xnu-1504.9.26.tar.gz

[apple/xnu.git] / bsd / netinet / tcp_input.c

diff --git a/bsd/netinet/tcp_input.c b/bsd/netinet/tcp_input.c
index 138bcb3c7e438b2a050611653ee5eb3a7a62a8b2..b65e9d5c6d2373aa9151e10552196436d8b1e7d5 100644 (file)
--- a/bsd/netinet/tcp_input.c
+++ b/bsd/netinet/tcp_input.c
@@ -81,6 +81,8 @@
 
 #include <kern/cpu_number.h>   /* before tcp_seq.h, for tcp_random18() */
 
 
 #include <kern/cpu_number.h>   /* before tcp_seq.h, for tcp_random18() */
 

+#include <machine/endian.h>
+

 #include <net/if.h>
 #include <net/if_types.h>
 #include <net/route.h>
 #include <net/if.h>
 #include <net/if_types.h>
 #include <net/route.h>


@@ -201,9 +203,20 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, maxseg_unacked, CTLFLAG_RW,
 static int     tcp_do_rfc3465 = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3465, CTLFLAG_RW,
        &tcp_do_rfc3465, 0, "");
 static int     tcp_do_rfc3465 = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3465, CTLFLAG_RW,
        &tcp_do_rfc3465, 0, "");

+
+static int     tcp_do_rfc3465_lim2 = 1;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, rfc3465_lim2, CTLFLAG_RW,
+       &tcp_do_rfc3465_lim2, 0, "Appropriate bytes counting w/ L=2*SMSS");
+
+#if CONFIG_IFEF_NOWINDOWSCALE
+int tcp_obey_ifef_nowindowscale = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, obey_ifef_nowindowscale, CTLFLAG_RW,
+       &tcp_obey_ifef_nowindowscale, 0, "");
+#endif
+

 extern int tcp_TCPTV_MIN;
 
 extern int tcp_TCPTV_MIN;
 

-u_long tcp_now;
+u_int32_t tcp_now;

 
 struct inpcbhead tcb;
 #define        tcb6    tcb  /* for KAME src sync over BSD*'s */
 
 struct inpcbhead tcb;
 #define        tcb6    tcb  /* for KAME src sync over BSD*'s */


@@ -234,7 +247,7 @@ do { \
 #define ND6_HINT(tp)
 #endif
 
 #define ND6_HINT(tp)
 #endif
 

-extern u_long  *delack_bitmask;
+extern u_int32_t       *delack_bitmask;

 
 extern void    add_to_time_wait(struct tcpcb *);
 extern void postevent(struct socket *, struct sockbuf *, int);
 
 extern void    add_to_time_wait(struct tcpcb *);
 extern void postevent(struct socket *, struct sockbuf *, int);


@@ -544,7 +557,7 @@ tcp_input(m, off0)
        int dropsocket = 0;
        int iss = 0;
        int nosock = 0;
        int dropsocket = 0;
        int iss = 0;
        int nosock = 0;

-       u_long tiwin;
+       u_int32_t tiwin;

        struct tcpopt to;               /* options in this segment */
        struct sockaddr_in *next_hop = NULL;
 #if TCPDEBUG
        struct tcpopt to;               /* options in this segment */
        struct sockaddr_in *next_hop = NULL;
 #if TCPDEBUG


@@ -567,7 +580,12 @@ tcp_input(m, off0)
                ifscope = IFSCOPE_NONE;
 
        /* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */
                ifscope = IFSCOPE_NONE;
 
        /* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */

-       fwd_tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_IPFORWARD, NULL);
+       if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
+               fwd_tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID,
+                   KERNEL_TAG_TYPE_IPFORWARD, NULL);
+       } else {
+               fwd_tag = NULL;
+       }

        if (fwd_tag != NULL) {
                struct ip_fwd_tag *ipfwd_tag = (struct ip_fwd_tag *)(fwd_tag+1);
                
        if (fwd_tag != NULL) {
                struct ip_fwd_tag *ipfwd_tag = (struct ip_fwd_tag *)(fwd_tag+1);
                


@@ -658,7 +676,11 @@ tcp_input(m, off0)
                        
                        bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
                        ipov->ih_len = (u_short)tlen;
                        
                        bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
                        ipov->ih_len = (u_short)tlen;

+
+#if BYTE_ORDER != BIG_ENDIAN

                        HTONS(ipov->ih_len);
                        HTONS(ipov->ih_len);

+#endif
+

                        pseudo = in_cksum(m, sizeof (struct ip));
                        
                        *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];
                        pseudo = in_cksum(m, sizeof (struct ip));
                        
                        *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];


@@ -687,7 +709,11 @@ tcp_input(m, off0)
                len = sizeof (struct ip) + tlen;
                bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
                ipov->ih_len = (u_short)tlen;
                len = sizeof (struct ip) + tlen;
                bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
                ipov->ih_len = (u_short)tlen;

