here should be discarded.
936 * We mark the socket as discardable until
937 * we're committed to it below in TCPS_LISTEN.
938 */
939 dropsocket++;
940 inp = (struct inpcb *)so->so_pcb;
941 #if INET6
942 if (isipv6)
943 inp->in6p_laddr = ip6->ip6_dst;
944 else {
945 inp->inp_vflag &= ~INP_IPV6;
946 inp->inp_vflag |= INP_IPV4;
947 #endif /* INET6 */
948 inp->inp_laddr = ip->ip_dst;
949 #if INET6
950 }
951 #endif /* INET6 */
952 inp->inp_lport = th->th_dport;
953 if (in_pcbinshash(inp) != 0) {
954 /*
955 * Undo the assignments above if we failed to
956 * put the PCB on the hash lists.
957 */
958 #if INET6
959 if (isipv6)
960 inp->in6p_laddr = in6addr_any;
961 else
962 #endif /* INET6 */
963 inp->inp_laddr.s_addr = INADDR_ANY;
964 inp->inp_lport = 0;
965 goto drop;
966 }
967 #if IPSEC
968 /*
969 * To avoid creating incorrectly cached IPsec
970 * association, this is need to be done here.
971 *
972 * Subject: (KAME-snap 748)
973 * From: Wayne Knowles <w.knowles@niwa.cri.nz>
974 * ftp://ftp.kame.net/pub/mail-list/snap-users/748
975 */
976 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
977 /*
978 * Note: dropwithreset makes sure we don't
979 * send a RST in response to a RST.
980 */
981 if (thflags & TH_ACK) {
982 tcpstat.tcps_badsyn++;
983 rstreason = BANDLIM_RST_OPENPORT;
984 goto dropwithreset;
985 }
986 goto drop;
987 }
988 #endif
989 #if INET6
990 if (isipv6) {
991 /*
992 * Inherit socket options from the listening
993 * socket.
994 * Note that in6p_inputopts are not (even
995 * should not be) copied, since it stores
996 * previously received options and is used to
997 * detect if each new option is different than
998 * the previous one and hence should be passed
999 * to a user.
1000 * If we copied in6p_inputopts, a user would
1001 * not be able to receive options just after
1002 * calling the accept system call.
1003 */
1004 inp->inp_flags |=
1005 oinp->inp_flags & INP_CONTROLOPTS;
1006 if (oinp->in6p_outputopts)
1007 inp->in6p_outputopts =
1008 ip6_copypktopts(oinp->in6p_outputopts,
1009 M_NOWAIT);
1010 } else
1011 #endif /* INET6 */
1012 inp->inp_options = ip_srcroute();
1013 #if IPSEC
1014 /* copy old policy into new socket's */
1015 if (sotoinpcb(oso)->inp_sp)
1016 {
1017 int error = 0;
1018 /* Is it a security hole here to silently fail to copy the policy? */
1019 if (inp->inp_sp != NULL)
1020 error = ipsec_init_policy(so, &inp->inp_sp);
1021 if (error != 0 || ipsec_copy_policy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
1022 printf("tcp_input: could not copy policy\n");
1023 }
1024 #endif
1025 tp = intotcpcb(inp);
1026 tp->t_state = TCPS_LISTEN;
1027 tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT|TF_NODELAY);
1028
1029 /* Compute proper scaling value from buffer space */
1030 while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1031 TCP_MAXWIN << tp->request_r_scale <
1032 so->so_rcv.sb_hiwat)
1033 tp->request_r_scale++;
1034
1035 KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_END,0,0,0,0,0);
1036 }
1037 }
1038
1039 /*
1040 * Segment received on connection.
1041 * Reset idle time and keep-alive timer.
1042 */
1043 tp->t_rcvtime = 0;
1044 if (TCPS_HAVEESTABLISHED(tp->t_state))
1045 tp->t_timer[TCPT_KEEP] = TCP_KEEPIDLE(tp);
1046
1047 /*
1048 * Process options if not in LISTEN state,
1049 * else do it below (after getting remote address).
1050 */
1051 if (tp->t_state != TCPS_LISTEN && optp)
1052 tcp_dooptions(tp, optp, optlen, th, &to);
1053
1054 /*
1055 * Header prediction: check for the two common cases
1056 * of a uni-directional data xfer. If the packet has
1057 * no control flags, is in-sequence, the window didn't
1058 * change and we're not retransmitting, it's a
1059 * candidate. If the length is zero and the ack moved
1060 * forward, we're the sender side of the xfer. Just
1061 * free the data acked & wake any higher level process
1062 * that was blocked waiting for space. If the length
1063 * is non-zero and the ack didn't move, we're the
1064 * receiver side. If we're getting packets in-order
1065 * (the reassembly queue is empty), add the data to
1066 * the socket buffer and note that we need a delayed ack.
1067 * Make sure that the hidden state-flags are also off.
1068 * Since we check for TCPS_ESTABLISHED above, it can only
1069 * be TH_NEEDSYN.
1070 */
1071 if (tp->t_state == TCPS_ESTABLISHED &&
1072 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1073 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1074 ((to.to_flag & TOF_TS) == 0 ||
1075 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
1076 /*
1077 * Using the CC option is compulsory if once started:
1078 * the segment is OK if no T/TCP was negotiated or
1079 * if the segment has a CC option equal to CCrecv
1080 */
1081 ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) ||
1082 ((to.to_flag & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
1083 th->th_seq == tp->rcv_nxt &&
1084 tiwin && tiwin == tp->snd_wnd &&
1085 tp->snd_nxt == tp->snd_max) {
1086
1087 /*
1088 * If last ACK falls within this segment's sequence numbers,
1089 * record the timestamp.
1090 * NOTE that the test is modified according to the latest
1091 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1092 */
1093 if ((to.to_flag & TOF_TS) != 0 &&
1094 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1095 tp->ts_recent_age = tcp_now;
1096 tp->ts_recent = to.to_tsval;
1097 }
1098
1099 if (tlen == 0) {
1100 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1101 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1102 tp->snd_cwnd >= tp->snd_wnd &&
1103 tp->t_dupacks < tcprexmtthresh) {
1104 /*
1105 * this is a pure ack for outstanding data.
1106 */
1107 ++tcpstat.tcps_predack;
1108 /*
1109 * "bad retransmit" recovery
1110 */
1111 if (tp->t_rxtshift == 1 &&
1112 tcp_now < tp->t_badrxtwin) {
1113 tp->snd_cwnd = tp->snd_cwnd_prev;
1114 tp->snd_ssthresh =
1115 tp->snd_ssthresh_prev;
1116 tp->snd_nxt = tp->snd_max;
1117 tp->t_badrxtwin = 0;
1118 }
1119 if (((to.to_flag & TOF_TS) != 0) && (to.to_tsecr != 0)) /* Makes sure we already have a TS */
1120 tcp_xmit_timer(tp,
1121 tcp_now - to.to_tsecr + 1);
1122 else if (tp->t_rtttime &&
1123 SEQ_GT(th->th_ack, tp->t_rtseq))
1124 tcp_xmit_timer(tp, tp->t_rtttime);
1125 acked = th->th_ack - tp->snd_una;
1126 tcpstat.tcps_rcvackpack++;
1127 tcpstat.tcps_rcvackbyte += acked;
1128 sbdrop(&so->so_snd, acked);
1129 tp->snd_una = th->th_ack;
1130 m_freem(m);
1131 ND6_HINT(tp); /* some progress has been done */
1132
1133 /*
1134 * If all outstanding data are acked, stop
1135 * retransmit timer, otherwise restart timer
1136 * using current (possibly backed-off) value.
1137 * If process is waiting for space,
1138 * wakeup/selwakeup/signal. If data
1139 * are ready to send, let tcp_output
1140 * decide between more output or persist.
1141 */
1142 if (tp->snd_una == tp->snd_max)
1143 tp->t_timer[TCPT_REXMT] = 0;
1144 else if (tp->t_timer[TCPT_PERSIST] == 0)
1145 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
1146
1147 if (so->so_snd.sb_cc)
1148 (void) tcp_output(tp);
1149 sowwakeup(so);
1150 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
1151 return;
1152 }
1153 } else if (th->th_ack == tp->snd_una &&
1154 LIST_EMPTY(&tp->t_segq) &&
1155 tlen <= sbspace(&so->so_rcv)) {
1156 /*
1157 * this is a pure, in-sequence data packet
1158 * with nothing on the reassembly queue and
1159 * we have enough buffer space to take it.
1160 */
1161 ++tcpstat.tcps_preddat;
1162 tp->rcv_nxt += tlen;
1163 tcpstat.tcps_rcvpack++;
1164 tcpstat.tcps_rcvbyte += tlen;
1165 ND6_HINT(tp); /* some progress has been done */
1166 /*
1167 * Add data to socket buffer.
1168 */
1169 m_adj(m, drop_hdrlen); /* delayed header drop */
1170 sbappend(&so->so_rcv, m);
1171 #if INET6
1172 if (isipv6) {
1173 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
1174 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
1175 th->th_seq, th->th_ack, th->th_win);
1176 }
1177 else
1178 #endif
1179 {
1180 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
1181 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
1182 th->th_seq, th->th_ack, th->th_win);
1183 }
1184 if (tcp_delack_enabled) {
1185 TCP_DELACK_BITSET(tp->t_inpcb->hash_element);
1186 tp->t_flags |= TF_DELACK;
1187 } else {
1188 tp->t_flags |= TF_ACKNOW;
1189 tcp_output(tp);
1190 }
1191 sorwakeup(so);
1192 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
1193 return;
1194 }
1195 }
1196
1197 /*
1198 * Calculate amount of space in receive window,
1199 * and then do TCP input processing.
1200 * Receive window is amount of space in rcv queue,
1201 * but not less than advertised window.
1202 */
1203 { int win;
1204
1205 win = sbspace(&so->so_rcv);
1206 if (win < 0)
1207 win = 0;
1208 else { /* clip rcv window to 4K for modems */
1209 if (tp->t_flags & TF_SLOWLINK && slowlink_wsize > 0)
1210 win = min(win, slowlink_wsize);
1211 }
1212 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1213 }
1214
1215 switch (tp->t_state) {
1216
1217 /*
1218 * If the state is LISTEN then ignore segment if it contains an RST.
1219 * If the segment contains an ACK then it is bad and send a RST.
1220 * If it does not contain a SYN then it is not interesting; drop it.
