tcp_input.c revision 1.356
1 /* $NetBSD: tcp_input.c,v 1.356 2017/03/31 06:49:44 ozaki-r Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 34 * 35 * NRL grants permission for redistribution and use in source and binary 36 * forms, with or without modification, of the software and documentation 37 * created at NRL provided that the following conditions are met: 38 * 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. All advertising materials mentioning features or use of this software 45 * must display the following acknowledgements: 46 * This product includes software developed by the University of 47 * California, Berkeley and its contributors. 48 * This product includes software developed at the Information 49 * Technology Division, US Naval Research Laboratory. 50 * 4. Neither the name of the NRL nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 65 * 66 * The views and conclusions contained in the software and documentation 67 * are those of the authors and should not be interpreted as representing 68 * official policies, either expressed or implied, of the US Naval 69 * Research Laboratory (NRL). 70 */ 71 72 /*- 73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006, 74 * 2011 The NetBSD Foundation, Inc. 75 * All rights reserved. 76 * 77 * This code is derived from software contributed to The NetBSD Foundation 78 * by Coyote Point Systems, Inc. 79 * This code is derived from software contributed to The NetBSD Foundation 80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation 81 * Facility, NASA Ames Research Center. 82 * This code is derived from software contributed to The NetBSD Foundation 83 * by Charles M. Hannum. 84 * This code is derived from software contributed to The NetBSD Foundation 85 * by Rui Paulo. 86 * 87 * Redistribution and use in source and binary forms, with or without 88 * modification, are permitted provided that the following conditions 89 * are met: 90 * 1. Redistributions of source code must retain the above copyright 91 * notice, this list of conditions and the following disclaimer. 92 * 2. Redistributions in binary form must reproduce the above copyright 93 * notice, this list of conditions and the following disclaimer in the 94 * documentation and/or other materials provided with the distribution. 95 * 96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 106 * POSSIBILITY OF SUCH DAMAGE. 107 */ 108 109 /* 110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 111 * The Regents of the University of California. All rights reserved. 112 * 113 * Redistribution and use in source and binary forms, with or without 114 * modification, are permitted provided that the following conditions 115 * are met: 116 * 1. Redistributions of source code must retain the above copyright 117 * notice, this list of conditions and the following disclaimer. 118 * 2. Redistributions in binary form must reproduce the above copyright 119 * notice, this list of conditions and the following disclaimer in the 120 * documentation and/or other materials provided with the distribution. 121 * 3. Neither the name of the University nor the names of its contributors 122 * may be used to endorse or promote products derived from this software 123 * without specific prior written permission. 124 * 125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 135 * SUCH DAMAGE. 136 * 137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 138 */ 139 140 /* 141 * TODO list for SYN cache stuff: 142 * 143 * Find room for a "state" field, which is needed to keep a 144 * compressed state for TIME_WAIT TCBs. It's been noted already 145 * that this is fairly important for very high-volume web and 146 * mail servers, which use a large number of short-lived 147 * connections. 148 */ 149 150 #include <sys/cdefs.h> 151 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.356 2017/03/31 06:49:44 ozaki-r Exp $"); 152 153 #ifdef _KERNEL_OPT 154 #include "opt_inet.h" 155 #include "opt_ipsec.h" 156 #include "opt_inet_csum.h" 157 #include "opt_tcp_debug.h" 158 #endif 159 160 #include <sys/param.h> 161 #include <sys/systm.h> 162 #include <sys/malloc.h> 163 #include <sys/mbuf.h> 164 #include <sys/protosw.h> 165 #include <sys/socket.h> 166 #include <sys/socketvar.h> 167 #include <sys/errno.h> 168 #include <sys/syslog.h> 169 #include <sys/pool.h> 170 #include <sys/domain.h> 171 #include <sys/kernel.h> 172 #ifdef TCP_SIGNATURE 173 #include <sys/md5.h> 174 #endif 175 #include <sys/lwp.h> /* for lwp0 */ 176 #include <sys/cprng.h> 177 178 #include <net/if.h> 179 #include <net/if_types.h> 180 181 #include <netinet/in.h> 182 #include <netinet/in_systm.h> 183 #include <netinet/ip.h> 184 #include <netinet/in_pcb.h> 185 #include <netinet/in_var.h> 186 #include <netinet/ip_var.h> 187 #include <netinet/in_offload.h> 188 189 #ifdef INET6 190 #ifndef INET 191 #include <netinet/in.h> 192 #endif 193 #include <netinet/ip6.h> 194 #include <netinet6/ip6_var.h> 195 #include <netinet6/in6_pcb.h> 196 #include <netinet6/ip6_var.h> 197 #include <netinet6/in6_var.h> 198 #include <netinet/icmp6.h> 199 #include <netinet6/nd6.h> 200 #ifdef TCP_SIGNATURE 201 #include <netinet6/scope6_var.h> 202 #endif 203 #endif 204 205 #ifndef INET6 206 /* always need ip6.h for IP6_EXTHDR_GET */ 207 #include <netinet/ip6.h> 208 #endif 209 210 #include <netinet/tcp.h> 211 #include <netinet/tcp_fsm.h> 212 #include <netinet/tcp_seq.h> 213 #include <netinet/tcp_timer.h> 214 #include <netinet/tcp_var.h> 215 #include <netinet/tcp_private.h> 216 #include <netinet/tcpip.h> 217 #include <netinet/tcp_congctl.h> 218 #include <netinet/tcp_debug.h> 219 220 #ifdef INET6 221 #include "faith.h" 222 #if defined(NFAITH) && NFAITH > 0 223 #include <net/if_faith.h> 224 #endif 225 #endif /* INET6 */ 226 227 #ifdef IPSEC 228 #include <netipsec/ipsec.h> 229 #include <netipsec/ipsec_var.h> 230 #include <netipsec/ipsec_private.h> 231 #include <netipsec/key.h> 232 #ifdef INET6 233 #include <netipsec/ipsec6.h> 234 #endif 235 #endif /* IPSEC*/ 236 237 #include <netinet/tcp_vtw.h> 238 239 int tcprexmtthresh = 3; 240 int tcp_log_refused; 241 242 int tcp_do_autorcvbuf = 1; 243 int tcp_autorcvbuf_inc = 16 * 1024; 244 int tcp_autorcvbuf_max = 256 * 1024; 245 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ); 246 247 static int tcp_rst_ppslim_count = 0; 248 static struct timeval tcp_rst_ppslim_last; 249 static int tcp_ackdrop_ppslim_count = 0; 250 static struct timeval tcp_ackdrop_ppslim_last; 251 252 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ) 253 254 /* for modulo comparisons of timestamps */ 255 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 256 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 257 258 /* 259 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. 260 */ 261 #ifdef INET6 262 static inline void 263 nd6_hint(struct tcpcb *tp) 264 { 265 struct rtentry *rt = NULL; 266 267 if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 && 268 (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL) 269 nd6_nud_hint(rt); 270 rtcache_unref(rt, &tp->t_in6pcb->in6p_route); 271 } 272 #else 273 static inline void 274 nd6_hint(struct tcpcb *tp) 275 { 276 } 277 #endif 278 279 /* 280 * Compute ACK transmission behavior. Delay the ACK unless 281 * we have already delayed an ACK (must send an ACK every two segments). 282 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 283 * option is enabled. 284 */ 285 static void 286 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th) 287 { 288 289 if (tp->t_flags & TF_DELACK || 290 (tcp_ack_on_push && th->th_flags & TH_PUSH)) 291 tp->t_flags |= TF_ACKNOW; 292 else 293 TCP_SET_DELACK(tp); 294 } 295 296 static void 297 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked) 298 { 299 300 /* 301 * If we had a pending ICMP message that refers to data that have 302 * just been acknowledged, disregard the recorded ICMP message. 303 */ 304 if ((tp->t_flags & TF_PMTUD_PEND) && 305 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 306 tp->t_flags &= ~TF_PMTUD_PEND; 307 308 /* 309 * Keep track of the largest chunk of data 310 * acknowledged since last PMTU update 311 */ 312 if (tp->t_pmtud_mss_acked < acked) 313 tp->t_pmtud_mss_acked = acked; 314 } 315 316 /* 317 * Convert TCP protocol fields to host order for easier processing. 318 */ 319 static void 320 tcp_fields_to_host(struct tcphdr *th) 321 { 322 323 NTOHL(th->th_seq); 324 NTOHL(th->th_ack); 325 NTOHS(th->th_win); 326 NTOHS(th->th_urp); 327 } 328 329 /* 330 * ... and reverse the above. 331 */ 332 static void 333 tcp_fields_to_net(struct tcphdr *th) 334 { 335 336 HTONL(th->th_seq); 337 HTONL(th->th_ack); 338 HTONS(th->th_win); 339 HTONS(th->th_urp); 340 } 341 342 #ifdef TCP_CSUM_COUNTERS 343 #include <sys/device.h> 344 345 #if defined(INET) 346 extern struct evcnt tcp_hwcsum_ok; 347 extern struct evcnt tcp_hwcsum_bad; 348 extern struct evcnt tcp_hwcsum_data; 349 extern struct evcnt tcp_swcsum; 350 #endif /* defined(INET) */ 351 #if defined(INET6) 352 extern struct evcnt tcp6_hwcsum_ok; 353 extern struct evcnt tcp6_hwcsum_bad; 354 extern struct evcnt tcp6_hwcsum_data; 355 extern struct evcnt tcp6_swcsum; 356 #endif /* defined(INET6) */ 357 358 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++ 359 360 #else 361 362 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */ 363 364 #endif /* TCP_CSUM_COUNTERS */ 365 366 #ifdef TCP_REASS_COUNTERS 367 #include <sys/device.h> 368 369 extern struct evcnt tcp_reass_; 370 extern struct evcnt tcp_reass_empty; 371 extern struct evcnt tcp_reass_iteration[8]; 372 extern struct evcnt tcp_reass_prependfirst; 373 extern struct evcnt tcp_reass_prepend; 374 extern struct evcnt tcp_reass_insert; 375 extern struct evcnt tcp_reass_inserttail; 376 extern struct evcnt tcp_reass_append; 377 extern struct evcnt tcp_reass_appendtail; 378 extern struct evcnt tcp_reass_overlaptail; 379 extern struct evcnt tcp_reass_overlapfront; 380 extern struct evcnt tcp_reass_segdup; 381 extern struct evcnt tcp_reass_fragdup; 382 383 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++ 384 385 #else 386 387 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */ 388 389 #endif /* TCP_REASS_COUNTERS */ 390 391 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *, 392 int *); 393 static int tcp_dooptions(struct tcpcb *, const u_char *, int, 394 struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *); 395 396 #ifdef INET 397 static void tcp4_log_refused(const struct ip *, const struct tcphdr *); 398 #endif 399 #ifdef INET6 400 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *); 401 #endif 402 403 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next 404 405 #if defined(MBUFTRACE) 406 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass"); 407 #endif /* defined(MBUFTRACE) */ 408 409 static struct pool tcpipqent_pool; 410 411 void 412 tcpipqent_init(void) 413 { 414 415 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl", 416 NULL, IPL_VM); 417 } 418 419 struct ipqent * 420 tcpipqent_alloc(void) 421 { 422 struct ipqent *ipqe; 423 int s; 424 425 s = splvm(); 426 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT); 427 splx(s); 428 429 return ipqe; 430 } 431 432 void 433 tcpipqent_free(struct ipqent *ipqe) 434 { 435 int s; 436 437 s = splvm(); 438 pool_put(&tcpipqent_pool, ipqe); 439 splx(s); 440 } 441 442 static int 443 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen) 444 { 445 struct ipqent *p, *q, *nq, *tiqe = NULL; 446 struct socket *so = NULL; 447 int pkt_flags; 448 tcp_seq pkt_seq; 449 unsigned pkt_len; 450 u_long rcvpartdupbyte = 0; 451 u_long rcvoobyte; 452 #ifdef TCP_REASS_COUNTERS 453 u_int count = 0; 454 #endif 455 uint64_t *tcps; 456 457 if (tp->t_inpcb) 458 so = tp->t_inpcb->inp_socket; 459 #ifdef INET6 460 else if (tp->t_in6pcb) 461 so = tp->t_in6pcb->in6p_socket; 462 #endif 463 464 TCP_REASS_LOCK_CHECK(tp); 465 466 /* 467 * Call with th==0 after become established to 468 * force pre-ESTABLISHED data up to user socket. 469 */ 470 if (th == 0) 471 goto present; 472 473 m_claimm(m, &tcp_reass_mowner); 474 475 rcvoobyte = *tlen; 476 /* 477 * Copy these to local variables because the tcpiphdr 478 * gets munged while we are collapsing mbufs. 479 */ 480 pkt_seq = th->th_seq; 481 pkt_len = *tlen; 482 pkt_flags = th->th_flags; 483 484 TCP_REASS_COUNTER_INCR(&tcp_reass_); 485 486 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) { 487 /* 488 * When we miss a packet, the vast majority of time we get 489 * packets that follow it in order. So optimize for that. 490 */ 491 if (pkt_seq == p->ipqe_seq + p->ipqe_len) { 492 p->ipqe_len += pkt_len; 493 p->ipqe_flags |= pkt_flags; 494 m_cat(p->ipre_mlast, m); 495 TRAVERSE(p->ipre_mlast); 496 m = NULL; 497 tiqe = p; 498 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq); 499 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail); 500 goto skip_replacement; 501 } 502 /* 503 * While we're here, if the pkt is completely beyond 504 * anything we have, just insert it at the tail. 505 */ 506 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) { 507 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail); 508 goto insert_it; 509 } 510 } 511 512 q = TAILQ_FIRST(&tp->segq); 513 514 if (q != NULL) { 515 /* 516 * If this segment immediately precedes the first out-of-order 517 * block, simply slap the segment in front of it and (mostly) 518 * skip the complicated logic. 519 */ 520 if (pkt_seq + pkt_len == q->ipqe_seq) { 521 q->ipqe_seq = pkt_seq; 522 q->ipqe_len += pkt_len; 523 q->ipqe_flags |= pkt_flags; 524 m_cat(m, q->ipqe_m); 525 q->ipqe_m = m; 526 q->ipre_mlast = m; /* last mbuf may have changed */ 527 TRAVERSE(q->ipre_mlast); 528 tiqe = q; 529 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq); 530 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst); 531 goto skip_replacement; 532 } 533 } else { 534 TCP_REASS_COUNTER_INCR(&tcp_reass_empty); 535 } 536 537 /* 538 * Find a segment which begins after this one does. 539 */ 540 for (p = NULL; q != NULL; q = nq) { 541 nq = TAILQ_NEXT(q, ipqe_q); 542 #ifdef TCP_REASS_COUNTERS 543 count++; 544 #endif 545 /* 546 * If the received segment is just right after this 547 * fragment, merge the two together and then check 548 * for further overlaps. 549 */ 550 if (q->ipqe_seq + q->ipqe_len == pkt_seq) { 551 #ifdef TCPREASS_DEBUG 552 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n", 553 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 554 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len); 555 #endif 556 pkt_len += q->ipqe_len; 557 pkt_flags |= q->ipqe_flags; 558 pkt_seq = q->ipqe_seq; 559 m_cat(q->ipre_mlast, m); 560 TRAVERSE(q->ipre_mlast); 561 m = q->ipqe_m; 562 TCP_REASS_COUNTER_INCR(&tcp_reass_append); 563 goto free_ipqe; 564 } 565 /* 566 * If the received segment is completely past this 567 * fragment, we need to go the next fragment. 568 */ 569 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 570 p = q; 571 continue; 572 } 573 /* 574 * If the fragment is past the received segment, 575 * it (or any following) can't be concatenated. 576 */ 577 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) { 578 TCP_REASS_COUNTER_INCR(&tcp_reass_insert); 579 break; 580 } 581 582 /* 583 * We've received all the data in this segment before. 584 * mark it as a duplicate and return. 