tcp_input.c revision 1.153 1 /* $NetBSD: tcp_input.c,v 1.153 2002/08/28 02:23:57 thorpej Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001 The NetBSD Foundation, Inc.
74 * All rights reserved.
75 *
76 * This code is derived from software contributed to The NetBSD Foundation
77 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
78 * Facility, NASA Ames Research Center.
79 *
80 * Redistribution and use in source and binary forms, with or without
81 * modification, are permitted provided that the following conditions
82 * are met:
83 * 1. Redistributions of source code must retain the above copyright
84 * notice, this list of conditions and the following disclaimer.
85 * 2. Redistributions in binary form must reproduce the above copyright
86 * notice, this list of conditions and the following disclaimer in the
87 * documentation and/or other materials provided with the distribution.
88 * 3. All advertising materials mentioning features or use of this software
89 * must display the following acknowledgement:
90 * This product includes software developed by the NetBSD
91 * Foundation, Inc. and its contributors.
92 * 4. Neither the name of The NetBSD Foundation nor the names of its
93 * contributors may be used to endorse or promote products derived
94 * from this software without specific prior written permission.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. All advertising materials mentioning features or use of this software
122 * must display the following acknowledgement:
123 * This product includes software developed by the University of
124 * California, Berkeley and its contributors.
125 * 4. Neither the name of the University nor the names of its contributors
126 * may be used to endorse or promote products derived from this software
127 * without specific prior written permission.
128 *
129 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
130 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
131 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
132 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
133 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
134 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
135 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
136 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
137 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
138 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
139 * SUCH DAMAGE.
140 *
141 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
142 */
143
144 /*
145 * TODO list for SYN cache stuff:
146 *
147 * Find room for a "state" field, which is needed to keep a
148 * compressed state for TIME_WAIT TCBs. It's been noted already
149 * that this is fairly important for very high-volume web and
150 * mail servers, which use a large number of short-lived
151 * connections.
152 */
153
154 #include <sys/cdefs.h>
155 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.153 2002/08/28 02:23:57 thorpej Exp $");
156
157 #include "opt_inet.h"
158 #include "opt_ipsec.h"
159 #include "opt_inet_csum.h"
160 #include "opt_tcp_debug.h"
161
162 #include <sys/param.h>
163 #include <sys/systm.h>
164 #include <sys/malloc.h>
165 #include <sys/mbuf.h>
166 #include <sys/protosw.h>
167 #include <sys/socket.h>
168 #include <sys/socketvar.h>
169 #include <sys/errno.h>
170 #include <sys/syslog.h>
171 #include <sys/pool.h>
172 #include <sys/domain.h>
173 #include <sys/kernel.h>
174
175 #include <net/if.h>
176 #include <net/route.h>
177 #include <net/if_types.h>
178
179 #include <netinet/in.h>
180 #include <netinet/in_systm.h>
181 #include <netinet/ip.h>
182 #include <netinet/in_pcb.h>
183 #include <netinet/ip_var.h>
184
185 #ifdef INET6
186 #ifndef INET
187 #include <netinet/in.h>
188 #endif
189 #include <netinet/ip6.h>
190 #include <netinet6/ip6_var.h>
191 #include <netinet6/in6_pcb.h>
192 #include <netinet6/ip6_var.h>
193 #include <netinet6/in6_var.h>
194 #include <netinet/icmp6.h>
195 #include <netinet6/nd6.h>
196 #endif
197
198 #ifdef PULLDOWN_TEST
199 #ifndef INET6
200 /* always need ip6.h for IP6_EXTHDR_GET */
201 #include <netinet/ip6.h>
202 #endif
203 #endif
204
205 #include <netinet/tcp.h>
206 #include <netinet/tcp_fsm.h>
207 #include <netinet/tcp_seq.h>
208 #include <netinet/tcp_timer.h>
209 #include <netinet/tcp_var.h>
210 #include <netinet/tcpip.h>
211 #include <netinet/tcp_debug.h>
212
213 #include <machine/stdarg.h>
214
215 #ifdef IPSEC
216 #include <netinet6/ipsec.h>
217 #include <netkey/key.h>
218 #endif /*IPSEC*/
219 #ifdef INET6
220 #include "faith.h"
221 #if defined(NFAITH) && NFAITH > 0
222 #include <net/if_faith.h>
223 #endif
224 #endif
225
226 int tcprexmtthresh = 3;
227 int tcp_log_refused;
228
229 static int tcp_rst_ppslim_count = 0;
230 static struct timeval tcp_rst_ppslim_last;
231
232 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ)
233
234 /* for modulo comparisons of timestamps */
235 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
236 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
237
238 /*
239 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
240 */
241 #ifdef INET6
242 #define ND6_HINT(tp) \
243 do { \
244 if (tp && tp->t_in6pcb && tp->t_family == AF_INET6 \
245 && tp->t_in6pcb->in6p_route.ro_rt) { \
246 nd6_nud_hint(tp->t_in6pcb->in6p_route.ro_rt, NULL, 0); \
247 } \
248 } while (0)
249 #else
250 #define ND6_HINT(tp)
251 #endif
252
253 /*
254 * Macro to compute ACK transmission behavior. Delay the ACK unless
255 * we have already delayed an ACK (must send an ACK every two segments).
256 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
257 * option is enabled.
258 */
259 #define TCP_SETUP_ACK(tp, th) \
260 do { \
261 if ((tp)->t_flags & TF_DELACK || \
262 (tcp_ack_on_push && (th)->th_flags & TH_PUSH)) \
263 tp->t_flags |= TF_ACKNOW; \
264 else \
265 TCP_SET_DELACK(tp); \
266 } while (0)
267
268 /*
269 * Convert TCP protocol fields to host order for easier processing.
270 */
271 #define TCP_FIELDS_TO_HOST(th) \
272 do { \
273 NTOHL((th)->th_seq); \
274 NTOHL((th)->th_ack); \
275 NTOHS((th)->th_win); \
276 NTOHS((th)->th_urp); \
277 } while (0)
278
279 /*
280 * ... and reverse the above.
281 */
282 #define TCP_FIELDS_TO_NET(th) \
283 do { \
284 HTONL((th)->th_seq); \
285 HTONL((th)->th_ack); \
286 HTONS((th)->th_win); \
287 HTONS((th)->th_urp); \
288 } while (0)
289
290 #ifdef TCP_CSUM_COUNTERS
291 #include <sys/device.h>
292
293 extern struct evcnt tcp_hwcsum_ok;
294 extern struct evcnt tcp_hwcsum_bad;
295 extern struct evcnt tcp_hwcsum_data;
296 extern struct evcnt tcp_swcsum;
297
298 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
299
300 #else
301
302 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
303
304 #endif /* TCP_CSUM_COUNTERS */
305
306 #ifdef TCP_REASS_COUNTERS
307 #include <sys/device.h>
308
309 extern struct evcnt tcp_reass_;
310 extern struct evcnt tcp_reass_empty;
311 extern struct evcnt tcp_reass_iteration[8];
312 extern struct evcnt tcp_reass_prependfirst;
313 extern struct evcnt tcp_reass_prepend;
314 extern struct evcnt tcp_reass_insert;
315 extern struct evcnt tcp_reass_inserttail;
316 extern struct evcnt tcp_reass_append;
317 extern struct evcnt tcp_reass_appendtail;
318 extern struct evcnt tcp_reass_overlaptail;
319 extern struct evcnt tcp_reass_overlapfront;
320 extern struct evcnt tcp_reass_segdup;
321 extern struct evcnt tcp_reass_fragdup;
322
323 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
324
325 #else
326
327 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
328
329 #endif /* TCP_REASS_COUNTERS */
330
331 #ifdef INET
332 static void tcp4_log_refused __P((const struct ip *, const struct tcphdr *));
333 #endif
334 #ifdef INET6
335 static void tcp6_log_refused
336 __P((const struct ip6_hdr *, const struct tcphdr *));
337 #endif
338
339 int
340 tcp_reass(tp, th, m, tlen)
341 struct tcpcb *tp;
342 struct tcphdr *th;
343 struct mbuf *m;
344 int *tlen;
345 {
346 struct ipqent *p, *q, *nq, *tiqe = NULL;
347 struct socket *so = NULL;
348 int pkt_flags;
349 tcp_seq pkt_seq;
350 unsigned pkt_len;
351 u_long rcvpartdupbyte = 0;
352 u_long rcvoobyte;
353 #ifdef TCP_REASS_COUNTERS
354 u_int count = 0;
355 #endif
356
357 if (tp->t_inpcb)
358 so = tp->t_inpcb->inp_socket;
359 #ifdef INET6
360 else if (tp->t_in6pcb)
361 so = tp->t_in6pcb->in6p_socket;
362 #endif
363
364 TCP_REASS_LOCK_CHECK(tp);
365
366 /*
367 * Call with th==0 after become established to
368 * force pre-ESTABLISHED data up to user socket.
369 */
370 if (th == 0)
371 goto present;
372
373 rcvoobyte = *tlen;
374 /*
375 * Copy these to local variables because the tcpiphdr
376 * gets munged while we are collapsing mbufs.
377 */
378 pkt_seq = th->th_seq;
379 pkt_len = *tlen;
380 pkt_flags = th->th_flags;
381
382 TCP_REASS_COUNTER_INCR(&tcp_reass_);
383
384 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
385 /*
386 * When we miss a packet, the vast majority of time we get
387 * packets that follow it in order. So optimize for that.
388 */
389 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
390 p->ipqe_len += pkt_len;
391 p->ipqe_flags |= pkt_flags;
392 m_cat(p->ipqe_m, m);
393 tiqe = p;
394 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
395 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
396 goto skip_replacement;
397 }
398 /*
399 * While we're here, if the pkt is completely beyond
400 * anything we have, just insert it at the tail.
401 */
402 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
403 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
404 goto insert_it;
405 }
406 }
407
408 q = TAILQ_FIRST(&tp->segq);
409
410 if (q != NULL) {
411 /*
412 * If this segment immediately precedes the first out-of-order
413 * block, simply slap the segment in front of it and (mostly)
414 * skip the complicated logic.
415 */
416 if (pkt_seq + pkt_len == q->ipqe_seq) {
417 q->ipqe_seq = pkt_seq;
418 q->ipqe_len += pkt_len;
419 q->ipqe_flags |= pkt_flags;
420 m_cat(m, q->ipqe_m);
421 q->ipqe_m = m;
422 tiqe = q;
423 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
424 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
425 goto skip_replacement;
426 }
427 } else {
428 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
429 }
430
431 /*
432 * Find a segment which begins after this one does.
433 */
434 for (p = NULL; q != NULL; q = nq) {
435 nq = TAILQ_NEXT(q, ipqe_q);
436 #ifdef TCP_REASS_COUNTERS
437 count++;
438 #endif
439 /*
440 * If the received segment is just right after this
441 * fragment, merge the two together and then check
442 * for further overlaps.
443 */
444 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
445 #ifdef TCPREASS_DEBUG
446 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
447 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
448 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
449 #endif
450 pkt_len += q->ipqe_len;
451 pkt_flags |= q->ipqe_flags;
452 pkt_seq = q->ipqe_seq;
453 m_cat(q->ipqe_m, m);
454 m = q->ipqe_m;
455 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
456 goto free_ipqe;
457 }
458 /*
459 * If the received segment is completely past this
460 * fragment, we need to go the next fragment.
461 */
462 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
463 p = q;
464 continue;
465 }
466 /*
467 * If the fragment is past the received segment,
468 * it (or any following) can't be concatenated.
469 */
470 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
471 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
472 break;
473 }
474
475 /*
476 * We've received all the data in this segment before.
477 * mark it as a duplicate and return.
478 */
479 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
480 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
481 tcpstat.tcps_rcvduppack++;
482 tcpstat.tcps_rcvdupbyte += pkt_len;
483 m_freem(m);
484 if (tiqe != NULL)
485 pool_put(&ipqent_pool, tiqe);
486 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
487 return (0);
488 }
489 /*
490 * Received segment completely overlaps this fragment
491 * so we drop the fragment (this keeps the temporal
492 * ordering of segments correct).
493 */
494 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
495 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
496 rcvpartdupbyte += q->ipqe_len;
497 m_freem(q->ipqe_m);
498 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
499 goto free_ipqe;
500 }
501 /*
502 * RX'ed segment extends past the end of the
503 * fragment. Drop the overlapping bytes. Then
504 * merge the fragment and segment then treat as
505 * a longer received packet.
506 */
507 if (SEQ_LT(q->ipqe_seq, pkt_seq)
508 && SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
509 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
510 #ifdef TCPREASS_DEBUG
511 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
512 tp, overlap,
513 pkt_seq, pkt_seq + pkt_len, pkt_len);
514 #endif
515 m_adj(m, overlap);
516 rcvpartdupbyte += overlap;
517 m_cat(q->ipqe_m, m);
518 m = q->ipqe_m;
519 pkt_seq = q->ipqe_seq;
520 pkt_len += q->ipqe_len - overlap;
521 rcvoobyte -= overlap;
522 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
523 goto free_ipqe;
524 }
525 /*
526 * RX'ed segment extends past the front of the
527 * fragment. Drop the overlapping bytes on the
528 * received packet. The packet will then be
529 * contatentated with this fragment a bit later.
530 */
531 if (SEQ_GT(q->ipqe_seq, pkt_seq)
532 && SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
533 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
534 #ifdef TCPREASS_DEBUG
535 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
536 tp, overlap,
537 pkt_seq, pkt_seq + pkt_len, pkt_len);
538 #endif
539 m_adj(m, -overlap);
540 pkt_len -= overlap;
541 rcvpartdupbyte += overlap;
542 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
543 rcvoobyte -= overlap;
544 }
545 /*
546 * If the received segment immediates precedes this
547 * fragment then tack the fragment onto this segment
548 * and reinsert the data.
549 */
550 if (q->ipqe_seq == pkt_seq + pkt_len) {
551 #ifdef TCPREASS_DEBUG
552 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
553 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
554 pkt_seq, pkt_seq + pkt_len, pkt_len);
555 #endif
556 pkt_len += q->ipqe_len;
557 pkt_flags |= q->ipqe_flags;
558 m_cat(m, q->ipqe_m);
559 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
560 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
561 if (tiqe == NULL) {
562 tiqe = q;
563 } else {
564 pool_put(&ipqent_pool, q);
565 }
566 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
567 break;
568 }
569 /*
570 * If the fragment is before the segment, remember it.
571 * When this loop is terminated, p will contain the
572 * pointer to fragment that is right before the received
573 * segment.
574 */
575 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
576 p = q;
577
578 continue;
579
580 /*
581 * This is a common operation. It also will allow
582 * to save doing a malloc/free in most instances.
583 */
584 free_ipqe:
585 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
586 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
587 if (tiqe == NULL) {
588 tiqe = q;
589 } else {
590 pool_put(&ipqent_pool, q);
591 }
592 }
593
594 #ifdef TCP_REASS_COUNTERS
595 if (count > 7)
596 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
597 else if (count > 0)
598 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
599 #endif
600
601 insert_it:
602
603 /*
604 * Allocate a new queue entry since the received segment did not
605 * collapse onto any other out-of-order block; thus we are allocating
606 * a new block. If it had collapsed, tiqe would not be NULL and
607 * we would be reusing it.