+
+#if BYTE_ORDER != BIG_ENDIAN

                HTONS(ipov->ih_len);
                HTONS(ipov->ih_len);

+#endif
+

                th->th_sum = in_cksum(m, len);
                
                *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];
                th->th_sum = in_cksum(m, len);
                
                *(uint32_t*)&ipov->ih_x1[0] = *(uint32_t*)&b[0];


@@ -773,10 +799,13 @@ tcp_input(m, off0)
        /*
         * Convert TCP protocol specific fields to host format.
         */
        /*
         * Convert TCP protocol specific fields to host format.
         */

+
+#if BYTE_ORDER != BIG_ENDIAN

        NTOHL(th->th_seq);
        NTOHL(th->th_ack);
        NTOHS(th->th_win);
        NTOHS(th->th_urp);
        NTOHL(th->th_seq);
        NTOHL(th->th_ack);
        NTOHS(th->th_win);
        NTOHS(th->th_urp);

+#endif

 
        /*
         * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options,
 
        /*
         * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options,


@@ -848,12 +877,16 @@ findpcb:
                if (isipv6) {
                        if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
                                IPSEC_STAT_INCREMENT(ipsec6stat.in_polvio);
                if (isipv6) {
                        if (inp != NULL && ipsec6_in_reject_so(m, inp->inp_socket)) {
                                IPSEC_STAT_INCREMENT(ipsec6stat.in_polvio);

+                               if (in_pcb_checkstate(inp, WNT_RELEASE, 0) == WNT_STOPUSING) 
+                                       inp = NULL;     // pretend we didn't find it 

                                goto dropnosock;
                        }
                } else
 #endif /* INET6 */
                        if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
                                goto dropnosock;
                        }
                } else
 #endif /* INET6 */
                        if (inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {

-                         IPSEC_STAT_INCREMENT(ipsecstat.in_polvio);
+                               IPSEC_STAT_INCREMENT(ipsecstat.in_polvio);
+                               if (in_pcb_checkstate(inp, WNT_RELEASE, 0) == WNT_STOPUSING) 
+                                       inp = NULL;     // pretend we didn't find it 

                                goto dropnosock;
                        }
        }
                                goto dropnosock;
                        }
        }


@@ -936,26 +969,21 @@ findpcb:
        }
        so = inp->inp_socket;
        if (so == NULL) {
        }
        so = inp->inp_socket;
        if (so == NULL) {

-               if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) 
-                       inp = NULL;     // pretend we didn't find it 
+               /* This case shouldn't happen  as the socket shouldn't be null
+                * if inp_state isn't set to INPCB_STATE_DEAD
+                * But just in case, we pretend we didn't find the socket if we hit this case
+                * as this isn't cause for a panic (the socket might be leaked however)...
+                */
+               inp = NULL;

 #if TEMPDEBUG
 #if TEMPDEBUG

-               printf("tcp_input: no more socket for inp=%x\n", inp);
+               printf("tcp_input: no more socket for inp=%x. This shouldn't happen\n", inp);

 #endif
                goto dropnosock;
        }
 
 #endif
                goto dropnosock;
        }
 

-#ifdef __APPLE__
-        /* 
-         * Bogus state when listening port owned by SharedIP with loopback as the 
-         * only configured interface: BlueBox does not filters loopback
-         */ 
-       if (so == &tcbinfo.nat_dummy_socket)
-               goto drop;
-
-#endif
-       tcp_lock(so, 1, 2);
+       tcp_lock(so, 1, (void *)2);

        if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
        if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {

-               tcp_unlock(so, 1, 2);
+               tcp_unlock(so, 1, (void *)2);

                inp = NULL;     // pretend we didn't find it 
                goto dropnosock;
        }
                inp = NULL;     // pretend we didn't find it 
                goto dropnosock;
        }


@@ -979,6 +1007,10 @@ findpcb:
                goto drop;
 #endif
 
                goto drop;
 #endif
 

+       /* Radar 7377561: Avoid processing packets while closing a listen socket */
+       if (tp->t_state == TCPS_LISTEN && (so->so_options & SO_ACCEPTCONN) == 0) 
+               goto drop;
+

        if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
 #if TCPDEBUG
                if (so->so_options & SO_DEBUG) {
        if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
 #if TCPDEBUG
                if (so->so_options & SO_DEBUG) {


@@ -1001,33 +1033,68 @@ findpcb:
 #if INET6
                        struct inpcb *oinp = sotoinpcb(so);
 #endif /* INET6 */
 #if INET6
                        struct inpcb *oinp = sotoinpcb(so);
 #endif /* INET6 */

-                       int ogencnt = so->so_gencnt;

                        unsigned int head_ifscope;
 
                        /* Get listener's bound-to-interface, if any */
                        head_ifscope = (inp->inp_flags & INP_BOUND_IF) ?
                            inp->inp_boundif : IFSCOPE_NONE;
 
                        unsigned int head_ifscope;
 
                        /* Get listener's bound-to-interface, if any */
                        head_ifscope = (inp->inp_flags & INP_BOUND_IF) ?
                            inp->inp_boundif : IFSCOPE_NONE;
 

-#if !IPSEC

                        /*
                        /*

-                        * Current IPsec implementation makes incorrect IPsec
-                        * cache if this check is done here.
-                        * So delay this until duplicated socket is created.
+                        * If the state is LISTEN then ignore segment if it contains an RST.
+                        * If the segment contains an ACK then it is bad and send a RST.
+                        * If it does not contain a SYN then it is not interesting; drop it.
+                        * If it is from this socket, drop it, it must be forged.