585 */ 586 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) && 587 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 588 tcps = TCP_STAT_GETREF(); 589 tcps[TCP_STAT_RCVDUPPACK]++; 590 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len; 591 TCP_STAT_PUTREF(); 592 tcp_new_dsack(tp, pkt_seq, pkt_len); 593 m_freem(m); 594 if (tiqe != NULL) { 595 tcpipqent_free(tiqe); 596 } 597 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup); 598 goto out; 599 } 600 /* 601 * Received segment completely overlaps this fragment 602 * so we drop the fragment (this keeps the temporal 603 * ordering of segments correct). 604 */ 605 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) && 606 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 607 rcvpartdupbyte += q->ipqe_len; 608 m_freem(q->ipqe_m); 609 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup); 610 goto free_ipqe; 611 } 612 /* 613 * RX'ed segment extends past the end of the 614 * fragment. Drop the overlapping bytes. Then 615 * merge the fragment and segment then treat as 616 * a longer received packet. 617 */ 618 if (SEQ_LT(q->ipqe_seq, pkt_seq) && 619 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 620 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq; 621 #ifdef TCPREASS_DEBUG 622 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n", 623 tp, overlap, 624 pkt_seq, pkt_seq + pkt_len, pkt_len); 625 #endif 626 m_adj(m, overlap); 627 rcvpartdupbyte += overlap; 628 m_cat(q->ipre_mlast, m); 629 TRAVERSE(q->ipre_mlast); 630 m = q->ipqe_m; 631 pkt_seq = q->ipqe_seq; 632 pkt_len += q->ipqe_len - overlap; 633 rcvoobyte -= overlap; 634 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail); 635 goto free_ipqe; 636 } 637 /* 638 * RX'ed segment extends past the front of the 639 * fragment. Drop the overlapping bytes on the 640 * received packet. The packet will then be 641 * contatentated with this fragment a bit later. 642 */ 643 if (SEQ_GT(q->ipqe_seq, pkt_seq) && 644 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) { 645 int overlap = pkt_seq + pkt_len - q->ipqe_seq; 646 #ifdef TCPREASS_DEBUG 647 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n", 648 tp, overlap, 649 pkt_seq, pkt_seq + pkt_len, pkt_len); 650 #endif 651 m_adj(m, -overlap); 652 pkt_len -= overlap; 653 rcvpartdupbyte += overlap; 654 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront); 655 rcvoobyte -= overlap; 656 } 657 /* 658 * If the received segment immediates precedes this 659 * fragment then tack the fragment onto this segment 660 * and reinsert the data. 661 */ 662 if (q->ipqe_seq == pkt_seq + pkt_len) { 663 #ifdef TCPREASS_DEBUG 664 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n", 665 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len, 666 pkt_seq, pkt_seq + pkt_len, pkt_len); 667 #endif 668 pkt_len += q->ipqe_len; 669 pkt_flags |= q->ipqe_flags; 670 m_cat(m, q->ipqe_m); 671 TAILQ_REMOVE(&tp->segq, q, ipqe_q); 672 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq); 673 tp->t_segqlen--; 674 KASSERT(tp->t_segqlen >= 0); 675 KASSERT(tp->t_segqlen != 0 || 676 (TAILQ_EMPTY(&tp->segq) && 677 TAILQ_EMPTY(&tp->timeq))); 678 if (tiqe == NULL) { 679 tiqe = q; 680 } else { 681 tcpipqent_free(q); 682 } 683 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend); 684 break; 685 } 686 /* 687 * If the fragment is before the segment, remember it. 688 * When this loop is terminated, p will contain the 689 * pointer to fragment that is right before the received 690 * segment. 691 */ 692 if (SEQ_LEQ(q->ipqe_seq, pkt_seq)) 693 p = q; 694 695 continue; 696 697 /* 698 * This is a common operation. It also will allow 699 * to save doing a malloc/free in most instances. 700 */ 701 free_ipqe: 702 TAILQ_REMOVE(&tp->segq, q, ipqe_q); 703 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq); 704 tp->t_segqlen--; 705 KASSERT(tp->t_segqlen >= 0); 706 KASSERT(tp->t_segqlen != 0 || 707 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq))); 708 if (tiqe == NULL) { 709 tiqe = q; 710 } else { 711 tcpipqent_free(q); 712 } 713 } 714 715 #ifdef TCP_REASS_COUNTERS 716 if (count > 7) 717 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]); 718 else if (count > 0) 719 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]); 720 #endif 721 722 insert_it: 723 724 /* 725 * Allocate a new queue entry since the received segment did not 726 * collapse onto any other out-of-order block; thus we are allocating 727 * a new block. If it had collapsed, tiqe would not be NULL and 728 * we would be reusing it. 729 * XXX If we can't, just drop the packet. XXX 730 */ 731 if (tiqe == NULL) { 732 tiqe = tcpipqent_alloc(); 733 if (tiqe == NULL) { 734 TCP_STATINC(TCP_STAT_RCVMEMDROP); 735 m_freem(m); 736 goto out; 737 } 738 } 739 740 /* 741 * Update the counters. 742 */ 743 tp->t_rcvoopack++; 744 tcps = TCP_STAT_GETREF(); 745 tcps[TCP_STAT_RCVOOPACK]++; 746 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte; 747 if (rcvpartdupbyte) { 748 tcps[TCP_STAT_RCVPARTDUPPACK]++; 749 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte; 750 } 751 TCP_STAT_PUTREF(); 752 753 /* 754 * Insert the new fragment queue entry into both queues. 755 */ 756 tiqe->ipqe_m = m; 757 tiqe->ipre_mlast = m; 758 tiqe->ipqe_seq = pkt_seq; 759 tiqe->ipqe_len = pkt_len; 760 tiqe->ipqe_flags = pkt_flags; 761 if (p == NULL) { 762 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q); 763 #ifdef TCPREASS_DEBUG 764 if (tiqe->ipqe_seq != tp->rcv_nxt) 765 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n", 766 tp, pkt_seq, pkt_seq + pkt_len, pkt_len); 767 #endif 768 } else { 769 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q); 770 #ifdef TCPREASS_DEBUG 771 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n", 772 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 773 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len); 774 #endif 775 } 776 tp->t_segqlen++; 777 778 skip_replacement: 779 780 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq); 781 782 present: 783 /* 784 * Present data to user, advancing rcv_nxt through 785 * completed sequence space. 786 */ 787 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 788 goto out; 789 q = TAILQ_FIRST(&tp->segq); 790 if (q == NULL || q->ipqe_seq != tp->rcv_nxt) 791 goto out; 792 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len) 793 goto out; 794 795 tp->rcv_nxt += q->ipqe_len; 796 pkt_flags = q->ipqe_flags & TH_FIN; 797 nd6_hint(tp); 798 799 TAILQ_REMOVE(&tp->segq, q, ipqe_q); 800 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq); 801 tp->t_segqlen--; 802 KASSERT(tp->t_segqlen >= 0); 803 KASSERT(tp->t_segqlen != 0 || 804 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq))); 805 if (so->so_state & SS_CANTRCVMORE) 806 m_freem(q->ipqe_m); 807 else 808 sbappendstream(&so->so_rcv, q->ipqe_m); 809 tcpipqent_free(q); 810 TCP_REASS_UNLOCK(tp); 811 sorwakeup(so); 812 return (pkt_flags); 813 out: 814 TCP_REASS_UNLOCK(tp); 815 return (0); 816 } 817 818 #ifdef INET6 819 int 820 tcp6_input(struct mbuf **mp, int *offp, int proto) 821 { 822 struct mbuf *m = *mp; 823 824 /* 825 * draft-itojun-ipv6-tcp-to-anycast 826 * better place to put this in? 827 */ 828 if (m->m_flags & M_ANYCAST6) { 829 struct ip6_hdr *ip6; 830 if (m->m_len < sizeof(struct ip6_hdr)) { 831 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 832 TCP_STATINC(TCP_STAT_RCVSHORT); 833 return IPPROTO_DONE; 834 } 835 } 836 ip6 = mtod(m, struct ip6_hdr *); 837 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR, 838 (char *)&ip6->ip6_dst - (char *)ip6); 839 return IPPROTO_DONE; 840 } 841 842 tcp_input(m, *offp, proto); 843 return IPPROTO_DONE; 844 } 845 #endif 846 847 #ifdef INET 848 static void 849 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th) 850 { 851 char src[INET_ADDRSTRLEN]; 852 char dst[INET_ADDRSTRLEN]; 853 854 if (ip) { 855 in_print(src, sizeof(src), &ip->ip_src); 856 in_print(dst, sizeof(dst), &ip->ip_dst); 857 } 858 else { 859 strlcpy(src, "(unknown)", sizeof(src)); 860 strlcpy(dst, "(unknown)", sizeof(dst)); 861 } 862 log(LOG_INFO, 863 "Connection attempt to TCP %s:%d from %s:%d\n", 864 dst, ntohs(th->th_dport), 865 src, ntohs(th->th_sport)); 866 } 867 #endif 868 869 #ifdef INET6 870 static void 871 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th) 872 { 873 char src[INET6_ADDRSTRLEN]; 874 char dst[INET6_ADDRSTRLEN]; 875 876 if (ip6) { 877 in6_print(src, sizeof(src), &ip6->ip6_src); 878 in6_print(dst, sizeof(dst), &ip6->ip6_dst); 879 } 880 else { 881 strlcpy(src, "(unknown v6)", sizeof(src)); 882 strlcpy(dst, "(unknown v6)", sizeof(dst)); 883 } 884 log(LOG_INFO, 885 "Connection attempt to TCP [%s]:%d from [%s]:%d\n", 886 dst, ntohs(th->th_dport), 887 src, ntohs(th->th_sport)); 888 } 889 #endif 890 891 /* 892 * Checksum extended TCP header and data. 893 */ 894 int 895 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th, 896 int toff, int off, int tlen) 897 { 898 struct ifnet *rcvif; 899 int s; 900 901 /* 902 * XXX it's better to record and check if this mbuf is 903 * already checked. 904 */ 905 906 rcvif = m_get_rcvif(m, &s); 907 if (__predict_false(rcvif == NULL)) 908 goto badcsum; /* XXX */ 909 910 switch (af) { 911 #ifdef INET 912 case AF_INET: 913 switch (m->m_pkthdr.csum_flags & 914 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv4) | 915 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) { 916 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD: 917 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad); 918 goto badcsum; 919 920 case M_CSUM_TCPv4|M_CSUM_DATA: { 921 u_int32_t hw_csum = m->m_pkthdr.csum_data; 922 923 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data); 924 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) { 925 const struct ip *ip = 926 mtod(m, const struct ip *); 927 928 hw_csum = in_cksum_phdr(ip->ip_src.s_addr, 929 ip->ip_dst.s_addr, 930 htons(hw_csum + tlen + off + IPPROTO_TCP)); 931 } 932 if ((hw_csum ^ 0xffff) != 0) 933 goto badcsum; 934 break; 935 } 936 937 case M_CSUM_TCPv4: 938 /* Checksum was okay. */ 939 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok); 940 break; 941 942 default: 943 /* 944 * Must compute it ourselves. Maybe skip checksum 945 * on loopback interfaces. 946 */ 947 if (__predict_true(!(rcvif->if_flags & IFF_LOOPBACK) || 948 tcp_do_loopback_cksum)) { 949 TCP_CSUM_COUNTER_INCR(&tcp_swcsum); 950 if (in4_cksum(m, IPPROTO_TCP, toff, 951 tlen + off) != 0) 952 goto badcsum; 953 } 954 break; 955 } 956 break; 957 #endif /* INET4 */ 958 959 #ifdef INET6 960 case AF_INET6: 961 switch (m->m_pkthdr.csum_flags & 962 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv6) | 963 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) { 964 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD: 965 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad); 966 goto badcsum; 967 968 #if 0 /* notyet */ 969 case M_CSUM_TCPv6|M_CSUM_DATA: 970 #endif 971 972 case M_CSUM_TCPv6: 973 /* Checksum was okay. */ 974 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok); 975 break; 976 977 default: 978 /* 979 * Must compute it ourselves. Maybe skip checksum 980 * on loopback interfaces. 981 */ 982 if (__predict_true((m->m_flags & M_LOOP) == 0 || 983 tcp_do_loopback_cksum)) { 984 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum); 985 if (in6_cksum(m, IPPROTO_TCP, toff, 986 tlen + off) != 0) 987 goto badcsum; 988 } 989 } 990 break; 991 #endif /* INET6 */ 992 } 993 m_put_rcvif(rcvif, &s); 994 995 return 0; 996 997 badcsum: 998 m_put_rcvif(rcvif, &s); 999 TCP_STATINC(TCP_STAT_RCVBADSUM); 1000 return -1; 1001 } 1002 1003 /* When a packet arrives addressed to a vestigial tcpbp, we 1004 * nevertheless have to respond to it per the spec. 1005 */ 1006 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp, 1007 struct mbuf *m, int tlen, int multicast) 1008 { 1009 int tiflags; 1010 int todrop; 1011 uint32_t t_flags = 0; 1012 uint64_t *tcps; 1013 1014 tiflags = th->th_flags; 1015 todrop = vp->rcv_nxt - th->th_seq; 1016 1017 if (todrop > 0) { 1018 if (tiflags & TH_SYN) { 1019 tiflags &= ~TH_SYN; 1020 ++th->th_seq; 1021 if (th->th_urp > 1) 1022 --th->th_urp; 1023 else { 1024 tiflags &= ~TH_URG; 1025 th->th_urp = 0; 1026 } 1027 --todrop; 1028 } 1029 if (todrop > tlen || 1030 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 1031 /* 1032 * Any valid FIN or RST must be to the left of the 1033 * window. At this point the FIN or RST must be a 1034 * duplicate or out of sequence; drop it. 1035 */ 1036 if (tiflags & TH_RST) 1037 goto drop; 1038 tiflags &= ~(TH_FIN|TH_RST); 1039 /* 1040 * Send an ACK to resynchronize and drop any data. 1041 * But keep on processing for RST or ACK. 1042 */ 1043 t_flags |= TF_ACKNOW; 1044 todrop = tlen; 1045 tcps = TCP_STAT_GETREF(); 1046 tcps[TCP_STAT_RCVDUPPACK] += 1; 1047 tcps[TCP_STAT_RCVDUPBYTE] += todrop; 1048 TCP_STAT_PUTREF(); 1049 } else if ((tiflags & TH_RST) 1050 && th->th_seq != vp->rcv_nxt) { 1051 /* 1052 * Test for reset before adjusting the sequence 1053 * number for overlapping data. 1054 */ 1055 goto dropafterack_ratelim; 1056 } else { 1057 tcps = TCP_STAT_GETREF(); 1058 tcps[TCP_STAT_RCVPARTDUPPACK] += 1; 1059 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop; 1060 TCP_STAT_PUTREF(); 1061 } 1062 1063 // tcp_new_dsack(tp, th->th_seq, todrop); 1064 // hdroptlen += todrop; /*drop from head afterwards*/ 1065 1066 th->th_seq += todrop; 1067 tlen -= todrop; 1068 1069 if (th->th_urp > todrop) 1070 th->th_urp -= todrop; 1071 else { 1072 tiflags &= ~TH_URG; 1073 th->th_urp = 0; 1074 } 1075 } 1076 1077 /* 1078 * If new data are received on a connection after the 1079 * user processes are gone, then RST the other end. 1080 */ 1081 if (tlen) { 1082 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE); 1083 goto dropwithreset; 1084 } 1085 1086 /* 1087 * If segment ends after window, drop trailing data 1088 * (and PUSH and FIN); if nothing left, just ACK. 1089 */ 1090 todrop = (th->th_seq + tlen) - (vp->rcv_nxt+vp->rcv_wnd); 1091 1092 if (todrop > 0) { 1093 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN); 1094 if (todrop >= tlen) { 1095 /* 1096 * The segment actually starts after the window. 1097 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen 1098 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0 1099 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd 1100 */ 1101 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen); 1102 /* 1103 * If a new connection request is received 1104 * while in TIME_WAIT, drop the old connection 1105 * and start over if the sequence numbers 1106 * are above the previous ones. 1107 */ 1108 if ((tiflags & TH_SYN) 1109 && SEQ_GT(th->th_seq, vp->rcv_nxt)) { 1110 /* We only support this in the !NOFDREF case, which 1111 * is to say: not here. 1112 */ 1113 goto dropwithreset; 1114 } 1115 /* 1116 * If window is closed can only take segments at 1117 * window edge, and have to drop data and PUSH from 1118 * incoming segments. Continue processing, but 1119 * remember to ack. Otherwise, drop segment 1120 * and (if not RST) ack. 1121 */ 1122 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) { 1123 t_flags |= TF_ACKNOW; 1124 TCP_STATINC(TCP_STAT_RCVWINPROBE); 1125 } else 1126 goto dropafterack; 1127 } else 1128 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop); 1129 m_adj(m, -todrop); 1130 tlen -= todrop; 1131 tiflags &= ~(TH_PUSH|TH_FIN); 1132 } 1133 1134 if (tiflags & TH_RST) { 1135 if (th->th_seq != vp->rcv_nxt) 1136 goto dropafterack_ratelim; 1137 1138 vtw_del(vp->ctl, vp->vtw); 1139 goto drop; 1140 } 1141 1142 /* 1143 * If the ACK bit is off we drop the segment and return. 