tcp_input.c revision 1.334 1 /* $NetBSD: tcp_input.c,v 1.334 2014/08/08 03:05:45 rtr Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006,
74 * 2011 The NetBSD Foundation, Inc.
75 * All rights reserved.
76 *
77 * This code is derived from software contributed to The NetBSD Foundation
78 * by Coyote Point Systems, Inc.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
81 * Facility, NASA Ames Research Center.
82 * This code is derived from software contributed to The NetBSD Foundation
83 * by Charles M. Hannum.
84 * This code is derived from software contributed to The NetBSD Foundation
85 * by Rui Paulo.
86 *
87 * Redistribution and use in source and binary forms, with or without
88 * modification, are permitted provided that the following conditions
89 * are met:
90 * 1. Redistributions of source code must retain the above copyright
91 * notice, this list of conditions and the following disclaimer.
92 * 2. Redistributions in binary form must reproduce the above copyright
93 * notice, this list of conditions and the following disclaimer in the
94 * documentation and/or other materials provided with the distribution.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. Neither the name of the University nor the names of its contributors
122 * may be used to endorse or promote products derived from this software
123 * without specific prior written permission.
124 *
125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135 * SUCH DAMAGE.
136 *
137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
138 */
139
140 /*
141 * TODO list for SYN cache stuff:
142 *
143 * Find room for a "state" field, which is needed to keep a
144 * compressed state for TIME_WAIT TCBs. It's been noted already
145 * that this is fairly important for very high-volume web and
146 * mail servers, which use a large number of short-lived
147 * connections.
148 */
149
150 #include <sys/cdefs.h>
151 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.334 2014/08/08 03:05:45 rtr Exp $");
152
153 #include "opt_inet.h"
154 #include "opt_ipsec.h"
155 #include "opt_inet_csum.h"
156 #include "opt_tcp_debug.h"
157
158 #include <sys/param.h>
159 #include <sys/systm.h>
160 #include <sys/malloc.h>
161 #include <sys/mbuf.h>
162 #include <sys/protosw.h>
163 #include <sys/socket.h>
164 #include <sys/socketvar.h>
165 #include <sys/errno.h>
166 #include <sys/syslog.h>
167 #include <sys/pool.h>
168 #include <sys/domain.h>
169 #include <sys/kernel.h>
170 #ifdef TCP_SIGNATURE
171 #include <sys/md5.h>
172 #endif
173 #include <sys/lwp.h> /* for lwp0 */
174 #include <sys/cprng.h>
175
176 #include <net/if.h>
177 #include <net/route.h>
178 #include <net/if_types.h>
179
180 #include <netinet/in.h>
181 #include <netinet/in_systm.h>
182 #include <netinet/ip.h>
183 #include <netinet/in_pcb.h>
184 #include <netinet/in_var.h>
185 #include <netinet/ip_var.h>
186 #include <netinet/in_offload.h>
187
188 #ifdef INET6
189 #ifndef INET
190 #include <netinet/in.h>
191 #endif
192 #include <netinet/ip6.h>
193 #include <netinet6/ip6_var.h>
194 #include <netinet6/in6_pcb.h>
195 #include <netinet6/ip6_var.h>
196 #include <netinet6/in6_var.h>
197 #include <netinet/icmp6.h>
198 #include <netinet6/nd6.h>
199 #ifdef TCP_SIGNATURE
200 #include <netinet6/scope6_var.h>
201 #endif
202 #endif
203
204 #ifndef INET6
205 /* always need ip6.h for IP6_EXTHDR_GET */
206 #include <netinet/ip6.h>
207 #endif
208
209 #include <netinet/tcp.h>
210 #include <netinet/tcp_fsm.h>
211 #include <netinet/tcp_seq.h>
212 #include <netinet/tcp_timer.h>
213 #include <netinet/tcp_var.h>
214 #include <netinet/tcp_private.h>
215 #include <netinet/tcpip.h>
216 #include <netinet/tcp_congctl.h>
217 #include <netinet/tcp_debug.h>
218
219 #ifdef INET6
220 #include "faith.h"
221 #if defined(NFAITH) && NFAITH > 0
222 #include <net/if_faith.h>
223 #endif
224 #endif /* INET6 */
225
226 #ifdef IPSEC
227 #include <netipsec/ipsec.h>
228 #include <netipsec/ipsec_var.h>
229 #include <netipsec/ipsec_private.h>
230 #include <netipsec/key.h>
231 #ifdef INET6
232 #include <netipsec/ipsec6.h>
233 #endif
234 #endif /* IPSEC*/
235
236 #include <netinet/tcp_vtw.h>
237
238 int tcprexmtthresh = 3;
239 int tcp_log_refused;
240
241 int tcp_do_autorcvbuf = 1;
242 int tcp_autorcvbuf_inc = 16 * 1024;
243 int tcp_autorcvbuf_max = 256 * 1024;
244 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
245
246 static int tcp_rst_ppslim_count = 0;
247 static struct timeval tcp_rst_ppslim_last;
248 static int tcp_ackdrop_ppslim_count = 0;
249 static struct timeval tcp_ackdrop_ppslim_last;
250
251 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
252
253 /* for modulo comparisons of timestamps */
254 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
255 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
256
257 /*
258 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
259 */
260 #ifdef INET6
261 static inline void
262 nd6_hint(struct tcpcb *tp)
263 {
264 struct rtentry *rt;
265
266 if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
267 (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
268 nd6_nud_hint(rt, NULL, 0);
269 }
270 #else
271 static inline void
272 nd6_hint(struct tcpcb *tp)
273 {
274 }
275 #endif
276
277 /*
278 * Compute ACK transmission behavior. Delay the ACK unless
279 * we have already delayed an ACK (must send an ACK every two segments).
280 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
281 * option is enabled.
282 */
283 static void
284 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
285 {
286
287 if (tp->t_flags & TF_DELACK ||
288 (tcp_ack_on_push && th->th_flags & TH_PUSH))
289 tp->t_flags |= TF_ACKNOW;
290 else
291 TCP_SET_DELACK(tp);
292 }
293
294 static void
295 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
296 {
297
298 /*
299 * If we had a pending ICMP message that refers to data that have
300 * just been acknowledged, disregard the recorded ICMP message.
301 */
302 if ((tp->t_flags & TF_PMTUD_PEND) &&
303 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
304 tp->t_flags &= ~TF_PMTUD_PEND;
305
306 /*
307 * Keep track of the largest chunk of data
308 * acknowledged since last PMTU update
309 */
310 if (tp->t_pmtud_mss_acked < acked)
311 tp->t_pmtud_mss_acked = acked;
312 }
313
314 /*
315 * Convert TCP protocol fields to host order for easier processing.
316 */
317 static void
318 tcp_fields_to_host(struct tcphdr *th)
319 {
320
321 NTOHL(th->th_seq);
322 NTOHL(th->th_ack);
323 NTOHS(th->th_win);
324 NTOHS(th->th_urp);
325 }
326
327 /*
328 * ... and reverse the above.
329 */
330 static void
331 tcp_fields_to_net(struct tcphdr *th)
332 {
333
334 HTONL(th->th_seq);
335 HTONL(th->th_ack);
336 HTONS(th->th_win);
337 HTONS(th->th_urp);
338 }
339
340 #ifdef TCP_CSUM_COUNTERS
341 #include <sys/device.h>
342
343 #if defined(INET)
344 extern struct evcnt tcp_hwcsum_ok;
345 extern struct evcnt tcp_hwcsum_bad;
346 extern struct evcnt tcp_hwcsum_data;
347 extern struct evcnt tcp_swcsum;
348 #endif /* defined(INET) */
349 #if defined(INET6)
350 extern struct evcnt tcp6_hwcsum_ok;
351 extern struct evcnt tcp6_hwcsum_bad;
352 extern struct evcnt tcp6_hwcsum_data;
353 extern struct evcnt tcp6_swcsum;
354 #endif /* defined(INET6) */
355
356 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
357
358 #else
359
360 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
361
362 #endif /* TCP_CSUM_COUNTERS */
363
364 #ifdef TCP_REASS_COUNTERS
365 #include <sys/device.h>
366
367 extern struct evcnt tcp_reass_;
368 extern struct evcnt tcp_reass_empty;
369 extern struct evcnt tcp_reass_iteration[8];
370 extern struct evcnt tcp_reass_prependfirst;
371 extern struct evcnt tcp_reass_prepend;
372 extern struct evcnt tcp_reass_insert;
373 extern struct evcnt tcp_reass_inserttail;
374 extern struct evcnt tcp_reass_append;
375 extern struct evcnt tcp_reass_appendtail;
376 extern struct evcnt tcp_reass_overlaptail;
377 extern struct evcnt tcp_reass_overlapfront;
378 extern struct evcnt tcp_reass_segdup;
379 extern struct evcnt tcp_reass_fragdup;
380
381 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
382
383 #else
384
385 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
386
387 #endif /* TCP_REASS_COUNTERS */
388
389 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
390 int *);
391 static int tcp_dooptions(struct tcpcb *, const u_char *, int,
392 struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *);
393
394 #ifdef INET
395 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
396 #endif
397 #ifdef INET6
398 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
399 #endif
400
401 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next
402
403 #if defined(MBUFTRACE)
404 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
405 #endif /* defined(MBUFTRACE) */
406
407 static struct pool tcpipqent_pool;
408
409 void
410 tcpipqent_init(void)
411 {
412
413 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
414 NULL, IPL_VM);
415 }
416
417 struct ipqent *
418 tcpipqent_alloc(void)
419 {
420 struct ipqent *ipqe;
421 int s;
422
423 s = splvm();
424 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
425 splx(s);
426
427 return ipqe;
428 }
429
430 void
431 tcpipqent_free(struct ipqent *ipqe)
432 {
433 int s;
434
435 s = splvm();
436 pool_put(&tcpipqent_pool, ipqe);
437 splx(s);
438 }
439
440 static int
441 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen)
442 {
443 struct ipqent *p, *q, *nq, *tiqe = NULL;
444 struct socket *so = NULL;
445 int pkt_flags;
446 tcp_seq pkt_seq;
447 unsigned pkt_len;
448 u_long rcvpartdupbyte = 0;
449 u_long rcvoobyte;
450 #ifdef TCP_REASS_COUNTERS
451 u_int count = 0;
452 #endif
453 uint64_t *tcps;
454
455 if (tp->t_inpcb)
456 so = tp->t_inpcb->inp_socket;
457 #ifdef INET6
458 else if (tp->t_in6pcb)
459 so = tp->t_in6pcb->in6p_socket;
460 #endif
461
462 TCP_REASS_LOCK_CHECK(tp);
463
464 /*
465 * Call with th==0 after become established to
466 * force pre-ESTABLISHED data up to user socket.
467 */
468 if (th == 0)
469 goto present;
470
471 m_claimm(m, &tcp_reass_mowner);
472
473 rcvoobyte = *tlen;
474 /*
475 * Copy these to local variables because the tcpiphdr
476 * gets munged while we are collapsing mbufs.
477 */
478 pkt_seq = th->th_seq;
479 pkt_len = *tlen;
480 pkt_flags = th->th_flags;
481
482 TCP_REASS_COUNTER_INCR(&tcp_reass_);
483
484 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
485 /*
486 * When we miss a packet, the vast majority of time we get
487 * packets that follow it in order. So optimize for that.
488 */
489 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
490 p->ipqe_len += pkt_len;
491 p->ipqe_flags |= pkt_flags;
492 m_cat(p->ipre_mlast, m);
493 TRAVERSE(p->ipre_mlast);
494 m = NULL;
495 tiqe = p;
496 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
497 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
498 goto skip_replacement;
499 }
500 /*
501 * While we're here, if the pkt is completely beyond
502 * anything we have, just insert it at the tail.
503 */
504 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
505 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
506 goto insert_it;
507 }
508 }
509
510 q = TAILQ_FIRST(&tp->segq);
511
512 if (q != NULL) {
513 /*
514 * If this segment immediately precedes the first out-of-order
515 * block, simply slap the segment in front of it and (mostly)
516 * skip the complicated logic.
517 */
518 if (pkt_seq + pkt_len == q->ipqe_seq) {
519 q->ipqe_seq = pkt_seq;
520 q->ipqe_len += pkt_len;
521 q->ipqe_flags |= pkt_flags;
522 m_cat(m, q->ipqe_m);
523 q->ipqe_m = m;
524 q->ipre_mlast = m; /* last mbuf may have changed */
525 TRAVERSE(q->ipre_mlast);
526 tiqe = q;
527 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
528 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
529 goto skip_replacement;
530 }
531 } else {
532 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
533 }
534
535 /*
536 * Find a segment which begins after this one does.
537 */
538 for (p = NULL; q != NULL; q = nq) {
539 nq = TAILQ_NEXT(q, ipqe_q);
540 #ifdef TCP_REASS_COUNTERS
541 count++;
542 #endif
543 /*
544 * If the received segment is just right after this
545 * fragment, merge the two together and then check
546 * for further overlaps.
547 */
548 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
549 #ifdef TCPREASS_DEBUG
550 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
551 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
552 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
553 #endif
554 pkt_len += q->ipqe_len;
555 pkt_flags |= q->ipqe_flags;
556 pkt_seq = q->ipqe_seq;
557 m_cat(q->ipre_mlast, m);
558 TRAVERSE(q->ipre_mlast);
559 m = q->ipqe_m;
560 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
561 goto free_ipqe;
562 }
563 /*
564 * If the received segment is completely past this
565 * fragment, we need to go the next fragment.
566 */
567 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
568 p = q;
569 continue;
570 }
571 /*
572 * If the fragment is past the received segment,
573 * it (or any following) can't be concatenated.
574 */
575 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
576 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
577 break;
578 }
579
580 /*
581 * We've received all the data in this segment before.
582 * mark it as a duplicate and return.
583 */
584 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
585 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
586 tcps = TCP_STAT_GETREF();
587 tcps[TCP_STAT_RCVDUPPACK]++;
588 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
589 TCP_STAT_PUTREF();
590 tcp_new_dsack(tp, pkt_seq, pkt_len);
591 m_freem(m);
592 if (tiqe != NULL) {
593 tcpipqent_free(tiqe);
594 }
595 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
596 goto out;
597 }
598 /*
599 * Received segment completely overlaps this fragment
600 * so we drop the fragment (this keeps the temporal
601 * ordering of segments correct).
602 */
603 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
604 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
605 rcvpartdupbyte += q->ipqe_len;
606 m_freem(q->ipqe_m);
607 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
608 goto free_ipqe;
609 }
610 /*
611 * RX'ed segment extends past the end of the
612 * fragment. Drop the overlapping bytes. Then
613 * merge the fragment and segment then treat as
614 * a longer received packet.
615 */
616 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
617 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
618 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
619 #ifdef TCPREASS_DEBUG
620 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
621 tp, overlap,
622 pkt_seq, pkt_seq + pkt_len, pkt_len);
623 #endif
624 m_adj(m, overlap);
625 rcvpartdupbyte += overlap;
626 m_cat(q->ipre_mlast, m);
627 TRAVERSE(q->ipre_mlast);
628 m = q->ipqe_m;
629 pkt_seq = q->ipqe_seq;
630 pkt_len += q->ipqe_len - overlap;
631 rcvoobyte -= overlap;
632 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
633 goto free_ipqe;
634 }
635 /*
636 * RX'ed segment extends past the front of the
637 * fragment. Drop the overlapping bytes on the
638 * received packet. The packet will then be
639 * contatentated with this fragment a bit later.
640 */
641 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
642 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
643 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
644 #ifdef TCPREASS_DEBUG
645 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
646 tp, overlap,
647 pkt_seq, pkt_seq + pkt_len, pkt_len);
648 #endif
649 m_adj(m, -overlap);
650 pkt_len -= overlap;
651 rcvpartdupbyte += overlap;
652 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
653 rcvoobyte -= overlap;
654 }
655 /*
656 * If the received segment immediates precedes this
657 * fragment then tack the fragment onto this segment
658 * and reinsert the data.
659 */
660 if (q->ipqe_seq == pkt_seq + pkt_len) {
661 #ifdef TCPREASS_DEBUG
662 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
663 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
664 pkt_seq, pkt_seq + pkt_len, pkt_len);
665 #endif
666 pkt_len += q->ipqe_len;
667 pkt_flags |= q->ipqe_flags;
668 m_cat(m, q->ipqe_m);
669 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
670 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
671 tp->t_segqlen--;
672 KASSERT(tp->t_segqlen >= 0);
673 KASSERT(tp->t_segqlen != 0 ||
674 (TAILQ_EMPTY(&tp->segq) &&
675 TAILQ_EMPTY(&tp->timeq)));
676 if (tiqe == NULL) {
677 tiqe = q;
678 } else {
679 tcpipqent_free(q);
680 }
681 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
682 break;
683 }
684 /*
685 * If the fragment is before the segment, remember it.
686 * When this loop is terminated, p will contain the
687 * pointer to fragment that is right before the received
688 * segment.
689 */
690 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
691 p = q;
692
693 continue;
694
695 /*
696 * This is a common operation. It also will allow
697 * to save doing a malloc/free in most instances.
698 */
699 free_ipqe:
700 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
701 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
702 tp->t_segqlen--;
703 KASSERT(tp->t_segqlen >= 0);
704 KASSERT(tp->t_segqlen != 0 ||
705 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
706 if (tiqe == NULL) {
707 tiqe = q;
708 } else {
709 tcpipqent_free(q);
710 }
711 }
712
713 #ifdef TCP_REASS_COUNTERS
714 if (count > 7)
715 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
716 else if (count > 0)
717 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
718 #endif
719
720 insert_it:
721
722 /*
723 * Allocate a new queue entry since the received segment did not
724 * collapse onto any other out-of-order block; thus we are allocating
725 * a new block. If it had collapsed, tiqe would not be NULL and
726 * we would be reusing it.
727 * XXX If we can't, just drop the packet. XXX
728 */
729 if (tiqe == NULL) {
730 tiqe = tcpipqent_alloc();
731 if (tiqe == NULL) {
732 TCP_STATINC(TCP_STAT_RCVMEMDROP);
733 m_freem(m);
734 goto out;
735 }
736 }
737
738 /*
739 * Update the counters.
740 */
741 tcps = TCP_STAT_GETREF();
742 tcps[TCP_STAT_RCVOOPACK]++;
743 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
744 if (rcvpartdupbyte) {
745 tcps[TCP_STAT_RCVPARTDUPPACK]++;
746 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
747 }
748 TCP_STAT_PUTREF();
749
750 /*
751 * Insert the new fragment queue entry into both queues.
