Home | History | Annotate | Line # | Download | only in netinet
tcp_input.c revision 1.35
      1 /*	$NetBSD: tcp_input.c,v 1.35 1997/11/21 06:18:30 thorpej Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994
      5  *	The Regents of the University of California.  All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *	This product includes software developed by the University of
     18  *	California, Berkeley and its contributors.
     19  * 4. Neither the name of the University nor the names of its contributors
     20  *    may be used to endorse or promote products derived from this software
     21  *    without specific prior written permission.
     22  *
     23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     33  * SUCH DAMAGE.
     34  *
     35  *	@(#)tcp_input.c	8.5 (Berkeley) 4/10/94
     36  */
     37 
     38 /*
     39  *	TODO list for SYN cache stuff:
     40  *
     41  *	(a) The definition of "struct syn_cache" says:
     42  *
     43  *		This structure should not exceeed 32 bytes.
     44  *
     45  *	    but it's 40 bytes on the Alpha.  Can reduce memory use one
     46  *	    of two ways:
     47  *
     48  *		(1) Use a dynamically-sized hash table, and handle
     49  *		    collisions by rehashing.  Then sc_next is unnecessary.
     50  *
     51  *		(2) Allocate syn_cache structures in pages (or some other
     52  *		    large chunk).  This would probably be desirable for
     53  *		    maintaining locality of reference anyway.
     54  *
     55  *		    If you do this, you can change sc_next to a page/index
     56  *		    value, and make it a 32-bit (or maybe even 16-bit)
     57  *		    integer, thus partly obviating the need for the previous
     58  *		    hack.
     59  *
     60  *	    It's also worth noting this this is necessary for IPv6, as well,
     61  *	    where we use 32 bytes just for the IP addresses, so eliminating
     62  *	    wastage is going to become more important.  (BTW, has anyone
     63  *	    integreated these changes with one fo the IPv6 status that are
     64  *	    available?)
     65  *
     66  *	(b) Find room for a "state" field, which is needed to keep a
     67  *	    compressed state for TIME_WAIT TCBs.  It's been noted already
     68  *	    that this is fairly important for very high-volume web and
     69  *	    mail servers, which use a large number of short-lived
     70  *	    connections.
     71  */
     72 
     73 #ifndef TUBA_INCLUDE
     74 #include <sys/param.h>
     75 #include <sys/systm.h>
     76 #include <sys/malloc.h>
     77 #include <sys/mbuf.h>
     78 #include <sys/protosw.h>
     79 #include <sys/socket.h>
     80 #include <sys/socketvar.h>
     81 #include <sys/errno.h>
     82 
     83 #include <net/if.h>
     84 #include <net/route.h>
     85 
     86 #include <netinet/in.h>
     87 #include <netinet/in_systm.h>
     88 #include <netinet/ip.h>
     89 #include <netinet/in_pcb.h>
     90 #include <netinet/ip_var.h>
     91 #include <netinet/tcp.h>
     92 #include <netinet/tcp_fsm.h>
     93 #include <netinet/tcp_seq.h>
     94 #include <netinet/tcp_timer.h>
     95 #include <netinet/tcp_var.h>
     96 #include <netinet/tcpip.h>
     97 #include <netinet/tcp_debug.h>
     98 
     99 #include <machine/stdarg.h>
    100 
    101 int	tcprexmtthresh = 3;
    102 struct	tcpiphdr tcp_saveti;
    103 
    104 extern u_long sb_max;
    105 
    106 #endif /* TUBA_INCLUDE */
    107 #define TCP_PAWS_IDLE	(24 * 24 * 60 * 60 * PR_SLOWHZ)
    108 
    109 /* for modulo comparisons of timestamps */
    110 #define TSTMP_LT(a,b)	((int)((a)-(b)) < 0)
    111 #define TSTMP_GEQ(a,b)	((int)((a)-(b)) >= 0)
    112 
    113 /*
    114  * Insert segment ti into reassembly queue of tcp with
    115  * control block tp.  Return TH_FIN if reassembly now includes
    116  * a segment with FIN.  The macro form does the common case inline
    117  * (segment is the next to be received on an established connection,
    118  * and the queue is empty), avoiding linkage into and removal
    119  * from the queue and repetition of various conversions.
    120  * Set DELACK for segments received in order, but ack immediately
    121  * when segments are out of order (so fast retransmit can work).
    122  */
    123 #define	TCP_REASS(tp, ti, m, so, flags) { \
    124 	if ((ti)->ti_seq == (tp)->rcv_nxt && \
    125 	    (tp)->segq.lh_first == NULL && \
    126 	    (tp)->t_state == TCPS_ESTABLISHED) { \
    127 		if ((ti)->ti_flags & TH_PUSH) \
    128 			tp->t_flags |= TF_ACKNOW; \
    129 		else \
    130 			tp->t_flags |= TF_DELACK; \
    131 		(tp)->rcv_nxt += (ti)->ti_len; \
    132 		flags = (ti)->ti_flags & TH_FIN; \
    133 		tcpstat.tcps_rcvpack++;\
    134 		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
    135 		sbappend(&(so)->so_rcv, (m)); \
    136 		sorwakeup(so); \
    137 	} else { \
    138 		(flags) = tcp_reass((tp), (ti), (m)); \
    139 		tp->t_flags |= TF_ACKNOW; \
    140 	} \
    141 }
    142 #ifndef TUBA_INCLUDE
    143 
    144 int
    145 tcp_reass(tp, ti, m)
    146 	register struct tcpcb *tp;
    147 	register struct tcpiphdr *ti;
    148 	struct mbuf *m;
    149 {
    150 	register struct ipqent *p, *q, *nq, *tiqe;
    151 	struct socket *so = tp->t_inpcb->inp_socket;
    152 	int flags;
    153 
    154 	/*
    155 	 * Call with ti==0 after become established to
    156 	 * force pre-ESTABLISHED data up to user socket.
    157 	 */
    158 	if (ti == 0)
    159 		goto present;
    160 
    161 	/*
    162 	 * Allocate a new queue entry, before we throw away any data.
    163 	 * If we can't, just drop the packet.  XXX
    164 	 */
    165 	MALLOC(tiqe, struct ipqent *, sizeof (struct ipqent), M_IPQ, M_NOWAIT);
    166 	if (tiqe == NULL) {
    167 		tcpstat.tcps_rcvmemdrop++;
    168 		m_freem(m);
    169 		return (0);
    170 	}
    171 
    172 	/*
    173 	 * Find a segment which begins after this one does.
    174 	 */
    175 	for (p = NULL, q = tp->segq.lh_first; q != NULL;
    176 	    p = q, q = q->ipqe_q.le_next)
    177 		if (SEQ_GT(q->ipqe_tcp->ti_seq, ti->ti_seq))
    178 			break;
    179 
    180 	/*
    181 	 * If there is a preceding segment, it may provide some of
    182 	 * our data already.  If so, drop the data from the incoming
    183 	 * segment.  If it provides all of our data, drop us.
    184 	 */
    185 	if (p != NULL) {
    186 		register struct tcpiphdr *phdr = p->ipqe_tcp;
    187 		register int i;
    188 
    189 		/* conversion to int (in i) handles seq wraparound */
    190 		i = phdr->ti_seq + phdr->ti_len - ti->ti_seq;
    191 		if (i > 0) {
    192 			if (i >= ti->ti_len) {
    193 				tcpstat.tcps_rcvduppack++;
    194 				tcpstat.tcps_rcvdupbyte += ti->ti_len;
    195 				m_freem(m);
    196 				FREE(tiqe, M_IPQ);
    197 				return (0);
    198 			}
    199 			m_adj(m, i);
    200 			ti->ti_len -= i;
    201 			ti->ti_seq += i;
    202 		}
    203 	}
    204 	tcpstat.tcps_rcvoopack++;
    205 	tcpstat.tcps_rcvoobyte += ti->ti_len;
    206 
    207 	/*
    208 	 * While we overlap succeeding segments trim them or,
    209 	 * if they are completely covered, dequeue them.
    210 	 */
    211 	for (; q != NULL; q = nq) {
    212 		register struct tcpiphdr *qhdr = q->ipqe_tcp;
    213 		register int i = (ti->ti_seq + ti->ti_len) - qhdr->ti_seq;
    214 
    215 		if (i <= 0)
    216 			break;
    217 		if (i < qhdr->ti_len) {
    218 			qhdr->ti_seq += i;
    219 			qhdr->ti_len -= i;
    220 			m_adj(q->ipqe_m, i);
    221 			break;
    222 		}
    223 		nq = q->ipqe_q.le_next;
    224 		m_freem(q->ipqe_m);
    225 		LIST_REMOVE(q, ipqe_q);
    226 		FREE(q, M_IPQ);
    227 	}
    228 
    229 	/* Insert the new fragment queue entry into place. */
    230 	tiqe->ipqe_m = m;
    231 	tiqe->ipqe_tcp = ti;
    232 	if (p == NULL) {
    233 		LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
    234 	} else {
    235 		LIST_INSERT_AFTER(p, tiqe, ipqe_q);
    236 	}
    237 
    238 present:
    239 	/*
    240 	 * Present data to user, advancing rcv_nxt through
    241 	 * completed sequence space.
    242 	 */
    243 	if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
    244 		return (0);
    245 	q = tp->segq.lh_first;
    246 	if (q == NULL || q->ipqe_tcp->ti_seq != tp->rcv_nxt)
    247 		return (0);
    248 	if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_tcp->ti_len)
    249 		return (0);
    250 	do {
    251 		tp->rcv_nxt += q->ipqe_tcp->ti_len;
    252 		flags = q->ipqe_tcp->ti_flags & TH_FIN;
    253 
    254 		nq = q->ipqe_q.le_next;
    255 		LIST_REMOVE(q, ipqe_q);
    256 		if (so->so_state & SS_CANTRCVMORE)
    257 			m_freem(q->ipqe_m);
    258 		else
    259 			sbappend(&so->so_rcv, q->ipqe_m);
    260 		FREE(q, M_IPQ);
    261 		q = nq;
    262 	} while (q != NULL && q->ipqe_tcp->ti_seq == tp->rcv_nxt);
    263 	sorwakeup(so);
    264 	return (flags);
    265 }
    266 
    267 /*
    268  * TCP input routine, follows pages 65-76 of the
    269  * protocol specification dated September, 1981 very closely.
    270  */
    271 void
    272 #if __STDC__
    273 tcp_input(struct mbuf *m, ...)