1144 */ 1145 if ((tiflags & TH_ACK) == 0) { 1146 if (t_flags & TF_ACKNOW) 1147 goto dropafterack; 1148 else 1149 goto drop; 1150 } 1151 1152 /* 1153 * In TIME_WAIT state the only thing that should arrive 1154 * is a retransmission of the remote FIN. Acknowledge 1155 * it and restart the finack timer. 1156 */ 1157 vtw_restart(vp); 1158 goto dropafterack; 1159 1160 dropafterack: 1161 /* 1162 * Generate an ACK dropping incoming segment if it occupies 1163 * sequence space, where the ACK reflects our state. 1164 */ 1165 if (tiflags & TH_RST) 1166 goto drop; 1167 goto dropafterack2; 1168 1169 dropafterack_ratelim: 1170 /* 1171 * We may want to rate-limit ACKs against SYN/RST attack. 1172 */ 1173 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count, 1174 tcp_ackdrop_ppslim) == 0) { 1175 /* XXX stat */ 1176 goto drop; 1177 } 1178 /* ...fall into dropafterack2... */ 1179 1180 dropafterack2: 1181 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack, 1182 TH_ACK); 1183 return; 1184 1185 dropwithreset: 1186 /* 1187 * Generate a RST, dropping incoming segment. 1188 * Make ACK acceptable to originator of segment. 1189 */ 1190 if (tiflags & TH_RST) 1191 goto drop; 1192 1193 if (tiflags & TH_ACK) 1194 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST); 1195 else { 1196 if (tiflags & TH_SYN) 1197 ++tlen; 1198 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0, 1199 TH_RST|TH_ACK); 1200 } 1201 return; 1202 drop: 1203 m_freem(m); 1204 } 1205 1206 /* 1207 * TCP input routine, follows pages 65-76 of RFC 793 very closely. 1208 */ 1209 void 1210 tcp_input(struct mbuf *m, ...) 1211 { 1212 struct tcphdr *th; 1213 struct ip *ip; 1214 struct inpcb *inp; 1215 #ifdef INET6 1216 struct ip6_hdr *ip6; 1217 struct in6pcb *in6p; 1218 #endif 1219 u_int8_t *optp = NULL; 1220 int optlen = 0; 1221 int len, tlen, toff, hdroptlen = 0; 1222 struct tcpcb *tp = 0; 1223 int tiflags; 1224 struct socket *so = NULL; 1225 int todrop, acked, ourfinisacked, needoutput = 0; 1226 bool dupseg; 1227 #ifdef TCP_DEBUG 1228 short ostate = 0; 1229 #endif 1230 u_long tiwin; 1231 struct tcp_opt_info opti; 1232 int off, iphlen; 1233 va_list ap; 1234 int af; /* af on the wire */ 1235 struct mbuf *tcp_saveti = NULL; 1236 uint32_t ts_rtt; 1237 uint8_t iptos; 1238 uint64_t *tcps; 1239 vestigial_inpcb_t vestige; 1240 1241 vestige.valid = 0; 1242 1243 MCLAIM(m, &tcp_rx_mowner); 1244 va_start(ap, m); 1245 toff = va_arg(ap, int); 1246 (void)va_arg(ap, int); /* ignore value, advance ap */ 1247 va_end(ap); 1248 1249 TCP_STATINC(TCP_STAT_RCVTOTAL); 1250 1251 memset(&opti, 0, sizeof(opti)); 1252 opti.ts_present = 0; 1253 opti.maxseg = 0; 1254 1255 /* 1256 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN. 1257 * 1258 * TCP is, by definition, unicast, so we reject all 1259 * multicast outright. 1260 * 1261 * Note, there are additional src/dst address checks in 1262 * the AF-specific code below. 1263 */ 1264 if (m->m_flags & (M_BCAST|M_MCAST)) { 1265 /* XXX stat */ 1266 goto drop; 1267 } 1268 #ifdef INET6 1269 if (m->m_flags & M_ANYCAST6) { 1270 /* XXX stat */ 1271 goto drop; 1272 } 1273 #endif 1274 1275 /* 1276 * Get IP and TCP header. 1277 * Note: IP leaves IP header in first mbuf. 1278 */ 1279 ip = mtod(m, struct ip *); 1280 switch (ip->ip_v) { 1281 #ifdef INET 1282 case 4: 1283 #ifdef INET6 1284 ip6 = NULL; 1285 #endif 1286 af = AF_INET; 1287 iphlen = sizeof(struct ip); 1288 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, 1289 sizeof(struct tcphdr)); 1290 if (th == NULL) { 1291 TCP_STATINC(TCP_STAT_RCVSHORT); 1292 return; 1293 } 1294 /* We do the checksum after PCB lookup... */ 1295 len = ntohs(ip->ip_len); 1296 tlen = len - toff; 1297 iptos = ip->ip_tos; 1298 break; 1299 #endif 1300 #ifdef INET6 1301 case 6: 1302 ip = NULL; 1303 iphlen = sizeof(struct ip6_hdr); 1304 af = AF_INET6; 1305 ip6 = mtod(m, struct ip6_hdr *); 1306 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, 1307 sizeof(struct tcphdr)); 1308 if (th == NULL) { 1309 TCP_STATINC(TCP_STAT_RCVSHORT); 1310 return; 1311 } 1312 1313 /* Be proactive about malicious use of IPv4 mapped address */ 1314 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 1315 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 1316 /* XXX stat */ 1317 goto drop; 1318 } 1319 1320 /* 1321 * Be proactive about unspecified IPv6 address in source. 1322 * As we use all-zero to indicate unbounded/unconnected pcb, 1323 * unspecified IPv6 address can be used to confuse us. 1324 * 1325 * Note that packets with unspecified IPv6 destination is 1326 * already dropped in ip6_input. 1327 */ 1328 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 1329 /* XXX stat */ 1330 goto drop; 1331 } 1332 1333 /* 1334 * Make sure destination address is not multicast. 1335 * Source address checked in ip6_input(). 1336 */ 1337 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 1338 /* XXX stat */ 1339 goto drop; 1340 } 1341 1342 /* We do the checksum after PCB lookup... */ 1343 len = m->m_pkthdr.len; 1344 tlen = len - toff; 1345 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 1346 break; 1347 #endif 1348 default: 1349 m_freem(m); 1350 return; 1351 } 1352 /* 1353 * Enforce alignment requirements that are violated in 1354 * some cases, see kern/50766 for details. 1355 */ 1356 if (TCP_HDR_ALIGNED_P(th) == 0) { 1357 m = m_copyup(m, toff + sizeof(struct tcphdr), 0); 1358 if (m == NULL) { 1359 TCP_STATINC(TCP_STAT_RCVSHORT); 1360 return; 1361 } 1362 ip = mtod(m, struct ip *); 1363 #ifdef INET6 1364 ip6 = mtod(m, struct ip6_hdr *); 1365 #endif 1366 th = (struct tcphdr *)(mtod(m, char *) + toff); 1367 } 1368 KASSERT(TCP_HDR_ALIGNED_P(th)); 1369 1370 /* 1371 * Check that TCP offset makes sense, 1372 * pull out TCP options and adjust length. XXX 1373 */ 1374 off = th->th_off << 2; 1375 if (off < sizeof (struct tcphdr) || off > tlen) { 1376 TCP_STATINC(TCP_STAT_RCVBADOFF); 1377 goto drop; 1378 } 1379 tlen -= off; 1380 1381 /* 1382 * tcp_input() has been modified to use tlen to mean the TCP data 1383 * length throughout the function. Other functions can use 1384 * m->m_pkthdr.len as the basis for calculating the TCP data length. 1385 * rja 1386 */ 1387 1388 if (off > sizeof (struct tcphdr)) { 1389 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off); 1390 if (th == NULL) { 1391 TCP_STATINC(TCP_STAT_RCVSHORT); 1392 return; 1393 } 1394 /* 1395 * NOTE: ip/ip6 will not be affected by m_pulldown() 1396 * (as they're before toff) and we don't need to update those. 1397 */ 1398 KASSERT(TCP_HDR_ALIGNED_P(th)); 1399 optlen = off - sizeof (struct tcphdr); 1400 optp = ((u_int8_t *)th) + sizeof(struct tcphdr); 1401 /* 1402 * Do quick retrieval of timestamp options ("options 1403 * prediction?"). If timestamp is the only option and it's 1404 * formatted as recommended in RFC 1323 appendix A, we 1405 * quickly get the values now and not bother calling 1406 * tcp_dooptions(), etc. 1407 */ 1408 if ((optlen == TCPOLEN_TSTAMP_APPA || 1409 (optlen > TCPOLEN_TSTAMP_APPA && 1410 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 1411 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 1412 (th->th_flags & TH_SYN) == 0) { 1413 opti.ts_present = 1; 1414 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 1415 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 1416 optp = NULL; /* we've parsed the options */ 1417 } 1418 } 1419 tiflags = th->th_flags; 1420 1421 /* 1422 * Checksum extended TCP header and data 1423 */ 1424 if (tcp_input_checksum(af, m, th, toff, off, tlen)) 1425 goto badcsum; 1426 1427 /* 1428 * Locate pcb for segment. 1429 */ 1430 findpcb: 1431 inp = NULL; 1432 #ifdef INET6 1433 in6p = NULL; 1434 #endif 1435 switch (af) { 1436 #ifdef INET 1437 case AF_INET: 1438 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport, 1439 ip->ip_dst, th->th_dport, 1440 &vestige); 1441 if (inp == 0 && !vestige.valid) { 1442 TCP_STATINC(TCP_STAT_PCBHASHMISS); 1443 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport); 1444 } 1445 #ifdef INET6 1446 if (inp == 0 && !vestige.valid) { 1447 struct in6_addr s, d; 1448 1449 /* mapped addr case */ 1450 in6_in_2_v4mapin6(&ip->ip_src, &s); 1451 in6_in_2_v4mapin6(&ip->ip_dst, &d); 1452 in6p = in6_pcblookup_connect(&tcbtable, &s, 1453 th->th_sport, &d, th->th_dport, 1454 0, &vestige); 1455 if (in6p == 0 && !vestige.valid) { 1456 TCP_STATINC(TCP_STAT_PCBHASHMISS); 1457 in6p = in6_pcblookup_bind(&tcbtable, &d, 1458 th->th_dport, 0); 1459 } 1460 } 1461 #endif 1462 #ifndef INET6 1463 if (inp == 0 && !vestige.valid) 1464 #else 1465 if (inp == 0 && in6p == 0 && !vestige.valid) 1466 #endif 1467 { 1468 TCP_STATINC(TCP_STAT_NOPORT); 1469 if (tcp_log_refused && 1470 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) { 1471 tcp4_log_refused(ip, th); 1472 } 1473 tcp_fields_to_host(th); 1474 goto dropwithreset_ratelim; 1475 } 1476 #if defined(IPSEC) 1477 if (ipsec_used) { 1478 if (inp && 1479 (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0 1480 && ipsec4_in_reject(m, inp)) { 1481 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1482 goto drop; 1483 } 1484 #ifdef INET6 1485 else if (in6p && 1486 (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 1487 && ipsec6_in_reject_so(m, in6p->in6p_socket)) { 1488 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1489 goto drop; 1490 } 1491 #endif 1492 } 1493 #endif /*IPSEC*/ 1494 break; 1495 #endif /*INET*/ 1496 #ifdef INET6 1497 case AF_INET6: 1498 { 1499 int faith; 1500 1501 #if defined(NFAITH) && NFAITH > 0 1502 faith = faithprefix(&ip6->ip6_dst); 1503 #else 1504 faith = 0; 1505 #endif 1506 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src, 1507 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige); 1508 if (!in6p && !vestige.valid) { 1509 TCP_STATINC(TCP_STAT_PCBHASHMISS); 1510 in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst, 1511 th->th_dport, faith); 1512 } 1513 if (!in6p && !vestige.valid) { 1514 TCP_STATINC(TCP_STAT_NOPORT); 1515 if (tcp_log_refused && 1516 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) { 1517 tcp6_log_refused(ip6, th); 1518 } 1519 tcp_fields_to_host(th); 1520 goto dropwithreset_ratelim; 1521 } 1522 #if defined(IPSEC) 1523 if (ipsec_used && in6p 1524 && (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 1525 && ipsec6_in_reject(m, in6p)) { 1526 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO); 1527 goto drop; 1528 } 1529 #endif /*IPSEC*/ 1530 break; 1531 } 1532 #endif 1533 } 1534 1535 /* 1536 * If the state is CLOSED (i.e., TCB does not exist) then 1537 * all data in the incoming segment is discarded. 1538 * If the TCB exists but is in CLOSED state, it is embryonic, 1539 * but should either do a listen or a connect soon. 1540 */ 1541 tp = NULL; 1542 so = NULL; 1543 if (inp) { 1544 /* Check the minimum TTL for socket. */ 1545 if (ip->ip_ttl < inp->inp_ip_minttl) 1546 goto drop; 1547 1548 tp = intotcpcb(inp); 1549 so = inp->inp_socket; 1550 } 1551 #ifdef INET6 1552 else if (in6p) { 1553 tp = in6totcpcb(in6p); 1554 so = in6p->in6p_socket; 1555 } 1556 #endif 1557 else if (vestige.valid) { 1558 int mc = 0; 1559 1560 /* We do not support the resurrection of vtw tcpcps. 1561 */ 1562 if (tcp_input_checksum(af, m, th, toff, off, tlen)) 1563 goto badcsum; 1564 1565 switch (af) { 1566 #ifdef INET6 1567 case AF_INET6: 1568 mc = IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst); 1569 break; 1570 #endif 1571 1572 case AF_INET: 1573 mc = (IN_MULTICAST(ip->ip_dst.s_addr) 1574 || in_broadcast(ip->ip_dst, 1575 m_get_rcvif_NOMPSAFE(m))); 1576 break; 1577 } 1578 1579 tcp_fields_to_host(th); 1580 tcp_vtw_input(th, &vestige, m, tlen, mc); 1581 m = 0; 1582 goto drop; 1583 } 1584 1585 if (tp == 0) { 1586 tcp_fields_to_host(th); 1587 goto dropwithreset_ratelim; 1588 } 1589 if (tp->t_state == TCPS_CLOSED) 1590 goto drop; 1591 1592 KASSERT(so->so_lock == softnet_lock); 1593 KASSERT(solocked(so)); 1594 1595 tcp_fields_to_host(th); 1596 1597 /* Unscale the window into a 32-bit value. */ 1598 if ((tiflags & TH_SYN) == 0) 1599 tiwin = th->th_win << tp->snd_scale; 1600 else 1601 tiwin = th->th_win; 1602 1603 #ifdef INET6 1604 /* save packet options if user wanted */ 1605 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) { 1606 if (in6p->in6p_options) { 1607 m_freem(in6p->in6p_options); 1608 in6p->in6p_options = 0; 1609 } 1610 KASSERT(ip6 != NULL); 1611 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m); 1612 } 1613 #endif 1614 1615 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 1616 union syn_cache_sa src; 1617 union syn_cache_sa dst; 1618 1619 memset(&src, 0, sizeof(src)); 1620 memset(&dst, 0, sizeof(dst)); 1621 switch (af) { 1622 #ifdef INET 1623 case AF_INET: 1624 src.sin.sin_len = sizeof(struct sockaddr_in); 1625 src.sin.sin_family = AF_INET; 1626 src.sin.sin_addr = ip->ip_src; 1627 src.sin.sin_port = th->th_sport; 1628 1629 dst.sin.sin_len = sizeof(struct sockaddr_in); 1630 dst.sin.sin_family = AF_INET; 1631 dst.sin.sin_addr = ip->ip_dst; 1632 dst.sin.sin_port = th->th_dport; 1633 break; 1634 #endif 1635 #ifdef INET6 1636 case AF_INET6: 1637 src.sin6.sin6_len = sizeof(struct sockaddr_in6); 1638 src.sin6.sin6_family = AF_INET6; 1639 src.sin6.sin6_addr = ip6->ip6_src; 1640 src.sin6.sin6_port = th->th_sport; 1641 1642 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 1643 dst.sin6.sin6_family = AF_INET6; 1644 dst.sin6.sin6_addr = ip6->ip6_dst; 1645 dst.sin6.sin6_port = th->th_dport; 1646 break; 1647 #endif /* INET6 */ 1648 default: 1649 goto badsyn; /*sanity*/ 1650 } 1651 1652 if (so->so_options & SO_DEBUG) { 1653 #ifdef TCP_DEBUG 1654 ostate = tp->t_state; 1655 #endif 1656 1657 tcp_saveti = NULL; 1658 if (iphlen + sizeof(struct tcphdr) > MHLEN) 1659 goto nosave; 1660 1661 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) { 1662 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT); 1663 if (!tcp_saveti) 1664 goto nosave; 1665 } else { 1666 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER); 1667 if (!tcp_saveti) 1668 goto nosave; 1669 MCLAIM(m, &tcp_mowner); 1670 tcp_saveti->m_len = iphlen; 1671 m_copydata(m, 0, iphlen, 1672 mtod(tcp_saveti, void *)); 1673 } 1674 1675 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) { 1676 m_freem(tcp_saveti); 1677 tcp_saveti = NULL; 1678 } else { 1679 tcp_saveti->m_len += sizeof(struct tcphdr); 1680 memcpy(mtod(tcp_saveti, char *) + iphlen, th, 1681 sizeof(struct tcphdr)); 1682 } 1683 nosave:; 1684 } 1685 if (so->so_options & SO_ACCEPTCONN) { 1686 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 1687 if (tiflags & TH_RST) { 1688 syn_cache_reset(&src.sa, &dst.sa, th); 1689 } else if ((tiflags & (TH_ACK|TH_SYN)) == 1690 (TH_ACK|TH_SYN)) { 1691 /* 1692 * Received a SYN,ACK. This should 1693 * never happen while we are in 1694 * LISTEN. Send an RST. 1695 */ 1696 goto badsyn; 1697 } else if (tiflags & TH_ACK) { 1698 so = syn_cache_get(&src.sa, &dst.sa, 1699 th, toff, tlen, so, m); 1700 if (so == NULL) { 1701 /* 1702 * We don't have a SYN for 1703 * this ACK; send an RST. 1704 */ 1705 goto badsyn; 1706 } else if (so == 1707 (struct socket *)(-1)) { 1708 /* 1709 * We were unable to create 1710 * the connection. If the 1711 * 3-way handshake was 1712 * completed, and RST has 1713 * been sent to the peer. 1714 * Since the mbuf might be 1715 * in use for the reply, 1716 * do not free it. 1717 */ 1718 m = NULL; 1719 } else { 1720 /* 1721 * We have created a 1722 * full-blown connection. 