752 */
753 tiqe->ipqe_m = m;
754 tiqe->ipre_mlast = m;
755 tiqe->ipqe_seq = pkt_seq;
756 tiqe->ipqe_len = pkt_len;
757 tiqe->ipqe_flags = pkt_flags;
758 if (p == NULL) {
759 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
760 #ifdef TCPREASS_DEBUG
761 if (tiqe->ipqe_seq != tp->rcv_nxt)
762 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
763 tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
764 #endif
765 } else {
766 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
767 #ifdef TCPREASS_DEBUG
768 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
769 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
770 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
771 #endif
772 }
773 tp->t_segqlen++;
774
775 skip_replacement:
776
777 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
778
779 present:
780 /*
781 * Present data to user, advancing rcv_nxt through
782 * completed sequence space.
783 */
784 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
785 goto out;
786 q = TAILQ_FIRST(&tp->segq);
787 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
788 goto out;
789 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
790 goto out;
791
792 tp->rcv_nxt += q->ipqe_len;
793 pkt_flags = q->ipqe_flags & TH_FIN;
794 nd6_hint(tp);
795
796 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
797 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
798 tp->t_segqlen--;
799 KASSERT(tp->t_segqlen >= 0);
800 KASSERT(tp->t_segqlen != 0 ||
801 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
802 if (so->so_state & SS_CANTRCVMORE)
803 m_freem(q->ipqe_m);
804 else
805 sbappendstream(&so->so_rcv, q->ipqe_m);
806 tcpipqent_free(q);
807 TCP_REASS_UNLOCK(tp);
808 sorwakeup(so);
809 return (pkt_flags);
810 out:
811 TCP_REASS_UNLOCK(tp);
812 return (0);
813 }
814
815 #ifdef INET6
816 int
817 tcp6_input(struct mbuf **mp, int *offp, int proto)
818 {
819 struct mbuf *m = *mp;
820
821 /*
822 * draft-itojun-ipv6-tcp-to-anycast
823 * better place to put this in?
824 */
825 if (m->m_flags & M_ANYCAST6) {
826 struct ip6_hdr *ip6;
827 if (m->m_len < sizeof(struct ip6_hdr)) {
828 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
829 TCP_STATINC(TCP_STAT_RCVSHORT);
830 return IPPROTO_DONE;
831 }
832 }
833 ip6 = mtod(m, struct ip6_hdr *);
834 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
835 (char *)&ip6->ip6_dst - (char *)ip6);
836 return IPPROTO_DONE;
837 }
838
839 tcp_input(m, *offp, proto);
840 return IPPROTO_DONE;
841 }
842 #endif
843
844 #ifdef INET
845 static void
846 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
847 {
848 char src[4*sizeof "123"];
849 char dst[4*sizeof "123"];
850
851 if (ip) {
852 strlcpy(src, inet_ntoa(ip->ip_src), sizeof(src));
853 strlcpy(dst, inet_ntoa(ip->ip_dst), sizeof(dst));
854 }
855 else {
856 strlcpy(src, "(unknown)", sizeof(src));
857 strlcpy(dst, "(unknown)", sizeof(dst));
858 }
859 log(LOG_INFO,
860 "Connection attempt to TCP %s:%d from %s:%d\n",
861 dst, ntohs(th->th_dport),
862 src, ntohs(th->th_sport));
863 }
864 #endif
865
866 #ifdef INET6
867 static void
868 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
869 {
870 char src[INET6_ADDRSTRLEN];
871 char dst[INET6_ADDRSTRLEN];
872
873 if (ip6) {
874 strlcpy(src, ip6_sprintf(&ip6->ip6_src), sizeof(src));
875 strlcpy(dst, ip6_sprintf(&ip6->ip6_dst), sizeof(dst));
876 }
877 else {
878 strlcpy(src, "(unknown v6)", sizeof(src));
879 strlcpy(dst, "(unknown v6)", sizeof(dst));
880 }
881 log(LOG_INFO,
882 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
883 dst, ntohs(th->th_dport),
884 src, ntohs(th->th_sport));
885 }
886 #endif
887
888 /*
889 * Checksum extended TCP header and data.
890 */
891 int
892 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
893 int toff, int off, int tlen)
894 {
895
896 /*
897 * XXX it's better to record and check if this mbuf is
898 * already checked.
899 */
900
901 switch (af) {
902 #ifdef INET
903 case AF_INET:
904 switch (m->m_pkthdr.csum_flags &
905 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
906 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
907 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
908 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
909 goto badcsum;
910
911 case M_CSUM_TCPv4|M_CSUM_DATA: {
912 u_int32_t hw_csum = m->m_pkthdr.csum_data;
913
914 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
915 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
916 const struct ip *ip =
917 mtod(m, const struct ip *);
918
919 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
920 ip->ip_dst.s_addr,
921 htons(hw_csum + tlen + off + IPPROTO_TCP));
922 }
923 if ((hw_csum ^ 0xffff) != 0)
924 goto badcsum;
925 break;
926 }
927
928 case M_CSUM_TCPv4:
929 /* Checksum was okay. */
930 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
931 break;
932
933 default:
934 /*
935 * Must compute it ourselves. Maybe skip checksum
936 * on loopback interfaces.
937 */
938 if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &
939 IFF_LOOPBACK) ||
940 tcp_do_loopback_cksum)) {
941 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
942 if (in4_cksum(m, IPPROTO_TCP, toff,
943 tlen + off) != 0)
944 goto badcsum;
945 }
946 break;
947 }
948 break;
949 #endif /* INET4 */
950
951 #ifdef INET6
952 case AF_INET6:
953 switch (m->m_pkthdr.csum_flags &
954 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
955 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
956 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
957 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
958 goto badcsum;
959
960 #if 0 /* notyet */
961 case M_CSUM_TCPv6|M_CSUM_DATA:
962 #endif
963
964 case M_CSUM_TCPv6:
965 /* Checksum was okay. */
966 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
967 break;
968
969 default:
970 /*
971 * Must compute it ourselves. Maybe skip checksum
972 * on loopback interfaces.
973 */
974 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
975 tcp_do_loopback_cksum)) {
976 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
977 if (in6_cksum(m, IPPROTO_TCP, toff,
978 tlen + off) != 0)
979 goto badcsum;
980 }
981 }
982 break;
983 #endif /* INET6 */
984 }
985
986 return 0;
987
988 badcsum:
989 TCP_STATINC(TCP_STAT_RCVBADSUM);
990 return -1;
991 }
992
993 /* When a packet arrives addressed to a vestigial tcpbp, we
994 * nevertheless have to respond to it per the spec.
995 */
996 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp,
997 struct mbuf *m, int tlen, int multicast)
998 {
999 int tiflags;
1000 int todrop;
1001 uint32_t t_flags = 0;
1002 uint64_t *tcps;
1003
1004 tiflags = th->th_flags;
1005 todrop = vp->rcv_nxt - th->th_seq;
1006
1007 if (todrop > 0) {
1008 if (tiflags & TH_SYN) {
1009 tiflags &= ~TH_SYN;
1010 ++th->th_seq;
1011 if (th->th_urp > 1)
1012 --th->th_urp;
1013 else {
1014 tiflags &= ~TH_URG;
1015 th->th_urp = 0;
1016 }
1017 --todrop;
1018 }
1019 if (todrop > tlen ||
1020 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1021 /*
1022 * Any valid FIN or RST must be to the left of the
1023 * window. At this point the FIN or RST must be a
1024 * duplicate or out of sequence; drop it.
1025 */
1026 if (tiflags & TH_RST)
1027 goto drop;
1028 tiflags &= ~(TH_FIN|TH_RST);
1029 /*
1030 * Send an ACK to resynchronize and drop any data.
1031 * But keep on processing for RST or ACK.
1032 */
1033 t_flags |= TF_ACKNOW;
1034 todrop = tlen;
1035 tcps = TCP_STAT_GETREF();
1036 tcps[TCP_STAT_RCVDUPPACK] += 1;
1037 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
1038 TCP_STAT_PUTREF();
1039 } else if ((tiflags & TH_RST)
1040 && th->th_seq != vp->rcv_nxt) {
1041 /*
1042 * Test for reset before adjusting the sequence
1043 * number for overlapping data.
1044 */
1045 goto dropafterack_ratelim;
1046 } else {
1047 tcps = TCP_STAT_GETREF();
1048 tcps[TCP_STAT_RCVPARTDUPPACK] += 1;
1049 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
1050 TCP_STAT_PUTREF();
1051 }
1052
1053 // tcp_new_dsack(tp, th->th_seq, todrop);
1054 // hdroptlen += todrop; /*drop from head afterwards*/
1055
1056 th->th_seq += todrop;
1057 tlen -= todrop;
1058
1059 if (th->th_urp > todrop)
1060 th->th_urp -= todrop;
1061 else {
1062 tiflags &= ~TH_URG;
1063 th->th_urp = 0;
1064 }
1065 }
1066
1067 /*
1068 * If new data are received on a connection after the
1069 * user processes are gone, then RST the other end.
1070 */
1071 if (tlen) {
1072 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
1073 goto dropwithreset;
1074 }
1075
1076 /*
1077 * If segment ends after window, drop trailing data
1078 * (and PUSH and FIN); if nothing left, just ACK.
1079 */
1080 todrop = (th->th_seq + tlen) - (vp->rcv_nxt+vp->rcv_wnd);
1081
1082 if (todrop > 0) {
1083 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
1084 if (todrop >= tlen) {
1085 /*
1086 * The segment actually starts after the window.
1087 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen
1088 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0
1089 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd
1090 */
1091 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
1092 /*
1093 * If a new connection request is received
1094 * while in TIME_WAIT, drop the old connection
1095 * and start over if the sequence numbers
1096 * are above the previous ones.
1097 */
1098 if ((tiflags & TH_SYN)
1099 && SEQ_GT(th->th_seq, vp->rcv_nxt)) {
1100 /* We only support this in the !NOFDREF case, which
1101 * is to say: not here.
1102 */
1103 goto dropwithreset;
1104 }
1105 /*
1106 * If window is closed can only take segments at
1107 * window edge, and have to drop data and PUSH from
1108 * incoming segments. Continue processing, but
1109 * remember to ack. Otherwise, drop segment
1110 * and (if not RST) ack.
1111 */
1112 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) {
1113 t_flags |= TF_ACKNOW;
1114 TCP_STATINC(TCP_STAT_RCVWINPROBE);
1115 } else
1116 goto dropafterack;
1117 } else
1118 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
1119 m_adj(m, -todrop);
1120 tlen -= todrop;
1121 tiflags &= ~(TH_PUSH|TH_FIN);
1122 }
1123
1124 if (tiflags & TH_RST) {
1125 if (th->th_seq != vp->rcv_nxt)
1126 goto dropafterack_ratelim;
1127
1128 vtw_del(vp->ctl, vp->vtw);
1129 goto drop;
1130 }
1131
1132 /*
1133 * If the ACK bit is off we drop the segment and return.
1134 */
1135 if ((tiflags & TH_ACK) == 0) {
1136 if (t_flags & TF_ACKNOW)
1137 goto dropafterack;
1138 else
1139 goto drop;
1140 }
1141
1142 /*
1143 * In TIME_WAIT state the only thing that should arrive
1144 * is a retransmission of the remote FIN. Acknowledge
1145 * it and restart the finack timer.
1146 */
1147 vtw_restart(vp);
1148 goto dropafterack;
1149
1150 dropafterack:
1151 /*
1152 * Generate an ACK dropping incoming segment if it occupies
1153 * sequence space, where the ACK reflects our state.
1154 */
1155 if (tiflags & TH_RST)
1156 goto drop;
1157 goto dropafterack2;
1158
1159 dropafterack_ratelim:
1160 /*
1161 * We may want to rate-limit ACKs against SYN/RST attack.
1162 */
1163 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
1164 tcp_ackdrop_ppslim) == 0) {
1165 /* XXX stat */
1166 goto drop;
1167 }
1168 /* ...fall into dropafterack2... */
1169
1170 dropafterack2:
1171 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack,
1172 TH_ACK);
1173 return;
1174
1175 dropwithreset:
1176 /*
1177 * Generate a RST, dropping incoming segment.
1178 * Make ACK acceptable to originator of segment.
1179 */
1180 if (tiflags & TH_RST)
1181 goto drop;
1182
1183 if (tiflags & TH_ACK)
1184 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
1185 else {
1186 if (tiflags & TH_SYN)
1187 ++tlen;
1188 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0,
1189 TH_RST|TH_ACK);
1190 }
1191 return;
1192 drop:
1193 m_freem(m);
1194 }
1195
1196 /*
1197 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
1198 */
1199 void
1200 tcp_input(struct mbuf *m, ...)
1201 {
1202 struct tcphdr *th;
1203 struct ip *ip;
1204 struct inpcb *inp;
1205 #ifdef INET6
1206 struct ip6_hdr *ip6;
1207 struct in6pcb *in6p;
1208 #endif
1209 u_int8_t *optp = NULL;
1210 int optlen = 0;
1211 int len, tlen, toff, hdroptlen = 0;
1212 struct tcpcb *tp = 0;
1213 int tiflags;
1214 struct socket *so = NULL;
1215 int todrop, acked, ourfinisacked, needoutput = 0;
1216 bool dupseg;
1217 #ifdef TCP_DEBUG
1218 short ostate = 0;
1219 #endif
1220 u_long tiwin;
1221 struct tcp_opt_info opti;
1222 int off, iphlen;
1223 va_list ap;
1224 int af; /* af on the wire */
1225 struct mbuf *tcp_saveti = NULL;
1226 uint32_t ts_rtt;
1227 uint8_t iptos;
1228 uint64_t *tcps;
1229 vestigial_inpcb_t vestige;
1230
1231 vestige.valid = 0;
1232
1233 MCLAIM(m, &tcp_rx_mowner);
1234 va_start(ap, m);
1235 toff = va_arg(ap, int);
1236 (void)va_arg(ap, int); /* ignore value, advance ap */
1237 va_end(ap);
1238
1239 TCP_STATINC(TCP_STAT_RCVTOTAL);
1240
1241 memset(&opti, 0, sizeof(opti));
1242 opti.ts_present = 0;
1243 opti.maxseg = 0;
1244
1245 /*
1246 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1247 *
1248 * TCP is, by definition, unicast, so we reject all
1249 * multicast outright.
1250 *
1251 * Note, there are additional src/dst address checks in
1252 * the AF-specific code below.
1253 */
1254 if (m->m_flags & (M_BCAST|M_MCAST)) {
1255 /* XXX stat */
1256 goto drop;
1257 }
1258 #ifdef INET6
1259 if (m->m_flags & M_ANYCAST6) {
1260 /* XXX stat */
1261 goto drop;
1262 }
1263 #endif
1264
1265 /*
1266 * Get IP and TCP header.
1267 * Note: IP leaves IP header in first mbuf.
1268 */
1269 ip = mtod(m, struct ip *);
1270 switch (ip->ip_v) {
1271 #ifdef INET
1272 case 4:
1273 #ifdef INET6
1274 ip6 = NULL;
1275 #endif
1276 af = AF_INET;
1277 iphlen = sizeof(struct ip);
1278 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1279 sizeof(struct tcphdr));
1280 if (th == NULL) {
1281 TCP_STATINC(TCP_STAT_RCVSHORT);
1282 return;
1283 }
1284 /* We do the checksum after PCB lookup... */
1285 len = ntohs(ip->ip_len);
1286 tlen = len - toff;
1287 iptos = ip->ip_tos;
1288 break;
1289 #endif
1290 #ifdef INET6
1291 case 6:
1292 ip = NULL;
1293 iphlen = sizeof(struct ip6_hdr);
1294 af = AF_INET6;
1295 ip6 = mtod(m, struct ip6_hdr *);
1296 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1297 sizeof(struct tcphdr));
1298 if (th == NULL) {
1299 TCP_STATINC(TCP_STAT_RCVSHORT);
1300 return;
1301 }
1302
1303 /* Be proactive about malicious use of IPv4 mapped address */
1304 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
1305 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
1306 /* XXX stat */
1307 goto drop;
1308 }
1309
1310 /*
1311 * Be proactive about unspecified IPv6 address in source.
1312 * As we use all-zero to indicate unbounded/unconnected pcb,
1313 * unspecified IPv6 address can be used to confuse us.
1314 *
1315 * Note that packets with unspecified IPv6 destination is
1316 * already dropped in ip6_input.
1317 */
1318 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1319 /* XXX stat */
1320 goto drop;
1321 }
1322
1323 /*
1324 * Make sure destination address is not multicast.
1325 * Source address checked in ip6_input().
1326 */
1327 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1328 /* XXX stat */
1329 goto drop;
1330 }
1331
1332 /* We do the checksum after PCB lookup... */
1333 len = m->m_pkthdr.len;
1334 tlen = len - toff;
1335 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1336 break;
1337 #endif
1338 default:
1339 m_freem(m);
1340 return;
1341 }
1342
1343 KASSERT(TCP_HDR_ALIGNED_P(th));
1344
1345 /*
1346 * Check that TCP offset makes sense,
1347 * pull out TCP options and adjust length. XXX
1348 */
1349 off = th->th_off << 2;
1350 if (off < sizeof (struct tcphdr) || off > tlen) {
1351 TCP_STATINC(TCP_STAT_RCVBADOFF);
1352 goto drop;
1353 }
1354 tlen -= off;
1355
1356 /*
1357 * tcp_input() has been modified to use tlen to mean the TCP data
1358 * length throughout the function. Other functions can use
1359 * m->m_pkthdr.len as the basis for calculating the TCP data length.
1360 * rja
1361 */
1362
1363 if (off > sizeof (struct tcphdr)) {
1364 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
1365 if (th == NULL) {
1366 TCP_STATINC(TCP_STAT_RCVSHORT);
1367 return;
1368 }
1369 /*
1370 * NOTE: ip/ip6 will not be affected by m_pulldown()
1371 * (as they're before toff) and we don't need to update those.
1372 */
1373 KASSERT(TCP_HDR_ALIGNED_P(th));
1374 optlen = off - sizeof (struct tcphdr);
1375 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1376 /*
1377 * Do quick retrieval of timestamp options ("options
1378 * prediction?"). If timestamp is the only option and it's
1379 * formatted as recommended in RFC 1323 appendix A, we
1380 * quickly get the values now and not bother calling
1381 * tcp_dooptions(), etc.
1382 */
1383 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1384 (optlen > TCPOLEN_TSTAMP_APPA &&
1385 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1386 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
1387 (th->th_flags & TH_SYN) == 0) {
1388 opti.ts_present = 1;
1389 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
1390 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
1391 optp = NULL; /* we've parsed the options */
1392 }
1393 }
1394 tiflags = th->th_flags;
1395
1396 /*
1397 * Locate pcb for segment.
