tcp_input.c revision 1.323 1 /* $NetBSD: tcp_input.c,v 1.323 2012/04/13 15:35:57 yamt Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006,
74 * 2011 The NetBSD Foundation, Inc.
75 * All rights reserved.
76 *
77 * This code is derived from software contributed to The NetBSD Foundation
78 * by Coyote Point Systems, Inc.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
81 * Facility, NASA Ames Research Center.
82 * This code is derived from software contributed to The NetBSD Foundation
83 * by Charles M. Hannum.
84 * This code is derived from software contributed to The NetBSD Foundation
85 * by Rui Paulo.
86 *
87 * Redistribution and use in source and binary forms, with or without
88 * modification, are permitted provided that the following conditions
89 * are met:
90 * 1. Redistributions of source code must retain the above copyright
91 * notice, this list of conditions and the following disclaimer.
92 * 2. Redistributions in binary form must reproduce the above copyright
93 * notice, this list of conditions and the following disclaimer in the
94 * documentation and/or other materials provided with the distribution.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. Neither the name of the University nor the names of its contributors
122 * may be used to endorse or promote products derived from this software
123 * without specific prior written permission.
124 *
125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135 * SUCH DAMAGE.
136 *
137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
138 */
139
140 /*
141 * TODO list for SYN cache stuff:
142 *
143 * Find room for a "state" field, which is needed to keep a
144 * compressed state for TIME_WAIT TCBs. It's been noted already
145 * that this is fairly important for very high-volume web and
146 * mail servers, which use a large number of short-lived
147 * connections.
148 */
149
150 #include <sys/cdefs.h>
151 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.323 2012/04/13 15:35:57 yamt Exp $");
152
153 #include "opt_inet.h"
154 #include "opt_ipsec.h"
155 #include "opt_inet_csum.h"
156 #include "opt_tcp_debug.h"
157
158 #include <sys/param.h>
159 #include <sys/systm.h>
160 #include <sys/malloc.h>
161 #include <sys/mbuf.h>
162 #include <sys/protosw.h>
163 #include <sys/socket.h>
164 #include <sys/socketvar.h>
165 #include <sys/errno.h>
166 #include <sys/syslog.h>
167 #include <sys/pool.h>
168 #include <sys/domain.h>
169 #include <sys/kernel.h>
170 #ifdef TCP_SIGNATURE
171 #include <sys/md5.h>
172 #endif
173 #include <sys/lwp.h> /* for lwp0 */
174 #include <sys/cprng.h>
175
176 #include <net/if.h>
177 #include <net/route.h>
178 #include <net/if_types.h>
179
180 #include <netinet/in.h>
181 #include <netinet/in_systm.h>
182 #include <netinet/ip.h>
183 #include <netinet/in_pcb.h>
184 #include <netinet/in_var.h>
185 #include <netinet/ip_var.h>
186 #include <netinet/in_offload.h>
187
188 #ifdef INET6
189 #ifndef INET
190 #include <netinet/in.h>
191 #endif
192 #include <netinet/ip6.h>
193 #include <netinet6/ip6_var.h>
194 #include <netinet6/in6_pcb.h>
195 #include <netinet6/ip6_var.h>
196 #include <netinet6/in6_var.h>
197 #include <netinet/icmp6.h>
198 #include <netinet6/nd6.h>
199 #ifdef TCP_SIGNATURE
200 #include <netinet6/scope6_var.h>
201 #endif
202 #endif
203
204 #ifndef INET6
205 /* always need ip6.h for IP6_EXTHDR_GET */
206 #include <netinet/ip6.h>
207 #endif
208
209 #include <netinet/tcp.h>
210 #include <netinet/tcp_fsm.h>
211 #include <netinet/tcp_seq.h>
212 #include <netinet/tcp_timer.h>
213 #include <netinet/tcp_var.h>
214 #include <netinet/tcp_private.h>
215 #include <netinet/tcpip.h>
216 #include <netinet/tcp_congctl.h>
217 #include <netinet/tcp_debug.h>
218
219 #ifdef INET6
220 #include "faith.h"
221 #if defined(NFAITH) && NFAITH > 0
222 #include <net/if_faith.h>
223 #endif
224 #endif /* INET6 */
225
226 #ifdef FAST_IPSEC
227 #include <netipsec/ipsec.h>
228 #include <netipsec/ipsec_var.h>
229 #include <netipsec/ipsec_private.h>
230 #include <netipsec/key.h>
231 #ifdef INET6
232 #include <netipsec/ipsec6.h>
233 #endif
234 #endif /* FAST_IPSEC*/
235
236 #include <netinet/tcp_vtw.h>
237
238 int tcprexmtthresh = 3;
239 int tcp_log_refused;
240
241 int tcp_do_autorcvbuf = 1;
242 int tcp_autorcvbuf_inc = 16 * 1024;
243 int tcp_autorcvbuf_max = 256 * 1024;
244 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
245
246 static int tcp_rst_ppslim_count = 0;
247 static struct timeval tcp_rst_ppslim_last;
248 static int tcp_ackdrop_ppslim_count = 0;
249 static struct timeval tcp_ackdrop_ppslim_last;
250
251 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
252
253 /* for modulo comparisons of timestamps */
254 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
255 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
256
257 /*
258 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
259 */
260 #ifdef INET6
261 static inline void
262 nd6_hint(struct tcpcb *tp)
263 {
264 struct rtentry *rt;
265
266 if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
267 (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
268 nd6_nud_hint(rt, NULL, 0);
269 }
270 #else
271 static inline void
272 nd6_hint(struct tcpcb *tp)
273 {
274 }
275 #endif
276
277 /*
278 * Compute ACK transmission behavior. Delay the ACK unless
279 * we have already delayed an ACK (must send an ACK every two segments).
280 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
281 * option is enabled.
282 */
283 static void
284 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
285 {
286
287 if (tp->t_flags & TF_DELACK ||
288 (tcp_ack_on_push && th->th_flags & TH_PUSH))
289 tp->t_flags |= TF_ACKNOW;
290 else
291 TCP_SET_DELACK(tp);
292 }
293
294 static void
295 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
296 {
297
298 /*
299 * If we had a pending ICMP message that refers to data that have
300 * just been acknowledged, disregard the recorded ICMP message.
301 */
302 if ((tp->t_flags & TF_PMTUD_PEND) &&
303 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
304 tp->t_flags &= ~TF_PMTUD_PEND;
305
306 /*
307 * Keep track of the largest chunk of data
308 * acknowledged since last PMTU update
309 */
310 if (tp->t_pmtud_mss_acked < acked)
311 tp->t_pmtud_mss_acked = acked;
312 }
313
314 /*
315 * Convert TCP protocol fields to host order for easier processing.
316 */
317 static void
318 tcp_fields_to_host(struct tcphdr *th)
319 {
320
321 NTOHL(th->th_seq);
322 NTOHL(th->th_ack);
323 NTOHS(th->th_win);
324 NTOHS(th->th_urp);
325 }
326
327 /*
328 * ... and reverse the above.
329 */
330 static void
331 tcp_fields_to_net(struct tcphdr *th)
332 {
333
334 HTONL(th->th_seq);
335 HTONL(th->th_ack);
336 HTONS(th->th_win);
337 HTONS(th->th_urp);
338 }
339
340 #ifdef TCP_CSUM_COUNTERS
341 #include <sys/device.h>
342
343 #if defined(INET)
344 extern struct evcnt tcp_hwcsum_ok;
345 extern struct evcnt tcp_hwcsum_bad;
346 extern struct evcnt tcp_hwcsum_data;
347 extern struct evcnt tcp_swcsum;
348 #endif /* defined(INET) */
349 #if defined(INET6)
350 extern struct evcnt tcp6_hwcsum_ok;
351 extern struct evcnt tcp6_hwcsum_bad;
352 extern struct evcnt tcp6_hwcsum_data;
353 extern struct evcnt tcp6_swcsum;
354 #endif /* defined(INET6) */
355
356 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
357
358 #else
359
360 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
361
362 #endif /* TCP_CSUM_COUNTERS */
363
364 #ifdef TCP_REASS_COUNTERS
365 #include <sys/device.h>
366
367 extern struct evcnt tcp_reass_;
368 extern struct evcnt tcp_reass_empty;
369 extern struct evcnt tcp_reass_iteration[8];
370 extern struct evcnt tcp_reass_prependfirst;
371 extern struct evcnt tcp_reass_prepend;
372 extern struct evcnt tcp_reass_insert;
373 extern struct evcnt tcp_reass_inserttail;
374 extern struct evcnt tcp_reass_append;
375 extern struct evcnt tcp_reass_appendtail;
376 extern struct evcnt tcp_reass_overlaptail;
377 extern struct evcnt tcp_reass_overlapfront;
378 extern struct evcnt tcp_reass_segdup;
379 extern struct evcnt tcp_reass_fragdup;
380
381 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
382
383 #else
384
385 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
386
387 #endif /* TCP_REASS_COUNTERS */
388
389 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
390 int *);
391 static int tcp_dooptions(struct tcpcb *, const u_char *, int,
392 struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *);
393
394 #ifdef INET
395 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
396 #endif
397 #ifdef INET6
398 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
399 #endif
400
401 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next
402
403 #if defined(MBUFTRACE)
404 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
405 #endif /* defined(MBUFTRACE) */
406
407 static struct pool tcpipqent_pool;
408
409 void
410 tcpipqent_init(void)
411 {
412
413 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
414 NULL, IPL_VM);
415 }
416
417 struct ipqent *
418 tcpipqent_alloc(void)
419 {
420 struct ipqent *ipqe;
421 int s;
422
423 s = splvm();
424 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
425 splx(s);
426
427 return ipqe;
428 }
429
430 void
431 tcpipqent_free(struct ipqent *ipqe)
432 {
433 int s;
434
435 s = splvm();
436 pool_put(&tcpipqent_pool, ipqe);
437 splx(s);
438 }
439
440 static int
441 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen)
442 {
443 struct ipqent *p, *q, *nq, *tiqe = NULL;
444 struct socket *so = NULL;
445 int pkt_flags;
446 tcp_seq pkt_seq;
447 unsigned pkt_len;
448 u_long rcvpartdupbyte = 0;
449 u_long rcvoobyte;
450 #ifdef TCP_REASS_COUNTERS
451 u_int count = 0;
452 #endif
453 uint64_t *tcps;
454
455 if (tp->t_inpcb)
456 so = tp->t_inpcb->inp_socket;
457 #ifdef INET6
458 else if (tp->t_in6pcb)
459 so = tp->t_in6pcb->in6p_socket;
460 #endif
461
462 TCP_REASS_LOCK_CHECK(tp);
463
464 /*
465 * Call with th==0 after become established to
466 * force pre-ESTABLISHED data up to user socket.
467 */
468 if (th == 0)
469 goto present;
470
471 m_claimm(m, &tcp_reass_mowner);
472
473 rcvoobyte = *tlen;
474 /*
475 * Copy these to local variables because the tcpiphdr
476 * gets munged while we are collapsing mbufs.
477 */
478 pkt_seq = th->th_seq;
479 pkt_len = *tlen;
480 pkt_flags = th->th_flags;
481
482 TCP_REASS_COUNTER_INCR(&tcp_reass_);
483
484 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
485 /*
486 * When we miss a packet, the vast majority of time we get
487 * packets that follow it in order. So optimize for that.
488 */
489 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
490 p->ipqe_len += pkt_len;
491 p->ipqe_flags |= pkt_flags;
492 m_cat(p->ipre_mlast, m);
493 TRAVERSE(p->ipre_mlast);
494 m = NULL;
495 tiqe = p;
496 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
497 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
498 goto skip_replacement;
499 }
500 /*
501 * While we're here, if the pkt is completely beyond
502 * anything we have, just insert it at the tail.
503 */
504 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
505 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
506 goto insert_it;
507 }
508 }
509
510 q = TAILQ_FIRST(&tp->segq);
511
512 if (q != NULL) {
513 /*
514 * If this segment immediately precedes the first out-of-order
515 * block, simply slap the segment in front of it and (mostly)
516 * skip the complicated logic.
517 */
518 if (pkt_seq + pkt_len == q->ipqe_seq) {
519 q->ipqe_seq = pkt_seq;
520 q->ipqe_len += pkt_len;
521 q->ipqe_flags |= pkt_flags;
522 m_cat(m, q->ipqe_m);
523 q->ipqe_m = m;
524 q->ipre_mlast = m; /* last mbuf may have changed */
525 TRAVERSE(q->ipre_mlast);
526 tiqe = q;
527 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
528 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
529 goto skip_replacement;
530 }
531 } else {
532 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
533 }
534
535 /*
536 * Find a segment which begins after this one does.
537 */
538 for (p = NULL; q != NULL; q = nq) {
539 nq = TAILQ_NEXT(q, ipqe_q);
540 #ifdef TCP_REASS_COUNTERS
541 count++;
542 #endif
543 /*
544 * If the received segment is just right after this
545 * fragment, merge the two together and then check
546 * for further overlaps.
547 */
548 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
549 #ifdef TCPREASS_DEBUG
550 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
551 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
552 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
553 #endif
554 pkt_len += q->ipqe_len;
555 pkt_flags |= q->ipqe_flags;
556 pkt_seq = q->ipqe_seq;
557 m_cat(q->ipre_mlast, m);
558 TRAVERSE(q->ipre_mlast);
559 m = q->ipqe_m;
560 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
561 goto free_ipqe;
562 }
563 /*
564 * If the received segment is completely past this
565 * fragment, we need to go the next fragment.
566 */
567 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
568 p = q;
569 continue;
570 }
571 /*
572 * If the fragment is past the received segment,
573 * it (or any following) can't be concatenated.
574 */
575 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
576 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
577 break;
578 }
579
580 /*
581 * We've received all the data in this segment before.
582 * mark it as a duplicate and return.
583 */
584 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
585 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
586 tcps = TCP_STAT_GETREF();
587 tcps[TCP_STAT_RCVDUPPACK]++;
588 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
589 TCP_STAT_PUTREF();
590 tcp_new_dsack(tp, pkt_seq, pkt_len);
591 m_freem(m);
592 if (tiqe != NULL) {
593 tcpipqent_free(tiqe);
594 }
595 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
596 goto out;
597 }
598 /*
599 * Received segment completely overlaps this fragment
600 * so we drop the fragment (this keeps the temporal
601 * ordering of segments correct).
602 */
603 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
604 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
605 rcvpartdupbyte += q->ipqe_len;
606 m_freem(q->ipqe_m);
607 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
608 goto free_ipqe;
609 }
610 /*
611 * RX'ed segment extends past the end of the
612 * fragment. Drop the overlapping bytes. Then
613 * merge the fragment and segment then treat as
614 * a longer received packet.
615 */
616 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
617 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
618 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
619 #ifdef TCPREASS_DEBUG
620 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
621 tp, overlap,
622 pkt_seq, pkt_seq + pkt_len, pkt_len);
623 #endif
624 m_adj(m, overlap);
625 rcvpartdupbyte += overlap;
626 m_cat(q->ipre_mlast, m);
627 TRAVERSE(q->ipre_mlast);
628 m = q->ipqe_m;
629 pkt_seq = q->ipqe_seq;
630 pkt_len += q->ipqe_len - overlap;
631 rcvoobyte -= overlap;
632 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
633 goto free_ipqe;
634 }
635 /*
636 * RX'ed segment extends past the front of the
637 * fragment. Drop the overlapping bytes on the
638 * received packet. The packet will then be
639 * contatentated with this fragment a bit later.
640 */
641 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
642 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
643 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
644 #ifdef TCPREASS_DEBUG
645 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
646 tp, overlap,
647 pkt_seq, pkt_seq + pkt_len, pkt_len);
648 #endif
649 m_adj(m, -overlap);
650 pkt_len -= overlap;
651 rcvpartdupbyte += overlap;
652 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
653 rcvoobyte -= overlap;
654 }
655 /*
656 * If the received segment immediates precedes this
657 * fragment then tack the fragment onto this segment
658 * and reinsert the data.
659 */
660 if (q->ipqe_seq == pkt_seq + pkt_len) {
661 #ifdef TCPREASS_DEBUG
662 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
663 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
664 pkt_seq, pkt_seq + pkt_len, pkt_len);
665 #endif
666 pkt_len += q->ipqe_len;
667 pkt_flags |= q->ipqe_flags;
668 m_cat(m, q->ipqe_m);
669 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
670 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
671 tp->t_segqlen--;
672 KASSERT(tp->t_segqlen >= 0);
673 KASSERT(tp->t_segqlen != 0 ||
674 (TAILQ_EMPTY(&tp->segq) &&
675 TAILQ_EMPTY(&tp->timeq)));
676 if (tiqe == NULL) {
677 tiqe = q;
678 } else {
679 tcpipqent_free(q);
680 }
681 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
682 break;
683 }
684 /*
685 * If the fragment is before the segment, remember it.
686 * When this loop is terminated, p will contain the
687 * pointer to fragment that is right before the received
688 * segment.
689 */
690 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
691 p = q;
692
693 continue;
694
695 /*
696 * This is a common operation. It also will allow
697 * to save doing a malloc/free in most instances.
698 */
699 free_ipqe:
700 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
701 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
702 tp->t_segqlen--;
703 KASSERT(tp->t_segqlen >= 0);
704 KASSERT(tp->t_segqlen != 0 ||
705 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
706 if (tiqe == NULL) {
707 tiqe = q;
708 } else {
709 tcpipqent_free(q);
710 }
711 }
712
713 #ifdef TCP_REASS_COUNTERS
714 if (count > 7)
715 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
716 else if (count > 0)
717 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
718 #endif
719
720 insert_it:
721
722 /*
723 * Allocate a new queue entry since the received segment did not
724 * collapse onto any other out-of-order block; thus we are allocating
725 * a new block. If it had collapsed, tiqe would not be NULL and
726 * we would be reusing it.
727 * XXX If we can't, just drop the packet. XXX
728 */
729 if (tiqe == NULL) {
730 tiqe = tcpipqent_alloc();
731 if (tiqe == NULL) {
732 TCP_STATINC(TCP_STAT_RCVMEMDROP);
733 m_freem(m);
734 goto out;
735 }
736 }
737
738 /*
739 * Update the counters.
740 */
741 tcps = TCP_STAT_GETREF();
742 tcps[TCP_STAT_RCVOOPACK]++;
743 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
744 if (rcvpartdupbyte) {
745 tcps[TCP_STAT_RCVPARTDUPPACK]++;
746 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
747 }
748 TCP_STAT_PUTREF();
749
750 /*
751 * Insert the new fragment queue entry into both queues.
752 */
753 tiqe->ipqe_m = m;
754 tiqe->ipre_mlast = m;
755 tiqe->ipqe_seq = pkt_seq;
756 tiqe->ipqe_len = pkt_len;
757 tiqe->ipqe_flags = pkt_flags;
758 if (p == NULL) {
759 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
760 #ifdef TCPREASS_DEBUG
761 if (tiqe->ipqe_seq != tp->rcv_nxt)
762 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
763 tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
764 #endif
765 } else {
766 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
767 #ifdef TCPREASS_DEBUG
768 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
769 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
770 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
771 #endif
772 }
773 tp->t_segqlen++;
774
775 skip_replacement:
776
777 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
778
779 present:
780 /*
781 * Present data to user, advancing rcv_nxt through
782 * completed sequence space.
