1 /* $NetBSD: tcp_syncache.c,v 1.8 2026/07/23 17:45:17 riastradh Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 34 * 35 * NRL grants permission for redistribution and use in source and binary 36 * forms, with or without modification, of the software and documentation 37 * created at NRL provided that the following conditions are met: 38 * 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. All advertising materials mentioning features or use of this software 45 * must display the following acknowledgements: 46 * This product includes software developed by the University of 47 * California, Berkeley and its contributors. 48 * This product includes software developed at the Information 49 * Technology Division, US Naval Research Laboratory. 50 * 4. Neither the name of the NRL nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 65 * 66 * The views and conclusions contained in the software and documentation 67 * are those of the authors and should not be interpreted as representing 68 * official policies, either expressed or implied, of the US Naval 69 * Research Laboratory (NRL). 70 */ 71 72 /*- 73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006, 74 * 2011 The NetBSD Foundation, Inc. 75 * All rights reserved. 76 * 77 * This code is derived from software contributed to The NetBSD Foundation 78 * by Coyote Point Systems, Inc. 79 * This code is derived from software contributed to The NetBSD Foundation 80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation 81 * Facility, NASA Ames Research Center. 82 * This code is derived from software contributed to The NetBSD Foundation 83 * by Charles M. Hannum. 84 * This code is derived from software contributed to The NetBSD Foundation 85 * by Rui Paulo. 86 * 87 * Redistribution and use in source and binary forms, with or without 88 * modification, are permitted provided that the following conditions 89 * are met: 90 * 1. Redistributions of source code must retain the above copyright 91 * notice, this list of conditions and the following disclaimer. 92 * 2. Redistributions in binary form must reproduce the above copyright 93 * notice, this list of conditions and the following disclaimer in the 94 * documentation and/or other materials provided with the distribution. 95 * 96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 106 * POSSIBILITY OF SUCH DAMAGE. 107 */ 108 109 /* 110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 111 * The Regents of the University of California. All rights reserved. 112 * 113 * Redistribution and use in source and binary forms, with or without 114 * modification, are permitted provided that the following conditions 115 * are met: 116 * 1. Redistributions of source code must retain the above copyright 117 * notice, this list of conditions and the following disclaimer. 118 * 2. Redistributions in binary form must reproduce the above copyright 119 * notice, this list of conditions and the following disclaimer in the 120 * documentation and/or other materials provided with the distribution. 121 * 3. Neither the name of the University nor the names of its contributors 122 * may be used to endorse or promote products derived from this software 123 * without specific prior written permission. 124 * 125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 135 * SUCH DAMAGE. 136 * 137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 138 */ 139 140 /* 141 * TODO list for SYN cache stuff: 142 * 143 * Find room for a "state" field, which is needed to keep a 144 * compressed state for TIME_WAIT TCBs. It's been noted already 145 * that this is fairly important for very high-volume web and 146 * mail servers, which use a large number of short-lived 147 * connections. 148 */ 149 150 #include <sys/cdefs.h> 151 __KERNEL_RCSID(0, "$NetBSD: tcp_syncache.c,v 1.8 2026/07/23 17:45:17 riastradh Exp $"); 152 153 #ifdef _KERNEL_OPT 154 #include "opt_inet.h" 155 #include "opt_ipsec.h" 156 #endif 157 158 #include <sys/param.h> 159 #include <sys/systm.h> 160 #include <sys/mbuf.h> 161 #include <sys/protosw.h> 162 #include <sys/socket.h> 163 #include <sys/socketvar.h> 164 #include <sys/errno.h> 165 #include <sys/syslog.h> 166 #include <sys/pool.h> 167 #include <sys/domain.h> 168 #include <sys/kernel.h> 169 #include <sys/lwp.h> /* for lwp0 */ 170 #include <sys/cprng.h> 171 172 #include <netinet/in.h> 173 #include <netinet/ip.h> 174 #include <netinet/in_pcb.h> 175 #include <netinet/in_var.h> 176 #include <netinet/ip_var.h> 177 178 #include <netinet/ip6.h> 179 #ifdef INET6 180 #include <netinet6/ip6_var.h> 181 #include <netinet6/in6_pcb.h> 182 #include <netinet6/ip6_var.h> 183 #include <netinet6/in6_var.h> 184 #endif 185 186 #include <netinet/tcp.h> 187 #include <netinet/tcp_fsm.h> 188 #include <netinet/tcp_seq.h> 189 #include <netinet/tcp_timer.h> 190 #include <netinet/tcp_var.h> 191 #include <netinet/tcp_private.h> 192 #include <netinet/tcp_syncache.h> 193 194 #ifdef TCP_SIGNATURE 195 #ifdef IPSEC 196 #include <netipsec/ipsec.h> 197 #include <netipsec/key.h> 198 #ifdef INET6 199 #include <netipsec/ipsec6.h> 200 #endif 201 #endif /* IPSEC*/ 202 #endif 203 204 static void syn_cache_timer(void *); 205 static struct syn_cache * 206 syn_cache_lookup(const struct sockaddr *, const struct sockaddr *, 207 struct syn_cache_head **); 208 static int syn_cache_respond(struct syn_cache *); 209 210 /* syn hash parameters */ 211 #define TCP_SYN_HASH_SIZE 293 212 #define TCP_SYN_BUCKET_SIZE 35 213 static int tcp_syn_cache_size = TCP_SYN_HASH_SIZE; 214 int tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE; 215 int tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE; 216 static struct syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE]; 217 218 /* 219 * TCP compressed state engine. Currently used to hold compressed 220 * state for SYN_RECEIVED. 221 */ 222 223 u_long syn_cache_count; 224 static u_int32_t syn_hash1, syn_hash2; 225 226 #define SYN_HASH(sa, sp, dp) \ 227 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 228 ((u_int32_t)(sp)))^syn_hash2))) 229 #ifndef INET6 230 #define SYN_HASHALL(hash, src, dst) \ 231 do { \ 232 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \ 233 ((const struct sockaddr_in *)(src))->sin_port, \ 234 ((const struct sockaddr_in *)(dst))->sin_port); \ 235 } while (/*CONSTCOND*/ 0) 236 #else 237 #define SYN_HASH6(sa, sp, dp) \ 238 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \ 239 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \ 240 & 0x7fffffff) 241 242 #define SYN_HASHALL(hash, src, dst) \ 243 do { \ 244 switch ((src)->sa_family) { \ 245 case AF_INET: \ 246 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \ 247 ((const struct sockaddr_in *)(src))->sin_port, \ 248 ((const struct sockaddr_in *)(dst))->sin_port); \ 249 break; \ 250 case AF_INET6: \ 251 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \ 252 ((const struct sockaddr_in6 *)(src))->sin6_port, \ 253 ((const struct sockaddr_in6 *)(dst))->sin6_port); \ 254 break; \ 255 default: \ 256 hash = 0; \ 257 } \ 258 } while (/*CONSTCOND*/0) 259 #endif /* INET6 */ 260 261 static struct pool syn_cache_pool; 262 263 /* 264 * We don't estimate RTT with SYNs, so each packet starts with the default 265 * RTT and each timer step has a fixed timeout value. 266 */ 267 static inline void 268 syn_cache_timer_arm(struct syn_cache *sc) 269 { 270 271 TCPT_RANGESET(sc->sc_rxtcur, 272 TCPTV_SRTTDFLT * tcp_backoff[sc->sc_rxtshift], TCPTV_MIN, 273 TCPTV_REXMTMAX); 274 callout_reset(&sc->sc_timer, 275 sc->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, sc); 276 } 277 278 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase) 279 280 static inline void 281 syn_cache_rm(struct syn_cache *sc) 282 { 283 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket, 284 sc, sc_bucketq); 285 sc->sc_tp = NULL; 286 LIST_REMOVE(sc, sc_tpq); 287 tcp_syn_cache[sc->sc_bucketidx].sch_length--; 288 callout_stop(&sc->sc_timer); 289 syn_cache_count--; 290 } 291 292 static inline void 293 syn_cache_put(struct syn_cache *sc) 294 { 295 if (sc->sc_ipopts) 296 (void) m_free(sc->sc_ipopts); 297 rtcache_free(&sc->sc_route); 298 sc->sc_flags |= SCF_DEAD; 299 if (!callout_invoking(&sc->sc_timer)) 300 callout_schedule(&(sc)->sc_timer, 1); 301 } 302 303 void 304 syn_cache_init(void) 305 { 306 int i; 307 308 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, 309 "synpl", NULL, IPL_SOFTNET); 310 311 /* Initialize the hash buckets. */ 312 for (i = 0; i < tcp_syn_cache_size; i++) 313 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket); 314 } 315 316 void 317 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp) 318 { 319 struct syn_cache_head *scp; 320 struct syn_cache *sc2; 321 int s; 322 323 /* 324 * If there are no entries in the hash table, reinitialize 325 * the hash secrets. 326 */ 327 if (syn_cache_count == 0) { 328 syn_hash1 = cprng_fast32(); 329 syn_hash2 = cprng_fast32(); 330 } 331 332 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa); 333 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size; 334 scp = &tcp_syn_cache[sc->sc_bucketidx]; 335 336 /* 337 * Make sure that we don't overflow the per-bucket 338 * limit or the total cache size limit. 339 */ 340 s = splsoftnet(); 341 if (scp->sch_length >= tcp_syn_bucket_limit) { 342 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW); 343 /* 344 * The bucket is full. Toss the oldest element in the 345 * bucket. This will be the first entry in the bucket. 346 */ 347 sc2 = TAILQ_FIRST(&scp->sch_bucket); 348 #ifdef DIAGNOSTIC 349 /* 350 * This should never happen; we should always find an 351 * entry in our bucket. 