1221 * If it is from this socket, drop it, it must be forged.
1222 * Don't bother responding if the destination was a broadcast.
1223 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
1224 * tp->iss, and send a segment:
1225 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
1226 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
1227 * Fill in remote peer address fields if not previously specified.
1228 * Enter SYN_RECEIVED state, and process any other fields of this
1229 * segment in this state.
1230 */
1231 case TCPS_LISTEN: {
1232 register struct sockaddr_in *sin;
1233 #if INET6
1234 register struct sockaddr_in6 *sin6;
1235 #endif
1236
1237 if (thflags & TH_RST)
1238 goto drop;
1239 if (thflags & TH_ACK) {
1240 rstreason = BANDLIM_RST_OPENPORT;
1241 goto dropwithreset;
1242 }
1243 if ((thflags & TH_SYN) == 0)
1244 goto drop;
1245 if (th->th_dport == th->th_sport) {
1246 #if INET6
1247 if (isipv6) {
1248 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
1249 &ip6->ip6_src))
1250 goto drop;
1251 } else
1252 #endif /* INET6 */
1253 if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
1254 goto drop;
1255 }
1256 /*
1257 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1258 * in_broadcast() should never return true on a received
1259 * packet with M_BCAST not set.
1260 *
1261 * Packets with a multicast source address should also
1262 * be discarded.
1263 */
1264 if (m->m_flags & (M_BCAST|M_MCAST))
1265 goto drop;
1266 #if INET6
1267 if (isipv6) {
1268 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1269 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
1270 goto drop;
1271 } else
1272 #endif
1273 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
1274 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
1275 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
1276 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1277 goto drop;
1278 #if INET6
1279 if (isipv6) {
1280 MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
1281 M_SONAME, M_NOWAIT);
1282 if (sin6 == NULL)
1283 goto drop;
1284 bzero(sin6, sizeof(*sin6));
1285 sin6->sin6_family = AF_INET6;
1286 sin6->sin6_len = sizeof(*sin6);
1287 sin6->sin6_addr = ip6->ip6_src;
1288 sin6->sin6_port = th->th_sport;
1289 laddr6 = inp->in6p_laddr;
1290 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
1291 inp->in6p_laddr = ip6->ip6_dst;
1292 if (in6_pcbconnect(inp, (struct sockaddr *)sin6,
1293 proc0)) {
1294 inp->in6p_laddr = laddr6;
1295 FREE(sin6, M_SONAME);
1296 goto drop;
1297 }
1298 FREE(sin6, M_SONAME);
1299 } else
1300 #endif
1301 {
1302 MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME,
1303 M_NOWAIT);
1304 if (sin == NULL)
1305 goto drop;
1306 sin->sin_family = AF_INET;
1307 sin->sin_len = sizeof(*sin);
1308 sin->sin_addr = ip->ip_src;
1309 sin->sin_port = th->th_sport;
1310 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
1311 laddr = inp->inp_laddr;
1312 if (inp->inp_laddr.s_addr == INADDR_ANY)
1313 inp->inp_laddr = ip->ip_dst;
1314 if (in_pcbconnect(inp, (struct sockaddr *)sin, proc0)) {
1315 inp->inp_laddr = laddr;
1316 FREE(sin, M_SONAME);
1317 goto drop;
1318 }
1319 FREE(sin, M_SONAME);
1320 }
1321 if ((taop = tcp_gettaocache(inp)) == NULL) {
1322 taop = &tao_noncached;
1323 bzero(taop, sizeof(*taop));
1324 }
1325 tcp_dooptions(tp, optp, optlen, th, &to);
1326 if (iss)
1327 tp->iss = iss;
1328 else {
1329 tp->iss = tcp_new_isn(tp);
1330 }
1331 tp->irs = th->th_seq;
1332 tcp_sendseqinit(tp);
1333 tcp_rcvseqinit(tp);
1334 tp->snd_recover = tp->snd_una;
1335 /*
1336 * Initialization of the tcpcb for transaction;
1337 * set SND.WND = SEG.WND,
1338 * initialize CCsend and CCrecv.
1339 */
1340 tp->snd_wnd = tiwin; /* initial send-window */
1341 tp->cc_send = CC_INC(tcp_ccgen);
1342 tp->cc_recv = to.to_cc;
1343 /*
1344 * Perform TAO test on incoming CC (SEG.CC) option, if any.
1345 * - compare SEG.CC against cached CC from the same host,
1346 * if any.
1347 * - if SEG.CC > chached value, SYN must be new and is accepted
1348 * immediately: save new CC in the cache, mark the socket
1349 * connected, enter ESTABLISHED state, turn on flag to
1350 * send a SYN in the next segment.
1351 * A virtual advertised window is set in rcv_adv to
1352 * initialize SWS prevention. Then enter normal segment
1353 * processing: drop SYN, process data and FIN.
1354 * - otherwise do a normal 3-way handshake.
1355 */
1356 if ((to.to_flag & TOF_CC) != 0) {
1357 if (((tp->t_flags & TF_NOPUSH) != 0) &&
1358 taop->tao_cc != 0 && CC_GT(to.to_cc, taop->tao_cc)) {
1359
1360 taop->tao_cc = to.to_cc;
1361
1362 tp->t_state = TCPS_ESTABLISHED;
1363
1364 /*
1365 * If there is a FIN, or if there is data and the
1366 * connection is local, then delay SYN,ACK(SYN) in
1367 * the hope of piggy-backing it on a response
1368 * segment. Otherwise must send ACK now in case
1369 * the other side is slow starting.
1370 */
1371 if (tcp_delack_enabled && ((thflags & TH_FIN) ||
1372 (tlen != 0 &&
1373 #if INET6
1374 (isipv6 && in6_localaddr(&inp->in6p_faddr))
1375 ||
1376 (!isipv6 &&
1377 #endif /* INET6 */
1378 in_localaddr(inp->inp_faddr)
1379 #if INET6
1380 )
1381 #endif /* INET6 */
1382 ))) {
1383 TCP_DELACK_BITSET(tp->t_inpcb->hash_element);
1384 tp->t_flags |= (TF_DELACK | TF_NEEDSYN);
1385 }
1386 else
1387 tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
1388
1389 /*
1390 * Limit the `virtual advertised window' to TCP_MAXWIN
1391 * here. Even if we requested window scaling, it will
1392 * become effective only later when our SYN is acked.
1393 */
1394 if (tp->t_flags & TF_SLOWLINK && slowlink_wsize > 0) /* clip window size for for slow link */
1395 tp->rcv_adv += min(tp->rcv_wnd, slowlink_wsize);
1396 else
1397 tp->rcv_adv += min(tp->rcv_wnd, TCP_MAXWIN);
1398 tcpstat.tcps_connects++;
1399 soisconnected(so);
1400 tp->t_timer[TCPT_KEEP] = tcp_keepinit;
1401 dropsocket = 0; /* committed to socket */
1402 tcpstat.tcps_accepts++;
1403 goto trimthenstep6;
1404 }
1405 /* else do standard 3-way handshake */
1406 } else {
1407 /*
1408 * No CC option, but maybe CC.NEW:
1409 * invalidate cached value.
1410 */
1411 taop->tao_cc = 0;
1412 }
1413 /*
1414 * TAO test failed or there was no CC option,
1415 * do a standard 3-way handshake.
1416 */
1417 tp->t_flags |= TF_ACKNOW;
1418 tp->t_state = TCPS_SYN_RECEIVED;
1419 tp->t_timer[TCPT_KEEP] = tcp_keepinit;
1420 dropsocket = 0; /* committed to socket */
1421 tcpstat.tcps_accepts++;
1422 goto trimthenstep6;
1423 }
1424
1425 /*
1426 * If the state is SYN_RECEIVED:
1427 * if seg contains an ACK, but not for our SYN/ACK, send a RST.
1428 */
1429 case TCPS_SYN_RECEIVED:
1430 if ((thflags & TH_ACK) &&
1431 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1432 SEQ_GT(th->th_ack, tp->snd_max))) {
1433 rstreason = BANDLIM_RST_OPENPORT;
1434 goto dropwithreset;
1435 }
1436 break;
1437
1438 /*
1439 * If the state is SYN_SENT:
1440 * if seg contains an ACK, but not for our SYN, drop the input.
1441 * if seg contains a RST, then drop the connection.
1442 * if seg does not contain SYN, then drop it.
1443 * Otherwise this is an acceptable SYN segment
1444 * initialize tp->rcv_nxt and tp->irs
1445 * if seg contains ack then advance tp->snd_una
1446 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1447 * arrange for segment to be acked (eventually)
1448 * continue processing rest of data/controls, beginning with URG
1449 */
1450 case TCPS_SYN_SENT:
1451 if ((taop = tcp_gettaocache(inp)) == NULL) {
1452 taop = &tao_noncached;
1453 bzero(taop, sizeof(*taop));
1454 }
1455
1456 if ((thflags & TH_ACK) &&
1457 (SEQ_LEQ(th->th_ack, tp->iss) ||
1458 SEQ_GT(th->th_ack, tp->snd_max))) {
1459 /*
1460 * If we have a cached CCsent for the remote host,
1461 * hence we haven't just crashed and restarted,
1462 * do not send a RST. This may be a retransmission
1463 * from the other side after our earlier ACK was lost.
1464 * Our new SYN, when it arrives, will serve as the
1465 * needed ACK.
1466 */
1467 if (taop->tao_ccsent != 0)
1468 goto drop;
1469 else {
1470 rstreason = BANDLIM_UNLIMITED;
1471 goto dropwithreset;
1472 }
1473 }
1474 if (thflags & TH_RST) {
1475 if (thflags & TH_ACK) {
1476 tp = tcp_drop(tp, ECONNREFUSED);
1477 postevent(so, 0, EV_RESET);
1478 }
1479 goto drop;
1480 }
1481 if ((thflags & TH_SYN) == 0)
1482 goto drop;
1483 tp->snd_wnd = th->th_win; /* initial send window */
1484 tp->cc_recv = to.to_cc; /* foreign CC */
1485
1486 tp->irs = th->th_seq;
1487 tcp_rcvseqinit(tp);
1488 if (thflags & TH_ACK) {
1489 /*
1490 * Our SYN was acked. If segment contains CC.ECHO
1491 * option, check it to make sure this segment really
1492 * matches our SYN. If not, just drop it as old
1493 * duplicate, but send an RST if we're still playing
1494 * by the old rules. If no CC.ECHO option, make sure
1495 * we don't get fooled into using T/TCP.