783 */
784 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
785 goto out;
786 q = TAILQ_FIRST(&tp->segq);
787 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
788 goto out;
789 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
790 goto out;
791
792 tp->rcv_nxt += q->ipqe_len;
793 pkt_flags = q->ipqe_flags & TH_FIN;
794 nd6_hint(tp);
795
796 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
797 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
798 tp->t_segqlen--;
799 KASSERT(tp->t_segqlen >= 0);
800 KASSERT(tp->t_segqlen != 0 ||
801 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
802 if (so->so_state & SS_CANTRCVMORE)
803 m_freem(q->ipqe_m);
804 else
805 sbappendstream(&so->so_rcv, q->ipqe_m);
806 tcpipqent_free(q);
807 TCP_REASS_UNLOCK(tp);
808 sorwakeup(so);
809 return (pkt_flags);
810 out:
811 TCP_REASS_UNLOCK(tp);
812 return (0);
813 }
814
815 #ifdef INET6
816 int
817 tcp6_input(struct mbuf **mp, int *offp, int proto)
818 {
819 struct mbuf *m = *mp;
820
821 /*
822 * draft-itojun-ipv6-tcp-to-anycast
823 * better place to put this in?
824 */
825 if (m->m_flags & M_ANYCAST6) {
826 struct ip6_hdr *ip6;
827 if (m->m_len < sizeof(struct ip6_hdr)) {
828 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
829 TCP_STATINC(TCP_STAT_RCVSHORT);
830 return IPPROTO_DONE;
831 }
832 }
833 ip6 = mtod(m, struct ip6_hdr *);
834 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
835 (char *)&ip6->ip6_dst - (char *)ip6);
836 return IPPROTO_DONE;
837 }
838
839 tcp_input(m, *offp, proto);
840 return IPPROTO_DONE;
841 }
842 #endif
843
844 #ifdef INET
845 static void
846 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
847 {
848 char src[4*sizeof "123"];
849 char dst[4*sizeof "123"];
850
851 if (ip) {
852 strlcpy(src, inet_ntoa(ip->ip_src), sizeof(src));
853 strlcpy(dst, inet_ntoa(ip->ip_dst), sizeof(dst));
854 }
855 else {
856 strlcpy(src, "(unknown)", sizeof(src));
857 strlcpy(dst, "(unknown)", sizeof(dst));
858 }
859 log(LOG_INFO,
860 "Connection attempt to TCP %s:%d from %s:%d\n",
861 dst, ntohs(th->th_dport),
862 src, ntohs(th->th_sport));
863 }
864 #endif
865
866 #ifdef INET6
867 static void
868 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
869 {
870 char src[INET6_ADDRSTRLEN];
871 char dst[INET6_ADDRSTRLEN];
872
873 if (ip6) {
874 strlcpy(src, ip6_sprintf(&ip6->ip6_src), sizeof(src));
875 strlcpy(dst, ip6_sprintf(&ip6->ip6_dst), sizeof(dst));
876 }
877 else {
878 strlcpy(src, "(unknown v6)", sizeof(src));
879 strlcpy(dst, "(unknown v6)", sizeof(dst));
880 }
881 log(LOG_INFO,
882 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
883 dst, ntohs(th->th_dport),
884 src, ntohs(th->th_sport));
885 }
886 #endif
887
888 /*
889 * Checksum extended TCP header and data.
890 */
891 int
892 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
893 int toff, int off, int tlen)
894 {
895
896 /*
897 * XXX it's better to record and check if this mbuf is
898 * already checked.
899 */
900
901 switch (af) {
902 #ifdef INET
903 case AF_INET:
904 switch (m->m_pkthdr.csum_flags &
905 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
906 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
907 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
908 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
909 goto badcsum;
910
911 case M_CSUM_TCPv4|M_CSUM_DATA: {
912 u_int32_t hw_csum = m->m_pkthdr.csum_data;
913
914 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
915 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
916 const struct ip *ip =
917 mtod(m, const struct ip *);
918
919 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
920 ip->ip_dst.s_addr,
921 htons(hw_csum + tlen + off + IPPROTO_TCP));
922 }
923 if ((hw_csum ^ 0xffff) != 0)
924 goto badcsum;
925 break;
926 }
927
928 case M_CSUM_TCPv4:
929 /* Checksum was okay. */
930 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
931 break;
932
933 default:
934 /*
935 * Must compute it ourselves. Maybe skip checksum
936 * on loopback interfaces.
937 */
938 if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &
939 IFF_LOOPBACK) ||
940 tcp_do_loopback_cksum)) {
941 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
942 if (in4_cksum(m, IPPROTO_TCP, toff,
943 tlen + off) != 0)
944 goto badcsum;
945 }
946 break;
947 }
948 break;
949 #endif /* INET4 */
950
951 #ifdef INET6
952 case AF_INET6:
953 switch (m->m_pkthdr.csum_flags &
954 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
955 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
956 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
957 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
958 goto badcsum;
959
960 #if 0 /* notyet */
961 case M_CSUM_TCPv6|M_CSUM_DATA:
962 #endif
963
964 case M_CSUM_TCPv6:
965 /* Checksum was okay. */
966 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
967 break;
968
969 default:
970 /*
971 * Must compute it ourselves. Maybe skip checksum
972 * on loopback interfaces.
973 */
974 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
975 tcp_do_loopback_cksum)) {
976 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
977 if (in6_cksum(m, IPPROTO_TCP, toff,
978 tlen + off) != 0)
979 goto badcsum;
980 }
981 }
982 break;
983 #endif /* INET6 */
984 }
985
986 return 0;
987
988 badcsum:
989 TCP_STATINC(TCP_STAT_RCVBADSUM);
990 return -1;
991 }
992
993 /* When a packet arrives addressed to a vestigial tcpbp, we
994 * nevertheless have to respond to it per the spec.
995 */
996 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp,
997 struct mbuf *m, int tlen, int multicast)
998 {
999 int tiflags;
1000 int todrop, dupseg;
1001 uint32_t t_flags = 0;
1002 uint64_t *tcps;
1003
1004 tiflags = th->th_flags;
1005 todrop = vp->rcv_nxt - th->th_seq;
1006 dupseg = false;
1007
1008 if (todrop > 0) {
1009 if (tiflags & TH_SYN) {
1010 tiflags &= ~TH_SYN;
1011 ++th->th_seq;
1012 if (th->th_urp > 1)
1013 --th->th_urp;
1014 else {
1015 tiflags &= ~TH_URG;
1016 th->th_urp = 0;
1017 }
1018 --todrop;
1019 }
1020 if (todrop > tlen ||
1021 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1022 /*
1023 * Any valid FIN or RST must be to the left of the
1024 * window. At this point the FIN or RST must be a
1025 * duplicate or out of sequence; drop it.
1026 */
1027 if (tiflags & TH_RST)
1028 goto drop;
1029 tiflags &= ~(TH_FIN|TH_RST);
1030 /*
1031 * Send an ACK to resynchronize and drop any data.
1032 * But keep on processing for RST or ACK.
1033 */
1034 t_flags |= TF_ACKNOW;
1035 todrop = tlen;
1036 dupseg = true;
1037 tcps = TCP_STAT_GETREF();
1038 tcps[TCP_STAT_RCVDUPPACK] += 1;
1039 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
1040 TCP_STAT_PUTREF();
1041 } else if ((tiflags & TH_RST)
1042 && th->th_seq != vp->rcv_nxt) {
1043 /*
1044 * Test for reset before adjusting the sequence
1045 * number for overlapping data.
1046 */
1047 goto dropafterack_ratelim;
1048 } else {
1049 tcps = TCP_STAT_GETREF();
1050 tcps[TCP_STAT_RCVPARTDUPPACK] += 1;
1051 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
1052 TCP_STAT_PUTREF();
1053 }
1054
1055 // tcp_new_dsack(tp, th->th_seq, todrop);
1056 // hdroptlen += todrop; /*drop from head afterwards*/
1057
1058 th->th_seq += todrop;
1059 tlen -= todrop;
1060
1061 if (th->th_urp > todrop)
1062 th->th_urp -= todrop;
1063 else {
1064 tiflags &= ~TH_URG;
1065 th->th_urp = 0;
1066 }
1067 }
1068
1069 /*
1070 * If new data are received on a connection after the
1071 * user processes are gone, then RST the other end.
1072 */
1073 if (tlen) {
1074 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
1075 goto dropwithreset;
1076 }
1077
1078 /*
1079 * If segment ends after window, drop trailing data
1080 * (and PUSH and FIN); if nothing left, just ACK.
1081 */
1082 todrop = (th->th_seq + tlen) - (vp->rcv_nxt+vp->rcv_wnd);
1083
1084 if (todrop > 0) {
1085 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
1086 if (todrop >= tlen) {
1087 /*
1088 * The segment actually starts after the window.
1089 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen
1090 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0
1091 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd
1092 */
1093 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
1094 /*
1095 * If a new connection request is received
1096 * while in TIME_WAIT, drop the old connection
1097 * and start over if the sequence numbers
1098 * are above the previous ones.
1099 */
1100 if ((tiflags & TH_SYN)
1101 && SEQ_GT(th->th_seq, vp->rcv_nxt)) {
1102 /* We only support this in the !NOFDREF case, which
1103 * is to say: not here.
1104 */
1105 goto dropwithreset;;
1106 }
1107 /*
1108 * If window is closed can only take segments at
1109 * window edge, and have to drop data and PUSH from
1110 * incoming segments. Continue processing, but
1111 * remember to ack. Otherwise, drop segment
1112 * and (if not RST) ack.
1113 */
1114 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) {
1115 t_flags |= TF_ACKNOW;
1116 TCP_STATINC(TCP_STAT_RCVWINPROBE);
1117 } else
1118 goto dropafterack;
1119 } else
1120 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
1121 m_adj(m, -todrop);
1122 tlen -= todrop;
1123 tiflags &= ~(TH_PUSH|TH_FIN);
1124 }
1125
1126 if (tiflags & TH_RST) {
1127 if (th->th_seq != vp->rcv_nxt)
1128 goto dropafterack_ratelim;
1129
1130 vtw_del(vp->ctl, vp->vtw);
1131 goto drop;
1132 }
1133
1134 /*
1135 * If the ACK bit is off we drop the segment and return.
1136 */
1137 if ((tiflags & TH_ACK) == 0) {
1138 if (t_flags & TF_ACKNOW)
1139 goto dropafterack;
1140 else
1141 goto drop;
1142 }
1143
1144 /*
1145 * In TIME_WAIT state the only thing that should arrive
1146 * is a retransmission of the remote FIN. Acknowledge
1147 * it and restart the finack timer.
1148 */
1149 vtw_restart(vp);
1150 goto dropafterack;
1151
1152 dropafterack:
1153 /*
1154 * Generate an ACK dropping incoming segment if it occupies
1155 * sequence space, where the ACK reflects our state.
1156 */
1157 if (tiflags & TH_RST)
1158 goto drop;
1159 goto dropafterack2;
1160
1161 dropafterack_ratelim:
1162 /*
1163 * We may want to rate-limit ACKs against SYN/RST attack.
1164 */
1165 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
1166 tcp_ackdrop_ppslim) == 0) {
1167 /* XXX stat */
1168 goto drop;
1169 }
1170 /* ...fall into dropafterack2... */
1171
1172 dropafterack2:
1173 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack,
1174 TH_ACK);
1175 return;
1176
1177 dropwithreset:
1178 /*
1179 * Generate a RST, dropping incoming segment.
1180 * Make ACK acceptable to originator of segment.
1181 */
1182 if (tiflags & TH_RST)
1183 goto drop;
1184
1185 if (tiflags & TH_ACK)
1186 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
1187 else {
1188 if (tiflags & TH_SYN)
1189 ++tlen;
1190 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0,
1191 TH_RST|TH_ACK);
1192 }
1193 return;
1194 drop:
1195 m_freem(m);
1196 }
1197
1198 /*
1199 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
1200 */
1201 void
1202 tcp_input(struct mbuf *m, ...)
1203 {
1204 struct tcphdr *th;
1205 struct ip *ip;
1206 struct inpcb *inp;
1207 #ifdef INET6
1208 struct ip6_hdr *ip6;
1209 struct in6pcb *in6p;
1210 #endif
1211 u_int8_t *optp = NULL;
1212 int optlen = 0;
1213 int len, tlen, toff, hdroptlen = 0;
1214 struct tcpcb *tp = 0;
1215 int tiflags;
1216 struct socket *so = NULL;
1217 int todrop, acked, ourfinisacked, needoutput = 0;
1218 bool dupseg;
1219 #ifdef TCP_DEBUG
1220 short ostate = 0;
1221 #endif
1222 u_long tiwin;
1223 struct tcp_opt_info opti;
1224 int off, iphlen;
1225 va_list ap;
1226 int af; /* af on the wire */
1227 struct mbuf *tcp_saveti = NULL;
1228 uint32_t ts_rtt;
1229 uint8_t iptos;
1230 uint64_t *tcps;
1231 vestigial_inpcb_t vestige;
1232
1233 vestige.valid = 0;
1234
1235 MCLAIM(m, &tcp_rx_mowner);
1236 va_start(ap, m);
1237 toff = va_arg(ap, int);
1238 (void)va_arg(ap, int); /* ignore value, advance ap */
1239 va_end(ap);
1240
1241 TCP_STATINC(TCP_STAT_RCVTOTAL);
1242
1243 memset(&opti, 0, sizeof(opti));
1244 opti.ts_present = 0;
1245 opti.maxseg = 0;
1246
1247 /*
1248 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1249 *
1250 * TCP is, by definition, unicast, so we reject all
1251 * multicast outright.
1252 *
1253 * Note, there are additional src/dst address checks in
1254 * the AF-specific code below.
1255 */
1256 if (m->m_flags & (M_BCAST|M_MCAST)) {
1257 /* XXX stat */
1258 goto drop;
1259 }
1260 #ifdef INET6
1261 if (m->m_flags & M_ANYCAST6) {
1262 /* XXX stat */
1263 goto drop;
1264 }
1265 #endif
1266
1267 /*
1268 * Get IP and TCP header.
1269 * Note: IP leaves IP header in first mbuf.
1270 */
1271 ip = mtod(m, struct ip *);
1272 switch (ip->ip_v) {
1273 #ifdef INET
1274 case 4:
1275 #ifdef INET6
1276 ip6 = NULL;
1277 #endif
1278 af = AF_INET;
1279 iphlen = sizeof(struct ip);
1280 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1281 sizeof(struct tcphdr));
1282 if (th == NULL) {
1283 TCP_STATINC(TCP_STAT_RCVSHORT);
1284 return;
1285 }
1286 /* We do the checksum after PCB lookup... */
1287 len = ntohs(ip->ip_len);
1288 tlen = len - toff;
1289 iptos = ip->ip_tos;
1290 break;
1291 #endif
1292 #ifdef INET6
1293 case 6:
1294 ip = NULL;
1295 iphlen = sizeof(struct ip6_hdr);
1296 af = AF_INET6;
1297 ip6 = mtod(m, struct ip6_hdr *);
1298 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1299 sizeof(struct tcphdr));
1300 if (th == NULL) {
1301 TCP_STATINC(TCP_STAT_RCVSHORT);
1302 return;
1303 }
1304
1305 /* Be proactive about malicious use of IPv4 mapped address */
1306 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
1307 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
1308 /* XXX stat */
1309 goto drop;
1310 }
1311
1312 /*
1313 * Be proactive about unspecified IPv6 address in source.
1314 * As we use all-zero to indicate unbounded/unconnected pcb,
1315 * unspecified IPv6 address can be used to confuse us.
1316 *
1317 * Note that packets with unspecified IPv6 destination is
1318 * already dropped in ip6_input.
1319 */
1320 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1321 /* XXX stat */
1322 goto drop;
1323 }
1324
1325 /*
1326 * Make sure destination address is not multicast.
1327 * Source address checked in ip6_input().
1328 */
1329 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1330 /* XXX stat */
1331 goto drop;
1332 }
1333
1334 /* We do the checksum after PCB lookup... */
1335 len = m->m_pkthdr.len;
1336 tlen = len - toff;
1337 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1338 break;
1339 #endif
1340 default:
1341 m_freem(m);
1342 return;
1343 }
1344
1345 KASSERT(TCP_HDR_ALIGNED_P(th));
1346
1347 /*
1348 * Check that TCP offset makes sense,
1349 * pull out TCP options and adjust length. XXX
1350 */
1351 off = th->th_off << 2;
1352 if (off < sizeof (struct tcphdr) || off > tlen) {
1353 TCP_STATINC(TCP_STAT_RCVBADOFF);
1354 goto drop;
1355 }
1356 tlen -= off;
1357
1358 /*
1359 * tcp_input() has been modified to use tlen to mean the TCP data
1360 * length throughout the function. Other functions can use
1361 * m->m_pkthdr.len as the basis for calculating the TCP data length.
1362 * rja
1363 */
1364
1365 if (off > sizeof (struct tcphdr)) {
1366 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
1367 if (th == NULL) {
1368 TCP_STATINC(TCP_STAT_RCVSHORT);
1369 return;
1370 }
1371 /*
1372 * NOTE: ip/ip6 will not be affected by m_pulldown()
1373 * (as they're before toff) and we don't need to update those.
1374 */
1375 KASSERT(TCP_HDR_ALIGNED_P(th));
1376 optlen = off - sizeof (struct tcphdr);
1377 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1378 /*
1379 * Do quick retrieval of timestamp options ("options
1380 * prediction?"). If timestamp is the only option and it's
1381 * formatted as recommended in RFC 1323 appendix A, we
1382 * quickly get the values now and not bother calling
1383 * tcp_dooptions(), etc.
1384 */
1385 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1386 (optlen > TCPOLEN_TSTAMP_APPA &&
1387 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1388 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
1389 (th->th_flags & TH_SYN) == 0) {
1390 opti.ts_present = 1;
1391 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
1392 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
1393 optp = NULL; /* we've parsed the options */
1394 }
1395 }
1396 tiflags = th->th_flags;
1397
1398 /*
1399 * Locate pcb for segment.