352 */ 353 if (sc2 == NULL) 354 panic("syn_cache_insert: bucketoverflow: impossible"); 355 #endif 356 syn_cache_rm(sc2); 357 syn_cache_put(sc2); /* calls pool_put but see spl above */ 358 } else if (syn_cache_count >= tcp_syn_cache_limit) { 359 struct syn_cache_head *scp2, *sce; 360 361 TCP_STATINC(TCP_STAT_SC_OVERFLOWED); 362 /* 363 * The cache is full. Toss the oldest entry in the 364 * first non-empty bucket we can find. 365 * 366 * XXX We would really like to toss the oldest 367 * entry in the cache, but we hope that this 368 * condition doesn't happen very often. 369 */ 370 scp2 = scp; 371 if (TAILQ_EMPTY(&scp2->sch_bucket)) { 372 sce = &tcp_syn_cache[tcp_syn_cache_size]; 373 for (++scp2; scp2 != scp; scp2++) { 374 if (scp2 >= sce) 375 scp2 = &tcp_syn_cache[0]; 376 if (! TAILQ_EMPTY(&scp2->sch_bucket)) 377 break; 378 } 379 #ifdef DIAGNOSTIC 380 /* 381 * This should never happen; we should always find a 382 * non-empty bucket. 383 */ 384 if (scp2 == scp) 385 panic("syn_cache_insert: cacheoverflow: " 386 "impossible"); 387 #endif 388 } 389 sc2 = TAILQ_FIRST(&scp2->sch_bucket); 390 syn_cache_rm(sc2); 391 syn_cache_put(sc2); /* calls pool_put but see spl above */ 392 } 393 394 /* 395 * Initialize the entry's timer. 396 */ 397 sc->sc_rxttot = 0; 398 sc->sc_rxtshift = 0; 399 syn_cache_timer_arm(sc); 400 401 /* Link it from tcpcb entry */ 402 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 403 404 /* Put it into the bucket. */ 405 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq); 406 scp->sch_length++; 407 syn_cache_count++; 408 409 TCP_STATINC(TCP_STAT_SC_ADDED); 410 splx(s); 411 } 412 413 /* 414 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 415 * If we have retransmitted an entry the maximum number of times, expire 416 * that entry. 417 */ 418 static void 419 syn_cache_timer(void *arg) 420 { 421 struct syn_cache *sc = arg; 422 423 mutex_enter(softnet_lock); 424 KERNEL_LOCK(1, NULL); 425 426 callout_ack(&sc->sc_timer); 427 428 if (__predict_false(sc->sc_flags & SCF_DEAD)) { 429 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE); 430 goto free; 431 } 432 433 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) { 434 /* Drop it -- too many retransmissions. */ 435 goto dropit; 436 } 437 438 /* 439 * Compute the total amount of time this entry has 440 * been on a queue. If this entry has been on longer 441 * than the keep alive timer would allow, expire it. 442 */ 443 sc->sc_rxttot += sc->sc_rxtcur; 444 if (sc->sc_rxttot >= MIN(tcp_keepinit, TCP_TIMER_MAXTICKS)) 445 goto dropit; 446 447 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED); 448 (void)syn_cache_respond(sc); 449 450 /* Advance the timer back-off. */ 451 sc->sc_rxtshift++; 452 syn_cache_timer_arm(sc); 453 454 goto out; 455 456 dropit: 457 TCP_STATINC(TCP_STAT_SC_TIMED_OUT); 458 syn_cache_rm(sc); 459 if (sc->sc_ipopts) 460 (void) m_free(sc->sc_ipopts); 461 rtcache_free(&sc->sc_route); 462 463 free: 464 callout_destroy(&sc->sc_timer); 465 pool_put(&syn_cache_pool, sc); 466 467 out: 468 KERNEL_UNLOCK_ONE(NULL); 469 mutex_exit(softnet_lock); 470 } 471 472 /* 473 * Remove syn cache created by the specified tcb entry, 474 * because this does not make sense to keep them 475 * (if there's no tcb entry, syn cache entry will never be used) 476 */ 477 void 478 syn_cache_cleanup(struct tcpcb *tp) 479 { 480 struct syn_cache *sc, *nsc; 481 int s; 482 483 s = splsoftnet(); 484 485 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) { 486 nsc = LIST_NEXT(sc, sc_tpq); 487 488 #ifdef DIAGNOSTIC 489 if (sc->sc_tp != tp) 490 panic("invalid sc_tp in syn_cache_cleanup"); 491 #endif 492 syn_cache_rm(sc); 493 syn_cache_put(sc); /* calls pool_put but see spl above */ 494 } 495 /* just for safety */ 496 LIST_INIT(&tp->t_sc); 497 498 splx(s); 499 } 500 501 /* 502 * Find an entry in the syn cache. 503 */ 504 static struct syn_cache * 505 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst, 506 struct syn_cache_head **headp) 507 { 508 struct syn_cache *sc; 509 struct syn_cache_head *scp; 510 u_int32_t hash; 511 int s; 512 513 SYN_HASHALL(hash, src, dst); 514 515 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 516 *headp = scp; 517 s = splsoftnet(); 518 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL; 519 sc = TAILQ_NEXT(sc, sc_bucketq)) { 520 if (sc->sc_hash != hash) 521 continue; 522 if (!memcmp(&sc->sc_src, src, src->sa_len) && 523 !memcmp(&sc->sc_dst, dst, dst->sa_len)) { 524 splx(s); 525 return (sc); 526 } 527 } 528 splx(s); 529 return (NULL); 530 } 531 532 /* 533 * This function gets called when we receive an ACK for a socket in the 534 * LISTEN state. We look up the connection in the syn cache, and if it's 535 * there, we pull it out of the cache and turn it into a full-blown 536 * connection in the SYN-RECEIVED state. 