1496 */
1497 if (to.to_flag & TOF_CCECHO) {
1498 if (tp->cc_send != to.to_ccecho) {
1499 if (taop->tao_ccsent != 0)
1500 goto drop;
1501 else {
1502 rstreason = BANDLIM_UNLIMITED;
1503 goto dropwithreset;
1504 }
1505 }
1506 } else
1507 tp->t_flags &= ~TF_RCVD_CC;
1508 tcpstat.tcps_connects++;
1509 soisconnected(so);
1510 /* Do window scaling on this connection? */
1511 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1512 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1513 tp->snd_scale = tp->requested_s_scale;
1514 tp->rcv_scale = tp->request_r_scale;
1515 }
1516 /* Segment is acceptable, update cache if undefined. */
1517 if (taop->tao_ccsent == 0)
1518 taop->tao_ccsent = to.to_ccecho;
1519
1520 tp->rcv_adv += tp->rcv_wnd;
1521 tp->snd_una++; /* SYN is acked */
1522 /*
1523 * If there's data, delay ACK; if there's also a FIN
1524 * ACKNOW will be turned on later.
1525 */
1526 if (tcp_delack_enabled && tlen != 0) {
1527 TCP_DELACK_BITSET(tp->t_inpcb->hash_element);
1528 tp->t_flags |= TF_DELACK;
1529 }
1530 else
1531 tp->t_flags |= TF_ACKNOW;
1532 /*
1533 * Received <SYN,ACK> in SYN_SENT[*] state.
1534 * Transitions:
1535 * SYN_SENT --> ESTABLISHED
1536 * SYN_SENT* --> FIN_WAIT_1
1537 */
1538 if (tp->t_flags & TF_NEEDFIN) {
1539 tp->t_state = TCPS_FIN_WAIT_1;
1540 tp->t_flags &= ~TF_NEEDFIN;
1541 thflags &= ~TH_SYN;
1542 } else {
1543 tp->t_state = TCPS_ESTABLISHED;
1544 tp->t_timer[TCPT_KEEP] = TCP_KEEPIDLE(tp);
1545 }
1546 } else {
1547 /*
1548 * Received initial SYN in SYN-SENT[*] state => simul-
1549 * taneous open. If segment contains CC option and there is
1550 * a cached CC, apply TAO test; if it succeeds, connection is
1551 * half-synchronized. Otherwise, do 3-way handshake:
1552 * SYN-SENT -> SYN-RECEIVED
1553 * SYN-SENT* -> SYN-RECEIVED*
1554 * If there was no CC option, clear cached CC value.
1555 */
1556 tp->t_flags |= TF_ACKNOW;
1557 tp->t_timer[TCPT_REXMT] = 0;
1558 if (to.to_flag & TOF_CC) {
1559 if (taop->tao_cc != 0 &&
1560 CC_GT(to.to_cc, taop->tao_cc)) {
1561 /*
1562 * update cache and make transition:
1563 * SYN-SENT -> ESTABLISHED*
1564 * SYN-SENT* -> FIN-WAIT-1*
1565 */
1566 taop->tao_cc = to.to_cc;
1567 if (tp->t_flags & TF_NEEDFIN) {
1568 tp->t_state = TCPS_FIN_WAIT_1;
1569 tp->t_flags &= ~TF_NEEDFIN;
1570 } else {
1571 tp->t_state = TCPS_ESTABLISHED;
1572 tp->t_timer[TCPT_KEEP] = TCP_KEEPIDLE(tp);
1573 }
1574 tp->t_flags |= TF_NEEDSYN;
1575 } else
1576 tp->t_state = TCPS_SYN_RECEIVED;
1577 } else {
1578 /* CC.NEW or no option => invalidate cache */
1579 taop->tao_cc = 0;
1580 tp->t_state = TCPS_SYN_RECEIVED;
1581 }
1582 }
1583
1584 trimthenstep6:
1585 /*
1586 * Advance th->th_seq to correspond to first data byte.
1587 * If data, trim to stay within window,
1588 * dropping FIN if necessary.
1589 */
1590 th->th_seq++;
1591 if (tlen > tp->rcv_wnd) {
1592 todrop = tlen - tp->rcv_wnd;
1593 m_adj(m, -todrop);
1594 tlen = tp->rcv_wnd;
1595 thflags &= ~TH_FIN;
1596 tcpstat.tcps_rcvpackafterwin++;
1597 tcpstat.tcps_rcvbyteafterwin += todrop;
1598 }
1599 tp->snd_wl1 = th->th_seq - 1;
1600 tp->rcv_up = th->th_seq;
1601 /*
1602 * Client side of transaction: already sent SYN and data.
1603 * If the remote host used T/TCP to validate the SYN,
1604 * our data will be ACK'd; if so, enter normal data segment
1605 * processing in the middle of step 5, ack processing.
1606 * Otherwise, goto step 6.
1607 */
1608 if (thflags & TH_ACK)
1609 goto process_ACK;
1610 goto step6;
1611 /*
1612 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
1613 * if segment contains a SYN and CC [not CC.NEW] option:
1614 * if state == TIME_WAIT and connection duration > MSL,
1615 * drop packet and send RST;
1616 *
1617 * if SEG.CC > CCrecv then is new SYN, and can implicitly
1618 * ack the FIN (and data) in retransmission queue.
1619 * Complete close and delete TCPCB. Then reprocess
1620 * segment, hoping to find new TCPCB in LISTEN state;
1621 *
1622 * else must be old SYN; drop it.
1623 * else do normal processing.
1624 */
1625 case TCPS_LAST_ACK:
1626 case TCPS_CLOSING:
1627 case TCPS_TIME_WAIT:
1628 if ((thflags & TH_SYN) &&
1629 (to.to_flag & TOF_CC) && tp->cc_recv != 0) {
1630 if (tp->t_state == TCPS_TIME_WAIT &&
1631 tp->t_starttime > tcp_msl) {
1632 rstreason = BANDLIM_UNLIMITED;
1633 goto dropwithreset;
1634 }
1635 if (CC_GT(to.to_cc, tp->cc_recv)) {
1636 tp = tcp_close(tp);
1637 goto findpcb;
1638 }
1639 else
1640 goto drop;
1641 }
1642 break; /* continue normal processing */
1643
1644 /* Received a SYN while connection is already established.
1645 * This is a "half open connection and other anomalies" described
1646 * in RFC793 page 34, send an ACK so the remote reset the connection
1647 * or recovers by adjusting its sequence numberering
1648 */
1649 case TCPS_ESTABLISHED:
1650 if (thflags & TH_SYN)
1651 goto dropafterack;
1652 break;
1653 }
1654
1655 /*
1656 * States other than LISTEN or SYN_SENT.
1657 * First check the RST flag and sequence number since reset segments
1658 * are exempt from the timestamp and connection count tests. This
1659 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
1660 * below which allowed reset segments in half the sequence space
1661 * to fall though and be processed (which gives forged reset
1662 * segments with a random sequence number a 50 percent chance of
1663 * killing a connection).
1664 * Then check timestamp, if present.
1665 * Then check the connection count, if present.
1666 * Then check that at least some bytes of segment are within
1667 * receive window. If segment begins before rcv_nxt,
1668 * drop leading data (and SYN); if nothing left, just ack.
1669 *
1670 *
1671 * If the RST bit is set, check the sequence number to see
1672 * if this is a valid reset segment.
1673 * RFC 793 page 37:
1674 * In all states except SYN-SENT, all reset (RST) segments
1675 * are validated by checking their SEQ-fields. A reset is
1676 * valid if its sequence number is in the window.
1677 * Note: this does not take into account delayed ACKs, so
1678 * we should test against last_ack_sent instead of rcv_nxt.
1679 * The sequence number in the reset segment is normally an
1680 * echo of our outgoing acknowlegement numbers, but some hosts
1681 * send a reset with the sequence number at the rightmost edge
1682 * of our receive window, and we have to handle this case.
1683 * If we have multiple segments in flight, the intial reset
1684 * segment sequence numbers will be to the left of last_ack_sent,
1685 * but they will eventually catch up.
1686 * In any case, it never made sense to trim reset segments to
1687 * fit the receive window since RFC 1122 says:
1688 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
1689 *
1690 * A TCP SHOULD allow a received RST segment to include data.
1691 *
1692 * DISCUSSION
1693 * It has been suggested that a RST segment could contain
1694 * ASCII text that encoded and explained the cause of the
1695 * RST. No standard has yet been established for such
1696 * data.
1697 *
1698 * If the reset segment passes the sequence number test examine
1699 * the state:
1700 * SYN_RECEIVED STATE:
1701 * If passive open, return to LISTEN state.
1702 * If active open, inform user that connection was refused.
1703 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
1704 * Inform user that connection was reset, and close tcb.
1705 * CLOSING, LAST_ACK STATES:
1706 * Close the tcb.
1707 * TIME_WAIT STATE:
1708 * Drop the segment - see Stevens, vol. 2, p. 964 and
1709 * RFC 1337.
1710 */
1711 if (thflags & TH_RST) {
1712 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
1713 SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
1714 switch (tp->t_state) {
1715
1716 case TCPS_SYN_RECEIVED:
1717 so->so_error = ECONNREFUSED;
1718 goto close;
1719
1720 case TCPS_ESTABLISHED:
1721 case TCPS_FIN_WAIT_1:
1722 case TCPS_CLOSE_WAIT:
1723 /*
1724 Drop through ...
1725 */
1726 case TCPS_FIN_WAIT_2:
1727 so->so_error = ECONNRESET;
1728 close:
1729 postevent(so, 0, EV_RESET);
1730 tp->t_state = TCPS_CLOSED;
1731 tcpstat.tcps_drops++;
1732 tp = tcp_close(tp);
1733 break;
1734
1735 case TCPS_CLOSING:
1736 case TCPS_LAST_ACK:
1737 tp = tcp_close(tp);
1738 break;
1739
1740 case TCPS_TIME_WAIT:
1741 break;
1742 }
1743 }
1744 goto drop;
1745 }
1746
1747 /*
1748 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1749 * and it's less than ts_recent, drop it.