    274 #else
    275 tcp_input(m, va_alist)
    276 	register struct mbuf *m;
    277 #endif
    278 {
    279 	register struct tcpiphdr *ti;
    280 	register struct inpcb *inp;
    281 	caddr_t optp = NULL;
    282 	int optlen = 0;
    283 	int len, tlen, off, hdroptlen;
    284 	register struct tcpcb *tp = 0;
    285 	register int tiflags;
    286 	struct socket *so = NULL;
    287 	int todrop, acked, ourfinisacked, needoutput = 0;
    288 	short ostate = 0;
    289 	int iss = 0;
    290 	u_long tiwin;
    291 	struct tcp_opt_info opti;
    292 	int iphlen;
    293 	va_list ap;
    294 
    295 	va_start(ap, m);
    296 	iphlen = va_arg(ap, int);
    297 	va_end(ap);
    298 
    299 	tcpstat.tcps_rcvtotal++;
    300 
    301 	opti.ts_present = 0;
    302 	opti.maxseg = 0;
    303 
    304 	/*
    305 	 * Get IP and TCP header together in first mbuf.
    306 	 * Note: IP leaves IP header in first mbuf.
    307 	 */
    308 	ti = mtod(m, struct tcpiphdr *);
    309 	if (iphlen > sizeof (struct ip))
    310 		ip_stripoptions(m, (struct mbuf *)0);
    311 	if (m->m_len < sizeof (struct tcpiphdr)) {
    312 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
    313 			tcpstat.tcps_rcvshort++;
    314 			return;
    315 		}
    316 		ti = mtod(m, struct tcpiphdr *);
    317 	}
    318 
    319 	/*
    320 	 * Checksum extended TCP header and data.
    321 	 */
    322 	tlen = ((struct ip *)ti)->ip_len;
    323 	len = sizeof (struct ip) + tlen;
    324 	bzero(ti->ti_x1, sizeof ti->ti_x1);
    325 	ti->ti_len = (u_int16_t)tlen;
    326 	HTONS(ti->ti_len);
    327 	if ((ti->ti_sum = in_cksum(m, len)) != 0) {
    328 		tcpstat.tcps_rcvbadsum++;
    329 		goto drop;
    330 	}
    331 #endif /* TUBA_INCLUDE */
    332 
    333 	/*
    334 	 * Check that TCP offset makes sense,
    335 	 * pull out TCP options and adjust length.		XXX
    336 	 */
    337 	off = ti->ti_off << 2;
    338 	if (off < sizeof (struct tcphdr) || off > tlen) {
    339 		tcpstat.tcps_rcvbadoff++;
    340 		goto drop;
    341 	}
    342 	tlen -= off;
    343 	ti->ti_len = tlen;
    344 	if (off > sizeof (struct tcphdr)) {
    345 		if (m->m_len < sizeof(struct ip) + off) {
    346 			if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
    347 				tcpstat.tcps_rcvshort++;
    348 				return;
    349 			}
    350 			ti = mtod(m, struct tcpiphdr *);
    351 		}
    352 		optlen = off - sizeof (struct tcphdr);
    353 		optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
    354 		/*
    355 		 * Do quick retrieval of timestamp options ("options
    356 		 * prediction?").  If timestamp is the only option and it's
    357 		 * formatted as recommended in RFC 1323 appendix A, we
    358 		 * quickly get the values now and not bother calling
    359 		 * tcp_dooptions(), etc.
    360 		 */
    361 		if ((optlen == TCPOLEN_TSTAMP_APPA ||
    362 		     (optlen > TCPOLEN_TSTAMP_APPA &&
    363 			optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
    364 		     *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
    365 		     (ti->ti_flags & TH_SYN) == 0) {
    366 			opti.ts_present = 1;
    367 			opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
    368 			opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
    369 			optp = NULL;	/* we've parsed the options */
    370 		}
    371 	}
    372 	tiflags = ti->ti_flags;
    373 
    374 	/*
    375 	 * Convert TCP protocol specific fields to host format.
    376 	 */
    377 	NTOHL(ti->ti_seq);
    378 	NTOHL(ti->ti_ack);
    379 	NTOHS(ti->ti_win);
    380 	NTOHS(ti->ti_urp);
    381 
    382 	/*
    383 	 * Locate pcb for segment.
    384 	 */
    385 findpcb:
    386 	inp = in_pcblookup_connect(&tcbtable, ti->ti_src, ti->ti_sport,
    387 	    ti->ti_dst, ti->ti_dport);
    388 	if (inp == 0) {
    389 		++tcpstat.tcps_pcbhashmiss;
    390 		inp = in_pcblookup_bind(&tcbtable, ti->ti_dst, ti->ti_dport);
    391 		if (inp == 0) {
    392 			++tcpstat.tcps_noport;
    393 			goto dropwithreset;
    394 		}
    395 	}
    396 
    397 	/*
    398 	 * If the state is CLOSED (i.e., TCB does not exist) then
    399 	 * all data in the incoming segment is discarded.
    400 	 * If the TCB exists but is in CLOSED state, it is embryonic,
    401 	 * but should either do a listen or a connect soon.
    402 	 */
    403 	tp = intotcpcb(inp);
    404 	if (tp == 0)
    405 		goto dropwithreset;
    406 	if (tp->t_state == TCPS_CLOSED)
    407 		goto drop;
    408 
    409 	/* Unscale the window into a 32-bit value. */
    410 	if ((tiflags & TH_SYN) == 0)
    411 		tiwin = ti->ti_win << tp->snd_scale;
    412 	else
    413 		tiwin = ti->ti_win;
    414 
    415 	so = inp->inp_socket;
    416 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
    417 		if (so->so_options & SO_DEBUG) {
    418 			ostate = tp->t_state;
    419 			tcp_saveti = *ti;
    420 		}
    421 		if (so->so_options & SO_ACCEPTCONN) {
    422   			if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
    423 				if (tiflags & TH_RST) {
    424 					syn_cache_reset(ti);
    425 				} else if ((tiflags & (TH_ACK|TH_SYN)) ==
    426 				    (TH_ACK|TH_SYN)) {
    427 					/*
    428 					 * Received a SYN,ACK.  This should
    429 					 * never happen while we are in
    430 					 * LISTEN.  Send an RST.
    431 					 */
    432 					goto badsyn;
    433 				} else if (tiflags & TH_ACK) {
    434 					so = syn_cache_get(so, m);
    435 					if (so == NULL) {
    436 						/*
    437 						 * We don't have a SYN for
    438 						 * this ACK; send an RST.
    439 						 */
    440 						goto badsyn;
    441 					} else if (so ==
    442 					    (struct socket *)(-1)) {
    443 						/*
    444 						 * We were unable to create
    445 						 * the connection.  If the
    446 						 * 3-way handshake was
    447 						 * completeed, and RST has
    448 						 * been sent to the peer.
    449 						 * Since the mbuf might be
    450 						 * in use for the reply,
    451 						 * do not free it.
    452 						 */
    453 						m = NULL;
    454 					} else {
    455 						/*
    456 						 * We have created a
    457 						 * full-blown connection.
    458 						 */
    459 						inp = sotoinpcb(so);
    460 						tp = intotcpcb(inp);
    461 						tiwin <<= tp->snd_scale;
    462 						goto after_listen;
    463 					}
    464   				}
    465   			} else {
    466 				/*
    467 				 * Received a SYN.
    468 				 */
    469 				if (in_hosteq(ti->ti_src, ti->ti_dst) &&
    470 				    ti->ti_sport == ti->ti_dport) {
    471 					/*
    472 					 * LISTEN socket received a SYN
    473 					 * from itself?  This can't possibly
    474 					 * be valid; send an RST.
    475 					 */
    476 					goto badsyn;
    477 				}
    478 				/*
    479 				 * SYN looks ok; create compressed TCP
    480 				 * state for it.
    481 				 */
    482 				if (so->so_qlen <= so->so_qlimit &&
    483 				    syn_cache_add(so, m, optp, optlen, &opti))
    484 					m = NULL;
    485 			}
    486 			goto drop;
    487 		}
    488 	}
    489 
    490 after_listen:
    491 #ifdef DIAGNOSTIC
    492 	/*
    493 	 * Should not happen now that all embryonic connections
    494 	 * are handled with compressed state.
    495 	 */
    496 	if (tp->t_state == TCPS_LISTEN)
    497 		panic("tcp_input: TCPS_LISTEN");
    498 #endif
    499 
    500 	/*
    501 	 * Segment received on connection.
    502 	 * Reset idle time and keep-alive timer.
    503 	 */
    504 	tp->t_idle = 0;
    505 	if (TCPS_HAVEESTABLISHED(tp->t_state))
    506 		tp->t_timer[TCPT_KEEP] = tcp_keepidle;
    507 
    508 	/*
    509 	 * Process options.
    510 	 */
    511 	if (optp)
    512 		tcp_dooptions(tp, optp, optlen, ti, &opti);
    513 
    514 	/*
    515 	 * Header prediction: check for the two common cases
    516 	 * of a uni-directional data xfer.  If the packet has
    517 	 * no control flags, is in-sequence, the window didn't
    518 	 * change and we're not retransmitting, it's a
    519 	 * candidate.  If the length is zero and the ack moved
    520 	 * forward, we're the sender side of the xfer.  Just
    521 	 * free the data acked & wake any higher level process
    522 	 * that was blocked waiting for space.  If the length
    523 	 * is non-zero and the ack didn't move, we're the
    524 	 * receiver side.  If we're getting packets in-order
    525 	 * (the reassembly queue is empty), add the data to
    526 	 * the socket buffer and note that we need a delayed ack.
    527 	 */
    528 	if (tp->t_state == TCPS_ESTABLISHED &&
    529 	    (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
    530 	    (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
    531 	    ti->ti_seq == tp->rcv_nxt &&
    532 	    tiwin && tiwin == tp->snd_wnd &&
    533 	    tp->snd_nxt == tp->snd_max) {
    534 
    535 		/*
    536 		 * If last ACK falls within this segment's sequence numbers,
    537 		 *  record the timestamp.
    538 		 */
    539 		if (opti.ts_present &&
    540 		    SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
    541 		    SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len)) {
    542 			tp->ts_recent_age = tcp_now;
    543 			tp->ts_recent = opti.ts_val;
    544 		}
    545 
    546 		if (ti->ti_len == 0) {
    547 			if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
    548 			    SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
    549 			    tp->snd_cwnd >= tp->snd_wnd &&
    550 			    tp->t_dupacks < tcprexmtthresh) {
    551 				/*
    552 				 * this is a pure ack for outstanding data.
    553 				 */
    554 				++tcpstat.tcps_predack;
    555 				if (opti.ts_present)
    556 					tcp_xmit_timer(tp,
    557 					    tcp_now-opti.ts_ecr+1);
    558 				else if (tp->t_rtt &&
    559 				    SEQ_GT(ti->ti_ack, tp->t_rtseq))
    560 					tcp_xmit_timer(tp, tp->t_rtt);
    561 				acked = ti->ti_ack - tp->snd_una;
    562 				tcpstat.tcps_rcvackpack++;
    563 				tcpstat.tcps_rcvackbyte += acked;
    564 				sbdrop(&so->so_snd, acked);
    565 				tp->snd_una = ti->ti_ack;
    566 				m_freem(m);
    567 
    568 				/*
    569 				 * If all outstanding data are acked, stop
    570 				 * retransmit timer, otherwise restart timer
    571 				 * using current (possibly backed-off) value.