1400 */
1401 findpcb:
1402 inp = NULL;
1403 #ifdef INET6
1404 in6p = NULL;
1405 #endif
1406 switch (af) {
1407 #ifdef INET
1408 case AF_INET:
1409 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
1410 ip->ip_dst, th->th_dport,
1411 &vestige);
1412 if (inp == 0 && !vestige.valid) {
1413 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1414 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
1415 }
1416 #ifdef INET6
1417 if (inp == 0 && !vestige.valid) {
1418 struct in6_addr s, d;
1419
1420 /* mapped addr case */
1421 memset(&s, 0, sizeof(s));
1422 s.s6_addr16[5] = htons(0xffff);
1423 bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
1424 memset(&d, 0, sizeof(d));
1425 d.s6_addr16[5] = htons(0xffff);
1426 bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
1427 in6p = in6_pcblookup_connect(&tcbtable, &s,
1428 th->th_sport, &d, th->th_dport,
1429 0, &vestige);
1430 if (in6p == 0 && !vestige.valid) {
1431 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1432 in6p = in6_pcblookup_bind(&tcbtable, &d,
1433 th->th_dport, 0);
1434 }
1435 }
1436 #endif
1437 #ifndef INET6
1438 if (inp == 0 && !vestige.valid)
1439 #else
1440 if (inp == 0 && in6p == 0 && !vestige.valid)
1441 #endif
1442 {
1443 TCP_STATINC(TCP_STAT_NOPORT);
1444 if (tcp_log_refused &&
1445 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1446 tcp4_log_refused(ip, th);
1447 }
1448 tcp_fields_to_host(th);
1449 goto dropwithreset_ratelim;
1450 }
1451 #if defined(FAST_IPSEC)
1452 if (inp && (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0 &&
1453 ipsec4_in_reject(m, inp)) {
1454 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1455 goto drop;
1456 }
1457 #ifdef INET6
1458 else if (in6p &&
1459 (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 &&
1460 ipsec6_in_reject_so(m, in6p->in6p_socket)) {
1461 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1462 goto drop;
1463 }
1464 #endif
1465 #endif /*IPSEC*/
1466 break;
1467 #endif /*INET*/
1468 #ifdef INET6
1469 case AF_INET6:
1470 {
1471 int faith;
1472
1473 #if defined(NFAITH) && NFAITH > 0
1474 faith = faithprefix(&ip6->ip6_dst);
1475 #else
1476 faith = 0;
1477 #endif
1478 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src,
1479 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige);
1480 if (!in6p && !vestige.valid) {
1481 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1482 in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst,
1483 th->th_dport, faith);
1484 }
1485 if (!in6p && !vestige.valid) {
1486 TCP_STATINC(TCP_STAT_NOPORT);
1487 if (tcp_log_refused &&
1488 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1489 tcp6_log_refused(ip6, th);
1490 }
1491 tcp_fields_to_host(th);
1492 goto dropwithreset_ratelim;
1493 }
1494 #if defined(FAST_IPSEC)
1495 if (in6p
1496 && (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0
1497 && ipsec6_in_reject(m, in6p)) {
1498 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1499 goto drop;
1500 }
1501 #endif /*IPSEC*/
1502 break;
1503 }
1504 #endif
1505 }
1506
1507 /*
1508 * If the state is CLOSED (i.e., TCB does not exist) then
1509 * all data in the incoming segment is discarded.
1510 * If the TCB exists but is in CLOSED state, it is embryonic,
1511 * but should either do a listen or a connect soon.
1512 */
1513 tp = NULL;
1514 so = NULL;
1515 if (inp) {
1516 /* Check the minimum TTL for socket. */
1517 if (ip->ip_ttl < inp->inp_ip_minttl)
1518 goto drop;
1519
1520 tp = intotcpcb(inp);
1521 so = inp->inp_socket;
1522 }
1523 #ifdef INET6
1524 else if (in6p) {
1525 tp = in6totcpcb(in6p);
1526 so = in6p->in6p_socket;
1527 }
1528 #endif
1529 else if (vestige.valid) {
1530 int mc = 0;
1531
1532 /* We do not support the resurrection of vtw tcpcps.
1533 */
1534 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1535 goto badcsum;
1536
1537 switch (af) {
1538 #ifdef INET6
1539 case AF_INET6:
1540 mc = IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst);
1541 break;
1542 #endif
1543
1544 case AF_INET:
1545 mc = (IN_MULTICAST(ip->ip_dst.s_addr)
1546 || in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif));
1547 break;
1548 }
1549
1550 tcp_fields_to_host(th);
1551 tcp_vtw_input(th, &vestige, m, tlen, mc);
1552 m = 0;
1553 goto drop;
1554 }
1555
1556 if (tp == 0) {
1557 tcp_fields_to_host(th);
1558 goto dropwithreset_ratelim;
1559 }
1560 if (tp->t_state == TCPS_CLOSED)
1561 goto drop;
1562
1563 KASSERT(so->so_lock == softnet_lock);
1564 KASSERT(solocked(so));
1565
1566 /*
1567 * Checksum extended TCP header and data.
1568 */
1569 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1570 goto badcsum;
1571
1572 tcp_fields_to_host(th);
1573
1574 /* Unscale the window into a 32-bit value. */
1575 if ((tiflags & TH_SYN) == 0)
1576 tiwin = th->th_win << tp->snd_scale;
1577 else
1578 tiwin = th->th_win;
1579
1580 #ifdef INET6
1581 /* save packet options if user wanted */
1582 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1583 if (in6p->in6p_options) {
1584 m_freem(in6p->in6p_options);
1585 in6p->in6p_options = 0;
1586 }
1587 KASSERT(ip6 != NULL);
1588 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1589 }
1590 #endif
1591
1592 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1593 union syn_cache_sa src;
1594 union syn_cache_sa dst;
1595
1596 memset(&src, 0, sizeof(src));
1597 memset(&dst, 0, sizeof(dst));
1598 switch (af) {
1599 #ifdef INET
1600 case AF_INET:
1601 src.sin.sin_len = sizeof(struct sockaddr_in);
1602 src.sin.sin_family = AF_INET;
1603 src.sin.sin_addr = ip->ip_src;
1604 src.sin.sin_port = th->th_sport;
1605
1606 dst.sin.sin_len = sizeof(struct sockaddr_in);
1607 dst.sin.sin_family = AF_INET;
1608 dst.sin.sin_addr = ip->ip_dst;
1609 dst.sin.sin_port = th->th_dport;
1610 break;
1611 #endif
1612 #ifdef INET6
1613 case AF_INET6:
1614 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1615 src.sin6.sin6_family = AF_INET6;
1616 src.sin6.sin6_addr = ip6->ip6_src;
1617 src.sin6.sin6_port = th->th_sport;
1618
1619 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1620 dst.sin6.sin6_family = AF_INET6;
1621 dst.sin6.sin6_addr = ip6->ip6_dst;
1622 dst.sin6.sin6_port = th->th_dport;
1623 break;
1624 #endif /* INET6 */
1625 default:
1626 goto badsyn; /*sanity*/
1627 }
1628
1629 if (so->so_options & SO_DEBUG) {
1630 #ifdef TCP_DEBUG
1631 ostate = tp->t_state;
1632 #endif
1633
1634 tcp_saveti = NULL;
1635 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1636 goto nosave;
1637
1638 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1639 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1640 if (!tcp_saveti)
1641 goto nosave;
1642 } else {
1643 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1644 if (!tcp_saveti)
1645 goto nosave;
1646 MCLAIM(m, &tcp_mowner);
1647 tcp_saveti->m_len = iphlen;
1648 m_copydata(m, 0, iphlen,
1649 mtod(tcp_saveti, void *));
1650 }
1651
1652 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1653 m_freem(tcp_saveti);
1654 tcp_saveti = NULL;
1655 } else {
1656 tcp_saveti->m_len += sizeof(struct tcphdr);
1657 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1658 sizeof(struct tcphdr));
1659 }
1660 nosave:;
1661 }
1662 if (so->so_options & SO_ACCEPTCONN) {
1663 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1664 if (tiflags & TH_RST) {
1665 syn_cache_reset(&src.sa, &dst.sa, th);
1666 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1667 (TH_ACK|TH_SYN)) {
1668 /*
1669 * Received a SYN,ACK. This should
1670 * never happen while we are in
1671 * LISTEN. Send an RST.
1672 */
1673 goto badsyn;
1674 } else if (tiflags & TH_ACK) {
1675 so = syn_cache_get(&src.sa, &dst.sa,
1676 th, toff, tlen, so, m);
1677 if (so == NULL) {
1678 /*
1679 * We don't have a SYN for
1680 * this ACK; send an RST.
1681 */
1682 goto badsyn;
1683 } else if (so ==
1684 (struct socket *)(-1)) {
1685 /*
1686 * We were unable to create
1687 * the connection. If the
1688 * 3-way handshake was
1689 * completed, and RST has
1690 * been sent to the peer.
1691 * Since the mbuf might be
1692 * in use for the reply,
1693 * do not free it.
1694 */
1695 m = NULL;
1696 } else {
1697 /*
1698 * We have created a
1699 * full-blown connection.
1700 */
1701 tp = NULL;
1702 inp = NULL;
1703 #ifdef INET6
1704 in6p = NULL;
1705 #endif
1706 switch (so->so_proto->pr_domain->dom_family) {
1707 #ifdef INET
1708 case AF_INET:
1709 inp = sotoinpcb(so);
1710 tp = intotcpcb(inp);
1711 break;
1712 #endif
1713 #ifdef INET6
1714 case AF_INET6:
1715 in6p = sotoin6pcb(so);
1716 tp = in6totcpcb(in6p);
1717 break;
1718 #endif
1719 }
1720 if (tp == NULL)
1721 goto badsyn; /*XXX*/
1722 tiwin <<= tp->snd_scale;
1723 goto after_listen;
1724 }
1725 } else {
1726 /*
1727 * None of RST, SYN or ACK was set.
1728 * This is an invalid packet for a
1729 * TCB in LISTEN state. Send a RST.
1730 */
1731 goto badsyn;
1732 }
1733 } else {
1734 /*
1735 * Received a SYN.
1736 *
1737 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1738 */
1739 if (m->m_flags & (M_BCAST|M_MCAST))
1740 goto drop;
1741
1742 switch (af) {
1743 #ifdef INET6
1744 case AF_INET6:
1745 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1746 goto drop;
1747 break;
1748 #endif /* INET6 */
1749 case AF_INET:
1750 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1751 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1752 goto drop;
1753 break;
1754 }
1755
1756 #ifdef INET6
1757 /*
1758 * If deprecated address is forbidden, we do
1759 * not accept SYN to deprecated interface
1760 * address to prevent any new inbound
1761 * connection from getting established.
1762 * When we do not accept SYN, we send a TCP
1763 * RST, with deprecated source address (instead
1764 * of dropping it). We compromise it as it is
1765 * much better for peer to send a RST, and
1766 * RST will be the final packet for the
1767 * exchange.
1768 *
1769 * If we do not forbid deprecated addresses, we
1770 * accept the SYN packet. RFC2462 does not
1771 * suggest dropping SYN in this case.
1772 * If we decipher RFC2462 5.5.4, it says like
1773 * this:
1774 * 1. use of deprecated addr with existing
1775 * communication is okay - "SHOULD continue
1776 * to be used"
1777 * 2. use of it with new communication:
1778 * (2a) "SHOULD NOT be used if alternate
1779 * address with sufficient scope is
1780 * available"
1781 * (2b) nothing mentioned otherwise.
1782 * Here we fall into (2b) case as we have no
1783 * choice in our source address selection - we
1784 * must obey the peer.
1785 *
1786 * The wording in RFC2462 is confusing, and
1787 * there are multiple description text for
1788 * deprecated address handling - worse, they
1789 * are not exactly the same. I believe 5.5.4
1790 * is the best one, so we follow 5.5.4.
1791 */
1792 if (af == AF_INET6 && !ip6_use_deprecated) {
1793 struct in6_ifaddr *ia6;
1794 if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
1795 &ip6->ip6_dst)) &&
1796 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1797 tp = NULL;
1798 goto dropwithreset;
1799 }
1800 }
1801 #endif
1802
1803 #if defined(FAST_IPSEC)
1804 switch (af) {
1805 #ifdef INET
1806 case AF_INET:
1807 if (ipsec4_in_reject_so(m, so)) {
1808 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1809 tp = NULL;
1810 goto dropwithreset;
1811 }
1812 break;
1813 #endif
1814 #ifdef INET6
1815 case AF_INET6:
1816 if (ipsec6_in_reject_so(m, so)) {
1817 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1818 tp = NULL;
1819 goto dropwithreset;
1820 }
1821 break;
1822 #endif /*INET6*/
1823 }
1824 #endif /*IPSEC*/
1825
1826 /*
1827 * LISTEN socket received a SYN
1828 * from itself? This can't possibly
1829 * be valid; drop the packet.
1830 */
1831 if (th->th_sport == th->th_dport) {
1832 int i;
1833
1834 switch (af) {
1835 #ifdef INET
1836 case AF_INET:
1837 i = in_hosteq(ip->ip_src, ip->ip_dst);
1838 break;
1839 #endif
1840 #ifdef INET6
1841 case AF_INET6:
1842 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1843 break;
1844 #endif
1845 default:
1846 i = 1;
1847 }
1848 if (i) {
1849 TCP_STATINC(TCP_STAT_BADSYN);
1850 goto drop;
1851 }
1852 }
1853
1854 /*
1855 * SYN looks ok; create compressed TCP
1856 * state for it.
1857 */
1858 if (so->so_qlen <= so->so_qlimit &&
1859 syn_cache_add(&src.sa, &dst.sa, th, tlen,
1860 so, m, optp, optlen, &opti))
1861 m = NULL;
1862 }
1863 goto drop;
1864 }
1865 }
1866
1867 after_listen:
1868 #ifdef DIAGNOSTIC
1869 /*
1870 * Should not happen now that all embryonic connections
1871 * are handled with compressed state.
1872 */
1873 if (tp->t_state == TCPS_LISTEN)
1874 panic("tcp_input: TCPS_LISTEN");
1875 #endif
1876
1877 /*
1878 * Segment received on connection.
1879 * Reset idle time and keep-alive timer.
1880 */
1881 tp->t_rcvtime = tcp_now;
1882 if (TCPS_HAVEESTABLISHED(tp->t_state))
1883 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1884
1885 /*
1886 * Process options.
1887 */
1888 #ifdef TCP_SIGNATURE
1889 if (optp || (tp->t_flags & TF_SIGNATURE))
1890 #else
1891 if (optp)
1892 #endif
1893 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0)
1894 goto drop;
1895
1896 if (TCP_SACK_ENABLED(tp)) {
1897 tcp_del_sackholes(tp, th);
1898 }
1899
1900 if (TCP_ECN_ALLOWED(tp)) {
1901 if (tiflags & TH_CWR) {
1902 tp->t_flags &= ~TF_ECN_SND_ECE;
1903 }
1904 switch (iptos & IPTOS_ECN_MASK) {
1905 case IPTOS_ECN_CE:
1906 tp->t_flags |= TF_ECN_SND_ECE;
1907 TCP_STATINC(TCP_STAT_ECN_CE);
1908 break;
1909 case IPTOS_ECN_ECT0:
1910 TCP_STATINC(TCP_STAT_ECN_ECT);
1911 break;
1912 case IPTOS_ECN_ECT1:
1913 /* XXX: ignore for now -- rpaulo */
1914 break;
1915 }
1916 /*
1917 * Congestion experienced.
1918 * Ignore if we are already trying to recover.
1919 */
1920 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1921 tp->t_congctl->cong_exp(tp);
1922 }
1923
1924 if (opti.ts_present && opti.ts_ecr) {
1925 /*
1926 * Calculate the RTT from the returned time stamp and the
1927 * connection's time base. If the time stamp is later than
1928 * the current time, or is extremely old, fall back to non-1323
1929 * RTT calculation. Since ts_rtt is unsigned, we can test both
1930 * at the same time.
1931 *
1932 * Note that ts_rtt is in units of slow ticks (500
1933 * ms). Since most earthbound RTTs are < 500 ms,
1934 * observed values will have large quantization noise.
1935 * Our smoothed RTT is then the fraction of observed
1936 * samples that are 1 tick instead of 0 (times 500
1937 * ms).
1938 *
1939 * ts_rtt is increased by 1 to denote a valid sample,
1940 * with 0 indicating an invalid measurement. This
1941 * extra 1 must be removed when ts_rtt is used, or
1942 * else an an erroneous extra 500 ms will result.
1943 */
1944 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1945 if (ts_rtt > TCP_PAWS_IDLE)
1946 ts_rtt = 0;
1947 } else {
1948 ts_rtt = 0;
1949 }
1950
1951 /*
1952 * Header prediction: check for the two common cases
1953 * of a uni-directional data xfer. If the packet has
1954 * no control flags, is in-sequence, the window didn't
1955 * change and we're not retransmitting, it's a
1956 * candidate. If the length is zero and the ack moved
1957 * forward, we're the sender side of the xfer. Just
1958 * free the data acked & wake any higher level process
1959 * that was blocked waiting for space. If the length
1960 * is non-zero and the ack didn't move, we're the
1961 * receiver side. If we're getting packets in-order
1962 * (the reassembly queue is empty), add the data to
1963 * the socket buffer and note that we need a delayed ack.
1964 */
1965 if (tp->t_state == TCPS_ESTABLISHED &&
1966 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1967 == TH_ACK &&
1968 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1969 th->th_seq == tp->rcv_nxt &&
1970 tiwin && tiwin == tp->snd_wnd &&
1971 tp->snd_nxt == tp->snd_max) {
1972
1973 /*
1974 * If last ACK falls within this segment's sequence numbers,
1975 * record the timestamp.
1976 * NOTE that the test is modified according to the latest
1977 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26).
1978 *
1979 * note that we already know
1980 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1981 */
1982 if (opti.ts_present &&
1983 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1984 tp->ts_recent_age = tcp_now;
1985 tp->ts_recent = opti.ts_val;
1986 }
1987
1988 if (tlen == 0) {
1989 /* Ack prediction. */
1990 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1991 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1992 tp->snd_cwnd >= tp->snd_wnd &&
1993 tp->t_partialacks < 0) {
1994 /*
1995 * this is a pure ack for outstanding data.
1996 */
1997 if (ts_rtt)
1998 tcp_xmit_timer(tp, ts_rtt - 1);
1999 else if (tp->t_rtttime &&
2000 SEQ_GT(th->th_ack, tp->t_rtseq))
2001 tcp_xmit_timer(tp,
2002 tcp_now - tp->t_rtttime);
2003 acked = th->th_ack - tp->snd_una;
2004 tcps = TCP_STAT_GETREF();
2005 tcps[TCP_STAT_PREDACK]++;
2006 tcps[TCP_STAT_RCVACKPACK]++;
2007 tcps[TCP_STAT_RCVACKBYTE] += acked;
2008 TCP_STAT_PUTREF();
2009 nd6_hint(tp);
2010
2011 if (acked > (tp->t_lastoff - tp->t_inoff))
2012 tp->t_lastm = NULL;
2013 sbdrop(&so->so_snd, acked);
2014 tp->t_lastoff -= acked;
2015
2016 icmp_check(tp, th, acked);
2017
2018 tp->snd_una = th->th_ack;
2019 tp->snd_fack = tp->snd_una;
2020 if (SEQ_LT(tp->snd_high, tp->snd_una))
2021 tp->snd_high = tp->snd_una;
2022 m_freem(m);
2023
2024 /*
2025 * If all outstanding data are acked, stop
2026 * retransmit timer, otherwise restart timer
2027 * using current (possibly backed-off) value.