608 * XXX If we can't, just drop the packet. XXX
609 */
610 if (tiqe == NULL) {
611 tiqe = pool_get(&ipqent_pool, PR_NOWAIT);
612 if (tiqe == NULL) {
613 tcpstat.tcps_rcvmemdrop++;
614 m_freem(m);
615 return (0);
616 }
617 }
618
619 /*
620 * Update the counters.
621 */
622 tcpstat.tcps_rcvoopack++;
623 tcpstat.tcps_rcvoobyte += rcvoobyte;
624 if (rcvpartdupbyte) {
625 tcpstat.tcps_rcvpartduppack++;
626 tcpstat.tcps_rcvpartdupbyte += rcvpartdupbyte;
627 }
628
629 /*
630 * Insert the new fragment queue entry into both queues.
631 */
632 tiqe->ipqe_m = m;
633 tiqe->ipqe_seq = pkt_seq;
634 tiqe->ipqe_len = pkt_len;
635 tiqe->ipqe_flags = pkt_flags;
636 if (p == NULL) {
637 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
638 #ifdef TCPREASS_DEBUG
639 if (tiqe->ipqe_seq != tp->rcv_nxt)
640 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
641 tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
642 #endif
643 } else {
644 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
645 #ifdef TCPREASS_DEBUG
646 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
647 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
648 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
649 #endif
650 }
651
652 skip_replacement:
653
654 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
655
656 present:
657 /*
658 * Present data to user, advancing rcv_nxt through
659 * completed sequence space.
660 */
661 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
662 return (0);
663 q = TAILQ_FIRST(&tp->segq);
664 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
665 return (0);
666 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
667 return (0);
668
669 tp->rcv_nxt += q->ipqe_len;
670 pkt_flags = q->ipqe_flags & TH_FIN;
671 ND6_HINT(tp);
672
673 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
674 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
675 if (so->so_state & SS_CANTRCVMORE)
676 m_freem(q->ipqe_m);
677 else
678 sbappendstream(&so->so_rcv, q->ipqe_m);
679 pool_put(&ipqent_pool, q);
680 sorwakeup(so);
681 return (pkt_flags);
682 }
683
684 #ifdef INET6
685 int
686 tcp6_input(mp, offp, proto)
687 struct mbuf **mp;
688 int *offp, proto;
689 {
690 struct mbuf *m = *mp;
691
692 /*
693 * draft-itojun-ipv6-tcp-to-anycast
694 * better place to put this in?
695 */
696 if (m->m_flags & M_ANYCAST6) {
697 struct ip6_hdr *ip6;
698 if (m->m_len < sizeof(struct ip6_hdr)) {
699 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
700 tcpstat.tcps_rcvshort++;
701 return IPPROTO_DONE;
702 }
703 }
704 ip6 = mtod(m, struct ip6_hdr *);
705 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
706 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
707 return IPPROTO_DONE;
708 }
709
710 tcp_input(m, *offp, proto);
711 return IPPROTO_DONE;
712 }
713 #endif
714
715 #ifdef INET
716 static void
717 tcp4_log_refused(ip, th)
718 const struct ip *ip;
719 const struct tcphdr *th;
720 {
721 char src[4*sizeof "123"];
722 char dst[4*sizeof "123"];
723
724 if (ip) {
725 strcpy(src, inet_ntoa(ip->ip_src));
726 strcpy(dst, inet_ntoa(ip->ip_dst));
727 }
728 else {
729 strcpy(src, "(unknown)");
730 strcpy(dst, "(unknown)");
731 }
732 log(LOG_INFO,
733 "Connection attempt to TCP %s:%d from %s:%d\n",
734 dst, ntohs(th->th_dport),
735 src, ntohs(th->th_sport));
736 }
737 #endif
738
739 #ifdef INET6
740 static void
741 tcp6_log_refused(ip6, th)
742 const struct ip6_hdr *ip6;
743 const struct tcphdr *th;
744 {
745 char src[INET6_ADDRSTRLEN];
746 char dst[INET6_ADDRSTRLEN];
747
748 if (ip6) {
749 strcpy(src, ip6_sprintf(&ip6->ip6_src));
750 strcpy(dst, ip6_sprintf(&ip6->ip6_dst));
751 }
752 else {
753 strcpy(src, "(unknown v6)");
754 strcpy(dst, "(unknown v6)");
755 }
756 log(LOG_INFO,
757 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
758 dst, ntohs(th->th_dport),
759 src, ntohs(th->th_sport));
760 }
761 #endif
762
763 /*
764 * TCP input routine, follows pages 65-76 of the
765 * protocol specification dated September, 1981 very closely.
766 */
767 void
768 #if __STDC__
769 tcp_input(struct mbuf *m, ...)
770 #else
771 tcp_input(m, va_alist)
772 struct mbuf *m;
773 #endif
774 {
775 int proto;
776 struct tcphdr *th;
777 struct ip *ip;
778 struct inpcb *inp;
779 #ifdef INET6
780 struct ip6_hdr *ip6;
781 struct in6pcb *in6p;
782 #endif
783 caddr_t optp = NULL;
784 int optlen = 0;
785 int len, tlen, toff, hdroptlen = 0;
786 struct tcpcb *tp = 0;
787 int tiflags;
788 struct socket *so = NULL;
789 int todrop, acked, ourfinisacked, needoutput = 0;
790 short ostate = 0;
791 int iss = 0;
792 u_long tiwin;
793 struct tcp_opt_info opti;
794 int off, iphlen;
795 va_list ap;
796 int af; /* af on the wire */
797 struct mbuf *tcp_saveti = NULL;
798
799 va_start(ap, m);
800 toff = va_arg(ap, int);
801 proto = va_arg(ap, int);
802 va_end(ap);
803
804 tcpstat.tcps_rcvtotal++;
805
806 bzero(&opti, sizeof(opti));
807 opti.ts_present = 0;
808 opti.maxseg = 0;
809
810 /*
811 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
812 *
813 * TCP is, by definition, unicast, so we reject all
814 * multicast outright.
815 *
816 * Note, there are additional src/dst address checks in
817 * the AF-specific code below.
818 */
819 if (m->m_flags & (M_BCAST|M_MCAST)) {
820 /* XXX stat */
821 goto drop;
822 }
823 #ifdef INET6
824 if (m->m_flags & M_ANYCAST6) {
825 /* XXX stat */
826 goto drop;
827 }
828 #endif
829
830 /*
831 * Get IP and TCP header together in first mbuf.
832 * Note: IP leaves IP header in first mbuf.
833 */
834 ip = mtod(m, struct ip *);
835 #ifdef INET6
836 ip6 = NULL;
837 #endif
838 switch (ip->ip_v) {
839 #ifdef INET
840 case 4:
841 af = AF_INET;
842 iphlen = sizeof(struct ip);
843 #ifndef PULLDOWN_TEST
844 /* would like to get rid of this... */
845 if (toff > sizeof (struct ip)) {
846 ip_stripoptions(m, (struct mbuf *)0);
847 toff = sizeof(struct ip);
848 }
849 if (m->m_len < toff + sizeof (struct tcphdr)) {
850 if ((m = m_pullup(m, toff + sizeof (struct tcphdr))) == 0) {
851 tcpstat.tcps_rcvshort++;
852 return;
853 }
854 }
855 ip = mtod(m, struct ip *);
856 th = (struct tcphdr *)(mtod(m, caddr_t) + toff);
857 #else
858 ip = mtod(m, struct ip *);
859 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
860 sizeof(struct tcphdr));
861 if (th == NULL) {
862 tcpstat.tcps_rcvshort++;
863 return;
864 }
865 #endif
866 /* We do the checksum after PCB lookup... */
867 len = ntohs(ip->ip_len);
868 tlen = len - toff;
869 break;
870 #endif
871 #ifdef INET6
872 case 6:
873 ip = NULL;
874 iphlen = sizeof(struct ip6_hdr);
875 af = AF_INET6;
876 #ifndef PULLDOWN_TEST
877 if (m->m_len < toff + sizeof(struct tcphdr)) {
878 m = m_pullup(m, toff + sizeof(struct tcphdr)); /*XXX*/
879 if (m == NULL) {
880 tcpstat.tcps_rcvshort++;
881 return;
882 }
883 }
884 ip6 = mtod(m, struct ip6_hdr *);
885 th = (struct tcphdr *)(mtod(m, caddr_t) + toff);
886 #else
887 ip6 = mtod(m, struct ip6_hdr *);
888 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
889 sizeof(struct tcphdr));
890 if (th == NULL) {
891 tcpstat.tcps_rcvshort++;
892 return;
893 }
894 #endif
895
896 /* Be proactive about malicious use of IPv4 mapped address */
897 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
898 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
899 /* XXX stat */
900 goto drop;
901 }
902
903 /*
904 * Be proactive about unspecified IPv6 address in source.
905 * As we use all-zero to indicate unbounded/unconnected pcb,
906 * unspecified IPv6 address can be used to confuse us.
907 *
908 * Note that packets with unspecified IPv6 destination is
909 * already dropped in ip6_input.
910 */
911 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
912 /* XXX stat */
913 goto drop;
914 }
915
916 /*
917 * Make sure destination address is not multicast.
918 * Source address checked in ip6_input().
919 */
920 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
921 /* XXX stat */
922 goto drop;
923 }
924
925 /* We do the checksum after PCB lookup... */
926 len = m->m_pkthdr.len;
927 tlen = len - toff;
928 break;
929 #endif
930 default:
931 m_freem(m);
932 return;
933 }
934
935 KASSERT(TCP_HDR_ALIGNED_P(th));
936
937 /*
938 * Check that TCP offset makes sense,
939 * pull out TCP options and adjust length. XXX
940 */
941 off = th->th_off << 2;
942 if (off < sizeof (struct tcphdr) || off > tlen) {
943 tcpstat.tcps_rcvbadoff++;
944 goto drop;
945 }
946 tlen -= off;
947
948 /*
949 * tcp_input() has been modified to use tlen to mean the TCP data
950 * length throughout the function. Other functions can use
951 * m->m_pkthdr.len as the basis for calculating the TCP data length.
952 * rja
953 */
954
955 if (off > sizeof (struct tcphdr)) {
956 #ifndef PULLDOWN_TEST
957 if (m->m_len < toff + off) {
958 if ((m = m_pullup(m, toff + off)) == 0) {
959 tcpstat.tcps_rcvshort++;
960 return;
961 }
962 switch (af) {
963 #ifdef INET
964 case AF_INET:
965 ip = mtod(m, struct ip *);
966 break;
967 #endif
968 #ifdef INET6
969 case AF_INET6:
970 ip6 = mtod(m, struct ip6_hdr *);
971 break;
972 #endif
973 }
974 th = (struct tcphdr *)(mtod(m, caddr_t) + toff);
975 }
976 #else
977 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
978 if (th == NULL) {
979 tcpstat.tcps_rcvshort++;
980 return;
981 }
982 /*
983 * NOTE: ip/ip6 will not be affected by m_pulldown()
984 * (as they're before toff) and we don't need to update those.
985 */
986 #endif
987 KASSERT(TCP_HDR_ALIGNED_P(th));
988 optlen = off - sizeof (struct tcphdr);
989 optp = ((caddr_t)th) + sizeof(struct tcphdr);
990 /*
991 * Do quick retrieval of timestamp options ("options
992 * prediction?"). If timestamp is the only option and it's
993 * formatted as recommended in RFC 1323 appendix A, we
994 * quickly get the values now and not bother calling
995 * tcp_dooptions(), etc.
996 */
997 if ((optlen == TCPOLEN_TSTAMP_APPA ||
998 (optlen > TCPOLEN_TSTAMP_APPA &&
999 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1000 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
1001 (th->th_flags & TH_SYN) == 0) {
1002 opti.ts_present = 1;
1003 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
1004 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
1005 optp = NULL; /* we've parsed the options */
1006 }
1007 }
1008 tiflags = th->th_flags;
1009
1010 /*
1011 * Locate pcb for segment.
1012 */
1013 findpcb:
1014 inp = NULL;
1015 #ifdef INET6
1016 in6p = NULL;
1017 #endif
1018 switch (af) {
1019 #ifdef INET
1020 case AF_INET:
1021 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
1022 ip->ip_dst, th->th_dport);
1023 if (inp == 0) {
1024 ++tcpstat.tcps_pcbhashmiss;
1025 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
1026 }
1027 #ifdef INET6
1028 if (inp == 0) {
1029 struct in6_addr s, d;
1030
1031 /* mapped addr case */
1032 bzero(&s, sizeof(s));
1033 s.s6_addr16[5] = htons(0xffff);
1034 bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
1035 bzero(&d, sizeof(d));
1036 d.s6_addr16[5] = htons(0xffff);
1037 bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
1038 in6p = in6_pcblookup_connect(&tcb6, &s, th->th_sport,
1039 &d, th->th_dport, 0);
1040 if (in6p == 0) {
1041 ++tcpstat.tcps_pcbhashmiss;
1042 in6p = in6_pcblookup_bind(&tcb6, &d,
1043 th->th_dport, 0);
1044 }
1045 }
1046 #endif
1047 #ifndef INET6
1048 if (inp == 0)
1049 #else
1050 if (inp == 0 && in6p == 0)
1051 #endif
1052 {
1053 ++tcpstat.tcps_noport;
1054 if (tcp_log_refused && (tiflags & TH_SYN)) {
1055 tcp4_log_refused(ip, th);
1056 }
1057 TCP_FIELDS_TO_HOST(th);
1058 goto dropwithreset_ratelim;
1059 }
1060 #ifdef IPSEC
1061 if (inp && ipsec4_in_reject(m, inp)) {
1062 ipsecstat.in_polvio++;
1063 goto drop;
1064 }
1065 #ifdef INET6
1066 else if (in6p && ipsec4_in_reject_so(m, in6p->in6p_socket)) {
1067 ipsecstat.in_polvio++;
1068 goto drop;
1069 }
1070 #endif
1071 #endif /*IPSEC*/
1072 break;
1073 #endif /*INET*/
1074 #ifdef INET6
1075 case AF_INET6:
1076 {
1077 int faith;
1078
1079 #if defined(NFAITH) && NFAITH > 0
1080 faith = faithprefix(&ip6->ip6_dst);
1081 #else
1082 faith = 0;
1083 #endif
1084 in6p = in6_pcblookup_connect(&tcb6, &ip6->ip6_src, th->th_sport,
1085 &ip6->ip6_dst, th->th_dport, faith);
1086 if (in6p == NULL) {
1087 ++tcpstat.tcps_pcbhashmiss;
1088 in6p = in6_pcblookup_bind(&tcb6, &ip6->ip6_dst,
1089 th->th_dport, faith);
1090 }
1091 if (in6p == NULL) {
1092 ++tcpstat.tcps_noport;
1093 if (tcp_log_refused && (tiflags & TH_SYN)) {
1094 tcp6_log_refused(ip6, th);
1095 }
1096 TCP_FIELDS_TO_HOST(th);
1097 goto dropwithreset_ratelim;
1098 }
1099 #ifdef IPSEC
1100 if (ipsec6_in_reject(m, in6p)) {
1101 ipsec6stat.in_polvio++;
1102 goto drop;
1103 }
1104 #endif /*IPSEC*/
1105 break;
1106 }
1107 #endif
1108 }
1109
1110 /*
1111 * If the state is CLOSED (i.e., TCB does not exist) then
1112 * all data in the incoming segment is discarded.