    572 				 * If process is waiting for space,
    573 				 * wakeup/selwakeup/signal.  If data
    574 				 * are ready to send, let tcp_output
    575 				 * decide between more output or persist.
    576 				 */
    577 				if (tp->snd_una == tp->snd_max)
    578 					tp->t_timer[TCPT_REXMT] = 0;
    579 				else if (tp->t_timer[TCPT_PERSIST] == 0)
    580 					tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
    581 
    582 				if (sb_notify(&so->so_snd))
    583 					sowwakeup(so);
    584 				if (so->so_snd.sb_cc)
    585 					(void) tcp_output(tp);
    586 				return;
    587 			}
    588 		} else if (ti->ti_ack == tp->snd_una &&
    589 		    tp->segq.lh_first == NULL &&
    590 		    ti->ti_len <= sbspace(&so->so_rcv)) {
    591 			/*
    592 			 * this is a pure, in-sequence data packet
    593 			 * with nothing on the reassembly queue and
    594 			 * we have enough buffer space to take it.
    595 			 */
    596 			++tcpstat.tcps_preddat;
    597 			tp->rcv_nxt += ti->ti_len;
    598 			tcpstat.tcps_rcvpack++;
    599 			tcpstat.tcps_rcvbyte += ti->ti_len;
    600 			/*
    601 			 * Drop TCP, IP headers and TCP options then add data
    602 			 * to socket buffer.
    603 			 */
    604 			m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
    605 			m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
    606 			sbappend(&so->so_rcv, m);
    607 			sorwakeup(so);
    608 			if (ti->ti_flags & TH_PUSH)
    609 				tp->t_flags |= TF_ACKNOW;
    610 			else
    611 				tp->t_flags |= TF_DELACK;
    612 			return;
    613 		}
    614 	}
    615 
    616 	/*
    617 	 * Drop TCP, IP headers and TCP options.
    618 	 */
    619 	hdroptlen  = sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
    620 	m->m_data += hdroptlen;
    621 	m->m_len  -= hdroptlen;
    622 
    623 	/*
    624 	 * Calculate amount of space in receive window,
    625 	 * and then do TCP input processing.
    626 	 * Receive window is amount of space in rcv queue,
    627 	 * but not less than advertised window.
    628 	 */
    629 	{ int win;
    630 
    631 	win = sbspace(&so->so_rcv);
    632 	if (win < 0)
    633 		win = 0;
    634 	tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
    635 	}
    636 
    637 	switch (tp->t_state) {
    638 
    639 	/*
    640 	 * If the state is SYN_SENT:
    641 	 *	if seg contains an ACK, but not for our SYN, drop the input.
    642 	 *	if seg contains a RST, then drop the connection.
    643 	 *	if seg does not contain SYN, then drop it.
    644 	 * Otherwise this is an acceptable SYN segment
    645 	 *	initialize tp->rcv_nxt and tp->irs
    646 	 *	if seg contains ack then advance tp->snd_una
    647 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
    648 	 *	arrange for segment to be acked (eventually)
    649 	 *	continue processing rest of data/controls, beginning with URG
    650 	 */
    651 	case TCPS_SYN_SENT:
    652 		if ((tiflags & TH_ACK) &&
    653 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
    654 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
    655 			goto dropwithreset;
    656 		if (tiflags & TH_RST) {
    657 			if (tiflags & TH_ACK)
    658 				tp = tcp_drop(tp, ECONNREFUSED);
    659 			goto drop;
    660 		}
    661 		if ((tiflags & TH_SYN) == 0)
    662 			goto drop;
    663 		if (tiflags & TH_ACK) {
    664 			tp->snd_una = ti->ti_ack;
    665 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
    666 				tp->snd_nxt = tp->snd_una;
    667 		}
    668 		tp->t_timer[TCPT_REXMT] = 0;
    669 		tp->irs = ti->ti_seq;
    670 		tcp_rcvseqinit(tp);
    671 		tp->t_flags |= TF_ACKNOW;
    672 		tcp_mss_from_peer(tp, opti.maxseg);
    673 		tcp_rmx_rtt(tp);
    674 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
    675 			tcpstat.tcps_connects++;
    676 			soisconnected(so);
    677 			tcp_established(tp);
    678 			/* Do window scaling on this connection? */
    679 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
    680 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
    681 				tp->snd_scale = tp->requested_s_scale;
    682 				tp->rcv_scale = tp->request_r_scale;
    683 			}
    684 			(void) tcp_reass(tp, (struct tcpiphdr *)0,
    685 				(struct mbuf *)0);
    686 			/*
    687 			 * if we didn't have to retransmit the SYN,
    688 			 * use its rtt as our initial srtt & rtt var.
    689 			 */
    690 			if (tp->t_rtt)
    691 				tcp_xmit_timer(tp, tp->t_rtt);
    692 		} else
    693 			tp->t_state = TCPS_SYN_RECEIVED;
    694 
    695 		/*
    696 		 * Advance ti->ti_seq to correspond to first data byte.
    697 		 * If data, trim to stay within window,
    698 		 * dropping FIN if necessary.
    699 		 */
    700 		ti->ti_seq++;
    701 		if (ti->ti_len > tp->rcv_wnd) {
    702 			todrop = ti->ti_len - tp->rcv_wnd;
    703 			m_adj(m, -todrop);
    704 			ti->ti_len = tp->rcv_wnd;
    705 			tiflags &= ~TH_FIN;
    706 			tcpstat.tcps_rcvpackafterwin++;
    707 			tcpstat.tcps_rcvbyteafterwin += todrop;
    708 		}
    709 		tp->snd_wl1 = ti->ti_seq - 1;
    710 		tp->rcv_up = ti->ti_seq;
    711 		goto step6;
    712 
    713 	/*
    714 	 * If the state is SYN_RECEIVED:
    715 	 *	If seg contains an ACK, but not for our SYN, drop the input
    716 	 *	and generate an RST.  See page 36, rfc793
    717 	 */
    718 	case TCPS_SYN_RECEIVED:
    719 		if ((tiflags & TH_ACK) &&
    720 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
    721 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
    722 			goto dropwithreset;
    723 		break;
    724 	}
    725 
    726 	/*
    727 	 * States other than LISTEN or SYN_SENT.
    728 	 * First check timestamp, if present.
    729 	 * Then check that at least some bytes of segment are within
    730 	 * receive window.  If segment begins before rcv_nxt,
    731 	 * drop leading data (and SYN); if nothing left, just ack.
    732 	 *
    733 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
    734 	 * and it's less than ts_recent, drop it.
    735 	 */
    736 	if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
    737 	    TSTMP_LT(opti.ts_val, tp->ts_recent)) {
    738 
    739 		/* Check to see if ts_recent is over 24 days old.  */
    740 		if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) {
    741 			/*
    742 			 * Invalidate ts_recent.  If this segment updates
    743 			 * ts_recent, the age will be reset later and ts_recent
    744 			 * will get a valid value.  If it does not, setting
    745 			 * ts_recent to zero will at least satisfy the
    746 			 * requirement that zero be placed in the timestamp
    747 			 * echo reply when ts_recent isn't valid.  The
    748 			 * age isn't reset until we get a valid ts_recent
    749 			 * because we don't want out-of-order segments to be
    750 			 * dropped when ts_recent is old.
    751 			 */
    752 			tp->ts_recent = 0;
    753 		} else {
    754 			tcpstat.tcps_rcvduppack++;
    755 			tcpstat.tcps_rcvdupbyte += ti->ti_len;
    756 			tcpstat.tcps_pawsdrop++;
    757 			goto dropafterack;
    758 		}
    759 	}
    760 
    761 	todrop = tp->rcv_nxt - ti->ti_seq;
    762 	if (todrop > 0) {
    763 		if (tiflags & TH_SYN) {
    764 			tiflags &= ~TH_SYN;
    765 			ti->ti_seq++;
    766 			if (ti->ti_urp > 1)
    767 				ti->ti_urp--;
    768 			else {
    769 				tiflags &= ~TH_URG;
    770 				ti->ti_urp = 0;
    771 			}
    772 			todrop--;
    773 		}
    774 		if (todrop >= ti->ti_len) {
    775 			/*
    776 			 * Any valid FIN must be to the left of the
    777 			 * window.  At this point, FIN must be a
    778 			 * duplicate or out-of-sequence, so drop it.
    779 			 */
    780 			tiflags &= ~TH_FIN;
    781 			/*
    782 			 * Send ACK to resynchronize, and drop any data,
    783 			 * but keep on processing for RST or ACK.
    784 			 */
    785 			tp->t_flags |= TF_ACKNOW;
    786 			tcpstat.tcps_rcvdupbyte += todrop = ti->ti_len;
    787 			tcpstat.tcps_rcvduppack++;
    788 		} else {
    789 			tcpstat.tcps_rcvpartduppack++;
    790 			tcpstat.tcps_rcvpartdupbyte += todrop;
    791 		}
    792 		m_adj(m, todrop);
    793 		ti->ti_seq += todrop;
    794 		ti->ti_len -= todrop;
    795 		if (ti->ti_urp > todrop)
    796 			ti->ti_urp -= todrop;
    797 		else {
    798 			tiflags &= ~TH_URG;
    799 			ti->ti_urp = 0;
    800 		}
    801 	}
    802 
    803 	/*
    804 	 * If new data are received on a connection after the
    805 	 * user processes are gone, then RST the other end.
    806 	 */
    807 	if ((so->so_state & SS_NOFDREF) &&
    808 	    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
    809 		tp = tcp_close(tp);
    810 		tcpstat.tcps_rcvafterclose++;
    811 		goto dropwithreset;
    812 	}
    813 
    814 	/*
    815 	 * If segment ends after window, drop trailing data
    816 	 * (and PUSH and FIN); if nothing left, just ACK.
    817 	 */
    818 	todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
    819 	if (todrop > 0) {
    820 		tcpstat.tcps_rcvpackafterwin++;
    821 		if (todrop >= ti->ti_len) {
    822 			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
    823 			/*
    824 			 * If a new connection request is received
    825 			 * while in TIME_WAIT, drop the old connection
    826 			 * and start over if the sequence numbers
    827 			 * are above the previous ones.
    828 			 */
    829 			if (tiflags & TH_SYN &&
    830 			    tp->t_state == TCPS_TIME_WAIT &&
    831 			    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
    832 				iss = tcp_new_iss(tp, sizeof(struct tcpcb),
    833 						  tp->rcv_nxt);
    834 				tp = tcp_close(tp);
    835 				/*
    836 				 * We have already advanced the mbuf
    837 				 * pointers past the IP+TCP headers and
    838 				 * options.  Restore those pointers before
    839 				 * attempting to use the TCP header again.