1750 */
1751 if ((to.to_flag & TOF_TS) != 0 && tp->ts_recent &&
1752 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
1753
1754 /* Check to see if ts_recent is over 24 days old. */
1755 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) {
1756 /*
1757 * Invalidate ts_recent. If this segment updates
1758 * ts_recent, the age will be reset later and ts_recent
1759 * will get a valid value. If it does not, setting
1760 * ts_recent to zero will at least satisfy the
1761 * requirement that zero be placed in the timestamp
1762 * echo reply when ts_recent isn't valid. The
1763 * age isn't reset until we get a valid ts_recent
1764 * because we don't want out-of-order segments to be
1765 * dropped when ts_recent is old.
1766 */
1767 tp->ts_recent = 0;
1768 } else {
1769 tcpstat.tcps_rcvduppack++;
1770 tcpstat.tcps_rcvdupbyte += tlen;
1771 tcpstat.tcps_pawsdrop++;
1772 goto dropafterack;
1773 }
1774 }
1775
1776 /*
1777 * T/TCP mechanism
1778 * If T/TCP was negotiated and the segment doesn't have CC,
1779 * or if its CC is wrong then drop the segment.
1780 * RST segments do not have to comply with this.
1781 */
1782 if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) &&
1783 ((to.to_flag & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
1784 goto dropafterack;
1785
1786 /*
1787 * In the SYN-RECEIVED state, validate that the packet belongs to
1788 * this connection before trimming the data to fit the receive
1789 * window. Check the sequence number versus IRS since we know
1790 * the sequence numbers haven't wrapped. This is a partial fix
1791 * for the "LAND" DoS attack.
1792 */
1793 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
1794 rstreason = BANDLIM_RST_OPENPORT;
1795 goto dropwithreset;
1796 }
1797
1798 todrop = tp->rcv_nxt - th->th_seq;
1799 if (todrop > 0) {
1800 if (thflags & TH_SYN) {
1801 thflags &= ~TH_SYN;
1802 th->th_seq++;
1803 if (th->th_urp > 1)
1804 th->th_urp--;
1805 else
1806 thflags &= ~TH_URG;
1807 todrop--;
1808 }
1809 /*
1810 * Following if statement from Stevens, vol. 2, p. 960.
1811 */
1812 if (todrop > tlen
1813 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
1814 /*
1815 * Any valid FIN must be to the left of the window.
1816 * At this point the FIN must be a duplicate or out
1817 * of sequence; drop it.
1818 */
1819 thflags &= ~TH_FIN;
1820
1821 /*
1822 * Send an ACK to resynchronize and drop any data.
1823 * But keep on processing for RST or ACK.
1824 */
1825 tp->t_flags |= TF_ACKNOW;
1826 todrop = tlen;
1827 tcpstat.tcps_rcvduppack++;
1828 tcpstat.tcps_rcvdupbyte += todrop;
1829 } else {
1830 tcpstat.tcps_rcvpartduppack++;
1831 tcpstat.tcps_rcvpartdupbyte += todrop;
1832 }
1833 drop_hdrlen += todrop; /* drop from the top afterwards */
1834 th->th_seq += todrop;
1835 tlen -= todrop;
1836 if (th->th_urp > todrop)
1837 th->th_urp -= todrop;
1838 else {
1839 thflags &= ~TH_URG;
1840 th->th_urp = 0;
1841 }
1842 }
1843
1844 /*
1845 * If new data are received on a connection after the
1846 * user processes are gone, then RST the other end.
1847 */
1848 if ((so->so_state & SS_NOFDREF) &&
1849 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1850 tp = tcp_close(tp);
1851 tcpstat.tcps_rcvafterclose++;
1852 rstreason = BANDLIM_UNLIMITED;
1853 goto dropwithreset;
1854 }
1855
1856 /*
1857 * If segment ends after window, drop trailing data
1858 * (and PUSH and FIN); if nothing left, just ACK.
1859 */
1860 todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1861 if (todrop > 0) {
1862 tcpstat.tcps_rcvpackafterwin++;
1863 if (todrop >= tlen) {
1864 tcpstat.tcps_rcvbyteafterwin += tlen;
1865 /*
1866 * If a new connection request is received
1867 * while in TIME_WAIT, drop the old connection
1868 * and start over if the sequence numbers
1869 * are above the previous ones.
1870 */
1871 if (thflags & TH_SYN &&
1872 tp->t_state == TCPS_TIME_WAIT &&
1873 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1874 iss = tcp_new_isn(tp);
1875 tp = tcp_close(tp);
1876 goto findpcb;
1877 }
1878 /*
1879 * If window is closed can only take segments at
1880 * window edge, and have to drop data and PUSH from
1881 * incoming segments. Continue processing, but
1882 * remember to ack. Otherwise, drop segment
1883 * and ack.
1884 */
1885 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1886 tp->t_flags |= TF_ACKNOW;
1887 tcpstat.tcps_rcvwinprobe++;
1888 } else
1889 goto dropafterack;
1890 } else
1891 tcpstat.tcps_rcvbyteafterwin += todrop;
1892 m_adj(m, -todrop);
1893 tlen -= todrop;
1894 thflags &= ~(TH_PUSH|TH_FIN);
1895 }
1896
1897 /*
1898 * If last ACK falls within this segment's sequence numbers,
1899 * record its timestamp.
1900 * NOTE that the test is modified according to the latest
1901 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1902 */
1903 if ((to.to_flag & TOF_TS) != 0 &&
1904 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1905 tp->ts_recent_age = tcp_now;
1906 tp->ts_recent = to.to_tsval;
1907 }
1908
1909 /*
1910 * If a SYN is in the window, then this is an
1911 * error and we send an RST and drop the connection.
1912 */
1913 if (thflags & TH_SYN) {
1914 tp = tcp_drop(tp, ECONNRESET);
1915 rstreason = BANDLIM_UNLIMITED;
1916 postevent(so, 0, EV_RESET);
1917 goto dropwithreset;
1918 }
1919
1920 /*
1921 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
1922 * flag is on (half-synchronized state), then queue data for
1923 * later processing; else drop segment and return.
1924 */
1925 if ((thflags & TH_ACK) == 0) {
1926 if (tp->t_state == TCPS_SYN_RECEIVED ||
1927 (tp->t_flags & TF_NEEDSYN))
1928 goto step6;
1929 else
1930 goto drop;
1931 }
1932
1933 /*
1934 * Ack processing.
1935 */
1936 switch (tp->t_state) {
1937
1938 /*
1939 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1940 * ESTABLISHED state and continue processing.
1941 * The ACK was checked above.
1942 */
1943 case TCPS_SYN_RECEIVED:
1944
1945 tcpstat.tcps_connects++;
1946 soisconnected(so);
1947
1948 /* Do window scaling? */
1949 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1950 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1951 tp->snd_scale = tp->requested_s_scale;
1952 tp->rcv_scale = tp->request_r_scale;
1953 }
1954 /*
1955 * Upon successful completion of 3-way handshake,
1956 * update cache.CC if it was undefined, pass any queued
1957 * data to the user, and advance state appropriately.
1958 */
1959 if ((taop = tcp_gettaocache(inp)) != NULL &&
1960 taop->tao_cc == 0)
1961 taop->tao_cc = tp->cc_recv;
1962
1963 /*
1964 * Make transitions:
1965 * SYN-RECEIVED -> ESTABLISHED
1966 * SYN-RECEIVED* -> FIN-WAIT-1
1967 */
1968 if (tp->t_flags & TF_NEEDFIN) {
1969 tp->t_state = TCPS_FIN_WAIT_1;
1970 tp->t_flags &= ~TF_NEEDFIN;
1971 } else {
1972 tp->t_state = TCPS_ESTABLISHED;
1973 tp->t_timer[TCPT_KEEP] = TCP_KEEPIDLE(tp);
1974 }
1975 /*
1976 * If segment contains data or ACK, will call tcp_reass()
1977 * later; if not, do so now to pass queued data to user.
1978 */
1979 if (tlen == 0 && (thflags & TH_FIN) == 0)
1980 (void) tcp_reass(tp, (struct tcphdr *)0, 0,
1981 (struct mbuf *)0);
1982 tp->snd_wl1 = th->th_seq - 1;
1983 /* fall into ... */
1984
1985 /*
1986 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1987 * ACKs. If the ack is in the range
1988 * tp->snd_una < th->th_ack <= tp->snd_max
1989 * then advance tp->snd_una to th->th_ack and drop
1990 * data from the retransmission queue. If this ACK reflects
1991 * more up to date window information we update our window information.
1992 */
1993 case TCPS_ESTABLISHED:
1994 case TCPS_FIN_WAIT_1:
1995 case TCPS_FIN_WAIT_2:
1996 case TCPS_CLOSE_WAIT:
1997 case TCPS_CLOSING:
1998 case TCPS_LAST_ACK:
1999 case TCPS_TIME_WAIT:
2000
2001 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2002 if (tlen == 0 && tiwin == tp->snd_wnd) {
2003 tcpstat.tcps_rcvdupack++;
2004 /*
2005 * If we have outstanding data (other than
2006 * a window probe), this is a completely
2007 * duplicate ack (ie, window info didn't
2008 * change), the ack is the biggest we've
2009 * seen and we've seen exactly our rexmt
2010 * threshhold of them, assume a packet
2011 * has been dropped and retransmit it.
2012 * Kludge snd_nxt & the congestion
2013 * window so we send only this one
2014 * packet.
2015 *
2016 * We know we're losing at the current
2017 * window size so do congestion avoidance
2018 * (set ssthresh to half the current window
2019 * and pull our congestion window back to
2020 * the new ssthresh).
2021 *
2022 * Dup acks mean that packets have left the
2023 * network (they're now cached at the receiver)
2024 * so bump cwnd by the amount in the receiver
2025 * to keep a constant cwnd packets in the
2026 * network.