1398 */
1399 findpcb:
1400 inp = NULL;
1401 #ifdef INET6
1402 in6p = NULL;
1403 #endif
1404 switch (af) {
1405 #ifdef INET
1406 case AF_INET:
1407 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
1408 ip->ip_dst, th->th_dport,
1409 &vestige);
1410 if (inp == 0 && !vestige.valid) {
1411 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1412 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
1413 }
1414 #ifdef INET6
1415 if (inp == 0 && !vestige.valid) {
1416 struct in6_addr s, d;
1417
1418 /* mapped addr case */
1419 memset(&s, 0, sizeof(s));
1420 s.s6_addr16[5] = htons(0xffff);
1421 bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
1422 memset(&d, 0, sizeof(d));
1423 d.s6_addr16[5] = htons(0xffff);
1424 bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
1425 in6p = in6_pcblookup_connect(&tcbtable, &s,
1426 th->th_sport, &d, th->th_dport,
1427 0, &vestige);
1428 if (in6p == 0 && !vestige.valid) {
1429 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1430 in6p = in6_pcblookup_bind(&tcbtable, &d,
1431 th->th_dport, 0);
1432 }
1433 }
1434 #endif
1435 #ifndef INET6
1436 if (inp == 0 && !vestige.valid)
1437 #else
1438 if (inp == 0 && in6p == 0 && !vestige.valid)
1439 #endif
1440 {
1441 TCP_STATINC(TCP_STAT_NOPORT);
1442 if (tcp_log_refused &&
1443 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1444 tcp4_log_refused(ip, th);
1445 }
1446 tcp_fields_to_host(th);
1447 goto dropwithreset_ratelim;
1448 }
1449 #if defined(IPSEC)
1450 if (ipsec_used) {
1451 if (inp &&
1452 (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0
1453 && ipsec4_in_reject(m, inp)) {
1454 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1455 goto drop;
1456 }
1457 #ifdef INET6
1458 else if (in6p &&
1459 (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0
1460 && ipsec6_in_reject_so(m, in6p->in6p_socket)) {
1461 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1462 goto drop;
1463 }
1464 #endif
1465 }
1466 #endif /*IPSEC*/
1467 break;
1468 #endif /*INET*/
1469 #ifdef INET6
1470 case AF_INET6:
1471 {
1472 int faith;
1473
1474 #if defined(NFAITH) && NFAITH > 0
1475 faith = faithprefix(&ip6->ip6_dst);
1476 #else
1477 faith = 0;
1478 #endif
1479 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src,
1480 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige);
1481 if (!in6p && !vestige.valid) {
1482 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1483 in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst,
1484 th->th_dport, faith);
1485 }
1486 if (!in6p && !vestige.valid) {
1487 TCP_STATINC(TCP_STAT_NOPORT);
1488 if (tcp_log_refused &&
1489 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1490 tcp6_log_refused(ip6, th);
1491 }
1492 tcp_fields_to_host(th);
1493 goto dropwithreset_ratelim;
1494 }
1495 #if defined(IPSEC)
1496 if (ipsec_used && in6p
1497 && (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0
1498 && ipsec6_in_reject(m, in6p)) {
1499 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1500 goto drop;
1501 }
1502 #endif /*IPSEC*/
1503 break;
1504 }
1505 #endif
1506 }
1507
1508 /*
1509 * If the state is CLOSED (i.e., TCB does not exist) then
1510 * all data in the incoming segment is discarded.
1511 * If the TCB exists but is in CLOSED state, it is embryonic,
1512 * but should either do a listen or a connect soon.
1513 */
1514 tp = NULL;
1515 so = NULL;
1516 if (inp) {
1517 /* Check the minimum TTL for socket. */
1518 if (ip->ip_ttl < inp->inp_ip_minttl)
1519 goto drop;
1520
1521 tp = intotcpcb(inp);
1522 so = inp->inp_socket;
1523 }
1524 #ifdef INET6
1525 else if (in6p) {
1526 tp = in6totcpcb(in6p);
1527 so = in6p->in6p_socket;
1528 }
1529 #endif
1530 else if (vestige.valid) {
1531 int mc = 0;
1532
1533 /* We do not support the resurrection of vtw tcpcps.
1534 */
1535 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1536 goto badcsum;
1537
1538 switch (af) {
1539 #ifdef INET6
1540 case AF_INET6:
1541 mc = IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst);
1542 break;
1543 #endif
1544
1545 case AF_INET:
1546 mc = (IN_MULTICAST(ip->ip_dst.s_addr)
1547 || in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif));
1548 break;
1549 }
1550
1551 tcp_fields_to_host(th);
1552 tcp_vtw_input(th, &vestige, m, tlen, mc);
1553 m = 0;
1554 goto drop;
1555 }
1556
1557 if (tp == 0) {
1558 tcp_fields_to_host(th);
1559 goto dropwithreset_ratelim;
1560 }
1561 if (tp->t_state == TCPS_CLOSED)
1562 goto drop;
1563
1564 KASSERT(so->so_lock == softnet_lock);
1565 KASSERT(solocked(so));
1566
1567 /*
1568 * Checksum extended TCP header and data.
1569 */
1570 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1571 goto badcsum;
1572
1573 tcp_fields_to_host(th);
1574
1575 /* Unscale the window into a 32-bit value. */
1576 if ((tiflags & TH_SYN) == 0)
1577 tiwin = th->th_win << tp->snd_scale;
1578 else
1579 tiwin = th->th_win;
1580
1581 #ifdef INET6
1582 /* save packet options if user wanted */
1583 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1584 if (in6p->in6p_options) {
1585 m_freem(in6p->in6p_options);
1586 in6p->in6p_options = 0;
1587 }
1588 KASSERT(ip6 != NULL);
1589 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1590 }
1591 #endif
1592
1593 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1594 union syn_cache_sa src;
1595 union syn_cache_sa dst;
1596
1597 memset(&src, 0, sizeof(src));
1598 memset(&dst, 0, sizeof(dst));
1599 switch (af) {
1600 #ifdef INET
1601 case AF_INET:
1602 src.sin.sin_len = sizeof(struct sockaddr_in);
1603 src.sin.sin_family = AF_INET;
1604 src.sin.sin_addr = ip->ip_src;
1605 src.sin.sin_port = th->th_sport;
1606
1607 dst.sin.sin_len = sizeof(struct sockaddr_in);
1608 dst.sin.sin_family = AF_INET;
1609 dst.sin.sin_addr = ip->ip_dst;
1610 dst.sin.sin_port = th->th_dport;
1611 break;
1612 #endif
1613 #ifdef INET6
1614 case AF_INET6:
1615 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1616 src.sin6.sin6_family = AF_INET6;
1617 src.sin6.sin6_addr = ip6->ip6_src;
1618 src.sin6.sin6_port = th->th_sport;
1619
1620 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1621 dst.sin6.sin6_family = AF_INET6;
1622 dst.sin6.sin6_addr = ip6->ip6_dst;
1623 dst.sin6.sin6_port = th->th_dport;
1624 break;
1625 #endif /* INET6 */
1626 default:
1627 goto badsyn; /*sanity*/
1628 }
1629
1630 if (so->so_options & SO_DEBUG) {
1631 #ifdef TCP_DEBUG
1632 ostate = tp->t_state;
1633 #endif
1634
1635 tcp_saveti = NULL;
1636 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1637 goto nosave;
1638
1639 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1640 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1641 if (!tcp_saveti)
1642 goto nosave;
1643 } else {
1644 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1645 if (!tcp_saveti)
1646 goto nosave;
1647 MCLAIM(m, &tcp_mowner);
1648 tcp_saveti->m_len = iphlen;
1649 m_copydata(m, 0, iphlen,
1650 mtod(tcp_saveti, void *));
1651 }
1652
1653 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1654 m_freem(tcp_saveti);
1655 tcp_saveti = NULL;
1656 } else {
1657 tcp_saveti->m_len += sizeof(struct tcphdr);
1658 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1659 sizeof(struct tcphdr));
1660 }
1661 nosave:;
1662 }
1663 if (so->so_options & SO_ACCEPTCONN) {
1664 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1665 if (tiflags & TH_RST) {
1666 syn_cache_reset(&src.sa, &dst.sa, th);
1667 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1668 (TH_ACK|TH_SYN)) {
1669 /*
1670 * Received a SYN,ACK. This should
1671 * never happen while we are in
1672 * LISTEN. Send an RST.
1673 */
1674 goto badsyn;
1675 } else if (tiflags & TH_ACK) {
1676 so = syn_cache_get(&src.sa, &dst.sa,
1677 th, toff, tlen, so, m);
1678 if (so == NULL) {
1679 /*
1680 * We don't have a SYN for
1681 * this ACK; send an RST.
1682 */
1683 goto badsyn;
1684 } else if (so ==
1685 (struct socket *)(-1)) {
1686 /*
1687 * We were unable to create
1688 * the connection. If the
1689 * 3-way handshake was
1690 * completed, and RST has
1691 * been sent to the peer.
1692 * Since the mbuf might be
1693 * in use for the reply,
1694 * do not free it.
1695 */
1696 m = NULL;
1697 } else {
1698 /*
1699 * We have created a
1700 * full-blown connection.
1701 */
1702 tp = NULL;
1703 inp = NULL;
1704 #ifdef INET6
1705 in6p = NULL;
1706 #endif
1707 switch (so->so_proto->pr_domain->dom_family) {
1708 #ifdef INET
1709 case AF_INET:
1710 inp = sotoinpcb(so);
1711 tp = intotcpcb(inp);
1712 break;
1713 #endif
1714 #ifdef INET6
1715 case AF_INET6:
1716 in6p = sotoin6pcb(so);
1717 tp = in6totcpcb(in6p);
1718 break;
1719 #endif
1720 }
1721 if (tp == NULL)
1722 goto badsyn; /*XXX*/
1723 tiwin <<= tp->snd_scale;
1724 goto after_listen;
1725 }
1726 } else {
1727 /*
1728 * None of RST, SYN or ACK was set.
1729 * This is an invalid packet for a
1730 * TCB in LISTEN state. Send a RST.
1731 */
1732 goto badsyn;
1733 }
1734 } else {
1735 /*
1736 * Received a SYN.
1737 *
1738 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1739 */
1740 if (m->m_flags & (M_BCAST|M_MCAST))
1741 goto drop;
1742
1743 switch (af) {
1744 #ifdef INET6
1745 case AF_INET6:
1746 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1747 goto drop;
1748 break;
1749 #endif /* INET6 */
1750 case AF_INET:
1751 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1752 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1753 goto drop;
1754 break;
1755 }
1756
1757 #ifdef INET6
1758 /*
1759 * If deprecated address is forbidden, we do
1760 * not accept SYN to deprecated interface
1761 * address to prevent any new inbound
1762 * connection from getting established.
1763 * When we do not accept SYN, we send a TCP
1764 * RST, with deprecated source address (instead
1765 * of dropping it). We compromise it as it is
1766 * much better for peer to send a RST, and
1767 * RST will be the final packet for the
1768 * exchange.
1769 *
1770 * If we do not forbid deprecated addresses, we
1771 * accept the SYN packet. RFC2462 does not
1772 * suggest dropping SYN in this case.
1773 * If we decipher RFC2462 5.5.4, it says like
1774 * this:
1775 * 1. use of deprecated addr with existing
1776 * communication is okay - "SHOULD continue
1777 * to be used"
1778 * 2. use of it with new communication:
1779 * (2a) "SHOULD NOT be used if alternate
1780 * address with sufficient scope is
1781 * available"
1782 * (2b) nothing mentioned otherwise.
1783 * Here we fall into (2b) case as we have no
1784 * choice in our source address selection - we
1785 * must obey the peer.
1786 *
1787 * The wording in RFC2462 is confusing, and
1788 * there are multiple description text for
1789 * deprecated address handling - worse, they
1790 * are not exactly the same. I believe 5.5.4
1791 * is the best one, so we follow 5.5.4.
1792 */
1793 if (af == AF_INET6 && !ip6_use_deprecated) {
1794 struct in6_ifaddr *ia6;
1795 if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
1796 &ip6->ip6_dst)) &&
1797 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1798 tp = NULL;
1799 goto dropwithreset;
1800 }
1801 }
1802 #endif
1803
1804 #if defined(IPSEC)
1805 if (ipsec_used) {
1806 switch (af) {
1807 #ifdef INET
1808 case AF_INET:
1809 if (!ipsec4_in_reject_so(m, so))
1810 break;
1811 IPSEC_STATINC(
1812 IPSEC_STAT_IN_POLVIO);
1813 tp = NULL;
1814 goto dropwithreset;
1815 #endif
1816 #ifdef INET6
1817 case AF_INET6:
1818 if (!ipsec6_in_reject_so(m, so))
1819 break;
1820 IPSEC6_STATINC(
1821 IPSEC_STAT_IN_POLVIO);
1822 tp = NULL;
1823 goto dropwithreset;
1824 #endif /*INET6*/
1825 }
1826 }
1827 #endif /*IPSEC*/
1828
1829 /*
1830 * LISTEN socket received a SYN
1831 * from itself? This can't possibly
1832 * be valid; drop the packet.
1833 */
1834 if (th->th_sport == th->th_dport) {
1835 int i;
1836
1837 switch (af) {
1838 #ifdef INET
1839 case AF_INET:
1840 i = in_hosteq(ip->ip_src, ip->ip_dst);
1841 break;
1842 #endif
1843 #ifdef INET6
1844 case AF_INET6:
1845 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1846 break;
1847 #endif
1848 default:
1849 i = 1;
1850 }
1851 if (i) {
1852 TCP_STATINC(TCP_STAT_BADSYN);
1853 goto drop;
1854 }
1855 }
1856
1857 /*
1858 * SYN looks ok; create compressed TCP
1859 * state for it.
1860 */
1861 if (so->so_qlen <= so->so_qlimit &&
1862 syn_cache_add(&src.sa, &dst.sa, th, tlen,
1863 so, m, optp, optlen, &opti))
1864 m = NULL;
1865 }
1866 goto drop;
1867 }
1868 }
1869
1870 after_listen:
1871 #ifdef DIAGNOSTIC
1872 /*
1873 * Should not happen now that all embryonic connections
1874 * are handled with compressed state.
1875 */
1876 if (tp->t_state == TCPS_LISTEN)
1877 panic("tcp_input: TCPS_LISTEN");
1878 #endif
1879
1880 /*
1881 * Segment received on connection.
1882 * Reset idle time and keep-alive timer.
1883 */
1884 tp->t_rcvtime = tcp_now;
1885 if (TCPS_HAVEESTABLISHED(tp->t_state))
1886 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1887
1888 /*
1889 * Process options.
1890 */
1891 #ifdef TCP_SIGNATURE
1892 if (optp || (tp->t_flags & TF_SIGNATURE))
1893 #else
1894 if (optp)
1895 #endif
1896 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0)
1897 goto drop;
1898
1899 if (TCP_SACK_ENABLED(tp)) {
1900 tcp_del_sackholes(tp, th);
1901 }
1902
1903 if (TCP_ECN_ALLOWED(tp)) {
1904 if (tiflags & TH_CWR) {
1905 tp->t_flags &= ~TF_ECN_SND_ECE;
1906 }
1907 switch (iptos & IPTOS_ECN_MASK) {
1908 case IPTOS_ECN_CE:
1909 tp->t_flags |= TF_ECN_SND_ECE;
1910 TCP_STATINC(TCP_STAT_ECN_CE);
1911 break;
1912 case IPTOS_ECN_ECT0:
1913 TCP_STATINC(TCP_STAT_ECN_ECT);
1914 break;
1915 case IPTOS_ECN_ECT1:
1916 /* XXX: ignore for now -- rpaulo */
1917 break;
1918 }
1919 /*
1920 * Congestion experienced.
1921 * Ignore if we are already trying to recover.
1922 */
1923 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1924 tp->t_congctl->cong_exp(tp);
1925 }
1926
1927 if (opti.ts_present && opti.ts_ecr) {
1928 /*
1929 * Calculate the RTT from the returned time stamp and the
1930 * connection's time base. If the time stamp is later than
1931 * the current time, or is extremely old, fall back to non-1323
1932 * RTT calculation. Since ts_rtt is unsigned, we can test both
1933 * at the same time.
1934 *
1935 * Note that ts_rtt is in units of slow ticks (500
1936 * ms). Since most earthbound RTTs are < 500 ms,
1937 * observed values will have large quantization noise.
1938 * Our smoothed RTT is then the fraction of observed
1939 * samples that are 1 tick instead of 0 (times 500
1940 * ms).
1941 *
1942 * ts_rtt is increased by 1 to denote a valid sample,
1943 * with 0 indicating an invalid measurement. This
1944 * extra 1 must be removed when ts_rtt is used, or
1945 * else an an erroneous extra 500 ms will result.
1946 */
1947 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1948 if (ts_rtt > TCP_PAWS_IDLE)
1949 ts_rtt = 0;
1950 } else {
1951 ts_rtt = 0;
1952 }
1953
1954 /*
1955 * Header prediction: check for the two common cases
1956 * of a uni-directional data xfer. If the packet has
1957 * no control flags, is in-sequence, the window didn't
1958 * change and we're not retransmitting, it's a
1959 * candidate. If the length is zero and the ack moved
1960 * forward, we're the sender side of the xfer. Just
1961 * free the data acked & wake any higher level process
1962 * that was blocked waiting for space. If the length
1963 * is non-zero and the ack didn't move, we're the
1964 * receiver side. If we're getting packets in-order
1965 * (the reassembly queue is empty), add the data to
1966 * the socket buffer and note that we need a delayed ack.
1967 */
1968 if (tp->t_state == TCPS_ESTABLISHED &&
1969 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1970 == TH_ACK &&
1971 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1972 th->th_seq == tp->rcv_nxt &&
1973 tiwin && tiwin == tp->snd_wnd &&
1974 tp->snd_nxt == tp->snd_max) {
1975
1976 /*
1977 * If last ACK falls within this segment's sequence numbers,
1978 * record the timestamp.
1979 * NOTE that the test is modified according to the latest
1980 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26).
1981 *
1982 * note that we already know
1983 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1984 */
1985 if (opti.ts_present &&
1986 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1987 tp->ts_recent_age = tcp_now;
1988 tp->ts_recent = opti.ts_val;
1989 }
1990
1991 if (tlen == 0) {
1992 /* Ack prediction. */
1993 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1994 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1995 tp->snd_cwnd >= tp->snd_wnd &&
1996 tp->t_partialacks < 0) {
1997 /*
1998 * this is a pure ack for outstanding data.
1999 */
2000 if (ts_rtt)
2001 tcp_xmit_timer(tp, ts_rtt - 1);
2002 else if (tp->t_rtttime &&
2003 SEQ_GT(th->th_ack, tp->t_rtseq))
2004 tcp_xmit_timer(tp,
2005 tcp_now - tp->t_rtttime);
2006 acked = th->th_ack - tp->snd_una;
2007 tcps = TCP_STAT_GETREF();
2008 tcps[TCP_STAT_PREDACK]++;
2009 tcps[TCP_STAT_RCVACKPACK]++;
2010 tcps[TCP_STAT_RCVACKBYTE] += acked;
2011 TCP_STAT_PUTREF();
2012 nd6_hint(tp);
2013
2014 if (acked > (tp->t_lastoff - tp->t_inoff))
2015 tp->t_lastm = NULL;
2016 sbdrop(&so->so_snd, acked);
2017 tp->t_lastoff -= acked;
2018
2019 icmp_check(tp, th, acked);
2020
2021 tp->snd_una = th->th_ack;
2022 tp->snd_fack = tp->snd_una;
2023 if (SEQ_LT(tp->snd_high, tp->snd_una))
2024 tp->snd_high = tp->snd_una;
2025 m_freem(m);
2026
2027 /*
2028 * If all outstanding data are acked, stop
2029 * retransmit timer, otherwise restart timer
2030 * using current (possibly backed-off) value.