    840 				 */
    841 				m->m_data -= hdroptlen;
    842 				m->m_len  += hdroptlen;
    843 				goto findpcb;
    844 			}
    845 			/*
    846 			 * If window is closed can only take segments at
    847 			 * window edge, and have to drop data and PUSH from
    848 			 * incoming segments.  Continue processing, but
    849 			 * remember to ack.  Otherwise, drop segment
    850 			 * and ack.
    851 			 */
    852 			if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
    853 				tp->t_flags |= TF_ACKNOW;
    854 				tcpstat.tcps_rcvwinprobe++;
    855 			} else
    856 				goto dropafterack;
    857 		} else
    858 			tcpstat.tcps_rcvbyteafterwin += todrop;
    859 		m_adj(m, -todrop);
    860 		ti->ti_len -= todrop;
    861 		tiflags &= ~(TH_PUSH|TH_FIN);
    862 	}
    863 
    864 	/*
    865 	 * If last ACK falls within this segment's sequence numbers,
    866 	 * record its timestamp.
    867 	 */
    868 	if (opti.ts_present && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
    869 	    SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len +
    870 		   ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
    871 		tp->ts_recent_age = tcp_now;
    872 		tp->ts_recent = opti.ts_val;
    873 	}
    874 
    875 	/*
    876 	 * If the RST bit is set examine the state:
    877 	 *    SYN_RECEIVED STATE:
    878 	 *	If passive open, return to LISTEN state.
    879 	 *	If active open, inform user that connection was refused.
    880 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
    881 	 *	Inform user that connection was reset, and close tcb.
    882 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
    883 	 *	Close the tcb.
    884 	 */
    885 	if (tiflags&TH_RST) switch (tp->t_state) {
    886 
    887 	case TCPS_SYN_RECEIVED:
    888 		so->so_error = ECONNREFUSED;
    889 		goto close;
    890 
    891 	case TCPS_ESTABLISHED:
    892 	case TCPS_FIN_WAIT_1:
    893 	case TCPS_FIN_WAIT_2:
    894 	case TCPS_CLOSE_WAIT:
    895 		so->so_error = ECONNRESET;
    896 	close:
    897 		tp->t_state = TCPS_CLOSED;
    898 		tcpstat.tcps_drops++;
    899 		tp = tcp_close(tp);
    900 		goto drop;
    901 
    902 	case TCPS_CLOSING:
    903 	case TCPS_LAST_ACK:
    904 	case TCPS_TIME_WAIT:
    905 		tp = tcp_close(tp);
    906 		goto drop;
    907 	}
    908 
    909 	/*
    910 	 * If a SYN is in the window, then this is an
    911 	 * error and we send an RST and drop the connection.
    912 	 */
    913 	if (tiflags & TH_SYN) {
    914 		tp = tcp_drop(tp, ECONNRESET);
    915 		goto dropwithreset;
    916 	}
    917 
    918 	/*
    919 	 * If the ACK bit is off we drop the segment and return.
    920 	 */
    921 	if ((tiflags & TH_ACK) == 0)
    922 		goto drop;
    923 
    924 	/*
    925 	 * Ack processing.
    926 	 */
    927 	switch (tp->t_state) {
    928 
    929 	/*
    930 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
    931 	 * ESTABLISHED state and continue processing, otherwise
    932 	 * send an RST.
    933 	 */
    934 	case TCPS_SYN_RECEIVED:
    935 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
    936 		    SEQ_GT(ti->ti_ack, tp->snd_max))
    937 			goto dropwithreset;
    938 		tcpstat.tcps_connects++;
    939 		soisconnected(so);
    940 		tcp_established(tp);
    941 		/* Do window scaling? */
    942 		if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
    943 			(TF_RCVD_SCALE|TF_REQ_SCALE)) {
    944 			tp->snd_scale = tp->requested_s_scale;
    945 			tp->rcv_scale = tp->request_r_scale;
    946 		}
    947 		(void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
    948 		tp->snd_wl1 = ti->ti_seq - 1;
    949 		/* fall into ... */
    950 
    951 	/*
    952 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
    953 	 * ACKs.  If the ack is in the range
    954 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
    955 	 * then advance tp->snd_una to ti->ti_ack and drop
    956 	 * data from the retransmission queue.  If this ACK reflects
    957 	 * more up to date window information we update our window information.
    958 	 */
    959 	case TCPS_ESTABLISHED:
    960 	case TCPS_FIN_WAIT_1:
    961 	case TCPS_FIN_WAIT_2:
    962 	case TCPS_CLOSE_WAIT:
    963 	case TCPS_CLOSING:
    964 	case TCPS_LAST_ACK:
    965 	case TCPS_TIME_WAIT:
    966 
    967 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
    968 			if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
    969 				tcpstat.tcps_rcvdupack++;
    970 				/*
    971 				 * If we have outstanding data (other than
    972 				 * a window probe), this is a completely
    973 				 * duplicate ack (ie, window info didn't
    974 				 * change), the ack is the biggest we've
    975 				 * seen and we've seen exactly our rexmt
    976 				 * threshhold of them, assume a packet
    977 				 * has been dropped and retransmit it.
    978 				 * Kludge snd_nxt & the congestion
    979 				 * window so we send only this one
    980 				 * packet.
    981 				 *
    982 				 * We know we're losing at the current
    983 				 * window size so do congestion avoidance
    984 				 * (set ssthresh to half the current window
    985 				 * and pull our congestion window back to
    986 				 * the new ssthresh).
    987 				 *
    988 				 * Dup acks mean that packets have left the
    989 				 * network (they're now cached at the receiver)
    990 				 * so bump cwnd by the amount in the receiver
    991 				 * to keep a constant cwnd packets in the
    992 				 * network.
    993 				 */
    994 				if (tp->t_timer[TCPT_REXMT] == 0 ||
    995 				    ti->ti_ack != tp->snd_una)
    996 					tp->t_dupacks = 0;
    997 				else if (++tp->t_dupacks == tcprexmtthresh) {
    998 					tcp_seq onxt = tp->snd_nxt;
    999 					u_int win =
   1000 					    min(tp->snd_wnd, tp->snd_cwnd) /
   1001 					    2 /	tp->t_segsz;
   1002 
   1003 					if (win < 2)
   1004 						win = 2;
   1005 					tp->snd_ssthresh = win * tp->t_segsz;
   1006 					tp->t_timer[TCPT_REXMT] = 0;
   1007 					tp->t_rtt = 0;
   1008 					tp->snd_nxt = ti->ti_ack;
   1009 					tp->snd_cwnd = tp->t_segsz;
   1010 					(void) tcp_output(tp);
   1011 					tp->snd_cwnd = tp->snd_ssthresh +
   1012 					       tp->t_segsz * tp->t_dupacks;
   1013 					if (SEQ_GT(onxt, tp->snd_nxt))
   1014 						tp->snd_nxt = onxt;
   1015 					goto drop;
   1016 				} else if (tp->t_dupacks > tcprexmtthresh) {
   1017 					tp->snd_cwnd += tp->t_segsz;
   1018 					(void) tcp_output(tp);
   1019 					goto drop;
   1020 				}
   1021 			} else
   1022 				tp->t_dupacks = 0;
   1023 			break;
   1024 		}
   1025 		/*
   1026 		 * If the congestion window was inflated to account
   1027 		 * for the other side's cached packets, retract it.
   1028 		 */
   1029 		if (tp->t_dupacks >= tcprexmtthresh &&
   1030 		    tp->snd_cwnd > tp->snd_ssthresh)
   1031 			tp->snd_cwnd = tp->snd_ssthresh;
   1032 		tp->t_dupacks = 0;
   1033 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
   1034 			tcpstat.tcps_rcvacktoomuch++;
   1035 			goto dropafterack;
   1036 		}
   1037 		acked = ti->ti_ack - tp->snd_una;
   1038 		tcpstat.tcps_rcvackpack++;
   1039 		tcpstat.tcps_rcvackbyte += acked;
   1040 
   1041 		/*
   1042 		 * If we have a timestamp reply, update smoothed
   1043 		 * round trip time.  If no timestamp is present but
   1044 		 * transmit timer is running and timed sequence
   1045 		 * number was acked, update smoothed round trip time.
   1046 		 * Since we now have an rtt measurement, cancel the
   1047 		 * timer backoff (cf., Phil Karn's retransmit alg.).
   1048 		 * Recompute the initial retransmit timer.
   1049 		 */
   1050 		if (opti.ts_present)
   1051 			tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1);
   1052 		else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
   1053 			tcp_xmit_timer(tp,tp->t_rtt);
   1054 
   1055 		/*
   1056 		 * If all outstanding data is acked, stop retransmit
   1057 		 * timer and remember to restart (more output or persist).
   1058 		 * If there is more data to be acked, restart retransmit
   1059 		 * timer, using current (possibly backed-off) value.
   1060 		 */
   1061 		if (ti->ti_ack == tp->snd_max) {
   1062 			tp->t_timer[TCPT_REXMT] = 0;
   1063 			needoutput = 1;
   1064 		} else if (tp->t_timer[TCPT_PERSIST] == 0)
   1065 			tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
   1066 		/*
   1067 		 * When new data is acked, open the congestion window.
   1068 		 * If the window gives us less than ssthresh packets
   1069 		 * in flight, open exponentially (segsz per packet).
   1070 		 * Otherwise open linearly: segsz per window
   1071 		 * (segsz^2 / cwnd per packet), plus a constant
   1072 		 * fraction of a packet (segsz/8) to help larger windows
   1073 		 * open quickly enough.
   1074 		 */
   1075 		{
   1076 		register u_int cw = tp->snd_cwnd;
   1077 		register u_int incr = tp->t_segsz;
   1078 
   1079 		if (cw > tp->snd_ssthresh)
   1080 			incr = incr * incr / cw;
   1081 		tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale);
   1082 		}
   1083 		if (acked > so->so_snd.sb_cc) {
   1084 			tp->snd_wnd -= so->so_snd.sb_cc;
   1085 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
   1086 			ourfinisacked = 1;
   1087 		} else {
   1088 			sbdrop(&so->so_snd, acked);
   1089 			tp->snd_wnd -= acked;
   1090 			ourfinisacked = 0;
   1091 		}
   1092 		if (sb_notify(&so->so_snd))
   1093 			sowwakeup(so);
   1094 		tp->snd_una = ti->ti_ack;
   1095 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
   1096 			tp->snd_nxt = tp->snd_una;
   1097 
   1098 		switch (tp->t_state) {
   1099 
   1100 		/*
   1101 		 * In FIN_WAIT_1 STATE in addition to the processing
   1102 		 * for the ESTABLISHED state if our FIN is now acknowledged
   1103 		 * then enter FIN_WAIT_2.
   1104 		 */
   1105 		case TCPS_FIN_WAIT_1:
   1106 			if (ourfinisacked) {
   1107 				/*
   1108 				 * If we can't receive any more
   1109 				 * data, then closing user can proceed.