2027 */
2028 if (tp->t_timer[TCPT_REXMT] == 0 ||
2029 th->th_ack != tp->snd_una)
2030 tp->t_dupacks = 0;
2031 else if (++tp->t_dupacks == tcprexmtthresh) {
2032 tcp_seq onxt = tp->snd_nxt;
2033 u_int win =
2034 min(tp->snd_wnd, tp->snd_cwnd) / 2 /
2035 tp->t_maxseg;
2036 if (tcp_do_newreno && SEQ_LT(th->th_ack,
2037 tp->snd_recover)) {
2038 /* False retransmit, should not
2039 * cut window
2040 */
2041 tp->snd_cwnd += tp->t_maxseg;
2042 tp->t_dupacks = 0;
2043 (void) tcp_output(tp);
2044 goto drop;
2045 }
2046 if (win < 2)
2047 win = 2;
2048 tp->snd_ssthresh = win * tp->t_maxseg;
2049 tp->snd_recover = tp->snd_max;
2050 tp->t_timer[TCPT_REXMT] = 0;
2051 tp->t_rtttime = 0;
2052 tp->snd_nxt = th->th_ack;
2053 tp->snd_cwnd = tp->t_maxseg;
2054 (void) tcp_output(tp);
2055 tp->snd_cwnd = tp->snd_ssthresh +
2056 tp->t_maxseg * tp->t_dupacks;
2057 if (SEQ_GT(onxt, tp->snd_nxt))
2058 tp->snd_nxt = onxt;
2059 goto drop;
2060 } else if (tp->t_dupacks > tcprexmtthresh) {
2061 tp->snd_cwnd += tp->t_maxseg;
2062 (void) tcp_output(tp);
2063 goto drop;
2064 }
2065 } else
2066 tp->t_dupacks = 0;
2067 break;
2068 }
2069 /*
2070 * If the congestion window was inflated to account
2071 * for the other side's cached packets, retract it.
2072 */
2073 if (tcp_do_newreno == 0) {
2074 if (tp->t_dupacks >= tcprexmtthresh &&
2075 tp->snd_cwnd > tp->snd_ssthresh)
2076 tp->snd_cwnd = tp->snd_ssthresh;
2077 tp->t_dupacks = 0;
2078 } else if (tp->t_dupacks >= tcprexmtthresh &&
2079 !tcp_newreno(tp, th)) {
2080 /*
2081 * Window inflation should have left us with approx.
2082 * snd_ssthresh outstanding data. But in case we
2083 * would be inclined to send a burst, better to do
2084 * it via the slow start mechanism.
2085 */
2086 if (SEQ_GT(th->th_ack + tp->snd_ssthresh, tp->snd_max))
2087 tp->snd_cwnd =
2088 tp->snd_max - th->th_ack + tp->t_maxseg;
2089 else
2090 tp->snd_cwnd = tp->snd_ssthresh;
2091 tp->t_dupacks = 0;
2092 }
2093
2094 if (tp->t_dupacks < tcprexmtthresh)
2095 tp->t_dupacks = 0;
2096
2097 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2098 tcpstat.tcps_rcvacktoomuch++;
2099 goto dropafterack;
2100 }
2101 /*
2102 * If we reach this point, ACK is not a duplicate,
2103 * i.e., it ACKs something we sent.
2104 */
2105 if (tp->t_flags & TF_NEEDSYN) {
2106 /*
2107 * T/TCP: Connection was half-synchronized, and our
2108 * SYN has been ACK'd (so connection is now fully
2109 * synchronized). Go to non-starred state,
2110 * increment snd_una for ACK of SYN, and check if
2111 * we can do window scaling.
2112 */
2113 tp->t_flags &= ~TF_NEEDSYN;
2114 tp->snd_una++;
2115 /* Do window scaling? */
2116 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2117 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2118 tp->snd_scale = tp->requested_s_scale;
2119 tp->rcv_scale = tp->request_r_scale;
2120 }
2121 }
2122
2123 process_ACK:
2124 acked = th->th_ack - tp->snd_una;
2125 tcpstat.tcps_rcvackpack++;
2126 tcpstat.tcps_rcvackbyte += acked;
2127
2128 /*
2129 * If we just performed our first retransmit, and the ACK
2130 * arrives within our recovery window, then it was a mistake
2131 * to do the retransmit in the first place. Recover our
2132 * original cwnd and ssthresh, and proceed to transmit where
2133 * we left off.
2134 */
2135 if (tp->t_rxtshift == 1 && tcp_now < tp->t_badrxtwin) {
2136 tp->snd_cwnd = tp->snd_cwnd_prev;
2137 tp->snd_ssthresh = tp->snd_ssthresh_prev;
2138 tp->snd_nxt = tp->snd_max;
2139 tp->t_badrxtwin = 0; /* XXX probably not required */
2140 }
2141
2142 /*
2143 * If we have a timestamp reply, update smoothed
2144 * round trip time. If no timestamp is present but
2145 * transmit timer is running and timed sequence
2146 * number was acked, update smoothed round trip time.
2147 * Since we now have an rtt measurement, cancel the
2148 * timer backoff (cf., Phil Karn's retransmit alg.).
2149 * Recompute the initial retransmit timer.
2150 * Also makes sure we have a valid time stamp in hand
2151 */
2152 if (((to.to_flag & TOF_TS) != 0) && (to.to_tsecr != 0))
2153 tcp_xmit_timer(tp, tcp_now - to.to_tsecr + 1);
2154 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2155 tcp_xmit_timer(tp, tp->t_rtttime);
2156
2157 /*
2158 * If all outstanding data is acked, stop retransmit
2159 * timer and remember to restart (more output or persist).
2160 * If there is more data to be acked, restart retransmit
2161 * timer, using current (possibly backed-off) value.
2162 */
2163 if (th->th_ack == tp->snd_max) {
2164 tp->t_timer[TCPT_REXMT] = 0;
2165 needoutput = 1;
2166 } else if (tp->t_timer[TCPT_PERSIST] == 0)
2167 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
2168
2169 /*
2170 * If no data (only SYN) was ACK'd,
2171 * skip rest of ACK processing.
2172 */
2173 if (acked == 0)
2174 goto step6;
2175
2176 /*
2177 * When new data is acked, open the congestion window.
2178 * If the window gives us less than ssthresh packets
2179 * in flight, open exponentially (maxseg per packet).
2180 * Otherwise open linearly: maxseg per window
2181 * (maxseg^2 / cwnd per packet).
2182 */
2183 {
2184 register u_int cw = tp->snd_cwnd;
2185 register u_int incr = tp->t_maxseg;
2186
2187 if (cw > tp->snd_ssthresh)
2188 incr = incr * incr / cw;
2189 /*
2190 * If t_dupacks != 0 here, it indicates that we are still
2191 * in NewReno fast recovery mode, so we leave the congestion
2192 * window alone.
2193 */
2194 if (tcp_do_newreno == 0 || tp->t_dupacks == 0)
2195 tp->snd_cwnd = min(cw + incr,TCP_MAXWIN<<tp->snd_scale);
2196 }
2197 if (acked > so->so_snd.sb_cc) {
2198 tp->snd_wnd -= so->so_snd.sb_cc;
2199 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2200 ourfinisacked = 1;
2201 } else {
2202 sbdrop(&so->so_snd, acked);
2203 tp->snd_wnd -= acked;
2204 ourfinisacked = 0;
2205 }
2206 tp->snd_una = th->th_ack;
2207 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2208 tp->snd_nxt = tp->snd_una;
2209 sowwakeup(so);
2210
2211 switch (tp->t_state) {
2212
2213 /*
2214 * In FIN_WAIT_1 STATE in addition to the processing
2215 * for the ESTABLISHED state if our FIN is now acknowledged
2216 * then enter FIN_WAIT_2.
2217 */
2218 case TCPS_FIN_WAIT_1:
2219 if (ourfinisacked) {
2220 /*
2221 * If we can't receive any more
2222 * data, then closing user can proceed.
2223 * Starting the timer is contrary to the
2224 * specification, but if we don't get a FIN
2225 * we'll hang forever.
2226 */
2227 if (so->so_state & SS_CANTRCVMORE) {
2228 soisdisconnected(so);
2229 tp->t_timer[TCPT_2MSL] = tcp_maxidle;
2230 }
2231 add_to_time_wait(tp);
2232 tp->t_state = TCPS_FIN_WAIT_2;
2233 }
2234 break;
2235
2236 /*
2237 * In CLOSING STATE in addition to the processing for
2238 * the ESTABLISHED state if the ACK acknowledges our FIN
2239 * then enter the TIME-WAIT state, otherwise ignore
2240 * the segment.
2241 */
2242 case TCPS_CLOSING:
2243 if (ourfinisacked) {
2244 tp->t_state = TCPS_TIME_WAIT;
2245 tcp_canceltimers(tp);
2246 /* Shorten TIME_WAIT [RFC-1644, p.28] */
2247 if (tp->cc_recv != 0 &&
2248 tp->t_starttime < tcp_msl)
2249 tp->t_timer[TCPT_2MSL] =
2250 tp->t_rxtcur * TCPTV_TWTRUNC;
2251 else
2252 tp->t_timer[TCPT_2MSL] = 2 * tcp_msl;
2253 add_to_time_wait(tp);
2254 soisdisconnected(so);
2255 }
2256 break;
2257
2258 /*
2259 * In LAST_ACK, we may still be waiting for data to drain
2260 * and/or to be acked, as well as for the ack of our FIN.
2261 * If our FIN is now acknowledged, delete the TCB,
2262 * enter the closed state and return.
2263 */
2264 case TCPS_LAST_ACK:
2265 if (ourfinisacked) {
2266 tp = tcp_close(tp);
2267 goto drop;
2268 }
2269 break;
2270
2271 /*
2272 * In TIME_WAIT state the only thing that should arrive
2273 * is a retransmission of the remote FIN. Acknowledge
2274 * it and restart the finack timer.
2275 */
2276 case TCPS_TIME_WAIT:
2277 tp->t_timer[TCPT_2MSL] = 2 * tcp_msl;
2278 add_to_time_wait(tp);
2279 goto dropafterack;
2280 }
2281 }
2282
2283 step6:
2284 /*
2285 * Update window information.
2286 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2287 */
2288 if ((thflags & TH_ACK) &&
2289 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2290 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2291 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2292 /* keep track of pure window updates */
2293 if (tlen == 0 &&
2294 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2295 tcpstat.tcps_rcvwinupd++;
2296 tp->snd_wnd = tiwin;
2297 tp->snd_wl1 = th->th_seq;
2298 tp->snd_wl2 = th->th_ack;
2299 if (tp->snd_wnd > tp->max_sndwnd)
2300 tp->max_sndwnd = tp->snd_wnd;
2301 needoutput = 1;
2302 }
2303
2304 /*
2305 * Process segments with URG.
2306 */
2307 if ((thflags & TH_URG) && th->th_urp &&
2308 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2309 /*
2310 * This is a kludge, but if we receive and accept
2311 * random urgent pointers, we'll crash in
2312 * soreceive. It's hard to imagine someone
2313 * actually wanting to send this much urgent data.