2031 * If process is waiting for space,
2032 * wakeup/selnotify/signal. If data
2033 * are ready to send, let tcp_output
2034 * decide between more output or persist.
2035 */
2036 if (tp->snd_una == tp->snd_max)
2037 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2038 else if (TCP_TIMER_ISARMED(tp,
2039 TCPT_PERSIST) == 0)
2040 TCP_TIMER_ARM(tp, TCPT_REXMT,
2041 tp->t_rxtcur);
2042
2043 sowwakeup(so);
2044 if (so->so_snd.sb_cc) {
2045 KERNEL_LOCK(1, NULL);
2046 (void) tcp_output(tp);
2047 KERNEL_UNLOCK_ONE(NULL);
2048 }
2049 if (tcp_saveti)
2050 m_freem(tcp_saveti);
2051 return;
2052 }
2053 } else if (th->th_ack == tp->snd_una &&
2054 TAILQ_FIRST(&tp->segq) == NULL &&
2055 tlen <= sbspace(&so->so_rcv)) {
2056 int newsize = 0; /* automatic sockbuf scaling */
2057
2058 /*
2059 * this is a pure, in-sequence data packet
2060 * with nothing on the reassembly queue and
2061 * we have enough buffer space to take it.
2062 */
2063 tp->rcv_nxt += tlen;
2064 tcps = TCP_STAT_GETREF();
2065 tcps[TCP_STAT_PREDDAT]++;
2066 tcps[TCP_STAT_RCVPACK]++;
2067 tcps[TCP_STAT_RCVBYTE] += tlen;
2068 TCP_STAT_PUTREF();
2069 nd6_hint(tp);
2070
2071 /*
2072 * Automatic sizing enables the performance of large buffers
2073 * and most of the efficiency of small ones by only allocating
2074 * space when it is needed.
2075 *
2076 * On the receive side the socket buffer memory is only rarely
2077 * used to any significant extent. This allows us to be much
2078 * more aggressive in scaling the receive socket buffer. For
2079 * the case that the buffer space is actually used to a large
2080 * extent and we run out of kernel memory we can simply drop
2081 * the new segments; TCP on the sender will just retransmit it
2082 * later. Setting the buffer size too big may only consume too
2083 * much kernel memory if the application doesn't read() from
2084 * the socket or packet loss or reordering makes use of the
2085 * reassembly queue.
2086 *
2087 * The criteria to step up the receive buffer one notch are:
2088 * 1. the number of bytes received during the time it takes
2089 * one timestamp to be reflected back to us (the RTT);
2090 * 2. received bytes per RTT is within seven eighth of the
2091 * current socket buffer size;
2092 * 3. receive buffer size has not hit maximal automatic size;
2093 *
2094 * This algorithm does one step per RTT at most and only if
2095 * we receive a bulk stream w/o packet losses or reorderings.
2096 * Shrinking the buffer during idle times is not necessary as
2097 * it doesn't consume any memory when idle.
2098 *
2099 * TODO: Only step up if the application is actually serving
2100 * the buffer to better manage the socket buffer resources.
2101 */
2102 if (tcp_do_autorcvbuf &&
2103 opti.ts_ecr &&
2104 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
2105 if (opti.ts_ecr > tp->rfbuf_ts &&
2106 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
2107 if (tp->rfbuf_cnt >
2108 (so->so_rcv.sb_hiwat / 8 * 7) &&
2109 so->so_rcv.sb_hiwat <
2110 tcp_autorcvbuf_max) {
2111 newsize =
2112 min(so->so_rcv.sb_hiwat +
2113 tcp_autorcvbuf_inc,
2114 tcp_autorcvbuf_max);
2115 }
2116 /* Start over with next RTT. */
2117 tp->rfbuf_ts = 0;
2118 tp->rfbuf_cnt = 0;
2119 } else
2120 tp->rfbuf_cnt += tlen; /* add up */
2121 }
2122
2123 /*
2124 * Drop TCP, IP headers and TCP options then add data
2125 * to socket buffer.
2126 */
2127 if (so->so_state & SS_CANTRCVMORE)
2128 m_freem(m);
2129 else {
2130 /*
2131 * Set new socket buffer size.
2132 * Give up when limit is reached.
2133 */
2134 if (newsize)
2135 if (!sbreserve(&so->so_rcv,
2136 newsize, so))
2137 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
2138 m_adj(m, toff + off);
2139 sbappendstream(&so->so_rcv, m);
2140 }
2141 sorwakeup(so);
2142 tcp_setup_ack(tp, th);
2143 if (tp->t_flags & TF_ACKNOW) {
2144 KERNEL_LOCK(1, NULL);
2145 (void) tcp_output(tp);
2146 KERNEL_UNLOCK_ONE(NULL);
2147 }
2148 if (tcp_saveti)
2149 m_freem(tcp_saveti);
2150 return;
2151 }
2152 }
2153
2154 /*
2155 * Compute mbuf offset to TCP data segment.
2156 */
2157 hdroptlen = toff + off;
2158
2159 /*
2160 * Calculate amount of space in receive window,
2161 * and then do TCP input processing.
2162 * Receive window is amount of space in rcv queue,
2163 * but not less than advertised window.
2164 */
2165 { int win;
2166
2167 win = sbspace(&so->so_rcv);
2168 if (win < 0)
2169 win = 0;
2170 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2171 }
2172
2173 /* Reset receive buffer auto scaling when not in bulk receive mode. */
2174 tp->rfbuf_ts = 0;
2175 tp->rfbuf_cnt = 0;
2176
2177 switch (tp->t_state) {
2178 /*
2179 * If the state is SYN_SENT:
2180 * if seg contains an ACK, but not for our SYN, drop the input.
2181 * if seg contains a RST, then drop the connection.
2182 * if seg does not contain SYN, then drop it.
2183 * Otherwise this is an acceptable SYN segment
2184 * initialize tp->rcv_nxt and tp->irs
2185 * if seg contains ack then advance tp->snd_una
2186 * if seg contains a ECE and ECN support is enabled, the stream
2187 * is ECN capable.
2188 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2189 * arrange for segment to be acked (eventually)
2190 * continue processing rest of data/controls, beginning with URG
2191 */
2192 case TCPS_SYN_SENT:
2193 if ((tiflags & TH_ACK) &&
2194 (SEQ_LEQ(th->th_ack, tp->iss) ||
2195 SEQ_GT(th->th_ack, tp->snd_max)))
2196 goto dropwithreset;
2197 if (tiflags & TH_RST) {
2198 if (tiflags & TH_ACK)
2199 tp = tcp_drop(tp, ECONNREFUSED);
2200 goto drop;
2201 }
2202 if ((tiflags & TH_SYN) == 0)
2203 goto drop;
2204 if (tiflags & TH_ACK) {
2205 tp->snd_una = th->th_ack;
2206 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2207 tp->snd_nxt = tp->snd_una;
2208 if (SEQ_LT(tp->snd_high, tp->snd_una))
2209 tp->snd_high = tp->snd_una;
2210 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2211
2212 if ((tiflags & TH_ECE) && tcp_do_ecn) {
2213 tp->t_flags |= TF_ECN_PERMIT;
2214 TCP_STATINC(TCP_STAT_ECN_SHS);
2215 }
2216
2217 }
2218 tp->irs = th->th_seq;
2219 tcp_rcvseqinit(tp);
2220 tp->t_flags |= TF_ACKNOW;
2221 tcp_mss_from_peer(tp, opti.maxseg);
2222
2223 /*
2224 * Initialize the initial congestion window. If we
2225 * had to retransmit the SYN, we must initialize cwnd
2226 * to 1 segment (i.e. the Loss Window).
2227 */
2228 if (tp->t_flags & TF_SYN_REXMT)
2229 tp->snd_cwnd = tp->t_peermss;
2230 else {
2231 int ss = tcp_init_win;
2232 #ifdef INET
2233 if (inp != NULL && in_localaddr(inp->inp_faddr))
2234 ss = tcp_init_win_local;
2235 #endif
2236 #ifdef INET6
2237 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
2238 ss = tcp_init_win_local;
2239 #endif
2240 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
2241 }
2242
2243 tcp_rmx_rtt(tp);
2244 if (tiflags & TH_ACK) {
2245 TCP_STATINC(TCP_STAT_CONNECTS);
2246 /*
2247 * move tcp_established before soisconnected
2248 * because upcall handler can drive tcp_output
2249 * functionality.
2250 * XXX we might call soisconnected at the end of
2251 * all processing
2252 */
2253 tcp_established(tp);
2254 soisconnected(so);
2255 /* Do window scaling on this connection? */
2256 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2257 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2258 tp->snd_scale = tp->requested_s_scale;
2259 tp->rcv_scale = tp->request_r_scale;
2260 }
2261 TCP_REASS_LOCK(tp);
2262 (void) tcp_reass(tp, NULL, NULL, &tlen);
2263 /*
2264 * if we didn't have to retransmit the SYN,
2265 * use its rtt as our initial srtt & rtt var.
2266 */
2267 if (tp->t_rtttime)
2268 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2269 } else
2270 tp->t_state = TCPS_SYN_RECEIVED;
2271
2272 /*
2273 * Advance th->th_seq to correspond to first data byte.
2274 * If data, trim to stay within window,
2275 * dropping FIN if necessary.
2276 */
2277 th->th_seq++;
2278 if (tlen > tp->rcv_wnd) {
2279 todrop = tlen - tp->rcv_wnd;
2280 m_adj(m, -todrop);
2281 tlen = tp->rcv_wnd;
2282 tiflags &= ~TH_FIN;
2283 tcps = TCP_STAT_GETREF();
2284 tcps[TCP_STAT_RCVPACKAFTERWIN]++;
2285 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
2286 TCP_STAT_PUTREF();
2287 }
2288 tp->snd_wl1 = th->th_seq - 1;
2289 tp->rcv_up = th->th_seq;
2290 goto step6;
2291
2292 /*
2293 * If the state is SYN_RECEIVED:
2294 * If seg contains an ACK, but not for our SYN, drop the input
2295 * and generate an RST. See page 36, rfc793
2296 */
2297 case TCPS_SYN_RECEIVED:
2298 if ((tiflags & TH_ACK) &&
2299 (SEQ_LEQ(th->th_ack, tp->iss) ||
2300 SEQ_GT(th->th_ack, tp->snd_max)))
2301 goto dropwithreset;
2302 break;
2303 }
2304
2305 /*
2306 * States other than LISTEN or SYN_SENT.
2307 * First check timestamp, if present.
2308 * Then check that at least some bytes of segment are within
2309 * receive window. If segment begins before rcv_nxt,
2310 * drop leading data (and SYN); if nothing left, just ack.
2311 *
2312 * RFC 1323 PAWS: If we have a timestamp reply on this segment
2313 * and it's less than ts_recent, drop it.
2314 */
2315 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2316 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2317
2318 /* Check to see if ts_recent is over 24 days old. */
2319 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2320 /*
2321 * Invalidate ts_recent. If this segment updates
2322 * ts_recent, the age will be reset later and ts_recent
2323 * will get a valid value. If it does not, setting
2324 * ts_recent to zero will at least satisfy the
2325 * requirement that zero be placed in the timestamp
2326 * echo reply when ts_recent isn't valid. The
2327 * age isn't reset until we get a valid ts_recent
2328 * because we don't want out-of-order segments to be
2329 * dropped when ts_recent is old.
2330 */
2331 tp->ts_recent = 0;
2332 } else {
2333 tcps = TCP_STAT_GETREF();
2334 tcps[TCP_STAT_RCVDUPPACK]++;
2335 tcps[TCP_STAT_RCVDUPBYTE] += tlen;
2336 tcps[TCP_STAT_PAWSDROP]++;
2337 TCP_STAT_PUTREF();
2338 tcp_new_dsack(tp, th->th_seq, tlen);
2339 goto dropafterack;
2340 }
2341 }
2342
2343 todrop = tp->rcv_nxt - th->th_seq;
2344 dupseg = false;
2345 if (todrop > 0) {
2346 if (tiflags & TH_SYN) {
2347 tiflags &= ~TH_SYN;
2348 th->th_seq++;
2349 if (th->th_urp > 1)
2350 th->th_urp--;
2351 else {
2352 tiflags &= ~TH_URG;
2353 th->th_urp = 0;
2354 }
2355 todrop--;
2356 }
2357 if (todrop > tlen ||
2358 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2359 /*
2360 * Any valid FIN or RST must be to the left of the
2361 * window. At this point the FIN or RST must be a
2362 * duplicate or out of sequence; drop it.
2363 */
2364 if (tiflags & TH_RST)
2365 goto drop;
2366 tiflags &= ~(TH_FIN|TH_RST);
2367 /*
2368 * Send an ACK to resynchronize and drop any data.
2369 * But keep on processing for RST or ACK.
2370 */
2371 tp->t_flags |= TF_ACKNOW;
2372 todrop = tlen;
2373 dupseg = true;
2374 tcps = TCP_STAT_GETREF();
2375 tcps[TCP_STAT_RCVDUPPACK]++;
2376 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
2377 TCP_STAT_PUTREF();
2378 } else if ((tiflags & TH_RST) &&
2379 th->th_seq != tp->rcv_nxt) {
2380 /*
2381 * Test for reset before adjusting the sequence
2382 * number for overlapping data.
2383 */
2384 goto dropafterack_ratelim;
2385 } else {
2386 tcps = TCP_STAT_GETREF();
2387 tcps[TCP_STAT_RCVPARTDUPPACK]++;
2388 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
2389 TCP_STAT_PUTREF();
2390 }
2391 tcp_new_dsack(tp, th->th_seq, todrop);
2392 hdroptlen += todrop; /*drop from head afterwards*/
2393 th->th_seq += todrop;
2394 tlen -= todrop;
2395 if (th->th_urp > todrop)
2396 th->th_urp -= todrop;
2397 else {
2398 tiflags &= ~TH_URG;
2399 th->th_urp = 0;
2400 }
2401 }
2402
2403 /*
2404 * If new data are received on a connection after the
2405 * user processes are gone, then RST the other end.
2406 */
2407 if ((so->so_state & SS_NOFDREF) &&
2408 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2409 tp = tcp_close(tp);
2410 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2411 goto dropwithreset;
2412 }
2413
2414 /*
2415 * If segment ends after window, drop trailing data
2416 * (and PUSH and FIN); if nothing left, just ACK.
2417 */
2418 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
2419 if (todrop > 0) {
2420 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2421 if (todrop >= tlen) {
2422 /*
2423 * The segment actually starts after the window.
2424 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2425 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2426 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2427 */
2428 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2429 /*
2430 * If a new connection request is received
2431 * while in TIME_WAIT, drop the old connection
2432 * and start over if the sequence numbers
2433 * are above the previous ones.
2434 *
2435 * NOTE: We will checksum the packet again, and
2436 * so we need to put the header fields back into
2437 * network order!
2438 * XXX This kind of sucks, but we don't expect
2439 * XXX this to happen very often, so maybe it
2440 * XXX doesn't matter so much.
2441 */
2442 if (tiflags & TH_SYN &&
2443 tp->t_state == TCPS_TIME_WAIT &&
2444 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2445 tp = tcp_close(tp);
2446 tcp_fields_to_net(th);
2447 goto findpcb;
2448 }
2449 /*
2450 * If window is closed can only take segments at
2451 * window edge, and have to drop data and PUSH from
2452 * incoming segments. Continue processing, but
2453 * remember to ack. Otherwise, drop segment
2454 * and (if not RST) ack.
2455 */
2456 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2457 tp->t_flags |= TF_ACKNOW;
2458 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2459 } else
2460 goto dropafterack;
2461 } else
2462 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2463 m_adj(m, -todrop);
2464 tlen -= todrop;
2465 tiflags &= ~(TH_PUSH|TH_FIN);
2466 }
2467
2468 /*
2469 * If last ACK falls within this segment's sequence numbers,
2470 * record the timestamp.
2471 * NOTE:
2472 * 1) That the test incorporates suggestions from the latest
2473 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26).
2474 * 2) That updating only on newer timestamps interferes with
2475 * our earlier PAWS tests, so this check should be solely
2476 * predicated on the sequence space of this segment.
2477 * 3) That we modify the segment boundary check to be
2478 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2479 * instead of RFC1323's
2480 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2481 * This modified check allows us to overcome RFC1323's
2482 * limitations as described in Stevens TCP/IP Illustrated
2483 * Vol. 2 p.869. In such cases, we can still calculate the
2484 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2485 */
2486 if (opti.ts_present &&
2487 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2488 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2489 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2490 tp->ts_recent_age = tcp_now;
2491 tp->ts_recent = opti.ts_val;
2492 }
2493
2494 /*
2495 * If the RST bit is set examine the state:
2496 * SYN_RECEIVED STATE:
2497 * If passive open, return to LISTEN state.
2498 * If active open, inform user that connection was refused.
2499 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
2500 * Inform user that connection was reset, and close tcb.
2501 * CLOSING, LAST_ACK, TIME_WAIT STATES
2502 * Close the tcb.
2503 */
2504 if (tiflags & TH_RST) {
2505 if (th->th_seq != tp->rcv_nxt)
2506 goto dropafterack_ratelim;
2507
2508 switch (tp->t_state) {
2509 case TCPS_SYN_RECEIVED:
2510 so->so_error = ECONNREFUSED;
2511 goto close;
2512
2513 case TCPS_ESTABLISHED:
2514 case TCPS_FIN_WAIT_1:
2515 case TCPS_FIN_WAIT_2:
2516 case TCPS_CLOSE_WAIT:
2517 so->so_error = ECONNRESET;
2518 close:
2519 tp->t_state = TCPS_CLOSED;
2520 TCP_STATINC(TCP_STAT_DROPS);
2521 tp = tcp_close(tp);
2522 goto drop;
2523
2524 case TCPS_CLOSING:
2525 case TCPS_LAST_ACK:
2526 case TCPS_TIME_WAIT:
2527 tp = tcp_close(tp);
2528 goto drop;
2529 }
2530 }
2531
2532 /*
2533 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2534 * we must be in a synchronized state. RFC791 states (under RST
2535 * generation) that any unacceptable segment (an out-of-order SYN
2536 * qualifies) received in a synchronized state must elicit only an
2537 * empty acknowledgment segment ... and the connection remains in
2538 * the same state.