537 * 538 * The return values may not be immediately obvious, and their effects 539 * can be subtle, so here they are: 540 * 541 * NULL SYN was not found in cache; caller should drop the 542 * packet and send an RST. 543 * 544 * -1 We were unable to create the new connection, and are 545 * aborting it. An ACK,RST is being sent to the peer 546 * (unless we got screwey sequence numbers; see below), 547 * because the 3-way handshake has been completed. Caller 548 * should not free the mbuf, since we may be using it. If 549 * we are not, we will free it. 550 * 551 * Otherwise, the return value is a pointer to the new socket 552 * associated with the connection. 553 */ 554 struct socket * 555 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, 556 struct tcphdr *th, struct socket *so, struct mbuf *m) 557 { 558 struct syn_cache *sc; 559 struct syn_cache_head *scp; 560 struct inpcb *inp = NULL; 561 struct tcpcb *tp; 562 int s; 563 struct socket *oso; 564 565 s = splsoftnet(); 566 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 567 splx(s); 568 return NULL; 569 } 570 571 /* 572 * Verify the sequence and ack numbers. Try getting the correct 573 * response again. 574 */ 575 if ((th->th_ack != sc->sc_iss + 1) || 576 SEQ_LEQ(th->th_seq, sc->sc_irs) || 577 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 578 m_freem(m); 579 (void)syn_cache_respond(sc); 580 splx(s); 581 return ((struct socket *)(-1)); 582 } 583 584 /* Remove this cache entry */ 585 syn_cache_rm(sc); 586 splx(s); 587 588 /* 589 * Ok, create the full blown connection, and set things up 590 * as they would have been set up if we had created the 591 * connection when the SYN arrived. If we can't create 592 * the connection, abort it. 593 */ 594 /* 595 * inp still has the OLD in_pcb stuff, set the 596 * v6-related flags on the new guy, too. This is 597 * done particularly for the case where an AF_INET6 598 * socket is bound only to a port, and a v4 connection 599 * comes in on that port. 600 * we also copy the flowinfo from the original pcb 601 * to the new one. 602 */ 603 oso = so; 604 so = sonewconn(so, true); 605 if (so == NULL) 606 goto resetandabort; 607 608 inp = sotoinpcb(so); 609 610 switch (src->sa_family) { 611 case AF_INET: 612 if (inp->inp_af == AF_INET) { 613 in4p_laddr(inp) = ((struct sockaddr_in *)dst)->sin_addr; 614 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port; 615 inp->inp_options = ip_srcroute(m); 616 inpcb_set_state(inp, INP_BOUND); 617 if (inp->inp_options == NULL) { 618 inp->inp_options = sc->sc_ipopts; 619 sc->sc_ipopts = NULL; 620 } 621 } 622 #ifdef INET6 623 else if (inp->inp_af == AF_INET6) { 624 /* IPv4 packet to AF_INET6 socket */ 625 memset(&in6p_laddr(inp), 0, sizeof(in6p_laddr(inp))); 626 in6p_laddr(inp).s6_addr16[5] = htons(0xffff); 627 bcopy(&((struct sockaddr_in *)dst)->sin_addr, 628 &in6p_laddr(inp).s6_addr32[3], 629 sizeof(((struct sockaddr_in *)dst)->sin_addr)); 630 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port; 631 intotcpcb(inp)->t_family = AF_INET; 632 if (sotoinpcb(oso)->inp_flags & IN6P_IPV6_V6ONLY) 633 inp->inp_flags |= IN6P_IPV6_V6ONLY; 634 else 635 inp->inp_flags &= ~IN6P_IPV6_V6ONLY; 636 inpcb_set_state(inp, INP_BOUND); 637 } 638 #endif 639 break; 640 #ifdef INET6 641 case AF_INET6: 642 if (inp->inp_af == AF_INET6) { 643 in6p_laddr(inp) = ((struct sockaddr_in6 *)dst)->sin6_addr; 644 inp->inp_lport = ((struct sockaddr_in6 *)dst)->sin6_port; 645 inpcb_set_state(inp, INP_BOUND); 646 } 647 break; 648 #endif 649 } 650 651 #ifdef INET6 652 if (inp && intotcpcb(inp)->t_family == AF_INET6 && sotoinpcb(oso)) { 653 struct inpcb *oinp = sotoinpcb(oso); 654 /* inherit socket options from the listening socket */ 655 inp->inp_flags |= (oinp->inp_flags & IN6P_CONTROLOPTS); 656 if (inp->inp_flags & IN6P_CONTROLOPTS) { 657 m_freem(inp->inp_options); 658 inp->inp_options = NULL; 659 } 660 ip6_savecontrol(inp, &inp->inp_options, 661 mtod(m, struct ip6_hdr *), m); 662 } 663 #endif 664 665 /* 666 * Give the new socket our cached route reference. 667 */ 668 rtcache_copy(&inp->inp_route, &sc->sc_route); 669 rtcache_free(&sc->sc_route); 670 671 if (inp->inp_af == AF_INET) { 672 struct sockaddr_in sin; 673 memcpy(&sin, src, src->sa_len); 674 if (inpcb_connect(inp, &sin, &lwp0)) { 675 goto resetandabort; 676 } 677 } 678 #ifdef INET6 679 else if (inp->inp_af == AF_INET6) { 680 struct sockaddr_in6 sin6; 681 memcpy(&sin6, src, src->sa_len); 682 if (src->sa_family == AF_INET) { 683 /* IPv4 packet to AF_INET6 socket */ 684 in6_sin_2_v4mapsin6((struct sockaddr_in *)src, &sin6); 685 } 686 if (in6pcb_connect(inp, &sin6, NULL)) { 687 goto resetandabort; 688 } 689 } 690 #endif 691 else { 692 goto resetandabort; 693 } 694 695 tp = intotcpcb(inp); 696 697 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY; 698 if (sc->sc_request_r_scale != 15) { 699 tp->requested_s_scale = sc->sc_requested_s_scale; 700 tp->request_r_scale = sc->sc_request_r_scale; 701 tp->snd_scale = sc->sc_requested_s_scale; 702 tp->rcv_scale = sc->sc_request_r_scale; 703 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE; 704 } 705 if (sc->sc_flags & SCF_TIMESTAMP) 706 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP; 707 tp->ts_timebase = sc->sc_timebase; 708 709 tp->t_template = tcp_template(tp); 710 if (tp->t_template == 0) { 711 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 712 so = NULL; 713 m_freem(m); 714 goto abort; 715 } 716 717 tp->iss = sc->sc_iss; 718 tp->irs = sc->sc_irs; 719 tcp_sendseqinit(tp); 720 tcp_rcvseqinit(tp); 721 tp->t_state = TCPS_SYN_RECEIVED; 722 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit); 723 TCP_STATINC(TCP_STAT_ACCEPTS); 724 725 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack) 726 tp->t_flags |= TF_WILL_SACK; 727 728 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn) 729 tp->t_flags |= TF_ECN_PERMIT; 730 731 #ifdef TCP_SIGNATURE 732 if (sc->sc_flags & SCF_SIGNATURE) 733 tp->t_flags |= TF_SIGNATURE; 734 #endif 735 736 /* Initialize tp->t_ourmss before we deal with the peer's! */ 737 tp->t_ourmss = sc->sc_ourmaxseg; 738 tcp_mss_from_peer(tp, sc->sc_peermaxseg); 739 740 /* 741 * Initialize the initial congestion window. If we 742 * had to retransmit the SYN,ACK, we must initialize cwnd 743 * to 1 segment (i.e. the Loss Window). 744 */ 745 if (sc->sc_rxtshift) 746 tp->snd_cwnd = tp->t_peermss; 747 else { 748 int ss = tcp_init_win; 749 if (inp->inp_af == AF_INET && in_localaddr(in4p_faddr(inp))) 750 ss = tcp_init_win_local; 751 #ifdef INET6 752 else if (inp->inp_af == AF_INET6 && in6_localaddr(&in6p_faddr(inp))) 753 ss = tcp_init_win_local; 754 #endif 755 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss); 756 } 757 758 tcp_rmx_rtt(tp); 759 tp->snd_wl1 = sc->sc_irs; 760 tp->rcv_up = sc->sc_irs + 1; 761 762 /* 763 * This is what would have happened in tcp_output() when 764 * the SYN,ACK was sent. 765 */ 766 tp->snd_up = tp->snd_una; 767 tp->snd_max = tp->snd_nxt = tp->iss+1; 768 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 769 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 770 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 771 tp->last_ack_sent = tp->rcv_nxt; 772 tp->t_partialacks = -1; 773 tp->t_dupacks = 0; 774 775 TCP_STATINC(TCP_STAT_SC_COMPLETED); 776 s = splsoftnet(); 777 syn_cache_put(sc); 778 splx(s); 779 return so; 780 781 resetandabort: 782 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST); 783 abort: 784 if (so != NULL) { 785 (void) soqremque(so, 1); 786 (void) soabort(so); 787 mutex_enter(softnet_lock); 788 } 789 s = splsoftnet(); 790 syn_cache_put(sc); 791 splx(s); 792 TCP_STATINC(TCP_STAT_SC_ABORTED); 793 return ((struct socket *)(-1)); 794 } 795 796 /* 797 * This function is called when we get a RST for a 798 * non-existent connection, so that we can see if the 799 * connection is in the syn cache. If it is, zap it. 800 */ 801 802 void 803 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th) 804 { 805 struct syn_cache *sc; 806 struct syn_cache_head *scp; 807 int s = splsoftnet(); 808 809 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 810 splx(s); 811 return; 812 } 813 if (SEQ_LT(th->th_seq, sc->sc_irs) || 814 SEQ_GT(th->th_seq, sc->sc_irs+1)) { 815 splx(s); 816 return; 817 } 818 syn_cache_rm(sc); 819 TCP_STATINC(TCP_STAT_SC_RESET); 820 syn_cache_put(sc); /* calls pool_put but see spl above */ 821 splx(s); 822 } 823 824 void 825 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst, 826 struct tcphdr *th) 827 { 828 struct syn_cache *sc; 829 struct syn_cache_head *scp; 830 int s; 831 832 s = splsoftnet(); 833 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 834 splx(s); 835 return; 836 } 837 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 838 if (ntohl(th->th_seq) != sc->sc_iss) { 839 splx(s); 840 return; 841 } 842 843 /* 844 * If we've retransmitted 3 times and this is our second error, 845 * we remove the entry. Otherwise, we allow it to continue on. 846 * This prevents us from incorrectly nuking an entry during a 847 * spurious network outage. 848 * 849 * See tcp_notify(). 850 */ 851 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 852 sc->sc_flags |= SCF_UNREACH; 853 splx(s); 854 return; 855 } 856 857 syn_cache_rm(sc); 858 TCP_STATINC(TCP_STAT_SC_UNREACH); 859 syn_cache_put(sc); /* calls pool_put but see spl above */ 860 splx(s); 861 } 862 863 /* 864 * Given a LISTEN socket and an inbound SYN request, add this to the syn 865 * cache, and send back a segment: 866 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 867 * to the source. 