1113 * If the TCB exists but is in CLOSED state, it is embryonic,
1114 * but should either do a listen or a connect soon.
1115 */
1116 tp = NULL;
1117 so = NULL;
1118 if (inp) {
1119 tp = intotcpcb(inp);
1120 so = inp->inp_socket;
1121 }
1122 #ifdef INET6
1123 else if (in6p) {
1124 tp = in6totcpcb(in6p);
1125 so = in6p->in6p_socket;
1126 }
1127 #endif
1128 if (tp == 0) {
1129 TCP_FIELDS_TO_HOST(th);
1130 goto dropwithreset_ratelim;
1131 }
1132 if (tp->t_state == TCPS_CLOSED)
1133 goto drop;
1134
1135 /*
1136 * Checksum extended TCP header and data.
1137 */
1138 switch (af) {
1139 #ifdef INET
1140 case AF_INET:
1141 switch (m->m_pkthdr.csum_flags &
1142 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
1143 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
1144 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
1145 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
1146 goto badcsum;
1147
1148 case M_CSUM_TCPv4|M_CSUM_DATA:
1149 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
1150 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0)
1151 goto badcsum;
1152 break;
1153
1154 case M_CSUM_TCPv4:
1155 /* Checksum was okay. */
1156 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
1157 break;
1158
1159 default:
1160 /* Must compute it ourselves. */
1161 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
1162 #ifndef PULLDOWN_TEST
1163 {
1164 struct ipovly *ipov;
1165 ipov = (struct ipovly *)ip;
1166 bzero(ipov->ih_x1, sizeof ipov->ih_x1);
1167 ipov->ih_len = htons(tlen + off);
1168
1169 if (in_cksum(m, len) != 0)
1170 goto badcsum;
1171 }
1172 #else
1173 if (in4_cksum(m, IPPROTO_TCP, toff, tlen + off) != 0)
1174 goto badcsum;
1175 #endif /* ! PULLDOWN_TEST */
1176 break;
1177 }
1178 break;
1179 #endif /* INET4 */
1180
1181 #ifdef INET6
1182 case AF_INET6:
1183 if (in6_cksum(m, IPPROTO_TCP, toff, tlen + off) != 0)
1184 goto badcsum;
1185 break;
1186 #endif /* INET6 */
1187 }
1188
1189 TCP_FIELDS_TO_HOST(th);
1190
1191 /* Unscale the window into a 32-bit value. */
1192 if ((tiflags & TH_SYN) == 0)
1193 tiwin = th->th_win << tp->snd_scale;
1194 else
1195 tiwin = th->th_win;
1196
1197 #ifdef INET6
1198 /* save packet options if user wanted */
1199 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1200 if (in6p->in6p_options) {
1201 m_freem(in6p->in6p_options);
1202 in6p->in6p_options = 0;
1203 }
1204 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1205 }
1206 #endif
1207
1208 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1209 union syn_cache_sa src;
1210 union syn_cache_sa dst;
1211
1212 bzero(&src, sizeof(src));
1213 bzero(&dst, sizeof(dst));
1214 switch (af) {
1215 #ifdef INET
1216 case AF_INET:
1217 src.sin.sin_len = sizeof(struct sockaddr_in);
1218 src.sin.sin_family = AF_INET;
1219 src.sin.sin_addr = ip->ip_src;
1220 src.sin.sin_port = th->th_sport;
1221
1222 dst.sin.sin_len = sizeof(struct sockaddr_in);
1223 dst.sin.sin_family = AF_INET;
1224 dst.sin.sin_addr = ip->ip_dst;
1225 dst.sin.sin_port = th->th_dport;
1226 break;
1227 #endif
1228 #ifdef INET6
1229 case AF_INET6:
1230 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1231 src.sin6.sin6_family = AF_INET6;
1232 src.sin6.sin6_addr = ip6->ip6_src;
1233 src.sin6.sin6_port = th->th_sport;
1234
1235 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1236 dst.sin6.sin6_family = AF_INET6;
1237 dst.sin6.sin6_addr = ip6->ip6_dst;
1238 dst.sin6.sin6_port = th->th_dport;
1239 break;
1240 #endif /* INET6 */
1241 default:
1242 goto badsyn; /*sanity*/
1243 }
1244
1245 if (so->so_options & SO_DEBUG) {
1246 ostate = tp->t_state;
1247
1248 tcp_saveti = NULL;
1249 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1250 goto nosave;
1251
1252 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1253 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1254 if (!tcp_saveti)
1255 goto nosave;
1256 } else {
1257 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1258 if (!tcp_saveti)
1259 goto nosave;
1260 tcp_saveti->m_len = iphlen;
1261 m_copydata(m, 0, iphlen,
1262 mtod(tcp_saveti, caddr_t));
1263 }
1264
1265 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1266 m_freem(tcp_saveti);
1267 tcp_saveti = NULL;
1268 } else {
1269 tcp_saveti->m_len += sizeof(struct tcphdr);
1270 bcopy(th, mtod(tcp_saveti, caddr_t) + iphlen,
1271 sizeof(struct tcphdr));
1272 }
1273 if (tcp_saveti) {
1274 /*
1275 * need to recover version # field, which was
1276 * overwritten on ip_cksum computation.
1277 */
1278 struct ip *sip;
1279 sip = mtod(tcp_saveti, struct ip *);
1280 switch (af) {
1281 #ifdef INET
1282 case AF_INET:
1283 sip->ip_v = 4;
1284 break;
1285 #endif
1286 #ifdef INET6
1287 case AF_INET6:
1288 sip->ip_v = 6;
1289 break;
1290 #endif
1291 }
1292 }
1293 nosave:;
1294 }
1295 if (so->so_options & SO_ACCEPTCONN) {
1296 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1297 if (tiflags & TH_RST) {
1298 syn_cache_reset(&src.sa, &dst.sa, th);
1299 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1300 (TH_ACK|TH_SYN)) {
1301 /*
1302 * Received a SYN,ACK. This should
1303 * never happen while we are in
1304 * LISTEN. Send an RST.
1305 */
1306 goto badsyn;
1307 } else if (tiflags & TH_ACK) {
1308 so = syn_cache_get(&src.sa, &dst.sa,
1309 th, toff, tlen, so, m);
1310 if (so == NULL) {
1311 /*
1312 * We don't have a SYN for
1313 * this ACK; send an RST.
1314 */
1315 goto badsyn;
1316 } else if (so ==
1317 (struct socket *)(-1)) {
1318 /*
1319 * We were unable to create
1320 * the connection. If the
1321 * 3-way handshake was
1322 * completed, and RST has
1323 * been sent to the peer.
1324 * Since the mbuf might be
1325 * in use for the reply,
1326 * do not free it.
1327 */
1328 m = NULL;
1329 } else {
1330 /*
1331 * We have created a
1332 * full-blown connection.
1333 */
1334 tp = NULL;
1335 inp = NULL;
1336 #ifdef INET6
1337 in6p = NULL;
1338 #endif
1339 switch (so->so_proto->pr_domain->dom_family) {
1340 #ifdef INET
1341 case AF_INET:
1342 inp = sotoinpcb(so);
1343 tp = intotcpcb(inp);
1344 break;
1345 #endif
1346 #ifdef INET6
1347 case AF_INET6:
1348 in6p = sotoin6pcb(so);
1349 tp = in6totcpcb(in6p);
1350 break;
1351 #endif
1352 }
1353 if (tp == NULL)
1354 goto badsyn; /*XXX*/
1355 tiwin <<= tp->snd_scale;
1356 goto after_listen;
1357 }
1358 } else {
1359 /*
1360 * None of RST, SYN or ACK was set.
1361 * This is an invalid packet for a
1362 * TCB in LISTEN state. Send a RST.
1363 */
1364 goto badsyn;
1365 }
1366 } else {
1367 /*
1368 * Received a SYN.
1369 */
1370
1371 #ifdef INET6
1372 /*
1373 * If deprecated address is forbidden, we do
1374 * not accept SYN to deprecated interface
1375 * address to prevent any new inbound
1376 * connection from getting established.
1377 * When we do not accept SYN, we send a TCP
1378 * RST, with deprecated source address (instead
1379 * of dropping it). We compromise it as it is
1380 * much better for peer to send a RST, and
1381 * RST will be the final packet for the
1382 * exchange.
1383 *
1384 * If we do not forbid deprecated addresses, we
1385 * accept the SYN packet. RFC2462 does not
1386 * suggest dropping SYN in this case.
1387 * If we decipher RFC2462 5.5.4, it says like
1388 * this:
1389 * 1. use of deprecated addr with existing
1390 * communication is okay - "SHOULD continue
1391 * to be used"
1392 * 2. use of it with new communication:
1393 * (2a) "SHOULD NOT be used if alternate
1394 * address with sufficient scope is
1395 * available"
1396 * (2b) nothing mentioned otherwise.
1397 * Here we fall into (2b) case as we have no
1398 * choice in our source address selection - we
1399 * must obey the peer.
1400 *
1401 * The wording in RFC2462 is confusing, and
1402 * there are multiple description text for
1403 * deprecated address handling - worse, they
1404 * are not exactly the same. I believe 5.5.4
1405 * is the best one, so we follow 5.5.4.
1406 */
1407 if (af == AF_INET6 && !ip6_use_deprecated) {
1408 struct in6_ifaddr *ia6;
1409 if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
1410 &ip6->ip6_dst)) &&
1411 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1412 tp = NULL;
1413 goto dropwithreset;
1414 }
1415 }
1416 #endif
1417
1418 /*
1419 * LISTEN socket received a SYN
1420 * from itself? This can't possibly
1421 * be valid; drop the packet.
1422 */
1423 if (th->th_sport == th->th_dport) {
1424 int i;
1425
1426 switch (af) {
1427 #ifdef INET
1428 case AF_INET:
1429 i = in_hosteq(ip->ip_src, ip->ip_dst);
1430 break;
1431 #endif
1432 #ifdef INET6
1433 case AF_INET6:
1434 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1435 break;
1436 #endif
1437 default:
1438 i = 1;
1439 }
1440 if (i) {
1441 tcpstat.tcps_badsyn++;
1442 goto drop;
1443 }
1444 }
1445
1446 /*
1447 * SYN looks ok; create compressed TCP
1448 * state for it.
1449 */
1450 if (so->so_qlen <= so->so_qlimit &&
1451 syn_cache_add(&src.sa, &dst.sa, th, tlen,
1452 so, m, optp, optlen, &opti))
1453 m = NULL;
1454 }
1455 goto drop;
1456 }
1457 }
1458
1459 after_listen:
1460 #ifdef DIAGNOSTIC
1461 /*
1462 * Should not happen now that all embryonic connections
1463 * are handled with compressed state.
1464 */
1465 if (tp->t_state == TCPS_LISTEN)
1466 panic("tcp_input: TCPS_LISTEN");
1467 #endif
1468
1469 /*
1470 * Segment received on connection.
1471 * Reset idle time and keep-alive timer.
1472 */
1473 tp->t_rcvtime = tcp_now;
1474 if (TCPS_HAVEESTABLISHED(tp->t_state))
1475 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle);
1476
1477 /*
1478 * Process options.
1479 */
1480 if (optp)
1481 tcp_dooptions(tp, optp, optlen, th, &opti);
1482
1483 /*
1484 * Header prediction: check for the two common cases
1485 * of a uni-directional data xfer. If the packet has
1486 * no control flags, is in-sequence, the window didn't
1487 * change and we're not retransmitting, it's a
1488 * candidate. If the length is zero and the ack moved
1489 * forward, we're the sender side of the xfer. Just
1490 * free the data acked & wake any higher level process
1491 * that was blocked waiting for space. If the length
1492 * is non-zero and the ack didn't move, we're the
1493 * receiver side. If we're getting packets in-order
1494 * (the reassembly queue is empty), add the data to
1495 * the socket buffer and note that we need a delayed ack.
1496 */
1497 if (tp->t_state == TCPS_ESTABLISHED &&
1498 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1499 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1500 th->th_seq == tp->rcv_nxt &&
1501 tiwin && tiwin == tp->snd_wnd &&
1502 tp->snd_nxt == tp->snd_max) {
1503
1504 /*
1505 * If last ACK falls within this segment's sequence numbers,
1506 * record the timestamp.
1507 */
1508 if (opti.ts_present &&
1509 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1510 SEQ_LT(tp->last_ack_sent, th->th_seq + tlen)) {
1511 tp->ts_recent_age = TCP_TIMESTAMP(tp);
1512 tp->ts_recent = opti.ts_val;
1513 }
1514
1515 if (tlen == 0) {
1516 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1517 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1518 tp->snd_cwnd >= tp->snd_wnd &&
1519 tp->t_dupacks < tcprexmtthresh) {
1520 /*
1521 * this is a pure ack for outstanding data.
1522 */
1523 ++tcpstat.tcps_predack;
1524 if (opti.ts_present && opti.ts_ecr)
1525 tcp_xmit_timer(tp,
1526 TCP_TIMESTAMP(tp) - opti.ts_ecr + 1);
1527 else if (tp->t_rtttime &&
1528 SEQ_GT(th->th_ack, tp->t_rtseq))
1529 tcp_xmit_timer(tp,
1530 tcp_now - tp->t_rtttime);
1531 acked = th->th_ack - tp->snd_una;
1532 tcpstat.tcps_rcvackpack++;
1533 tcpstat.tcps_rcvackbyte += acked;
1534 ND6_HINT(tp);
1535 sbdrop(&so->so_snd, acked);
1536 /*
1537 * We want snd_recover to track snd_una to
1538 * avoid sequence wraparound problems for
1539 * very large transfers.
1540 */
1541 tp->snd_una = tp->snd_recover = th->th_ack;
1542 m_freem(m);
1543
1544 /*
1545 * If all outstanding data are acked, stop
1546 * retransmit timer, otherwise restart timer
1547 * using current (possibly backed-off) value.
1548 * If process is waiting for space,
1549 * wakeup/selwakeup/signal. If data
1550 * are ready to send, let tcp_output
1551 * decide between more output or persist.
1552 */
1553 if (tp->snd_una == tp->snd_max)
1554 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1555 else if (TCP_TIMER_ISARMED(tp,
1556 TCPT_PERSIST) == 0)
1557 TCP_TIMER_ARM(tp, TCPT_REXMT,
1558 tp->t_rxtcur);
1559
1560 sowwakeup(so);
1561 if (so->so_snd.sb_cc)
1562 (void) tcp_output(tp);
1563 if (tcp_saveti)
1564 m_freem(tcp_saveti);
1565 return;
1566 }
1567 } else if (th->th_ack == tp->snd_una &&
1568 TAILQ_FIRST(&tp->segq) == NULL &&
1569 tlen <= sbspace(&so->so_rcv)) {
1570 /*
1571 * this is a pure, in-sequence data packet
1572 * with nothing on the reassembly queue and
1573 * we have enough buffer space to take it.
1574 */
1575 ++tcpstat.tcps_preddat;
1576 tp->rcv_nxt += tlen;
1577 tcpstat.tcps_rcvpack++;
1578 tcpstat.tcps_rcvbyte += tlen;
1579 ND6_HINT(tp);
1580 /*
1581 * Drop TCP, IP headers and TCP options then add data
1582 * to socket buffer.