2028 * If process is waiting for space,
2029 * wakeup/selnotify/signal. If data
2030 * are ready to send, let tcp_output
2031 * decide between more output or persist.
2032 */
2033 if (tp->snd_una == tp->snd_max)
2034 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2035 else if (TCP_TIMER_ISARMED(tp,
2036 TCPT_PERSIST) == 0)
2037 TCP_TIMER_ARM(tp, TCPT_REXMT,
2038 tp->t_rxtcur);
2039
2040 sowwakeup(so);
2041 if (so->so_snd.sb_cc) {
2042 KERNEL_LOCK(1, NULL);
2043 (void) tcp_output(tp);
2044 KERNEL_UNLOCK_ONE(NULL);
2045 }
2046 if (tcp_saveti)
2047 m_freem(tcp_saveti);
2048 return;
2049 }
2050 } else if (th->th_ack == tp->snd_una &&
2051 TAILQ_FIRST(&tp->segq) == NULL &&
2052 tlen <= sbspace(&so->so_rcv)) {
2053 int newsize = 0; /* automatic sockbuf scaling */
2054
2055 /*
2056 * this is a pure, in-sequence data packet
2057 * with nothing on the reassembly queue and
2058 * we have enough buffer space to take it.
2059 */
2060 tp->rcv_nxt += tlen;
2061 tcps = TCP_STAT_GETREF();
2062 tcps[TCP_STAT_PREDDAT]++;
2063 tcps[TCP_STAT_RCVPACK]++;
2064 tcps[TCP_STAT_RCVBYTE] += tlen;
2065 TCP_STAT_PUTREF();
2066 nd6_hint(tp);
2067
2068 /*
2069 * Automatic sizing enables the performance of large buffers
2070 * and most of the efficiency of small ones by only allocating
2071 * space when it is needed.
2072 *
2073 * On the receive side the socket buffer memory is only rarely
2074 * used to any significant extent. This allows us to be much
2075 * more aggressive in scaling the receive socket buffer. For
2076 * the case that the buffer space is actually used to a large
2077 * extent and we run out of kernel memory we can simply drop
2078 * the new segments; TCP on the sender will just retransmit it
2079 * later. Setting the buffer size too big may only consume too
2080 * much kernel memory if the application doesn't read() from
2081 * the socket or packet loss or reordering makes use of the
2082 * reassembly queue.
2083 *
2084 * The criteria to step up the receive buffer one notch are:
2085 * 1. the number of bytes received during the time it takes
2086 * one timestamp to be reflected back to us (the RTT);
2087 * 2. received bytes per RTT is within seven eighth of the
2088 * current socket buffer size;
2089 * 3. receive buffer size has not hit maximal automatic size;
2090 *
2091 * This algorithm does one step per RTT at most and only if
2092 * we receive a bulk stream w/o packet losses or reorderings.
2093 * Shrinking the buffer during idle times is not necessary as
2094 * it doesn't consume any memory when idle.
2095 *
2096 * TODO: Only step up if the application is actually serving
2097 * the buffer to better manage the socket buffer resources.
2098 */
2099 if (tcp_do_autorcvbuf &&
2100 opti.ts_ecr &&
2101 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
2102 if (opti.ts_ecr > tp->rfbuf_ts &&
2103 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
2104 if (tp->rfbuf_cnt >
2105 (so->so_rcv.sb_hiwat / 8 * 7) &&
2106 so->so_rcv.sb_hiwat <
2107 tcp_autorcvbuf_max) {
2108 newsize =
2109 min(so->so_rcv.sb_hiwat +
2110 tcp_autorcvbuf_inc,
2111 tcp_autorcvbuf_max);
2112 }
2113 /* Start over with next RTT. */
2114 tp->rfbuf_ts = 0;
2115 tp->rfbuf_cnt = 0;
2116 } else
2117 tp->rfbuf_cnt += tlen; /* add up */
2118 }
2119
2120 /*
2121 * Drop TCP, IP headers and TCP options then add data
2122 * to socket buffer.
2123 */
2124 if (so->so_state & SS_CANTRCVMORE)
2125 m_freem(m);
2126 else {
2127 /*
2128 * Set new socket buffer size.
2129 * Give up when limit is reached.
2130 */
2131 if (newsize)
2132 if (!sbreserve(&so->so_rcv,
2133 newsize, so))
2134 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
2135 m_adj(m, toff + off);
2136 sbappendstream(&so->so_rcv, m);
2137 }
2138 sorwakeup(so);
2139 tcp_setup_ack(tp, th);
2140 if (tp->t_flags & TF_ACKNOW) {
2141 KERNEL_LOCK(1, NULL);
2142 (void) tcp_output(tp);
2143 KERNEL_UNLOCK_ONE(NULL);
2144 }
2145 if (tcp_saveti)
2146 m_freem(tcp_saveti);
2147 return;
2148 }
2149 }
2150
2151 /*
2152 * Compute mbuf offset to TCP data segment.
2153 */
2154 hdroptlen = toff + off;
2155
2156 /*
2157 * Calculate amount of space in receive window,
2158 * and then do TCP input processing.
2159 * Receive window is amount of space in rcv queue,
2160 * but not less than advertised window.
2161 */
2162 { int win;
2163
2164 win = sbspace(&so->so_rcv);
2165 if (win < 0)
2166 win = 0;
2167 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2168 }
2169
2170 /* Reset receive buffer auto scaling when not in bulk receive mode. */
2171 tp->rfbuf_ts = 0;
2172 tp->rfbuf_cnt = 0;
2173
2174 switch (tp->t_state) {
2175 /*
2176 * If the state is SYN_SENT:
2177 * if seg contains an ACK, but not for our SYN, drop the input.
2178 * if seg contains a RST, then drop the connection.
2179 * if seg does not contain SYN, then drop it.
2180 * Otherwise this is an acceptable SYN segment
2181 * initialize tp->rcv_nxt and tp->irs
2182 * if seg contains ack then advance tp->snd_una
2183 * if seg contains a ECE and ECN support is enabled, the stream
2184 * is ECN capable.
2185 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2186 * arrange for segment to be acked (eventually)
2187 * continue processing rest of data/controls, beginning with URG
2188 */
2189 case TCPS_SYN_SENT:
2190 if ((tiflags & TH_ACK) &&
2191 (SEQ_LEQ(th->th_ack, tp->iss) ||
2192 SEQ_GT(th->th_ack, tp->snd_max)))
2193 goto dropwithreset;
2194 if (tiflags & TH_RST) {
2195 if (tiflags & TH_ACK)
2196 tp = tcp_drop(tp, ECONNREFUSED);
2197 goto drop;
2198 }
2199 if ((tiflags & TH_SYN) == 0)
2200 goto drop;
2201 if (tiflags & TH_ACK) {
2202 tp->snd_una = th->th_ack;
2203 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2204 tp->snd_nxt = tp->snd_una;
2205 if (SEQ_LT(tp->snd_high, tp->snd_una))
2206 tp->snd_high = tp->snd_una;
2207 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2208
2209 if ((tiflags & TH_ECE) && tcp_do_ecn) {
2210 tp->t_flags |= TF_ECN_PERMIT;
2211 TCP_STATINC(TCP_STAT_ECN_SHS);
2212 }
2213
2214 }
2215 tp->irs = th->th_seq;
2216 tcp_rcvseqinit(tp);
2217 tp->t_flags |= TF_ACKNOW;
2218 tcp_mss_from_peer(tp, opti.maxseg);
2219
2220 /*
2221 * Initialize the initial congestion window. If we
2222 * had to retransmit the SYN, we must initialize cwnd
2223 * to 1 segment (i.e. the Loss Window).
2224 */
2225 if (tp->t_flags & TF_SYN_REXMT)
2226 tp->snd_cwnd = tp->t_peermss;
2227 else {
2228 int ss = tcp_init_win;
2229 #ifdef INET
2230 if (inp != NULL && in_localaddr(inp->inp_faddr))
2231 ss = tcp_init_win_local;
2232 #endif
2233 #ifdef INET6
2234 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
2235 ss = tcp_init_win_local;
2236 #endif
2237 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
2238 }
2239
2240 tcp_rmx_rtt(tp);
2241 if (tiflags & TH_ACK) {
2242 TCP_STATINC(TCP_STAT_CONNECTS);
2243 /*
2244 * move tcp_established before soisconnected
2245 * because upcall handler can drive tcp_output
2246 * functionality.
2247 * XXX we might call soisconnected at the end of
2248 * all processing
2249 */
2250 tcp_established(tp);
2251 soisconnected(so);
2252 /* Do window scaling on this connection? */
2253 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2254 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2255 tp->snd_scale = tp->requested_s_scale;
2256 tp->rcv_scale = tp->request_r_scale;
2257 }
2258 TCP_REASS_LOCK(tp);
2259 (void) tcp_reass(tp, NULL, NULL, &tlen);
2260 /*
2261 * if we didn't have to retransmit the SYN,
2262 * use its rtt as our initial srtt & rtt var.
2263 */
2264 if (tp->t_rtttime)
2265 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2266 } else
2267 tp->t_state = TCPS_SYN_RECEIVED;
2268
2269 /*
2270 * Advance th->th_seq to correspond to first data byte.
2271 * If data, trim to stay within window,
2272 * dropping FIN if necessary.
2273 */
2274 th->th_seq++;
2275 if (tlen > tp->rcv_wnd) {
2276 todrop = tlen - tp->rcv_wnd;
2277 m_adj(m, -todrop);
2278 tlen = tp->rcv_wnd;
2279 tiflags &= ~TH_FIN;
2280 tcps = TCP_STAT_GETREF();
2281 tcps[TCP_STAT_RCVPACKAFTERWIN]++;
2282 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
2283 TCP_STAT_PUTREF();
2284 }
2285 tp->snd_wl1 = th->th_seq - 1;
2286 tp->rcv_up = th->th_seq;
2287 goto step6;
2288
2289 /*
2290 * If the state is SYN_RECEIVED:
2291 * If seg contains an ACK, but not for our SYN, drop the input
2292 * and generate an RST. See page 36, rfc793
2293 */
2294 case TCPS_SYN_RECEIVED:
2295 if ((tiflags & TH_ACK) &&
2296 (SEQ_LEQ(th->th_ack, tp->iss) ||
2297 SEQ_GT(th->th_ack, tp->snd_max)))
2298 goto dropwithreset;
2299 break;
2300 }
2301
2302 /*
2303 * States other than LISTEN or SYN_SENT.
2304 * First check timestamp, if present.
2305 * Then check that at least some bytes of segment are within
2306 * receive window. If segment begins before rcv_nxt,
2307 * drop leading data (and SYN); if nothing left, just ack.
2308 *
2309 * RFC 1323 PAWS: If we have a timestamp reply on this segment
2310 * and it's less than ts_recent, drop it.
2311 */
2312 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2313 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2314
2315 /* Check to see if ts_recent is over 24 days old. */
2316 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2317 /*
2318 * Invalidate ts_recent. If this segment updates
2319 * ts_recent, the age will be reset later and ts_recent
2320 * will get a valid value. If it does not, setting
2321 * ts_recent to zero will at least satisfy the
2322 * requirement that zero be placed in the timestamp
2323 * echo reply when ts_recent isn't valid. The
2324 * age isn't reset until we get a valid ts_recent
2325 * because we don't want out-of-order segments to be
2326 * dropped when ts_recent is old.
2327 */
2328 tp->ts_recent = 0;
2329 } else {
2330 tcps = TCP_STAT_GETREF();
2331 tcps[TCP_STAT_RCVDUPPACK]++;
2332 tcps[TCP_STAT_RCVDUPBYTE] += tlen;
2333 tcps[TCP_STAT_PAWSDROP]++;
2334 TCP_STAT_PUTREF();
2335 tcp_new_dsack(tp, th->th_seq, tlen);
2336 goto dropafterack;
2337 }
2338 }
2339
2340 todrop = tp->rcv_nxt - th->th_seq;
2341 dupseg = false;
2342 if (todrop > 0) {
2343 if (tiflags & TH_SYN) {
2344 tiflags &= ~TH_SYN;
2345 th->th_seq++;
2346 if (th->th_urp > 1)
2347 th->th_urp--;
2348 else {
2349 tiflags &= ~TH_URG;
2350 th->th_urp = 0;
2351 }
2352 todrop--;
2353 }
2354 if (todrop > tlen ||
2355 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2356 /*
2357 * Any valid FIN or RST must be to the left of the
2358 * window. At this point the FIN or RST must be a
2359 * duplicate or out of sequence; drop it.
2360 */
2361 if (tiflags & TH_RST)
2362 goto drop;
2363 tiflags &= ~(TH_FIN|TH_RST);
2364 /*
2365 * Send an ACK to resynchronize and drop any data.
2366 * But keep on processing for RST or ACK.
2367 */
2368 tp->t_flags |= TF_ACKNOW;
2369 todrop = tlen;
2370 dupseg = true;
2371 tcps = TCP_STAT_GETREF();
2372 tcps[TCP_STAT_RCVDUPPACK]++;
2373 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
2374 TCP_STAT_PUTREF();
2375 } else if ((tiflags & TH_RST) &&
2376 th->th_seq != tp->rcv_nxt) {
2377 /*
2378 * Test for reset before adjusting the sequence
2379 * number for overlapping data.
2380 */
2381 goto dropafterack_ratelim;
2382 } else {
2383 tcps = TCP_STAT_GETREF();
2384 tcps[TCP_STAT_RCVPARTDUPPACK]++;
2385 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
2386 TCP_STAT_PUTREF();
2387 }
2388 tcp_new_dsack(tp, th->th_seq, todrop);
2389 hdroptlen += todrop; /*drop from head afterwards*/
2390 th->th_seq += todrop;
2391 tlen -= todrop;
2392 if (th->th_urp > todrop)
2393 th->th_urp -= todrop;
2394 else {
2395 tiflags &= ~TH_URG;
2396 th->th_urp = 0;
2397 }
2398 }
2399
2400 /*
2401 * If new data are received on a connection after the
2402 * user processes are gone, then RST the other end.
2403 */
2404 if ((so->so_state & SS_NOFDREF) &&
2405 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2406 tp = tcp_close(tp);
2407 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2408 goto dropwithreset;
2409 }
2410
2411 /*
2412 * If segment ends after window, drop trailing data
2413 * (and PUSH and FIN); if nothing left, just ACK.
2414 */
2415 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
2416 if (todrop > 0) {
2417 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2418 if (todrop >= tlen) {
2419 /*
2420 * The segment actually starts after the window.
2421 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2422 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2423 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2424 */
2425 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2426 /*
2427 * If a new connection request is received
2428 * while in TIME_WAIT, drop the old connection
2429 * and start over if the sequence numbers
2430 * are above the previous ones.
2431 *
2432 * NOTE: We will checksum the packet again, and
2433 * so we need to put the header fields back into
2434 * network order!
2435 * XXX This kind of sucks, but we don't expect
2436 * XXX this to happen very often, so maybe it
2437 * XXX doesn't matter so much.
2438 */
2439 if (tiflags & TH_SYN &&
2440 tp->t_state == TCPS_TIME_WAIT &&
2441 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2442 tp = tcp_close(tp);
2443 tcp_fields_to_net(th);
2444 goto findpcb;
2445 }
2446 /*
2447 * If window is closed can only take segments at
2448 * window edge, and have to drop data and PUSH from
2449 * incoming segments. Continue processing, but
2450 * remember to ack. Otherwise, drop segment
2451 * and (if not RST) ack.
2452 */
2453 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2454 tp->t_flags |= TF_ACKNOW;
2455 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2456 } else
2457 goto dropafterack;
2458 } else
2459 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2460 m_adj(m, -todrop);
2461 tlen -= todrop;
2462 tiflags &= ~(TH_PUSH|TH_FIN);
2463 }
2464
2465 /*
2466 * If last ACK falls within this segment's sequence numbers,
2467 * record the timestamp.
2468 * NOTE:
2469 * 1) That the test incorporates suggestions from the latest
2470 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26).
2471 * 2) That updating only on newer timestamps interferes with
2472 * our earlier PAWS tests, so this check should be solely
2473 * predicated on the sequence space of this segment.
2474 * 3) That we modify the segment boundary check to be
2475 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2476 * instead of RFC1323's
2477 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2478 * This modified check allows us to overcome RFC1323's
2479 * limitations as described in Stevens TCP/IP Illustrated
2480 * Vol. 2 p.869. In such cases, we can still calculate the
2481 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2482 */
2483 if (opti.ts_present &&
2484 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2485 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2486 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2487 tp->ts_recent_age = tcp_now;
2488 tp->ts_recent = opti.ts_val;
2489 }
2490
2491 /*
2492 * If the RST bit is set examine the state:
2493 * SYN_RECEIVED STATE:
2494 * If passive open, return to LISTEN state.
2495 * If active open, inform user that connection was refused.
2496 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
2497 * Inform user that connection was reset, and close tcb.
2498 * CLOSING, LAST_ACK, TIME_WAIT STATES
2499 * Close the tcb.
2500 */
2501 if (tiflags & TH_RST) {
2502 if (th->th_seq != tp->rcv_nxt)
2503 goto dropafterack_ratelim;
2504
2505 switch (tp->t_state) {
2506 case TCPS_SYN_RECEIVED:
2507 so->so_error = ECONNREFUSED;
2508 goto close;
2509
2510 case TCPS_ESTABLISHED:
2511 case TCPS_FIN_WAIT_1:
2512 case TCPS_FIN_WAIT_2:
2513 case TCPS_CLOSE_WAIT:
2514 so->so_error = ECONNRESET;
2515 close:
2516 tp->t_state = TCPS_CLOSED;
2517 TCP_STATINC(TCP_STAT_DROPS);
2518 tp = tcp_close(tp);
2519 goto drop;
2520
2521 case TCPS_CLOSING:
2522 case TCPS_LAST_ACK:
2523 case TCPS_TIME_WAIT:
2524 tp = tcp_close(tp);
2525 goto drop;
2526 }
2527 }
2528
2529 /*
2530 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2531 * we must be in a synchronized state. RFC791 states (under RST
2532 * generation) that any unacceptable segment (an out-of-order SYN
2533 * qualifies) received in a synchronized state must elicit only an
2534 * empty acknowledgment segment ... and the connection remains in
2535 * the same state.
2536 */
2537 if (tiflags & TH_SYN) {
2538 if (tp->rcv_nxt == th->th_seq) {
2539 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2540 TH_ACK);
2541 if (tcp_saveti)
2542 m_freem(tcp_saveti);
2543 return;
2544 }
2545
2546 goto dropafterack_ratelim;
2547 }
2548
2549 /*
2550 * If the ACK bit is off we drop the segment and return.