868 * 869 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 870 * Doing so would require that we hold onto the data and deliver it 871 * to the application. However, if we are the target of a SYN-flood 872 * DoS attack, an attacker could send data which would eventually 873 * consume all available buffer space if it were ACKed. By not ACKing 874 * the data, we avoid this DoS scenario. 875 */ 876 int 877 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 878 unsigned int toff, struct socket *so, struct mbuf *m, u_char *optp, 879 int optlen, struct tcp_opt_info *oi) 880 { 881 struct tcpcb tb, *tp; 882 long win; 883 struct syn_cache *sc; 884 struct syn_cache_head *scp; 885 struct mbuf *ipopts; 886 int s; 887 888 tp = sototcpcb(so); 889 890 /* 891 * Initialize some local state. 892 */ 893 win = sbspace(&so->so_rcv); 894 if (win > TCP_MAXWIN) 895 win = TCP_MAXWIN; 896 897 /* 898 * memset may be suboptimal for a ~800-byte structure, but it's 899 * a pain to prove every relevant part of tb is initialized 900 * before use. 901 */ 902 memset(&tb, 0, sizeof(tb)); 903 904 #ifdef TCP_SIGNATURE 905 if (optp || (tp->t_flags & TF_SIGNATURE)) 906 #else 907 if (optp) 908 #endif 909 { 910 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 911 #ifdef TCP_SIGNATURE 912 tb.t_flags |= (tp->t_flags & TF_SIGNATURE); 913 #endif 914 tb.t_state = TCPS_LISTEN; 915 if (tcp_dooptions(&tb, optp, optlen, th, m, toff, oi) < 0) 916 return 0; 917 } else 918 tb.t_flags = 0; 919 920 switch (src->sa_family) { 921 case AF_INET: 922 /* Remember the IP options, if any. */ 923 ipopts = ip_srcroute(m); 924 break; 925 default: 926 ipopts = NULL; 927 } 928 929 /* 930 * See if we already have an entry for this connection. 931 * If we do, resend the SYN,ACK. We do not count this 932 * as a retransmission (XXX though maybe we should). 933 */ 934 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) { 935 TCP_STATINC(TCP_STAT_SC_DUPESYN); 936 if (ipopts) { 937 /* 938 * If we were remembering a previous source route, 939 * forget it and use the new one we've been given. 940 */ 941 if (sc->sc_ipopts) 942 (void)m_free(sc->sc_ipopts); 943 sc->sc_ipopts = ipopts; 944 } 945 sc->sc_timestamp = tb.ts_recent; 946 m_freem(m); 947 if (syn_cache_respond(sc) == 0) { 948 net_stat_ref_t tcps = TCP_STAT_GETREF(); 949 _NET_STATINC_REF(tcps, TCP_STAT_SNDACKS); 950 _NET_STATINC_REF(tcps, TCP_STAT_SNDTOTAL); 951 TCP_STAT_PUTREF(); 952 } 953 return 1; 954 } 955 956 s = splsoftnet(); 957 sc = pool_get(&syn_cache_pool, PR_NOWAIT); 958 splx(s); 959 if (sc == NULL) { 960 if (ipopts) 961 (void)m_free(ipopts); 962 return 0; 963 } 964 965 /* 966 * Fill in the cache, and put the necessary IP and TCP 967 * options into the reply. 968 */ 969 memset(sc, 0, sizeof(struct syn_cache)); 970 callout_init(&sc->sc_timer, CALLOUT_MPSAFE); 971 memcpy(&sc->sc_src, src, src->sa_len); 972 memcpy(&sc->sc_dst, dst, dst->sa_len); 973 sc->sc_flags = 0; 974 sc->sc_ipopts = ipopts; 975 sc->sc_irs = th->th_seq; 976 switch (src->sa_family) { 977 case AF_INET: 978 { 979 struct sockaddr_in *srcin = (void *)src; 980 struct sockaddr_in *dstin = (void *)dst; 981 982 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr, 983 &srcin->sin_addr, dstin->sin_port, 984 srcin->sin_port, sizeof(dstin->sin_addr)); 985 break; 986 } 987 #ifdef INET6 988 case AF_INET6: 989 { 990 struct sockaddr_in6 *srcin6 = (void *)src; 991 struct sockaddr_in6 *dstin6 = (void *)dst; 992 993 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr, 994 &srcin6->sin6_addr, dstin6->sin6_port, 995 srcin6->sin6_port, sizeof(dstin6->sin6_addr)); 996 break; 997 } 998 #endif 999 } 1000 sc->sc_peermaxseg = oi->maxseg; 1001 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ? 1002 m_get_rcvif_NOMPSAFE(m) : NULL, sc->sc_src.sa.sa_family); 1003 sc->sc_win = win; 1004 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */ 1005 sc->sc_timestamp = tb.ts_recent; 1006 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) == 1007 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) 1008 sc->sc_flags |= SCF_TIMESTAMP; 1009 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1010 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1011 sc->sc_requested_s_scale = tb.requested_s_scale; 1012 sc->sc_request_r_scale = 0; 1013 /* 1014 * Pick the smallest possible scaling factor that 1015 * will still allow us to scale up to sb_max. 1016 * 1017 * We do this because there are broken firewalls that 1018 * will corrupt the window scale option, leading to 1019 * the other endpoint believing that our advertised 1020 * window is unscaled. At scale factors larger than 1021 * 5 the unscaled window will drop below 1500 bytes, 1022 * leading to serious problems when traversing these 1023 * broken firewalls. 1024 * 1025 * With the default sbmax of 256K, a scale factor 1026 * of 3 will be chosen by this algorithm. Those who 1027 * choose a larger sbmax should watch out 1028 * for the compatibility problems mentioned above. 