                         */
                        if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
                         */
                        if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {

-                               /*
-                                * Note: dropwithreset makes sure we don't
-                                * send a RST in response to a RST.
-                                */
+                               if (thflags & TH_RST) {
+                                       goto drop;
+                               }

                                if (thflags & TH_ACK) {
                                if (thflags & TH_ACK) {

+                                       tp = NULL;

                                        tcpstat.tcps_badsyn++;
                                        rstreason = BANDLIM_RST_OPENPORT;
                                        goto dropwithreset;
                                }
                                        tcpstat.tcps_badsyn++;
                                        rstreason = BANDLIM_RST_OPENPORT;
                                        goto dropwithreset;
                                }

+
+                               /* We come here if there is no SYN set */
+                               tcpstat.tcps_badsyn++;

                                goto drop;
                        }
                                goto drop;
                        }

-#endif

                        KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_START,0,0,0,0,0);
                        KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_START,0,0,0,0,0);

+                       if (th->th_dport == th->th_sport) {
+#if INET6
+                               if (isipv6) {
+                                       if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
+                                                       &ip6->ip6_src))
+                                               goto drop;
+                               } else
+#endif /* INET6 */
+                                       if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
+                                               goto drop;
+                       }
+                       /*
+                        * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
+                        * in_broadcast() should never return true on a received
+                        * packet with M_BCAST not set.
+                        *
+                        * Packets with a multicast source address should also
+                        * be discarded.
+                        */
+                       if (m->m_flags & (M_BCAST|M_MCAST))
+                               goto drop;
+#if INET6
+                       if (isipv6) {
+                               if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
+                                       IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
+                                       goto drop;
+                       } else
+#endif
+                       if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
+                               IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
+                               ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
+                               in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
+                               goto drop;
+

 
 #if INET6
                        /*
 
 #if INET6
                        /*


@@ -1108,12 +1175,10 @@ findpcb:
                                if (!so2) 
                                        goto drop;
                        }
                                if (!so2) 
                                        goto drop;
                        }

-                       /*
-                        * Make sure listening socket did not get closed during socket allocation,
-                        * not only this is incorrect but it is know to cause panic
-                        */
-                       if (so->so_gencnt != ogencnt)
-                               goto drop;
+
+                       /* Point "inp" and "tp" in tandem to new socket */
+                       inp = (struct inpcb *)so2->so_pcb;
+                       tp = intotcpcb(inp);

 
                        oso = so;
                        tcp_unlock(so, 0, 0); /* Unlock but keep a reference on listener for now */
 
                        oso = so;
                        tcp_unlock(so, 0, 0); /* Unlock but keep a reference on listener for now */


@@ -1121,8 +1186,6 @@ findpcb:
                        so = so2;
                        tcp_lock(so, 1, 0);
                        /*
                        so = so2;
                        tcp_lock(so, 1, 0);
                        /*

-                        * This is ugly, but ....
-                        *

                         * Mark socket as temporary until we're
                         * committed to keeping it.  The code at
                         * ``drop'' and ``dropwithreset'' check the
                         * Mark socket as temporary until we're
                         * committed to keeping it.  The code at
                         * ``drop'' and ``dropwithreset'' check the


@@ -1130,10 +1193,10 @@ findpcb:
                         * socket created here should be discarded.
                         * We mark the socket as discardable until
                         * we're committed to it below in TCPS_LISTEN.
                         * socket created here should be discarded.
                         * We mark the socket as discardable until
                         * we're committed to it below in TCPS_LISTEN.

+                        * There are some error conditions in which we
+                        * have to drop the temporary socket.

                         */
                        dropsocket++;
                         */
                        dropsocket++;

-                       inp = (struct inpcb *)so->so_pcb;
-

                        /*
                         * Inherit INP_BOUND_IF from listener; testing if
                         * head_ifscope is non-zero is sufficient, since it
                        /*
                         * Inherit INP_BOUND_IF from listener; testing if
                         * head_ifscope is non-zero is sufficient, since it


@@ -1155,7 +1218,7 @@ findpcb:
                                inp->inp_vflag &= ~INP_IPV6;
                                inp->inp_vflag |= INP_IPV4;
 #endif /* INET6 */
                                inp->inp_vflag &= ~INP_IPV6;
                                inp->inp_vflag |= INP_IPV4;
 #endif /* INET6 */