2551 */
2552 if ((tiflags & TH_ACK) == 0) {
2553 if (tp->t_flags & TF_ACKNOW)
2554 goto dropafterack;
2555 else
2556 goto drop;
2557 }
2558
2559 /*
2560 * Ack processing.
2561 */
2562 switch (tp->t_state) {
2563
2564 /*
2565 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2566 * ESTABLISHED state and continue processing, otherwise
2567 * send an RST.
2568 */
2569 case TCPS_SYN_RECEIVED:
2570 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2571 SEQ_GT(th->th_ack, tp->snd_max))
2572 goto dropwithreset;
2573 TCP_STATINC(TCP_STAT_CONNECTS);
2574 soisconnected(so);
2575 tcp_established(tp);
2576 /* Do window scaling? */
2577 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2578 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2579 tp->snd_scale = tp->requested_s_scale;
2580 tp->rcv_scale = tp->request_r_scale;
2581 }
2582 TCP_REASS_LOCK(tp);
2583 (void) tcp_reass(tp, NULL, NULL, &tlen);
2584 tp->snd_wl1 = th->th_seq - 1;
2585 /* fall into ... */
2586
2587 /*
2588 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2589 * ACKs. If the ack is in the range
2590 * tp->snd_una < th->th_ack <= tp->snd_max
2591 * then advance tp->snd_una to th->th_ack and drop
2592 * data from the retransmission queue. If this ACK reflects
2593 * more up to date window information we update our window information.
2594 */
2595 case TCPS_ESTABLISHED:
2596 case TCPS_FIN_WAIT_1:
2597 case TCPS_FIN_WAIT_2:
2598 case TCPS_CLOSE_WAIT:
2599 case TCPS_CLOSING:
2600 case TCPS_LAST_ACK:
2601 case TCPS_TIME_WAIT:
2602
2603 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2604 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2605 TCP_STATINC(TCP_STAT_RCVDUPACK);
2606 /*
2607 * If we have outstanding data (other than
2608 * a window probe), this is a completely
2609 * duplicate ack (ie, window info didn't
2610 * change), the ack is the biggest we've
2611 * seen and we've seen exactly our rexmt
2612 * threshhold of them, assume a packet
2613 * has been dropped and retransmit it.
2614 * Kludge snd_nxt & the congestion
2615 * window so we send only this one
2616 * packet.
2617 */
2618 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2619 th->th_ack != tp->snd_una)
2620 tp->t_dupacks = 0;
2621 else if (tp->t_partialacks < 0 &&
2622 (++tp->t_dupacks == tcprexmtthresh ||
2623 TCP_FACK_FASTRECOV(tp))) {
2624 /*
2625 * Do the fast retransmit, and adjust
2626 * congestion control paramenters.
2627 */
2628 if (tp->t_congctl->fast_retransmit(tp, th)) {
2629 /* False fast retransmit */
2630 break;
2631 } else
2632 goto drop;
2633 } else if (tp->t_dupacks > tcprexmtthresh) {
2634 tp->snd_cwnd += tp->t_segsz;
2635 KERNEL_LOCK(1, NULL);
2636 (void) tcp_output(tp);
2637 KERNEL_UNLOCK_ONE(NULL);
2638 goto drop;
2639 }
2640 } else {
2641 /*
2642 * If the ack appears to be very old, only
2643 * allow data that is in-sequence. This
2644 * makes it somewhat more difficult to insert
2645 * forged data by guessing sequence numbers.
2646 * Sent an ack to try to update the send
2647 * sequence number on the other side.
2648 */
2649 if (tlen && th->th_seq != tp->rcv_nxt &&
2650 SEQ_LT(th->th_ack,
2651 tp->snd_una - tp->max_sndwnd))
2652 goto dropafterack;
2653 }
2654 break;
2655 }
2656 /*
2657 * If the congestion window was inflated to account
2658 * for the other side's cached packets, retract it.
2659 */
2660 /* XXX: make SACK have his own congestion control
2661 * struct -- rpaulo */
2662 if (TCP_SACK_ENABLED(tp))
2663 tcp_sack_newack(tp, th);
2664 else
2665 tp->t_congctl->fast_retransmit_newack(tp, th);
2666 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2667 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2668 goto dropafterack;
2669 }
2670 acked = th->th_ack - tp->snd_una;
2671 tcps = TCP_STAT_GETREF();
2672 tcps[TCP_STAT_RCVACKPACK]++;
2673 tcps[TCP_STAT_RCVACKBYTE] += acked;
2674 TCP_STAT_PUTREF();
2675
2676 /*
2677 * If we have a timestamp reply, update smoothed
2678 * round trip time. If no timestamp is present but
2679 * transmit timer is running and timed sequence
2680 * number was acked, update smoothed round trip time.
2681 * Since we now have an rtt measurement, cancel the
2682 * timer backoff (cf., Phil Karn's retransmit alg.).
2683 * Recompute the initial retransmit timer.
2684 */
2685 if (ts_rtt)
2686 tcp_xmit_timer(tp, ts_rtt - 1);
2687 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2688 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2689
2690 /*
2691 * If all outstanding data is acked, stop retransmit
2692 * timer and remember to restart (more output or persist).
2693 * If there is more data to be acked, restart retransmit
2694 * timer, using current (possibly backed-off) value.
2695 */
2696 if (th->th_ack == tp->snd_max) {
2697 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2698 needoutput = 1;
2699 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2700 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2701
2702 /*
2703 * New data has been acked, adjust the congestion window.
2704 */
2705 tp->t_congctl->newack(tp, th);
2706
2707 nd6_hint(tp);
2708 if (acked > so->so_snd.sb_cc) {
2709 tp->snd_wnd -= so->so_snd.sb_cc;
2710 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2711 ourfinisacked = 1;
2712 } else {
2713 if (acked > (tp->t_lastoff - tp->t_inoff))
2714 tp->t_lastm = NULL;
2715 sbdrop(&so->so_snd, acked);
2716 tp->t_lastoff -= acked;
2717 tp->snd_wnd -= acked;
2718 ourfinisacked = 0;
2719 }
2720 sowwakeup(so);
2721
2722 icmp_check(tp, th, acked);
2723
2724 tp->snd_una = th->th_ack;
2725 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2726 tp->snd_fack = tp->snd_una;
2727 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2728 tp->snd_nxt = tp->snd_una;
2729 if (SEQ_LT(tp->snd_high, tp->snd_una))
2730 tp->snd_high = tp->snd_una;
2731
2732 switch (tp->t_state) {
2733
2734 /*
2735 * In FIN_WAIT_1 STATE in addition to the processing
2736 * for the ESTABLISHED state if our FIN is now acknowledged
2737 * then enter FIN_WAIT_2.
2738 */
2739 case TCPS_FIN_WAIT_1:
2740 if (ourfinisacked) {
2741 /*
2742 * If we can't receive any more
2743 * data, then closing user can proceed.
2744 * Starting the timer is contrary to the
2745 * specification, but if we don't get a FIN
2746 * we'll hang forever.
2747 */
2748 if (so->so_state & SS_CANTRCVMORE) {
2749 soisdisconnected(so);
2750 if (tp->t_maxidle > 0)
2751 TCP_TIMER_ARM(tp, TCPT_2MSL,
2752 tp->t_maxidle);
2753 }
2754 tp->t_state = TCPS_FIN_WAIT_2;
2755 }
2756 break;
2757
2758 /*
2759 * In CLOSING STATE in addition to the processing for
2760 * the ESTABLISHED state if the ACK acknowledges our FIN
2761 * then enter the TIME-WAIT state, otherwise ignore
2762 * the segment.
2763 */
2764 case TCPS_CLOSING:
2765 if (ourfinisacked) {
2766 tp->t_state = TCPS_TIME_WAIT;
2767 tcp_canceltimers(tp);
2768 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2769 soisdisconnected(so);
2770 }
2771 break;
2772
2773 /*
2774 * In LAST_ACK, we may still be waiting for data to drain
2775 * and/or to be acked, as well as for the ack of our FIN.
2776 * If our FIN is now acknowledged, delete the TCB,
2777 * enter the closed state and return.
2778 */
2779 case TCPS_LAST_ACK:
2780 if (ourfinisacked) {
2781 tp = tcp_close(tp);
2782 goto drop;
2783 }
2784 break;
2785
2786 /*
2787 * In TIME_WAIT state the only thing that should arrive
2788 * is a retransmission of the remote FIN. Acknowledge
2789 * it and restart the finack timer.
2790 */
2791 case TCPS_TIME_WAIT:
2792 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2793 goto dropafterack;
2794 }
2795 }
2796
2797 step6:
2798 /*
2799 * Update window information.
2800 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2801 */
2802 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2803 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2804 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2805 /* keep track of pure window updates */
2806 if (tlen == 0 &&
2807 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2808 TCP_STATINC(TCP_STAT_RCVWINUPD);
2809 tp->snd_wnd = tiwin;
2810 tp->snd_wl1 = th->th_seq;
2811 tp->snd_wl2 = th->th_ack;
2812 if (tp->snd_wnd > tp->max_sndwnd)
2813 tp->max_sndwnd = tp->snd_wnd;
2814 needoutput = 1;
2815 }
2816
2817 /*
2818 * Process segments with URG.
2819 */
2820 if ((tiflags & TH_URG) && th->th_urp &&
2821 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2822 /*
2823 * This is a kludge, but if we receive and accept
2824 * random urgent pointers, we'll crash in
2825 * soreceive. It's hard to imagine someone
2826 * actually wanting to send this much urgent data.
2827 */
2828 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2829 th->th_urp = 0; /* XXX */
2830 tiflags &= ~TH_URG; /* XXX */
2831 goto dodata; /* XXX */
2832 }
2833 /*
2834 * If this segment advances the known urgent pointer,
2835 * then mark the data stream. This should not happen
2836 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2837 * a FIN has been received from the remote side.
2838 * In these states we ignore the URG.
2839 *
2840 * According to RFC961 (Assigned Protocols),
2841 * the urgent pointer points to the last octet
2842 * of urgent data. We continue, however,
2843 * to consider it to indicate the first octet
2844 * of data past the urgent section as the original
2845 * spec states (in one of two places).
2846 */
2847 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2848 tp->rcv_up = th->th_seq + th->th_urp;
2849 so->so_oobmark = so->so_rcv.sb_cc +
2850 (tp->rcv_up - tp->rcv_nxt) - 1;
2851 if (so->so_oobmark == 0)
2852 so->so_state |= SS_RCVATMARK;
2853 sohasoutofband(so);
2854 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2855 }
2856 /*
2857 * Remove out of band data so doesn't get presented to user.
2858 * This can happen independent of advancing the URG pointer,
2859 * but if two URG's are pending at once, some out-of-band
2860 * data may creep in... ick.
2861 */
2862 if (th->th_urp <= (u_int16_t) tlen
2863 #ifdef SO_OOBINLINE
2864 && (so->so_options & SO_OOBINLINE) == 0
2865 #endif
2866 )
2867 tcp_pulloutofband(so, th, m, hdroptlen);
2868 } else
2869 /*
2870 * If no out of band data is expected,
2871 * pull receive urgent pointer along
2872 * with the receive window.
2873 */
2874 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2875 tp->rcv_up = tp->rcv_nxt;
2876 dodata: /* XXX */
2877
2878 /*
2879 * Process the segment text, merging it into the TCP sequencing queue,
2880 * and arranging for acknowledgement of receipt if necessary.
2881 * This process logically involves adjusting tp->rcv_wnd as data
2882 * is presented to the user (this happens in tcp_usrreq.c,
2883 * case PRU_RCVD). If a FIN has already been received on this
2884 * connection then we just ignore the text.
2885 */
2886 if ((tlen || (tiflags & TH_FIN)) &&
2887 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2888 /*
2889 * Insert segment ti into reassembly queue of tcp with
2890 * control block tp. Return TH_FIN if reassembly now includes
2891 * a segment with FIN. The macro form does the common case
2892 * inline (segment is the next to be received on an
2893 * established connection, and the queue is empty),
2894 * avoiding linkage into and removal from the queue and
2895 * repetition of various conversions.
2896 * Set DELACK for segments received in order, but ack
2897 * immediately when segments are out of order
2898 * (so fast retransmit can work).
2899 */
2900 /* NOTE: this was TCP_REASS() macro, but used only once */
2901 TCP_REASS_LOCK(tp);
2902 if (th->th_seq == tp->rcv_nxt &&
2903 TAILQ_FIRST(&tp->segq) == NULL &&
2904 tp->t_state == TCPS_ESTABLISHED) {
2905 tcp_setup_ack(tp, th);
2906 tp->rcv_nxt += tlen;
2907 tiflags = th->th_flags & TH_FIN;
2908 tcps = TCP_STAT_GETREF();
2909 tcps[TCP_STAT_RCVPACK]++;
2910 tcps[TCP_STAT_RCVBYTE] += tlen;
2911 TCP_STAT_PUTREF();
2912 nd6_hint(tp);
2913 if (so->so_state & SS_CANTRCVMORE)
2914 m_freem(m);
2915 else {
2916 m_adj(m, hdroptlen);
2917 sbappendstream(&(so)->so_rcv, m);
2918 }
2919 TCP_REASS_UNLOCK(tp);
2920 sorwakeup(so);
2921 } else {
2922 m_adj(m, hdroptlen);
2923 tiflags = tcp_reass(tp, th, m, &tlen);
2924 tp->t_flags |= TF_ACKNOW;
2925 }
2926
2927 /*
2928 * Note the amount of data that peer has sent into
2929 * our window, in order to estimate the sender's
2930 * buffer size.
2931 */
2932 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2933 } else {
2934 m_freem(m);
2935 m = NULL;
2936 tiflags &= ~TH_FIN;
2937 }
2938
2939 /*
2940 * If FIN is received ACK the FIN and let the user know
2941 * that the connection is closing. Ignore a FIN received before
2942 * the connection is fully established.
2943 */
2944 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2945 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2946 socantrcvmore(so);
2947 tp->t_flags |= TF_ACKNOW;
2948 tp->rcv_nxt++;
2949 }
2950 switch (tp->t_state) {
2951
2952 /*
2953 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2954 */
2955 case TCPS_ESTABLISHED:
2956 tp->t_state = TCPS_CLOSE_WAIT;
2957 break;
2958
2959 /*
2960 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2961 * enter the CLOSING state.
2962 */
2963 case TCPS_FIN_WAIT_1:
2964 tp->t_state = TCPS_CLOSING;
2965 break;
2966
2967 /*
2968 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2969 * starting the time-wait timer, turning off the other
2970 * standard timers.
2971 */
2972 case TCPS_FIN_WAIT_2:
2973 tp->t_state = TCPS_TIME_WAIT;
2974 tcp_canceltimers(tp);
2975 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2976 soisdisconnected(so);
2977 break;
2978
2979 /*
2980 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2981 */
2982 case TCPS_TIME_WAIT:
2983 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2984 break;
2985 }
2986 }
2987 #ifdef TCP_DEBUG
2988 if (so->so_options & SO_DEBUG)
2989 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2990 #endif
2991
2992 /*
2993 * Return any desired output.
2994 */
2995 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
2996 KERNEL_LOCK(1, NULL);
2997 (void) tcp_output(tp);
2998 KERNEL_UNLOCK_ONE(NULL);
2999 }
3000 if (tcp_saveti)
3001 m_freem(tcp_saveti);
3002
3003 if (tp->t_state == TCPS_TIME_WAIT
3004 && (so->so_state & SS_NOFDREF)
3005 && (tp->t_inpcb || af != AF_INET)
3006 && (tp->t_in6pcb || af != AF_INET6)
3007 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0
3008 && TAILQ_EMPTY(&tp->segq)
3009 && vtw_add(af, tp)) {
3010 ;
3011 }
3012 return;
3013
3014 badsyn:
3015 /*
3016 * Received a bad SYN. Increment counters and dropwithreset.
3017 */
3018 TCP_STATINC(TCP_STAT_BADSYN);
3019 tp = NULL;
3020 goto dropwithreset;
3021
3022 dropafterack:
3023 /*
3024 * Generate an ACK dropping incoming segment if it occupies
3025 * sequence space, where the ACK reflects our state.
3026 */
3027 if (tiflags & TH_RST)
3028 goto drop;
3029 goto dropafterack2;
3030
3031 dropafterack_ratelim:
3032 /*
3033 * We may want to rate-limit ACKs against SYN/RST attack.
3034 */
3035 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
3036 tcp_ackdrop_ppslim) == 0) {
3037 /* XXX stat */
3038 goto drop;
3039 }
3040 /* ...fall into dropafterack2... */
3041
3042 dropafterack2:
3043 m_freem(m);
3044 tp->t_flags |= TF_ACKNOW;
3045 KERNEL_LOCK(1, NULL);
3046 (void) tcp_output(tp);
3047 KERNEL_UNLOCK_ONE(NULL);
3048 if (tcp_saveti)
3049 m_freem(tcp_saveti);
3050 return;
3051
3052 dropwithreset_ratelim:
3053 /*
3054 * We may want to rate-limit RSTs in certain situations,
3055 * particularly if we are sending an RST in response to
3056 * an attempt to connect to or otherwise communicate with
3057 * a port for which we have no socket.
3058 */
3059 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
3060 tcp_rst_ppslim) == 0) {
3061 /* XXX stat */
3062 goto drop;
3063 }
3064 /* ...fall into dropwithreset... */
3065
3066 dropwithreset:
3067 /*
3068 * Generate a RST, dropping incoming segment.
3069 * Make ACK acceptable to originator of segment.
3070 */
3071 if (tiflags & TH_RST)
3072 goto drop;
3073
3074 switch (af) {
3075 #ifdef INET6
3076 case AF_INET6:
3077 /* For following calls to tcp_respond */
3078 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
3079 goto drop;
3080 break;
3081 #endif /* INET6 */
3082 case AF_INET:
3083 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
3084 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
3085 goto drop;
3086 }
3087
3088 if (tiflags & TH_ACK)
3089 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
3090 else {
3091 if (tiflags & TH_SYN)
3092 tlen++;
3093 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
3094 TH_RST|TH_ACK);
3095 }
3096 if (tcp_saveti)
3097 m_freem(tcp_saveti);
3098 return;
3099
3100 badcsum:
3101 drop:
3102 /*
3103 * Drop space held by incoming segment and return.