1029 * 1030 * RFC1323: The Window field in a SYN (i.e., a <SYN> 1031 * or <SYN,ACK>) segment itself is never scaled. 1032 */ 1033 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 1034 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max) 1035 sc->sc_request_r_scale++; 1036 } else { 1037 sc->sc_requested_s_scale = 15; 1038 sc->sc_request_r_scale = 15; 1039 } 1040 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack) 1041 sc->sc_flags |= SCF_SACK_PERMIT; 1042 1043 /* 1044 * ECN setup packet received. 1045 */ 1046 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn) 1047 sc->sc_flags |= SCF_ECN_PERMIT; 1048 1049 #ifdef TCP_SIGNATURE 1050 if (tb.t_flags & TF_SIGNATURE) 1051 sc->sc_flags |= SCF_SIGNATURE; 1052 #endif 1053 sc->sc_tp = tp; 1054 m_freem(m); 1055 if (syn_cache_respond(sc) == 0) { 1056 net_stat_ref_t tcps = TCP_STAT_GETREF(); 1057 _NET_STATINC_REF(tcps, TCP_STAT_SNDACKS); 1058 _NET_STATINC_REF(tcps, TCP_STAT_SNDTOTAL); 1059 TCP_STAT_PUTREF(); 1060 syn_cache_insert(sc, tp); 1061 } else { 1062 s = splsoftnet(); 1063 /* 1064 * syn_cache_put() will try to schedule the timer, so 1065 * we need to initialize it 1066 */ 1067 syn_cache_timer_arm(sc); 1068 syn_cache_put(sc); 1069 splx(s); 1070 TCP_STATINC(TCP_STAT_SC_DROPPED); 1071 } 1072 return 1; 1073 } 1074 1075 /* 1076 * syn_cache_respond: (re)send SYN+ACK. 1077 * 1078 * Returns 0 on success. 1079 */ 1080 1081 static int 1082 syn_cache_respond(struct syn_cache *sc) 1083 { 1084 #ifdef INET6 1085 struct rtentry *rt = NULL; 1086 #endif 1087 struct route *ro; 1088 u_int8_t *optp; 1089 int optlen, error; 1090 u_int16_t tlen; 1091 struct ip *ip = NULL; 1092 #ifdef INET6 1093 struct ip6_hdr *ip6 = NULL; 1094 #endif 1095 struct tcpcb *tp; 1096 struct tcphdr *th; 1097 struct mbuf *m; 1098 u_int hlen; 1099 #ifdef TCP_SIGNATURE 1100 struct secasvar *sav = NULL; 1101 u_int8_t *sigp = NULL; 1102 #endif 1103 1104 ro = &sc->sc_route; 1105 switch (sc->sc_src.sa.sa_family) { 1106 case AF_INET: 1107 hlen = sizeof(struct ip); 1108 break; 1109 #ifdef INET6 1110 case AF_INET6: 1111 hlen = sizeof(struct ip6_hdr); 1112 break; 1113 #endif 1114 default: 1115 return EAFNOSUPPORT; 1116 } 1117 1118 /* Worst case scenario, since we don't know the option size yet. */ 1119 tlen = hlen + sizeof(struct tcphdr) + MAX_TCPOPTLEN; 1120 KASSERT(max_linkhdr + tlen <= MCLBYTES); 1121 1122 /* 1123 * Create the IP+TCP header from scratch. 1124 */ 1125 MGETHDR(m, M_DONTWAIT, MT_DATA); 1126 if (m && (max_linkhdr + tlen) > MHLEN) { 1127 MCLGET(m, M_DONTWAIT); 1128 if ((m->m_flags & M_EXT) == 0) { 1129 m_freem(m); 1130 m = NULL; 1131 } 1132 } 1133 if (m == NULL) 1134 return ENOBUFS; 1135 MCLAIM(m, &tcp_tx_mowner); 1136 1137 tp = sc->sc_tp; 1138 1139 /* Fixup the mbuf. */ 1140 m->m_data += max_linkhdr; 1141 m_reset_rcvif(m); 1142 memset(mtod(m, void *), 0, tlen); 1143 1144 switch (sc->sc_src.sa.sa_family) { 1145 case AF_INET: 1146 ip = mtod(m, struct ip *); 1147 ip->ip_v = 4; 1148 ip->ip_dst = sc->sc_src.sin.sin_addr; 1149 ip->ip_src = sc->sc_dst.sin.sin_addr; 1150 ip->ip_p = IPPROTO_TCP; 1151 th = (struct tcphdr *)(ip + 1); 1152 th->th_dport = sc->sc_src.sin.sin_port; 1153 th->th_sport = sc->sc_dst.sin.sin_port; 1154 break; 1155 #ifdef INET6 1156 case AF_INET6: 1157 ip6 = mtod(m, struct ip6_hdr *); 1158 ip6->ip6_vfc = IPV6_VERSION; 1159 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 1160 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 1161 ip6->ip6_nxt = IPPROTO_TCP; 1162 /* ip6_plen will be updated in ip6_output() */ 1163 th = (struct tcphdr *)(ip6 + 1); 1164 th->th_dport = sc->sc_src.sin6.sin6_port; 1165 th->th_sport = sc->sc_dst.sin6.sin6_port; 1166 break; 1167 #endif 1168 default: 1169 panic("%s: impossible (1)", __func__); 1170 } 1171 1172 th->th_seq = htonl(sc->sc_iss); 1173 th->th_ack = htonl(sc->sc_irs + 1); 1174 th->th_flags = TH_SYN|TH_ACK; 1175 th->th_win = htons(sc->sc_win); 1176 /* th_x2, th_sum, th_urp already 0 from memset */ 1177 1178 /* Tack on the TCP options. */ 1179 optp = (u_int8_t *)(th + 1); 1180 optlen = 0; 1181 *optp++ = TCPOPT_MAXSEG; 1182 *optp++ = TCPOLEN_MAXSEG; 1183 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 1184 *optp++ = sc->sc_ourmaxseg & 0xff; 1185 optlen += TCPOLEN_MAXSEG; 1186 1187 if (sc->sc_request_r_scale != 15) { 1188 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 1189 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 1190 sc->sc_request_r_scale); 1191 optp += TCPOLEN_WINDOW + TCPOLEN_NOP; 1192 optlen += TCPOLEN_WINDOW + TCPOLEN_NOP; 1193 } 1194 1195 if (sc->sc_flags & SCF_SACK_PERMIT) { 1196 /* Let the peer know that we will SACK. */ 1197 *optp++ = TCPOPT_SACK_PERMITTED; 1198 *optp++ = TCPOLEN_SACK_PERMITTED; 1199 optlen += TCPOLEN_SACK_PERMITTED; 1200 } 1201 1202 if (sc->sc_flags & SCF_TIMESTAMP) { 1203 while (optlen % 