1723 */ 1724 tp = NULL; 1725 inp = NULL; 1726 #ifdef INET6 1727 in6p = NULL; 1728 #endif 1729 switch (so->so_proto->pr_domain->dom_family) { 1730 #ifdef INET 1731 case AF_INET: 1732 inp = sotoinpcb(so); 1733 tp = intotcpcb(inp); 1734 break; 1735 #endif 1736 #ifdef INET6 1737 case AF_INET6: 1738 in6p = sotoin6pcb(so); 1739 tp = in6totcpcb(in6p); 1740 break; 1741 #endif 1742 } 1743 if (tp == NULL) 1744 goto badsyn; /*XXX*/ 1745 tiwin <<= tp->snd_scale; 1746 goto after_listen; 1747 } 1748 } else { 1749 /* 1750 * None of RST, SYN or ACK was set. 1751 * This is an invalid packet for a 1752 * TCB in LISTEN state. Send a RST. 1753 */ 1754 goto badsyn; 1755 } 1756 } else { 1757 /* 1758 * Received a SYN. 1759 * 1760 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 1761 */ 1762 if (m->m_flags & (M_BCAST|M_MCAST)) 1763 goto drop; 1764 1765 switch (af) { 1766 #ifdef INET6 1767 case AF_INET6: 1768 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) 1769 goto drop; 1770 break; 1771 #endif /* INET6 */ 1772 case AF_INET: 1773 if (IN_MULTICAST(ip->ip_dst.s_addr) || 1774 in_broadcast(ip->ip_dst, 1775 m_get_rcvif_NOMPSAFE(m))) 1776 goto drop; 1777 break; 1778 } 1779 1780 #ifdef INET6 1781 /* 1782 * If deprecated address is forbidden, we do 1783 * not accept SYN to deprecated interface 1784 * address to prevent any new inbound 1785 * connection from getting established. 1786 * When we do not accept SYN, we send a TCP 1787 * RST, with deprecated source address (instead 1788 * of dropping it). We compromise it as it is 1789 * much better for peer to send a RST, and 1790 * RST will be the final packet for the 1791 * exchange. 1792 * 1793 * If we do not forbid deprecated addresses, we 1794 * accept the SYN packet. RFC2462 does not 1795 * suggest dropping SYN in this case. 1796 * If we decipher RFC2462 5.5.4, it says like 1797 * this: 1798 * 1. use of deprecated addr with existing 1799 * communication is okay - "SHOULD continue 1800 * to be used" 1801 * 2. use of it with new communication: 1802 * (2a) "SHOULD NOT be used if alternate 1803 * address with sufficient scope is 1804 * available" 1805 * (2b) nothing mentioned otherwise. 1806 * Here we fall into (2b) case as we have no 1807 * choice in our source address selection - we 1808 * must obey the peer. 1809 * 1810 * The wording in RFC2462 is confusing, and 1811 * there are multiple description text for 1812 * deprecated address handling - worse, they 1813 * are not exactly the same. I believe 5.5.4 1814 * is the best one, so we follow 5.5.4. 1815 */ 1816 if (af == AF_INET6 && !ip6_use_deprecated) { 1817 struct in6_ifaddr *ia6; 1818 int s; 1819 struct ifnet *rcvif = m_get_rcvif(m, &s); 1820 if (rcvif == NULL) 1821 goto dropwithreset; /* XXX */ 1822 if ((ia6 = in6ifa_ifpwithaddr(rcvif, 1823 &ip6->ip6_dst)) && 1824 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) { 1825 tp = NULL; 1826 m_put_rcvif(rcvif, &s); 1827 goto dropwithreset; 1828 } 1829 m_put_rcvif(rcvif, &s); 1830 } 1831 #endif 1832 1833 #if defined(IPSEC) 1834 if (ipsec_used) { 1835 switch (af) { 1836 #ifdef INET 1837 case AF_INET: 1838 if (!ipsec4_in_reject_so(m, so)) 1839 break; 1840 IPSEC_STATINC( 1841 IPSEC_STAT_IN_POLVIO); 1842 tp = NULL; 1843 goto dropwithreset; 1844 #endif 1845 #ifdef INET6 1846 case AF_INET6: 1847 if (!ipsec6_in_reject_so(m, so)) 1848 break; 1849 IPSEC6_STATINC( 1850 IPSEC_STAT_IN_POLVIO); 1851 tp = NULL; 1852 goto dropwithreset; 1853 #endif /*INET6*/ 1854 } 1855 } 1856 #endif /*IPSEC*/ 1857 1858 /* 1859 * LISTEN socket received a SYN 1860 * from itself? This can't possibly 1861 * be valid; drop the packet. 1862 */ 1863 if (th->th_sport == th->th_dport) { 1864 int i; 1865 1866 switch (af) { 1867 #ifdef INET 1868 case AF_INET: 1869 i = in_hosteq(ip->ip_src, ip->ip_dst); 1870 break; 1871 #endif 1872 #ifdef INET6 1873 case AF_INET6: 1874 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst); 1875 break; 1876 #endif 1877 default: 1878 i = 1; 1879 } 1880 if (i) { 1881 TCP_STATINC(TCP_STAT_BADSYN); 1882 goto drop; 1883 } 1884 } 1885 1886 /* 1887 * SYN looks ok; create compressed TCP 1888 * state for it. 1889 */ 1890 if (so->so_qlen <= so->so_qlimit && 1891 syn_cache_add(&src.sa, &dst.sa, th, tlen, 1892 so, m, optp, optlen, &opti)) 1893 m = NULL; 1894 } 1895 goto drop; 1896 } 1897 } 1898 1899 after_listen: 1900 #ifdef DIAGNOSTIC 1901 /* 1902 * Should not happen now that all embryonic connections 1903 * are handled with compressed state. 1904 */ 1905 if (tp->t_state == TCPS_LISTEN) 1906 panic("tcp_input: TCPS_LISTEN"); 1907 #endif 1908 1909 /* 1910 * Segment received on connection. 1911 * Reset idle time and keep-alive timer. 1912 */ 1913 tp->t_rcvtime = tcp_now; 1914 if (TCPS_HAVEESTABLISHED(tp->t_state)) 1915 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle); 1916 1917 /* 1918 * Process options. 1919 */ 1920 #ifdef TCP_SIGNATURE 1921 if (optp || (tp->t_flags & TF_SIGNATURE)) 1922 #else 1923 if (optp) 1924 #endif 1925 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0) 1926 goto drop; 1927 1928 if (TCP_SACK_ENABLED(tp)) { 1929 tcp_del_sackholes(tp, th); 1930 } 1931 1932 if (TCP_ECN_ALLOWED(tp)) { 1933 if (tiflags & TH_CWR) { 1934 tp->t_flags &= ~TF_ECN_SND_ECE; 1935 } 1936 switch (iptos & IPTOS_ECN_MASK) { 1937 case IPTOS_ECN_CE: 1938 tp->t_flags |= TF_ECN_SND_ECE; 1939 TCP_STATINC(TCP_STAT_ECN_CE); 1940 break; 1941 case IPTOS_ECN_ECT0: 1942 TCP_STATINC(TCP_STAT_ECN_ECT); 1943 break; 1944 case IPTOS_ECN_ECT1: 1945 /* XXX: ignore for now -- rpaulo */ 1946 break; 1947 } 1948 /* 1949 * Congestion experienced. 1950 * Ignore if we are already trying to recover. 1951 */ 1952 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover)) 1953 tp->t_congctl->cong_exp(tp); 1954 } 1955 1956 if (opti.ts_present && opti.ts_ecr) { 1957 /* 1958 * Calculate the RTT from the returned time stamp and the 1959 * connection's time base. If the time stamp is later than 1960 * the current time, or is extremely old, fall back to non-1323 1961 * RTT calculation. Since ts_rtt is unsigned, we can test both 1962 * at the same time. 1963 * 1964 * Note that ts_rtt is in units of slow ticks (500 1965 * ms). Since most earthbound RTTs are < 500 ms, 1966 * observed values will have large quantization noise. 1967 * Our smoothed RTT is then the fraction of observed 1968 * samples that are 1 tick instead of 0 (times 500 1969 * ms). 1970 * 1971 * ts_rtt is increased by 1 to denote a valid sample, 1972 * with 0 indicating an invalid measurement. This 1973 * extra 1 must be removed when ts_rtt is used, or 1974 * else an an erroneous extra 500 ms will result. 1975 */ 1976 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1; 1977 if (ts_rtt > TCP_PAWS_IDLE) 1978 ts_rtt = 0; 1979 } else { 1980 ts_rtt = 0; 1981 } 1982 1983 /* 1984 * Header prediction: check for the two common cases 1985 * of a uni-directional data xfer. If the packet has 1986 * no control flags, is in-sequence, the window didn't 1987 * change and we're not retransmitting, it's a 1988 * candidate. If the length is zero and the ack moved 1989 * forward, we're the sender side of the xfer. Just 1990 * free the data acked & wake any higher level process 1991 * that was blocked waiting for space. If the length 1992 * is non-zero and the ack didn't move, we're the 1993 * receiver side. If we're getting packets in-order 1994 * (the reassembly queue is empty), add the data to 1995 * the socket buffer and note that we need a delayed ack. 1996 */ 1997 if (tp->t_state == TCPS_ESTABLISHED && 1998 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK)) 1999 == TH_ACK && 2000 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 2001 th->th_seq == tp->rcv_nxt && 2002 tiwin && tiwin == tp->snd_wnd && 2003 tp->snd_nxt == tp->snd_max) { 2004 2005 /* 2006 * If last ACK falls within this segment's sequence numbers, 2007 * record the timestamp. 2008 * NOTE that the test is modified according to the latest 2009 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26). 2010 * 2011 * note that we already know 2012 * TSTMP_GEQ(opti.ts_val, tp->ts_recent) 2013 */ 2014 if (opti.ts_present && 2015 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 2016 tp->ts_recent_age = tcp_now; 2017 tp->ts_recent = opti.ts_val; 2018 } 2019 2020 if (tlen == 0) { 2021 /* Ack prediction. */ 2022 if (SEQ_GT(th->th_ack, tp->snd_una) && 2023 SEQ_LEQ(th->th_ack, tp->snd_max) && 2024 tp->snd_cwnd >= tp->snd_wnd && 2025 tp->t_partialacks < 0) { 2026 /* 2027 * this is a pure ack for outstanding data. 2028 */ 2029 if (ts_rtt) 2030 tcp_xmit_timer(tp, ts_rtt - 1); 2031 else if (tp->t_rtttime && 2032 SEQ_GT(th->th_ack, tp->t_rtseq)) 2033 tcp_xmit_timer(tp, 2034 tcp_now - tp->t_rtttime); 2035 acked = th->th_ack - tp->snd_una; 2036 tcps = TCP_STAT_GETREF(); 2037 tcps[TCP_STAT_PREDACK]++; 2038 tcps[TCP_STAT_RCVACKPACK]++; 2039 tcps[TCP_STAT_RCVACKBYTE] += acked; 2040 TCP_STAT_PUTREF(); 2041 nd6_hint(tp); 2042 2043 if (acked > (tp->t_lastoff - tp->t_inoff)) 2044 tp->t_lastm = NULL; 2045 sbdrop(&so->so_snd, acked); 2046 tp->t_lastoff -= acked; 2047 2048 icmp_check(tp, th, acked); 2049 2050 tp->snd_una = th->th_ack; 2051 tp->snd_fack = tp->snd_una; 2052 if (SEQ_LT(tp->snd_high, tp->snd_una)) 2053 tp->snd_high = tp->snd_una; 2054 m_freem(m); 2055 2056 /* 2057 * If all outstanding data are acked, stop 2058 * retransmit timer, otherwise restart timer 2059 * using current (possibly backed-off) value. 2060 * If process is waiting for space, 2061 * wakeup/selnotify/signal. If data 2062 * are ready to send, let tcp_output 2063 * decide between more output or persist. 2064 */ 2065 if (tp->snd_una == tp->snd_max) 2066 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2067 else if (TCP_TIMER_ISARMED(tp, 2068 TCPT_PERSIST) == 0) 2069 TCP_TIMER_ARM(tp, TCPT_REXMT, 2070 tp->t_rxtcur); 2071 2072 sowwakeup(so); 2073 if (so->so_snd.sb_cc) { 2074 KERNEL_LOCK(1, NULL); 2075 (void) tcp_output(tp); 2076 KERNEL_UNLOCK_ONE(NULL); 2077 } 2078 if (tcp_saveti) 2079 m_freem(tcp_saveti); 2080 return; 2081 } 2082 } else if (th->th_ack == tp->snd_una && 2083 TAILQ_FIRST(&tp->segq) == NULL && 2084 tlen <= sbspace(&so->so_rcv)) { 2085 int newsize = 0; /* automatic sockbuf scaling */ 2086 2087 /* 2088 * this is a pure, in-sequence data packet 2089 * with nothing on the reassembly queue and 2090 * we have enough buffer space to take it. 2091 */ 2092 tp->rcv_nxt += tlen; 2093 tcps = TCP_STAT_GETREF(); 2094 tcps[TCP_STAT_PREDDAT]++; 2095 tcps[TCP_STAT_RCVPACK]++; 2096 tcps[TCP_STAT_RCVBYTE] += tlen; 2097 TCP_STAT_PUTREF(); 2098 nd6_hint(tp); 2099 2100 /* 2101 * Automatic sizing enables the performance of large buffers 2102 * and most of the efficiency of small ones by only allocating 2103 * space when it is needed. 2104 * 2105 * On the receive side the socket buffer memory is only rarely 2106 * used to any significant extent. This allows us to be much 2107 * more aggressive in scaling the receive socket buffer. For 2108 * the case that the buffer space is actually used to a large 2109 * extent and we run out of kernel memory we can simply drop 2110 * the new segments; TCP on the sender will just retransmit it 2111 * later. Setting the buffer size too big may only consume too 2112 * much kernel memory if the application doesn't read() from 2113 * the socket or packet loss or reordering makes use of the 2114 * reassembly queue. 2115 * 2116 * The criteria to step up the receive buffer one notch are: 2117 * 1. the number of bytes received during the time it takes 2118 * one timestamp to be reflected back to us (the RTT); 2119 * 2. received bytes per RTT is within seven eighth of the 2120 * current socket buffer size; 2121 * 3. receive buffer size has not hit maximal automatic size; 2122 * 2123 * This algorithm does one step per RTT at most and only if 2124 * we receive a bulk stream w/o packet losses or reorderings. 2125 * Shrinking the buffer during idle times is not necessary as 2126 * it doesn't consume any memory when idle. 2127 * 2128 * TODO: Only step up if the application is actually serving 2129 * the buffer to better manage the socket buffer resources. 2130 */ 2131 if (tcp_do_autorcvbuf && 2132 opti.ts_ecr && 2133 (so->so_rcv.sb_flags & SB_AUTOSIZE)) { 2134 if (opti.ts_ecr > tp->rfbuf_ts && 2135 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) { 2136 if (tp->rfbuf_cnt > 2137 (so->so_rcv.sb_hiwat / 8 * 7) && 2138 so->so_rcv.sb_hiwat < 2139 tcp_autorcvbuf_max) { 2140 newsize = 2141 min(so->so_rcv.sb_hiwat + 2142 tcp_autorcvbuf_inc, 2143 tcp_autorcvbuf_max); 2144 } 2145 /* Start over with next RTT. */ 2146 tp->rfbuf_ts = 0; 2147 tp->rfbuf_cnt = 0; 2148 } else 2149 tp->rfbuf_cnt += tlen; /* add up */ 2150 } 2151 2152 /* 2153 * Drop TCP, IP headers and TCP options then add data 2154 * to socket buffer. 2155 */ 2156 if (so->so_state & SS_CANTRCVMORE) 2157 m_freem(m); 2158 else { 2159 /* 2160 * Set new socket buffer size. 2161 * Give up when limit is reached. 2162 */ 2163 if (newsize) 2164 if (!sbreserve(&so->so_rcv, 2165 newsize, so)) 2166 so->so_rcv.sb_flags &= ~SB_AUTOSIZE; 2167 m_adj(m, toff + off); 2168 sbappendstream(&so->so_rcv, m); 2169 } 2170 sorwakeup(so); 2171 tcp_setup_ack(tp, th); 2172 if (tp->t_flags & TF_ACKNOW) { 2173 KERNEL_LOCK(1, NULL); 2174 (void) tcp_output(tp); 2175 KERNEL_UNLOCK_ONE(NULL); 2176 } 2177 if (tcp_saveti) 2178 m_freem(tcp_saveti); 2179 return; 2180 } 2181 } 2182 2183 /* 2184 * Compute mbuf offset to TCP data segment. 2185 */ 2186 hdroptlen = toff + off; 2187 2188 /* 2189 * Calculate amount of space in receive window, 2190 * and then do TCP input processing. 2191 * Receive window is amount of space in rcv queue, 2192 * but not less than advertised window. 2193 */ 2194 { int win; 2195 2196 win = sbspace(&so->so_rcv); 2197 if (win < 0) 2198 win = 0; 2199 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 2200 } 2201 2202 /* Reset receive buffer auto scaling when not in bulk receive mode. */ 2203 tp->rfbuf_ts = 0; 2204 tp->rfbuf_cnt = 0; 2205 2206 switch (tp->t_state) { 2207 /* 2208 * If the state is SYN_SENT: 2209 * if seg contains an ACK, but not for our SYN, drop the input. 2210 * if seg contains a RST, then drop the connection. 2211 * if seg does not contain SYN, then drop it. 2212 * Otherwise this is an acceptable SYN segment 2213 * initialize tp->rcv_nxt and tp->irs 2214 * if seg contains ack then advance tp->snd_una 2215 * if seg contains a ECE and ECN support is enabled, the stream 2216 * is ECN capable. 2217 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 2218 * arrange for segment to be acked (eventually) 2219 * continue processing rest of data/controls, beginning with URG 2220 */ 2221 case TCPS_SYN_SENT: 2222 if ((tiflags & TH_ACK) && 2223 (SEQ_LEQ(th->th_ack, tp->iss) || 2224 SEQ_GT(th->th_ack, tp->snd_max))) 2225 goto dropwithreset; 2226 if (tiflags & TH_RST) { 2227 if (tiflags & TH_ACK) 2228 tp = tcp_drop(tp, ECONNREFUSED); 2229 goto drop; 2230 } 2231 if ((tiflags & TH_SYN) == 0) 2232 goto drop; 2233 if (tiflags & TH_ACK) { 2234 tp->snd_una = th->th_ack; 2235 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 2236 tp->snd_nxt = tp->snd_una; 2237 if (SEQ_LT(tp->snd_high, tp->snd_una)) 2238 tp->snd_high = tp->snd_una; 2239 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2240 2241 if ((tiflags & TH_ECE) && tcp_do_ecn) { 2242 tp->t_flags |= TF_ECN_PERMIT; 2243 TCP_STATINC(TCP_STAT_ECN_SHS); 2244 } 2245 2246 } 2247 tp->irs = th->th_seq; 2248 tcp_rcvseqinit(tp); 2249 tp->t_flags |= TF_ACKNOW; 2250 tcp_mss_from_peer(tp, opti.maxseg); 2251 2252 /* 2253 * Initialize the initial congestion window. If we 2254 * had to retransmit the SYN, we must initialize cwnd 2255 * to 1 segment (i.e. the Loss Window). 