3104 */
3105 if (tp) {
3106 if (tp->t_inpcb)
3107 so = tp->t_inpcb->inp_socket;
3108 #ifdef INET6
3109 else if (tp->t_in6pcb)
3110 so = tp->t_in6pcb->in6p_socket;
3111 #endif
3112 else
3113 so = NULL;
3114 #ifdef TCP_DEBUG
3115 if (so && (so->so_options & SO_DEBUG) != 0)
3116 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
3117 #endif
3118 }
3119 if (tcp_saveti)
3120 m_freem(tcp_saveti);
3121 m_freem(m);
3122 return;
3123 }
3124
3125 #ifdef TCP_SIGNATURE
3126 int
3127 tcp_signature_apply(void *fstate, void *data, u_int len)
3128 {
3129
3130 MD5Update(fstate, (u_char *)data, len);
3131 return (0);
3132 }
3133
3134 struct secasvar *
3135 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th)
3136 {
3137 struct secasvar *sav;
3138 #ifdef FAST_IPSEC
3139 union sockaddr_union dst;
3140 #endif
3141 struct ip *ip;
3142 struct ip6_hdr *ip6;
3143
3144 ip = mtod(m, struct ip *);
3145 switch (ip->ip_v) {
3146 case 4:
3147 ip = mtod(m, struct ip *);
3148 ip6 = NULL;
3149 break;
3150 case 6:
3151 ip = NULL;
3152 ip6 = mtod(m, struct ip6_hdr *);
3153 break;
3154 default:
3155 return (NULL);
3156 }
3157
3158 #ifdef FAST_IPSEC
3159 /* Extract the destination from the IP header in the mbuf. */
3160 memset(&dst, 0, sizeof(union sockaddr_union));
3161 if (ip !=NULL) {
3162 dst.sa.sa_len = sizeof(struct sockaddr_in);
3163 dst.sa.sa_family = AF_INET;
3164 dst.sin.sin_addr = ip->ip_dst;
3165 } else {
3166 dst.sa.sa_len = sizeof(struct sockaddr_in6);
3167 dst.sa.sa_family = AF_INET6;
3168 dst.sin6.sin6_addr = ip6->ip6_dst;
3169 }
3170
3171 /*
3172 * Look up an SADB entry which matches the address of the peer.
3173 */
3174 sav = KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0);
3175 #else
3176 if (ip)
3177 sav = key_allocsa(AF_INET, (void *)&ip->ip_src,
3178 (void *)&ip->ip_dst, IPPROTO_TCP,
3179 htonl(TCP_SIG_SPI), 0, 0);
3180 else
3181 sav = key_allocsa(AF_INET6, (void *)&ip6->ip6_src,
3182 (void *)&ip6->ip6_dst, IPPROTO_TCP,
3183 htonl(TCP_SIG_SPI), 0, 0);
3184 #endif
3185
3186 return (sav); /* freesav must be performed by caller */
3187 }
3188
3189 int
3190 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
3191 struct secasvar *sav, char *sig)
3192 {
3193 MD5_CTX ctx;
3194 struct ip *ip;
3195 struct ipovly *ipovly;
3196 struct ip6_hdr *ip6;
3197 struct ippseudo ippseudo;
3198 struct ip6_hdr_pseudo ip6pseudo;
3199 struct tcphdr th0;
3200 int l, tcphdrlen;
3201
3202 if (sav == NULL)
3203 return (-1);
3204
3205 tcphdrlen = th->th_off * 4;
3206
3207 switch (mtod(m, struct ip *)->ip_v) {
3208 case 4:
3209 ip = mtod(m, struct ip *);
3210 ip6 = NULL;
3211 break;
3212 case 6:
3213 ip = NULL;
3214 ip6 = mtod(m, struct ip6_hdr *);
3215 break;
3216 default:
3217 return (-1);
3218 }
3219
3220 MD5Init(&ctx);
3221
3222 if (ip) {
3223 memset(&ippseudo, 0, sizeof(ippseudo));
3224 ipovly = (struct ipovly *)ip;
3225 ippseudo.ippseudo_src = ipovly->ih_src;
3226 ippseudo.ippseudo_dst = ipovly->ih_dst;
3227 ippseudo.ippseudo_pad = 0;
3228 ippseudo.ippseudo_p = IPPROTO_TCP;
3229 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
3230 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
3231 } else {
3232 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
3233 ip6pseudo.ip6ph_src = ip6->ip6_src;
3234 in6_clearscope(&ip6pseudo.ip6ph_src);
3235 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
3236 in6_clearscope(&ip6pseudo.ip6ph_dst);
3237 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
3238 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
3239 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
3240 }
3241
3242 th0 = *th;
3243 th0.th_sum = 0;
3244 MD5Update(&ctx, (char *)&th0, sizeof(th0));
3245
3246 l = m->m_pkthdr.len - thoff - tcphdrlen;
3247 if (l > 0)
3248 m_apply(m, thoff + tcphdrlen,
3249 m->m_pkthdr.len - thoff - tcphdrlen,
3250 tcp_signature_apply, &ctx);
3251
3252 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
3253 MD5Final(sig, &ctx);
3254
3255 return (0);
3256 }
3257 #endif
3258
3259 /*
3260 * tcp_dooptions: parse and process tcp options.
3261 *
3262 * returns -1 if this segment should be dropped. (eg. wrong signature)
3263 * otherwise returns 0.
3264 */
3265
3266 static int
3267 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt,
3268 struct tcphdr *th,
3269 struct mbuf *m, int toff, struct tcp_opt_info *oi)
3270 {
3271 u_int16_t mss;
3272 int opt, optlen = 0;
3273 #ifdef TCP_SIGNATURE
3274 void *sigp = NULL;
3275 char sigbuf[TCP_SIGLEN];
3276 struct secasvar *sav = NULL;
3277 #endif
3278
3279 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
3280 opt = cp[0];
3281 if (opt == TCPOPT_EOL)
3282 break;
3283 if (opt == TCPOPT_NOP)
3284 optlen = 1;
3285 else {
3286 if (cnt < 2)
3287 break;
3288 optlen = cp[1];
3289 if (optlen < 2 || optlen > cnt)
3290 break;
3291 }
3292 switch (opt) {
3293
3294 default:
3295 continue;
3296
3297 case TCPOPT_MAXSEG:
3298 if (optlen != TCPOLEN_MAXSEG)
3299 continue;
3300 if (!(th->th_flags & TH_SYN))
3301 continue;
3302 if (TCPS_HAVERCVDSYN(tp->t_state))
3303 continue;
3304 bcopy(cp + 2, &mss, sizeof(mss));
3305 oi->maxseg = ntohs(mss);
3306 break;
3307
3308 case TCPOPT_WINDOW:
3309 if (optlen != TCPOLEN_WINDOW)
3310 continue;
3311 if (!(th->th_flags & TH_SYN))
3312 continue;
3313 if (TCPS_HAVERCVDSYN(tp->t_state))
3314 continue;
3315 tp->t_flags |= TF_RCVD_SCALE;
3316 tp->requested_s_scale = cp[2];
3317 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3318 #if 0 /*XXX*/
3319 char *p;
3320
3321 if (ip)
3322 p = ntohl(ip->ip_src);
3323 #ifdef INET6
3324 else if (ip6)
3325 p = ip6_sprintf(&ip6->ip6_src);
3326 #endif
3327 else
3328 p = "(unknown)";
3329 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3330 "assuming %d\n",
3331 tp->requested_s_scale, p,
3332 TCP_MAX_WINSHIFT);
3333 #else
3334 log(LOG_ERR, "TCP: invalid wscale %d, "
3335 "assuming %d\n",
3336 tp->requested_s_scale,
3337 TCP_MAX_WINSHIFT);
3338 #endif
3339 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3340 }
3341 break;
3342
3343 case TCPOPT_TIMESTAMP:
3344 if (optlen != TCPOLEN_TIMESTAMP)
3345 continue;
3346 oi->ts_present = 1;
3347 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
3348 NTOHL(oi->ts_val);
3349 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
3350 NTOHL(oi->ts_ecr);
3351
3352 if (!(th->th_flags & TH_SYN))
3353 continue;
3354 if (TCPS_HAVERCVDSYN(tp->t_state))
3355 continue;
3356 /*
3357 * A timestamp received in a SYN makes
3358 * it ok to send timestamp requests and replies.
3359 */
3360 tp->t_flags |= TF_RCVD_TSTMP;
3361 tp->ts_recent = oi->ts_val;
3362 tp->ts_recent_age = tcp_now;
3363 break;
3364
3365 case TCPOPT_SACK_PERMITTED:
3366 if (optlen != TCPOLEN_SACK_PERMITTED)
3367 continue;
3368 if (!(th->th_flags & TH_SYN))
3369 continue;
3370 if (TCPS_HAVERCVDSYN(tp->t_state))
3371 continue;
3372 if (tcp_do_sack) {
3373 tp->t_flags |= TF_SACK_PERMIT;
3374 tp->t_flags |= TF_WILL_SACK;
3375 }
3376 break;
3377
3378 case TCPOPT_SACK:
3379 tcp_sack_option(tp, th, cp, optlen);
3380 break;
3381 #ifdef TCP_SIGNATURE
3382 case TCPOPT_SIGNATURE:
3383 if (optlen != TCPOLEN_SIGNATURE)
3384 continue;
3385 if (sigp && memcmp(sigp, cp + 2, TCP_SIGLEN))
3386 return (-1);
3387
3388 sigp = sigbuf;
3389 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3390 tp->t_flags |= TF_SIGNATURE;
3391 break;
3392 #endif
3393 }
3394 }
3395
3396 #ifdef TCP_SIGNATURE
3397 if (tp->t_flags & TF_SIGNATURE) {
3398
3399 sav = tcp_signature_getsav(m, th);
3400
3401 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3402 return (-1);
3403 }
3404
3405 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) {
3406 if (sav == NULL)
3407 return (-1);
3408 #ifdef FAST_IPSEC
3409 KEY_FREESAV(&sav);
3410 #else
3411 key_freesav(sav);
3412 #endif
3413 return (-1);
3414 }
3415
3416 if (sigp) {
3417 char sig[TCP_SIGLEN];
3418
3419 tcp_fields_to_net(th);
3420 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3421 tcp_fields_to_host(th);
3422 if (sav == NULL)
3423 return (-1);
3424 #ifdef FAST_IPSEC
3425 KEY_FREESAV(&sav);
3426 #else
3427 key_freesav(sav);
3428 #endif
3429 return (-1);
3430 }
3431 tcp_fields_to_host(th);
3432
3433 if (memcmp(sig, sigp, TCP_SIGLEN)) {
3434 TCP_STATINC(TCP_STAT_BADSIG);
3435 if (sav == NULL)
3436 return (-1);
3437 #ifdef FAST_IPSEC
3438 KEY_FREESAV(&sav);
3439 #else
3440 key_freesav(sav);
3441 #endif
3442 return (-1);
3443 } else
3444 TCP_STATINC(TCP_STAT_GOODSIG);
3445
3446 key_sa_recordxfer(sav, m);
3447 #ifdef FAST_IPSEC
3448 KEY_FREESAV(&sav);
3449 #else
3450 key_freesav(sav);
3451 #endif
3452 }
3453 #endif
3454
3455 return (0);
3456 }
3457
3458 /*
3459 * Pull out of band byte out of a segment so
3460 * it doesn't appear in the user's data queue.
3461 * It is still reflected in the segment length for
3462 * sequencing purposes.
3463 */
3464 void
3465 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3466 struct mbuf *m, int off)
3467 {
3468 int cnt = off + th->th_urp - 1;
3469
3470 while (cnt >= 0) {
3471 if (m->m_len > cnt) {
3472 char *cp = mtod(m, char *) + cnt;
3473 struct tcpcb *tp = sototcpcb(so);
3474
3475 tp->t_iobc = *cp;
3476 tp->t_oobflags |= TCPOOB_HAVEDATA;
3477 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3478 m->m_len--;
3479 return;
3480 }
3481 cnt -= m->m_len;
3482 m = m->m_next;
3483 if (m == 0)
3484 break;
3485 }
3486 panic("tcp_pulloutofband");
3487 }
3488
3489 /*
3490 * Collect new round-trip time estimate
3491 * and update averages and current timeout.
3492 *
3493 * rtt is in units of slow ticks (typically 500 ms) -- essentially the
3494 * difference of two timestamps.
3495 */
3496 void
3497 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3498 {
3499 int32_t delta;
3500
3501 TCP_STATINC(TCP_STAT_RTTUPDATED);
3502 if (tp->t_srtt != 0) {
3503 /*
3504 * Compute the amount to add to srtt for smoothing,
3505 * *alpha, or 2^(-TCP_RTT_SHIFT). Because
3506 * srtt is stored in 1/32 slow ticks, we conceptually
3507 * shift left 5 bits, subtract srtt to get the
3508 * diference, and then shift right by TCP_RTT_SHIFT
3509 * (3) to obtain 1/8 of the difference.
3510 */
3511 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3512 /*
3513 * This can never happen, because delta's lowest
3514 * possible value is 1/8 of t_srtt. But if it does,
3515 * set srtt to some reasonable value, here chosen
3516 * as 1/8 tick.
3517 */
3518 if ((tp->t_srtt += delta) <= 0)
3519 tp->t_srtt = 1 << 2;
3520 /*
3521 * RFC2988 requires that rttvar be updated first.
3522 * This code is compliant because "delta" is the old
3523 * srtt minus the new observation (scaled).
3524 *
3525 * RFC2988 says:
3526 * rttvar = (1-beta) * rttvar + beta * |srtt-observed|
3527 *
3528 * delta is in units of 1/32 ticks, and has then been
3529 * divided by 8. This is equivalent to being in 1/16s
3530 * units and divided by 4. Subtract from it 1/4 of
3531 * the existing rttvar to form the (signed) amount to
3532 * adjust.
3533 */
3534 if (delta < 0)
3535 delta = -delta;
3536 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3537 /*
3538 * As with srtt, this should never happen. There is
3539 * no support in RFC2988 for this operation. But 1/4s
3540 * as rttvar when faced with something arguably wrong
3541 * is ok.
3542 */
3543 if ((tp->t_rttvar += delta) <= 0)
3544 tp->t_rttvar = 1 << 2;
3545
3546 /*
3547 * If srtt exceeds .01 second, ensure we use the 'remote' MSL
3548 * Problem is: it doesn't work. Disabled by defaulting
3549 * tcp_rttlocal to 0; see corresponding code in
3550 * tcp_subr that selects local vs remote in a different way.
3551 *
3552 * The static branch prediction hint here should be removed
3553 * when the rtt estimator is fixed and the rtt_enable code
3554 * is turned back on.
3555 */
3556 if (__predict_false(tcp_rttlocal) && tcp_msl_enable
3557 && tp->t_srtt > tcp_msl_remote_threshold
3558 && tp->t_msl < tcp_msl_remote) {
3559 tp->t_msl = tcp_msl_remote;
3560 }
3561 } else {
3562 /*
3563 * This is the first measurement. Per RFC2988, 2.2,
3564 * set rtt=R and srtt=R/2.
3565 * For srtt, storage representation is 1/32 ticks,
3566 * so shift left by 5.
3567 * For rttvar, storage representation is 1/16 ticks,
3568 * So shift left by 4, but then right by 1 to halve.
3569 */
3570 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3571 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3572 }
3573 tp->t_rtttime = 0;
3574 tp->t_rxtshift = 0;
3575
3576 /*
3577 * the retransmit should happen at rtt + 4 * rttvar.
3578 * Because of the way we do the smoothing, srtt and rttvar
3579 * will each average +1/2 tick of bias. When we compute
3580 * the retransmit timer, we want 1/2 tick of rounding and
3581 * 1 extra tick because of +-1/2 tick uncertainty in the
3582 * firing of the timer. The bias will give us exactly the
3583 * 1.5 tick we need. But, because the bias is
3584 * statistical, we have to test that we don't drop below
3585 * the minimum feasible timer (which is 2 ticks).
3586 */
3587 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3588 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3589
3590 /*
3591 * We received an ack for a packet that wasn't retransmitted;
3592 * it is probably safe to discard any error indications we've
3593 * received recently. This isn't quite right, but close enough
3594 * for now (a route might have failed after we sent a segment,
3595 * and the return path might not be symmetrical).
3596 */
3597 tp->t_softerror = 0;
3598 }
3599
3600
3601 /*
3602 * TCP compressed state engine. Currently used to hold compressed
3603 * state for SYN_RECEIVED.
3604 */
3605
3606 u_long syn_cache_count;
3607 u_int32_t syn_hash1, syn_hash2;
3608
3609 #define SYN_HASH(sa, sp, dp) \
3610 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
3611 ((u_int32_t)(sp)))^syn_hash2)))
3612 #ifndef INET6
3613 #define SYN_HASHALL(hash, src, dst) \
3614 do { \
3615 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3616 ((const struct sockaddr_in *)(src))->sin_port, \
3617 ((const struct sockaddr_in *)(dst))->sin_port); \
3618 } while (/*CONSTCOND*/ 0)
3619 #else
3620 #define SYN_HASH6(sa, sp, dp) \
3621 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
3622 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
3623 & 0x7fffffff)
3624
3625 #define SYN_HASHALL(hash, src, dst) \
3626 do { \
3627 switch ((src)->sa_family) { \
3628 case AF_INET: \
3629 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3630 ((const struct sockaddr_in *)(src))->sin_port, \
3631 ((const struct sockaddr_in *)(dst))->sin_port); \
3632 break; \
3633 case AF_INET6: \
3634 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \
3635 ((const struct sockaddr_in6 *)(src))->sin6_port, \
3636 ((const struct sockaddr_in6 *)(dst))->sin6_port); \
3637 break; \
3638 default: \
3639 hash = 0; \
3640 } \
3641 } while (/*CONSTCOND*/0)
3642 #endif /* INET6 */
3643
3644 static struct pool syn_cache_pool;
3645
3646 /*
3647 * We don't estimate RTT with SYNs, so each packet starts with the default
3648 * RTT and each timer step has a fixed timeout value.
3649 */
3650 #define SYN_CACHE_TIMER_ARM(sc) \
3651 do { \
3652 TCPT_RANGESET((sc)->sc_rxtcur, \
3653 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
3654 TCPTV_REXMTMAX); \
3655 callout_reset(&(sc)->sc_timer, \
3656 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
3657 } while (/*CONSTCOND*/0)
3658
3659 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
3660
3661 static inline void
3662 syn_cache_rm(struct syn_cache *sc)
3663 {
3664 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket,
3665 sc, sc_bucketq);
3666 sc->sc_tp = NULL;
3667 LIST_REMOVE(sc, sc_tpq);
3668 tcp_syn_cache[sc->sc_bucketidx].sch_length--;
3669 callout_stop(&sc->sc_timer);
3670 syn_cache_count--;
3671 }
3672
3673 static inline void
3674 syn_cache_put(struct syn_cache *sc)
3675 {
3676 if (sc->sc_ipopts)
3677 (void) m_free(sc->sc_ipopts);
3678 rtcache_free(&sc->sc_route);
3679 sc->sc_flags |= SCF_DEAD;
3680 if (!callout_invoking(&sc->sc_timer))
3681 callout_schedule(&(sc)->sc_timer, 1);
3682 }
3683
3684 void
3685 syn_cache_init(void)
3686 {
3687 int i;
3688
3689 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0,
3690 "synpl", NULL, IPL_SOFTNET);
3691
3692 /* Initialize the hash buckets. */
3693 for (i = 0; i < tcp_syn_cache_size; i++)
3694 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
3695 }
3696
3697 void
3698 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
3699 {
3700 struct syn_cache_head *scp;
3701 struct syn_cache *sc2;
3702 int s;
3703
3704 /*
3705 * If there are no entries in the hash table, reinitialize
3706 * the hash secrets.