   1110 				 * Starting the timer is contrary to the
   1111 				 * specification, but if we don't get a FIN
   1112 				 * we'll hang forever.
   1113 				 */
   1114 				if (so->so_state & SS_CANTRCVMORE) {
   1115 					soisdisconnected(so);
   1116 					tp->t_timer[TCPT_2MSL] = tcp_maxidle;
   1117 				}
   1118 				tp->t_state = TCPS_FIN_WAIT_2;
   1119 			}
   1120 			break;
   1121 
   1122 	 	/*
   1123 		 * In CLOSING STATE in addition to the processing for
   1124 		 * the ESTABLISHED state if the ACK acknowledges our FIN
   1125 		 * then enter the TIME-WAIT state, otherwise ignore
   1126 		 * the segment.
   1127 		 */
   1128 		case TCPS_CLOSING:
   1129 			if (ourfinisacked) {
   1130 				tp->t_state = TCPS_TIME_WAIT;
   1131 				tcp_canceltimers(tp);
   1132 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1133 				soisdisconnected(so);
   1134 			}
   1135 			break;
   1136 
   1137 		/*
   1138 		 * In LAST_ACK, we may still be waiting for data to drain
   1139 		 * and/or to be acked, as well as for the ack of our FIN.
   1140 		 * If our FIN is now acknowledged, delete the TCB,
   1141 		 * enter the closed state and return.
   1142 		 */
   1143 		case TCPS_LAST_ACK:
   1144 			if (ourfinisacked) {
   1145 				tp = tcp_close(tp);
   1146 				goto drop;
   1147 			}
   1148 			break;
   1149 
   1150 		/*
   1151 		 * In TIME_WAIT state the only thing that should arrive
   1152 		 * is a retransmission of the remote FIN.  Acknowledge
   1153 		 * it and restart the finack timer.
   1154 		 */
   1155 		case TCPS_TIME_WAIT:
   1156 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1157 			goto dropafterack;
   1158 		}
   1159 	}
   1160 
   1161 step6:
   1162 	/*
   1163 	 * Update window information.
   1164 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
   1165 	 */
   1166 	if (((tiflags & TH_ACK) && SEQ_LT(tp->snd_wl1, ti->ti_seq)) ||
   1167 	    (tp->snd_wl1 == ti->ti_seq && SEQ_LT(tp->snd_wl2, ti->ti_ack)) ||
   1168 	    (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)) {
   1169 		/* keep track of pure window updates */
   1170 		if (ti->ti_len == 0 &&
   1171 		    tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)
   1172 			tcpstat.tcps_rcvwinupd++;
   1173 		tp->snd_wnd = tiwin;
   1174 		tp->snd_wl1 = ti->ti_seq;
   1175 		tp->snd_wl2 = ti->ti_ack;
   1176 		if (tp->snd_wnd > tp->max_sndwnd)
   1177 			tp->max_sndwnd = tp->snd_wnd;
   1178 		needoutput = 1;
   1179 	}
   1180 
   1181 	/*
   1182 	 * Process segments with URG.
   1183 	 */
   1184 	if ((tiflags & TH_URG) && ti->ti_urp &&
   1185 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1186 		/*
   1187 		 * This is a kludge, but if we receive and accept
   1188 		 * random urgent pointers, we'll crash in
   1189 		 * soreceive.  It's hard to imagine someone
   1190 		 * actually wanting to send this much urgent data.
   1191 		 */
   1192 		if (ti->ti_urp + so->so_rcv.sb_cc > sb_max) {
   1193 			ti->ti_urp = 0;			/* XXX */
   1194 			tiflags &= ~TH_URG;		/* XXX */
   1195 			goto dodata;			/* XXX */
   1196 		}
   1197 		/*
   1198 		 * If this segment advances the known urgent pointer,
   1199 		 * then mark the data stream.  This should not happen
   1200 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
   1201 		 * a FIN has been received from the remote side.
   1202 		 * In these states we ignore the URG.
   1203 		 *
   1204 		 * According to RFC961 (Assigned Protocols),
   1205 		 * the urgent pointer points to the last octet
   1206 		 * of urgent data.  We continue, however,
   1207 		 * to consider it to indicate the first octet
   1208 		 * of data past the urgent section as the original
   1209 		 * spec states (in one of two places).
   1210 		 */
   1211 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
   1212 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
   1213 			so->so_oobmark = so->so_rcv.sb_cc +
   1214 			    (tp->rcv_up - tp->rcv_nxt) - 1;
   1215 			if (so->so_oobmark == 0)
   1216 				so->so_state |= SS_RCVATMARK;
   1217 			sohasoutofband(so);
   1218 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
   1219 		}
   1220 		/*
   1221 		 * Remove out of band data so doesn't get presented to user.
   1222 		 * This can happen independent of advancing the URG pointer,
   1223 		 * but if two URG's are pending at once, some out-of-band
   1224 		 * data may creep in... ick.
   1225 		 */
   1226 		if (ti->ti_urp <= (u_int16_t) ti->ti_len
   1227 #ifdef SO_OOBINLINE
   1228 		     && (so->so_options & SO_OOBINLINE) == 0
   1229 #endif
   1230 		     )
   1231 			tcp_pulloutofband(so, ti, m);
   1232 	} else
   1233 		/*
   1234 		 * If no out of band data is expected,
   1235 		 * pull receive urgent pointer along
   1236 		 * with the receive window.
   1237 		 */
   1238 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
   1239 			tp->rcv_up = tp->rcv_nxt;
   1240 dodata:							/* XXX */
   1241 
   1242 	/*
   1243 	 * Process the segment text, merging it into the TCP sequencing queue,
   1244 	 * and arranging for acknowledgment of receipt if necessary.
   1245 	 * This process logically involves adjusting tp->rcv_wnd as data
   1246 	 * is presented to the user (this happens in tcp_usrreq.c,
   1247 	 * case PRU_RCVD).  If a FIN has already been received on this
   1248 	 * connection then we just ignore the text.
   1249 	 */
   1250 	if ((ti->ti_len || (tiflags & TH_FIN)) &&
   1251 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1252 		TCP_REASS(tp, ti, m, so, tiflags);
   1253 		/*
   1254 		 * Note the amount of data that peer has sent into
   1255 		 * our window, in order to estimate the sender's
   1256 		 * buffer size.
   1257 		 */
   1258 		len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
   1259 	} else {
   1260 		m_freem(m);
   1261 		tiflags &= ~TH_FIN;
   1262 	}
   1263 
   1264 	/*
   1265 	 * If FIN is received ACK the FIN and let the user know
   1266 	 * that the connection is closing.  Ignore a FIN received before
   1267 	 * the connection is fully established.
   1268 	 */
   1269 	if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
   1270 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1271 			socantrcvmore(so);
   1272 			tp->t_flags |= TF_ACKNOW;
   1273 			tp->rcv_nxt++;
   1274 		}
   1275 		switch (tp->t_state) {
   1276 
   1277 	 	/*
   1278 		 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
   1279 		 */
   1280 		case TCPS_ESTABLISHED:
   1281 			tp->t_state = TCPS_CLOSE_WAIT;
   1282 			break;
   1283 
   1284 	 	/*
   1285 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
   1286 		 * enter the CLOSING state.
   1287 		 */
   1288 		case TCPS_FIN_WAIT_1:
   1289 			tp->t_state = TCPS_CLOSING;
   1290 			break;
   1291 
   1292 	 	/*
   1293 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
   1294 		 * starting the time-wait timer, turning off the other
   1295 		 * standard timers.
   1296 		 */
   1297 		case TCPS_FIN_WAIT_2:
   1298 			tp->t_state = TCPS_TIME_WAIT;
   1299 			tcp_canceltimers(tp);
   1300 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1301 			soisdisconnected(so);
   1302 			break;
   1303 
   1304 		/*
   1305 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
   1306 		 */
   1307 		case TCPS_TIME_WAIT:
   1308 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1309 			break;
   1310 		}
   1311 	}
   1312 	if (so->so_options & SO_DEBUG)
   1313 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
   1314 
   1315 	/*
   1316 	 * Return any desired output.
   1317 	 */
   1318 	if (needoutput || (tp->t_flags & TF_ACKNOW))
   1319 		(void) tcp_output(tp);
   1320 	return;
   1321 
   1322 badsyn:
   1323 	/*
   1324 	 * Received a bad SYN.  Increment counters and dropwithreset.
   1325 	 */
   1326 	tcpstat.tcps_badsyn++;
   1327 	tp = NULL;
   1328 	goto dropwithreset;
   1329 
   1330 dropafterack:
   1331 	/*
   1332 	 * Generate an ACK dropping incoming segment if it occupies
   1333 	 * sequence space, where the ACK reflects our state.
   1334 	 */
   1335 	if (tiflags & TH_RST)
   1336 		goto drop;
   1337 	m_freem(m);
   1338 	tp->t_flags |= TF_ACKNOW;
   1339 	(void) tcp_output(tp);
   1340 	return;
   1341 
   1342 dropwithreset:
   1343 	/*
   1344 	 * Generate a RST, dropping incoming segment.
   1345 	 * Make ACK acceptable to originator of segment.
   1346 	 * Don't bother to respond if destination was broadcast/multicast.
   1347 	 */
   1348 	if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) ||
   1349 	    IN_MULTICAST(ti->ti_dst.s_addr))
   1350 		goto drop;
   1351 	if (tiflags & TH_ACK)
   1352 		(void)tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST);
   1353 	else {
   1354 		if (tiflags & TH_SYN)
   1355 			ti->ti_len++;
   1356 		(void)tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0,
   1357 		    TH_RST|TH_ACK);
   1358 	}
   1359 	return;
   1360 
   1361 drop:
   1362 	/*
   1363 	 * Drop space held by incoming segment and return.