2314 */
2315 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2316 th->th_urp = 0; /* XXX */
2317 thflags &= ~TH_URG; /* XXX */
2318 goto dodata; /* XXX */
2319 }
2320 /*
2321 * If this segment advances the known urgent pointer,
2322 * then mark the data stream. This should not happen
2323 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2324 * a FIN has been received from the remote side.
2325 * In these states we ignore the URG.
2326 *
2327 * According to RFC961 (Assigned Protocols),
2328 * the urgent pointer points to the last octet
2329 * of urgent data. We continue, however,
2330 * to consider it to indicate the first octet
2331 * of data past the urgent section as the original
2332 * spec states (in one of two places).
2333 */
2334 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2335 tp->rcv_up = th->th_seq + th->th_urp;
2336 so->so_oobmark = so->so_rcv.sb_cc +
2337 (tp->rcv_up - tp->rcv_nxt) - 1;
2338 if (so->so_oobmark == 0) {
2339 so->so_state |= SS_RCVATMARK;
2340 postevent(so, 0, EV_OOB);
2341 }
2342 sohasoutofband(so);
2343 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2344 }
2345 /*
2346 * Remove out of band data so doesn't get presented to user.
2347 * This can happen independent of advancing the URG pointer,
2348 * but if two URG's are pending at once, some out-of-band
2349 * data may creep in... ick.
2350 */
2351 if (th->th_urp <= (u_long)tlen
2352 #if SO_OOBINLINE
2353 && (so->so_options & SO_OOBINLINE) == 0
2354 #endif
2355 )
2356 tcp_pulloutofband(so, th, m,
2357 drop_hdrlen); /* hdr drop is delayed */
2358 } else
2359 /*
2360 * If no out of band data is expected,
2361 * pull receive urgent pointer along
2362 * with the receive window.
2363 */
2364 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2365 tp->rcv_up = tp->rcv_nxt;
2366 dodata: /* XXX */
2367
2368 /*
2369 * Process the segment text, merging it into the TCP sequencing queue,
2370 * and arranging for acknowledgment of receipt if necessary.
2371 * This process logically involves adjusting tp->rcv_wnd as data
2372 * is presented to the user (this happens in tcp_usrreq.c,
2373 * case PRU_RCVD). If a FIN has already been received on this
2374 * connection then we just ignore the text.
2375 */
2376 if ((tlen || (thflags&TH_FIN)) &&
2377 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2378 m_adj(m, drop_hdrlen); /* delayed header drop */
2379 /*
2380 * Insert segment which inludes th into reassembly queue of tcp with
2381 * control block tp. Return TH_FIN if reassembly now includes
2382 * a segment with FIN. This handle the common case inline (segment
2383 * is the next to be received on an established connection, and the
2384 * queue is empty), avoiding linkage into and removal from the queue
2385 * and repetition of various conversions.
2386 * Set DELACK for segments received in order, but ack immediately
2387 * when segments are out of order (so fast retransmit can work).
2388 */
2389 if (th->th_seq == tp->rcv_nxt &&
2390 LIST_EMPTY(&tp->t_segq) &&
2391 TCPS_HAVEESTABLISHED(tp->t_state)) {
2392 #ifdef __APPLE__
2393 if (tcp_delack_enabled) {
2394 TCP_DELACK_BITSET(tp->t_inpcb->hash_element);
2395 tp->t_flags |= TF_DELACK;
2396 }
2397 #else
2398 if (DELAY_ACK(tp))
2399 callout_reset(tp->tt_delack, tcp_delacktime,
2400 tcp_timer_delack, tp);
2401 #endif
2402 else
2403 tp->t_flags |= TF_ACKNOW;
2404 tp->rcv_nxt += tlen;
2405 thflags = th->th_flags & TH_FIN;
2406 tcpstat.tcps_rcvpack++;
2407 tcpstat.tcps_rcvbyte += tlen;
2408 ND6_HINT(tp);
2409 sbappend(&so->so_rcv, m);
2410 sorwakeup(so);
2411 } else {
2412 thflags = tcp_reass(tp, th, &tlen, m);
2413 tp->t_flags |= TF_ACKNOW;
2414 }
2415
2416 if (tp->t_flags & TF_DELACK)
2417 {
2418 #if INET6
2419 if (isipv6) {
2420 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
2421 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
2422 th->th_seq, th->th_ack, th->th_win);
2423 }
2424 else
2425 #endif
2426 {
2427 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
2428 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
2429 th->th_seq, th->th_ack, th->th_win);
2430 }
2431
2432 }
2433 /*
2434 * Note the amount of data that peer has sent into
2435 * our window, in order to estimate the sender's
2436 * buffer size.
2437 */
2438 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2439 } else {
2440 m_freem(m);
2441 thflags &= ~TH_FIN;
2442 }
2443
2444 /*
2445 * If FIN is received ACK the FIN and let the user know
2446 * that the connection is closing.
2447 */
2448 if (thflags & TH_FIN) {
2449 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2450 socantrcvmore(so);
2451 postevent(so, 0, EV_FIN);
2452 /*
2453 * If connection is half-synchronized
2454 * (ie NEEDSYN flag on) then delay ACK,
2455 * so it may be piggybacked when SYN is sent.
2456 * Otherwise, since we received a FIN then no
2457 * more input can be expected, send ACK now.
2458 */
2459 if (tcp_delack_enabled && (tp->t_flags & TF_NEEDSYN)) {
2460 TCP_DELACK_BITSET(tp->t_inpcb->hash_element);
2461 tp->t_flags |= TF_DELACK;
2462 }
2463 else
2464 tp->t_flags |= TF_ACKNOW;
2465 tp->rcv_nxt++;
2466 }
2467 switch (tp->t_state) {
2468
2469 /*
2470 * In SYN_RECEIVED and ESTABLISHED STATES
2471 * enter the CLOSE_WAIT state.
2472 */
2473 case TCPS_SYN_RECEIVED:
2474 /*FALLTHROUGH*/
2475 case TCPS_ESTABLISHED:
2476 tp->t_state = TCPS_CLOSE_WAIT;
2477 break;
2478
2479 /*
2480 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2481 * enter the CLOSING state.
2482 */
2483 case TCPS_FIN_WAIT_1:
2484 tp->t_state = TCPS_CLOSING;
2485 break;
2486
2487 /*
2488 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2489 * starting the time-wait timer, turning off the other
2490 * standard timers.
2491 */
2492 case TCPS_FIN_WAIT_2:
2493 tp->t_state = TCPS_TIME_WAIT;
2494 tcp_canceltimers(tp);
2495 /* Shorten TIME_WAIT [RFC-1644, p.28] */
2496 if (tp->cc_recv != 0 &&
2497 tp->t_starttime < tcp_msl) {
2498 tp->t_timer[TCPT_2MSL] =
2499 tp->t_rxtcur * TCPTV_TWTRUNC;
2500 /* For transaction client, force ACK now. */
2501 tp->t_flags |= TF_ACKNOW;
2502 }
2503 else
2504 tp->t_timer[TCPT_2MSL] = 2 * tcp_msl;
2505
2506 add_to_time_wait(tp);
2507 soisdisconnected(so);
2508 break;
2509
2510 /*
2511 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2512 */
2513 case TCPS_TIME_WAIT:
2514 tp->t_timer[TCPT_2MSL] = 2 * tcp_msl;
2515 add_to_time_wait(tp);
2516 break;
2517 }
2518 }
2519 #if TCPDEBUG
2520 if (so->so_options & SO_DEBUG)
2521 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
2522 &tcp_savetcp, 0);
2523 #endif
2524
2525 /*
2526 * Return any desired output.
2527 */
2528 if (needoutput || (tp->t_flags & TF_ACKNOW))
2529 (void) tcp_output(tp);
2530 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
2531 return;
2532
2533 dropafterack:
2534 /*
2535 * Generate an ACK dropping incoming segment if it occupies
2536 * sequence space, where the ACK reflects our state.
2537 *
2538 * We can now skip the test for the RST flag since all
2539 * paths to this code happen after packets containing
2540 * RST have been dropped.
2541 *
2542 * In the SYN-RECEIVED state, don't send an ACK unless the
2543 * segment we received passes the SYN-RECEIVED ACK test.
2544 * If it fails send a RST. This breaks the loop in the
2545 * "LAND" DoS attack, and also prevents an ACK storm
2546 * between two listening ports that have been sent forged
2547 * SYN segments, each with the source address of the other.
2548 */
2549 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
2550 (SEQ_GT(tp->snd_una, th->th_ack) ||
2551 SEQ_GT(th->th_ack, tp->snd_max)) ) {
2552 rstreason = BANDLIM_RST_OPENPORT;
2553 goto dropwithreset;
2554 }
2555 #if TCPDEBUG
2556 if (so->so_options & SO_DEBUG)
2557 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2558 &tcp_savetcp, 0);
2559 #endif
2560 m_freem(m);
2561 tp->t_flags |= TF_ACKNOW;
2562 (void) tcp_output(tp);
2563 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
2564 return;
2565
2566 dropwithreset:
2567 /*
2568 * Generate a RST, dropping incoming segment.
2569 * Make ACK acceptable to originator of segment.
2570 * Don't bother to respond if destination was broadcast/multicast.
2571 */
2572 if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
2573 goto drop;
2574 #if INET6
2575 if (isipv6) {
2576 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2577 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2578 goto drop;
2579 } else
2580 #endif /* INET6 */
2581 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2582 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2583 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2584 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2585 goto drop;
2586 /* IPv6 anycast check is done at tcp6_input() */
2587
2588 /*
2589 * Perform bandwidth limiting.
2590 */
2591 #if ICMP_BANDLIM
2592 if (badport_bandlim(rstreason) < 0)
2593 goto drop;
2594 #endif
2595
2596 #if TCPDEBUG
2597 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2598 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2599 &tcp_savetcp, 0);
2600 #endif
2601 if (thflags & TH_ACK)
2602 /* mtod() below is safe as long as hdr dropping is delayed */
2603 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack,
2604 TH_RST);
2605 else {
2606 if (thflags & TH_SYN)
2607 tlen++;
2608 /* mtod() below is safe as long as hdr dropping is delayed */
2609 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
2610 (tcp_seq)0, TH_RST|TH_ACK);
2611 }
2612 /* destroy temporarily created socket */
2613 if (dropsocket)
2614 (void) soabort(so);
2615 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
2616 return;
2617
2618 drop:
2619 /*
2620 * Drop space held by incoming segment and return.