2539 */
2540 if (tiflags & TH_SYN) {
2541 if (tp->rcv_nxt == th->th_seq) {
2542 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2543 TH_ACK);
2544 if (tcp_saveti)
2545 m_freem(tcp_saveti);
2546 return;
2547 }
2548
2549 goto dropafterack_ratelim;
2550 }
2551
2552 /*
2553 * If the ACK bit is off we drop the segment and return.
2554 */
2555 if ((tiflags & TH_ACK) == 0) {
2556 if (tp->t_flags & TF_ACKNOW)
2557 goto dropafterack;
2558 else
2559 goto drop;
2560 }
2561
2562 /*
2563 * Ack processing.
2564 */
2565 switch (tp->t_state) {
2566
2567 /*
2568 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2569 * ESTABLISHED state and continue processing, otherwise
2570 * send an RST.
2571 */
2572 case TCPS_SYN_RECEIVED:
2573 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2574 SEQ_GT(th->th_ack, tp->snd_max))
2575 goto dropwithreset;
2576 TCP_STATINC(TCP_STAT_CONNECTS);
2577 soisconnected(so);
2578 tcp_established(tp);
2579 /* Do window scaling? */
2580 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2581 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2582 tp->snd_scale = tp->requested_s_scale;
2583 tp->rcv_scale = tp->request_r_scale;
2584 }
2585 TCP_REASS_LOCK(tp);
2586 (void) tcp_reass(tp, NULL, NULL, &tlen);
2587 tp->snd_wl1 = th->th_seq - 1;
2588 /* fall into ... */
2589
2590 /*
2591 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2592 * ACKs. If the ack is in the range
2593 * tp->snd_una < th->th_ack <= tp->snd_max
2594 * then advance tp->snd_una to th->th_ack and drop
2595 * data from the retransmission queue. If this ACK reflects
2596 * more up to date window information we update our window information.
2597 */
2598 case TCPS_ESTABLISHED:
2599 case TCPS_FIN_WAIT_1:
2600 case TCPS_FIN_WAIT_2:
2601 case TCPS_CLOSE_WAIT:
2602 case TCPS_CLOSING:
2603 case TCPS_LAST_ACK:
2604 case TCPS_TIME_WAIT:
2605
2606 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2607 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2608 TCP_STATINC(TCP_STAT_RCVDUPACK);
2609 /*
2610 * If we have outstanding data (other than
2611 * a window probe), this is a completely
2612 * duplicate ack (ie, window info didn't
2613 * change), the ack is the biggest we've
2614 * seen and we've seen exactly our rexmt
2615 * threshhold of them, assume a packet
2616 * has been dropped and retransmit it.
2617 * Kludge snd_nxt & the congestion
2618 * window so we send only this one
2619 * packet.
2620 */
2621 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2622 th->th_ack != tp->snd_una)
2623 tp->t_dupacks = 0;
2624 else if (tp->t_partialacks < 0 &&
2625 (++tp->t_dupacks == tcprexmtthresh ||
2626 TCP_FACK_FASTRECOV(tp))) {
2627 /*
2628 * Do the fast retransmit, and adjust
2629 * congestion control paramenters.
2630 */
2631 if (tp->t_congctl->fast_retransmit(tp, th)) {
2632 /* False fast retransmit */
2633 break;
2634 } else
2635 goto drop;
2636 } else if (tp->t_dupacks > tcprexmtthresh) {
2637 tp->snd_cwnd += tp->t_segsz;
2638 KERNEL_LOCK(1, NULL);
2639 (void) tcp_output(tp);
2640 KERNEL_UNLOCK_ONE(NULL);
2641 goto drop;
2642 }
2643 } else {
2644 /*
2645 * If the ack appears to be very old, only
2646 * allow data that is in-sequence. This
2647 * makes it somewhat more difficult to insert
2648 * forged data by guessing sequence numbers.
2649 * Sent an ack to try to update the send
2650 * sequence number on the other side.
2651 */
2652 if (tlen && th->th_seq != tp->rcv_nxt &&
2653 SEQ_LT(th->th_ack,
2654 tp->snd_una - tp->max_sndwnd))
2655 goto dropafterack;
2656 }
2657 break;
2658 }
2659 /*
2660 * If the congestion window was inflated to account
2661 * for the other side's cached packets, retract it.
2662 */
2663 tp->t_congctl->fast_retransmit_newack(tp, th);
2664
2665 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2666 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2667 goto dropafterack;
2668 }
2669 acked = th->th_ack - tp->snd_una;
2670 tcps = TCP_STAT_GETREF();
2671 tcps[TCP_STAT_RCVACKPACK]++;
2672 tcps[TCP_STAT_RCVACKBYTE] += acked;
2673 TCP_STAT_PUTREF();
2674
2675 /*
2676 * If we have a timestamp reply, update smoothed
2677 * round trip time. If no timestamp is present but
2678 * transmit timer is running and timed sequence
2679 * number was acked, update smoothed round trip time.
2680 * Since we now have an rtt measurement, cancel the
2681 * timer backoff (cf., Phil Karn's retransmit alg.).
2682 * Recompute the initial retransmit timer.
2683 */
2684 if (ts_rtt)
2685 tcp_xmit_timer(tp, ts_rtt - 1);
2686 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2687 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2688
2689 /*
2690 * If all outstanding data is acked, stop retransmit
2691 * timer and remember to restart (more output or persist).
2692 * If there is more data to be acked, restart retransmit
2693 * timer, using current (possibly backed-off) value.
2694 */
2695 if (th->th_ack == tp->snd_max) {
2696 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2697 needoutput = 1;
2698 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2699 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2700
2701 /*
2702 * New data has been acked, adjust the congestion window.
2703 */
2704 tp->t_congctl->newack(tp, th);
2705
2706 nd6_hint(tp);
2707 if (acked > so->so_snd.sb_cc) {
2708 tp->snd_wnd -= so->so_snd.sb_cc;
2709 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2710 ourfinisacked = 1;
2711 } else {
2712 if (acked > (tp->t_lastoff - tp->t_inoff))
2713 tp->t_lastm = NULL;
2714 sbdrop(&so->so_snd, acked);
2715 tp->t_lastoff -= acked;
2716 tp->snd_wnd -= acked;
2717 ourfinisacked = 0;
2718 }
2719 sowwakeup(so);
2720
2721 icmp_check(tp, th, acked);
2722
2723 tp->snd_una = th->th_ack;
2724 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2725 tp->snd_fack = tp->snd_una;
2726 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2727 tp->snd_nxt = tp->snd_una;
2728 if (SEQ_LT(tp->snd_high, tp->snd_una))
2729 tp->snd_high = tp->snd_una;
2730
2731 switch (tp->t_state) {
2732
2733 /*
2734 * In FIN_WAIT_1 STATE in addition to the processing
2735 * for the ESTABLISHED state if our FIN is now acknowledged
2736 * then enter FIN_WAIT_2.
2737 */
2738 case TCPS_FIN_WAIT_1:
2739 if (ourfinisacked) {
2740 /*
2741 * If we can't receive any more
2742 * data, then closing user can proceed.
2743 * Starting the timer is contrary to the
2744 * specification, but if we don't get a FIN
2745 * we'll hang forever.
2746 */
2747 if (so->so_state & SS_CANTRCVMORE) {
2748 soisdisconnected(so);
2749 if (tp->t_maxidle > 0)
2750 TCP_TIMER_ARM(tp, TCPT_2MSL,
2751 tp->t_maxidle);
2752 }
2753 tp->t_state = TCPS_FIN_WAIT_2;
2754 }
2755 break;
2756
2757 /*
2758 * In CLOSING STATE in addition to the processing for
2759 * the ESTABLISHED state if the ACK acknowledges our FIN
2760 * then enter the TIME-WAIT state, otherwise ignore
2761 * the segment.
2762 */
2763 case TCPS_CLOSING:
2764 if (ourfinisacked) {
2765 tp->t_state = TCPS_TIME_WAIT;
2766 tcp_canceltimers(tp);
2767 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2768 soisdisconnected(so);
2769 }
2770 break;
2771
2772 /*
2773 * In LAST_ACK, we may still be waiting for data to drain
2774 * and/or to be acked, as well as for the ack of our FIN.
2775 * If our FIN is now acknowledged, delete the TCB,
2776 * enter the closed state and return.
2777 */
2778 case TCPS_LAST_ACK:
2779 if (ourfinisacked) {
2780 tp = tcp_close(tp);
2781 goto drop;
2782 }
2783 break;
2784
2785 /*
2786 * In TIME_WAIT state the only thing that should arrive
2787 * is a retransmission of the remote FIN. Acknowledge
2788 * it and restart the finack timer.
2789 */
2790 case TCPS_TIME_WAIT:
2791 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2792 goto dropafterack;
2793 }
2794 }
2795
2796 step6:
2797 /*
2798 * Update window information.
2799 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2800 */
2801 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2802 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2803 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2804 /* keep track of pure window updates */
2805 if (tlen == 0 &&
2806 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2807 TCP_STATINC(TCP_STAT_RCVWINUPD);
2808 tp->snd_wnd = tiwin;
2809 tp->snd_wl1 = th->th_seq;
2810 tp->snd_wl2 = th->th_ack;
2811 if (tp->snd_wnd > tp->max_sndwnd)
2812 tp->max_sndwnd = tp->snd_wnd;
2813 needoutput = 1;
2814 }
2815
2816 /*
2817 * Process segments with URG.
2818 */
2819 if ((tiflags & TH_URG) && th->th_urp &&
2820 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2821 /*
2822 * This is a kludge, but if we receive and accept
2823 * random urgent pointers, we'll crash in
2824 * soreceive. It's hard to imagine someone
2825 * actually wanting to send this much urgent data.
2826 */
2827 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2828 th->th_urp = 0; /* XXX */
2829 tiflags &= ~TH_URG; /* XXX */
2830 goto dodata; /* XXX */
2831 }
2832 /*
2833 * If this segment advances the known urgent pointer,
2834 * then mark the data stream. This should not happen
2835 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2836 * a FIN has been received from the remote side.
2837 * In these states we ignore the URG.
2838 *
2839 * According to RFC961 (Assigned Protocols),
2840 * the urgent pointer points to the last octet
2841 * of urgent data. We continue, however,
2842 * to consider it to indicate the first octet
2843 * of data past the urgent section as the original
2844 * spec states (in one of two places).
2845 */
2846 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2847 tp->rcv_up = th->th_seq + th->th_urp;
2848 so->so_oobmark = so->so_rcv.sb_cc +
2849 (tp->rcv_up - tp->rcv_nxt) - 1;
2850 if (so->so_oobmark == 0)
2851 so->so_state |= SS_RCVATMARK;
2852 sohasoutofband(so);
2853 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2854 }
2855 /*
2856 * Remove out of band data so doesn't get presented to user.
2857 * This can happen independent of advancing the URG pointer,
2858 * but if two URG's are pending at once, some out-of-band
2859 * data may creep in... ick.
2860 */
2861 if (th->th_urp <= (u_int16_t) tlen
2862 #ifdef SO_OOBINLINE
2863 && (so->so_options & SO_OOBINLINE) == 0
2864 #endif
2865 )
2866 tcp_pulloutofband(so, th, m, hdroptlen);
2867 } else
2868 /*
2869 * If no out of band data is expected,
2870 * pull receive urgent pointer along
2871 * with the receive window.
2872 */
2873 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2874 tp->rcv_up = tp->rcv_nxt;
2875 dodata: /* XXX */
2876
2877 /*
2878 * Process the segment text, merging it into the TCP sequencing queue,
2879 * and arranging for acknowledgement of receipt if necessary.
2880 * This process logically involves adjusting tp->rcv_wnd as data
2881 * is presented to the user (this happens in tcp_usrreq.c,
2882 * tcp_rcvd()). If a FIN has already been received on this
2883 * connection then we just ignore the text.
2884 */
2885 if ((tlen || (tiflags & TH_FIN)) &&
2886 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2887 /*
2888 * Insert segment ti into reassembly queue of tcp with
2889 * control block tp. Return TH_FIN if reassembly now includes
2890 * a segment with FIN. The macro form does the common case
2891 * inline (segment is the next to be received on an
2892 * established connection, and the queue is empty),
2893 * avoiding linkage into and removal from the queue and
2894 * repetition of various conversions.
2895 * Set DELACK for segments received in order, but ack
2896 * immediately when segments are out of order
2897 * (so fast retransmit can work).
2898 */
2899 /* NOTE: this was TCP_REASS() macro, but used only once */
2900 TCP_REASS_LOCK(tp);
2901 if (th->th_seq == tp->rcv_nxt &&
2902 TAILQ_FIRST(&tp->segq) == NULL &&
2903 tp->t_state == TCPS_ESTABLISHED) {
2904 tcp_setup_ack(tp, th);
2905 tp->rcv_nxt += tlen;
2906 tiflags = th->th_flags & TH_FIN;
2907 tcps = TCP_STAT_GETREF();
2908 tcps[TCP_STAT_RCVPACK]++;
2909 tcps[TCP_STAT_RCVBYTE] += tlen;
2910 TCP_STAT_PUTREF();
2911 nd6_hint(tp);
2912 if (so->so_state & SS_CANTRCVMORE)
2913 m_freem(m);
2914 else {
2915 m_adj(m, hdroptlen);
2916 sbappendstream(&(so)->so_rcv, m);
2917 }
2918 TCP_REASS_UNLOCK(tp);
2919 sorwakeup(so);
2920 } else {
2921 m_adj(m, hdroptlen);
2922 tiflags = tcp_reass(tp, th, m, &tlen);
2923 tp->t_flags |= TF_ACKNOW;
2924 }
2925
2926 /*
2927 * Note the amount of data that peer has sent into
2928 * our window, in order to estimate the sender's
2929 * buffer size.
2930 */
2931 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2932 } else {
2933 m_freem(m);
2934 m = NULL;
2935 tiflags &= ~TH_FIN;
2936 }
2937
2938 /*
2939 * If FIN is received ACK the FIN and let the user know
2940 * that the connection is closing. Ignore a FIN received before
2941 * the connection is fully established.
2942 */
2943 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2944 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2945 socantrcvmore(so);
2946 tp->t_flags |= TF_ACKNOW;
2947 tp->rcv_nxt++;
2948 }
2949 switch (tp->t_state) {
2950
2951 /*
2952 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2953 */
2954 case TCPS_ESTABLISHED:
2955 tp->t_state = TCPS_CLOSE_WAIT;
2956 break;
2957
2958 /*
2959 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2960 * enter the CLOSING state.
2961 */
2962 case TCPS_FIN_WAIT_1:
2963 tp->t_state = TCPS_CLOSING;
2964 break;
2965
2966 /*
2967 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2968 * starting the time-wait timer, turning off the other
2969 * standard timers.
2970 */
2971 case TCPS_FIN_WAIT_2:
2972 tp->t_state = TCPS_TIME_WAIT;
2973 tcp_canceltimers(tp);
2974 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2975 soisdisconnected(so);
2976 break;
2977
2978 /*
2979 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2980 */
2981 case TCPS_TIME_WAIT:
2982 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2983 break;
2984 }
2985 }
2986 #ifdef TCP_DEBUG
2987 if (so->so_options & SO_DEBUG)
2988 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2989 #endif
2990
2991 /*
2992 * Return any desired output.
2993 */
2994 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
2995 KERNEL_LOCK(1, NULL);
2996 (void) tcp_output(tp);
2997 KERNEL_UNLOCK_ONE(NULL);
2998 }
2999 if (tcp_saveti)
3000 m_freem(tcp_saveti);
3001
3002 if (tp->t_state == TCPS_TIME_WAIT
3003 && (so->so_state & SS_NOFDREF)
3004 && (tp->t_inpcb || af != AF_INET)
3005 && (tp->t_in6pcb || af != AF_INET6)
3006 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0
3007 && TAILQ_EMPTY(&tp->segq)
3008 && vtw_add(af, tp)) {
3009 ;
3010 }
3011 return;
3012
3013 badsyn:
3014 /*
3015 * Received a bad SYN. Increment counters and dropwithreset.
3016 */
3017 TCP_STATINC(TCP_STAT_BADSYN);
3018 tp = NULL;
3019 goto dropwithreset;
3020
3021 dropafterack:
3022 /*
3023 * Generate an ACK dropping incoming segment if it occupies
3024 * sequence space, where the ACK reflects our state.
3025 */
3026 if (tiflags & TH_RST)
3027 goto drop;
3028 goto dropafterack2;
3029
3030 dropafterack_ratelim:
3031 /*
3032 * We may want to rate-limit ACKs against SYN/RST attack.
3033 */
3034 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
3035 tcp_ackdrop_ppslim) == 0) {
3036 /* XXX stat */
3037 goto drop;
3038 }
3039 /* ...fall into dropafterack2... */
3040
3041 dropafterack2:
3042 m_freem(m);
3043 tp->t_flags |= TF_ACKNOW;
3044 KERNEL_LOCK(1, NULL);
3045 (void) tcp_output(tp);
3046 KERNEL_UNLOCK_ONE(NULL);
3047 if (tcp_saveti)
3048 m_freem(tcp_saveti);
3049 return;
3050
3051 dropwithreset_ratelim:
3052 /*
3053 * We may want to rate-limit RSTs in certain situations,
3054 * particularly if we are sending an RST in response to
3055 * an attempt to connect to or otherwise communicate with
3056 * a port for which we have no socket.
3057 */
3058 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
3059 tcp_rst_ppslim) == 0) {
3060 /* XXX stat */
3061 goto drop;
3062 }
3063 /* ...fall into dropwithreset... */
3064
3065 dropwithreset:
3066 /*
3067 * Generate a RST, dropping incoming segment.
3068 * Make ACK acceptable to originator of segment.
3069 */
3070 if (tiflags & TH_RST)
3071 goto drop;
3072
3073 switch (af) {
3074 #ifdef INET6
3075 case AF_INET6:
3076 /* For following calls to tcp_respond */
3077 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
3078 goto drop;
3079 break;
3080 #endif /* INET6 */
3081 case AF_INET:
3082 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
3083 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
3084 goto drop;
3085 }
3086
3087 if (tiflags & TH_ACK)
3088 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
3089 else {
3090 if (tiflags & TH_SYN)
3091 tlen++;
3092 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
3093 TH_RST|TH_ACK);
3094 }
3095 if (tcp_saveti)
3096 m_freem(tcp_saveti);
3097 return;
3098
3099 badcsum:
3100 drop:
3101 /*
3102 * Drop space held by incoming segment and return.