   1364 	 */
   1365 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
   1366 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
   1367 	m_freem(m);
   1368 	return;
   1369 #ifndef TUBA_INCLUDE
   1370 }
   1371 
   1372 void
   1373 tcp_dooptions(tp, cp, cnt, ti, oi)
   1374 	struct tcpcb *tp;
   1375 	u_char *cp;
   1376 	int cnt;
   1377 	struct tcpiphdr *ti;
   1378 	struct tcp_opt_info *oi;
   1379 {
   1380 	u_int16_t mss;
   1381 	int opt, optlen;
   1382 
   1383 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
   1384 		opt = cp[0];
   1385 		if (opt == TCPOPT_EOL)
   1386 			break;
   1387 		if (opt == TCPOPT_NOP)
   1388 			optlen = 1;
   1389 		else {
   1390 			optlen = cp[1];
   1391 			if (optlen <= 0)
   1392 				break;
   1393 		}
   1394 		switch (opt) {
   1395 
   1396 		default:
   1397 			continue;
   1398 
   1399 		case TCPOPT_MAXSEG:
   1400 			if (optlen != TCPOLEN_MAXSEG)
   1401 				continue;
   1402 			if (!(ti->ti_flags & TH_SYN))
   1403 				continue;
   1404 			bcopy(cp + 2, &mss, sizeof(mss));
   1405 			oi->maxseg = ntohs(mss);
   1406 			break;
   1407 
   1408 		case TCPOPT_WINDOW:
   1409 			if (optlen != TCPOLEN_WINDOW)
   1410 				continue;
   1411 			if (!(ti->ti_flags & TH_SYN))
   1412 				continue;
   1413 			tp->t_flags |= TF_RCVD_SCALE;
   1414 			tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
   1415 			break;
   1416 
   1417 		case TCPOPT_TIMESTAMP:
   1418 			if (optlen != TCPOLEN_TIMESTAMP)
   1419 				continue;
   1420 			oi->ts_present = 1;
   1421 			bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
   1422 			NTOHL(oi->ts_val);
   1423 			bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
   1424 			NTOHL(oi->ts_ecr);
   1425 
   1426 			/*
   1427 			 * A timestamp received in a SYN makes
   1428 			 * it ok to send timestamp requests and replies.
   1429 			 */
   1430 			if (ti->ti_flags & TH_SYN) {
   1431 				tp->t_flags |= TF_RCVD_TSTMP;
   1432 				tp->ts_recent = oi->ts_val;
   1433 				tp->ts_recent_age = tcp_now;
   1434 			}
   1435 			break;
   1436 		}
   1437 	}
   1438 }
   1439 
   1440 /*
   1441  * Pull out of band byte out of a segment so
   1442  * it doesn't appear in the user's data queue.
   1443  * It is still reflected in the segment length for
   1444  * sequencing purposes.
   1445  */
   1446 void
   1447 tcp_pulloutofband(so, ti, m)
   1448 	struct socket *so;
   1449 	struct tcpiphdr *ti;
   1450 	register struct mbuf *m;
   1451 {
   1452 	int cnt = ti->ti_urp - 1;
   1453 
   1454 	while (cnt >= 0) {
   1455 		if (m->m_len > cnt) {
   1456 			char *cp = mtod(m, caddr_t) + cnt;
   1457 			struct tcpcb *tp = sototcpcb(so);
   1458 
   1459 			tp->t_iobc = *cp;
   1460 			tp->t_oobflags |= TCPOOB_HAVEDATA;
   1461 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
   1462 			m->m_len--;
   1463 			return;
   1464 		}
   1465 		cnt -= m->m_len;
   1466 		m = m->m_next;
   1467 		if (m == 0)
   1468 			break;
   1469 	}
   1470 	panic("tcp_pulloutofband");
   1471 }
   1472 
   1473 /*
   1474  * Collect new round-trip time estimate
   1475  * and update averages and current timeout.
   1476  */
   1477 void
   1478 tcp_xmit_timer(tp, rtt)
   1479 	register struct tcpcb *tp;
   1480 	short rtt;
   1481 {
   1482 	register short delta;
   1483 
   1484 	tcpstat.tcps_rttupdated++;
   1485 	--rtt;
   1486 	if (tp->t_srtt != 0) {
   1487 		/*
   1488 		 * srtt is stored as fixed point with 3 bits after the
   1489 		 * binary point (i.e., scaled by 8).  The following magic
   1490 		 * is equivalent to the smoothing algorithm in rfc793 with
   1491 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
   1492 		 * point).  Adjust rtt to origin 0.
   1493 		 */
   1494 		delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
   1495 		if ((tp->t_srtt += delta) <= 0)
   1496 			tp->t_srtt = 1 << 2;
   1497 		/*
   1498 		 * We accumulate a smoothed rtt variance (actually, a
   1499 		 * smoothed mean difference), then set the retransmit
   1500 		 * timer to smoothed rtt + 4 times the smoothed variance.
   1501 		 * rttvar is stored as fixed point with 2 bits after the
   1502 		 * binary point (scaled by 4).  The following is
   1503 		 * equivalent to rfc793 smoothing with an alpha of .75
   1504 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
   1505 		 * rfc793's wired-in beta.
   1506 		 */
   1507 		if (delta < 0)
   1508 			delta = -delta;
   1509 		delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
   1510 		if ((tp->t_rttvar += delta) <= 0)
   1511 			tp->t_rttvar = 1 << 2;
   1512 	} else {
   1513 		/*
   1514 		 * No rtt measurement yet - use the unsmoothed rtt.
   1515 		 * Set the variance to half the rtt (so our first
   1516 		 * retransmit happens at 3*rtt).
   1517 		 */
   1518 		tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
   1519 		tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
   1520 	}
   1521 	tp->t_rtt = 0;
   1522 	tp->t_rxtshift = 0;
   1523 
   1524 	/*
   1525 	 * the retransmit should happen at rtt + 4 * rttvar.
   1526 	 * Because of the way we do the smoothing, srtt and rttvar
   1527 	 * will each average +1/2 tick of bias.  When we compute
   1528 	 * the retransmit timer, we want 1/2 tick of rounding and
   1529 	 * 1 extra tick because of +-1/2 tick uncertainty in the
   1530 	 * firing of the timer.  The bias will give us exactly the
   1531 	 * 1.5 tick we need.  But, because the bias is
   1532 	 * statistical, we have to test that we don't drop below
   1533 	 * the minimum feasible timer (which is 2 ticks).
   1534 	 */
   1535 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
   1536 	    rtt + 2, TCPTV_REXMTMAX);
   1537 
   1538 	/*
   1539 	 * We received an ack for a packet that wasn't retransmitted;
   1540 	 * it is probably safe to discard any error indications we've
   1541 	 * received recently.  This isn't quite right, but close enough
   1542 	 * for now (a route might have failed after we sent a segment,
   1543 	 * and the return path might not be symmetrical).
   1544 	 */
   1545 	tp->t_softerror = 0;
   1546 }
   1547 
   1548 /*
   1549  * TCP compressed state engine.  Currently used to hold compressed
   1550  * state for SYN_RECEIVED.
   1551  */
   1552 
   1553 u_long	syn_cache_count;
   1554 u_int32_t syn_hash1, syn_hash2;
   1555 
   1556 #define SYN_HASH(sa, sp, dp) \
   1557 	((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
   1558 				     ((u_int32_t)(sp)))^syn_hash2)) \
   1559 	 & 0x7fffffff)
   1560 
   1561 #define	eptosp(ep, e, s)	((struct s *)((char *)(ep) - \
   1562 			    ((char *)(&((struct s *)0)->e) - (char *)0)))
   1563 
   1564 #define	SYN_CACHE_RM(sc, p, scp) {					\
   1565 	*(p) = (sc)->sc_next;						\
   1566 	if ((sc)->sc_next)						\
   1567 		(sc)->sc_next->sc_timer += (sc)->sc_timer;		\
   1568 	else {								\
   1569 		(scp)->sch_timer_sum -= (sc)->sc_timer;			\
   1570 		if ((scp)->sch_timer_sum <= 0)				\
   1571 			(scp)->sch_timer_sum = -1;			\
   1572 		/* If need be, fix up the last pointer */		\
   1573 		if ((scp)->sch_first)					\
   1574 			(scp)->sch_last = eptosp(p, sc_next, syn_cache); \
   1575 	}								\
   1576 	(scp)->sch_length--;						\
   1577 	syn_cache_count--;						\
   1578 }
   1579 
   1580 void
   1581 syn_cache_insert(sc, prevp, headp)
   1582 	struct syn_cache *sc;
   1583 	struct syn_cache ***prevp;
   1584 	struct syn_cache_head **headp;
   1585 {
   1586 	struct syn_cache_head *scp, *scp2, *sce;
   1587 	struct syn_cache *sc2;
   1588 	static u_int timeo_val;
   1589 	int s;
   1590 
   1591 	/* Initialize the hash secrets when adding the first entry */
   1592 	if (syn_cache_count == 0) {
   1593 		struct timeval tv;
   1594 		microtime(&tv);
   1595 		syn_hash1 = random() ^ (u_long)&sc;
   1596 		syn_hash2 = random() ^ tv.tv_usec;
   1597 	}
   1598 
   1599 	sc->sc_hash = SYN_HASH(&sc->sc_src, sc->sc_sport, sc->sc_dport);
   1600 	sc->sc_next = NULL;
   1601 	scp = &tcp_syn_cache[sc->sc_hash % tcp_syn_cache_size];
   1602 	*headp = scp;
   1603 
   1604 	/*
   1605 	 * Make sure that we don't overflow the per-bucket
   1606 	 * limit or the total cache size limit.
   1607 	 */
   1608 	s = splsoftnet();
   1609 	if (scp->sch_length >= tcp_syn_bucket_limit) {
   1610 		tcpstat.tcps_sc_bucketoverflow++;
   1611 		sc2 = scp->sch_first;
   1612 		scp->sch_first = sc2->sc_next;
   1613 		FREE(sc2, M_PCB);
   1614 	} else if (syn_cache_count >= tcp_syn_cache_limit) {
   1615 		tcpstat.tcps_sc_overflowed++;
   1616 		/*
   1617 		 * The cache is full.  Toss the first (i.e, oldest)
   1618 		 * element in this bucket.
   1619 		 */
   1620 		scp2 = scp;
   1621 		if (scp2->sch_first == NULL) {
   1622 			sce = &tcp_syn_cache[tcp_syn_cache_size];
   1623 			for (++scp2; scp2 != scp; scp2++) {
   1624 				if (scp2 >= sce)
   1625 					scp2 = &tcp_syn_cache[0];
   1626 				if (scp2->sch_first)
   1627 					break;
   1628 			}
   1629 		}
   1630 		sc2 = scp2->sch_first;
   1631 		if (sc2 == NULL) {
   1632 			FREE(sc, M_PCB);
   1633 			return;
   1634 		}
   1635 		if ((scp2->sch_first = sc2->sc_next) == NULL)
   1636 			scp2->sch_last = NULL;
   1637 		else
   1638 			sc2->sc_next->sc_timer += sc2->sc_timer;
   1639 		FREE(sc2, M_PCB);
   1640 	} else {
   1641 		scp->sch_length++;
   1642 		syn_cache_count++;
   1643 	}
   1644 	tcpstat.tcps_sc_added++;
   1645 
   1646 	/*
   1647 	 * Put it into the bucket.
   1648 	 */
   1649 	if (scp->sch_first == NULL)
   1650 		*prevp = &scp->sch_first;
   1651 	else {
   1652 		*prevp = &scp->sch_last->sc_next;
   1653 		tcpstat.tcps_sc_collisions++;
   1654 	}
   1655 	**prevp = sc;
   1656 	scp->sch_last = sc;
   1657 
   1658 	/*
   1659 	 * If the timeout value has changed
   1660 	 *   1) force it to fit in a u_char
   1661 	 *   2) Run the timer routine to truncate all
   1662 	 *	existing entries to the new timeout value.