1583 */
1584 m_adj(m, toff + off);
1585 sbappendstream(&so->so_rcv, m);
1586 sorwakeup(so);
1587 TCP_SETUP_ACK(tp, th);
1588 if (tp->t_flags & TF_ACKNOW)
1589 (void) tcp_output(tp);
1590 if (tcp_saveti)
1591 m_freem(tcp_saveti);
1592 return;
1593 }
1594 }
1595
1596 /*
1597 * Compute mbuf offset to TCP data segment.
1598 */
1599 hdroptlen = toff + off;
1600
1601 /*
1602 * Calculate amount of space in receive window,
1603 * and then do TCP input processing.
1604 * Receive window is amount of space in rcv queue,
1605 * but not less than advertised window.
1606 */
1607 { int win;
1608
1609 win = sbspace(&so->so_rcv);
1610 if (win < 0)
1611 win = 0;
1612 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1613 }
1614
1615 switch (tp->t_state) {
1616 case TCPS_LISTEN:
1617 /*
1618 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1619 */
1620 if (m->m_flags & (M_BCAST|M_MCAST))
1621 goto drop;
1622 switch (af) {
1623 #ifdef INET6
1624 case AF_INET6:
1625 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1626 goto drop;
1627 break;
1628 #endif /* INET6 */
1629 case AF_INET:
1630 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1631 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1632 goto drop;
1633 break;
1634 }
1635 break;
1636
1637 /*
1638 * If the state is SYN_SENT:
1639 * if seg contains an ACK, but not for our SYN, drop the input.
1640 * if seg contains a RST, then drop the connection.
1641 * if seg does not contain SYN, then drop it.
1642 * Otherwise this is an acceptable SYN segment
1643 * initialize tp->rcv_nxt and tp->irs
1644 * if seg contains ack then advance tp->snd_una
1645 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1646 * arrange for segment to be acked (eventually)
1647 * continue processing rest of data/controls, beginning with URG
1648 */
1649 case TCPS_SYN_SENT:
1650 if ((tiflags & TH_ACK) &&
1651 (SEQ_LEQ(th->th_ack, tp->iss) ||
1652 SEQ_GT(th->th_ack, tp->snd_max)))
1653 goto dropwithreset;
1654 if (tiflags & TH_RST) {
1655 if (tiflags & TH_ACK)
1656 tp = tcp_drop(tp, ECONNREFUSED);
1657 goto drop;
1658 }
1659 if ((tiflags & TH_SYN) == 0)
1660 goto drop;
1661 if (tiflags & TH_ACK) {
1662 tp->snd_una = tp->snd_recover = th->th_ack;
1663 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1664 tp->snd_nxt = tp->snd_una;
1665 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1666 }
1667 tp->irs = th->th_seq;
1668 tcp_rcvseqinit(tp);
1669 tp->t_flags |= TF_ACKNOW;
1670 tcp_mss_from_peer(tp, opti.maxseg);
1671
1672 /*
1673 * Initialize the initial congestion window. If we
1674 * had to retransmit the SYN, we must initialize cwnd
1675 * to 1 segment (i.e. the Loss Window).
1676 */
1677 if (tp->t_flags & TF_SYN_REXMT)
1678 tp->snd_cwnd = tp->t_peermss;
1679 else
1680 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win,
1681 tp->t_peermss);
1682
1683 tcp_rmx_rtt(tp);
1684 if (tiflags & TH_ACK) {
1685 tcpstat.tcps_connects++;
1686 soisconnected(so);
1687 tcp_established(tp);
1688 /* Do window scaling on this connection? */
1689 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1690 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1691 tp->snd_scale = tp->requested_s_scale;
1692 tp->rcv_scale = tp->request_r_scale;
1693 }
1694 TCP_REASS_LOCK(tp);
1695 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
1696 TCP_REASS_UNLOCK(tp);
1697 /*
1698 * if we didn't have to retransmit the SYN,
1699 * use its rtt as our initial srtt & rtt var.
1700 */
1701 if (tp->t_rtttime)
1702 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
1703 } else
1704 tp->t_state = TCPS_SYN_RECEIVED;
1705
1706 /*
1707 * Advance th->th_seq to correspond to first data byte.
1708 * If data, trim to stay within window,
1709 * dropping FIN if necessary.
1710 */
1711 th->th_seq++;
1712 if (tlen > tp->rcv_wnd) {
1713 todrop = tlen - tp->rcv_wnd;
1714 m_adj(m, -todrop);
1715 tlen = tp->rcv_wnd;
1716 tiflags &= ~TH_FIN;
1717 tcpstat.tcps_rcvpackafterwin++;
1718 tcpstat.tcps_rcvbyteafterwin += todrop;
1719 }
1720 tp->snd_wl1 = th->th_seq - 1;
1721 tp->rcv_up = th->th_seq;
1722 goto step6;
1723
1724 /*
1725 * If the state is SYN_RECEIVED:
1726 * If seg contains an ACK, but not for our SYN, drop the input
1727 * and generate an RST. See page 36, rfc793
1728 */
1729 case TCPS_SYN_RECEIVED:
1730 if ((tiflags & TH_ACK) &&
1731 (SEQ_LEQ(th->th_ack, tp->iss) ||
1732 SEQ_GT(th->th_ack, tp->snd_max)))
1733 goto dropwithreset;
1734 break;
1735 }
1736
1737 /*
1738 * States other than LISTEN or SYN_SENT.
1739 * First check timestamp, if present.
1740 * Then check that at least some bytes of segment are within
1741 * receive window. If segment begins before rcv_nxt,
1742 * drop leading data (and SYN); if nothing left, just ack.
1743 *
1744 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1745 * and it's less than ts_recent, drop it.
1746 */
1747 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
1748 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
1749
1750 /* Check to see if ts_recent is over 24 days old. */
1751 if ((int)(TCP_TIMESTAMP(tp) - tp->ts_recent_age) >
1752 TCP_PAWS_IDLE) {
1753 /*
1754 * Invalidate ts_recent. If this segment updates
1755 * ts_recent, the age will be reset later and ts_recent
1756 * will get a valid value. If it does not, setting
1757 * ts_recent to zero will at least satisfy the
1758 * requirement that zero be placed in the timestamp
1759 * echo reply when ts_recent isn't valid. The
1760 * age isn't reset until we get a valid ts_recent
1761 * because we don't want out-of-order segments to be
1762 * dropped when ts_recent is old.
1763 */
1764 tp->ts_recent = 0;
1765 } else {
1766 tcpstat.tcps_rcvduppack++;
1767 tcpstat.tcps_rcvdupbyte += tlen;
1768 tcpstat.tcps_pawsdrop++;
1769 goto dropafterack;
1770 }
1771 }
1772
1773 todrop = tp->rcv_nxt - th->th_seq;
1774 if (todrop > 0) {
1775 if (tiflags & TH_SYN) {
1776 tiflags &= ~TH_SYN;
1777 th->th_seq++;
1778 if (th->th_urp > 1)
1779 th->th_urp--;
1780 else {
1781 tiflags &= ~TH_URG;
1782 th->th_urp = 0;
1783 }
1784 todrop--;
1785 }
1786 if (todrop > tlen ||
1787 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1788 /*
1789 * Any valid FIN must be to the left of the window.
1790 * At this point the FIN must be a duplicate or
1791 * out of sequence; drop it.
1792 */
1793 tiflags &= ~TH_FIN;
1794 /*
1795 * Send an ACK to resynchronize and drop any data.
1796 * But keep on processing for RST or ACK.
1797 */
1798 tp->t_flags |= TF_ACKNOW;
1799 todrop = tlen;
1800 tcpstat.tcps_rcvdupbyte += todrop;
1801 tcpstat.tcps_rcvduppack++;
1802 } else {
1803 tcpstat.tcps_rcvpartduppack++;
1804 tcpstat.tcps_rcvpartdupbyte += todrop;
1805 }
1806 hdroptlen += todrop; /*drop from head afterwards*/
1807 th->th_seq += todrop;
1808 tlen -= todrop;
1809 if (th->th_urp > todrop)
1810 th->th_urp -= todrop;
1811 else {
1812 tiflags &= ~TH_URG;
1813 th->th_urp = 0;
1814 }
1815 }
1816
1817 /*
1818 * If new data are received on a connection after the
1819 * user processes are gone, then RST the other end.
1820 */
1821 if ((so->so_state & SS_NOFDREF) &&
1822 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1823 tp = tcp_close(tp);
1824 tcpstat.tcps_rcvafterclose++;
1825 goto dropwithreset;
1826 }
1827
1828 /*
1829 * If segment ends after window, drop trailing data
1830 * (and PUSH and FIN); if nothing left, just ACK.
1831 */
1832 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1833 if (todrop > 0) {
1834 tcpstat.tcps_rcvpackafterwin++;
1835 if (todrop >= tlen) {
1836 tcpstat.tcps_rcvbyteafterwin += tlen;
1837 /*
1838 * If a new connection request is received
1839 * while in TIME_WAIT, drop the old connection
1840 * and start over if the sequence numbers
1841 * are above the previous ones.
1842 *
1843 * NOTE: We will checksum the packet again, and
1844 * so we need to put the header fields back into
1845 * network order!
1846 * XXX This kind of sucks, but we don't expect
1847 * XXX this to happen very often, so maybe it
1848 * XXX doesn't matter so much.
1849 */
1850 if (tiflags & TH_SYN &&
1851 tp->t_state == TCPS_TIME_WAIT &&
1852 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1853 iss = tcp_new_iss(tp, tp->snd_nxt);
1854 tp = tcp_close(tp);
1855 TCP_FIELDS_TO_NET(th);
1856 goto findpcb;
1857 }
1858 /*
1859 * If window is closed can only take segments at
1860 * window edge, and have to drop data and PUSH from
1861 * incoming segments. Continue processing, but
1862 * remember to ack. Otherwise, drop segment
1863 * and ack.
1864 */
1865 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1866 tp->t_flags |= TF_ACKNOW;
1867 tcpstat.tcps_rcvwinprobe++;
1868 } else
1869 goto dropafterack;
1870 } else
1871 tcpstat.tcps_rcvbyteafterwin += todrop;
1872 m_adj(m, -todrop);
1873 tlen -= todrop;
1874 tiflags &= ~(TH_PUSH|TH_FIN);
1875 }
1876
1877 /*
1878 * If last ACK falls within this segment's sequence numbers,
1879 * and the timestamp is newer, record it.
1880 */
1881 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) &&
1882 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1883 SEQ_LT(tp->last_ack_sent, th->th_seq + tlen +
1884 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
1885 tp->ts_recent_age = TCP_TIMESTAMP(tp);
1886 tp->ts_recent = opti.ts_val;
1887 }
1888
1889 /*
1890 * If the RST bit is set examine the state:
1891 * SYN_RECEIVED STATE:
1892 * If passive open, return to LISTEN state.
1893 * If active open, inform user that connection was refused.
1894 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
1895 * Inform user that connection was reset, and close tcb.
1896 * CLOSING, LAST_ACK, TIME_WAIT STATES
1897 * Close the tcb.
1898 */
1899 if (tiflags&TH_RST) switch (tp->t_state) {
1900
1901 case TCPS_SYN_RECEIVED:
1902 so->so_error = ECONNREFUSED;
1903 goto close;
1904
1905 case TCPS_ESTABLISHED:
1906 case TCPS_FIN_WAIT_1:
1907 case TCPS_FIN_WAIT_2:
1908 case TCPS_CLOSE_WAIT:
1909 so->so_error = ECONNRESET;
1910 close:
1911 tp->t_state = TCPS_CLOSED;
1912 tcpstat.tcps_drops++;
1913 tp = tcp_close(tp);
1914 goto drop;
1915
1916 case TCPS_CLOSING:
1917 case TCPS_LAST_ACK:
1918 case TCPS_TIME_WAIT:
1919 tp = tcp_close(tp);
1920 goto drop;
1921 }
1922
1923 /*
1924 * If a SYN is in the window, then this is an
1925 * error and we send an RST and drop the connection.
1926 */
1927 if (tiflags & TH_SYN) {
1928 tp = tcp_drop(tp, ECONNRESET);
1929 goto dropwithreset;
1930 }
1931
1932 /*
1933 * If the ACK bit is off we drop the segment and return.
1934 */
1935 if ((tiflags & TH_ACK) == 0) {
1936 if (tp->t_flags & TF_ACKNOW)
1937 goto dropafterack;
1938 else
1939 goto drop;
1940 }
1941
1942 /*
1943 * Ack processing.
1944 */
1945 switch (tp->t_state) {
1946
1947 /*
1948 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
1949 * ESTABLISHED state and continue processing, otherwise
1950 * send an RST.
1951 */
1952 case TCPS_SYN_RECEIVED:
1953 if (SEQ_GT(tp->snd_una, th->th_ack) ||
1954 SEQ_GT(th->th_ack, tp->snd_max))
1955 goto dropwithreset;
1956 tcpstat.tcps_connects++;
1957 soisconnected(so);
1958 tcp_established(tp);
1959 /* Do window scaling? */
1960 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1961 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1962 tp->snd_scale = tp->requested_s_scale;
1963 tp->rcv_scale = tp->request_r_scale;
1964 }
1965 TCP_REASS_LOCK(tp);
1966 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
1967 TCP_REASS_UNLOCK(tp);
1968 tp->snd_wl1 = th->th_seq - 1;
1969 /* fall into ... */
1970
1971 /*
1972 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1973 * ACKs. If the ack is in the range
1974 * tp->snd_una < th->th_ack <= tp->snd_max
1975 * then advance tp->snd_una to th->th_ack and drop
1976 * data from the retransmission queue. If this ACK reflects
1977 * more up to date window information we update our window information.
1978 */
1979 case TCPS_ESTABLISHED:
1980 case TCPS_FIN_WAIT_1:
1981 case TCPS_FIN_WAIT_2:
1982 case TCPS_CLOSE_WAIT:
1983 case TCPS_CLOSING:
1984 case TCPS_LAST_ACK:
1985 case TCPS_TIME_WAIT:
1986
1987 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1988 if (tlen == 0 && tiwin == tp->snd_wnd) {
1989 tcpstat.tcps_rcvdupack++;
1990 /*
1991 * If we have outstanding data (other than
1992 * a window probe), this is a completely
1993 * duplicate ack (ie, window info didn't
1994 * change), the ack is the biggest we've
1995 * seen and we've seen exactly our rexmt
1996 * threshhold of them, assume a packet
1997 * has been dropped and retransmit it.
1998 * Kludge snd_nxt & the congestion
1999 * window so we send only this one
2000 * packet.
2001 *
2002 * We know we're losing at the current
2003 * window size so do congestion avoidance
2004 * (set ssthresh to half the current window
2005 * and pull our congestion window back to
2006 * the new ssthresh).
2007 *
2008 * Dup acks mean that packets have left the
2009 * network (they're now cached at the receiver)
2010 * so bump cwnd by the amount in the receiver
2011 * to keep a constant cwnd packets in the
2012 * network.
2013 */
2014 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2015 th->th_ack != tp->snd_una)
2016 tp->t_dupacks = 0;
2017 else if (++tp->t_dupacks == tcprexmtthresh) {
2018 tcp_seq onxt = tp->snd_nxt;
2019 u_int win =
2020 min(tp->snd_wnd, tp->snd_cwnd) /
2021 2 / tp->t_segsz;
2022 if (tcp_do_newreno && SEQ_LT(th->th_ack,
2023 tp->snd_recover)) {
2024 /*
2025 * False fast retransmit after
2026 * timeout. Do not cut window.