-                       inp->inp_laddr = ip->ip_dst;
+                               inp->inp_laddr = ip->ip_dst;

 #if INET6
                        }
 #endif /* INET6 */
 #if INET6
                        }
 #endif /* INET6 */


@@ -1176,30 +1239,6 @@ findpcb:
                                tcp_unlock(oso, 1, 0);
                                goto drop;
                        }
                                tcp_unlock(oso, 1, 0);
                                goto drop;
                        }

-#if IPSEC
-                       /*
-                        * To avoid creating incorrectly cached IPsec
-                        * association, this is need to be done here.
-                        *
-                        * Subject: (KAME-snap 748)
-                        * From: Wayne Knowles <w.knowles@niwa.cri.nz>
-                        * ftp://ftp.kame.net/pub/mail-list/snap-users/748
-                        */
-                       if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
-                               /*
-                                * Note: dropwithreset makes sure we don't
-                                * send a RST in response to a RST.
-                                */
-                               tcp_lock(oso, 0, 0);    /* release ref on parent */
-                               tcp_unlock(oso, 1, 0);
-                               if (thflags & TH_ACK) {
-                                       tcpstat.tcps_badsyn++;
-                                       rstreason = BANDLIM_RST_OPENPORT;
-                                       goto dropwithreset;
-                               }
-                               goto drop;
-                       }
-#endif

 #if INET6
                        if (isipv6) {
                                /*
 #if INET6
                        if (isipv6) {
                                /*


@@ -1237,15 +1276,19 @@ findpcb:
                                        printf("tcp_input: could not copy policy\n");
                        }
 #endif
                                        printf("tcp_input: could not copy policy\n");
                        }
 #endif

-                       tcp_unlock(oso, 1, 0);  /* now drop the reference on the listener */
-                       tp = intotcpcb(inp);
+                       /* inherit states from the listener */

                        tp->t_state = TCPS_LISTEN;
                        tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT|TF_NODELAY);
                        tp->t_state = TCPS_LISTEN;
                        tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT|TF_NODELAY);

+                       tp->t_keepinit = tp0->t_keepinit;

                        tp->t_inpcb->inp_ip_ttl = tp0->t_inpcb->inp_ip_ttl;
                        tp->t_inpcb->inp_ip_ttl = tp0->t_inpcb->inp_ip_ttl;

+
+                       /* now drop the reference on the listener */
+                       tcp_unlock(oso, 1, 0);
+

                        /* Compute proper scaling value from buffer space */
                        if (inp->inp_pcbinfo->ipi_count < tcp_sockthreshold) {
                                tp->request_r_scale = max(tcp_win_scale, tp->request_r_scale);
                        /* Compute proper scaling value from buffer space */
                        if (inp->inp_pcbinfo->ipi_count < tcp_sockthreshold) {
                                tp->request_r_scale = max(tcp_win_scale, tp->request_r_scale);

-                               so->so_rcv.sb_hiwat = lmin(TCP_MAXWIN << tp->request_r_scale, (sb_max / (MSIZE+MCLBYTES)) * MCLBYTES);  
+                               so->so_rcv.sb_hiwat = imin(TCP_MAXWIN << tp->request_r_scale, (sb_max / (MSIZE+MCLBYTES)) * MCLBYTES);  

                        }
                        else {
                                while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
                        }
                        else {
                                while (tp->request_r_scale < TCP_MAX_WINSHIFT &&


@@ -1257,7 +1300,6 @@ findpcb:
                        KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_END,0,0,0,0,0);
                }
        }
                        KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_END,0,0,0,0,0);
                }
        }

-

 #if 1
        lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
 #endif
 #if 1
        lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
 #endif


@@ -1306,7 +1348,7 @@ findpcb:
                                if ((tp->rcv_byps / tp->rcv_pps) < tcp_minmss) {
                                        char    ipstrbuf[MAX_IPv6_STR_LEN];
                                        printf("too many small tcp packets from "
                                if ((tp->rcv_byps / tp->rcv_pps) < tcp_minmss) {
                                        char    ipstrbuf[MAX_IPv6_STR_LEN];
                                        printf("too many small tcp packets from "

-                                              "%s:%u, av. %lubyte/packet, "
+                                              "%s:%u, av. %ubyte/packet, "

                                               "dropping connection\n",
 #if INET6
                                                isipv6 ?
                                               "dropping connection\n",
 #if INET6
                                                isipv6 ?