2256 */ 2257 if (tp->t_flags & TF_SYN_REXMT) 2258 tp->snd_cwnd = tp->t_peermss; 2259 else { 2260 int ss = tcp_init_win; 2261 #ifdef INET 2262 if (inp != NULL && in_localaddr(inp->inp_faddr)) 2263 ss = tcp_init_win_local; 2264 #endif 2265 #ifdef INET6 2266 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr)) 2267 ss = tcp_init_win_local; 2268 #endif 2269 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss); 2270 } 2271 2272 tcp_rmx_rtt(tp); 2273 if (tiflags & TH_ACK) { 2274 TCP_STATINC(TCP_STAT_CONNECTS); 2275 /* 2276 * move tcp_established before soisconnected 2277 * because upcall handler can drive tcp_output 2278 * functionality. 2279 * XXX we might call soisconnected at the end of 2280 * all processing 2281 */ 2282 tcp_established(tp); 2283 soisconnected(so); 2284 /* Do window scaling on this connection? */ 2285 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 2286 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 2287 tp->snd_scale = tp->requested_s_scale; 2288 tp->rcv_scale = tp->request_r_scale; 2289 } 2290 TCP_REASS_LOCK(tp); 2291 (void) tcp_reass(tp, NULL, NULL, &tlen); 2292 /* 2293 * if we didn't have to retransmit the SYN, 2294 * use its rtt as our initial srtt & rtt var. 2295 */ 2296 if (tp->t_rtttime) 2297 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 2298 } else 2299 tp->t_state = TCPS_SYN_RECEIVED; 2300 2301 /* 2302 * Advance th->th_seq to correspond to first data byte. 2303 * If data, trim to stay within window, 2304 * dropping FIN if necessary. 2305 */ 2306 th->th_seq++; 2307 if (tlen > tp->rcv_wnd) { 2308 todrop = tlen - tp->rcv_wnd; 2309 m_adj(m, -todrop); 2310 tlen = tp->rcv_wnd; 2311 tiflags &= ~TH_FIN; 2312 tcps = TCP_STAT_GETREF(); 2313 tcps[TCP_STAT_RCVPACKAFTERWIN]++; 2314 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop; 2315 TCP_STAT_PUTREF(); 2316 } 2317 tp->snd_wl1 = th->th_seq - 1; 2318 tp->rcv_up = th->th_seq; 2319 goto step6; 2320 2321 /* 2322 * If the state is SYN_RECEIVED: 2323 * If seg contains an ACK, but not for our SYN, drop the input 2324 * and generate an RST. See page 36, rfc793 2325 */ 2326 case TCPS_SYN_RECEIVED: 2327 if ((tiflags & TH_ACK) && 2328 (SEQ_LEQ(th->th_ack, tp->iss) || 2329 SEQ_GT(th->th_ack, tp->snd_max))) 2330 goto dropwithreset; 2331 break; 2332 } 2333 2334 /* 2335 * States other than LISTEN or SYN_SENT. 2336 * First check timestamp, if present. 2337 * Then check that at least some bytes of segment are within 2338 * receive window. If segment begins before rcv_nxt, 2339 * drop leading data (and SYN); if nothing left, just ack. 2340 * 2341 * RFC 1323 PAWS: If we have a timestamp reply on this segment 2342 * and it's less than ts_recent, drop it. 2343 */ 2344 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 2345 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 2346 2347 /* Check to see if ts_recent is over 24 days old. */ 2348 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) { 2349 /* 2350 * Invalidate ts_recent. If this segment updates 2351 * ts_recent, the age will be reset later and ts_recent 2352 * will get a valid value. If it does not, setting 2353 * ts_recent to zero will at least satisfy the 2354 * requirement that zero be placed in the timestamp 2355 * echo reply when ts_recent isn't valid. The 2356 * age isn't reset until we get a valid ts_recent 2357 * because we don't want out-of-order segments to be 2358 * dropped when ts_recent is old. 2359 */ 2360 tp->ts_recent = 0; 2361 } else { 2362 tcps = TCP_STAT_GETREF(); 2363 tcps[TCP_STAT_RCVDUPPACK]++; 2364 tcps[TCP_STAT_RCVDUPBYTE] += tlen; 2365 tcps[TCP_STAT_PAWSDROP]++; 2366 TCP_STAT_PUTREF(); 2367 tcp_new_dsack(tp, th->th_seq, tlen); 2368 goto dropafterack; 2369 } 2370 } 2371 2372 todrop = tp->rcv_nxt - th->th_seq; 2373 dupseg = false; 2374 if (todrop > 0) { 2375 if (tiflags & TH_SYN) { 2376 tiflags &= ~TH_SYN; 2377 th->th_seq++; 2378 if (th->th_urp > 1) 2379 th->th_urp--; 2380 else { 2381 tiflags &= ~TH_URG; 2382 th->th_urp = 0; 2383 } 2384 todrop--; 2385 } 2386 if (todrop > tlen || 2387 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 2388 /* 2389 * Any valid FIN or RST must be to the left of the 2390 * window. At this point the FIN or RST must be a 2391 * duplicate or out of sequence; drop it. 2392 */ 2393 if (tiflags & TH_RST) 2394 goto drop; 2395 tiflags &= ~(TH_FIN|TH_RST); 2396 /* 2397 * Send an ACK to resynchronize and drop any data. 2398 * But keep on processing for RST or ACK. 2399 */ 2400 tp->t_flags |= TF_ACKNOW; 2401 todrop = tlen; 2402 dupseg = true; 2403 tcps = TCP_STAT_GETREF(); 2404 tcps[TCP_STAT_RCVDUPPACK]++; 2405 tcps[TCP_STAT_RCVDUPBYTE] += todrop; 2406 TCP_STAT_PUTREF(); 2407 } else if ((tiflags & TH_RST) && 2408 th->th_seq != tp->rcv_nxt) { 2409 /* 2410 * Test for reset before adjusting the sequence 2411 * number for overlapping data. 2412 */ 2413 goto dropafterack_ratelim; 2414 } else { 2415 tcps = TCP_STAT_GETREF(); 2416 tcps[TCP_STAT_RCVPARTDUPPACK]++; 2417 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop; 2418 TCP_STAT_PUTREF(); 2419 } 2420 tcp_new_dsack(tp, th->th_seq, todrop); 2421 hdroptlen += todrop; /*drop from head afterwards*/ 2422 th->th_seq += todrop; 2423 tlen -= todrop; 2424 if (th->th_urp > todrop) 2425 th->th_urp -= todrop; 2426 else { 2427 tiflags &= ~TH_URG; 2428 th->th_urp = 0; 2429 } 2430 } 2431 2432 /* 2433 * If new data are received on a connection after the 2434 * user processes are gone, then RST the other end. 2435 */ 2436 if ((so->so_state & SS_NOFDREF) && 2437 tp->t_state > TCPS_CLOSE_WAIT && tlen) { 2438 tp = tcp_close(tp); 2439 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE); 2440 goto dropwithreset; 2441 } 2442 2443 /* 2444 * If segment ends after window, drop trailing data 2445 * (and PUSH and FIN); if nothing left, just ACK. 2446 */ 2447 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd); 2448 if (todrop > 0) { 2449 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN); 2450 if (todrop >= tlen) { 2451 /* 2452 * The segment actually starts after the window. 2453 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen 2454 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0 2455 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd 2456 */ 2457 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen); 2458 /* 2459 * If a new connection request is received 2460 * while in TIME_WAIT, drop the old connection 2461 * and start over if the sequence numbers 2462 * are above the previous ones. 2463 * 2464 * NOTE: We will checksum the packet again, and 2465 * so we need to put the header fields back into 2466 * network order! 2467 * XXX This kind of sucks, but we don't expect 2468 * XXX this to happen very often, so maybe it 2469 * XXX doesn't matter so much. 2470 */ 2471 if (tiflags & TH_SYN && 2472 tp->t_state == TCPS_TIME_WAIT && 2473 SEQ_GT(th->th_seq, tp->rcv_nxt)) { 2474 tp = tcp_close(tp); 2475 tcp_fields_to_net(th); 2476 goto findpcb; 2477 } 2478 /* 2479 * If window is closed can only take segments at 2480 * window edge, and have to drop data and PUSH from 2481 * incoming segments. Continue processing, but 2482 * remember to ack. Otherwise, drop segment 2483 * and (if not RST) ack. 2484 */ 2485 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 2486 tp->t_flags |= TF_ACKNOW; 2487 TCP_STATINC(TCP_STAT_RCVWINPROBE); 2488 } else 2489 goto dropafterack; 2490 } else 2491 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop); 2492 m_adj(m, -todrop); 2493 tlen -= todrop; 2494 tiflags &= ~(TH_PUSH|TH_FIN); 2495 } 2496 2497 /* 2498 * If last ACK falls within this segment's sequence numbers, 2499 * record the timestamp. 2500 * NOTE: 2501 * 1) That the test incorporates suggestions from the latest 2502 * proposal of the tcplw (at) cray.com list (Braden 1993/04/26). 2503 * 2) That updating only on newer timestamps interferes with 2504 * our earlier PAWS tests, so this check should be solely 2505 * predicated on the sequence space of this segment. 2506 * 3) That we modify the segment boundary check to be 2507 * Last.ACK.Sent <= SEG.SEQ + SEG.Len 2508 * instead of RFC1323's 2509 * Last.ACK.Sent < SEG.SEQ + SEG.Len, 2510 * This modified check allows us to overcome RFC1323's 2511 * limitations as described in Stevens TCP/IP Illustrated 2512 * Vol. 2 p.869. In such cases, we can still calculate the 2513 * RTT correctly when RCV.NXT == Last.ACK.Sent. 2514 */ 2515 if (opti.ts_present && 2516 SEQ_LEQ(th->th_seq, tp->last_ack_sent) && 2517 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen + 2518 ((tiflags & (TH_SYN|TH_FIN)) != 0))) { 2519 tp->ts_recent_age = tcp_now; 2520 tp->ts_recent = opti.ts_val; 2521 } 2522 2523 /* 2524 * If the RST bit is set examine the state: 2525 * SYN_RECEIVED STATE: 2526 * If passive open, return to LISTEN state. 2527 * If active open, inform user that connection was refused. 2528 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 2529 * Inform user that connection was reset, and close tcb. 2530 * CLOSING, LAST_ACK, TIME_WAIT STATES 2531 * Close the tcb. 2532 */ 2533 if (tiflags & TH_RST) { 2534 if (th->th_seq != tp->rcv_nxt) 2535 goto dropafterack_ratelim; 2536 2537 switch (tp->t_state) { 2538 case TCPS_SYN_RECEIVED: 2539 so->so_error = ECONNREFUSED; 2540 goto close; 2541 2542 case TCPS_ESTABLISHED: 2543 case TCPS_FIN_WAIT_1: 2544 case TCPS_FIN_WAIT_2: 2545 case TCPS_CLOSE_WAIT: 2546 so->so_error = ECONNRESET; 2547 close: 2548 tp->t_state = TCPS_CLOSED; 2549 TCP_STATINC(TCP_STAT_DROPS); 2550 tp = tcp_close(tp); 2551 goto drop; 2552 2553 case TCPS_CLOSING: 2554 case TCPS_LAST_ACK: 2555 case TCPS_TIME_WAIT: 2556 tp = tcp_close(tp); 2557 goto drop; 2558 } 2559 } 2560 2561 /* 2562 * Since we've covered the SYN-SENT and SYN-RECEIVED states above 2563 * we must be in a synchronized state. RFC791 states (under RST 2564 * generation) that any unacceptable segment (an out-of-order SYN 2565 * qualifies) received in a synchronized state must elicit only an 2566 * empty acknowledgment segment ... and the connection remains in 2567 * the same state. 2568 */ 2569 if (tiflags & TH_SYN) { 2570 if (tp->rcv_nxt == th->th_seq) { 2571 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1, 2572 TH_ACK); 2573 if (tcp_saveti) 2574 m_freem(tcp_saveti); 2575 return; 2576 } 2577 2578 goto dropafterack_ratelim; 2579 } 2580 2581 /* 2582 * If the ACK bit is off we drop the segment and return. 2583 */ 2584 if ((tiflags & TH_ACK) == 0) { 2585 if (tp->t_flags & TF_ACKNOW) 2586 goto dropafterack; 2587 else 2588 goto drop; 2589 } 2590 2591 /* 2592 * Ack processing. 2593 */ 2594 switch (tp->t_state) { 2595 2596 /* 2597 * In SYN_RECEIVED state if the ack ACKs our SYN then enter 2598 * ESTABLISHED state and continue processing, otherwise 2599 * send an RST. 2600 */ 2601 case TCPS_SYN_RECEIVED: 2602 if (SEQ_GT(tp->snd_una, th->th_ack) || 2603 SEQ_GT(th->th_ack, tp->snd_max)) 2604 goto dropwithreset; 2605 TCP_STATINC(TCP_STAT_CONNECTS); 2606 soisconnected(so); 2607 tcp_established(tp); 2608 /* Do window scaling? */ 2609 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 2610 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 2611 tp->snd_scale = tp->requested_s_scale; 2612 tp->rcv_scale = tp->request_r_scale; 2613 } 2614 TCP_REASS_LOCK(tp); 2615 (void) tcp_reass(tp, NULL, NULL, &tlen); 2616 tp->snd_wl1 = th->th_seq - 1; 2617 /* fall into ... */ 2618 2619 /* 2620 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 2621 * ACKs. If the ack is in the range 2622 * tp->snd_una < th->th_ack <= tp->snd_max 2623 * then advance tp->snd_una to th->th_ack and drop 2624 * data from the retransmission queue. If this ACK reflects 2625 * more up to date window information we update our window information. 2626 */ 2627 case TCPS_ESTABLISHED: 2628 case TCPS_FIN_WAIT_1: 2629 case TCPS_FIN_WAIT_2: 2630 case TCPS_CLOSE_WAIT: 2631 case TCPS_CLOSING: 2632 case TCPS_LAST_ACK: 2633 case TCPS_TIME_WAIT: 2634 2635 if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 2636 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) { 2637 TCP_STATINC(TCP_STAT_RCVDUPACK); 2638 /* 2639 * If we have outstanding data (other than 2640 * a window probe), this is a completely 2641 * duplicate ack (ie, window info didn't 2642 * change), the ack is the biggest we've 2643 * seen and we've seen exactly our rexmt 2644 * threshhold of them, assume a packet 2645 * has been dropped and retransmit it. 2646 * Kludge snd_nxt & the congestion 2647 * window so we send only this one 2648 * packet. 2649 */ 2650 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 || 2651 th->th_ack != tp->snd_una) 2652 tp->t_dupacks = 0; 2653 else if (tp->t_partialacks < 0 && 2654 (++tp->t_dupacks == tcprexmtthresh || 2655 TCP_FACK_FASTRECOV(tp))) { 2656 /* 2657 * Do the fast retransmit, and adjust 2658 * congestion control paramenters. 2659 */ 2660 if (tp->t_congctl->fast_retransmit(tp, th)) { 2661 /* False fast retransmit */ 2662 break; 2663 } else 2664 goto drop; 2665 } else if (tp->t_dupacks > tcprexmtthresh) { 2666 tp->snd_cwnd += tp->t_segsz; 2667 KERNEL_LOCK(1, NULL); 2668 (void) tcp_output(tp); 2669 KERNEL_UNLOCK_ONE(NULL); 2670 goto drop; 2671 } 2672 } else { 2673 /* 2674 * If the ack appears to be very old, only 2675 * allow data that is in-sequence. This 2676 * makes it somewhat more difficult to insert 2677 * forged data by guessing sequence numbers. 2678 * Sent an ack to try to update the send 2679 * sequence number on the other side. 2680 */ 2681 if (tlen && th->th_seq != tp->rcv_nxt && 2682 SEQ_LT(th->th_ack, 2683 tp->snd_una - tp->max_sndwnd)) 2684 goto dropafterack; 2685 } 2686 break; 2687 } 2688 /* 2689 * If the congestion window was inflated to account 2690 * for the other side's cached packets, retract it. 2691 */ 2692 tp->t_congctl->fast_retransmit_newack(tp, th); 2693 2694 if (SEQ_GT(th->th_ack, tp->snd_max)) { 2695 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH); 2696 goto dropafterack; 2697 } 2698 acked = th->th_ack - tp->snd_una; 2699 tcps = TCP_STAT_GETREF(); 2700 tcps[TCP_STAT_RCVACKPACK]++; 2701 tcps[TCP_STAT_RCVACKBYTE] += acked; 2702 TCP_STAT_PUTREF(); 2703 2704 /* 2705 * If we have a timestamp reply, update smoothed 2706 * round trip time. If no timestamp is present but 2707 * transmit timer is running and timed sequence 2708 * number was acked, update smoothed round trip time. 2709 * Since we now have an rtt measurement, cancel the 2710 * timer backoff (cf., Phil Karn's retransmit alg.). 2711 * Recompute the initial retransmit timer. 2712 */ 2713 if (ts_rtt) 2714 tcp_xmit_timer(tp, ts_rtt - 1); 2715 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) 2716 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 2717 2718 /* 2719 * If all outstanding data is acked, stop retransmit 2720 * timer and remember to restart (more output or persist). 2721 * If there is more data to be acked, restart retransmit 2722 * timer, using current (possibly backed-off) value. 2723 */ 2724 if (th->th_ack == tp->snd_max) { 2725 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2726 needoutput = 1; 2727 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 2728 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 2729 2730 /* 2731 * New data has been acked, adjust the congestion window. 