   1663 	 */
   1664 	if (timeo_val != tcp_syn_cache_timeo) {
   1665 		tcp_syn_cache_timeo = min(tcp_syn_cache_timeo, UCHAR_MAX);
   1666 		if (timeo_val > tcp_syn_cache_timeo)
   1667 			syn_cache_timer(timeo_val - tcp_syn_cache_timeo);
   1668 		timeo_val = tcp_syn_cache_timeo;
   1669 	}
   1670 	if (scp->sch_timer_sum > 0)
   1671 		sc->sc_timer = tcp_syn_cache_timeo - scp->sch_timer_sum;
   1672 	else if (scp->sch_timer_sum == 0) {
   1673 		/* When the bucket timer is 0, it is not in the cache queue.  */
   1674 		scp->sch_headq = tcp_syn_cache_first;
   1675 		tcp_syn_cache_first = scp;
   1676 		sc->sc_timer = tcp_syn_cache_timeo;
   1677 	}
   1678 	scp->sch_timer_sum = tcp_syn_cache_timeo;
   1679 	splx(s);
   1680 }
   1681 
   1682 /*
   1683  * Walk down the cache list, decrementing the timer of
   1684  * the first element on each entry.  If the timer goes
   1685  * to zero, remove it and all successive entries with
   1686  * a zero timer.
   1687  */
   1688 void
   1689 syn_cache_timer(interval)
   1690 	int interval;
   1691 {
   1692 	struct syn_cache_head *scp, **pscp;
   1693 	struct syn_cache *sc, *scn;
   1694 	int n, s;
   1695 
   1696 	pscp = &tcp_syn_cache_first;
   1697 	scp = tcp_syn_cache_first;
   1698 	s = splsoftnet();
   1699 	while (scp) {
   1700 		/*
   1701 		 * Remove any empty hash buckets
   1702 		 * from the cache queue.
   1703 		 */
   1704 		if ((sc = scp->sch_first) == NULL) {
   1705 			*pscp = scp->sch_headq;
   1706 			scp->sch_headq = NULL;
   1707 			scp->sch_timer_sum = 0;
   1708 			scp->sch_first = scp->sch_last = NULL;
   1709 			scp->sch_length = 0;
   1710 			scp = *pscp;
   1711 			continue;
   1712 		}
   1713 
   1714 		scp->sch_timer_sum -= interval;
   1715 		if (scp->sch_timer_sum <= 0)
   1716 			scp->sch_timer_sum = -1;
   1717 		n = interval;
   1718 		while (sc->sc_timer <= n) {
   1719 			n -= sc->sc_timer;
   1720 			scn = sc->sc_next;
   1721 			tcpstat.tcps_sc_timed_out++;
   1722 			syn_cache_count--;
   1723 			FREE(sc, M_PCB);
   1724 			scp->sch_length--;
   1725 			if ((sc = scn) == NULL)
   1726 				break;
   1727 		}
   1728 		if ((scp->sch_first = sc) != NULL) {
   1729 			sc->sc_timer -= n;
   1730 			pscp = &scp->sch_headq;
   1731 			scp = scp->sch_headq;
   1732 		}
   1733 	}
   1734 	splx(s);
   1735 }
   1736 
   1737 /*
   1738  * Find an entry in the syn cache.
   1739  */
   1740 struct syn_cache *
   1741 syn_cache_lookup(ti, prevp, headp)
   1742 	struct tcpiphdr *ti;
   1743 	struct syn_cache ***prevp;
   1744 	struct syn_cache_head **headp;
   1745 {
   1746 	struct syn_cache *sc, **prev;
   1747 	struct syn_cache_head *head;
   1748 	u_int32_t hash;
   1749 	int s;
   1750 
   1751 	hash = SYN_HASH(&ti->ti_src, ti->ti_sport, ti->ti_dport);
   1752 
   1753 	head = &tcp_syn_cache[hash % tcp_syn_cache_size];
   1754 	*headp = head;
   1755 	prev = &head->sch_first;
   1756 	s = splsoftnet();
   1757 	for (sc = head->sch_first; sc; prev = &sc->sc_next, sc = sc->sc_next) {
   1758 		if (sc->sc_hash != hash)
   1759 			continue;
   1760 		if (sc->sc_src.s_addr == ti->ti_src.s_addr &&
   1761 		    sc->sc_sport == ti->ti_sport &&
   1762 		    sc->sc_dport == ti->ti_dport &&
   1763 		    sc->sc_dst.s_addr == ti->ti_dst.s_addr) {
   1764 			*prevp = prev;
   1765 			splx(s);
   1766 			return (sc);
   1767 		}
   1768 	}
   1769 	splx(s);
   1770 	return (NULL);
   1771 }
   1772 
   1773 /*
   1774  * This function gets called when we receive an ACK for a
   1775  * socket in the LISTEN state.  We look up the connection
   1776  * in the syn cache, and if its there, we pull it out of
   1777  * the cache and turn it into a full-blown connection in
   1778  * the SYN-RECEIVED state.
   1779  *
   1780  * The return values may not be immediately obvious, and their effects
   1781  * can be subtle, so here they are:
   1782  *
   1783  *	NULL	SYN was not found in cache; caller should drop the
   1784  *		packet and send an RST.
   1785  *
   1786  *	-1	We were unable to create the new connection, and are
   1787  *		aborting it.  An ACK,RST is being sent to the peer
   1788  *		(unless we got screwey sequence numbners; see below),
   1789  *		because the 3-way handshake has been completed.  Caller
   1790  *		should not free the mbuf, since we may be using it.  If
   1791  *		we are not, we will free it.
   1792  *
   1793  *	Otherwise, the return value is a pointer to the new socket
   1794  *	associated with the connection.
   1795  */
   1796 struct socket *
   1797 syn_cache_get(so, m)
   1798 	struct socket *so;
   1799 	struct mbuf *m;
   1800 {
   1801 	struct syn_cache *sc, **sc_prev;
   1802 	struct syn_cache_head *head;
   1803 	register struct inpcb *inp;
   1804 	register struct tcpcb *tp = 0;
   1805 	register struct tcpiphdr *ti;
   1806 	struct sockaddr_in *sin;
   1807 	struct mbuf *am;
   1808 	long win;
   1809 	int s;
   1810 
   1811 	ti = mtod(m, struct tcpiphdr *);
   1812 	s = splsoftnet();
   1813 	if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
   1814 		splx(s);
   1815 		return (NULL);
   1816 	}
   1817 
   1818 	win = sbspace(&so->so_rcv);
   1819 	if (win > TCP_MAXWIN)
   1820 		win = TCP_MAXWIN;
   1821 
   1822 	/*
   1823 	 * Verify the sequence and ack numbers.
   1824 	 */
   1825 	if ((ti->ti_ack != sc->sc_iss + 1) ||
   1826 	    SEQ_LEQ(ti->ti_seq, sc->sc_irs) ||
   1827 	    SEQ_GT(ti->ti_seq, sc->sc_irs + 1 + win)) {
   1828 		(void) syn_cache_respond(sc, m, ti, win, 0);
   1829 		splx(s);
   1830 		return ((struct socket *)(-1));
   1831 	}
   1832 
   1833 	/* Remove this cache entry */
   1834 	SYN_CACHE_RM(sc, sc_prev, head);
   1835 	splx(s);
   1836 
   1837 	/*
   1838 	 * Ok, create the full blown connection, and set things up
   1839 	 * as they would have been set up if we had created the
   1840 	 * connection when the SYN arrived.  If we can't create
   1841 	 * the connection, abort it.
   1842 	 */
   1843 	so = sonewconn(so, SS_ISCONNECTED);
   1844 	if (so == NULL)
   1845 		goto resetandabort;
   1846 
   1847 	inp = sotoinpcb(so);
   1848 	inp->inp_laddr = sc->sc_dst;
   1849 	inp->inp_lport = sc->sc_dport;
   1850 	in_pcbstate(inp, INP_BOUND);
   1851 #if BSD>=43
   1852 	inp->inp_options = ip_srcroute();
   1853 #endif
   1854 
   1855 	am = m_get(M_DONTWAIT, MT_SONAME);	/* XXX */
   1856 	if (am == NULL) {
   1857 		m_freem(m);
   1858 		goto resetandabort;
   1859 	}
   1860 	am->m_len = sizeof(struct sockaddr_in);
   1861 	sin = mtod(am, struct sockaddr_in *);
   1862 	sin->sin_family = AF_INET;
   1863 	sin->sin_len = sizeof(*sin);
   1864 	sin->sin_addr = sc->sc_src;
   1865 	sin->sin_port = sc->sc_sport;
   1866 	bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
   1867 	if (in_pcbconnect(inp, am)) {
   1868 		(void) m_free(am);
   1869 		m_freem(m);
   1870 		goto resetandabort;
   1871 	}
   1872 	(void) m_free(am);
   1873 
   1874 	tp = intotcpcb(inp);
   1875 	if (sc->sc_request_r_scale != 15) {
   1876 		tp->requested_s_scale = sc->sc_requested_s_scale;
   1877 		tp->request_r_scale = sc->sc_request_r_scale;
   1878 		tp->snd_scale = sc->sc_requested_s_scale;
   1879 		tp->rcv_scale = sc->sc_request_r_scale;
   1880 		tp->t_flags |= TF_RCVD_SCALE;
   1881 	}
   1882 	if (sc->sc_tstmp)
   1883 		tp->t_flags |= TF_RCVD_TSTMP;
   1884 
   1885 	tp->t_template = tcp_template(tp);
   1886 	if (tp->t_template == 0) {
   1887 		tp = tcp_drop(tp, ENOBUFS);	/* destroys socket */
   1888 		so = NULL;
   1889 		m_freem(m);
   1890 		goto abort;
   1891 	}
   1892 
   1893 	tp->iss = sc->sc_iss;
   1894 	tp->irs = sc->sc_irs;
   1895 	tcp_sendseqinit(tp);
   1896 	tcp_rcvseqinit(tp);
   1897 	tp->t_state = TCPS_SYN_RECEIVED;
   1898 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
   1899 	tcpstat.tcps_accepts++;
   1900 
   1901 	/* Initialize tp->t_ourmss before we deal with the peer's! */
   1902 	tp->t_ourmss = sc->sc_ourmaxseg;
   1903 	tcp_mss_from_peer(tp, sc->sc_peermaxseg);
   1904 	tcp_rmx_rtt(tp);
   1905 	tp->snd_wl1 = sc->sc_irs;
   1906 	tp->rcv_up = sc->sc_irs + 1;
   1907 
   1908 	/*
   1909 	 * This is what whould have happened in tcp_ouput() when
   1910 	 * the SYN,ACK was sent.