2621 */
2622 #if TCPDEBUG
2623 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
2624 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
2625 &tcp_savetcp, 0);
2626 #endif
2627 m_freem(m);
2628 /* destroy temporarily created socket */
2629 if (dropsocket)
2630 (void) soabort(so);
2631 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
2632 return;
2633 }
2634
2635 static void
2636 tcp_dooptions(tp, cp, cnt, th, to)
2637 struct tcpcb *tp;
2638 u_char *cp;
2639 int cnt;
2640 struct tcphdr *th;
2641 struct tcpopt *to;
2642 {
2643 u_short mss = 0;
2644 int opt, optlen;
2645
2646 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2647 opt = cp[0];
2648 if (opt == TCPOPT_EOL)
2649 break;
2650 if (opt == TCPOPT_NOP)
2651 optlen = 1;
2652 else {
2653 if (cnt < 2)
2654 break;
2655 optlen = cp[1];
2656 if (optlen < 2 || optlen > cnt)
2657 break;
2658 }
2659 switch (opt) {
2660
2661 default:
2662 continue;
2663
2664 case TCPOPT_MAXSEG:
2665 if (optlen != TCPOLEN_MAXSEG)
2666 continue;
2667 if (!(th->th_flags & TH_SYN))
2668 continue;
2669 bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
2670 NTOHS(mss);
2671 break;
2672
2673 case TCPOPT_WINDOW:
2674 if (optlen != TCPOLEN_WINDOW)
2675 continue;
2676 if (!(th->th_flags & TH_SYN))
2677 continue;
2678 tp->t_flags |= TF_RCVD_SCALE;
2679 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
2680 break;
2681
2682 case TCPOPT_TIMESTAMP:
2683 if (optlen != TCPOLEN_TIMESTAMP)
2684 continue;
2685 to->to_flag |= TOF_TS;
2686 bcopy((char *)cp + 2,
2687 (char *)&to->to_tsval, sizeof(to->to_tsval));
2688 NTOHL(to->to_tsval);
2689 bcopy((char *)cp + 6,
2690 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
2691 NTOHL(to->to_tsecr);
2692
2693 /*
2694 * A timestamp received in a SYN makes
2695 * it ok to send timestamp requests and replies.
2696 */
2697 if (th->th_flags & TH_SYN) {
2698 tp->t_flags |= TF_RCVD_TSTMP;
2699 tp->ts_recent = to->to_tsval;
2700 tp->ts_recent_age = tcp_now;
2701 }
2702 break;
2703 case TCPOPT_CC:
2704 if (optlen != TCPOLEN_CC)
2705 continue;
2706 to->to_flag |= TOF_CC;
2707 bcopy((char *)cp + 2,
2708 (char *)&to->to_cc, sizeof(to->to_cc));
2709 NTOHL(to->to_cc);
2710 /*
2711 * A CC or CC.new option received in a SYN makes
2712 * it ok to send CC in subsequent segments.
2713 */
2714 if (th->th_flags & TH_SYN)
2715 tp->t_flags |= TF_RCVD_CC;
2716 break;
2717 case TCPOPT_CCNEW:
2718 if (optlen != TCPOLEN_CC)
2719 continue;
2720 if (!(th->th_flags & TH_SYN))
2721 continue;
2722 to->to_flag |= TOF_CCNEW;
2723 bcopy((char *)cp + 2,
2724 (char *)&to->to_cc, sizeof(to->to_cc));
2725 NTOHL(to->to_cc);
2726 /*
2727 * A CC or CC.new option received in a SYN makes
2728 * it ok to send CC in subsequent segments.
2729 */
2730 tp->t_flags |= TF_RCVD_CC;
2731 break;
2732 case TCPOPT_CCECHO:
2733 if (optlen != TCPOLEN_CC)
2734 continue;
2735 if (!(th->th_flags & TH_SYN))
2736 continue;
2737 to->to_flag |= TOF_CCECHO;
2738 bcopy((char *)cp + 2,
2739 (char *)&to->to_ccecho, sizeof(to->to_ccecho));
2740 NTOHL(to->to_ccecho);
2741 break;
2742 }
2743 }
2744 if (th->th_flags & TH_SYN)
2745 tcp_mss(tp, mss); /* sets t_maxseg */
2746 }
2747
2748 /*
2749 * Pull out of band byte out of a segment so
2750 * it doesn't appear in the user's data queue.
2751 * It is still reflected in the segment length for
2752 * sequencing purposes.
2753 */
2754 static void
2755 tcp_pulloutofband(so, th, m, off)
2756 struct socket *so;
2757 struct tcphdr *th;
2758 register struct mbuf *m;
2759 int off; /* delayed to be droped hdrlen */
2760 {
2761 int cnt = off + th->th_urp - 1;
2762
2763 while (cnt >= 0) {
2764 if (m->m_len > cnt) {
2765 char *cp = mtod(m, caddr_t) + cnt;
2766 struct tcpcb *tp = sototcpcb(so);
2767
2768 tp->t_iobc = *cp;
2769 tp->t_oobflags |= TCPOOB_HAVEDATA;
2770 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2771 m->m_len--;
2772 if (m->m_flags & M_PKTHDR)
2773 m->m_pkthdr.len--;
2774 return;
2775 }
2776 cnt -= m->m_len;
2777 m = m->m_next;
2778 if (m == 0)
2779 break;
2780 }
2781 panic("tcp_pulloutofband");
2782 }
2783
2784 /*
2785 * Collect new round-trip time estimate
2786 * and update averages and current timeout.
2787 */
2788 static void
2789 tcp_xmit_timer(tp, rtt)
2790 register struct tcpcb *tp;
2791 int rtt;
2792 {
2793 register int delta;
2794
2795 tcpstat.tcps_rttupdated++;
2796 tp->t_rttupdated++;
2797 if (tp->t_srtt != 0) {
2798 /*
2799 * srtt is stored as fixed point with 5 bits after the
2800 * binary point (i.e., scaled by 8). The following magic
2801 * is equivalent to the smoothing algorithm in rfc793 with
2802 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2803 * point). Adjust rtt to origin 0.
2804 */
2805 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
2806 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
2807
2808 if ((tp->t_srtt += delta) <= 0)
2809 tp->t_srtt = 1;
2810
2811 /*
2812 * We accumulate a smoothed rtt variance (actually, a
2813 * smoothed mean difference), then set the retransmit
2814 * timer to smoothed rtt + 4 times the smoothed variance.
2815 * rttvar is stored as fixed point with 4 bits after the
2816 * binary point (scaled by 16). The following is
2817 * equivalent to rfc793 smoothing with an alpha of .75
2818 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2819 * rfc793's wired-in beta.
2820 */
2821 if (delta < 0)
2822 delta = -delta;
2823 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
2824 if ((tp->t_rttvar += delta) <= 0)
2825 tp->t_rttvar = 1;
2826 } else {
2827 /*
2828 * No rtt measurement yet - use the unsmoothed rtt.
2829 * Set the variance to half the rtt (so our first
2830 * retransmit happens at 3*rtt).
2831 */
2832 tp->t_srtt = rtt << TCP_RTT_SHIFT;
2833 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
2834 }
2835 tp->t_rtttime = 0;
2836 tp->t_rxtshift = 0;
2837
2838 /*
2839 * the retransmit should happen at rtt + 4 * rttvar.
2840 * Because of the way we do the smoothing, srtt and rttvar
2841 * will each average +1/2 tick of bias. When we compute
2842 * the retransmit timer, we want 1/2 tick of rounding and
2843 * 1 extra tick because of +-1/2 tick uncertainty in the
2844 * firing of the timer. The bias will give us exactly the
2845 * 1.5 tick we need. But, because the bias is
2846 * statistical, we have to test that we don't drop below
2847 * the minimum feasible timer (which is 2 ticks).
2848 */
2849 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2850 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2851
2852 /*
2853 * We received an ack for a packet that wasn't retransmitted;
2854 * it is probably safe to discard any error indications we've
2855 * received recently. This isn't quite right, but close enough
2856 * for now (a route might have failed after we sent a segment,
2857 * and the return path might not be symmetrical).
2858 */
2859 tp->t_softerror = 0;
2860 }
2861
2862 /*
2863 * Determine a reasonable value for maxseg size.
2864 * If the route is known, check route for mtu.
2865 * If none, use an mss that can be handled on the outgoing
2866 * interface without forcing IP to fragment; if bigger than
2867 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2868 * to utilize large mbufs. If no route is found, route has no mtu,
2869 * or the destination isn't local, use a default, hopefully conservative
2870 * size (usually 512 or the default IP max size, but no more than the mtu
2871 * of the interface), as we can't discover anything about intervening
2872 * gateways or networks. We also initialize the congestion/slow start
2873 * window to be a single segment if the destination isn't local.
2874 * While looking at the routing entry, we also initialize other path-dependent
2875 * parameters from pre-set or cached values in the routing entry.
2876 *
2877 * Also take into account the space needed for options that we
2878 * send regularly. Make maxseg shorter by that amount to assure
2879 * that we can send maxseg amount of data even when the options
2880 * are present. Store the upper limit of the length of options plus
2881 * data in maxopd.
2882 *
2883 * NOTE that this routine is only called when we process an incoming
2884 * segment, for outgoing segments only tcp_mssopt is called.
2885 *
2886 * In case of T/TCP, we call this routine during implicit connection
2887 * setup as well (offer = -1), to initialize maxseg from the cached
2888 * MSS of our peer.
2889 */
2890 void
2891 tcp_mss(tp, offer)
2892 struct tcpcb *tp;
2893 int offer;
2894 {
2895 register struct rtentry *rt;
2896 struct ifnet *ifp;
2897 register int rtt, mss;
2898 u_long bufsize;
2899 struct inpcb *inp;
2900 struct socket *so;
2901 struct rmxp_tao *taop;
2902 int origoffer = offer;
2903 #if INET6
2904 int isipv6;
2905 int min_protoh;
2906 #endif
2907
2908 inp = tp->t_inpcb;
2909 #if INET6
2910 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
2911 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
2912 : sizeof (struct tcpiphdr);
2913 #else
2914 #define min_protoh (sizeof (struct tcpiphdr))
2915 #endif
2916 #if INET6
2917 if (isipv6)
2918 rt = tcp_rtlookup6(inp);
2919 else
2920 #endif /* INET6 */
2921 rt = tcp_rtlookup(inp);
2922 if (rt == NULL) {
2923 tp->t_maxopd = tp->t_maxseg =
2924 #if INET6
2925 isipv6 ? tcp_v6mssdflt :
2926 #endif /* INET6 */
2927 tcp_mssdflt;
2928 return;
2929 }
2930 ifp = rt->rt_ifp;
2931 /*
2932 * Slower link window correction:
2933 * If a value is specificied for slowlink_wsize use it for PPP links
2934 * believed to be on a serial modem (speed <128Kbps). Excludes 9600bps as
2935 * it is the default value adversized by pseudo-devices over ppp.