3103 */
3104 if (tp) {
3105 if (tp->t_inpcb)
3106 so = tp->t_inpcb->inp_socket;
3107 #ifdef INET6
3108 else if (tp->t_in6pcb)
3109 so = tp->t_in6pcb->in6p_socket;
3110 #endif
3111 else
3112 so = NULL;
3113 #ifdef TCP_DEBUG
3114 if (so && (so->so_options & SO_DEBUG) != 0)
3115 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
3116 #endif
3117 }
3118 if (tcp_saveti)
3119 m_freem(tcp_saveti);
3120 m_freem(m);
3121 return;
3122 }
3123
3124 #ifdef TCP_SIGNATURE
3125 int
3126 tcp_signature_apply(void *fstate, void *data, u_int len)
3127 {
3128
3129 MD5Update(fstate, (u_char *)data, len);
3130 return (0);
3131 }
3132
3133 struct secasvar *
3134 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th)
3135 {
3136 struct ip *ip;
3137 struct ip6_hdr *ip6;
3138
3139 ip = mtod(m, struct ip *);
3140 switch (ip->ip_v) {
3141 case 4:
3142 ip = mtod(m, struct ip *);
3143 ip6 = NULL;
3144 break;
3145 case 6:
3146 ip = NULL;
3147 ip6 = mtod(m, struct ip6_hdr *);
3148 break;
3149 default:
3150 return (NULL);
3151 }
3152
3153 #ifdef IPSEC
3154 if (ipsec_used) {
3155 union sockaddr_union dst;
3156 /* Extract the destination from the IP header in the mbuf. */
3157 memset(&dst, 0, sizeof(union sockaddr_union));
3158 if (ip != NULL) {
3159 dst.sa.sa_len = sizeof(struct sockaddr_in);
3160 dst.sa.sa_family = AF_INET;
3161 dst.sin.sin_addr = ip->ip_dst;
3162 } else {
3163 dst.sa.sa_len = sizeof(struct sockaddr_in6);
3164 dst.sa.sa_family = AF_INET6;
3165 dst.sin6.sin6_addr = ip6->ip6_dst;
3166 }
3167
3168 /*
3169 * Look up an SADB entry which matches the address of the peer.
3170 */
3171 return KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0);
3172 }
3173 return NULL;
3174 #else
3175 if (ip)
3176 return key_allocsa(AF_INET, (void *)&ip->ip_src,
3177 (void *)&ip->ip_dst, IPPROTO_TCP,
3178 htonl(TCP_SIG_SPI), 0, 0);
3179 else
3180 return key_allocsa(AF_INET6, (void *)&ip6->ip6_src,
3181 (void *)&ip6->ip6_dst, IPPROTO_TCP,
3182 htonl(TCP_SIG_SPI), 0, 0);
3183 #endif
3184 }
3185
3186 int
3187 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
3188 struct secasvar *sav, char *sig)
3189 {
3190 MD5_CTX ctx;
3191 struct ip *ip;
3192 struct ipovly *ipovly;
3193 struct ip6_hdr *ip6;
3194 struct ippseudo ippseudo;
3195 struct ip6_hdr_pseudo ip6pseudo;
3196 struct tcphdr th0;
3197 int l, tcphdrlen;
3198
3199 if (sav == NULL)
3200 return (-1);
3201
3202 tcphdrlen = th->th_off * 4;
3203
3204 switch (mtod(m, struct ip *)->ip_v) {
3205 case 4:
3206 ip = mtod(m, struct ip *);
3207 ip6 = NULL;
3208 break;
3209 case 6:
3210 ip = NULL;
3211 ip6 = mtod(m, struct ip6_hdr *);
3212 break;
3213 default:
3214 return (-1);
3215 }
3216
3217 MD5Init(&ctx);
3218
3219 if (ip) {
3220 memset(&ippseudo, 0, sizeof(ippseudo));
3221 ipovly = (struct ipovly *)ip;
3222 ippseudo.ippseudo_src = ipovly->ih_src;
3223 ippseudo.ippseudo_dst = ipovly->ih_dst;
3224 ippseudo.ippseudo_pad = 0;
3225 ippseudo.ippseudo_p = IPPROTO_TCP;
3226 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
3227 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
3228 } else {
3229 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
3230 ip6pseudo.ip6ph_src = ip6->ip6_src;
3231 in6_clearscope(&ip6pseudo.ip6ph_src);
3232 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
3233 in6_clearscope(&ip6pseudo.ip6ph_dst);
3234 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
3235 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
3236 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
3237 }
3238
3239 th0 = *th;
3240 th0.th_sum = 0;
3241 MD5Update(&ctx, (char *)&th0, sizeof(th0));
3242
3243 l = m->m_pkthdr.len - thoff - tcphdrlen;
3244 if (l > 0)
3245 m_apply(m, thoff + tcphdrlen,
3246 m->m_pkthdr.len - thoff - tcphdrlen,
3247 tcp_signature_apply, &ctx);
3248
3249 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
3250 MD5Final(sig, &ctx);
3251
3252 return (0);
3253 }
3254 #endif
3255
3256 /*
3257 * tcp_dooptions: parse and process tcp options.
3258 *
3259 * returns -1 if this segment should be dropped. (eg. wrong signature)
3260 * otherwise returns 0.
3261 */
3262
3263 static int
3264 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt,
3265 struct tcphdr *th,
3266 struct mbuf *m, int toff, struct tcp_opt_info *oi)
3267 {
3268 u_int16_t mss;
3269 int opt, optlen = 0;
3270 #ifdef TCP_SIGNATURE
3271 void *sigp = NULL;
3272 char sigbuf[TCP_SIGLEN];
3273 struct secasvar *sav = NULL;
3274 #endif
3275
3276 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
3277 opt = cp[0];
3278 if (opt == TCPOPT_EOL)
3279 break;
3280 if (opt == TCPOPT_NOP)
3281 optlen = 1;
3282 else {
3283 if (cnt < 2)
3284 break;
3285 optlen = cp[1];
3286 if (optlen < 2 || optlen > cnt)
3287 break;
3288 }
3289 switch (opt) {
3290
3291 default:
3292 continue;
3293
3294 case TCPOPT_MAXSEG:
3295 if (optlen != TCPOLEN_MAXSEG)
3296 continue;
3297 if (!(th->th_flags & TH_SYN))
3298 continue;
3299 if (TCPS_HAVERCVDSYN(tp->t_state))
3300 continue;
3301 bcopy(cp + 2, &mss, sizeof(mss));
3302 oi->maxseg = ntohs(mss);
3303 break;
3304
3305 case TCPOPT_WINDOW:
3306 if (optlen != TCPOLEN_WINDOW)
3307 continue;
3308 if (!(th->th_flags & TH_SYN))
3309 continue;
3310 if (TCPS_HAVERCVDSYN(tp->t_state))
3311 continue;
3312 tp->t_flags |= TF_RCVD_SCALE;
3313 tp->requested_s_scale = cp[2];
3314 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3315 #if 0 /*XXX*/
3316 char *p;
3317
3318 if (ip)
3319 p = ntohl(ip->ip_src);
3320 #ifdef INET6
3321 else if (ip6)
3322 p = ip6_sprintf(&ip6->ip6_src);
3323 #endif
3324 else
3325 p = "(unknown)";
3326 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3327 "assuming %d\n",
3328 tp->requested_s_scale, p,
3329 TCP_MAX_WINSHIFT);
3330 #else
3331 log(LOG_ERR, "TCP: invalid wscale %d, "
3332 "assuming %d\n",
3333 tp->requested_s_scale,
3334 TCP_MAX_WINSHIFT);
3335 #endif
3336 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3337 }
3338 break;
3339
3340 case TCPOPT_TIMESTAMP:
3341 if (optlen != TCPOLEN_TIMESTAMP)
3342 continue;
3343 oi->ts_present = 1;
3344 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
3345 NTOHL(oi->ts_val);
3346 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
3347 NTOHL(oi->ts_ecr);
3348
3349 if (!(th->th_flags & TH_SYN))
3350 continue;
3351 if (TCPS_HAVERCVDSYN(tp->t_state))
3352 continue;
3353 /*
3354 * A timestamp received in a SYN makes
3355 * it ok to send timestamp requests and replies.
3356 */
3357 tp->t_flags |= TF_RCVD_TSTMP;
3358 tp->ts_recent = oi->ts_val;
3359 tp->ts_recent_age = tcp_now;
3360 break;
3361
3362 case TCPOPT_SACK_PERMITTED:
3363 if (optlen != TCPOLEN_SACK_PERMITTED)
3364 continue;
3365 if (!(th->th_flags & TH_SYN))
3366 continue;
3367 if (TCPS_HAVERCVDSYN(tp->t_state))
3368 continue;
3369 if (tcp_do_sack) {
3370 tp->t_flags |= TF_SACK_PERMIT;
3371 tp->t_flags |= TF_WILL_SACK;
3372 }
3373 break;
3374
3375 case TCPOPT_SACK:
3376 tcp_sack_option(tp, th, cp, optlen);
3377 break;
3378 #ifdef TCP_SIGNATURE
3379 case TCPOPT_SIGNATURE:
3380 if (optlen != TCPOLEN_SIGNATURE)
3381 continue;
3382 if (sigp && memcmp(sigp, cp + 2, TCP_SIGLEN))
3383 return (-1);
3384
3385 sigp = sigbuf;
3386 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3387 tp->t_flags |= TF_SIGNATURE;
3388 break;
3389 #endif
3390 }
3391 }
3392
3393 #ifndef TCP_SIGNATURE
3394 return 0;
3395 #else
3396 if (tp->t_flags & TF_SIGNATURE) {
3397
3398 sav = tcp_signature_getsav(m, th);
3399
3400 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3401 return (-1);
3402 }
3403
3404 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE))
3405 goto out;
3406
3407 if (sigp) {
3408 char sig[TCP_SIGLEN];
3409
3410 tcp_fields_to_net(th);
3411 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3412 tcp_fields_to_host(th);
3413 goto out;
3414 }
3415 tcp_fields_to_host(th);
3416
3417 if (memcmp(sig, sigp, TCP_SIGLEN)) {
3418 TCP_STATINC(TCP_STAT_BADSIG);
3419 goto out;
3420 } else
3421 TCP_STATINC(TCP_STAT_GOODSIG);
3422
3423 key_sa_recordxfer(sav, m);
3424 KEY_FREESAV(&sav);
3425 }
3426 return 0;
3427 out:
3428 if (sav != NULL)
3429 KEY_FREESAV(&sav);
3430 return -1;
3431 #endif
3432 }
3433
3434 /*
3435 * Pull out of band byte out of a segment so
3436 * it doesn't appear in the user's data queue.
3437 * It is still reflected in the segment length for
3438 * sequencing purposes.
3439 */
3440 void
3441 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3442 struct mbuf *m, int off)
3443 {
3444 int cnt = off + th->th_urp - 1;
3445
3446 while (cnt >= 0) {
3447 if (m->m_len > cnt) {
3448 char *cp = mtod(m, char *) + cnt;
3449 struct tcpcb *tp = sototcpcb(so);
3450
3451 tp->t_iobc = *cp;
3452 tp->t_oobflags |= TCPOOB_HAVEDATA;
3453 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3454 m->m_len--;
3455 return;
3456 }
3457 cnt -= m->m_len;
3458 m = m->m_next;
3459 if (m == 0)
3460 break;
3461 }
3462 panic("tcp_pulloutofband");
3463 }
3464
3465 /*
3466 * Collect new round-trip time estimate
3467 * and update averages and current timeout.
3468 *
3469 * rtt is in units of slow ticks (typically 500 ms) -- essentially the
3470 * difference of two timestamps.
3471 */
3472 void
3473 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3474 {
3475 int32_t delta;
3476
3477 TCP_STATINC(TCP_STAT_RTTUPDATED);
3478 if (tp->t_srtt != 0) {
3479 /*
3480 * Compute the amount to add to srtt for smoothing,
3481 * *alpha, or 2^(-TCP_RTT_SHIFT). Because
3482 * srtt is stored in 1/32 slow ticks, we conceptually
3483 * shift left 5 bits, subtract srtt to get the
3484 * diference, and then shift right by TCP_RTT_SHIFT
3485 * (3) to obtain 1/8 of the difference.
3486 */
3487 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3488 /*
3489 * This can never happen, because delta's lowest
3490 * possible value is 1/8 of t_srtt. But if it does,
3491 * set srtt to some reasonable value, here chosen
3492 * as 1/8 tick.
3493 */
3494 if ((tp->t_srtt += delta) <= 0)
3495 tp->t_srtt = 1 << 2;
3496 /*
3497 * RFC2988 requires that rttvar be updated first.
3498 * This code is compliant because "delta" is the old
3499 * srtt minus the new observation (scaled).
3500 *
3501 * RFC2988 says:
3502 * rttvar = (1-beta) * rttvar + beta * |srtt-observed|
3503 *
3504 * delta is in units of 1/32 ticks, and has then been
3505 * divided by 8. This is equivalent to being in 1/16s
3506 * units and divided by 4. Subtract from it 1/4 of
3507 * the existing rttvar to form the (signed) amount to
3508 * adjust.
3509 */
3510 if (delta < 0)
3511 delta = -delta;
3512 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3513 /*
3514 * As with srtt, this should never happen. There is
3515 * no support in RFC2988 for this operation. But 1/4s
3516 * as rttvar when faced with something arguably wrong
3517 * is ok.
3518 */
3519 if ((tp->t_rttvar += delta) <= 0)
3520 tp->t_rttvar = 1 << 2;
3521
3522 /*
3523 * If srtt exceeds .01 second, ensure we use the 'remote' MSL
3524 * Problem is: it doesn't work. Disabled by defaulting
3525 * tcp_rttlocal to 0; see corresponding code in
3526 * tcp_subr that selects local vs remote in a different way.
3527 *
3528 * The static branch prediction hint here should be removed
3529 * when the rtt estimator is fixed and the rtt_enable code
3530 * is turned back on.
3531 */
3532 if (__predict_false(tcp_rttlocal) && tcp_msl_enable
3533 && tp->t_srtt > tcp_msl_remote_threshold
3534 && tp->t_msl < tcp_msl_remote) {
3535 tp->t_msl = tcp_msl_remote;
3536 }
3537 } else {
3538 /*
3539 * This is the first measurement. Per RFC2988, 2.2,
3540 * set rtt=R and srtt=R/2.
3541 * For srtt, storage representation is 1/32 ticks,
3542 * so shift left by 5.
3543 * For rttvar, storage representation is 1/16 ticks,
3544 * So shift left by 4, but then right by 1 to halve.
3545 */
3546 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3547 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3548 }
3549 tp->t_rtttime = 0;
3550 tp->t_rxtshift = 0;
3551
3552 /*
3553 * the retransmit should happen at rtt + 4 * rttvar.
3554 * Because of the way we do the smoothing, srtt and rttvar
3555 * will each average +1/2 tick of bias. When we compute
3556 * the retransmit timer, we want 1/2 tick of rounding and
3557 * 1 extra tick because of +-1/2 tick uncertainty in the
3558 * firing of the timer. The bias will give us exactly the
3559 * 1.5 tick we need. But, because the bias is
3560 * statistical, we have to test that we don't drop below
3561 * the minimum feasible timer (which is 2 ticks).
3562 */
3563 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3564 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3565
3566 /*
3567 * We received an ack for a packet that wasn't retransmitted;
3568 * it is probably safe to discard any error indications we've
3569 * received recently. This isn't quite right, but close enough
3570 * for now (a route might have failed after we sent a segment,
3571 * and the return path might not be symmetrical).
3572 */
3573 tp->t_softerror = 0;
3574 }
3575
3576
3577 /*
3578 * TCP compressed state engine. Currently used to hold compressed
3579 * state for SYN_RECEIVED.
3580 */
3581
3582 u_long syn_cache_count;
3583 u_int32_t syn_hash1, syn_hash2;
3584
3585 #define SYN_HASH(sa, sp, dp) \
3586 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
3587 ((u_int32_t)(sp)))^syn_hash2)))
3588 #ifndef INET6
3589 #define SYN_HASHALL(hash, src, dst) \
3590 do { \
3591 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3592 ((const struct sockaddr_in *)(src))->sin_port, \
3593 ((const struct sockaddr_in *)(dst))->sin_port); \
3594 } while (/*CONSTCOND*/ 0)
3595 #else
3596 #define SYN_HASH6(sa, sp, dp) \
3597 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
3598 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
3599 & 0x7fffffff)
3600
3601 #define SYN_HASHALL(hash, src, dst) \
3602 do { \
3603 switch ((src)->sa_family) { \
3604 case AF_INET: \
3605 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3606 ((const struct sockaddr_in *)(src))->sin_port, \
3607 ((const struct sockaddr_in *)(dst))->sin_port); \
3608 break; \
3609 case AF_INET6: \
3610 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \
3611 ((const struct sockaddr_in6 *)(src))->sin6_port, \
3612 ((const struct sockaddr_in6 *)(dst))->sin6_port); \
3613 break; \
3614 default: \
3615 hash = 0; \
3616 } \
3617 } while (/*CONSTCOND*/0)
3618 #endif /* INET6 */
3619
3620 static struct pool syn_cache_pool;
3621
3622 /*
3623 * We don't estimate RTT with SYNs, so each packet starts with the default
3624 * RTT and each timer step has a fixed timeout value.
3625 */
3626 #define SYN_CACHE_TIMER_ARM(sc) \
3627 do { \
3628 TCPT_RANGESET((sc)->sc_rxtcur, \
3629 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
3630 TCPTV_REXMTMAX); \
3631 callout_reset(&(sc)->sc_timer, \
3632 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
3633 } while (/*CONSTCOND*/0)
3634
3635 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
3636
3637 static inline void
3638 syn_cache_rm(struct syn_cache *sc)
3639 {
3640 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket,
3641 sc, sc_bucketq);
3642 sc->sc_tp = NULL;
3643 LIST_REMOVE(sc, sc_tpq);
3644 tcp_syn_cache[sc->sc_bucketidx].sch_length--;
3645 callout_stop(&sc->sc_timer);
3646 syn_cache_count--;
3647 }
3648
3649 static inline void
3650 syn_cache_put(struct syn_cache *sc)
3651 {
3652 if (sc->sc_ipopts)
3653 (void) m_free(sc->sc_ipopts);
3654 rtcache_free(&sc->sc_route);
3655 sc->sc_flags |= SCF_DEAD;
3656 if (!callout_invoking(&sc->sc_timer))
3657 callout_schedule(&(sc)->sc_timer, 1);
3658 }
3659
3660 void
3661 syn_cache_init(void)
3662 {
3663 int i;
3664
3665 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0,
3666 "synpl", NULL, IPL_SOFTNET);
3667
3668 /* Initialize the hash buckets. */
3669 for (i = 0; i < tcp_syn_cache_size; i++)
3670 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
3671 }
3672
3673 void
3674 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
3675 {
3676 struct syn_cache_head *scp;
3677 struct syn_cache *sc2;
3678 int s;
3679
3680 /*
3681 * If there are no entries in the hash table, reinitialize
3682 * the hash secrets.