   1911 	 */
   1912 	tp->snd_up = tp->snd_una;
   1913 	tp->snd_max = tp->snd_nxt = tp->iss+1;
   1914 	tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
   1915 	if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
   1916 		tp->rcv_adv = tp->rcv_nxt + win;
   1917 	tp->last_ack_sent = tp->rcv_nxt;
   1918 
   1919 	tcpstat.tcps_sc_completed++;
   1920 	FREE(sc, M_PCB);
   1921 	return (so);
   1922 
   1923 resetandabort:
   1924 	(void) tcp_respond(NULL, ti, m, ti->ti_seq+ti->ti_len,
   1925 	    (tcp_seq)0, TH_RST|TH_ACK);
   1926 abort:
   1927 	if (so != NULL)
   1928 		(void) soabort(so);
   1929 	FREE(sc, M_PCB);
   1930 	tcpstat.tcps_sc_aborted++;
   1931 	return ((struct socket *)(-1));
   1932 }
   1933 
   1934 /*
   1935  * This function is called when we get a RST for a
   1936  * non-existant connection, so that we can see if the
   1937  * connection is in the syn cache.  If it is, zap it.
   1938  */
   1939 
   1940 void
   1941 syn_cache_reset(ti)
   1942 	register struct tcpiphdr *ti;
   1943 {
   1944 	struct syn_cache *sc, **sc_prev;
   1945 	struct syn_cache_head *head;
   1946 	int s = splsoftnet();
   1947 
   1948 	if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
   1949 		splx(s);
   1950 		return;
   1951 	}
   1952 	if (SEQ_LT(ti->ti_seq,sc->sc_irs) ||
   1953 	    SEQ_GT(ti->ti_seq, sc->sc_irs+1)) {
   1954 		splx(s);
   1955 		return;
   1956 	}
   1957 	SYN_CACHE_RM(sc, sc_prev, head);
   1958 	splx(s);
   1959 	tcpstat.tcps_sc_reset++;
   1960 	FREE(sc, M_PCB);
   1961 }
   1962 
   1963 void
   1964 syn_cache_unreach(ip, th)
   1965 	struct ip *ip;
   1966 	struct tcphdr *th;
   1967 {
   1968 	struct syn_cache *sc, **sc_prev;
   1969 	struct syn_cache_head *head;
   1970 	struct tcpiphdr ti2;
   1971 	int s;
   1972 
   1973 	ti2.ti_src.s_addr = ip->ip_dst.s_addr;
   1974 	ti2.ti_dst.s_addr = ip->ip_src.s_addr;
   1975 	ti2.ti_sport = th->th_dport;
   1976 	ti2.ti_dport = th->th_sport;
   1977 
   1978 	s = splsoftnet();
   1979 	if ((sc = syn_cache_lookup(&ti2, &sc_prev, &head)) == NULL) {
   1980 		splx(s);
   1981 		return;
   1982 	}
   1983 	/* If the sequence number != sc_iss, then it's a bogus ICMP msg */
   1984 	if (ntohl (th->th_seq) != sc->sc_iss) {
   1985 		splx(s);
   1986 		return;
   1987 	}
   1988 	SYN_CACHE_RM(sc, sc_prev, head);
   1989 	splx(s);
   1990 	tcpstat.tcps_sc_unreach++;
   1991 	FREE(sc, M_PCB);
   1992 }
   1993 
   1994 /*
   1995  * Given a LISTEN socket and an inbound SYN request, add
   1996  * this to the syn cache, and send back a segment:
   1997  *	<SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
   1998  * to the source.
   1999  *
   2000  * XXX We don't properly handle SYN-with-data!
   2001  */
   2002 
   2003 int
   2004 syn_cache_add(so, m, optp, optlen, oi)
   2005 	struct socket *so;
   2006 	struct mbuf *m;
   2007 	u_char *optp;
   2008 	int optlen;
   2009 	struct tcp_opt_info *oi;
   2010 {
   2011 	register struct tcpiphdr *ti;
   2012 	struct tcpcb tb, *tp;
   2013 	long win;
   2014 	struct syn_cache *sc, **sc_prev;
   2015 	struct syn_cache_head *scp;
   2016 	extern int tcp_do_rfc1323;
   2017 
   2018 	tp = sototcpcb(so);
   2019 	ti = mtod(m, struct tcpiphdr *);
   2020 
   2021 	/*
   2022 	 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
   2023 	 * in_broadcast() should never return true on a received
   2024 	 * packet with M_BCAST not set.
   2025 	 */
   2026 	if (m->m_flags & (M_BCAST|M_MCAST) ||
   2027 	    IN_MULTICAST(ti->ti_src.s_addr) ||
   2028 	    IN_MULTICAST(ti->ti_dst.s_addr))
   2029 		return (0);
   2030 
   2031 	/*
   2032 	 * Initialize some local state.
   2033 	 */
   2034 	win = sbspace(&so->so_rcv);
   2035 	if (win > TCP_MAXWIN)
   2036 		win = TCP_MAXWIN;
   2037 
   2038 	if (optp) {
   2039 		tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
   2040 		tcp_dooptions(&tb, optp, optlen, ti, oi);
   2041 	} else
   2042 		tb.t_flags = 0;
   2043 
   2044 	/*
   2045 	 * See if we already have an entry for this connection.
   2046 	 */
   2047 	if ((sc = syn_cache_lookup(ti, &sc_prev, &scp)) != NULL) {
   2048 		tcpstat.tcps_sc_dupesyn++;
   2049 		if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
   2050 			tcpstat.tcps_sndacks++;
   2051 			tcpstat.tcps_sndtotal++;
   2052 		}
   2053 		return (1);
   2054 	}
   2055 
   2056 	MALLOC(sc, struct syn_cache *, sizeof(*sc), M_PCB, M_NOWAIT);
   2057 	if (sc == NULL)
   2058 		return (0);
   2059 	/*
   2060 	 * Fill in the cache, and put the necessary TCP
   2061 	 * options into the reply.
   2062 	 */
   2063 	sc->sc_src.s_addr = ti->ti_src.s_addr;
   2064 	sc->sc_dst.s_addr = ti->ti_dst.s_addr;
   2065 	sc->sc_sport = ti->ti_sport;
   2066 	sc->sc_dport = ti->ti_dport;
   2067 	sc->sc_irs = ti->ti_seq;
   2068 	sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0);
   2069 	sc->sc_peermaxseg = oi->maxseg;
   2070 	sc->sc_ourmaxseg = tcp_mss_to_advertise(tp);
   2071 	sc->sc_tstmp = (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP)) ? 1 : 0;
   2072 	if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
   2073 	    (TF_RCVD_SCALE|TF_REQ_SCALE)) {
   2074 		sc->sc_requested_s_scale = tb.requested_s_scale;
   2075 		sc->sc_request_r_scale = 0;
   2076 		while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
   2077 		    TCP_MAXWIN << sc->sc_request_r_scale <
   2078 		    so->so_rcv.sb_hiwat)
   2079 			sc->sc_request_r_scale++;
   2080 	} else {
   2081 		sc->sc_requested_s_scale = 15;
   2082 		sc->sc_request_r_scale = 15;
   2083 	}
   2084 	if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
   2085 		syn_cache_insert(sc, &sc_prev, &scp);
   2086 		tcpstat.tcps_sndacks++;
   2087 		tcpstat.tcps_sndtotal++;
   2088 	} else {
   2089 		FREE(sc, M_PCB);
   2090 		tcpstat.tcps_sc_dropped++;
   2091 	}
   2092 	return (1);
   2093 }
   2094 
   2095 int
   2096 syn_cache_respond(sc, m, ti, win, ts)
   2097 	struct syn_cache *sc;
   2098 	struct mbuf *m;
   2099 	register struct tcpiphdr *ti;
   2100 	long win;
   2101 	u_long ts;
   2102 {
   2103 	u_int8_t *optp;
   2104 	int optlen;
   2105 
   2106 	/*
   2107 	 * Tack on the TCP options.  If there isn't enough trailing
   2108 	 * space for them, move up the fixed header to make space.
   2109 	 */
   2110 	optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
   2111 	    (sc->sc_tstmp ? TCPOLEN_TSTAMP_APPA : 0);
   2112 	if (optlen > M_TRAILINGSPACE(m)) {
   2113 		if (M_LEADINGSPACE(m) >= optlen) {
   2114 			m->m_data -= optlen;
   2115 			m->m_len += optlen;
   2116 		} else {
   2117 			struct mbuf *m0 = m;
   2118 			if ((m = m_gethdr(M_DONTWAIT, MT_HEADER)) == NULL) {
   2119 				m_freem(m0);
   2120 				return (ENOBUFS);
   2121 			}
   2122 			MH_ALIGN(m, sizeof(*ti) + optlen);
   2123 			m->m_next = m0; /* this gets freed below */
   2124 		}
   2125 		ovbcopy((caddr_t)ti, mtod(m, caddr_t), sizeof(*ti));
   2126 		ti = mtod(m, struct tcpiphdr *);
   2127 	}
   2128 
   2129 	optp = (u_int8_t *)(ti + 1);
   2130 	optp[0] = TCPOPT_MAXSEG;
   2131 	optp[1] = 4;
   2132 	optp[2] = (sc->sc_ourmaxseg >> 8) & 0xff;
   2133 	optp[3] = sc->sc_ourmaxseg & 0xff;
   2134 	optlen = 4;
   2135 
   2136 	if (sc->sc_request_r_scale != 15) {
   2137 		*((u_int32_t *)(optp + optlen)) = htonl(TCPOPT_NOP << 24 |
   2138 		    TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
   2139 		    sc->sc_request_r_scale);
   2140 		optlen += 4;
   2141 	}
   2142 
   2143 	if (sc->sc_tstmp) {
   2144 		u_int32_t *lp = (u_int32_t *)(optp + optlen);
   2145 		/* Form timestamp option as shown in appendix A of RFC 1323. */
   2146 		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
   2147 		*lp++ = htonl(tcp_now);
   2148 		*lp   = htonl(ts);
   2149 		optlen += TCPOLEN_TSTAMP_APPA;
   2150 	}
   2151 
   2152 	/*
   2153 	 * Toss any trailing mbufs.  No need to worry about
   2154 	 * m_len and m_pkthdr.len, since tcp_respond() will
   2155 	 * unconditionally set them.
   2156 	 */
   2157 	if (m->m_next) {
   2158 		m_freem(m->m_next);
   2159 		m->m_next = NULL;
   2160   	}
   2161 
   2162 	/*
   2163 	 * Fill in the fields that tcp_respond() will not touch, and
   2164 	 * then send the response.
   2165 	 */
   2166 	ti->ti_off = (sizeof(struct tcphdr) + optlen) >> 2;
   2167 	ti->ti_win = htons(win);
   2168 	return (tcp_respond(NULL, ti, m, sc->sc_irs + 1, sc->sc_iss,
   2169 	    TH_SYN|TH_ACK));
   2170 }
   2171 #endif /* TUBA_INCLUDE */
   2172