3707 */
3708 if (syn_cache_count == 0) {
3709 syn_hash1 = cprng_fast32();
3710 syn_hash2 = cprng_fast32();
3711 }
3712
3713 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
3714 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
3715 scp = &tcp_syn_cache[sc->sc_bucketidx];
3716
3717 /*
3718 * Make sure that we don't overflow the per-bucket
3719 * limit or the total cache size limit.
3720 */
3721 s = splsoftnet();
3722 if (scp->sch_length >= tcp_syn_bucket_limit) {
3723 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW);
3724 /*
3725 * The bucket is full. Toss the oldest element in the
3726 * bucket. This will be the first entry in the bucket.
3727 */
3728 sc2 = TAILQ_FIRST(&scp->sch_bucket);
3729 #ifdef DIAGNOSTIC
3730 /*
3731 * This should never happen; we should always find an
3732 * entry in our bucket.
3733 */
3734 if (sc2 == NULL)
3735 panic("syn_cache_insert: bucketoverflow: impossible");
3736 #endif
3737 syn_cache_rm(sc2);
3738 syn_cache_put(sc2); /* calls pool_put but see spl above */
3739 } else if (syn_cache_count >= tcp_syn_cache_limit) {
3740 struct syn_cache_head *scp2, *sce;
3741
3742 TCP_STATINC(TCP_STAT_SC_OVERFLOWED);
3743 /*
3744 * The cache is full. Toss the oldest entry in the
3745 * first non-empty bucket we can find.
3746 *
3747 * XXX We would really like to toss the oldest
3748 * entry in the cache, but we hope that this
3749 * condition doesn't happen very often.
3750 */
3751 scp2 = scp;
3752 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
3753 sce = &tcp_syn_cache[tcp_syn_cache_size];
3754 for (++scp2; scp2 != scp; scp2++) {
3755 if (scp2 >= sce)
3756 scp2 = &tcp_syn_cache[0];
3757 if (! TAILQ_EMPTY(&scp2->sch_bucket))
3758 break;
3759 }
3760 #ifdef DIAGNOSTIC
3761 /*
3762 * This should never happen; we should always find a
3763 * non-empty bucket.
3764 */
3765 if (scp2 == scp)
3766 panic("syn_cache_insert: cacheoverflow: "
3767 "impossible");
3768 #endif
3769 }
3770 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
3771 syn_cache_rm(sc2);
3772 syn_cache_put(sc2); /* calls pool_put but see spl above */
3773 }
3774
3775 /*
3776 * Initialize the entry's timer.
3777 */
3778 sc->sc_rxttot = 0;
3779 sc->sc_rxtshift = 0;
3780 SYN_CACHE_TIMER_ARM(sc);
3781
3782 /* Link it from tcpcb entry */
3783 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
3784
3785 /* Put it into the bucket. */
3786 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
3787 scp->sch_length++;
3788 syn_cache_count++;
3789
3790 TCP_STATINC(TCP_STAT_SC_ADDED);
3791 splx(s);
3792 }
3793
3794 /*
3795 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
3796 * If we have retransmitted an entry the maximum number of times, expire
3797 * that entry.
3798 */
3799 void
3800 syn_cache_timer(void *arg)
3801 {
3802 struct syn_cache *sc = arg;
3803
3804 mutex_enter(softnet_lock);
3805 KERNEL_LOCK(1, NULL);
3806 callout_ack(&sc->sc_timer);
3807
3808 if (__predict_false(sc->sc_flags & SCF_DEAD)) {
3809 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE);
3810 callout_destroy(&sc->sc_timer);
3811 pool_put(&syn_cache_pool, sc);
3812 KERNEL_UNLOCK_ONE(NULL);
3813 mutex_exit(softnet_lock);
3814 return;
3815 }
3816
3817 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3818 /* Drop it -- too many retransmissions. */
3819 goto dropit;
3820 }
3821
3822 /*
3823 * Compute the total amount of time this entry has
3824 * been on a queue. If this entry has been on longer
3825 * than the keep alive timer would allow, expire it.
3826 */
3827 sc->sc_rxttot += sc->sc_rxtcur;
3828 if (sc->sc_rxttot >= tcp_keepinit)
3829 goto dropit;
3830
3831 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED);
3832 (void) syn_cache_respond(sc, NULL);
3833
3834 /* Advance the timer back-off. */
3835 sc->sc_rxtshift++;
3836 SYN_CACHE_TIMER_ARM(sc);
3837
3838 KERNEL_UNLOCK_ONE(NULL);
3839 mutex_exit(softnet_lock);
3840 return;
3841
3842 dropit:
3843 TCP_STATINC(TCP_STAT_SC_TIMED_OUT);
3844 syn_cache_rm(sc);
3845 if (sc->sc_ipopts)
3846 (void) m_free(sc->sc_ipopts);
3847 rtcache_free(&sc->sc_route);
3848 callout_destroy(&sc->sc_timer);
3849 pool_put(&syn_cache_pool, sc);
3850 KERNEL_UNLOCK_ONE(NULL);
3851 mutex_exit(softnet_lock);
3852 }
3853
3854 /*
3855 * Remove syn cache created by the specified tcb entry,
3856 * because this does not make sense to keep them
3857 * (if there's no tcb entry, syn cache entry will never be used)
3858 */
3859 void
3860 syn_cache_cleanup(struct tcpcb *tp)
3861 {
3862 struct syn_cache *sc, *nsc;
3863 int s;
3864
3865 s = splsoftnet();
3866
3867 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3868 nsc = LIST_NEXT(sc, sc_tpq);
3869
3870 #ifdef DIAGNOSTIC
3871 if (sc->sc_tp != tp)
3872 panic("invalid sc_tp in syn_cache_cleanup");
3873 #endif
3874 syn_cache_rm(sc);
3875 syn_cache_put(sc); /* calls pool_put but see spl above */
3876 }
3877 /* just for safety */
3878 LIST_INIT(&tp->t_sc);
3879
3880 splx(s);
3881 }
3882
3883 /*
3884 * Find an entry in the syn cache.
3885 */
3886 struct syn_cache *
3887 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
3888 struct syn_cache_head **headp)
3889 {
3890 struct syn_cache *sc;
3891 struct syn_cache_head *scp;
3892 u_int32_t hash;
3893 int s;
3894
3895 SYN_HASHALL(hash, src, dst);
3896
3897 scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3898 *headp = scp;
3899 s = splsoftnet();
3900 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3901 sc = TAILQ_NEXT(sc, sc_bucketq)) {
3902 if (sc->sc_hash != hash)
3903 continue;
3904 if (!memcmp(&sc->sc_src, src, src->sa_len) &&
3905 !memcmp(&sc->sc_dst, dst, dst->sa_len)) {
3906 splx(s);
3907 return (sc);
3908 }
3909 }
3910 splx(s);
3911 return (NULL);
3912 }
3913
3914 /*
3915 * This function gets called when we receive an ACK for a
3916 * socket in the LISTEN state. We look up the connection
3917 * in the syn cache, and if its there, we pull it out of
3918 * the cache and turn it into a full-blown connection in
3919 * the SYN-RECEIVED state.
3920 *
3921 * The return values may not be immediately obvious, and their effects
3922 * can be subtle, so here they are:
3923 *
3924 * NULL SYN was not found in cache; caller should drop the
3925 * packet and send an RST.
3926 *
3927 * -1 We were unable to create the new connection, and are
3928 * aborting it. An ACK,RST is being sent to the peer
3929 * (unless we got screwey sequence numbners; see below),
3930 * because the 3-way handshake has been completed. Caller
3931 * should not free the mbuf, since we may be using it. If
3932 * we are not, we will free it.
3933 *
3934 * Otherwise, the return value is a pointer to the new socket
3935 * associated with the connection.
3936 */
3937 struct socket *
3938 syn_cache_get(struct sockaddr *src, struct sockaddr *dst,
3939 struct tcphdr *th, unsigned int hlen, unsigned int tlen,
3940 struct socket *so, struct mbuf *m)
3941 {
3942 struct syn_cache *sc;
3943 struct syn_cache_head *scp;
3944 struct inpcb *inp = NULL;
3945 #ifdef INET6
3946 struct in6pcb *in6p = NULL;
3947 #endif
3948 struct tcpcb *tp = 0;
3949 struct mbuf *am;
3950 int s;
3951 struct socket *oso;
3952
3953 s = splsoftnet();
3954 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3955 splx(s);
3956 return (NULL);
3957 }
3958
3959 /*
3960 * Verify the sequence and ack numbers. Try getting the correct
3961 * response again.
3962 */
3963 if ((th->th_ack != sc->sc_iss + 1) ||
3964 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3965 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3966 (void) syn_cache_respond(sc, m);
3967 splx(s);
3968 return ((struct socket *)(-1));
3969 }
3970
3971 /* Remove this cache entry */
3972 syn_cache_rm(sc);
3973 splx(s);
3974
3975 /*
3976 * Ok, create the full blown connection, and set things up
3977 * as they would have been set up if we had created the
3978 * connection when the SYN arrived. If we can't create
3979 * the connection, abort it.
3980 */
3981 /*
3982 * inp still has the OLD in_pcb stuff, set the
3983 * v6-related flags on the new guy, too. This is
3984 * done particularly for the case where an AF_INET6
3985 * socket is bound only to a port, and a v4 connection
3986 * comes in on that port.
3987 * we also copy the flowinfo from the original pcb
3988 * to the new one.
3989 */
3990 oso = so;
3991 so = sonewconn(so, SS_ISCONNECTED);
3992 if (so == NULL)
3993 goto resetandabort;
3994
3995 switch (so->so_proto->pr_domain->dom_family) {
3996 #ifdef INET
3997 case AF_INET:
3998 inp = sotoinpcb(so);
3999 break;
4000 #endif
4001 #ifdef INET6
4002 case AF_INET6:
4003 in6p = sotoin6pcb(so);
4004 break;
4005 #endif
4006 }
4007 switch (src->sa_family) {
4008 #ifdef INET
4009 case AF_INET:
4010 if (inp) {
4011 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
4012 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
4013 inp->inp_options = ip_srcroute();
4014 in_pcbstate(inp, INP_BOUND);
4015 if (inp->inp_options == NULL) {
4016 inp->inp_options = sc->sc_ipopts;
4017 sc->sc_ipopts = NULL;
4018 }
4019 }
4020 #ifdef INET6
4021 else if (in6p) {
4022 /* IPv4 packet to AF_INET6 socket */
4023 memset(&in6p->in6p_laddr, 0, sizeof(in6p->in6p_laddr));
4024 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
4025 bcopy(&((struct sockaddr_in *)dst)->sin_addr,
4026 &in6p->in6p_laddr.s6_addr32[3],
4027 sizeof(((struct sockaddr_in *)dst)->sin_addr));
4028 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
4029 in6totcpcb(in6p)->t_family = AF_INET;
4030 if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
4031 in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
4032 else
4033 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
4034 in6_pcbstate(in6p, IN6P_BOUND);
4035 }
4036 #endif
4037 break;
4038 #endif
4039 #ifdef INET6
4040 case AF_INET6:
4041 if (in6p) {
4042 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
4043 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
4044 in6_pcbstate(in6p, IN6P_BOUND);
4045 }
4046 break;
4047 #endif
4048 }
4049 #ifdef INET6
4050 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
4051 struct in6pcb *oin6p = sotoin6pcb(oso);
4052 /* inherit socket options from the listening socket */
4053 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
4054 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
4055 m_freem(in6p->in6p_options);
4056 in6p->in6p_options = 0;
4057 }
4058 ip6_savecontrol(in6p, &in6p->in6p_options,
4059 mtod(m, struct ip6_hdr *), m);
4060 }
4061 #endif
4062
4063 #if defined(FAST_IPSEC)
4064 /*
4065 * we make a copy of policy, instead of sharing the policy,
4066 * for better behavior in terms of SA lookup and dead SA removal.
4067 */
4068 if (inp) {
4069 /* copy old policy into new socket's */
4070 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
4071 printf("tcp_input: could not copy policy\n");
4072 }
4073 #ifdef INET6
4074 else if (in6p) {
4075 /* copy old policy into new socket's */
4076 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
4077 in6p->in6p_sp))
4078 printf("tcp_input: could not copy policy\n");
4079 }
4080 #endif
4081 #endif
4082
4083 /*
4084 * Give the new socket our cached route reference.
4085 */
4086 if (inp) {
4087 rtcache_copy(&inp->inp_route, &sc->sc_route);
4088 rtcache_free(&sc->sc_route);
4089 }
4090 #ifdef INET6
4091 else {
4092 rtcache_copy(&in6p->in6p_route, &sc->sc_route);
4093 rtcache_free(&sc->sc_route);
4094 }
4095 #endif
4096
4097 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
4098 if (am == NULL)
4099 goto resetandabort;
4100 MCLAIM(am, &tcp_mowner);
4101 am->m_len = src->sa_len;
4102 bcopy(src, mtod(am, void *), src->sa_len);
4103 if (inp) {
4104 if (in_pcbconnect(inp, am, &lwp0)) {
4105 (void) m_free(am);
4106 goto resetandabort;
4107 }
4108 }
4109 #ifdef INET6
4110 else if (in6p) {
4111 if (src->sa_family == AF_INET) {
4112 /* IPv4 packet to AF_INET6 socket */
4113 struct sockaddr_in6 *sin6;
4114 sin6 = mtod(am, struct sockaddr_in6 *);
4115 am->m_len = sizeof(*sin6);
4116 memset(sin6, 0, sizeof(*sin6));
4117 sin6->sin6_family = AF_INET6;
4118 sin6->sin6_len = sizeof(*sin6);
4119 sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
4120 sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
4121 bcopy(&((struct sockaddr_in *)src)->sin_addr,
4122 &sin6->sin6_addr.s6_addr32[3],
4123 sizeof(sin6->sin6_addr.s6_addr32[3]));
4124 }
4125 if (in6_pcbconnect(in6p, am, NULL)) {
4126 (void) m_free(am);
4127 goto resetandabort;
4128 }
4129 }
4130 #endif
4131 else {
4132 (void) m_free(am);
4133 goto resetandabort;
4134 }
4135 (void) m_free(am);
4136
4137 if (inp)
4138 tp = intotcpcb(inp);
4139 #ifdef INET6
4140 else if (in6p)
4141 tp = in6totcpcb(in6p);
4142 #endif
4143 else
4144 tp = NULL;
4145 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
4146 if (sc->sc_request_r_scale != 15) {
4147 tp->requested_s_scale = sc->sc_requested_s_scale;
4148 tp->request_r_scale = sc->sc_request_r_scale;
4149 tp->snd_scale = sc->sc_requested_s_scale;
4150 tp->rcv_scale = sc->sc_request_r_scale;
4151 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
4152 }
4153 if (sc->sc_flags & SCF_TIMESTAMP)
4154 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
4155 tp->ts_timebase = sc->sc_timebase;
4156
4157 tp->t_template = tcp_template(tp);
4158 if (tp->t_template == 0) {
4159 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
4160 so = NULL;
4161 m_freem(m);
4162 goto abort;
4163 }
4164
4165 tp->iss = sc->sc_iss;
4166 tp->irs = sc->sc_irs;
4167 tcp_sendseqinit(tp);
4168 tcp_rcvseqinit(tp);
4169 tp->t_state = TCPS_SYN_RECEIVED;
4170 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit);
4171 TCP_STATINC(TCP_STAT_ACCEPTS);
4172
4173 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack)
4174 tp->t_flags |= TF_WILL_SACK;
4175
4176 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn)
4177 tp->t_flags |= TF_ECN_PERMIT;
4178
4179 #ifdef TCP_SIGNATURE
4180 if (sc->sc_flags & SCF_SIGNATURE)
4181 tp->t_flags |= TF_SIGNATURE;
4182 #endif
4183
4184 /* Initialize tp->t_ourmss before we deal with the peer's! */
4185 tp->t_ourmss = sc->sc_ourmaxseg;
4186 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
4187
4188 /*
4189 * Initialize the initial congestion window. If we
4190 * had to retransmit the SYN,ACK, we must initialize cwnd
4191 * to 1 segment (i.e. the Loss Window).
4192 */
4193 if (sc->sc_rxtshift)
4194 tp->snd_cwnd = tp->t_peermss;
4195 else {
4196 int ss = tcp_init_win;
4197 #ifdef INET
4198 if (inp != NULL && in_localaddr(inp->inp_faddr))
4199 ss = tcp_init_win_local;
4200 #endif
4201 #ifdef INET6
4202 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
4203 ss = tcp_init_win_local;
4204 #endif
4205 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
4206 }
4207
4208 tcp_rmx_rtt(tp);
4209 tp->snd_wl1 = sc->sc_irs;
4210 tp->rcv_up = sc->sc_irs + 1;
4211
4212 /*
4213 * This is what whould have happened in tcp_output() when
4214 * the SYN,ACK was sent.
4215 */
4216 tp->snd_up = tp->snd_una;
4217 tp->snd_max = tp->snd_nxt = tp->iss+1;
4218 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
4219 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
4220 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
4221 tp->last_ack_sent = tp->rcv_nxt;
4222 tp->t_partialacks = -1;
4223 tp->t_dupacks = 0;
4224
4225 TCP_STATINC(TCP_STAT_SC_COMPLETED);
4226 s = splsoftnet();
4227 syn_cache_put(sc);
4228 splx(s);
4229 return (so);
4230
4231 resetandabort:
4232 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
4233 abort:
4234 if (so != NULL) {
4235 (void) soqremque(so, 1);
4236 (void) soabort(so);
4237 mutex_enter(softnet_lock);
4238 }
4239 s = splsoftnet();
4240 syn_cache_put(sc);
4241 splx(s);
4242 TCP_STATINC(TCP_STAT_SC_ABORTED);
4243 return ((struct socket *)(-1));
4244 }
4245
4246 /*
4247 * This function is called when we get a RST for a
4248 * non-existent connection, so that we can see if the
4249 * connection is in the syn cache. If it is, zap it.
4250 */
4251
4252 void
4253 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th)
4254 {
4255 struct syn_cache *sc;
4256 struct syn_cache_head *scp;
4257 int s = splsoftnet();
4258
4259 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4260 splx(s);
4261 return;
4262 }
4263 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
4264 SEQ_GT(th->th_seq, sc->sc_irs+1)) {
4265 splx(s);
4266 return;
4267 }
4268 syn_cache_rm(sc);
4269 TCP_STATINC(TCP_STAT_SC_RESET);
4270 syn_cache_put(sc); /* calls pool_put but see spl above */
4271 splx(s);
4272 }
4273
4274 void
4275 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
4276 struct tcphdr *th)
4277 {
4278 struct syn_cache *sc;
4279 struct syn_cache_head *scp;
4280 int s;
4281
4282 s = splsoftnet();
4283 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4284 splx(s);
4285 return;
4286 }
4287 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
4288 if (ntohl (th->th_seq) != sc->sc_iss) {
4289 splx(s);
4290 return;
4291 }
4292
4293 /*
4294 * If we've retransmitted 3 times and this is our second error,
4295 * we remove the entry. Otherwise, we allow it to continue on.