2732 */ 2733 tp->t_congctl->newack(tp, th); 2734 2735 nd6_hint(tp); 2736 if (acked > so->so_snd.sb_cc) { 2737 tp->snd_wnd -= so->so_snd.sb_cc; 2738 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 2739 ourfinisacked = 1; 2740 } else { 2741 if (acked > (tp->t_lastoff - tp->t_inoff)) 2742 tp->t_lastm = NULL; 2743 sbdrop(&so->so_snd, acked); 2744 tp->t_lastoff -= acked; 2745 if (tp->snd_wnd > acked) 2746 tp->snd_wnd -= acked; 2747 else 2748 tp->snd_wnd = 0; 2749 ourfinisacked = 0; 2750 } 2751 sowwakeup(so); 2752 2753 icmp_check(tp, th, acked); 2754 2755 tp->snd_una = th->th_ack; 2756 if (SEQ_GT(tp->snd_una, tp->snd_fack)) 2757 tp->snd_fack = tp->snd_una; 2758 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 2759 tp->snd_nxt = tp->snd_una; 2760 if (SEQ_LT(tp->snd_high, tp->snd_una)) 2761 tp->snd_high = tp->snd_una; 2762 2763 switch (tp->t_state) { 2764 2765 /* 2766 * In FIN_WAIT_1 STATE in addition to the processing 2767 * for the ESTABLISHED state if our FIN is now acknowledged 2768 * then enter FIN_WAIT_2. 2769 */ 2770 case TCPS_FIN_WAIT_1: 2771 if (ourfinisacked) { 2772 /* 2773 * If we can't receive any more 2774 * data, then closing user can proceed. 2775 * Starting the timer is contrary to the 2776 * specification, but if we don't get a FIN 2777 * we'll hang forever. 2778 */ 2779 if (so->so_state & SS_CANTRCVMORE) { 2780 soisdisconnected(so); 2781 if (tp->t_maxidle > 0) 2782 TCP_TIMER_ARM(tp, TCPT_2MSL, 2783 tp->t_maxidle); 2784 } 2785 tp->t_state = TCPS_FIN_WAIT_2; 2786 } 2787 break; 2788 2789 /* 2790 * In CLOSING STATE in addition to the processing for 2791 * the ESTABLISHED state if the ACK acknowledges our FIN 2792 * then enter the TIME-WAIT state, otherwise ignore 2793 * the segment. 2794 */ 2795 case TCPS_CLOSING: 2796 if (ourfinisacked) { 2797 tp->t_state = TCPS_TIME_WAIT; 2798 tcp_canceltimers(tp); 2799 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl); 2800 soisdisconnected(so); 2801 } 2802 break; 2803 2804 /* 2805 * In LAST_ACK, we may still be waiting for data to drain 2806 * and/or to be acked, as well as for the ack of our FIN. 2807 * If our FIN is now acknowledged, delete the TCB, 2808 * enter the closed state and return. 2809 */ 2810 case TCPS_LAST_ACK: 2811 if (ourfinisacked) { 2812 tp = tcp_close(tp); 2813 goto drop; 2814 } 2815 break; 2816 2817 /* 2818 * In TIME_WAIT state the only thing that should arrive 2819 * is a retransmission of the remote FIN. Acknowledge 2820 * it and restart the finack timer. 2821 */ 2822 case TCPS_TIME_WAIT: 2823 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl); 2824 goto dropafterack; 2825 } 2826 } 2827 2828 step6: 2829 /* 2830 * Update window information. 2831 * Don't look at window if no ACK: TAC's send garbage on first SYN. 2832 */ 2833 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) || 2834 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) || 2835 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 2836 /* keep track of pure window updates */ 2837 if (tlen == 0 && 2838 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 2839 TCP_STATINC(TCP_STAT_RCVWINUPD); 2840 tp->snd_wnd = tiwin; 2841 tp->snd_wl1 = th->th_seq; 2842 tp->snd_wl2 = th->th_ack; 2843 if (tp->snd_wnd > tp->max_sndwnd) 2844 tp->max_sndwnd = tp->snd_wnd; 2845 needoutput = 1; 2846 } 2847 2848 /* 2849 * Process segments with URG. 2850 */ 2851 if ((tiflags & TH_URG) && th->th_urp && 2852 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2853 /* 2854 * This is a kludge, but if we receive and accept 2855 * random urgent pointers, we'll crash in 2856 * soreceive. It's hard to imagine someone 2857 * actually wanting to send this much urgent data. 2858 */ 2859 if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 2860 th->th_urp = 0; /* XXX */ 2861 tiflags &= ~TH_URG; /* XXX */ 2862 goto dodata; /* XXX */ 2863 } 2864 /* 2865 * If this segment advances the known urgent pointer, 2866 * then mark the data stream. This should not happen 2867 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 2868 * a FIN has been received from the remote side. 2869 * In these states we ignore the URG. 2870 * 2871 * According to RFC961 (Assigned Protocols), 2872 * the urgent pointer points to the last octet 2873 * of urgent data. We continue, however, 2874 * to consider it to indicate the first octet 2875 * of data past the urgent section as the original 2876 * spec states (in one of two places). 2877 */ 2878 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 2879 tp->rcv_up = th->th_seq + th->th_urp; 2880 so->so_oobmark = so->so_rcv.sb_cc + 2881 (tp->rcv_up - tp->rcv_nxt) - 1; 2882 if (so->so_oobmark == 0) 2883 so->so_state |= SS_RCVATMARK; 2884 sohasoutofband(so); 2885 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 2886 } 2887 /* 2888 * Remove out of band data so doesn't get presented to user. 2889 * This can happen independent of advancing the URG pointer, 2890 * but if two URG's are pending at once, some out-of-band 2891 * data may creep in... ick. 2892 */ 2893 if (th->th_urp <= (u_int16_t) tlen 2894 #ifdef SO_OOBINLINE 2895 && (so->so_options & SO_OOBINLINE) == 0 2896 #endif 2897 ) 2898 tcp_pulloutofband(so, th, m, hdroptlen); 2899 } else 2900 /* 2901 * If no out of band data is expected, 2902 * pull receive urgent pointer along 2903 * with the receive window. 2904 */ 2905 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 2906 tp->rcv_up = tp->rcv_nxt; 2907 dodata: /* XXX */ 2908 2909 /* 2910 * Process the segment text, merging it into the TCP sequencing queue, 2911 * and arranging for acknowledgement of receipt if necessary. 2912 * This process logically involves adjusting tp->rcv_wnd as data 2913 * is presented to the user (this happens in tcp_usrreq.c, 2914 * tcp_rcvd()). If a FIN has already been received on this 2915 * connection then we just ignore the text. 2916 */ 2917 if ((tlen || (tiflags & TH_FIN)) && 2918 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2919 /* 2920 * Insert segment ti into reassembly queue of tcp with 2921 * control block tp. Return TH_FIN if reassembly now includes 2922 * a segment with FIN. The macro form does the common case 2923 * inline (segment is the next to be received on an 2924 * established connection, and the queue is empty), 2925 * avoiding linkage into and removal from the queue and 2926 * repetition of various conversions. 2927 * Set DELACK for segments received in order, but ack 2928 * immediately when segments are out of order 2929 * (so fast retransmit can work). 2930 */ 2931 /* NOTE: this was TCP_REASS() macro, but used only once */ 2932 TCP_REASS_LOCK(tp); 2933 if (th->th_seq == tp->rcv_nxt && 2934 TAILQ_FIRST(&tp->segq) == NULL && 2935 tp->t_state == TCPS_ESTABLISHED) { 2936 tcp_setup_ack(tp, th); 2937 tp->rcv_nxt += tlen; 2938 tiflags = th->th_flags & TH_FIN; 2939 tcps = TCP_STAT_GETREF(); 2940 tcps[TCP_STAT_RCVPACK]++; 2941 tcps[TCP_STAT_RCVBYTE] += tlen; 2942 TCP_STAT_PUTREF(); 2943 nd6_hint(tp); 2944 if (so->so_state & SS_CANTRCVMORE) 2945 m_freem(m); 2946 else { 2947 m_adj(m, hdroptlen); 2948 sbappendstream(&(so)->so_rcv, m); 2949 } 2950 TCP_REASS_UNLOCK(tp); 2951 sorwakeup(so); 2952 } else { 2953 m_adj(m, hdroptlen); 2954 tiflags = tcp_reass(tp, th, m, &tlen); 2955 tp->t_flags |= TF_ACKNOW; 2956 } 2957 2958 /* 2959 * Note the amount of data that peer has sent into 2960 * our window, in order to estimate the sender's 2961 * buffer size. 2962 */ 2963 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 2964 } else { 2965 m_freem(m); 2966 m = NULL; 2967 tiflags &= ~TH_FIN; 2968 } 2969 2970 /* 2971 * If FIN is received ACK the FIN and let the user know 2972 * that the connection is closing. Ignore a FIN received before 2973 * the connection is fully established. 2974 */ 2975 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 2976 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2977 socantrcvmore(so); 2978 tp->t_flags |= TF_ACKNOW; 2979 tp->rcv_nxt++; 2980 } 2981 switch (tp->t_state) { 2982 2983 /* 2984 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 2985 */ 2986 case TCPS_ESTABLISHED: 2987 tp->t_state = TCPS_CLOSE_WAIT; 2988 break; 2989 2990 /* 2991 * If still in FIN_WAIT_1 STATE FIN has not been acked so 2992 * enter the CLOSING state. 2993 */ 2994 case TCPS_FIN_WAIT_1: 2995 tp->t_state = TCPS_CLOSING; 2996 break; 2997 2998 /* 2999 * In FIN_WAIT_2 state enter the TIME_WAIT state, 3000 * starting the time-wait timer, turning off the other 3001 * standard timers. 3002 */ 3003 case TCPS_FIN_WAIT_2: 3004 tp->t_state = TCPS_TIME_WAIT; 3005 tcp_canceltimers(tp); 3006 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl); 3007 soisdisconnected(so); 3008 break; 3009 3010 /* 3011 * In TIME_WAIT state restart the 2 MSL time_wait timer. 3012 */ 3013 case TCPS_TIME_WAIT: 3014 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl); 3015 break; 3016 } 3017 } 3018 #ifdef TCP_DEBUG 3019 if (so->so_options & SO_DEBUG) 3020 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0); 3021 #endif 3022 3023 /* 3024 * Return any desired output. 3025 */ 3026 if (needoutput || (tp->t_flags & TF_ACKNOW)) { 3027 KERNEL_LOCK(1, NULL); 3028 (void) tcp_output(tp); 3029 KERNEL_UNLOCK_ONE(NULL); 3030 } 3031 if (tcp_saveti) 3032 m_freem(tcp_saveti); 3033 3034 if (tp->t_state == TCPS_TIME_WAIT 3035 && (so->so_state & SS_NOFDREF) 3036 && (tp->t_inpcb || af != AF_INET) 3037 && (tp->t_in6pcb || af != AF_INET6) 3038 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0 3039 && TAILQ_EMPTY(&tp->segq) 3040 && vtw_add(af, tp)) { 3041 ; 3042 } 3043 return; 3044 3045 badsyn: 3046 /* 3047 * Received a bad SYN. Increment counters and dropwithreset. 3048 */ 3049 TCP_STATINC(TCP_STAT_BADSYN); 3050 tp = NULL; 3051 goto dropwithreset; 3052 3053 dropafterack: 3054 /* 3055 * Generate an ACK dropping incoming segment if it occupies 3056 * sequence space, where the ACK reflects our state. 3057 */ 3058 if (tiflags & TH_RST) 3059 goto drop; 3060 goto dropafterack2; 3061 3062 dropafterack_ratelim: 3063 /* 3064 * We may want to rate-limit ACKs against SYN/RST attack. 3065 */ 3066 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count, 3067 tcp_ackdrop_ppslim) == 0) { 3068 /* XXX stat */ 3069 goto drop; 3070 } 3071 /* ...fall into dropafterack2... */ 3072 3073 dropafterack2: 3074 m_freem(m); 3075 tp->t_flags |= TF_ACKNOW; 3076 KERNEL_LOCK(1, NULL); 3077 (void) tcp_output(tp); 3078 KERNEL_UNLOCK_ONE(NULL); 3079 if (tcp_saveti) 3080 m_freem(tcp_saveti); 3081 return; 3082 3083 dropwithreset_ratelim: 3084 /* 3085 * We may want to rate-limit RSTs in certain situations, 3086 * particularly if we are sending an RST in response to 3087 * an attempt to connect to or otherwise communicate with 3088 * a port for which we have no socket. 3089 */ 3090 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count, 3091 tcp_rst_ppslim) == 0) { 3092 /* XXX stat */ 3093 goto drop; 3094 } 3095 /* ...fall into dropwithreset... */ 3096 3097 dropwithreset: 3098 /* 3099 * Generate a RST, dropping incoming segment. 3100 * Make ACK acceptable to originator of segment. 3101 */ 3102 if (tiflags & TH_RST) 3103 goto drop; 3104 3105 switch (af) { 3106 #ifdef INET6 3107 case AF_INET6: 3108 /* For following calls to tcp_respond */ 3109 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) 3110 goto drop; 3111 break; 3112 #endif /* INET6 */ 3113 case AF_INET: 3114 if (IN_MULTICAST(ip->ip_dst.s_addr) || 3115 in_broadcast(ip->ip_dst, m_get_rcvif_NOMPSAFE(m))) 3116 goto drop; 3117 } 3118 3119 if (tiflags & TH_ACK) 3120 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST); 3121 else { 3122 if (tiflags & TH_SYN) 3123 tlen++; 3124 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0, 3125 TH_RST|TH_ACK); 3126 } 3127 if (tcp_saveti) 3128 m_freem(tcp_saveti); 3129 return; 3130 3131 badcsum: 3132 drop: 3133 /* 3134 * Drop space held by incoming segment and return. 3135 */ 3136 if (tp) { 3137 if (tp->t_inpcb) 3138 so = tp->t_inpcb->inp_socket; 3139 #ifdef INET6 3140 else if (tp->t_in6pcb) 3141 so = tp->t_in6pcb->in6p_socket; 3142 #endif 3143 else 3144 so = NULL; 3145 #ifdef TCP_DEBUG 3146 if (so && (so->so_options & SO_DEBUG) != 0) 3147 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0); 3148 #endif 3149 } 3150 if (tcp_saveti) 3151 m_freem(tcp_saveti); 3152 m_freem(m); 3153 return; 3154 } 3155 3156 #ifdef TCP_SIGNATURE 3157 int 3158 tcp_signature_apply(void *fstate, void *data, u_int len) 3159 { 3160 3161 MD5Update(fstate, (u_char *)data, len); 3162 return (0); 3163 } 3164 3165 struct secasvar * 3166 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th) 3167 { 3168 struct ip *ip; 3169 struct ip6_hdr *ip6; 3170 3171 ip = mtod(m, struct ip *); 3172 switch (ip->ip_v) { 3173 case 4: 3174 ip = mtod(m, struct ip *); 3175 ip6 = NULL; 3176 break; 3177 case 6: 3178 ip = NULL; 3179 ip6 = mtod(m, struct ip6_hdr *); 3180 break; 3181 default: 3182 return (NULL); 3183 } 3184 3185 #ifdef IPSEC 3186 union sockaddr_union dst; 3187 3188 /* Extract the destination from the IP header in the mbuf. */ 3189 memset(&dst, 0, sizeof(union sockaddr_union)); 3190 if (ip != NULL) { 3191 dst.sa.sa_len = sizeof(struct sockaddr_in); 3192 dst.sa.sa_family = AF_INET; 3193 dst.sin.sin_addr = ip->ip_dst; 3194 } else { 3195 dst.sa.sa_len = sizeof(struct sockaddr_in6); 3196 dst.sa.sa_family = AF_INET6; 3197 dst.sin6.sin6_addr = ip6->ip6_dst; 3198 } 3199 3200 /* 3201 * Look up an SADB entry which matches the address of the peer. 3202 */ 3203 return KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0); 3204 #else 3205 return NULL; 3206 #endif 3207 } 3208 3209 int 3210 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff, 3211 struct secasvar *sav, char *sig) 3212 { 3213 MD5_CTX ctx; 3214 struct ip *ip; 3215 struct ipovly *ipovly; 3216 #ifdef INET6 3217 struct ip6_hdr *ip6; 3218 struct ip6_hdr_pseudo ip6pseudo; 3219 #endif /* INET6 */ 3220 struct ippseudo ippseudo; 3221 struct tcphdr th0; 3222 int l, tcphdrlen; 3223 3224 if (sav == NULL) 3225 return (-1); 3226 3227 tcphdrlen = th->th_off * 4; 3228 3229 switch (mtod(m, struct ip *)->ip_v) { 3230 case 4: 3231 MD5Init(&ctx); 3232 ip = mtod(m, struct ip *); 3233 memset(&ippseudo, 0, sizeof(ippseudo)); 3234 ipovly = (struct ipovly *)ip; 3235 ippseudo.ippseudo_src = ipovly->ih_src; 3236 ippseudo.ippseudo_dst = ipovly->ih_dst; 3237 ippseudo.ippseudo_pad = 0; 3238 ippseudo.ippseudo_p = IPPROTO_TCP; 3239 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff); 3240 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo)); 3241 break; 3242 #if INET6 3243 case 6: 3244 MD5Init(&ctx); 3245 ip6 = mtod(m, struct ip6_hdr *); 3246 memset(&ip6pseudo, 0, sizeof(ip6pseudo)); 3247 ip6pseudo.ip6ph_src = ip6->ip6_src; 3248 in6_clearscope(&ip6pseudo.ip6ph_src); 3249 ip6pseudo.ip6ph_dst = ip6->ip6_dst; 3250 in6_clearscope(&ip6pseudo.ip6ph_dst); 3251 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff); 3252 ip6pseudo.ip6ph_nxt = IPPROTO_TCP; 3253 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo)); 3254 break; 3255 #endif /* INET6 */ 3256 default: 3257 return (-1); 3258 } 3259 3260 th0 = *th; 3261 th0.th_sum = 0; 3262 MD5Update(&ctx, (char *)&th0, sizeof(th0)); 3263 3264 l = m->m_pkthdr.len - thoff - tcphdrlen; 3265 if (l > 0) 3266 m_apply(m, thoff + tcphdrlen, 3267 m->m_pkthdr.len - thoff - tcphdrlen, 3268 tcp_signature_apply, &ctx); 3269 3270 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth)); 3271 MD5Final(sig, &ctx); 3272 3273 return (0); 3274 } 3275 #endif 3276 3277 /* 3278 * tcp_dooptions: parse and process tcp options. 