2027 */
2028 tp->snd_cwnd += tp->t_segsz;
2029 tp->t_dupacks = 0;
2030 (void) tcp_output(tp);
2031 goto drop;
2032 }
2033
2034 if (win < 2)
2035 win = 2;
2036 tp->snd_ssthresh = win * tp->t_segsz;
2037 tp->snd_recover = tp->snd_max;
2038 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2039 tp->t_rtttime = 0;
2040 tp->snd_nxt = th->th_ack;
2041 tp->snd_cwnd = tp->t_segsz;
2042 (void) tcp_output(tp);
2043 tp->snd_cwnd = tp->snd_ssthresh +
2044 tp->t_segsz * tp->t_dupacks;
2045 if (SEQ_GT(onxt, tp->snd_nxt))
2046 tp->snd_nxt = onxt;
2047 goto drop;
2048 } else if (tp->t_dupacks > tcprexmtthresh) {
2049 tp->snd_cwnd += tp->t_segsz;
2050 (void) tcp_output(tp);
2051 goto drop;
2052 }
2053 } else
2054 tp->t_dupacks = 0;
2055 break;
2056 }
2057 /*
2058 * If the congestion window was inflated to account
2059 * for the other side's cached packets, retract it.
2060 */
2061 if (tcp_do_newreno == 0) {
2062 if (tp->t_dupacks >= tcprexmtthresh &&
2063 tp->snd_cwnd > tp->snd_ssthresh)
2064 tp->snd_cwnd = tp->snd_ssthresh;
2065 tp->t_dupacks = 0;
2066 } else if (tp->t_dupacks >= tcprexmtthresh &&
2067 tcp_newreno(tp, th) == 0) {
2068 tp->snd_cwnd = tp->snd_ssthresh;
2069 /*
2070 * Window inflation should have left us with approx.
2071 * snd_ssthresh outstanding data. But in case we
2072 * would be inclined to send a burst, better to do
2073 * it via the slow start mechanism.
2074 */
2075 if (SEQ_SUB(tp->snd_max, th->th_ack) < tp->snd_ssthresh)
2076 tp->snd_cwnd = SEQ_SUB(tp->snd_max, th->th_ack)
2077 + tp->t_segsz;
2078 tp->t_dupacks = 0;
2079 }
2080 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2081 tcpstat.tcps_rcvacktoomuch++;
2082 goto dropafterack;
2083 }
2084 acked = th->th_ack - tp->snd_una;
2085 tcpstat.tcps_rcvackpack++;
2086 tcpstat.tcps_rcvackbyte += acked;
2087
2088 /*
2089 * If we have a timestamp reply, update smoothed
2090 * round trip time. If no timestamp is present but
2091 * transmit timer is running and timed sequence
2092 * number was acked, update smoothed round trip time.
2093 * Since we now have an rtt measurement, cancel the
2094 * timer backoff (cf., Phil Karn's retransmit alg.).
2095 * Recompute the initial retransmit timer.
2096 */
2097 if (opti.ts_present && opti.ts_ecr)
2098 tcp_xmit_timer(tp, TCP_TIMESTAMP(tp) - opti.ts_ecr + 1);
2099 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2100 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2101
2102 /*
2103 * If all outstanding data is acked, stop retransmit
2104 * timer and remember to restart (more output or persist).
2105 * If there is more data to be acked, restart retransmit
2106 * timer, using current (possibly backed-off) value.
2107 */
2108 if (th->th_ack == tp->snd_max) {
2109 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2110 needoutput = 1;
2111 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2112 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2113 /*
2114 * When new data is acked, open the congestion window.
2115 * If the window gives us less than ssthresh packets
2116 * in flight, open exponentially (segsz per packet).
2117 * Otherwise open linearly: segsz per window
2118 * (segsz^2 / cwnd per packet), plus a constant
2119 * fraction of a packet (segsz/8) to help larger windows
2120 * open quickly enough.
2121 */
2122 {
2123 u_int cw = tp->snd_cwnd;
2124 u_int incr = tp->t_segsz;
2125
2126 if (cw > tp->snd_ssthresh)
2127 incr = incr * incr / cw;
2128 if (tcp_do_newreno == 0 || SEQ_GEQ(th->th_ack, tp->snd_recover))
2129 tp->snd_cwnd = min(cw + incr,
2130 TCP_MAXWIN << tp->snd_scale);
2131 }
2132 ND6_HINT(tp);
2133 if (acked > so->so_snd.sb_cc) {
2134 tp->snd_wnd -= so->so_snd.sb_cc;
2135 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2136 ourfinisacked = 1;
2137 } else {
2138 sbdrop(&so->so_snd, acked);
2139 tp->snd_wnd -= acked;
2140 ourfinisacked = 0;
2141 }
2142 sowwakeup(so);
2143 /*
2144 * We want snd_recover to track snd_una to
2145 * avoid sequence wraparound problems for
2146 * very large transfers.
2147 */
2148 tp->snd_una = tp->snd_recover = th->th_ack;
2149 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2150 tp->snd_nxt = tp->snd_una;
2151
2152 switch (tp->t_state) {
2153
2154 /*
2155 * In FIN_WAIT_1 STATE in addition to the processing
2156 * for the ESTABLISHED state if our FIN is now acknowledged
2157 * then enter FIN_WAIT_2.
2158 */
2159 case TCPS_FIN_WAIT_1:
2160 if (ourfinisacked) {
2161 /*
2162 * If we can't receive any more
2163 * data, then closing user can proceed.
2164 * Starting the timer is contrary to the
2165 * specification, but if we don't get a FIN
2166 * we'll hang forever.
2167 */
2168 if (so->so_state & SS_CANTRCVMORE) {
2169 soisdisconnected(so);
2170 if (tcp_maxidle > 0)
2171 TCP_TIMER_ARM(tp, TCPT_2MSL,
2172 tcp_maxidle);
2173 }
2174 tp->t_state = TCPS_FIN_WAIT_2;
2175 }
2176 break;
2177
2178 /*
2179 * In CLOSING STATE in addition to the processing for
2180 * the ESTABLISHED state if the ACK acknowledges our FIN
2181 * then enter the TIME-WAIT state, otherwise ignore
2182 * the segment.
2183 */
2184 case TCPS_CLOSING:
2185 if (ourfinisacked) {
2186 tp->t_state = TCPS_TIME_WAIT;
2187 tcp_canceltimers(tp);
2188 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2189 soisdisconnected(so);
2190 }
2191 break;
2192
2193 /*
2194 * In LAST_ACK, we may still be waiting for data to drain
2195 * and/or to be acked, as well as for the ack of our FIN.
2196 * If our FIN is now acknowledged, delete the TCB,
2197 * enter the closed state and return.
2198 */
2199 case TCPS_LAST_ACK:
2200 if (ourfinisacked) {
2201 tp = tcp_close(tp);
2202 goto drop;
2203 }
2204 break;
2205
2206 /*
2207 * In TIME_WAIT state the only thing that should arrive
2208 * is a retransmission of the remote FIN. Acknowledge
2209 * it and restart the finack timer.
2210 */
2211 case TCPS_TIME_WAIT:
2212 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2213 goto dropafterack;
2214 }
2215 }
2216
2217 step6:
2218 /*
2219 * Update window information.
2220 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2221 */
2222 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2223 (tp->snd_wl1 == th->th_seq && SEQ_LT(tp->snd_wl2, th->th_ack)) ||
2224 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))) {
2225 /* keep track of pure window updates */
2226 if (tlen == 0 &&
2227 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2228 tcpstat.tcps_rcvwinupd++;
2229 tp->snd_wnd = tiwin;
2230 tp->snd_wl1 = th->th_seq;
2231 tp->snd_wl2 = th->th_ack;
2232 if (tp->snd_wnd > tp->max_sndwnd)
2233 tp->max_sndwnd = tp->snd_wnd;
2234 needoutput = 1;
2235 }
2236
2237 /*
2238 * Process segments with URG.
2239 */
2240 if ((tiflags & TH_URG) && th->th_urp &&
2241 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2242 /*
2243 * This is a kludge, but if we receive and accept
2244 * random urgent pointers, we'll crash in
2245 * soreceive. It's hard to imagine someone
2246 * actually wanting to send this much urgent data.
2247 */
2248 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2249 th->th_urp = 0; /* XXX */
2250 tiflags &= ~TH_URG; /* XXX */
2251 goto dodata; /* XXX */
2252 }
2253 /*
2254 * If this segment advances the known urgent pointer,
2255 * then mark the data stream. This should not happen
2256 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2257 * a FIN has been received from the remote side.
2258 * In these states we ignore the URG.
2259 *
2260 * According to RFC961 (Assigned Protocols),
2261 * the urgent pointer points to the last octet
2262 * of urgent data. We continue, however,
2263 * to consider it to indicate the first octet
2264 * of data past the urgent section as the original
2265 * spec states (in one of two places).
2266 */
2267 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2268 tp->rcv_up = th->th_seq + th->th_urp;
2269 so->so_oobmark = so->so_rcv.sb_cc +
2270 (tp->rcv_up - tp->rcv_nxt) - 1;
2271 if (so->so_oobmark == 0)
2272 so->so_state |= SS_RCVATMARK;
2273 sohasoutofband(so);
2274 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2275 }
2276 /*
2277 * Remove out of band data so doesn't get presented to user.
2278 * This can happen independent of advancing the URG pointer,
2279 * but if two URG's are pending at once, some out-of-band
2280 * data may creep in... ick.
2281 */
2282 if (th->th_urp <= (u_int16_t) tlen
2283 #ifdef SO_OOBINLINE
2284 && (so->so_options & SO_OOBINLINE) == 0
2285 #endif
2286 )
2287 tcp_pulloutofband(so, th, m, hdroptlen);
2288 } else
2289 /*
2290 * If no out of band data is expected,
2291 * pull receive urgent pointer along
2292 * with the receive window.
2293 */
2294 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2295 tp->rcv_up = tp->rcv_nxt;
2296 dodata: /* XXX */
2297
2298 /*
2299 * Process the segment text, merging it into the TCP sequencing queue,
2300 * and arranging for acknowledgement of receipt if necessary.
2301 * This process logically involves adjusting tp->rcv_wnd as data
2302 * is presented to the user (this happens in tcp_usrreq.c,
2303 * case PRU_RCVD). If a FIN has already been received on this
2304 * connection then we just ignore the text.
2305 */
2306 if ((tlen || (tiflags & TH_FIN)) &&
2307 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2308 /*
2309 * Insert segment ti into reassembly queue of tcp with
2310 * control block tp. Return TH_FIN if reassembly now includes
2311 * a segment with FIN. The macro form does the common case
2312 * inline (segment is the next to be received on an
2313 * established connection, and the queue is empty),
2314 * avoiding linkage into and removal from the queue and
2315 * repetition of various conversions.
2316 * Set DELACK for segments received in order, but ack
2317 * immediately when segments are out of order
2318 * (so fast retransmit can work).
2319 */
2320 /* NOTE: this was TCP_REASS() macro, but used only once */
2321 TCP_REASS_LOCK(tp);
2322 if (th->th_seq == tp->rcv_nxt &&
2323 TAILQ_FIRST(&tp->segq) == NULL &&
2324 tp->t_state == TCPS_ESTABLISHED) {
2325 TCP_SETUP_ACK(tp, th);
2326 tp->rcv_nxt += tlen;
2327 tiflags = th->th_flags & TH_FIN;
2328 tcpstat.tcps_rcvpack++;
2329 tcpstat.tcps_rcvbyte += tlen;
2330 ND6_HINT(tp);
2331 m_adj(m, hdroptlen);
2332 sbappendstream(&(so)->so_rcv, m);
2333 sorwakeup(so);
2334 } else {
2335 m_adj(m, hdroptlen);
2336 tiflags = tcp_reass(tp, th, m, &tlen);
2337 tp->t_flags |= TF_ACKNOW;
2338 }
2339 TCP_REASS_UNLOCK(tp);
2340
2341 /*
2342 * Note the amount of data that peer has sent into
2343 * our window, in order to estimate the sender's
2344 * buffer size.
2345 */
2346 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2347 } else {
2348 m_freem(m);
2349 m = NULL;
2350 tiflags &= ~TH_FIN;
2351 }
2352
2353 /*
2354 * If FIN is received ACK the FIN and let the user know
2355 * that the connection is closing. Ignore a FIN received before
2356 * the connection is fully established.
2357 */
2358 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2359 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2360 socantrcvmore(so);
2361 tp->t_flags |= TF_ACKNOW;
2362 tp->rcv_nxt++;
2363 }
2364 switch (tp->t_state) {
2365
2366 /*
2367 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2368 */
2369 case TCPS_ESTABLISHED:
2370 tp->t_state = TCPS_CLOSE_WAIT;
2371 break;
2372
2373 /*
2374 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2375 * enter the CLOSING state.
2376 */
2377 case TCPS_FIN_WAIT_1:
2378 tp->t_state = TCPS_CLOSING;
2379 break;
2380
2381 /*
2382 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2383 * starting the time-wait timer, turning off the other
2384 * standard timers.
2385 */
2386 case TCPS_FIN_WAIT_2:
2387 tp->t_state = TCPS_TIME_WAIT;
2388 tcp_canceltimers(tp);
2389 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2390 soisdisconnected(so);
2391 break;
2392
2393 /*
2394 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2395 */
2396 case TCPS_TIME_WAIT:
2397 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2398 break;
2399 }
2400 }
2401 #ifdef TCP_DEBUG
2402 if (so->so_options & SO_DEBUG)
2403 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2404 #endif
2405
2406 /*
2407 * Return any desired output.
2408 */
2409 if (needoutput || (tp->t_flags & TF_ACKNOW))
2410 (void) tcp_output(tp);
2411 if (tcp_saveti)
2412 m_freem(tcp_saveti);
2413 return;
2414
2415 badsyn:
2416 /*
2417 * Received a bad SYN. Increment counters and dropwithreset.
2418 */
2419 tcpstat.tcps_badsyn++;
2420 tp = NULL;
2421 goto dropwithreset;
2422
2423 dropafterack:
2424 /*
2425 * Generate an ACK dropping incoming segment if it occupies
2426 * sequence space, where the ACK reflects our state.
2427 */
2428 if (tiflags & TH_RST)
2429 goto drop;
2430 m_freem(m);
2431 tp->t_flags |= TF_ACKNOW;
2432 (void) tcp_output(tp);
2433 if (tcp_saveti)
2434 m_freem(tcp_saveti);
2435 return;
2436
2437 dropwithreset_ratelim:
2438 /*
2439 * We may want to rate-limit RSTs in certain situations,
2440 * particularly if we are sending an RST in response to
2441 * an attempt to connect to or otherwise communicate with
2442 * a port for which we have no socket.
2443 */
2444 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2445 tcp_rst_ppslim) == 0) {
2446 /* XXX stat */
2447 goto drop;
2448 }
2449 /* ...fall into dropwithreset... */
2450
2451 dropwithreset:
2452 /*
2453 * Generate a RST, dropping incoming segment.
2454 * Make ACK acceptable to originator of segment.