@@ -1330,7 +1372,7 @@ findpcb:
        }
        
 #if TRAFFIC_MGT
        }
        
 #if TRAFFIC_MGT

-       if (so->so_traffic_mgt_flags & TRAFFIC_MGT_SO_BACKGROUND) {
+       if (so->so_traffic_mgt_flags & TRAFFIC_MGT_SO_BG_REGULATE) {

                tcpstat.tcps_bg_rcvtotal++;
 
                 /* Take snapshots of pkts recv;
                tcpstat.tcps_bg_rcvtotal++;
 
                 /* Take snapshots of pkts recv;


@@ -1636,12 +1678,7 @@ findpcb:
        switch (tp->t_state) {
 
        /*
        switch (tp->t_state) {
 
        /*

-        * If the state is LISTEN then ignore segment if it contains an RST.
-        * If the segment contains an ACK then it is bad and send a RST.
-        * If it does not contain a SYN then it is not interesting; drop it.
-        * If it is from this socket, drop it, it must be forged.
-        * Don't bother responding if the destination was a broadcast.
-        * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
+        * Initialize tp->rcv_nxt, and tp->irs, select an initial

         * tp->iss, and send a segment:
         *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
         * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
         * tp->iss, and send a segment:
         *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
         * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.


@@ -1658,47 +1695,6 @@ findpcb:
 #if 1
                lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
 #endif
 #if 1
                lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
 #endif

-               if (thflags & TH_RST) 
-                       goto drop;
-               if (thflags & TH_ACK) {
-                       rstreason = BANDLIM_RST_OPENPORT;
-                       goto dropwithreset;
-               }
-               if ((thflags & TH_SYN) == 0)
-                       goto drop;
-               if (th->th_dport == th->th_sport) {
-#if INET6
-                       if (isipv6) {
-                               if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
-                                                      &ip6->ip6_src))
-                                       goto drop;
-                       } else
-#endif /* INET6 */
-                       if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
-                               goto drop;
-               }
-               /*
-                * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
-                * in_broadcast() should never return true on a received
-                * packet with M_BCAST not set.
-                *
-                * Packets with a multicast source address should also
-                * be discarded.
-                */
-               if (m->m_flags & (M_BCAST|M_MCAST))
-                       goto drop;
-#if INET6
-               if (isipv6) {
-                       if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
-                           IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
-                               goto drop;
-               } else
-#endif
-               if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
-                   IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
-                   ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
-                   in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
-                       goto drop;

 #if INET6
                if (isipv6) {
                        MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
 #if INET6
                if (isipv6) {
                        MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,


@@ -1773,19 +1769,18 @@ findpcb:
                tp->t_flags |= TF_ACKNOW;
                tp->t_unacksegs = 0;
                tp->t_state = TCPS_SYN_RECEIVED;
                tp->t_flags |= TF_ACKNOW;
                tp->t_unacksegs = 0;
                tp->t_state = TCPS_SYN_RECEIVED;

-               tp->t_timer[TCPT_KEEP] = tcp_keepinit;
+               tp->t_timer[TCPT_KEEP] = tp->t_keepinit ? tp->t_keepinit : tcp_keepinit;

                dropsocket = 0;         /* committed to socket */
                tcpstat.tcps_accepts++;
                if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE | TH_CWR)) {
                        /* ECN-setup SYN */
                        tp->ecn_flags |= (TE_SETUPRECEIVED | TE_SENDIPECT);
                }
                dropsocket = 0;         /* committed to socket */
                tcpstat.tcps_accepts++;
                if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE | TH_CWR)) {
                        /* ECN-setup SYN */
                        tp->ecn_flags |= (TE_SETUPRECEIVED | TE_SENDIPECT);
                }

-#ifdef IFEF_NOWINDOWSCALE
-               if (m->m_pkthdr.rcvif != NULL &&
-                       (m->m_pkthdr.rcvif->if_eflags & IFEF_NOWINDOWSCALE) != 0)
-               {
-                       // Timestamps are not enabled on this interface
-                       tp->t_flags &= ~(TF_REQ_SCALE);
+#if CONFIG_IFEF_NOWINDOWSCALE
+               if (tcp_obey_ifef_nowindowscale && m->m_pkthdr.rcvif != NULL &&
+                   (m->m_pkthdr.rcvif->if_eflags & IFEF_NOWINDOWSCALE)) {
+                       /* Window scaling is not enabled on this interface */
+                       tp->t_flags &= ~TF_REQ_SCALE;

                }
 #endif
                goto trimthenstep6;
                }
 #endif
                goto trimthenstep6;


@@ -2447,7 +2442,10 @@ trimthenstep6:
                                tp->t_dupacks = 0;
                        break;
                }
                                tp->t_dupacks = 0;
                        break;
                }

-
+               /*
+                * If the congestion window was inflated to account
+                * for the other side's cached packets, retract it.
+                */

                if (!IN_FASTRECOVERY(tp)) {
                        /*
                         * We were not in fast recovery.  Reset the duplicate ack
                if (!IN_FASTRECOVERY(tp)) {
                        /*
                         * We were not in fast recovery.  Reset the duplicate ack


@@ -2469,7 +2467,7 @@ trimthenstep6:
                                }
                                else {
                                        if (tcp_do_newreno) {
                                }
                                else {
                                        if (tcp_do_newreno) {

-                                               long ss = tp->snd_max - th->th_ack;
+                                               int32_t ss = tp->snd_max - th->th_ack;