3279 * 3280 * returns -1 if this segment should be dropped. (eg. wrong signature) 3281 * otherwise returns 0. 3282 */ 3283 3284 static int 3285 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt, 3286 struct tcphdr *th, 3287 struct mbuf *m, int toff, struct tcp_opt_info *oi) 3288 { 3289 u_int16_t mss; 3290 int opt, optlen = 0; 3291 #ifdef TCP_SIGNATURE 3292 void *sigp = NULL; 3293 char sigbuf[TCP_SIGLEN]; 3294 struct secasvar *sav = NULL; 3295 #endif 3296 3297 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) { 3298 opt = cp[0]; 3299 if (opt == TCPOPT_EOL) 3300 break; 3301 if (opt == TCPOPT_NOP) 3302 optlen = 1; 3303 else { 3304 if (cnt < 2) 3305 break; 3306 optlen = cp[1]; 3307 if (optlen < 2 || optlen > cnt) 3308 break; 3309 } 3310 switch (opt) { 3311 3312 default: 3313 continue; 3314 3315 case TCPOPT_MAXSEG: 3316 if (optlen != TCPOLEN_MAXSEG) 3317 continue; 3318 if (!(th->th_flags & TH_SYN)) 3319 continue; 3320 if (TCPS_HAVERCVDSYN(tp->t_state)) 3321 continue; 3322 bcopy(cp + 2, &mss, sizeof(mss)); 3323 oi->maxseg = ntohs(mss); 3324 break; 3325 3326 case TCPOPT_WINDOW: 3327 if (optlen != TCPOLEN_WINDOW) 3328 continue; 3329 if (!(th->th_flags & TH_SYN)) 3330 continue; 3331 if (TCPS_HAVERCVDSYN(tp->t_state)) 3332 continue; 3333 tp->t_flags |= TF_RCVD_SCALE; 3334 tp->requested_s_scale = cp[2]; 3335 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) { 3336 char buf[INET6_ADDRSTRLEN]; 3337 struct ip *ip = mtod(m, struct ip *); 3338 #ifdef INET6 3339 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 3340 #endif 3341 if (ip) 3342 in_print(buf, sizeof(buf), 3343 &ip->ip_src); 3344 #ifdef INET6 3345 else if (ip6) 3346 in6_print(buf, sizeof(buf), 3347 &ip6->ip6_src); 3348 #endif 3349 else 3350 strlcpy(buf, "(unknown)", sizeof(buf)); 3351 log(LOG_ERR, "TCP: invalid wscale %d from %s, " 3352 "assuming %d\n", 3353 tp->requested_s_scale, buf, 3354 TCP_MAX_WINSHIFT); 3355 tp->requested_s_scale = TCP_MAX_WINSHIFT; 3356 } 3357 break; 3358 3359 case TCPOPT_TIMESTAMP: 3360 if (optlen != TCPOLEN_TIMESTAMP) 3361 continue; 3362 oi->ts_present = 1; 3363 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val)); 3364 NTOHL(oi->ts_val); 3365 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr)); 3366 NTOHL(oi->ts_ecr); 3367 3368 if (!(th->th_flags & TH_SYN)) 3369 continue; 3370 if (TCPS_HAVERCVDSYN(tp->t_state)) 3371 continue; 3372 /* 3373 * A timestamp received in a SYN makes 3374 * it ok to send timestamp requests and replies. 3375 */ 3376 tp->t_flags |= TF_RCVD_TSTMP; 3377 tp->ts_recent = oi->ts_val; 3378 tp->ts_recent_age = tcp_now; 3379 break; 3380 3381 case TCPOPT_SACK_PERMITTED: 3382 if (optlen != TCPOLEN_SACK_PERMITTED) 3383 continue; 3384 if (!(th->th_flags & TH_SYN)) 3385 continue; 3386 if (TCPS_HAVERCVDSYN(tp->t_state)) 3387 continue; 3388 if (tcp_do_sack) { 3389 tp->t_flags |= TF_SACK_PERMIT; 3390 tp->t_flags |= TF_WILL_SACK; 3391 } 3392 break; 3393 3394 case TCPOPT_SACK: 3395 tcp_sack_option(tp, th, cp, optlen); 3396 break; 3397 #ifdef TCP_SIGNATURE 3398 case TCPOPT_SIGNATURE: 3399 if (optlen != TCPOLEN_SIGNATURE) 3400 continue; 3401 if (sigp && memcmp(sigp, cp + 2, TCP_SIGLEN)) 3402 return (-1); 3403 3404 sigp = sigbuf; 3405 memcpy(sigbuf, cp + 2, TCP_SIGLEN); 3406 tp->t_flags |= TF_SIGNATURE; 3407 break; 3408 #endif 3409 } 3410 } 3411 3412 #ifndef TCP_SIGNATURE 3413 return 0; 3414 #else 3415 if (tp->t_flags & TF_SIGNATURE) { 3416 3417 sav = tcp_signature_getsav(m, th); 3418 3419 if (sav == NULL && tp->t_state == TCPS_LISTEN) 3420 return (-1); 3421 } 3422 3423 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) 3424 goto out; 3425 3426 if (sigp) { 3427 char sig[TCP_SIGLEN]; 3428 3429 tcp_fields_to_net(th); 3430 if (tcp_signature(m, th, toff, sav, sig) < 0) { 3431 tcp_fields_to_host(th); 3432 goto out; 3433 } 3434 tcp_fields_to_host(th); 3435 3436 if (memcmp(sig, sigp, TCP_SIGLEN)) { 3437 TCP_STATINC(TCP_STAT_BADSIG); 3438 goto out; 3439 } else 3440 TCP_STATINC(TCP_STAT_GOODSIG); 3441 3442 key_sa_recordxfer(sav, m); 3443 KEY_FREESAV(&sav); 3444 } 3445 return 0; 3446 out: 3447 if (sav != NULL) 3448 KEY_FREESAV(&sav); 3449 return -1; 3450 #endif 3451 } 3452 3453 /* 3454 * Pull out of band byte out of a segment so 3455 * it doesn't appear in the user's data queue. 3456 * It is still reflected in the segment length for 3457 * sequencing purposes. 3458 */ 3459 void 3460 tcp_pulloutofband(struct socket *so, struct tcphdr *th, 3461 struct mbuf *m, int off) 3462 { 3463 int cnt = off + th->th_urp - 1; 3464 3465 while (cnt >= 0) { 3466 if (m->m_len > cnt) { 3467 char *cp = mtod(m, char *) + cnt; 3468 struct tcpcb *tp = sototcpcb(so); 3469 3470 tp->t_iobc = *cp; 3471 tp->t_oobflags |= TCPOOB_HAVEDATA; 3472 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 3473 m->m_len--; 3474 return; 3475 } 3476 cnt -= m->m_len; 3477 m = m->m_next; 3478 if (m == 0) 3479 break; 3480 } 3481 panic("tcp_pulloutofband"); 3482 } 3483 3484 /* 3485 * Collect new round-trip time estimate 3486 * and update averages and current timeout. 3487 * 3488 * rtt is in units of slow ticks (typically 500 ms) -- essentially the 3489 * difference of two timestamps. 3490 */ 3491 void 3492 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt) 3493 { 3494 int32_t delta; 3495 3496 TCP_STATINC(TCP_STAT_RTTUPDATED); 3497 if (tp->t_srtt != 0) { 3498 /* 3499 * Compute the amount to add to srtt for smoothing, 3500 * *alpha, or 2^(-TCP_RTT_SHIFT). Because 3501 * srtt is stored in 1/32 slow ticks, we conceptually 3502 * shift left 5 bits, subtract srtt to get the 3503 * diference, and then shift right by TCP_RTT_SHIFT 3504 * (3) to obtain 1/8 of the difference. 3505 */ 3506 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT); 3507 /* 3508 * This can never happen, because delta's lowest 3509 * possible value is 1/8 of t_srtt. But if it does, 3510 * set srtt to some reasonable value, here chosen 3511 * as 1/8 tick. 3512 */ 3513 if ((tp->t_srtt += delta) <= 0) 3514 tp->t_srtt = 1 << 2; 3515 /* 3516 * RFC2988 requires that rttvar be updated first. 3517 * This code is compliant because "delta" is the old 3518 * srtt minus the new observation (scaled). 3519 * 3520 * RFC2988 says: 3521 * rttvar = (1-beta) * rttvar + beta * |srtt-observed| 3522 * 3523 * delta is in units of 1/32 ticks, and has then been 3524 * divided by 8. This is equivalent to being in 1/16s 3525 * units and divided by 4. Subtract from it 1/4 of 3526 * the existing rttvar to form the (signed) amount to 3527 * adjust. 3528 */ 3529 if (delta < 0) 3530 delta = -delta; 3531 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 3532 /* 3533 * As with srtt, this should never happen. There is 3534 * no support in RFC2988 for this operation. But 1/4s 3535 * as rttvar when faced with something arguably wrong 3536 * is ok. 3537 */ 3538 if ((tp->t_rttvar += delta) <= 0) 3539 tp->t_rttvar = 1 << 2; 3540 3541 /* 3542 * If srtt exceeds .01 second, ensure we use the 'remote' MSL 3543 * Problem is: it doesn't work. Disabled by defaulting 3544 * tcp_rttlocal to 0; see corresponding code in 3545 * tcp_subr that selects local vs remote in a different way. 3546 * 3547 * The static branch prediction hint here should be removed 3548 * when the rtt estimator is fixed and the rtt_enable code 3549 * is turned back on. 3550 */ 3551 if (__predict_false(tcp_rttlocal) && tcp_msl_enable 3552 && tp->t_srtt > tcp_msl_remote_threshold 3553 && tp->t_msl < tcp_msl_remote) { 3554 tp->t_msl = tcp_msl_remote; 3555 } 3556 } else { 3557 /* 3558 * This is the first measurement. Per RFC2988, 2.2, 3559 * set rtt=R and srtt=R/2. 3560 * For srtt, storage representation is 1/32 ticks, 3561 * so shift left by 5. 3562 * For rttvar, storage representation is 1/16 ticks, 3563 * So shift left by 4, but then right by 1 to halve. 3564 */ 3565 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2); 3566 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1); 3567 } 3568 tp->t_rtttime = 0; 3569 tp->t_rxtshift = 0; 3570 3571 /* 3572 * the retransmit should happen at rtt + 4 * rttvar. 3573 * Because of the way we do the smoothing, srtt and rttvar 3574 * will each average +1/2 tick of bias. When we compute 3575 * the retransmit timer, we want 1/2 tick of rounding and 3576 * 1 extra tick because of +-1/2 tick uncertainty in the 3577 * firing of the timer. The bias will give us exactly the 3578 * 1.5 tick we need. But, because the bias is 3579 * statistical, we have to test that we don't drop below 3580 * the minimum feasible timer (which is 2 ticks). 3581 */ 3582 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), 3583 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX); 3584 3585 /* 3586 * We received an ack for a packet that wasn't retransmitted; 3587 * it is probably safe to discard any error indications we've 3588 * received recently. This isn't quite right, but close enough 3589 * for now (a route might have failed after we sent a segment, 3590 * and the return path might not be symmetrical). 3591 */ 3592 tp->t_softerror = 0; 3593 } 3594 3595 3596 /* 3597 * TCP compressed state engine. Currently used to hold compressed 3598 * state for SYN_RECEIVED. 3599 */ 3600 3601 u_long syn_cache_count; 3602 u_int32_t syn_hash1, syn_hash2; 3603 3604 #define SYN_HASH(sa, sp, dp) \ 3605 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 3606 ((u_int32_t)(sp)))^syn_hash2))) 3607 #ifndef INET6 3608 #define SYN_HASHALL(hash, src, dst) \ 3609 do { \ 3610 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \ 3611 ((const struct sockaddr_in *)(src))->sin_port, \ 3612 ((const struct sockaddr_in *)(dst))->sin_port); \ 3613 } while (/*CONSTCOND*/ 0) 3614 #else 3615 #define SYN_HASH6(sa, sp, dp) \ 3616 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \ 3617 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \ 3618 & 0x7fffffff) 3619 3620 #define SYN_HASHALL(hash, src, dst) \ 3621 do { \ 3622 switch ((src)->sa_family) { \ 3623 case AF_INET: \ 3624 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \ 3625 ((const struct sockaddr_in *)(src))->sin_port, \ 3626 ((const struct sockaddr_in *)(dst))->sin_port); \ 3627 break; \ 3628 case AF_INET6: \ 3629 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \ 3630 ((const struct sockaddr_in6 *)(src))->sin6_port, \ 3631 ((const struct sockaddr_in6 *)(dst))->sin6_port); \ 3632 break; \ 3633 default: \ 3634 hash = 0; \ 3635 } \ 3636 } while (/*CONSTCOND*/0) 3637 #endif /* INET6 */ 3638 3639 static struct pool syn_cache_pool; 3640 3641 /* 3642 * We don't estimate RTT with SYNs, so each packet starts with the default 3643 * RTT and each timer step has a fixed timeout value. 3644 */ 3645 #define SYN_CACHE_TIMER_ARM(sc) \ 3646 do { \ 3647 TCPT_RANGESET((sc)->sc_rxtcur, \ 3648 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \ 3649 TCPTV_REXMTMAX); \ 3650 callout_reset(&(sc)->sc_timer, \ 3651 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \ 3652 } while (/*CONSTCOND*/0) 3653 3654 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase) 3655 3656 static inline void 3657 syn_cache_rm(struct syn_cache *sc) 3658 { 3659 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket, 3660 sc, sc_bucketq); 3661 sc->sc_tp = NULL; 3662 LIST_REMOVE(sc, sc_tpq); 3663 tcp_syn_cache[sc->sc_bucketidx].sch_length--; 3664 callout_stop(&sc->sc_timer); 3665 syn_cache_count--; 3666 } 3667 3668 static inline void 3669 syn_cache_put(struct syn_cache *sc) 3670 { 3671 if (sc->sc_ipopts) 3672 (void) m_free(sc->sc_ipopts); 3673 rtcache_free(&sc->sc_route); 3674 sc->sc_flags |= SCF_DEAD; 3675 if (!callout_invoking(&sc->sc_timer)) 3676 callout_schedule(&(sc)->sc_timer, 1); 3677 } 3678 3679 void 3680 syn_cache_init(void) 3681 { 3682 int i; 3683 3684 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, 3685 "synpl", NULL, IPL_SOFTNET); 3686 3687 /* Initialize the hash buckets. */ 3688 for (i = 0; i < tcp_syn_cache_size; i++) 3689 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket); 3690 } 3691 3692 void 3693 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp) 3694 { 3695 struct syn_cache_head *scp; 3696 struct syn_cache *sc2; 3697 int s; 3698 3699 /* 3700 * If there are no entries in the hash table, reinitialize 3701 * the hash secrets. 3702 */ 3703 if (syn_cache_count == 0) { 3704 syn_hash1 = cprng_fast32(); 3705 syn_hash2 = cprng_fast32(); 3706 } 3707 3708 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa); 3709 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size; 3710 scp = &tcp_syn_cache[sc->sc_bucketidx]; 3711 3712 /* 3713 * Make sure that we don't overflow the per-bucket 3714 * limit or the total cache size limit. 3715 */ 3716 s = splsoftnet(); 3717 if (scp->sch_length >= tcp_syn_bucket_limit) { 3718 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW); 3719 /* 3720 * The bucket is full. Toss the oldest element in the 3721 * bucket. This will be the first entry in the bucket. 3722 */ 3723 sc2 = TAILQ_FIRST(&scp->sch_bucket); 3724 #ifdef DIAGNOSTIC 3725 /* 3726 * This should never happen; we should always find an 3727 * entry in our bucket. 3728 */ 3729 if (sc2 == NULL) 3730 panic("syn_cache_insert: bucketoverflow: impossible"); 3731 #endif 3732 syn_cache_rm(sc2); 3733 syn_cache_put(sc2); /* calls pool_put but see spl above */ 3734 } else if (syn_cache_count >= tcp_syn_cache_limit) { 3735 struct syn_cache_head *scp2, *sce; 3736 3737 TCP_STATINC(TCP_STAT_SC_OVERFLOWED); 3738 /* 3739 * The cache is full. Toss the oldest entry in the 3740 * first non-empty bucket we can find. 3741 * 3742 * XXX We would really like to toss the oldest 3743 * entry in the cache, but we hope that this 3744 * condition doesn't happen very often. 3745 */ 3746 scp2 = scp; 3747 if (TAILQ_EMPTY(&scp2->sch_bucket)) { 3748 sce = &tcp_syn_cache[tcp_syn_cache_size]; 3749 for (++scp2; scp2 != scp; scp2++) { 3750 if (scp2 >= sce) 3751 scp2 = &tcp_syn_cache[0]; 3752 if (! TAILQ_EMPTY(&scp2->sch_bucket)) 3753 break; 3754 } 3755 #ifdef DIAGNOSTIC 3756 /* 3757 * This should never happen; we should always find a 3758 * non-empty bucket. 3759 */ 3760 if (scp2 == scp) 3761 panic("syn_cache_insert: cacheoverflow: " 3762 "impossible"); 3763 #endif 3764 } 3765 sc2 = TAILQ_FIRST(&scp2->sch_bucket); 3766 syn_cache_rm(sc2); 3767 syn_cache_put(sc2); /* calls pool_put but see spl above */ 3768 } 3769 3770 /* 3771 * Initialize the entry's timer. 3772 */ 3773 sc->sc_rxttot = 0; 3774 sc->sc_rxtshift = 0; 3775 SYN_CACHE_TIMER_ARM(sc); 3776 3777 /* Link it from tcpcb entry */ 3778 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 3779 3780 /* Put it into the bucket. */ 3781 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq); 3782 scp->sch_length++; 3783 syn_cache_count++; 3784 3785 TCP_STATINC(TCP_STAT_SC_ADDED); 3786 splx(s); 3787 } 3788 3789 /* 3790 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 3791 * If we have retransmitted an entry the maximum number of times, expire 3792 * that entry. 