2455 */
2456 if (tiflags & TH_RST)
2457 goto drop;
2458
2459 switch (af) {
2460 #ifdef INET6
2461 case AF_INET6:
2462 /* For following calls to tcp_respond */
2463 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
2464 goto drop;
2465 break;
2466 #endif /* INET6 */
2467 case AF_INET:
2468 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
2469 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2470 goto drop;
2471 }
2472
2473 {
2474 /*
2475 * need to recover version # field, which was overwritten on
2476 * ip_cksum computation.
2477 */
2478 struct ip *sip;
2479 sip = mtod(m, struct ip *);
2480 switch (af) {
2481 #ifdef INET
2482 case AF_INET:
2483 sip->ip_v = 4;
2484 break;
2485 #endif
2486 #ifdef INET6
2487 case AF_INET6:
2488 sip->ip_v = 6;
2489 break;
2490 #endif
2491 }
2492 }
2493 if (tiflags & TH_ACK)
2494 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
2495 else {
2496 if (tiflags & TH_SYN)
2497 tlen++;
2498 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
2499 TH_RST|TH_ACK);
2500 }
2501 if (tcp_saveti)
2502 m_freem(tcp_saveti);
2503 return;
2504
2505 badcsum:
2506 tcpstat.tcps_rcvbadsum++;
2507 drop:
2508 /*
2509 * Drop space held by incoming segment and return.
2510 */
2511 if (tp) {
2512 if (tp->t_inpcb)
2513 so = tp->t_inpcb->inp_socket;
2514 #ifdef INET6
2515 else if (tp->t_in6pcb)
2516 so = tp->t_in6pcb->in6p_socket;
2517 #endif
2518 else
2519 so = NULL;
2520 #ifdef TCP_DEBUG
2521 if (so && (so->so_options & SO_DEBUG) != 0)
2522 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
2523 #endif
2524 }
2525 if (tcp_saveti)
2526 m_freem(tcp_saveti);
2527 m_freem(m);
2528 return;
2529 }
2530
2531 void
2532 tcp_dooptions(tp, cp, cnt, th, oi)
2533 struct tcpcb *tp;
2534 u_char *cp;
2535 int cnt;
2536 struct tcphdr *th;
2537 struct tcp_opt_info *oi;
2538 {
2539 u_int16_t mss;
2540 int opt, optlen;
2541
2542 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2543 opt = cp[0];
2544 if (opt == TCPOPT_EOL)
2545 break;
2546 if (opt == TCPOPT_NOP)
2547 optlen = 1;
2548 else {
2549 if (cnt < 2)
2550 break;
2551 optlen = cp[1];
2552 if (optlen < 2 || optlen > cnt)
2553 break;
2554 }
2555 switch (opt) {
2556
2557 default:
2558 continue;
2559
2560 case TCPOPT_MAXSEG:
2561 if (optlen != TCPOLEN_MAXSEG)
2562 continue;
2563 if (!(th->th_flags & TH_SYN))
2564 continue;
2565 bcopy(cp + 2, &mss, sizeof(mss));
2566 oi->maxseg = ntohs(mss);
2567 break;
2568
2569 case TCPOPT_WINDOW:
2570 if (optlen != TCPOLEN_WINDOW)
2571 continue;
2572 if (!(th->th_flags & TH_SYN))
2573 continue;
2574 tp->t_flags |= TF_RCVD_SCALE;
2575 tp->requested_s_scale = cp[2];
2576 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
2577 #if 0 /*XXX*/
2578 char *p;
2579
2580 if (ip)
2581 p = ntohl(ip->ip_src);
2582 #ifdef INET6
2583 else if (ip6)
2584 p = ip6_sprintf(&ip6->ip6_src);
2585 #endif
2586 else
2587 p = "(unknown)";
2588 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
2589 "assuming %d\n",
2590 tp->requested_s_scale, p,
2591 TCP_MAX_WINSHIFT);
2592 #else
2593 log(LOG_ERR, "TCP: invalid wscale %d, "
2594 "assuming %d\n",
2595 tp->requested_s_scale,
2596 TCP_MAX_WINSHIFT);
2597 #endif
2598 tp->requested_s_scale = TCP_MAX_WINSHIFT;
2599 }
2600 break;
2601
2602 case TCPOPT_TIMESTAMP:
2603 if (optlen != TCPOLEN_TIMESTAMP)
2604 continue;
2605 oi->ts_present = 1;
2606 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
2607 NTOHL(oi->ts_val);
2608 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
2609 NTOHL(oi->ts_ecr);
2610
2611 /*
2612 * A timestamp received in a SYN makes
2613 * it ok to send timestamp requests and replies.
2614 */
2615 if (th->th_flags & TH_SYN) {
2616 tp->t_flags |= TF_RCVD_TSTMP;
2617 tp->ts_recent = oi->ts_val;
2618 tp->ts_recent_age = TCP_TIMESTAMP(tp);
2619 }
2620 break;
2621 case TCPOPT_SACK_PERMITTED:
2622 if (optlen != TCPOLEN_SACK_PERMITTED)
2623 continue;
2624 if (!(th->th_flags & TH_SYN))
2625 continue;
2626 tp->t_flags &= ~TF_CANT_TXSACK;
2627 break;
2628
2629 case TCPOPT_SACK:
2630 if (tp->t_flags & TF_IGNR_RXSACK)
2631 continue;
2632 if (optlen % 8 != 2 || optlen < 10)
2633 continue;
2634 cp += 2;
2635 optlen -= 2;
2636 for (; optlen > 0; cp -= 8, optlen -= 8) {
2637 tcp_seq lwe, rwe;
2638 bcopy((char *)cp, (char *) &lwe, sizeof(lwe));
2639 NTOHL(lwe);
2640 bcopy((char *)cp, (char *) &rwe, sizeof(rwe));
2641 NTOHL(rwe);
2642 /* tcp_mark_sacked(tp, lwe, rwe); */
2643 }
2644 break;
2645 }
2646 }
2647 }
2648
2649 /*
2650 * Pull out of band byte out of a segment so
2651 * it doesn't appear in the user's data queue.
2652 * It is still reflected in the segment length for
2653 * sequencing purposes.
2654 */
2655 void
2656 tcp_pulloutofband(so, th, m, off)
2657 struct socket *so;
2658 struct tcphdr *th;
2659 struct mbuf *m;
2660 int off;
2661 {
2662 int cnt = off + th->th_urp - 1;
2663
2664 while (cnt >= 0) {
2665 if (m->m_len > cnt) {
2666 char *cp = mtod(m, caddr_t) + cnt;
2667 struct tcpcb *tp = sototcpcb(so);
2668
2669 tp->t_iobc = *cp;
2670 tp->t_oobflags |= TCPOOB_HAVEDATA;
2671 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2672 m->m_len--;
2673 return;
2674 }
2675 cnt -= m->m_len;
2676 m = m->m_next;
2677 if (m == 0)
2678 break;
2679 }
2680 panic("tcp_pulloutofband");
2681 }
2682
2683 /*
2684 * Collect new round-trip time estimate
2685 * and update averages and current timeout.
2686 */
2687 void
2688 tcp_xmit_timer(tp, rtt)
2689 struct tcpcb *tp;
2690 uint32_t rtt;
2691 {
2692 int32_t delta;
2693
2694 tcpstat.tcps_rttupdated++;
2695 if (tp->t_srtt != 0) {
2696 /*
2697 * srtt is stored as fixed point with 3 bits after the
2698 * binary point (i.e., scaled by 8). The following magic
2699 * is equivalent to the smoothing algorithm in rfc793 with
2700 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2701 * point). Adjust rtt to origin 0.
2702 */
2703 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
2704 if ((tp->t_srtt += delta) <= 0)
2705 tp->t_srtt = 1 << 2;
2706 /*
2707 * We accumulate a smoothed rtt variance (actually, a
2708 * smoothed mean difference), then set the retransmit
2709 * timer to smoothed rtt + 4 times the smoothed variance.
2710 * rttvar is stored as fixed point with 2 bits after the
2711 * binary point (scaled by 4). The following is
2712 * equivalent to rfc793 smoothing with an alpha of .75
2713 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2714 * rfc793's wired-in beta.
2715 */
2716 if (delta < 0)
2717 delta = -delta;
2718 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
2719 if ((tp->t_rttvar += delta) <= 0)
2720 tp->t_rttvar = 1 << 2;
2721 } else {
2722 /*
2723 * No rtt measurement yet - use the unsmoothed rtt.
2724 * Set the variance to half the rtt (so our first
2725 * retransmit happens at 3*rtt).
2726 */
2727 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
2728 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
2729 }
2730 tp->t_rtttime = 0;
2731 tp->t_rxtshift = 0;
2732
2733 /*
2734 * the retransmit should happen at rtt + 4 * rttvar.
2735 * Because of the way we do the smoothing, srtt and rttvar
2736 * will each average +1/2 tick of bias. When we compute
2737 * the retransmit timer, we want 1/2 tick of rounding and
2738 * 1 extra tick because of +-1/2 tick uncertainty in the
2739 * firing of the timer. The bias will give us exactly the
2740 * 1.5 tick we need. But, because the bias is
2741 * statistical, we have to test that we don't drop below
2742 * the minimum feasible timer (which is 2 ticks).
2743 */
2744 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2745 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2746
2747 /*
2748 * We received an ack for a packet that wasn't retransmitted;
2749 * it is probably safe to discard any error indications we've
2750 * received recently. This isn't quite right, but close enough
2751 * for now (a route might have failed after we sent a segment,
2752 * and the return path might not be symmetrical).
2753 */
2754 tp->t_softerror = 0;
2755 }
2756
2757 /*
2758 * Checks for partial ack. If partial ack arrives, force the retransmission
2759 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return
2760 * 1. By setting snd_nxt to th_ack, this forces retransmission timer to
2761 * be started again. If the ack advances at least to tp->snd_recover, return 0.
2762 */
2763 int
2764 tcp_newreno(tp, th)
2765 struct tcpcb *tp;
2766 struct tcphdr *th;
2767 {
2768 tcp_seq onxt = tp->snd_nxt;
2769 u_long ocwnd = tp->snd_cwnd;
2770
2771 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2772 /*
2773 * snd_una has not yet been updated and the socket's send
2774 * buffer has not yet drained off the ACK'd data, so we
2775 * have to leave snd_una as it was to get the correct data
2776 * offset in tcp_output().
2777 */
2778 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2779 tp->t_rtttime = 0;
2780 tp->snd_nxt = th->th_ack;
2781 /*
2782 * Set snd_cwnd to one segment beyond ACK'd offset. snd_una
2783 * is not yet updated when we're called.
2784 */
2785 tp->snd_cwnd = tp->t_segsz + (th->th_ack - tp->snd_una);
2786 (void) tcp_output(tp);
2787 tp->snd_cwnd = ocwnd;
2788 if (SEQ_GT(onxt, tp->snd_nxt))
2789 tp->snd_nxt = onxt;
2790 /*
2791 * Partial window deflation. Relies on fact that tp->snd_una
2792 * not updated yet.
2793 */
2794 tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_segsz);
2795 return 1;
2796 }
2797 return 0;
2798 }
2799
2800
2801 /*
2802 * TCP compressed state engine. Currently used to hold compressed
2803 * state for SYN_RECEIVED.
2804 */
2805
2806 u_long syn_cache_count;
2807 u_int32_t syn_hash1, syn_hash2;
2808
2809 #define SYN_HASH(sa, sp, dp) \
2810 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
2811 ((u_int32_t)(sp)))^syn_hash2)))
2812 #ifndef INET6
2813 #define SYN_HASHALL(hash, src, dst) \
2814 do { \
2815 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \
2816 ((struct sockaddr_in *)(src))->sin_port, \
2817 ((struct sockaddr_in *)(dst))->sin_port); \
2818 } while (0)
2819 #else
2820 #define SYN_HASH6(sa, sp, dp) \
2821 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
2822 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
2823 & 0x7fffffff)
2824
2825 #define SYN_HASHALL(hash, src, dst) \
2826 do { \
2827 switch ((src)->sa_family) { \
2828 case AF_INET: \
2829 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \
2830 ((struct sockaddr_in *)(src))->sin_port, \
2831 ((struct sockaddr_in *)(dst))->sin_port); \
2832 break; \
2833 case AF_INET6: \
2834 hash = SYN_HASH6(&((struct sockaddr_in6 *)(src))->sin6_addr, \
2835 ((struct sockaddr_in6 *)(src))->sin6_port, \
2836 ((struct sockaddr_in6 *)(dst))->sin6_port); \
2837 break; \
2838 default: \
2839 hash = 0; \
2840 } \
2841 } while (/*CONSTCOND*/0)
2842 #endif /* INET6 */
2843
2844 #define SYN_CACHE_RM(sc) \
2845 do { \
2846 TAILQ_REMOVE(&tcp_syn_cache[(sc)->sc_bucketidx].sch_bucket, \
2847 (sc), sc_bucketq); \
2848 (sc)->sc_tp = NULL; \
2849 LIST_REMOVE((sc), sc_tpq); \
2850 tcp_syn_cache[(sc)->sc_bucketidx].sch_length--; \
2851 callout_stop(&(sc)->sc_timer); \
2852 syn_cache_count--; \
2853 } while (/*CONSTCOND*/0)
2854
2855 #define SYN_CACHE_PUT(sc) \
2856 do { \
2857 if ((sc)->sc_ipopts) \
2858 (void) m_free((sc)->sc_ipopts); \
2859 if ((sc)->sc_route4.ro_rt != NULL) \
2860 RTFREE((sc)->sc_route4.ro_rt); \
2861 pool_put(&syn_cache_pool, (sc)); \
2862 } while (/*CONSTCOND*/0)
2863
2864 struct pool syn_cache_pool;
2865
2866 /*
2867 * We don't estimate RTT with SYNs, so each packet starts with the default
2868 * RTT and each timer step has a fixed timeout value.
2869 */
2870 #define SYN_CACHE_TIMER_ARM(sc) \
2871 do { \
2872 TCPT_RANGESET((sc)->sc_rxtcur, \
2873 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
2874 TCPTV_REXMTMAX); \
2875 callout_reset(&(sc)->sc_timer, \
2876 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
2877 } while (/*CONSTCOND*/0)
2878
2879 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
2880
2881 void
2882 syn_cache_init()
2883 {
2884 int i;
2885
2886 /* Initialize the hash buckets. */
2887 for (i = 0; i < tcp_syn_cache_size; i++)
2888 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
2889
2890 /* Initialize the syn cache pool. */
2891 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0,
2892 "synpl", NULL);
2893 }
2894
2895 void
2896 syn_cache_insert(sc, tp)
2897 struct syn_cache *sc;
2898 struct tcpcb *tp;
2899 {
2900 struct syn_cache_head *scp;
2901 struct syn_cache *sc2;
2902 int s;
2903
2904 /*
2905 * If there are no entries in the hash table, reinitialize
2906 * the hash secrets.
2907 */
2908 if (syn_cache_count == 0) {
2909 struct timeval tv;
2910 microtime(&tv);
2911 syn_hash1 = arc4random() ^ (u_long)≻
2912 syn_hash2 = arc4random() ^ tv.tv_usec;
2913 }
2914
2915 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
2916 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
2917 scp = &tcp_syn_cache[sc->sc_bucketidx];
2918
2919 /*
2920 * Make sure that we don't overflow the per-bucket
2921 * limit or the total cache size limit.