        
                                                /*
                                                 * Complete ack.  Inflate the congestion window to
        
                                                /*
                                                 * Complete ack.  Inflate the congestion window to


@@ -2632,30 +2630,47 @@ process_ACK:
                        register u_int cw = tp->snd_cwnd;
                        register u_int incr = tp->t_maxseg;
 
                        register u_int cw = tp->snd_cwnd;
                        register u_int incr = tp->t_maxseg;
 

-                       if (cw >= tp->snd_ssthresh) {
-                               tp->t_bytes_acked += acked;
-                               if (tp->t_bytes_acked >= cw) {
+                       if (tcp_do_rfc3465) {
+
+                               if (cw >= tp->snd_ssthresh) {
+                                       tp->t_bytes_acked += acked;
+                                       if (tp->t_bytes_acked >= cw) {

                                        /* Time to increase the window. */
                                        /* Time to increase the window. */

-                                       tp->t_bytes_acked -= cw;
-                               } else {
+                                               tp->t_bytes_acked -= cw;
+                                       } else {

                                        /* No need to increase yet. */
                                        /* No need to increase yet. */

-                                       incr = 0;
+                                               incr = 0;
+                                       }
+                               } else {
+                                       /*
+                                        * If the user explicitly enables RFC3465
+                                        * use 2*SMSS for the "L" param.  Otherwise
+                                        * use the more conservative 1*SMSS.
+                                        *
+                                        * (See RFC 3465 2.3 Choosing the Limit)
+                                        */
+                                       u_int abc_lim;
+
+                                       abc_lim = (tcp_do_rfc3465_lim2 &&
+                                               tp->snd_nxt == tp->snd_max) ? incr * 2 : incr;
+
+                                       incr = lmin(acked, abc_lim);

                                }
                                }

-                       } else {
+                       }
+                       else {

                                /*
                                /*

-                                * If the user explicitly enables RFC3465
-                                * use 2*SMSS for the "L" param.  Otherwise
-                                * use the more conservative 1*SMSS.
-                                *
-                                * (See RFC 3465 2.3 Choosing the Limit)
+                                * If the window gives us less than ssthresh packets
+                                * in flight, open exponentially (segsz per packet).
+                                * Otherwise open linearly: segsz per window
+                                * (segsz^2 / cwnd per packet).

                                 */
                                 */

-                               u_int abc_lim;
-
-                               abc_lim = (tcp_do_rfc3465 == 0) ?
-                                   incr : incr * 2;
-                               incr = min(acked, abc_lim);
+               
+                                       if (cw >= tp->snd_ssthresh) {
+                                               incr = max((incr * incr / cw), 1);
+                                       }

                        }
 
                        }
 

+

                        tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale);
                }
                if (acked > so->so_snd.sb_cc) {
                        tp->snd_cwnd = min(cw+incr, TCP_MAXWIN<<tp->snd_scale);
                }
                if (acked > so->so_snd.sb_cc) {


@@ -2730,7 +2745,7 @@ process_ACK:
                                tcp_canceltimers(tp);
                                /* Shorten TIME_WAIT [RFC-1644, p.28] */
                                if (tp->cc_recv != 0 &&
                                tcp_canceltimers(tp);
                                /* Shorten TIME_WAIT [RFC-1644, p.28] */
                                if (tp->cc_recv != 0 &&

-                                   tp->t_starttime < (u_long)tcp_msl)
+                                   tp->t_starttime < (u_int32_t)tcp_msl)

                                        tp->t_timer[TCPT_2MSL] =
                                            tp->t_rxtcur * TCPTV_TWTRUNC;
                                else
                                        tp->t_timer[TCPT_2MSL] =
                                            tp->t_rxtcur * TCPTV_TWTRUNC;
                                else


@@ -2834,7 +2849,7 @@ step6:
                 * but if two URG's are pending at once, some out-of-band
                 * data may creep in... ick.
                 */
                 * but if two URG's are pending at once, some out-of-band
                 * data may creep in... ick.
                 */

-               if (th->th_urp <= (u_long)tlen
+               if (th->th_urp <= (u_int32_t)tlen

 #if SO_OOBINLINE
                     && (so->so_options & SO_OOBINLINE) == 0
 #endif
 #if SO_OOBINLINE
                     && (so->so_options & SO_OOBINLINE) == 0
 #endif


@@ -2990,7 +3005,7 @@ dodata:                                                   /* XXX */
                        tcp_canceltimers(tp);
                        /* Shorten TIME_WAIT [RFC-1644, p.28] */
                        if (tp->cc_recv != 0 &&
                        tcp_canceltimers(tp);
                        /* Shorten TIME_WAIT [RFC-1644, p.28] */
                        if (tp->cc_recv != 0 &&

-                           tp->t_starttime < (u_long)tcp_msl) {
+                           tp->t_starttime < (u_int32_t)tcp_msl) {