2936 */
2937 if (ifp->if_type == IFT_PPP && slowlink_wsize > 0 &&
2938 ifp->if_baudrate > 9600 && ifp->if_baudrate <= 128000) {
2939 tp->t_flags |= TF_SLOWLINK;
2940 }
2941 so = inp->inp_socket;
2942
2943 taop = rmx_taop(rt->rt_rmx);
2944 /*
2945 * Offer == -1 means that we didn't receive SYN yet,
2946 * use cached value in that case;
2947 */
2948 if (offer == -1)
2949 offer = taop->tao_mssopt;
2950 /*
2951 * Offer == 0 means that there was no MSS on the SYN segment,
2952 * in this case we use tcp_mssdflt.
2953 */
2954 if (offer == 0)
2955 offer =
2956 #if INET6
2957 isipv6 ? tcp_v6mssdflt :
2958 #endif /* INET6 */
2959 tcp_mssdflt;
2960 else {
2961 /*
2962 * Prevent DoS attack with too small MSS. Round up
2963 * to at least minmss.
2964 */
2965 offer = max(offer, tcp_minmss);
2966 /*
2967 * Sanity check: make sure that maxopd will be large
2968 * enough to allow some data on segments even is the
2969 * all the option space is used (40bytes). Otherwise
2970 * funny things may happen in tcp_output.
2971 */
2972 offer = max(offer, 64);
2973 }
2974 taop->tao_mssopt = offer;
2975
2976 /*
2977 * While we're here, check if there's an initial rtt
2978 * or rttvar. Convert from the route-table units
2979 * to scaled multiples of the slow timeout timer.
2980 */
2981 if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
2982 /*
2983 * XXX the lock bit for RTT indicates that the value
2984 * is also a minimum value; this is subject to time.
2985 */
2986 if (rt->rt_rmx.rmx_locks & RTV_RTT)
2987 tp->t_rttmin = rtt / (RTM_RTTUNIT / PR_SLOWHZ);
2988 tp->t_srtt = rtt / (RTM_RTTUNIT / (PR_SLOWHZ * TCP_RTT_SCALE));
2989 tcpstat.tcps_usedrtt++;
2990 if (rt->rt_rmx.rmx_rttvar) {
2991 tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
2992 (RTM_RTTUNIT / (PR_SLOWHZ * TCP_RTTVAR_SCALE));
2993 tcpstat.tcps_usedrttvar++;
2994 } else {
2995 /* default variation is +- 1 rtt */
2996 tp->t_rttvar =
2997 tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
2998 }
2999 TCPT_RANGESET(tp->t_rxtcur,
3000 ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
3001 tp->t_rttmin, TCPTV_REXMTMAX);
3002 }
3003 /*
3004 * if there's an mtu associated with the route, use it
3005 * else, use the link mtu.
3006 */
3007 if (rt->rt_rmx.rmx_mtu)
3008 mss = rt->rt_rmx.rmx_mtu - min_protoh;
3009 else
3010 {
3011 mss =
3012 #if INET6
3013 (isipv6 ? nd_ifinfo[rt->rt_ifp->if_index].linkmtu :
3014 #endif
3015 ifp->if_mtu
3016 #if INET6
3017 )
3018 #endif
3019 - min_protoh;
3020 #if INET6
3021 if (isipv6) {
3022 if (!in6_localaddr(&inp->in6p_faddr))
3023 mss = min(mss, tcp_v6mssdflt);
3024 } else
3025 #endif /* INET6 */
3026 if (!in_localaddr(inp->inp_faddr))
3027 mss = min(mss, tcp_mssdflt);
3028 }
3029 mss = min(mss, offer);
3030 /*
3031 * maxopd stores the maximum length of data AND options
3032 * in a segment; maxseg is the amount of data in a normal
3033 * segment. We need to store this value (maxopd) apart
3034 * from maxseg, because now every segment carries options
3035 * and thus we normally have somewhat less data in segments.
3036 */
3037 tp->t_maxopd = mss;
3038
3039 /*
3040 * In case of T/TCP, origoffer==-1 indicates, that no segments
3041 * were received yet. In this case we just guess, otherwise
3042 * we do the same as before T/TCP.
3043 */
3044 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
3045 (origoffer == -1 ||
3046 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
3047 mss -= TCPOLEN_TSTAMP_APPA;
3048 if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
3049 (origoffer == -1 ||
3050 (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC))
3051 mss -= TCPOLEN_CC_APPA;
3052
3053 /*
3054 * If there's a pipesize (ie loopback), change the socket
3055 * buffer to that size only if it's bigger than the current
3056 * sockbuf size. Make the socket buffers an integral
3057 * number of mss units; if the mss is larger than
3058 * the socket buffer, decrease the mss.
3059 */
3060 #if RTV_SPIPE
3061 bufsize = rt->rt_rmx.rmx_sendpipe;
3062 if (bufsize < so->so_snd.sb_hiwat)
3063 #endif
3064 bufsize = so->so_snd.sb_hiwat;
3065 if (bufsize < mss)
3066 mss = bufsize;
3067 else {
3068 bufsize = roundup(bufsize, mss);
3069 if (bufsize > sb_max)
3070 bufsize = sb_max;
3071 (void)sbreserve(&so->so_snd, bufsize);
3072 }
3073 tp->t_maxseg = mss;
3074
3075 #if RTV_RPIPE
3076 bufsize = rt->rt_rmx.rmx_recvpipe;
3077 if (bufsize < so->so_rcv.sb_hiwat)
3078 #endif
3079 bufsize = so->so_rcv.sb_hiwat;
3080 if (bufsize > mss) {
3081 bufsize = roundup(bufsize, mss);
3082 if (bufsize > sb_max)
3083 bufsize = sb_max;
3084 (void)sbreserve(&so->so_rcv, bufsize);
3085 }
3086
3087 /*
3088 * Set the slow-start flight size depending on whether this
3089 * is a local network or not.
3090 */
3091 if (
3092 #if INET6
3093 (isipv6 && in6_localaddr(&inp->in6p_faddr)) ||
3094 (!isipv6 &&
3095 #endif
3096 in_localaddr(inp->inp_faddr)
3097 #if INET6
3098 )
3099 #endif
3100 )
3101 tp->snd_cwnd = mss * ss_fltsz_local;
3102 else
3103 tp->snd_cwnd = mss * ss_fltsz;
3104
3105 if (rt->rt_rmx.rmx_ssthresh) {
3106 /*
3107 * There's some sort of gateway or interface
3108 * buffer limit on the path. Use this to set
3109 * the slow start threshhold, but set the
3110 * threshold to no less than 2*mss.
3111 */
3112 tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
3113 tcpstat.tcps_usedssthresh++;
3114 }
3115 }
3116
3117 /*
3118 * Determine the MSS option to send on an outgoing SYN.
3119 */
3120 int
3121 tcp_mssopt(tp)
3122 struct tcpcb *tp;
3123 {
3124 struct rtentry *rt;
3125 #if INET6
3126 int isipv6;
3127 int min_protoh;
3128 #endif
3129
3130 #if INET6
3131 isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
3132 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
3133 : sizeof (struct tcpiphdr);
3134 #else
3135 #define min_protoh (sizeof (struct tcpiphdr))
3136 #endif
3137 #if INET6
3138 if (isipv6)
3139 rt = tcp_rtlookup6(tp->t_inpcb);
3140 else
3141 #endif /* INET6 */
3142 rt = tcp_rtlookup(tp->t_inpcb);
3143 if (rt == NULL)
3144 return
3145 #if INET6
3146 isipv6 ? tcp_v6mssdflt :
3147 #endif /* INET6 */
3148 tcp_mssdflt;
3149 /*
3150 * Slower link window correction:
3151 * If a value is specificied for slowlink_wsize use it for PPP links
3152 * believed to be on a serial modem (speed <128Kbps). Excludes 9600bps as
3153 * it is the default value adversized by pseudo-devices over ppp.
3154 */
3155 if (rt->rt_ifp->if_type == IFT_PPP && slowlink_wsize > 0 &&
3156 rt->rt_ifp->if_baudrate > 9600 && rt->rt_ifp->if_baudrate <= 128000) {
3157 tp->t_flags |= TF_SLOWLINK;
3158 }
3159
3160 return rt->rt_ifp->if_mtu - min_protoh;
3161 }
3162
3163
3164 /*
3165 * Checks for partial ack. If partial ack arrives, force the retransmission
3166 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return
3167 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to
3168 * be started again. If the ack advances at least to tp->snd_recover, return 0.
3169 */
3170 static int
3171 tcp_newreno(tp, th)
3172 struct tcpcb *tp;
3173 struct tcphdr *th;
3174 {
3175 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
3176 tcp_seq onxt = tp->snd_nxt;
3177 u_long ocwnd = tp->snd_cwnd;
3178 #ifdef __APPLE__
3179 tp->t_timer[TCPT_REXMT] = 0;
3180 #else
3181 callout_stop(tp->tt_rexmt);
3182 #endif
3183 tp->t_rtttime = 0;
3184 tp->snd_nxt = th->th_ack;
3185 /*
3186 * Set snd_cwnd to one segment beyond acknowledged offset
3187 * (tp->snd_una has not yet been updated when this function
3188 * is called)
3189 */
3190 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
3191 (void) tcp_output(tp);
3192 tp->snd_cwnd = ocwnd;
3193 if (SEQ_GT(onxt, tp->snd_nxt))
3194 tp->snd_nxt = onxt;
3195 /*
3196 * Partial window deflation. Relies on fact that tp->snd_una
3197 * not updated yet.
3198 */
3199 tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_maxseg);
3200 return (1);
3201 }
3202 return (0);
3203 }
mirror of XNU