2922 */
2923 s = splsoftnet();
2924 if (scp->sch_length >= tcp_syn_bucket_limit) {
2925 tcpstat.tcps_sc_bucketoverflow++;
2926 /*
2927 * The bucket is full. Toss the oldest element in the
2928 * bucket. This will be the first entry in the bucket.
2929 */
2930 sc2 = TAILQ_FIRST(&scp->sch_bucket);
2931 #ifdef DIAGNOSTIC
2932 /*
2933 * This should never happen; we should always find an
2934 * entry in our bucket.
2935 */
2936 if (sc2 == NULL)
2937 panic("syn_cache_insert: bucketoverflow: impossible");
2938 #endif
2939 SYN_CACHE_RM(sc2);
2940 SYN_CACHE_PUT(sc2);
2941 } else if (syn_cache_count >= tcp_syn_cache_limit) {
2942 struct syn_cache_head *scp2, *sce;
2943
2944 tcpstat.tcps_sc_overflowed++;
2945 /*
2946 * The cache is full. Toss the oldest entry in the
2947 * first non-empty bucket we can find.
2948 *
2949 * XXX We would really like to toss the oldest
2950 * entry in the cache, but we hope that this
2951 * condition doesn't happen very often.
2952 */
2953 scp2 = scp;
2954 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
2955 sce = &tcp_syn_cache[tcp_syn_cache_size];
2956 for (++scp2; scp2 != scp; scp2++) {
2957 if (scp2 >= sce)
2958 scp2 = &tcp_syn_cache[0];
2959 if (! TAILQ_EMPTY(&scp2->sch_bucket))
2960 break;
2961 }
2962 #ifdef DIAGNOSTIC
2963 /*
2964 * This should never happen; we should always find a
2965 * non-empty bucket.
2966 */
2967 if (scp2 == scp)
2968 panic("syn_cache_insert: cacheoverflow: "
2969 "impossible");
2970 #endif
2971 }
2972 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
2973 SYN_CACHE_RM(sc2);
2974 SYN_CACHE_PUT(sc2);
2975 }
2976
2977 /*
2978 * Initialize the entry's timer.
2979 */
2980 sc->sc_rxttot = 0;
2981 sc->sc_rxtshift = 0;
2982 SYN_CACHE_TIMER_ARM(sc);
2983
2984 /* Link it from tcpcb entry */
2985 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
2986
2987 /* Put it into the bucket. */
2988 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
2989 scp->sch_length++;
2990 syn_cache_count++;
2991
2992 tcpstat.tcps_sc_added++;
2993 splx(s);
2994 }
2995
2996 /*
2997 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
2998 * If we have retransmitted an entry the maximum number of times, expire
2999 * that entry.
3000 */
3001 void
3002 syn_cache_timer(void *arg)
3003 {
3004 struct syn_cache *sc = arg;
3005 int s;
3006
3007 s = splsoftnet();
3008
3009 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3010 /* Drop it -- too many retransmissions. */
3011 goto dropit;
3012 }
3013
3014 /*
3015 * Compute the total amount of time this entry has
3016 * been on a queue. If this entry has been on longer
3017 * than the keep alive timer would allow, expire it.
3018 */
3019 sc->sc_rxttot += sc->sc_rxtcur;
3020 if (sc->sc_rxttot >= TCPTV_KEEP_INIT)
3021 goto dropit;
3022
3023 tcpstat.tcps_sc_retransmitted++;
3024 (void) syn_cache_respond(sc, NULL);
3025
3026 /* Advance the timer back-off. */
3027 sc->sc_rxtshift++;
3028 SYN_CACHE_TIMER_ARM(sc);
3029
3030 splx(s);
3031 return;
3032
3033 dropit:
3034 tcpstat.tcps_sc_timed_out++;
3035 SYN_CACHE_RM(sc);
3036 SYN_CACHE_PUT(sc);
3037 splx(s);
3038 }
3039
3040 /*
3041 * Remove syn cache created by the specified tcb entry,
3042 * because this does not make sense to keep them
3043 * (if there's no tcb entry, syn cache entry will never be used)
3044 */
3045 void
3046 syn_cache_cleanup(tp)
3047 struct tcpcb *tp;
3048 {
3049 struct syn_cache *sc, *nsc;
3050 int s;
3051
3052 s = splsoftnet();
3053
3054 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3055 nsc = LIST_NEXT(sc, sc_tpq);
3056
3057 #ifdef DIAGNOSTIC
3058 if (sc->sc_tp != tp)
3059 panic("invalid sc_tp in syn_cache_cleanup");
3060 #endif
3061 SYN_CACHE_RM(sc);
3062 SYN_CACHE_PUT(sc);
3063 }
3064 /* just for safety */
3065 LIST_INIT(&tp->t_sc);
3066
3067 splx(s);
3068 }
3069
3070 /*
3071 * Find an entry in the syn cache.
3072 */
3073 struct syn_cache *
3074 syn_cache_lookup(src, dst, headp)
3075 struct sockaddr *src;
3076 struct sockaddr *dst;
3077 struct syn_cache_head **headp;
3078 {
3079 struct syn_cache *sc;
3080 struct syn_cache_head *scp;
3081 u_int32_t hash;
3082 int s;
3083
3084 SYN_HASHALL(hash, src, dst);
3085
3086 scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3087 *headp = scp;
3088 s = splsoftnet();
3089 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3090 sc = TAILQ_NEXT(sc, sc_bucketq)) {
3091 if (sc->sc_hash != hash)
3092 continue;
3093 if (!bcmp(&sc->sc_src, src, src->sa_len) &&
3094 !bcmp(&sc->sc_dst, dst, dst->sa_len)) {
3095 splx(s);
3096 return (sc);
3097 }
3098 }
3099 splx(s);
3100 return (NULL);
3101 }
3102
3103 /*
3104 * This function gets called when we receive an ACK for a
3105 * socket in the LISTEN state. We look up the connection
3106 * in the syn cache, and if its there, we pull it out of
3107 * the cache and turn it into a full-blown connection in
3108 * the SYN-RECEIVED state.
3109 *
3110 * The return values may not be immediately obvious, and their effects
3111 * can be subtle, so here they are:
3112 *
3113 * NULL SYN was not found in cache; caller should drop the
3114 * packet and send an RST.
3115 *
3116 * -1 We were unable to create the new connection, and are
3117 * aborting it. An ACK,RST is being sent to the peer
3118 * (unless we got screwey sequence numbners; see below),
3119 * because the 3-way handshake has been completed. Caller
3120 * should not free the mbuf, since we may be using it. If
3121 * we are not, we will free it.
3122 *
3123 * Otherwise, the return value is a pointer to the new socket
3124 * associated with the connection.
3125 */
3126 struct socket *
3127 syn_cache_get(src, dst, th, hlen, tlen, so, m)
3128 struct sockaddr *src;
3129 struct sockaddr *dst;
3130 struct tcphdr *th;
3131 unsigned int hlen, tlen;
3132 struct socket *so;
3133 struct mbuf *m;
3134 {
3135 struct syn_cache *sc;
3136 struct syn_cache_head *scp;
3137 struct inpcb *inp = NULL;
3138 #ifdef INET6
3139 struct in6pcb *in6p = NULL;
3140 #endif
3141 struct tcpcb *tp = 0;
3142 struct mbuf *am;
3143 int s;
3144 struct socket *oso;
3145
3146 s = splsoftnet();
3147 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3148 splx(s);
3149 return (NULL);
3150 }
3151
3152 /*
3153 * Verify the sequence and ack numbers. Try getting the correct
3154 * response again.
3155 */
3156 if ((th->th_ack != sc->sc_iss + 1) ||
3157 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3158 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3159 (void) syn_cache_respond(sc, m);
3160 splx(s);
3161 return ((struct socket *)(-1));
3162 }
3163
3164 /* Remove this cache entry */
3165 SYN_CACHE_RM(sc);
3166 splx(s);
3167
3168 /*
3169 * Ok, create the full blown connection, and set things up
3170 * as they would have been set up if we had created the
3171 * connection when the SYN arrived. If we can't create
3172 * the connection, abort it.
3173 */
3174 /*
3175 * inp still has the OLD in_pcb stuff, set the
3176 * v6-related flags on the new guy, too. This is
3177 * done particularly for the case where an AF_INET6
3178 * socket is bound only to a port, and a v4 connection
3179 * comes in on that port.
3180 * we also copy the flowinfo from the original pcb
3181 * to the new one.
3182 */
3183 {
3184 struct inpcb *parentinpcb;
3185
3186 parentinpcb = (struct inpcb *)so->so_pcb;
3187
3188 oso = so;
3189 so = sonewconn(so, SS_ISCONNECTED);
3190 if (so == NULL)
3191 goto resetandabort;
3192
3193 switch (so->so_proto->pr_domain->dom_family) {
3194 #ifdef INET
3195 case AF_INET:
3196 inp = sotoinpcb(so);
3197 break;
3198 #endif
3199 #ifdef INET6
3200 case AF_INET6:
3201 in6p = sotoin6pcb(so);
3202 break;
3203 #endif
3204 }
3205 }
3206 switch (src->sa_family) {
3207 #ifdef INET
3208 case AF_INET:
3209 if (inp) {
3210 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
3211 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
3212 inp->inp_options = ip_srcroute();
3213 in_pcbstate(inp, INP_BOUND);
3214 if (inp->inp_options == NULL) {
3215 inp->inp_options = sc->sc_ipopts;
3216 sc->sc_ipopts = NULL;
3217 }
3218 }
3219 #ifdef INET6
3220 else if (in6p) {
3221 /* IPv4 packet to AF_INET6 socket */
3222 bzero(&in6p->in6p_laddr, sizeof(in6p->in6p_laddr));
3223 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
3224 bcopy(&((struct sockaddr_in *)dst)->sin_addr,
3225 &in6p->in6p_laddr.s6_addr32[3],
3226 sizeof(((struct sockaddr_in *)dst)->sin_addr));
3227 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
3228 in6totcpcb(in6p)->t_family = AF_INET;
3229 }
3230 #endif
3231 break;
3232 #endif
3233 #ifdef INET6
3234 case AF_INET6:
3235 if (in6p) {
3236 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
3237 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
3238 #if 0
3239 in6p->in6p_flowinfo = ip6->ip6_flow & IPV6_FLOWINFO_MASK;
3240 /*inp->inp_options = ip6_srcroute();*/ /* soon. */
3241 #endif
3242 }
3243 break;
3244 #endif
3245 }
3246 #ifdef INET6
3247 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
3248 struct in6pcb *oin6p = sotoin6pcb(oso);
3249 /* inherit socket options from the listening socket */
3250 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
3251 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
3252 m_freem(in6p->in6p_options);
3253 in6p->in6p_options = 0;
3254 }
3255 ip6_savecontrol(in6p, &in6p->in6p_options,
3256 mtod(m, struct ip6_hdr *), m);
3257 }
3258 #endif
3259
3260 #ifdef IPSEC
3261 /*
3262 * we make a copy of policy, instead of sharing the policy,
3263 * for better behavior in terms of SA lookup and dead SA removal.
3264 */
3265 if (inp) {
3266 /* copy old policy into new socket's */
3267 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
3268 printf("tcp_input: could not copy policy\n");
3269 }
3270 #ifdef INET6
3271 else if (in6p) {
3272 /* copy old policy into new socket's */
3273 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
3274 in6p->in6p_sp))
3275 printf("tcp_input: could not copy policy\n");
3276 }
3277 #endif
3278 #endif
3279
3280 /*
3281 * Give the new socket our cached route reference.
3282 */
3283 if (inp)
3284 inp->inp_route = sc->sc_route4; /* struct assignment */
3285 #ifdef INET6
3286 else
3287 in6p->in6p_route = sc->sc_route6;
3288 #endif
3289 sc->sc_route4.ro_rt = NULL;
3290
3291 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
3292 if (am == NULL)
3293 goto resetandabort;
3294 am->m_len = src->sa_len;
3295 bcopy(src, mtod(am, caddr_t), src->sa_len);
3296 if (inp) {
3297 if (in_pcbconnect(inp, am)) {
3298 (void) m_free(am);
3299 goto resetandabort;
3300 }
3301 }
3302 #ifdef INET6
3303 else if (in6p) {
3304 if (src->sa_family == AF_INET) {
3305 /* IPv4 packet to AF_INET6 socket */
3306 struct sockaddr_in6 *sin6;
3307 sin6 = mtod(am, struct sockaddr_in6 *);
3308 am->m_len = sizeof(*sin6);
3309 bzero(sin6, sizeof(*sin6));
3310 sin6->sin6_family = AF_INET6;
3311 sin6->sin6_len = sizeof(*sin6);
3312 sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
3313 sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
3314 bcopy(&((struct sockaddr_in *)src)->sin_addr,
3315 &sin6->sin6_addr.s6_addr32[3],
3316 sizeof(sin6->sin6_addr.s6_addr32[3]));
3317 }
3318 if (in6_pcbconnect(in6p, am)) {
3319 (void) m_free(am);
3320 goto resetandabort;
3321 }
3322 }
3323 #endif
3324 else {
3325 (void) m_free(am);
3326 goto resetandabort;
3327 }
3328 (void) m_free(am);
3329
3330 if (inp)
3331 tp = intotcpcb(inp);
3332 #ifdef INET6
3333 else if (in6p)
3334 tp = in6totcpcb(in6p);
3335 #endif
3336 else
3337 tp = NULL;
3338 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
3339 if (sc->sc_request_r_scale != 15) {
3340 tp->requested_s_scale = sc->sc_requested_s_scale;
3341 tp->request_r_scale = sc->sc_request_r_scale;
3342 tp->snd_scale = sc->sc_requested_s_scale;
3343 tp->rcv_scale = sc->sc_request_r_scale;
3344 tp->t_flags |= TF_RCVD_SCALE;
3345 }
3346 if (sc->sc_flags & SCF_TIMESTAMP)
3347 tp->t_flags |= TF_RCVD_TSTMP;
3348 tp->ts_timebase = sc->sc_timebase;
3349
3350 tp->t_template = tcp_template(tp);
3351 if (tp->t_template == 0) {
3352 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
3353 so = NULL;
3354 m_freem(m);
3355 goto abort;
3356 }
3357
3358 tp->iss = sc->sc_iss;
3359 tp->irs = sc->sc_irs;
3360 tcp_sendseqinit(tp);
3361 tcp_rcvseqinit(tp);
3362 tp->t_state = TCPS_SYN_RECEIVED;
3363 TCP_TIMER_ARM(tp, TCPT_KEEP, TCPTV_KEEP_INIT);
3364 tcpstat.tcps_accepts++;
3365
3366 /* Initialize tp->t_ourmss before we deal with the peer's! */
3367 tp->t_ourmss = sc->sc_ourmaxseg;
3368 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
3369
3370 /*
3371 * Initialize the initial congestion window. If we
3372 * had to retransmit the SYN,ACK, we must initialize cwnd
3373 * to 1 segment (i.e. the Loss Window).
3374 */
3375 if (sc->sc_rxtshift)
3376 tp->snd_cwnd = tp->t_peermss;
3377 else
3378 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, tp->t_peermss);
3379
3380 tcp_rmx_rtt(tp);
3381 tp->snd_wl1 = sc->sc_irs;
3382 tp->rcv_up = sc->sc_irs + 1;
3383
3384 /*
3385 * This is what whould have happened in tcp_ouput() when
3386 * the SYN,ACK was sent.