                                tp->t_timer[TCPT_2MSL] =
                                    tp->t_rxtcur * TCPTV_TWTRUNC;
                                /* For transaction client, force ACK now. */
                                tp->t_timer[TCPT_2MSL] =
                                    tp->t_rxtcur * TCPTV_TWTRUNC;
                                /* For transaction client, force ACK now. */


@@ -3185,7 +3200,11 @@ tcp_dooptions(tp, cp, cnt, th, to, input_ifscope)
                        if (!(th->th_flags & TH_SYN))
                                continue;
                        bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
                        if (!(th->th_flags & TH_SYN))
                                continue;
                        bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));

+
+#if BYTE_ORDER != BIG_ENDIAN

                        NTOHS(mss);
                        NTOHS(mss);

+#endif
+

                        break;
 
                case TCPOPT_WINDOW:
                        break;
 
                case TCPOPT_WINDOW:


@@ -3203,10 +3222,17 @@ tcp_dooptions(tp, cp, cnt, th, to, input_ifscope)
                        to->to_flags |= TOF_TS;
                        bcopy((char *)cp + 2,
                            (char *)&to->to_tsval, sizeof(to->to_tsval));
                        to->to_flags |= TOF_TS;
                        bcopy((char *)cp + 2,
                            (char *)&to->to_tsval, sizeof(to->to_tsval));

+
+#if BYTE_ORDER != BIG_ENDIAN

                        NTOHL(to->to_tsval);
                        NTOHL(to->to_tsval);

+#endif
+

                        bcopy((char *)cp + 6,
                            (char *)&to->to_tsecr, sizeof(to->to_tsecr));
                        bcopy((char *)cp + 6,
                            (char *)&to->to_tsecr, sizeof(to->to_tsecr));

+
+#if BYTE_ORDER != BIG_ENDIAN

                        NTOHL(to->to_tsecr);
                        NTOHL(to->to_tsecr);

+#endif

 
                        /*
                         * A timestamp received in a SYN makes
 
                        /*
                         * A timestamp received in a SYN makes


@@ -3361,6 +3387,7 @@ tcp_maxmtu(struct rtentry *rt)
 {
        unsigned int maxmtu;
 
 {
        unsigned int maxmtu;
 

+       RT_LOCK_ASSERT_HELD(rt);

        if (rt->rt_rmx.rmx_mtu == 0)
                maxmtu = rt->rt_ifp->if_mtu;
        else
        if (rt->rt_rmx.rmx_mtu == 0)
                maxmtu = rt->rt_ifp->if_mtu;
        else


@@ -3375,10 +3402,13 @@ tcp_maxmtu6(struct rtentry *rt)
 {
        unsigned int maxmtu;
 
 {
        unsigned int maxmtu;
 

+       RT_LOCK_ASSERT_HELD(rt);
+       lck_rw_lock_shared(nd_if_rwlock);

        if (rt->rt_rmx.rmx_mtu == 0)
                maxmtu = IN6_LINKMTU(rt->rt_ifp);
        else
                maxmtu = MIN(rt->rt_rmx.rmx_mtu, IN6_LINKMTU(rt->rt_ifp));
        if (rt->rt_rmx.rmx_mtu == 0)
                maxmtu = IN6_LINKMTU(rt->rt_ifp);
        else
                maxmtu = MIN(rt->rt_rmx.rmx_mtu, IN6_LINKMTU(rt->rt_ifp));

+       lck_rw_done(nd_if_rwlock);

 
        return (maxmtu);
 }
 
        return (maxmtu);
 }


@@ -3418,12 +3448,12 @@ tcp_mss(tp, offer, input_ifscope)
        register struct rtentry *rt;
        struct ifnet *ifp;
        register int rtt, mss;
        register struct rtentry *rt;
        struct ifnet *ifp;
        register int rtt, mss;

-       u_long bufsize;
+       u_int32_t bufsize;

        struct inpcb *inp;
        struct socket *so;
        struct rmxp_tao *taop;
        int origoffer = offer;
        struct inpcb *inp;
        struct socket *so;
        struct rmxp_tao *taop;
        int origoffer = offer;

-       u_long sb_max_corrected;
+       u_int32_t sb_max_corrected;

        int isnetlocal = 0;
 #if INET6
        int isipv6;
        int isnetlocal = 0;
 #if INET6
        int isipv6;


@@ -3438,19 +3468,23 @@ tcp_mss(tp, offer, input_ifscope)
 #else
 #define min_protoh  (sizeof (struct tcpiphdr))
 #endif
 #else
 #define min_protoh  (sizeof (struct tcpiphdr))
 #endif

-       lck_mtx_lock(rt_mtx);
+

 #if INET6
        if (isipv6) {
                rt = tcp_rtlookup6(inp);
 #if INET6
        if (isipv6) {
                rt = tcp_rtlookup6(inp);