4 != 2) { 1204 optlen += TCPOLEN_NOP; 1205 *optp++ = TCPOPT_NOP; 1206 } 1207 *optp++ = TCPOPT_TIMESTAMP; 1208 *optp++ = TCPOLEN_TIMESTAMP; 1209 u_int32_t *lp = (u_int32_t *)(optp); 1210 /* Form timestamp option as shown in appendix A of RFC 1323. */ 1211 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc)); 1212 *lp = htonl(sc->sc_timestamp); 1213 optp += TCPOLEN_TIMESTAMP - 2; 1214 optlen += TCPOLEN_TIMESTAMP; 1215 } 1216 1217 #ifdef TCP_SIGNATURE 1218 if (sc->sc_flags & SCF_SIGNATURE) { 1219 sav = tcp_signature_getsav(m); 1220 if (sav == NULL) { 1221 m_freem(m); 1222 return EPERM; 1223 } 1224 1225 *optp++ = TCPOPT_SIGNATURE; 1226 *optp++ = TCPOLEN_SIGNATURE; 1227 sigp = optp; 1228 memset(optp, 0, TCP_SIGLEN); 1229 optp += TCP_SIGLEN; 1230 optlen += TCPOLEN_SIGNATURE; 1231 } 1232 #endif 1233 1234 /* 1235 * Terminate and pad TCP options to a 4 byte boundary. 1236 * 1237 * According to RFC793: "The content of the header beyond the 1238 * End-of-Option option must be header padding (i.e., zero)." 1239 * And later: "The padding is composed of zeros." 1240 */ 1241 if (optlen % 4) { 1242 optlen += TCPOLEN_EOL; 1243 *optp++ = TCPOPT_EOL; 1244 } 1245 while (optlen % 4) { 1246 optlen += TCPOLEN_PAD; 1247 *optp++ = TCPOPT_PAD; 1248 } 1249 1250 /* Compute the actual values now that we've added the options. */ 1251 tlen = hlen + sizeof(struct tcphdr) + optlen; 1252 m->m_len = m->m_pkthdr.len = tlen; 1253 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 1254 1255 #ifdef TCP_SIGNATURE 1256 if (sav) { 1257 (void)tcp_signature(m, th, hlen, sav, sigp); 1258 key_sa_recordxfer(sav, m); 1259 KEY_SA_UNREF(&sav); 1260 } 1261 #endif 1262 1263 /* 1264 * Send ECN SYN-ACK setup packet. 1265 * Routes can be asymmetric, so, even if we receive a packet 1266 * with ECE and CWR set, we must not assume no one will block 1267 * the ECE packet we are about to send. 1268 */ 1269 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp && 1270 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) { 1271 th->th_flags |= TH_ECE; 1272 TCP_STATINC(TCP_STAT_ECN_SHS); 1273 1274 /* 1275 * draft-ietf-tcpm-ecnsyn-00.txt 1276 * 1277 * "[...] a TCP node MAY respond to an ECN-setup 1278 * SYN packet by setting ECT in the responding 1279 * ECN-setup SYN/ACK packet, indicating to routers 1280 * that the SYN/ACK packet is ECN-Capable. 1281 * This allows a congested router along the path 1282 * to mark the packet instead of dropping the 1283 * packet as an indication of congestion." 1284 * 1285 * "[...] There can be a great benefit in setting 1286 * an ECN-capable codepoint in SYN/ACK packets [...] 1287 * Congestion is most likely to occur in 1288 * the server-to-client direction. As a result, 1289 * setting an ECN-capable codepoint in SYN/ACK 1290 * packets can reduce the occurrence of three-second 1291 * retransmit timeouts resulting from the drop 1292 * of SYN/ACK packets." 1293 * 1294 * Page 4 and 6, January 2006. 1295 */ 1296 1297 switch (sc->sc_src.sa.sa_family) { 1298 case AF_INET: 1299 ip->ip_tos |= IPTOS_ECN_ECT0; 1300 break; 1301 #ifdef INET6 1302 case AF_INET6: 1303 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20); 1304 break; 1305 #endif 1306 } 1307 TCP_STATINC(TCP_STAT_ECN_ECT); 1308 } 1309 1310 1311 /* 1312 * Compute the packet's checksum. 1313 * 1314 * Fill in some straggling IP bits. Note the stack expects 1315 * ip_len to be in host order, for convenience. 1316 */ 1317 switch (sc->sc_src.sa.sa_family) { 1318 case AF_INET: 1319 ip->ip_len = htons(tlen - hlen); 1320 th->th_sum = 0; 1321 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 1322 ip->ip_len = htons(tlen); 1323 ip->ip_ttl = ip_defttl; 1324 /* XXX tos? */ 1325 break; 1326 #ifdef INET6 1327 case AF_INET6: 1328 ip6->ip6_plen = htons(tlen - hlen); 1329 th->th_sum = 0; 1330 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 1331 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 1332 ip6->ip6_vfc |= IPV6_VERSION; 1333 ip6->ip6_plen = htons(tlen - hlen); 1334 /* ip6_hlim will be initialized afterwards */ 1335 /* XXX flowlabel? */ 1336 break; 1337 #endif 1338 } 1339 1340 /* XXX use IPsec policy on listening socket, on SYN ACK */ 1341 tp = sc->sc_tp; 1342 1343 switch (sc->sc_src.sa.sa_family) { 1344 case AF_INET: 1345 error = ip_output(m, sc->sc_ipopts, ro, 1346 (ip_mtudisc ? IP_MTUDISC : 0), 1347 NULL, tp ? tp->t_inpcb : NULL); 1348 break; 1349 #ifdef INET6 1350 case AF_INET6: 1351 ip6->ip6_hlim = in6pcb_selecthlim(NULL, 1352 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp : NULL); 1353 rtcache_unref(rt, ro); 1354 1355 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, 1356 tp ? tp->t_inpcb : NULL, NULL); 1357 break; 1358 #endif 1359 default: 1360 panic("%s: impossible (2)", __func__); 1361 } 1362 1363 return error; 1364 } 1365
Indexes created Mon Aug 10 00:24:53 UTC 2026