3387 */
3388 tp->snd_up = tp->snd_una;
3389 tp->snd_max = tp->snd_nxt = tp->iss+1;
3390 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
3391 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
3392 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
3393 tp->last_ack_sent = tp->rcv_nxt;
3394
3395 tcpstat.tcps_sc_completed++;
3396 SYN_CACHE_PUT(sc);
3397 return (so);
3398
3399 resetandabort:
3400 (void) tcp_respond(NULL, m, m, th,
3401 th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
3402 abort:
3403 if (so != NULL)
3404 (void) soabort(so);
3405 SYN_CACHE_PUT(sc);
3406 tcpstat.tcps_sc_aborted++;
3407 return ((struct socket *)(-1));
3408 }
3409
3410 /*
3411 * This function is called when we get a RST for a
3412 * non-existent connection, so that we can see if the
3413 * connection is in the syn cache. If it is, zap it.
3414 */
3415
3416 void
3417 syn_cache_reset(src, dst, th)
3418 struct sockaddr *src;
3419 struct sockaddr *dst;
3420 struct tcphdr *th;
3421 {
3422 struct syn_cache *sc;
3423 struct syn_cache_head *scp;
3424 int s = splsoftnet();
3425
3426 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3427 splx(s);
3428 return;
3429 }
3430 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
3431 SEQ_GT(th->th_seq, sc->sc_irs+1)) {
3432 splx(s);
3433 return;
3434 }
3435 SYN_CACHE_RM(sc);
3436 splx(s);
3437 tcpstat.tcps_sc_reset++;
3438 SYN_CACHE_PUT(sc);
3439 }
3440
3441 void
3442 syn_cache_unreach(src, dst, th)
3443 struct sockaddr *src;
3444 struct sockaddr *dst;
3445 struct tcphdr *th;
3446 {
3447 struct syn_cache *sc;
3448 struct syn_cache_head *scp;
3449 int s;
3450
3451 s = splsoftnet();
3452 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3453 splx(s);
3454 return;
3455 }
3456 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
3457 if (ntohl (th->th_seq) != sc->sc_iss) {
3458 splx(s);
3459 return;
3460 }
3461
3462 /*
3463 * If we've rertransmitted 3 times and this is our second error,
3464 * we remove the entry. Otherwise, we allow it to continue on.
3465 * This prevents us from incorrectly nuking an entry during a
3466 * spurious network outage.
3467 *
3468 * See tcp_notify().
3469 */
3470 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
3471 sc->sc_flags |= SCF_UNREACH;
3472 splx(s);
3473 return;
3474 }
3475
3476 SYN_CACHE_RM(sc);
3477 splx(s);
3478 tcpstat.tcps_sc_unreach++;
3479 SYN_CACHE_PUT(sc);
3480 }
3481
3482 /*
3483 * Given a LISTEN socket and an inbound SYN request, add
3484 * this to the syn cache, and send back a segment:
3485 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
3486 * to the source.
3487 *
3488 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
3489 * Doing so would require that we hold onto the data and deliver it
3490 * to the application. However, if we are the target of a SYN-flood
3491 * DoS attack, an attacker could send data which would eventually
3492 * consume all available buffer space if it were ACKed. By not ACKing
3493 * the data, we avoid this DoS scenario.
3494 */
3495
3496 int
3497 syn_cache_add(src, dst, th, hlen, so, m, optp, optlen, oi)
3498 struct sockaddr *src;
3499 struct sockaddr *dst;
3500 struct tcphdr *th;
3501 unsigned int hlen;
3502 struct socket *so;
3503 struct mbuf *m;
3504 u_char *optp;
3505 int optlen;
3506 struct tcp_opt_info *oi;
3507 {
3508 struct tcpcb tb, *tp;
3509 long win;
3510 struct syn_cache *sc;
3511 struct syn_cache_head *scp;
3512 struct mbuf *ipopts;
3513
3514 tp = sototcpcb(so);
3515
3516 /*
3517 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
3518 *
3519 * Note this check is performed in tcp_input() very early on.
3520 */
3521
3522 /*
3523 * Initialize some local state.
3524 */
3525 win = sbspace(&so->so_rcv);
3526 if (win > TCP_MAXWIN)
3527 win = TCP_MAXWIN;
3528
3529 switch (src->sa_family) {
3530 #ifdef INET
3531 case AF_INET:
3532 /*
3533 * Remember the IP options, if any.
3534 */
3535 ipopts = ip_srcroute();
3536 break;
3537 #endif
3538 default:
3539 ipopts = NULL;
3540 }
3541
3542 if (optp) {
3543 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
3544 tcp_dooptions(&tb, optp, optlen, th, oi);
3545 } else
3546 tb.t_flags = 0;
3547
3548 /*
3549 * See if we already have an entry for this connection.
3550 * If we do, resend the SYN,ACK. We do not count this
3551 * as a retransmission (XXX though maybe we should).
3552 */
3553 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
3554 tcpstat.tcps_sc_dupesyn++;
3555 if (ipopts) {
3556 /*
3557 * If we were remembering a previous source route,
3558 * forget it and use the new one we've been given.
3559 */
3560 if (sc->sc_ipopts)
3561 (void) m_free(sc->sc_ipopts);
3562 sc->sc_ipopts = ipopts;
3563 }
3564 sc->sc_timestamp = tb.ts_recent;
3565 if (syn_cache_respond(sc, m) == 0) {
3566 tcpstat.tcps_sndacks++;
3567 tcpstat.tcps_sndtotal++;
3568 }
3569 return (1);
3570 }
3571
3572 sc = pool_get(&syn_cache_pool, PR_NOWAIT);
3573 if (sc == NULL) {
3574 if (ipopts)
3575 (void) m_free(ipopts);
3576 return (0);
3577 }
3578
3579 /*
3580 * Fill in the cache, and put the necessary IP and TCP
3581 * options into the reply.
3582 */
3583 callout_init(&sc->sc_timer);
3584 bzero(sc, sizeof(struct syn_cache));
3585 bcopy(src, &sc->sc_src, src->sa_len);
3586 bcopy(dst, &sc->sc_dst, dst->sa_len);
3587 sc->sc_flags = 0;
3588 sc->sc_ipopts = ipopts;
3589 sc->sc_irs = th->th_seq;
3590 switch (src->sa_family) {
3591 #ifdef INET
3592 case AF_INET:
3593 {
3594 struct sockaddr_in *srcin = (void *) src;
3595 struct sockaddr_in *dstin = (void *) dst;
3596
3597 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
3598 &srcin->sin_addr, dstin->sin_port,
3599 srcin->sin_port, sizeof(dstin->sin_addr), 0);
3600 break;
3601 }
3602 #endif /* INET */
3603 #ifdef INET6
3604 case AF_INET6:
3605 {
3606 struct sockaddr_in6 *srcin6 = (void *) src;
3607 struct sockaddr_in6 *dstin6 = (void *) dst;
3608
3609 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
3610 &srcin6->sin6_addr, dstin6->sin6_port,
3611 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
3612 break;
3613 }
3614 #endif /* INET6 */
3615 }
3616 sc->sc_peermaxseg = oi->maxseg;
3617 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
3618 m->m_pkthdr.rcvif : NULL,
3619 sc->sc_src.sa.sa_family);
3620 sc->sc_win = win;
3621 sc->sc_timebase = tcp_now; /* see tcp_newtcpcb() */
3622 sc->sc_timestamp = tb.ts_recent;
3623 if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP))
3624 sc->sc_flags |= SCF_TIMESTAMP;
3625 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
3626 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
3627 sc->sc_requested_s_scale = tb.requested_s_scale;
3628 sc->sc_request_r_scale = 0;
3629 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
3630 TCP_MAXWIN << sc->sc_request_r_scale <
3631 so->so_rcv.sb_hiwat)
3632 sc->sc_request_r_scale++;
3633 } else {
3634 sc->sc_requested_s_scale = 15;
3635 sc->sc_request_r_scale = 15;
3636 }
3637 sc->sc_tp = tp;
3638 if (syn_cache_respond(sc, m) == 0) {
3639 syn_cache_insert(sc, tp);
3640 tcpstat.tcps_sndacks++;
3641 tcpstat.tcps_sndtotal++;
3642 } else {
3643 SYN_CACHE_PUT(sc);
3644 tcpstat.tcps_sc_dropped++;
3645 }
3646 return (1);
3647 }
3648
3649 int
3650 syn_cache_respond(sc, m)
3651 struct syn_cache *sc;
3652 struct mbuf *m;
3653 {
3654 struct route *ro;
3655 u_int8_t *optp;
3656 int optlen, error;
3657 u_int16_t tlen;
3658 struct ip *ip = NULL;
3659 #ifdef INET6
3660 struct ip6_hdr *ip6 = NULL;
3661 #endif
3662 struct tcphdr *th;
3663 u_int hlen;
3664
3665 switch (sc->sc_src.sa.sa_family) {
3666 case AF_INET:
3667 hlen = sizeof(struct ip);
3668 ro = &sc->sc_route4;
3669 break;
3670 #ifdef INET6
3671 case AF_INET6:
3672 hlen = sizeof(struct ip6_hdr);
3673 ro = (struct route *)&sc->sc_route6;
3674 break;
3675 #endif
3676 default:
3677 if (m)
3678 m_freem(m);
3679 return EAFNOSUPPORT;
3680 }
3681
3682 /* Compute the size of the TCP options. */
3683 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
3684 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
3685
3686 tlen = hlen + sizeof(struct tcphdr) + optlen;
3687
3688 /*
3689 * Create the IP+TCP header from scratch.
3690 */
3691 if (m)
3692 m_freem(m);
3693 #ifdef DIAGNOSTIC
3694 if (max_linkhdr + tlen > MCLBYTES)
3695 return (ENOBUFS);
3696 #endif
3697 MGETHDR(m, M_DONTWAIT, MT_DATA);
3698 if (m && tlen > MHLEN) {
3699 MCLGET(m, M_DONTWAIT);
3700 if ((m->m_flags & M_EXT) == 0) {
3701 m_freem(m);
3702 m = NULL;
3703 }
3704 }
3705 if (m == NULL)
3706 return (ENOBUFS);
3707
3708 /* Fixup the mbuf. */
3709 m->m_data += max_linkhdr;
3710 m->m_len = m->m_pkthdr.len = tlen;
3711 #ifdef IPSEC
3712 if (sc->sc_tp) {
3713 struct tcpcb *tp;
3714 struct socket *so;
3715
3716 tp = sc->sc_tp;
3717 if (tp->t_inpcb)
3718 so = tp->t_inpcb->inp_socket;
3719 #ifdef INET6
3720 else if (tp->t_in6pcb)
3721 so = tp->t_in6pcb->in6p_socket;
3722 #endif
3723 else
3724 so = NULL;
3725 /* use IPsec policy on listening socket, on SYN ACK */
3726 if (ipsec_setsocket(m, so) != 0) {
3727 m_freem(m);
3728 return ENOBUFS;
3729 }
3730 }
3731 #endif
3732 m->m_pkthdr.rcvif = NULL;
3733 memset(mtod(m, u_char *), 0, tlen);
3734
3735 switch (sc->sc_src.sa.sa_family) {
3736 case AF_INET:
3737 ip = mtod(m, struct ip *);
3738 ip->ip_dst = sc->sc_src.sin.sin_addr;
3739 ip->ip_src = sc->sc_dst.sin.sin_addr;
3740 ip->ip_p = IPPROTO_TCP;
3741 th = (struct tcphdr *)(ip + 1);
3742 th->th_dport = sc->sc_src.sin.sin_port;
3743 th->th_sport = sc->sc_dst.sin.sin_port;
3744 break;
3745 #ifdef INET6
3746 case AF_INET6:
3747 ip6 = mtod(m, struct ip6_hdr *);
3748 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
3749 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
3750 ip6->ip6_nxt = IPPROTO_TCP;
3751 /* ip6_plen will be updated in ip6_output() */
3752 th = (struct tcphdr *)(ip6 + 1);
3753 th->th_dport = sc->sc_src.sin6.sin6_port;
3754 th->th_sport = sc->sc_dst.sin6.sin6_port;
3755 break;
3756 #endif
3757 default:
3758 th = NULL;
3759 }
3760
3761 th->th_seq = htonl(sc->sc_iss);
3762 th->th_ack = htonl(sc->sc_irs + 1);
3763 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
3764 th->th_flags = TH_SYN|TH_ACK;
3765 th->th_win = htons(sc->sc_win);
3766 /* th_sum already 0 */
3767 /* th_urp already 0 */
3768
3769 /* Tack on the TCP options. */
3770 optp = (u_int8_t *)(th + 1);
3771 *optp++ = TCPOPT_MAXSEG;
3772 *optp++ = 4;
3773 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
3774 *optp++ = sc->sc_ourmaxseg & 0xff;
3775
3776 if (sc->sc_request_r_scale != 15) {
3777 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
3778 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
3779 sc->sc_request_r_scale);
3780 optp += 4;
3781 }
3782
3783 if (sc->sc_flags & SCF_TIMESTAMP) {
3784 u_int32_t *lp = (u_int32_t *)(optp);
3785 /* Form timestamp option as shown in appendix A of RFC 1323. */
3786 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
3787 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
3788 *lp = htonl(sc->sc_timestamp);
3789 optp += TCPOLEN_TSTAMP_APPA;
3790 }
3791
3792 /* Compute the packet's checksum. */
3793 switch (sc->sc_src.sa.sa_family) {
3794 case AF_INET:
3795 ip->ip_len = htons(tlen - hlen);
3796 th->th_sum = 0;
3797 th->th_sum = in_cksum(m, tlen);
3798 break;
3799 #ifdef INET6
3800 case AF_INET6:
3801 ip6->ip6_plen = htons(tlen - hlen);
3802 th->th_sum = 0;
3803 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
3804 break;
3805 #endif
3806 }
3807
3808 /*
3809 * Fill in some straggling IP bits. Note the stack expects
3810 * ip_len to be in host order, for convenience.
3811 */
3812 switch (sc->sc_src.sa.sa_family) {
3813 #ifdef INET
3814 case AF_INET:
3815 ip->ip_len = htons(tlen);
3816 ip->ip_ttl = ip_defttl;
3817 /* XXX tos? */
3818 break;
3819 #endif
3820 #ifdef INET6
3821 case AF_INET6:
3822 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3823 ip6->ip6_vfc |= IPV6_VERSION;
3824 ip6->ip6_plen = htons(tlen - hlen);
3825 /* ip6_hlim will be initialized afterwards */
3826 /* XXX flowlabel? */
3827 break;
3828 #endif
3829 }
3830
3831 switch (sc->sc_src.sa.sa_family) {
3832 #ifdef INET
3833 case AF_INET:
3834 error = ip_output(m, sc->sc_ipopts, ro,
3835 (ip_mtudisc ? IP_MTUDISC : 0),
3836 NULL);
3837 break;
3838 #endif
3839 #ifdef INET6
3840 case AF_INET6:
3841 ip6->ip6_hlim = in6_selecthlim(NULL,
3842 ro->ro_rt ? ro->ro_rt->rt_ifp : NULL);
3843
3844 error = ip6_output(m, NULL /*XXX*/, (struct route_in6 *)ro,
3845 0, NULL, NULL);
3846 break;
3847 #endif
3848 default:
3849 error = EAFNOSUPPORT;
3850 break;
3851 }
3852 return (error);
3853 }
3854