-               if (rt && (IN6_IS_ADDR_LOOPBACK(&inp->in6p_faddr) || IN6_IS_ADDR_LINKLOCAL(&inp->in6p_faddr) || rt->rt_gateway->sa_family == AF_LINK))
-                                isnetlocal = TRUE;
+               if (rt != NULL &&
+                   (IN6_IS_ADDR_LOOPBACK(&inp->in6p_faddr) ||
+                   IN6_IS_ADDR_LINKLOCAL(&inp->in6p_faddr) ||
+                   rt->rt_gateway->sa_family == AF_LINK))
+                        isnetlocal = TRUE;

        }
        else
 #endif /* INET6 */
        {
                rt = tcp_rtlookup(inp, input_ifscope);
        }
        else
 #endif /* INET6 */
        {
                rt = tcp_rtlookup(inp, input_ifscope);

-               if (rt && (rt->rt_gateway->sa_family == AF_LINK ||
-                       rt->rt_ifp->if_flags & IFF_LOOPBACK)) 
+               if (rt != NULL &&
+                   (rt->rt_gateway->sa_family == AF_LINK ||
+                   rt->rt_ifp->if_flags & IFF_LOOPBACK))

                         isnetlocal = TRUE;
        }
        if (rt == NULL) {
                         isnetlocal = TRUE;
        }
        if (rt == NULL) {


@@ -3459,7 +3493,6 @@ tcp_mss(tp, offer, input_ifscope)
                isipv6 ? tcp_v6mssdflt :
 #endif /* INET6 */
                tcp_mssdflt;
                isipv6 ? tcp_v6mssdflt :
 #endif /* INET6 */
                tcp_mssdflt;

-               lck_mtx_unlock(rt_mtx);

                return;
        }
        ifp = rt->rt_ifp;
                return;
        }
        ifp = rt->rt_ifp;


@@ -3636,11 +3669,12 @@ tcp_mss(tp, offer, input_ifscope)
                 */
                tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
                tcpstat.tcps_usedssthresh++;
                 */
                tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
                tcpstat.tcps_usedssthresh++;

-       }
-       else
+       } else {

                tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
                tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;

+       }

 
 

-       lck_mtx_unlock(rt_mtx);
+       /* Route locked during lookup above */
+       RT_UNLOCK(rt);

 }
 
 /*
 }
 
 /*


@@ -3664,7 +3698,7 @@ tcp_mssopt(tp)
 #else
 #define min_protoh  (sizeof (struct tcpiphdr))
 #endif
 #else
 #define min_protoh  (sizeof (struct tcpiphdr))
 #endif

-       lck_mtx_lock(rt_mtx);
+

 #if INET6
        if (isipv6)
                rt = tcp_rtlookup6(tp->t_inpcb);
 #if INET6
        if (isipv6)
                rt = tcp_rtlookup6(tp->t_inpcb);


@@ -3672,7 +3706,6 @@ tcp_mssopt(tp)
 #endif /* INET6 */
        rt = tcp_rtlookup(tp->t_inpcb, IFSCOPE_NONE);
        if (rt == NULL) {
 #endif /* INET6 */
        rt = tcp_rtlookup(tp->t_inpcb, IFSCOPE_NONE);
        if (rt == NULL) {

-               lck_mtx_unlock(rt_mtx);

                return (
 #if INET6
                        isipv6 ? tcp_v6mssdflt :
                return (
 #if INET6
                        isipv6 ? tcp_v6mssdflt :


@@ -3695,7 +3728,8 @@ tcp_mssopt(tp)
 #else
        mss = tcp_maxmtu(rt);
 #endif
 #else
        mss = tcp_maxmtu(rt);
 #endif

-       lck_mtx_unlock(rt_mtx);
+       /* Route locked during lookup above */
+       RT_UNLOCK(rt);

        return (mss - min_protoh);
 }
 
        return (mss - min_protoh);
 }
 


@@ -3711,7 +3745,7 @@ tcp_newreno_partial_ack(tp, th)
        struct tcphdr *th;
 {
                tcp_seq onxt = tp->snd_nxt;
        struct tcphdr *th;
 {
                tcp_seq onxt = tp->snd_nxt;

-               u_long  ocwnd = tp->snd_cwnd;
+               u_int32_t  ocwnd = tp->snd_cwnd;

                tp->t_timer[TCPT_REXMT] = 0;
                tp->t_rtttime = 0;
                tp->snd_nxt = th->th_ack;
                tp->t_timer[TCPT_REXMT] = 0;
                tp->t_rtttime = 0;
                tp->snd_nxt = th->th_ack;


@@ -3803,6 +3837,13 @@ tcp_dropdropablreq(struct socket *head)
                                        tcp_unlock(so, 1, 0);
                                }
                        }
                                        tcp_unlock(so, 1, 0);
                                }
                        }

+                       else {
+                               /* do not try to lock the inp in in_pcb_checkstate
+                                * because the lock is already held in some other thread.
+                                * Only drop the inp_wntcnt reference.
+                                */
+                               in_pcb_checkstate(inp, WNT_RELEASE, 1);
+                       }

                }
                so = sonext;
                
                }
                so = sonext;