3683 */
3684 if (syn_cache_count == 0) {
3685 syn_hash1 = cprng_fast32();
3686 syn_hash2 = cprng_fast32();
3687 }
3688
3689 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
3690 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
3691 scp = &tcp_syn_cache[sc->sc_bucketidx];
3692
3693 /*
3694 * Make sure that we don't overflow the per-bucket
3695 * limit or the total cache size limit.
3696 */
3697 s = splsoftnet();
3698 if (scp->sch_length >= tcp_syn_bucket_limit) {
3699 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW);
3700 /*
3701 * The bucket is full. Toss the oldest element in the
3702 * bucket. This will be the first entry in the bucket.
3703 */
3704 sc2 = TAILQ_FIRST(&scp->sch_bucket);
3705 #ifdef DIAGNOSTIC
3706 /*
3707 * This should never happen; we should always find an
3708 * entry in our bucket.
3709 */
3710 if (sc2 == NULL)
3711 panic("syn_cache_insert: bucketoverflow: impossible");
3712 #endif
3713 syn_cache_rm(sc2);
3714 syn_cache_put(sc2); /* calls pool_put but see spl above */
3715 } else if (syn_cache_count >= tcp_syn_cache_limit) {
3716 struct syn_cache_head *scp2, *sce;
3717
3718 TCP_STATINC(TCP_STAT_SC_OVERFLOWED);
3719 /*
3720 * The cache is full. Toss the oldest entry in the
3721 * first non-empty bucket we can find.
3722 *
3723 * XXX We would really like to toss the oldest
3724 * entry in the cache, but we hope that this
3725 * condition doesn't happen very often.
3726 */
3727 scp2 = scp;
3728 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
3729 sce = &tcp_syn_cache[tcp_syn_cache_size];
3730 for (++scp2; scp2 != scp; scp2++) {
3731 if (scp2 >= sce)
3732 scp2 = &tcp_syn_cache[0];
3733 if (! TAILQ_EMPTY(&scp2->sch_bucket))
3734 break;
3735 }
3736 #ifdef DIAGNOSTIC
3737 /*
3738 * This should never happen; we should always find a
3739 * non-empty bucket.
3740 */
3741 if (scp2 == scp)
3742 panic("syn_cache_insert: cacheoverflow: "
3743 "impossible");
3744 #endif
3745 }
3746 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
3747 syn_cache_rm(sc2);
3748 syn_cache_put(sc2); /* calls pool_put but see spl above */
3749 }
3750
3751 /*
3752 * Initialize the entry's timer.
3753 */
3754 sc->sc_rxttot = 0;
3755 sc->sc_rxtshift = 0;
3756 SYN_CACHE_TIMER_ARM(sc);
3757
3758 /* Link it from tcpcb entry */
3759 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
3760
3761 /* Put it into the bucket. */
3762 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
3763 scp->sch_length++;
3764 syn_cache_count++;
3765
3766 TCP_STATINC(TCP_STAT_SC_ADDED);
3767 splx(s);
3768 }
3769
3770 /*
3771 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
3772 * If we have retransmitted an entry the maximum number of times, expire
3773 * that entry.
3774 */
3775 void
3776 syn_cache_timer(void *arg)
3777 {
3778 struct syn_cache *sc = arg;
3779
3780 mutex_enter(softnet_lock);
3781 KERNEL_LOCK(1, NULL);
3782 callout_ack(&sc->sc_timer);
3783
3784 if (__predict_false(sc->sc_flags & SCF_DEAD)) {
3785 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE);
3786 callout_destroy(&sc->sc_timer);
3787 pool_put(&syn_cache_pool, sc);
3788 KERNEL_UNLOCK_ONE(NULL);
3789 mutex_exit(softnet_lock);
3790 return;
3791 }
3792
3793 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3794 /* Drop it -- too many retransmissions. */
3795 goto dropit;
3796 }
3797
3798 /*
3799 * Compute the total amount of time this entry has
3800 * been on a queue. If this entry has been on longer
3801 * than the keep alive timer would allow, expire it.
3802 */
3803 sc->sc_rxttot += sc->sc_rxtcur;
3804 if (sc->sc_rxttot >= tcp_keepinit)
3805 goto dropit;
3806
3807 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED);
3808 (void) syn_cache_respond(sc, NULL);
3809
3810 /* Advance the timer back-off. */
3811 sc->sc_rxtshift++;
3812 SYN_CACHE_TIMER_ARM(sc);
3813
3814 KERNEL_UNLOCK_ONE(NULL);
3815 mutex_exit(softnet_lock);
3816 return;
3817
3818 dropit:
3819 TCP_STATINC(TCP_STAT_SC_TIMED_OUT);
3820 syn_cache_rm(sc);
3821 if (sc->sc_ipopts)
3822 (void) m_free(sc->sc_ipopts);
3823 rtcache_free(&sc->sc_route);
3824 callout_destroy(&sc->sc_timer);
3825 pool_put(&syn_cache_pool, sc);
3826 KERNEL_UNLOCK_ONE(NULL);
3827 mutex_exit(softnet_lock);
3828 }
3829
3830 /*
3831 * Remove syn cache created by the specified tcb entry,
3832 * because this does not make sense to keep them
3833 * (if there's no tcb entry, syn cache entry will never be used)
3834 */
3835 void
3836 syn_cache_cleanup(struct tcpcb *tp)
3837 {
3838 struct syn_cache *sc, *nsc;
3839 int s;
3840
3841 s = splsoftnet();
3842
3843 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3844 nsc = LIST_NEXT(sc, sc_tpq);
3845
3846 #ifdef DIAGNOSTIC
3847 if (sc->sc_tp != tp)
3848 panic("invalid sc_tp in syn_cache_cleanup");
3849 #endif
3850 syn_cache_rm(sc);
3851 syn_cache_put(sc); /* calls pool_put but see spl above */
3852 }
3853 /* just for safety */
3854 LIST_INIT(&tp->t_sc);
3855
3856 splx(s);
3857 }
3858
3859 /*
3860 * Find an entry in the syn cache.
3861 */
3862 struct syn_cache *
3863 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
3864 struct syn_cache_head **headp)
3865 {
3866 struct syn_cache *sc;
3867 struct syn_cache_head *scp;
3868 u_int32_t hash;
3869 int s;
3870
3871 SYN_HASHALL(hash, src, dst);
3872
3873 scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3874 *headp = scp;
3875 s = splsoftnet();
3876 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3877 sc = TAILQ_NEXT(sc, sc_bucketq)) {
3878 if (sc->sc_hash != hash)
3879 continue;
3880 if (!memcmp(&sc->sc_src, src, src->sa_len) &&
3881 !memcmp(&sc->sc_dst, dst, dst->sa_len)) {
3882 splx(s);
3883 return (sc);
3884 }
3885 }
3886 splx(s);
3887 return (NULL);
3888 }
3889
3890 /*
3891 * This function gets called when we receive an ACK for a
3892 * socket in the LISTEN state. We look up the connection
3893 * in the syn cache, and if its there, we pull it out of
3894 * the cache and turn it into a full-blown connection in
3895 * the SYN-RECEIVED state.
3896 *
3897 * The return values may not be immediately obvious, and their effects
3898 * can be subtle, so here they are:
3899 *
3900 * NULL SYN was not found in cache; caller should drop the
3901 * packet and send an RST.
3902 *
3903 * -1 We were unable to create the new connection, and are
3904 * aborting it. An ACK,RST is being sent to the peer
3905 * (unless we got screwey sequence numbners; see below),
3906 * because the 3-way handshake has been completed. Caller
3907 * should not free the mbuf, since we may be using it. If
3908 * we are not, we will free it.
3909 *
3910 * Otherwise, the return value is a pointer to the new socket
3911 * associated with the connection.
3912 */
3913 struct socket *
3914 syn_cache_get(struct sockaddr *src, struct sockaddr *dst,
3915 struct tcphdr *th, unsigned int hlen, unsigned int tlen,
3916 struct socket *so, struct mbuf *m)
3917 {
3918 struct syn_cache *sc;
3919 struct syn_cache_head *scp;
3920 struct inpcb *inp = NULL;
3921 #ifdef INET6
3922 struct in6pcb *in6p = NULL;
3923 #endif
3924 struct tcpcb *tp = 0;
3925 struct mbuf *am;
3926 int s;
3927 struct socket *oso;
3928
3929 s = splsoftnet();
3930 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3931 splx(s);
3932 return (NULL);
3933 }
3934
3935 /*
3936 * Verify the sequence and ack numbers. Try getting the correct
3937 * response again.
3938 */
3939 if ((th->th_ack != sc->sc_iss + 1) ||
3940 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3941 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3942 (void) syn_cache_respond(sc, m);
3943 splx(s);
3944 return ((struct socket *)(-1));
3945 }
3946
3947 /* Remove this cache entry */
3948 syn_cache_rm(sc);
3949 splx(s);
3950
3951 /*
3952 * Ok, create the full blown connection, and set things up
3953 * as they would have been set up if we had created the
3954 * connection when the SYN arrived. If we can't create
3955 * the connection, abort it.
3956 */
3957 /*
3958 * inp still has the OLD in_pcb stuff, set the
3959 * v6-related flags on the new guy, too. This is
3960 * done particularly for the case where an AF_INET6
3961 * socket is bound only to a port, and a v4 connection
3962 * comes in on that port.
3963 * we also copy the flowinfo from the original pcb
3964 * to the new one.
3965 */
3966 oso = so;
3967 so = sonewconn(so, true);
3968 if (so == NULL)
3969 goto resetandabort;
3970
3971 switch (so->so_proto->pr_domain->dom_family) {
3972 #ifdef INET
3973 case AF_INET:
3974 inp = sotoinpcb(so);
3975 break;
3976 #endif
3977 #ifdef INET6
3978 case AF_INET6:
3979 in6p = sotoin6pcb(so);
3980 break;
3981 #endif
3982 }
3983 switch (src->sa_family) {
3984 #ifdef INET
3985 case AF_INET:
3986 if (inp) {
3987 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
3988 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
3989 inp->inp_options = ip_srcroute();
3990 in_pcbstate(inp, INP_BOUND);
3991 if (inp->inp_options == NULL) {
3992 inp->inp_options = sc->sc_ipopts;
3993 sc->sc_ipopts = NULL;
3994 }
3995 }
3996 #ifdef INET6
3997 else if (in6p) {
3998 /* IPv4 packet to AF_INET6 socket */
3999 memset(&in6p->in6p_laddr, 0, sizeof(in6p->in6p_laddr));
4000 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
4001 bcopy(&((struct sockaddr_in *)dst)->sin_addr,
4002 &in6p->in6p_laddr.s6_addr32[3],
4003 sizeof(((struct sockaddr_in *)dst)->sin_addr));
4004 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
4005 in6totcpcb(in6p)->t_family = AF_INET;
4006 if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
4007 in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
4008 else
4009 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
4010 in6_pcbstate(in6p, IN6P_BOUND);
4011 }
4012 #endif
4013 break;
4014 #endif
4015 #ifdef INET6
4016 case AF_INET6:
4017 if (in6p) {
4018 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
4019 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
4020 in6_pcbstate(in6p, IN6P_BOUND);
4021 }
4022 break;
4023 #endif
4024 }
4025 #ifdef INET6
4026 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
4027 struct in6pcb *oin6p = sotoin6pcb(oso);
4028 /* inherit socket options from the listening socket */
4029 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
4030 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
4031 m_freem(in6p->in6p_options);
4032 in6p->in6p_options = 0;
4033 }
4034 ip6_savecontrol(in6p, &in6p->in6p_options,
4035 mtod(m, struct ip6_hdr *), m);
4036 }
4037 #endif
4038
4039 #if defined(IPSEC)
4040 if (ipsec_used) {
4041 /*
4042 * we make a copy of policy, instead of sharing the policy, for
4043 * better behavior in terms of SA lookup and dead SA removal.
4044 */
4045 if (inp) {
4046 /* copy old policy into new socket's */
4047 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp,
4048 inp->inp_sp))
4049 printf("tcp_input: could not copy policy\n");
4050 }
4051 #ifdef INET6
4052 else if (in6p) {
4053 /* copy old policy into new socket's */
4054 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
4055 in6p->in6p_sp))
4056 printf("tcp_input: could not copy policy\n");
4057 }
4058 #endif
4059 }
4060 #endif
4061
4062 /*
4063 * Give the new socket our cached route reference.
4064 */
4065 if (inp) {
4066 rtcache_copy(&inp->inp_route, &sc->sc_route);
4067 rtcache_free(&sc->sc_route);
4068 }
4069 #ifdef INET6
4070 else {
4071 rtcache_copy(&in6p->in6p_route, &sc->sc_route);
4072 rtcache_free(&sc->sc_route);
4073 }
4074 #endif
4075
4076 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
4077 if (am == NULL)
4078 goto resetandabort;
4079 MCLAIM(am, &tcp_mowner);
4080 am->m_len = src->sa_len;
4081 bcopy(src, mtod(am, void *), src->sa_len);
4082 if (inp) {
4083 if (in_pcbconnect(inp, am, &lwp0)) {
4084 (void) m_free(am);
4085 goto resetandabort;
4086 }
4087 }
4088 #ifdef INET6
4089 else if (in6p) {
4090 if (src->sa_family == AF_INET) {
4091 /* IPv4 packet to AF_INET6 socket */
4092 struct sockaddr_in6 *sin6;
4093 sin6 = mtod(am, struct sockaddr_in6 *);
4094 am->m_len = sizeof(*sin6);
4095 memset(sin6, 0, sizeof(*sin6));
4096 sin6->sin6_family = AF_INET6;
4097 sin6->sin6_len = sizeof(*sin6);
4098 sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
4099 sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
4100 bcopy(&((struct sockaddr_in *)src)->sin_addr,
4101 &sin6->sin6_addr.s6_addr32[3],
4102 sizeof(sin6->sin6_addr.s6_addr32[3]));
4103 }
4104 if (in6_pcbconnect(in6p, am, NULL)) {
4105 (void) m_free(am);
4106 goto resetandabort;
4107 }
4108 }
4109 #endif
4110 else {
4111 (void) m_free(am);
4112 goto resetandabort;
4113 }
4114 (void) m_free(am);
4115
4116 if (inp)
4117 tp = intotcpcb(inp);
4118 #ifdef INET6
4119 else if (in6p)
4120 tp = in6totcpcb(in6p);
4121 #endif
4122 else
4123 tp = NULL;
4124 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
4125 if (sc->sc_request_r_scale != 15) {
4126 tp->requested_s_scale = sc->sc_requested_s_scale;
4127 tp->request_r_scale = sc->sc_request_r_scale;
4128 tp->snd_scale = sc->sc_requested_s_scale;
4129 tp->rcv_scale = sc->sc_request_r_scale;
4130 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
4131 }
4132 if (sc->sc_flags & SCF_TIMESTAMP)
4133 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
4134 tp->ts_timebase = sc->sc_timebase;
4135
4136 tp->t_template = tcp_template(tp);
4137 if (tp->t_template == 0) {
4138 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
4139 so = NULL;
4140 m_freem(m);
4141 goto abort;
4142 }
4143
4144 tp->iss = sc->sc_iss;
4145 tp->irs = sc->sc_irs;
4146 tcp_sendseqinit(tp);
4147 tcp_rcvseqinit(tp);
4148 tp->t_state = TCPS_SYN_RECEIVED;
4149 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit);
4150 TCP_STATINC(TCP_STAT_ACCEPTS);
4151
4152 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack)
4153 tp->t_flags |= TF_WILL_SACK;
4154
4155 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn)
4156 tp->t_flags |= TF_ECN_PERMIT;
4157
4158 #ifdef TCP_SIGNATURE
4159 if (sc->sc_flags & SCF_SIGNATURE)
4160 tp->t_flags |= TF_SIGNATURE;
4161 #endif
4162
4163 /* Initialize tp->t_ourmss before we deal with the peer's! */
4164 tp->t_ourmss = sc->sc_ourmaxseg;
4165 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
4166
4167 /*
4168 * Initialize the initial congestion window. If we
4169 * had to retransmit the SYN,ACK, we must initialize cwnd
4170 * to 1 segment (i.e. the Loss Window).
4171 */
4172 if (sc->sc_rxtshift)
4173 tp->snd_cwnd = tp->t_peermss;
4174 else {
4175 int ss = tcp_init_win;
4176 #ifdef INET
4177 if (inp != NULL && in_localaddr(inp->inp_faddr))
4178 ss = tcp_init_win_local;
4179 #endif
4180 #ifdef INET6
4181 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
4182 ss = tcp_init_win_local;
4183 #endif
4184 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
4185 }
4186
4187 tcp_rmx_rtt(tp);
4188 tp->snd_wl1 = sc->sc_irs;
4189 tp->rcv_up = sc->sc_irs + 1;
4190
4191 /*
4192 * This is what whould have happened in tcp_output() when
4193 * the SYN,ACK was sent.
4194 */
4195 tp->snd_up = tp->snd_una;
4196 tp->snd_max = tp->snd_nxt = tp->iss+1;
4197 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
4198 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
4199 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
4200 tp->last_ack_sent = tp->rcv_nxt;
4201 tp->t_partialacks = -1;
4202 tp->t_dupacks = 0;
4203
4204 TCP_STATINC(TCP_STAT_SC_COMPLETED);
4205 s = splsoftnet();
4206 syn_cache_put(sc);
4207 splx(s);
4208 return (so);
4209
4210 resetandabort:
4211 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
4212 abort:
4213 if (so != NULL) {
4214 (void) soqremque(so, 1);
4215 (void) soabort(so);
4216 mutex_enter(softnet_lock);
4217 }
4218 s = splsoftnet();
4219 syn_cache_put(sc);
4220 splx(s);
4221 TCP_STATINC(TCP_STAT_SC_ABORTED);
4222 return ((struct socket *)(-1));
4223 }
4224
4225 /*
4226 * This function is called when we get a RST for a
4227 * non-existent connection, so that we can see if the
4228 * connection is in the syn cache. If it is, zap it.
4229 */
4230
4231 void
4232 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th)
4233 {
4234 struct syn_cache *sc;
4235 struct syn_cache_head *scp;
4236 int s = splsoftnet();
4237
4238 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4239 splx(s);
4240 return;
4241 }
4242 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
4243 SEQ_GT(th->th_seq, sc->sc_irs+1)) {
4244 splx(s);
4245 return;
4246 }
4247 syn_cache_rm(sc);
4248 TCP_STATINC(TCP_STAT_SC_RESET);
4249 syn_cache_put(sc); /* calls pool_put but see spl above */
4250 splx(s);
4251 }
4252
4253 void
4254 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
4255 struct tcphdr *th)
4256 {
4257 struct syn_cache *sc;
4258 struct syn_cache_head *scp;
4259 int s;
4260
4261 s = splsoftnet();
4262 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4263 splx(s);
4264 return;
4265 }
4266 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
4267 if (ntohl (th->th_seq) != sc->sc_iss) {
4268 splx(s);
4269 return;
4270 }
4271
4272 /*
4273 * If we've retransmitted 3 times and this is our second error,
4274 * we remove the entry. Otherwise, we allow it to continue on.