4296 * This prevents us from incorrectly nuking an entry during a
4297 * spurious network outage.
4298 *
4299 * See tcp_notify().
4300 */
4301 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
4302 sc->sc_flags |= SCF_UNREACH;
4303 splx(s);
4304 return;
4305 }
4306
4307 syn_cache_rm(sc);
4308 TCP_STATINC(TCP_STAT_SC_UNREACH);
4309 syn_cache_put(sc); /* calls pool_put but see spl above */
4310 splx(s);
4311 }
4312
4313 /*
4314 * Given a LISTEN socket and an inbound SYN request, add
4315 * this to the syn cache, and send back a segment:
4316 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
4317 * to the source.
4318 *
4319 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
4320 * Doing so would require that we hold onto the data and deliver it
4321 * to the application. However, if we are the target of a SYN-flood
4322 * DoS attack, an attacker could send data which would eventually
4323 * consume all available buffer space if it were ACKed. By not ACKing
4324 * the data, we avoid this DoS scenario.
4325 */
4326
4327 int
4328 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
4329 unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp,
4330 int optlen, struct tcp_opt_info *oi)
4331 {
4332 struct tcpcb tb, *tp;
4333 long win;
4334 struct syn_cache *sc;
4335 struct syn_cache_head *scp;
4336 struct mbuf *ipopts;
4337 struct tcp_opt_info opti;
4338 int s;
4339
4340 tp = sototcpcb(so);
4341
4342 memset(&opti, 0, sizeof(opti));
4343
4344 /*
4345 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
4346 *
4347 * Note this check is performed in tcp_input() very early on.
4348 */
4349
4350 /*
4351 * Initialize some local state.
4352 */
4353 win = sbspace(&so->so_rcv);
4354 if (win > TCP_MAXWIN)
4355 win = TCP_MAXWIN;
4356
4357 switch (src->sa_family) {
4358 #ifdef INET
4359 case AF_INET:
4360 /*
4361 * Remember the IP options, if any.
4362 */
4363 ipopts = ip_srcroute();
4364 break;
4365 #endif
4366 default:
4367 ipopts = NULL;
4368 }
4369
4370 #ifdef TCP_SIGNATURE
4371 if (optp || (tp->t_flags & TF_SIGNATURE))
4372 #else
4373 if (optp)
4374 #endif
4375 {
4376 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
4377 #ifdef TCP_SIGNATURE
4378 tb.t_flags |= (tp->t_flags & TF_SIGNATURE);
4379 #endif
4380 tb.t_state = TCPS_LISTEN;
4381 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len -
4382 sizeof(struct tcphdr) - optlen - hlen, oi) < 0)
4383 return (0);
4384 } else
4385 tb.t_flags = 0;
4386
4387 /*
4388 * See if we already have an entry for this connection.
4389 * If we do, resend the SYN,ACK. We do not count this
4390 * as a retransmission (XXX though maybe we should).
4391 */
4392 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
4393 TCP_STATINC(TCP_STAT_SC_DUPESYN);
4394 if (ipopts) {
4395 /*
4396 * If we were remembering a previous source route,
4397 * forget it and use the new one we've been given.
4398 */
4399 if (sc->sc_ipopts)
4400 (void) m_free(sc->sc_ipopts);
4401 sc->sc_ipopts = ipopts;
4402 }
4403 sc->sc_timestamp = tb.ts_recent;
4404 if (syn_cache_respond(sc, m) == 0) {
4405 uint64_t *tcps = TCP_STAT_GETREF();
4406 tcps[TCP_STAT_SNDACKS]++;
4407 tcps[TCP_STAT_SNDTOTAL]++;
4408 TCP_STAT_PUTREF();
4409 }
4410 return (1);
4411 }
4412
4413 s = splsoftnet();
4414 sc = pool_get(&syn_cache_pool, PR_NOWAIT);
4415 splx(s);
4416 if (sc == NULL) {
4417 if (ipopts)
4418 (void) m_free(ipopts);
4419 return (0);
4420 }
4421
4422 /*
4423 * Fill in the cache, and put the necessary IP and TCP
4424 * options into the reply.
4425 */
4426 memset(sc, 0, sizeof(struct syn_cache));
4427 callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
4428 bcopy(src, &sc->sc_src, src->sa_len);
4429 bcopy(dst, &sc->sc_dst, dst->sa_len);
4430 sc->sc_flags = 0;
4431 sc->sc_ipopts = ipopts;
4432 sc->sc_irs = th->th_seq;
4433 switch (src->sa_family) {
4434 #ifdef INET
4435 case AF_INET:
4436 {
4437 struct sockaddr_in *srcin = (void *) src;
4438 struct sockaddr_in *dstin = (void *) dst;
4439
4440 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
4441 &srcin->sin_addr, dstin->sin_port,
4442 srcin->sin_port, sizeof(dstin->sin_addr), 0);
4443 break;
4444 }
4445 #endif /* INET */
4446 #ifdef INET6
4447 case AF_INET6:
4448 {
4449 struct sockaddr_in6 *srcin6 = (void *) src;
4450 struct sockaddr_in6 *dstin6 = (void *) dst;
4451
4452 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
4453 &srcin6->sin6_addr, dstin6->sin6_port,
4454 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
4455 break;
4456 }
4457 #endif /* INET6 */
4458 }
4459 sc->sc_peermaxseg = oi->maxseg;
4460 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
4461 m->m_pkthdr.rcvif : NULL,
4462 sc->sc_src.sa.sa_family);
4463 sc->sc_win = win;
4464 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */
4465 sc->sc_timestamp = tb.ts_recent;
4466 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
4467 (TF_REQ_TSTMP|TF_RCVD_TSTMP))
4468 sc->sc_flags |= SCF_TIMESTAMP;
4469 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
4470 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
4471 sc->sc_requested_s_scale = tb.requested_s_scale;
4472 sc->sc_request_r_scale = 0;
4473 /*
4474 * Pick the smallest possible scaling factor that
4475 * will still allow us to scale up to sb_max.
4476 *
4477 * We do this because there are broken firewalls that
4478 * will corrupt the window scale option, leading to
4479 * the other endpoint believing that our advertised
4480 * window is unscaled. At scale factors larger than
4481 * 5 the unscaled window will drop below 1500 bytes,
4482 * leading to serious problems when traversing these
4483 * broken firewalls.
4484 *
4485 * With the default sbmax of 256K, a scale factor
4486 * of 3 will be chosen by this algorithm. Those who
4487 * choose a larger sbmax should watch out
4488 * for the compatiblity problems mentioned above.
4489 *
4490 * RFC1323: The Window field in a SYN (i.e., a <SYN>
4491 * or <SYN,ACK>) segment itself is never scaled.
4492 */
4493 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
4494 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
4495 sc->sc_request_r_scale++;
4496 } else {
4497 sc->sc_requested_s_scale = 15;
4498 sc->sc_request_r_scale = 15;
4499 }
4500 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack)
4501 sc->sc_flags |= SCF_SACK_PERMIT;
4502
4503 /*
4504 * ECN setup packet recieved.
4505 */
4506 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn)
4507 sc->sc_flags |= SCF_ECN_PERMIT;
4508
4509 #ifdef TCP_SIGNATURE
4510 if (tb.t_flags & TF_SIGNATURE)
4511 sc->sc_flags |= SCF_SIGNATURE;
4512 #endif
4513 sc->sc_tp = tp;
4514 if (syn_cache_respond(sc, m) == 0) {
4515 uint64_t *tcps = TCP_STAT_GETREF();
4516 tcps[TCP_STAT_SNDACKS]++;
4517 tcps[TCP_STAT_SNDTOTAL]++;
4518 TCP_STAT_PUTREF();
4519 syn_cache_insert(sc, tp);
4520 } else {
4521 s = splsoftnet();
4522 /*
4523 * syn_cache_put() will try to schedule the timer, so
4524 * we need to initialize it
4525 */
4526 SYN_CACHE_TIMER_ARM(sc);
4527 syn_cache_put(sc);
4528 splx(s);
4529 TCP_STATINC(TCP_STAT_SC_DROPPED);
4530 }
4531 return (1);
4532 }
4533
4534 /*
4535 * syn_cache_respond: (re)send SYN+ACK.
4536 *
4537 * returns 0 on success. otherwise returns an errno, typically ENOBUFS.
4538 */
4539
4540 int
4541 syn_cache_respond(struct syn_cache *sc, struct mbuf *m)
4542 {
4543 #ifdef INET6
4544 struct rtentry *rt;
4545 #endif
4546 struct route *ro;
4547 u_int8_t *optp;
4548 int optlen, error;
4549 u_int16_t tlen;
4550 struct ip *ip = NULL;
4551 #ifdef INET6
4552 struct ip6_hdr *ip6 = NULL;
4553 #endif
4554 struct tcpcb *tp = NULL;
4555 struct tcphdr *th;
4556 u_int hlen;
4557 struct socket *so;
4558
4559 ro = &sc->sc_route;
4560 switch (sc->sc_src.sa.sa_family) {
4561 case AF_INET:
4562 hlen = sizeof(struct ip);
4563 break;
4564 #ifdef INET6
4565 case AF_INET6:
4566 hlen = sizeof(struct ip6_hdr);
4567 break;
4568 #endif
4569 default:
4570 if (m)
4571 m_freem(m);
4572 return (EAFNOSUPPORT);
4573 }
4574
4575 /* Compute the size of the TCP options. */
4576 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
4577 ((sc->sc_flags & SCF_SACK_PERMIT) ? (TCPOLEN_SACK_PERMITTED + 2) : 0) +
4578 #ifdef TCP_SIGNATURE
4579 ((sc->sc_flags & SCF_SIGNATURE) ? (TCPOLEN_SIGNATURE + 2) : 0) +
4580 #endif
4581 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
4582
4583 tlen = hlen + sizeof(struct tcphdr) + optlen;
4584
4585 /*
4586 * Create the IP+TCP header from scratch.
4587 */
4588 if (m)
4589 m_freem(m);
4590 #ifdef DIAGNOSTIC
4591 if (max_linkhdr + tlen > MCLBYTES)
4592 return (ENOBUFS);
4593 #endif
4594 MGETHDR(m, M_DONTWAIT, MT_DATA);
4595 if (m && (max_linkhdr + tlen) > MHLEN) {
4596 MCLGET(m, M_DONTWAIT);
4597 if ((m->m_flags & M_EXT) == 0) {
4598 m_freem(m);
4599 m = NULL;
4600 }
4601 }
4602 if (m == NULL)
4603 return (ENOBUFS);
4604 MCLAIM(m, &tcp_tx_mowner);
4605
4606 /* Fixup the mbuf. */
4607 m->m_data += max_linkhdr;
4608 m->m_len = m->m_pkthdr.len = tlen;
4609 if (sc->sc_tp) {
4610 tp = sc->sc_tp;
4611 if (tp->t_inpcb)
4612 so = tp->t_inpcb->inp_socket;
4613 #ifdef INET6
4614 else if (tp->t_in6pcb)
4615 so = tp->t_in6pcb->in6p_socket;
4616 #endif
4617 else
4618 so = NULL;
4619 } else
4620 so = NULL;
4621 m->m_pkthdr.rcvif = NULL;
4622 memset(mtod(m, u_char *), 0, tlen);
4623
4624 switch (sc->sc_src.sa.sa_family) {
4625 case AF_INET:
4626 ip = mtod(m, struct ip *);
4627 ip->ip_v = 4;
4628 ip->ip_dst = sc->sc_src.sin.sin_addr;
4629 ip->ip_src = sc->sc_dst.sin.sin_addr;
4630 ip->ip_p = IPPROTO_TCP;
4631 th = (struct tcphdr *)(ip + 1);
4632 th->th_dport = sc->sc_src.sin.sin_port;
4633 th->th_sport = sc->sc_dst.sin.sin_port;
4634 break;
4635 #ifdef INET6
4636 case AF_INET6:
4637 ip6 = mtod(m, struct ip6_hdr *);
4638 ip6->ip6_vfc = IPV6_VERSION;
4639 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
4640 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
4641 ip6->ip6_nxt = IPPROTO_TCP;
4642 /* ip6_plen will be updated in ip6_output() */
4643 th = (struct tcphdr *)(ip6 + 1);
4644 th->th_dport = sc->sc_src.sin6.sin6_port;
4645 th->th_sport = sc->sc_dst.sin6.sin6_port;
4646 break;
4647 #endif
4648 default:
4649 th = NULL;
4650 }
4651
4652 th->th_seq = htonl(sc->sc_iss);
4653 th->th_ack = htonl(sc->sc_irs + 1);
4654 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
4655 th->th_flags = TH_SYN|TH_ACK;
4656 th->th_win = htons(sc->sc_win);
4657 /* th_sum already 0 */
4658 /* th_urp already 0 */
4659
4660 /* Tack on the TCP options. */
4661 optp = (u_int8_t *)(th + 1);
4662 *optp++ = TCPOPT_MAXSEG;
4663 *optp++ = 4;
4664 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
4665 *optp++ = sc->sc_ourmaxseg & 0xff;
4666
4667 if (sc->sc_request_r_scale != 15) {
4668 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
4669 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
4670 sc->sc_request_r_scale);
4671 optp += 4;
4672 }
4673
4674 if (sc->sc_flags & SCF_TIMESTAMP) {
4675 u_int32_t *lp = (u_int32_t *)(optp);
4676 /* Form timestamp option as shown in appendix A of RFC 1323. */
4677 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
4678 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
4679 *lp = htonl(sc->sc_timestamp);
4680 optp += TCPOLEN_TSTAMP_APPA;
4681 }
4682
4683 if (sc->sc_flags & SCF_SACK_PERMIT) {
4684 u_int8_t *p = optp;
4685
4686 /* Let the peer know that we will SACK. */
4687 p[0] = TCPOPT_SACK_PERMITTED;
4688 p[1] = 2;
4689 p[2] = TCPOPT_NOP;
4690 p[3] = TCPOPT_NOP;
4691 optp += 4;
4692 }
4693
4694 /*
4695 * Send ECN SYN-ACK setup packet.
4696 * Routes can be asymetric, so, even if we receive a packet
4697 * with ECE and CWR set, we must not assume no one will block
4698 * the ECE packet we are about to send.
4699 */
4700 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp &&
4701 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) {
4702 th->th_flags |= TH_ECE;
4703 TCP_STATINC(TCP_STAT_ECN_SHS);
4704
4705 /*
4706 * draft-ietf-tcpm-ecnsyn-00.txt
4707 *
4708 * "[...] a TCP node MAY respond to an ECN-setup
4709 * SYN packet by setting ECT in the responding
4710 * ECN-setup SYN/ACK packet, indicating to routers
4711 * that the SYN/ACK packet is ECN-Capable.
4712 * This allows a congested router along the path
4713 * to mark the packet instead of dropping the
4714 * packet as an indication of congestion."
4715 *
4716 * "[...] There can be a great benefit in setting
4717 * an ECN-capable codepoint in SYN/ACK packets [...]
4718 * Congestion is most likely to occur in
4719 * the server-to-client direction. As a result,
4720 * setting an ECN-capable codepoint in SYN/ACK
4721 * packets can reduce the occurence of three-second
4722 * retransmit timeouts resulting from the drop
4723 * of SYN/ACK packets."
4724 *
4725 * Page 4 and 6, January 2006.
4726 */
4727
4728 switch (sc->sc_src.sa.sa_family) {
4729 #ifdef INET
4730 case AF_INET:
4731 ip->ip_tos |= IPTOS_ECN_ECT0;
4732 break;
4733 #endif
4734 #ifdef INET6
4735 case AF_INET6:
4736 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
4737 break;
4738 #endif
4739 }
4740 TCP_STATINC(TCP_STAT_ECN_ECT);
4741 }
4742
4743 #ifdef TCP_SIGNATURE
4744 if (sc->sc_flags & SCF_SIGNATURE) {
4745 struct secasvar *sav;
4746 u_int8_t *sigp;
4747
4748 sav = tcp_signature_getsav(m, th);
4749
4750 if (sav == NULL) {
4751 if (m)
4752 m_freem(m);
4753 return (EPERM);
4754 }
4755
4756 *optp++ = TCPOPT_SIGNATURE;
4757 *optp++ = TCPOLEN_SIGNATURE;
4758 sigp = optp;
4759 memset(optp, 0, TCP_SIGLEN);
4760 optp += TCP_SIGLEN;
4761 *optp++ = TCPOPT_NOP;
4762 *optp++ = TCPOPT_EOL;
4763
4764 (void)tcp_signature(m, th, hlen, sav, sigp);
4765
4766 key_sa_recordxfer(sav, m);
4767 #ifdef FAST_IPSEC
4768 KEY_FREESAV(&sav);
4769 #else
4770 key_freesav(sav);
4771 #endif
4772 }
4773 #endif
4774
4775 /* Compute the packet's checksum. */
4776 switch (sc->sc_src.sa.sa_family) {
4777 case AF_INET:
4778 ip->ip_len = htons(tlen - hlen);
4779 th->th_sum = 0;
4780 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4781 break;
4782 #ifdef INET6
4783 case AF_INET6:
4784 ip6->ip6_plen = htons(tlen - hlen);
4785 th->th_sum = 0;
4786 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4787 break;
4788 #endif
4789 }
4790
4791 /*
4792 * Fill in some straggling IP bits. Note the stack expects
4793 * ip_len to be in host order, for convenience.
4794 */
4795 switch (sc->sc_src.sa.sa_family) {
4796 #ifdef INET
4797 case AF_INET:
4798 ip->ip_len = htons(tlen);
4799 ip->ip_ttl = ip_defttl;
4800 /* XXX tos? */
4801 break;
4802 #endif
4803 #ifdef INET6
4804 case AF_INET6:
4805 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
4806 ip6->ip6_vfc |= IPV6_VERSION;
4807 ip6->ip6_plen = htons(tlen - hlen);
4808 /* ip6_hlim will be initialized afterwards */
4809 /* XXX flowlabel? */
4810 break;
4811 #endif
4812 }
4813
4814 /* XXX use IPsec policy on listening socket, on SYN ACK */
4815 tp = sc->sc_tp;
4816
4817 switch (sc->sc_src.sa.sa_family) {
4818 #ifdef INET
4819 case AF_INET:
4820 error = ip_output(m, sc->sc_ipopts, ro,
4821 (ip_mtudisc ? IP_MTUDISC : 0),
4822 NULL, so);
4823 break;
4824 #endif
4825 #ifdef INET6
4826 case AF_INET6:
4827 ip6->ip6_hlim = in6_selecthlim(NULL,
4828 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
4829 : NULL);
4830
4831 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, so, NULL);
4832 break;
4833 #endif
4834 default:
4835 error = EAFNOSUPPORT;
4836 break;
4837 }
4838 return (error);
4839 }
4840