4275 * This prevents us from incorrectly nuking an entry during a
4276 * spurious network outage.
4277 *
4278 * See tcp_notify().
4279 */
4280 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
4281 sc->sc_flags |= SCF_UNREACH;
4282 splx(s);
4283 return;
4284 }
4285
4286 syn_cache_rm(sc);
4287 TCP_STATINC(TCP_STAT_SC_UNREACH);
4288 syn_cache_put(sc); /* calls pool_put but see spl above */
4289 splx(s);
4290 }
4291
4292 /*
4293 * Given a LISTEN socket and an inbound SYN request, add
4294 * this to the syn cache, and send back a segment:
4295 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
4296 * to the source.
4297 *
4298 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
4299 * Doing so would require that we hold onto the data and deliver it
4300 * to the application. However, if we are the target of a SYN-flood
4301 * DoS attack, an attacker could send data which would eventually
4302 * consume all available buffer space if it were ACKed. By not ACKing
4303 * the data, we avoid this DoS scenario.
4304 */
4305
4306 int
4307 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
4308 unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp,
4309 int optlen, struct tcp_opt_info *oi)
4310 {
4311 struct tcpcb tb, *tp;
4312 long win;
4313 struct syn_cache *sc;
4314 struct syn_cache_head *scp;
4315 struct mbuf *ipopts;
4316 struct tcp_opt_info opti;
4317 int s;
4318
4319 tp = sototcpcb(so);
4320
4321 memset(&opti, 0, sizeof(opti));
4322
4323 /*
4324 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
4325 *
4326 * Note this check is performed in tcp_input() very early on.
4327 */
4328
4329 /*
4330 * Initialize some local state.
4331 */
4332 win = sbspace(&so->so_rcv);
4333 if (win > TCP_MAXWIN)
4334 win = TCP_MAXWIN;
4335
4336 switch (src->sa_family) {
4337 #ifdef INET
4338 case AF_INET:
4339 /*
4340 * Remember the IP options, if any.
4341 */
4342 ipopts = ip_srcroute();
4343 break;
4344 #endif
4345 default:
4346 ipopts = NULL;
4347 }
4348
4349 #ifdef TCP_SIGNATURE
4350 if (optp || (tp->t_flags & TF_SIGNATURE))
4351 #else
4352 if (optp)
4353 #endif
4354 {
4355 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
4356 #ifdef TCP_SIGNATURE
4357 tb.t_flags |= (tp->t_flags & TF_SIGNATURE);
4358 #endif
4359 tb.t_state = TCPS_LISTEN;
4360 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len -
4361 sizeof(struct tcphdr) - optlen - hlen, oi) < 0)
4362 return (0);
4363 } else
4364 tb.t_flags = 0;
4365
4366 /*
4367 * See if we already have an entry for this connection.
4368 * If we do, resend the SYN,ACK. We do not count this
4369 * as a retransmission (XXX though maybe we should).
4370 */
4371 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
4372 TCP_STATINC(TCP_STAT_SC_DUPESYN);
4373 if (ipopts) {
4374 /*
4375 * If we were remembering a previous source route,
4376 * forget it and use the new one we've been given.
4377 */
4378 if (sc->sc_ipopts)
4379 (void) m_free(sc->sc_ipopts);
4380 sc->sc_ipopts = ipopts;
4381 }
4382 sc->sc_timestamp = tb.ts_recent;
4383 if (syn_cache_respond(sc, m) == 0) {
4384 uint64_t *tcps = TCP_STAT_GETREF();
4385 tcps[TCP_STAT_SNDACKS]++;
4386 tcps[TCP_STAT_SNDTOTAL]++;
4387 TCP_STAT_PUTREF();
4388 }
4389 return (1);
4390 }
4391
4392 s = splsoftnet();
4393 sc = pool_get(&syn_cache_pool, PR_NOWAIT);
4394 splx(s);
4395 if (sc == NULL) {
4396 if (ipopts)
4397 (void) m_free(ipopts);
4398 return (0);
4399 }
4400
4401 /*
4402 * Fill in the cache, and put the necessary IP and TCP
4403 * options into the reply.
4404 */
4405 memset(sc, 0, sizeof(struct syn_cache));
4406 callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
4407 bcopy(src, &sc->sc_src, src->sa_len);
4408 bcopy(dst, &sc->sc_dst, dst->sa_len);
4409 sc->sc_flags = 0;
4410 sc->sc_ipopts = ipopts;
4411 sc->sc_irs = th->th_seq;
4412 switch (src->sa_family) {
4413 #ifdef INET
4414 case AF_INET:
4415 {
4416 struct sockaddr_in *srcin = (void *) src;
4417 struct sockaddr_in *dstin = (void *) dst;
4418
4419 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
4420 &srcin->sin_addr, dstin->sin_port,
4421 srcin->sin_port, sizeof(dstin->sin_addr), 0);
4422 break;
4423 }
4424 #endif /* INET */
4425 #ifdef INET6
4426 case AF_INET6:
4427 {
4428 struct sockaddr_in6 *srcin6 = (void *) src;
4429 struct sockaddr_in6 *dstin6 = (void *) dst;
4430
4431 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
4432 &srcin6->sin6_addr, dstin6->sin6_port,
4433 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
4434 break;
4435 }
4436 #endif /* INET6 */
4437 }
4438 sc->sc_peermaxseg = oi->maxseg;
4439 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
4440 m->m_pkthdr.rcvif : NULL,
4441 sc->sc_src.sa.sa_family);
4442 sc->sc_win = win;
4443 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */
4444 sc->sc_timestamp = tb.ts_recent;
4445 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
4446 (TF_REQ_TSTMP|TF_RCVD_TSTMP))
4447 sc->sc_flags |= SCF_TIMESTAMP;
4448 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
4449 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
4450 sc->sc_requested_s_scale = tb.requested_s_scale;
4451 sc->sc_request_r_scale = 0;
4452 /*
4453 * Pick the smallest possible scaling factor that
4454 * will still allow us to scale up to sb_max.
4455 *
4456 * We do this because there are broken firewalls that
4457 * will corrupt the window scale option, leading to
4458 * the other endpoint believing that our advertised
4459 * window is unscaled. At scale factors larger than
4460 * 5 the unscaled window will drop below 1500 bytes,
4461 * leading to serious problems when traversing these
4462 * broken firewalls.
4463 *
4464 * With the default sbmax of 256K, a scale factor
4465 * of 3 will be chosen by this algorithm. Those who
4466 * choose a larger sbmax should watch out
4467 * for the compatiblity problems mentioned above.
4468 *
4469 * RFC1323: The Window field in a SYN (i.e., a <SYN>
4470 * or <SYN,ACK>) segment itself is never scaled.
4471 */
4472 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
4473 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
4474 sc->sc_request_r_scale++;
4475 } else {
4476 sc->sc_requested_s_scale = 15;
4477 sc->sc_request_r_scale = 15;
4478 }
4479 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack)
4480 sc->sc_flags |= SCF_SACK_PERMIT;
4481
4482 /*
4483 * ECN setup packet recieved.
4484 */
4485 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn)
4486 sc->sc_flags |= SCF_ECN_PERMIT;
4487
4488 #ifdef TCP_SIGNATURE
4489 if (tb.t_flags & TF_SIGNATURE)
4490 sc->sc_flags |= SCF_SIGNATURE;
4491 #endif
4492 sc->sc_tp = tp;
4493 if (syn_cache_respond(sc, m) == 0) {
4494 uint64_t *tcps = TCP_STAT_GETREF();
4495 tcps[TCP_STAT_SNDACKS]++;
4496 tcps[TCP_STAT_SNDTOTAL]++;
4497 TCP_STAT_PUTREF();
4498 syn_cache_insert(sc, tp);
4499 } else {
4500 s = splsoftnet();
4501 /*
4502 * syn_cache_put() will try to schedule the timer, so
4503 * we need to initialize it
4504 */
4505 SYN_CACHE_TIMER_ARM(sc);
4506 syn_cache_put(sc);
4507 splx(s);
4508 TCP_STATINC(TCP_STAT_SC_DROPPED);
4509 }
4510 return (1);
4511 }
4512
4513 /*
4514 * syn_cache_respond: (re)send SYN+ACK.
4515 *
4516 * returns 0 on success. otherwise returns an errno, typically ENOBUFS.
4517 */
4518
4519 int
4520 syn_cache_respond(struct syn_cache *sc, struct mbuf *m)
4521 {
4522 #ifdef INET6
4523 struct rtentry *rt;
4524 #endif
4525 struct route *ro;
4526 u_int8_t *optp;
4527 int optlen, error;
4528 u_int16_t tlen;
4529 struct ip *ip = NULL;
4530 #ifdef INET6
4531 struct ip6_hdr *ip6 = NULL;
4532 #endif
4533 struct tcpcb *tp = NULL;
4534 struct tcphdr *th;
4535 u_int hlen;
4536 struct socket *so;
4537
4538 ro = &sc->sc_route;
4539 switch (sc->sc_src.sa.sa_family) {
4540 case AF_INET:
4541 hlen = sizeof(struct ip);
4542 break;
4543 #ifdef INET6
4544 case AF_INET6:
4545 hlen = sizeof(struct ip6_hdr);
4546 break;
4547 #endif
4548 default:
4549 if (m)
4550 m_freem(m);
4551 return (EAFNOSUPPORT);
4552 }
4553
4554 /* Compute the size of the TCP options. */
4555 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
4556 ((sc->sc_flags & SCF_SACK_PERMIT) ? (TCPOLEN_SACK_PERMITTED + 2) : 0) +
4557 #ifdef TCP_SIGNATURE
4558 ((sc->sc_flags & SCF_SIGNATURE) ? (TCPOLEN_SIGNATURE + 2) : 0) +
4559 #endif
4560 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
4561
4562 tlen = hlen + sizeof(struct tcphdr) + optlen;
4563
4564 /*
4565 * Create the IP+TCP header from scratch.
4566 */
4567 if (m)
4568 m_freem(m);
4569 #ifdef DIAGNOSTIC
4570 if (max_linkhdr + tlen > MCLBYTES)
4571 return (ENOBUFS);
4572 #endif
4573 MGETHDR(m, M_DONTWAIT, MT_DATA);
4574 if (m && (max_linkhdr + tlen) > MHLEN) {
4575 MCLGET(m, M_DONTWAIT);
4576 if ((m->m_flags & M_EXT) == 0) {
4577 m_freem(m);
4578 m = NULL;
4579 }
4580 }
4581 if (m == NULL)
4582 return (ENOBUFS);
4583 MCLAIM(m, &tcp_tx_mowner);
4584
4585 /* Fixup the mbuf. */
4586 m->m_data += max_linkhdr;
4587 m->m_len = m->m_pkthdr.len = tlen;
4588 if (sc->sc_tp) {
4589 tp = sc->sc_tp;
4590 if (tp->t_inpcb)
4591 so = tp->t_inpcb->inp_socket;
4592 #ifdef INET6
4593 else if (tp->t_in6pcb)
4594 so = tp->t_in6pcb->in6p_socket;
4595 #endif
4596 else
4597 so = NULL;
4598 } else
4599 so = NULL;
4600 m->m_pkthdr.rcvif = NULL;
4601 memset(mtod(m, u_char *), 0, tlen);
4602
4603 switch (sc->sc_src.sa.sa_family) {
4604 case AF_INET:
4605 ip = mtod(m, struct ip *);
4606 ip->ip_v = 4;
4607 ip->ip_dst = sc->sc_src.sin.sin_addr;
4608 ip->ip_src = sc->sc_dst.sin.sin_addr;
4609 ip->ip_p = IPPROTO_TCP;
4610 th = (struct tcphdr *)(ip + 1);
4611 th->th_dport = sc->sc_src.sin.sin_port;
4612 th->th_sport = sc->sc_dst.sin.sin_port;
4613 break;
4614 #ifdef INET6
4615 case AF_INET6:
4616 ip6 = mtod(m, struct ip6_hdr *);
4617 ip6->ip6_vfc = IPV6_VERSION;
4618 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
4619 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
4620 ip6->ip6_nxt = IPPROTO_TCP;
4621 /* ip6_plen will be updated in ip6_output() */
4622 th = (struct tcphdr *)(ip6 + 1);
4623 th->th_dport = sc->sc_src.sin6.sin6_port;
4624 th->th_sport = sc->sc_dst.sin6.sin6_port;
4625 break;
4626 #endif
4627 default:
4628 th = NULL;
4629 }
4630
4631 th->th_seq = htonl(sc->sc_iss);
4632 th->th_ack = htonl(sc->sc_irs + 1);
4633 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
4634 th->th_flags = TH_SYN|TH_ACK;
4635 th->th_win = htons(sc->sc_win);
4636 /* th_sum already 0 */
4637 /* th_urp already 0 */
4638
4639 /* Tack on the TCP options. */
4640 optp = (u_int8_t *)(th + 1);
4641 *optp++ = TCPOPT_MAXSEG;
4642 *optp++ = 4;
4643 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
4644 *optp++ = sc->sc_ourmaxseg & 0xff;
4645
4646 if (sc->sc_request_r_scale != 15) {
4647 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
4648 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
4649 sc->sc_request_r_scale);
4650 optp += 4;
4651 }
4652
4653 if (sc->sc_flags & SCF_TIMESTAMP) {
4654 u_int32_t *lp = (u_int32_t *)(optp);
4655 /* Form timestamp option as shown in appendix A of RFC 1323. */
4656 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
4657 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
4658 *lp = htonl(sc->sc_timestamp);
4659 optp += TCPOLEN_TSTAMP_APPA;
4660 }
4661
4662 if (sc->sc_flags & SCF_SACK_PERMIT) {
4663 u_int8_t *p = optp;
4664
4665 /* Let the peer know that we will SACK. */
4666 p[0] = TCPOPT_SACK_PERMITTED;
4667 p[1] = 2;
4668 p[2] = TCPOPT_NOP;
4669 p[3] = TCPOPT_NOP;
4670 optp += 4;
4671 }
4672
4673 /*
4674 * Send ECN SYN-ACK setup packet.
4675 * Routes can be asymetric, so, even if we receive a packet
4676 * with ECE and CWR set, we must not assume no one will block
4677 * the ECE packet we are about to send.
4678 */
4679 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp &&
4680 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) {
4681 th->th_flags |= TH_ECE;
4682 TCP_STATINC(TCP_STAT_ECN_SHS);
4683
4684 /*
4685 * draft-ietf-tcpm-ecnsyn-00.txt
4686 *
4687 * "[...] a TCP node MAY respond to an ECN-setup
4688 * SYN packet by setting ECT in the responding
4689 * ECN-setup SYN/ACK packet, indicating to routers
4690 * that the SYN/ACK packet is ECN-Capable.
4691 * This allows a congested router along the path
4692 * to mark the packet instead of dropping the
4693 * packet as an indication of congestion."
4694 *
4695 * "[...] There can be a great benefit in setting
4696 * an ECN-capable codepoint in SYN/ACK packets [...]
4697 * Congestion is most likely to occur in
4698 * the server-to-client direction. As a result,
4699 * setting an ECN-capable codepoint in SYN/ACK
4700 * packets can reduce the occurence of three-second
4701 * retransmit timeouts resulting from the drop
4702 * of SYN/ACK packets."
4703 *
4704 * Page 4 and 6, January 2006.
4705 */
4706
4707 switch (sc->sc_src.sa.sa_family) {
4708 #ifdef INET
4709 case AF_INET:
4710 ip->ip_tos |= IPTOS_ECN_ECT0;
4711 break;
4712 #endif
4713 #ifdef INET6
4714 case AF_INET6:
4715 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
4716 break;
4717 #endif
4718 }
4719 TCP_STATINC(TCP_STAT_ECN_ECT);
4720 }
4721
4722 #ifdef TCP_SIGNATURE
4723 if (sc->sc_flags & SCF_SIGNATURE) {
4724 struct secasvar *sav;
4725 u_int8_t *sigp;
4726
4727 sav = tcp_signature_getsav(m, th);
4728
4729 if (sav == NULL) {
4730 if (m)
4731 m_freem(m);
4732 return (EPERM);
4733 }
4734
4735 *optp++ = TCPOPT_SIGNATURE;
4736 *optp++ = TCPOLEN_SIGNATURE;
4737 sigp = optp;
4738 memset(optp, 0, TCP_SIGLEN);
4739 optp += TCP_SIGLEN;
4740 *optp++ = TCPOPT_NOP;
4741 *optp++ = TCPOPT_EOL;
4742
4743 (void)tcp_signature(m, th, hlen, sav, sigp);
4744
4745 key_sa_recordxfer(sav, m);
4746 KEY_FREESAV(&sav);
4747 }
4748 #endif
4749
4750 /* Compute the packet's checksum. */
4751 switch (sc->sc_src.sa.sa_family) {
4752 case AF_INET:
4753 ip->ip_len = htons(tlen - hlen);
4754 th->th_sum = 0;
4755 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4756 break;
4757 #ifdef INET6
4758 case AF_INET6:
4759 ip6->ip6_plen = htons(tlen - hlen);
4760 th->th_sum = 0;
4761 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4762 break;
4763 #endif
4764 }
4765
4766 /*
4767 * Fill in some straggling IP bits. Note the stack expects
4768 * ip_len to be in host order, for convenience.
4769 */
4770 switch (sc->sc_src.sa.sa_family) {
4771 #ifdef INET
4772 case AF_INET:
4773 ip->ip_len = htons(tlen);
4774 ip->ip_ttl = ip_defttl;
4775 /* XXX tos? */
4776 break;
4777 #endif
4778 #ifdef INET6
4779 case AF_INET6:
4780 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
4781 ip6->ip6_vfc |= IPV6_VERSION;
4782 ip6->ip6_plen = htons(tlen - hlen);
4783 /* ip6_hlim will be initialized afterwards */
4784 /* XXX flowlabel? */
4785 break;
4786 #endif
4787 }
4788
4789 /* XXX use IPsec policy on listening socket, on SYN ACK */
4790 tp = sc->sc_tp;
4791
4792 switch (sc->sc_src.sa.sa_family) {
4793 #ifdef INET
4794 case AF_INET:
4795 error = ip_output(m, sc->sc_ipopts, ro,
4796 (ip_mtudisc ? IP_MTUDISC : 0),
4797 NULL, so);
4798 break;
4799 #endif
4800 #ifdef INET6
4801 case AF_INET6:
4802 ip6->ip6_hlim = in6_selecthlim(NULL,
4803 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
4804 : NULL);
4805
4806 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, so, NULL);
4807 break;
4808 #endif
4809 default:
4810 error = EAFNOSUPPORT;
4811 break;
4812 }
4813 return (error);
4814 }
4815