3793 */ 3794 void 3795 syn_cache_timer(void *arg) 3796 { 3797 struct syn_cache *sc = arg; 3798 3799 mutex_enter(softnet_lock); 3800 KERNEL_LOCK(1, NULL); 3801 callout_ack(&sc->sc_timer); 3802 3803 if (__predict_false(sc->sc_flags & SCF_DEAD)) { 3804 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE); 3805 callout_destroy(&sc->sc_timer); 3806 pool_put(&syn_cache_pool, sc); 3807 KERNEL_UNLOCK_ONE(NULL); 3808 mutex_exit(softnet_lock); 3809 return; 3810 } 3811 3812 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) { 3813 /* Drop it -- too many retransmissions. */ 3814 goto dropit; 3815 } 3816 3817 /* 3818 * Compute the total amount of time this entry has 3819 * been on a queue. If this entry has been on longer 3820 * than the keep alive timer would allow, expire it. 3821 */ 3822 sc->sc_rxttot += sc->sc_rxtcur; 3823 if (sc->sc_rxttot >= tcp_keepinit) 3824 goto dropit; 3825 3826 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED); 3827 (void) syn_cache_respond(sc, NULL); 3828 3829 /* Advance the timer back-off. */ 3830 sc->sc_rxtshift++; 3831 SYN_CACHE_TIMER_ARM(sc); 3832 3833 KERNEL_UNLOCK_ONE(NULL); 3834 mutex_exit(softnet_lock); 3835 return; 3836 3837 dropit: 3838 TCP_STATINC(TCP_STAT_SC_TIMED_OUT); 3839 syn_cache_rm(sc); 3840 if (sc->sc_ipopts) 3841 (void) m_free(sc->sc_ipopts); 3842 rtcache_free(&sc->sc_route); 3843 callout_destroy(&sc->sc_timer); 3844 pool_put(&syn_cache_pool, sc); 3845 KERNEL_UNLOCK_ONE(NULL); 3846 mutex_exit(softnet_lock); 3847 } 3848 3849 /* 3850 * Remove syn cache created by the specified tcb entry, 3851 * because this does not make sense to keep them 3852 * (if there's no tcb entry, syn cache entry will never be used) 3853 */ 3854 void 3855 syn_cache_cleanup(struct tcpcb *tp) 3856 { 3857 struct syn_cache *sc, *nsc; 3858 int s; 3859 3860 s = splsoftnet(); 3861 3862 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) { 3863 nsc = LIST_NEXT(sc, sc_tpq); 3864 3865 #ifdef DIAGNOSTIC 3866 if (sc->sc_tp != tp) 3867 panic("invalid sc_tp in syn_cache_cleanup"); 3868 #endif 3869 syn_cache_rm(sc); 3870 syn_cache_put(sc); /* calls pool_put but see spl above */ 3871 } 3872 /* just for safety */ 3873 LIST_INIT(&tp->t_sc); 3874 3875 splx(s); 3876 } 3877 3878 /* 3879 * Find an entry in the syn cache. 3880 */ 3881 struct syn_cache * 3882 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst, 3883 struct syn_cache_head **headp) 3884 { 3885 struct syn_cache *sc; 3886 struct syn_cache_head *scp; 3887 u_int32_t hash; 3888 int s; 3889 3890 SYN_HASHALL(hash, src, dst); 3891 3892 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 3893 *headp = scp; 3894 s = splsoftnet(); 3895 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL; 3896 sc = TAILQ_NEXT(sc, sc_bucketq)) { 3897 if (sc->sc_hash != hash) 3898 continue; 3899 if (!memcmp(&sc->sc_src, src, src->sa_len) && 3900 !memcmp(&sc->sc_dst, dst, dst->sa_len)) { 3901 splx(s); 3902 return (sc); 3903 } 3904 } 3905 splx(s); 3906 return (NULL); 3907 } 3908 3909 /* 3910 * This function gets called when we receive an ACK for a 3911 * socket in the LISTEN state. We look up the connection 3912 * in the syn cache, and if its there, we pull it out of 3913 * the cache and turn it into a full-blown connection in 3914 * the SYN-RECEIVED state. 3915 * 3916 * The return values may not be immediately obvious, and their effects 3917 * can be subtle, so here they are: 3918 * 3919 * NULL SYN was not found in cache; caller should drop the 3920 * packet and send an RST. 3921 * 3922 * -1 We were unable to create the new connection, and are 3923 * aborting it. An ACK,RST is being sent to the peer 3924 * (unless we got screwey sequence numbners; see below), 3925 * because the 3-way handshake has been completed. Caller 3926 * should not free the mbuf, since we may be using it. If 3927 * we are not, we will free it. 3928 * 3929 * Otherwise, the return value is a pointer to the new socket 3930 * associated with the connection. 3931 */ 3932 struct socket * 3933 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, 3934 struct tcphdr *th, unsigned int hlen, unsigned int tlen, 3935 struct socket *so, struct mbuf *m) 3936 { 3937 struct syn_cache *sc; 3938 struct syn_cache_head *scp; 3939 struct inpcb *inp = NULL; 3940 #ifdef INET6 3941 struct in6pcb *in6p = NULL; 3942 #endif 3943 struct tcpcb *tp = 0; 3944 int s; 3945 struct socket *oso; 3946 3947 s = splsoftnet(); 3948 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 3949 splx(s); 3950 return (NULL); 3951 } 3952 3953 /* 3954 * Verify the sequence and ack numbers. Try getting the correct 3955 * response again. 3956 */ 3957 if ((th->th_ack != sc->sc_iss + 1) || 3958 SEQ_LEQ(th->th_seq, sc->sc_irs) || 3959 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 3960 (void) syn_cache_respond(sc, m); 3961 splx(s); 3962 return ((struct socket *)(-1)); 3963 } 3964 3965 /* Remove this cache entry */ 3966 syn_cache_rm(sc); 3967 splx(s); 3968 3969 /* 3970 * Ok, create the full blown connection, and set things up 3971 * as they would have been set up if we had created the 3972 * connection when the SYN arrived. If we can't create 3973 * the connection, abort it. 3974 */ 3975 /* 3976 * inp still has the OLD in_pcb stuff, set the 3977 * v6-related flags on the new guy, too. This is 3978 * done particularly for the case where an AF_INET6 3979 * socket is bound only to a port, and a v4 connection 3980 * comes in on that port. 3981 * we also copy the flowinfo from the original pcb 3982 * to the new one. 3983 */ 3984 oso = so; 3985 so = sonewconn(so, true); 3986 if (so == NULL) 3987 goto resetandabort; 3988 3989 switch (so->so_proto->pr_domain->dom_family) { 3990 #ifdef INET 3991 case AF_INET: 3992 inp = sotoinpcb(so); 3993 break; 3994 #endif 3995 #ifdef INET6 3996 case AF_INET6: 3997 in6p = sotoin6pcb(so); 3998 break; 3999 #endif 4000 } 4001 switch (src->sa_family) { 4002 #ifdef INET 4003 case AF_INET: 4004 if (inp) { 4005 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr; 4006 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port; 4007 inp->inp_options = ip_srcroute(m); 4008 in_pcbstate(inp, INP_BOUND); 4009 if (inp->inp_options == NULL) { 4010 inp->inp_options = sc->sc_ipopts; 4011 sc->sc_ipopts = NULL; 4012 } 4013 } 4014 #ifdef INET6 4015 else if (in6p) { 4016 /* IPv4 packet to AF_INET6 socket */ 4017 memset(&in6p->in6p_laddr, 0, sizeof(in6p->in6p_laddr)); 4018 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff); 4019 bcopy(&((struct sockaddr_in *)dst)->sin_addr, 4020 &in6p->in6p_laddr.s6_addr32[3], 4021 sizeof(((struct sockaddr_in *)dst)->sin_addr)); 4022 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port; 4023 in6totcpcb(in6p)->t_family = AF_INET; 4024 if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY) 4025 in6p->in6p_flags |= IN6P_IPV6_V6ONLY; 4026 else 4027 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY; 4028 in6_pcbstate(in6p, IN6P_BOUND); 4029 } 4030 #endif 4031 break; 4032 #endif 4033 #ifdef INET6 4034 case AF_INET6: 4035 if (in6p) { 4036 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr; 4037 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port; 4038 in6_pcbstate(in6p, IN6P_BOUND); 4039 } 4040 break; 4041 #endif 4042 } 4043 #ifdef INET6 4044 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) { 4045 struct in6pcb *oin6p = sotoin6pcb(oso); 4046 /* inherit socket options from the listening socket */ 4047 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS); 4048 if (in6p->in6p_flags & IN6P_CONTROLOPTS) { 4049 m_freem(in6p->in6p_options); 4050 in6p->in6p_options = 0; 4051 } 4052 ip6_savecontrol(in6p, &in6p->in6p_options, 4053 mtod(m, struct ip6_hdr *), m); 4054 } 4055 #endif 4056 4057 #if defined(IPSEC) 4058 if (ipsec_used) { 4059 /* 4060 * we make a copy of policy, instead of sharing the policy, for 4061 * better behavior in terms of SA lookup and dead SA removal. 4062 */ 4063 if (inp) { 4064 /* copy old policy into new socket's */ 4065 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, 4066 inp->inp_sp)) 4067 printf("tcp_input: could not copy policy\n"); 4068 } 4069 #ifdef INET6 4070 else if (in6p) { 4071 /* copy old policy into new socket's */ 4072 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp, 4073 in6p->in6p_sp)) 4074 printf("tcp_input: could not copy policy\n"); 4075 } 4076 #endif 4077 } 4078 #endif 4079 4080 /* 4081 * Give the new socket our cached route reference. 4082 */ 4083 if (inp) { 4084 rtcache_copy(&inp->inp_route, &sc->sc_route); 4085 rtcache_free(&sc->sc_route); 4086 } 4087 #ifdef INET6 4088 else { 4089 rtcache_copy(&in6p->in6p_route, &sc->sc_route); 4090 rtcache_free(&sc->sc_route); 4091 } 4092 #endif 4093 4094 if (inp) { 4095 struct sockaddr_in sin; 4096 memcpy(&sin, src, src->sa_len); 4097 if (in_pcbconnect(inp, &sin, &lwp0)) { 4098 goto resetandabort; 4099 } 4100 } 4101 #ifdef INET6 4102 else if (in6p) { 4103 struct sockaddr_in6 sin6; 4104 memcpy(&sin6, src, src->sa_len); 4105 if (src->sa_family == AF_INET) { 4106 /* IPv4 packet to AF_INET6 socket */ 4107 in6_sin_2_v4mapsin6((struct sockaddr_in *)src, &sin6); 4108 } 4109 if (in6_pcbconnect(in6p, &sin6, NULL)) { 4110 goto resetandabort; 4111 } 4112 } 4113 #endif 4114 else { 4115 goto resetandabort; 4116 } 4117 4118 if (inp) 4119 tp = intotcpcb(inp); 4120 #ifdef INET6 4121 else if (in6p) 4122 tp = in6totcpcb(in6p); 4123 #endif 4124 else 4125 tp = NULL; 4126 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY; 4127 if (sc->sc_request_r_scale != 15) { 4128 tp->requested_s_scale = sc->sc_requested_s_scale; 4129 tp->request_r_scale = sc->sc_request_r_scale; 4130 tp->snd_scale = sc->sc_requested_s_scale; 4131 tp->rcv_scale = sc->sc_request_r_scale; 4132 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE; 4133 } 4134 if (sc->sc_flags & SCF_TIMESTAMP) 4135 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP; 4136 tp->ts_timebase = sc->sc_timebase; 4137 4138 tp->t_template = tcp_template(tp); 4139 if (tp->t_template == 0) { 4140 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 4141 so = NULL; 4142 m_freem(m); 4143 goto abort; 4144 } 4145 4146 tp->iss = sc->sc_iss; 4147 tp->irs = sc->sc_irs; 4148 tcp_sendseqinit(tp); 4149 tcp_rcvseqinit(tp); 4150 tp->t_state = TCPS_SYN_RECEIVED; 4151 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit); 4152 TCP_STATINC(TCP_STAT_ACCEPTS); 4153 4154 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack) 4155 tp->t_flags |= TF_WILL_SACK; 4156 4157 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn) 4158 tp->t_flags |= TF_ECN_PERMIT; 4159 4160 #ifdef TCP_SIGNATURE 4161 if (sc->sc_flags & SCF_SIGNATURE) 4162 tp->t_flags |= TF_SIGNATURE; 4163 #endif 4164 4165 /* Initialize tp->t_ourmss before we deal with the peer's! */ 4166 tp->t_ourmss = sc->sc_ourmaxseg; 4167 tcp_mss_from_peer(tp, sc->sc_peermaxseg); 4168 4169 /* 4170 * Initialize the initial congestion window. If we 4171 * had to retransmit the SYN,ACK, we must initialize cwnd 4172 * to 1 segment (i.e. the Loss Window). 4173 */ 4174 if (sc->sc_rxtshift) 4175 tp->snd_cwnd = tp->t_peermss; 4176 else { 4177 int ss = tcp_init_win; 4178 #ifdef INET 4179 if (inp != NULL && in_localaddr(inp->inp_faddr)) 4180 ss = tcp_init_win_local; 4181 #endif 4182 #ifdef INET6 4183 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr)) 4184 ss = tcp_init_win_local; 4185 #endif 4186 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss); 4187 } 4188 4189 tcp_rmx_rtt(tp); 4190 tp->snd_wl1 = sc->sc_irs; 4191 tp->rcv_up = sc->sc_irs + 1; 4192 4193 /* 4194 * This is what whould have happened in tcp_output() when 4195 * the SYN,ACK was sent. 4196 */ 4197 tp->snd_up = tp->snd_una; 4198 tp->snd_max = tp->snd_nxt = tp->iss+1; 4199 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 4200 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 4201 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 4202 tp->last_ack_sent = tp->rcv_nxt; 4203 tp->t_partialacks = -1; 4204 tp->t_dupacks = 0; 4205 4206 TCP_STATINC(TCP_STAT_SC_COMPLETED); 4207 s = splsoftnet(); 4208 syn_cache_put(sc); 4209 splx(s); 4210 return (so); 4211 4212 resetandabort: 4213 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST); 4214 abort: 4215 if (so != NULL) { 4216 (void) soqremque(so, 1); 4217 (void) soabort(so); 4218 mutex_enter(softnet_lock); 4219 } 4220 s = splsoftnet(); 4221 syn_cache_put(sc); 4222 splx(s); 4223 TCP_STATINC(TCP_STAT_SC_ABORTED); 4224 return ((struct socket *)(-1)); 4225 } 4226 4227 /* 4228 * This function is called when we get a RST for a 4229 * non-existent connection, so that we can see if the 4230 * connection is in the syn cache. If it is, zap it. 4231 */ 4232 4233 void 4234 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th) 4235 { 4236 struct syn_cache *sc; 4237 struct syn_cache_head *scp; 4238 int s = splsoftnet(); 4239 4240 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 4241 splx(s); 4242 return; 4243 } 4244 if (SEQ_LT(th->th_seq, sc->sc_irs) || 4245 SEQ_GT(th->th_seq, sc->sc_irs+1)) { 4246 splx(s); 4247 return; 4248 } 4249 syn_cache_rm(sc); 4250 TCP_STATINC(TCP_STAT_SC_RESET); 4251 syn_cache_put(sc); /* calls pool_put but see spl above */ 4252 splx(s); 4253 } 4254 4255 void 4256 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst, 4257 struct tcphdr *th) 4258 { 4259 struct syn_cache *sc; 4260 struct syn_cache_head *scp; 4261 int s; 4262 4263 s = splsoftnet(); 4264 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 4265 splx(s); 4266 return; 4267 } 4268 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 4269 if (ntohl (th->th_seq) != sc->sc_iss) { 4270 splx(s); 4271 return; 4272 } 4273 4274 /* 4275 * If we've retransmitted 3 times and this is our second error, 4276 * we remove the entry. Otherwise, we allow it to continue on. 4277 * This prevents us from incorrectly nuking an entry during a 4278 * spurious network outage. 4279 * 4280 * See tcp_notify(). 4281 */ 4282 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 4283 sc->sc_flags |= SCF_UNREACH; 4284 splx(s); 4285 return; 4286 } 4287 4288 syn_cache_rm(sc); 4289 TCP_STATINC(TCP_STAT_SC_UNREACH); 4290 syn_cache_put(sc); /* calls pool_put but see spl above */ 4291 splx(s); 4292 } 4293 4294 /* 4295 * Given a LISTEN socket and an inbound SYN request, add 4296 * this to the syn cache, and send back a segment: 4297 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 4298 * to the source. 4299 * 4300 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 4301 * Doing so would require that we hold onto the data and deliver it 4302 * to the application. However, if we are the target of a SYN-flood 4303 * DoS attack, an attacker could send data which would eventually 4304 * consume all available buffer space if it were ACKed. By not ACKing 4305 * the data, we avoid this DoS scenario. 4306 */ 4307 4308 int 4309 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 4310 unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp, 4311 int optlen, struct tcp_opt_info *oi) 4312 { 4313 struct tcpcb tb, *tp; 4314 long win; 4315 struct syn_cache *sc; 4316 struct syn_cache_head *scp; 4317 struct mbuf *ipopts; 4318 struct tcp_opt_info opti; 4319 int s; 4320 4321 tp = sototcpcb(so); 4322 4323 memset(&opti, 0, sizeof(opti)); 4324 4325 /* 4326 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 4327 * 4328 * Note this check is performed in tcp_input() very early on. 4329 */ 4330 4331 /* 4332 * Initialize some local state. 4333 */ 4334 win = sbspace(&so->so_rcv); 4335 if (win > TCP_MAXWIN) 4336 win = TCP_MAXWIN; 4337 4338 switch (src->sa_family) { 4339 #ifdef INET 4340 case AF_INET: 4341 /* 4342 * Remember the IP options, if any. 4343 */ 4344 ipopts = ip_srcroute(m); 4345 break; 4346 #endif 4347 default: 4348 ipopts = NULL; 4349 } 4350 4351 #ifdef TCP_SIGNATURE 4352 if (optp || (tp->t_flags & TF_SIGNATURE)) 4353 #else 4354 if (optp) 4355 #endif 4356 { 4357 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 4358 #ifdef TCP_SIGNATURE 4359 tb.t_flags |= (tp->t_flags & TF_SIGNATURE); 4360 #endif 4361 tb.t_state = TCPS_LISTEN; 4362 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len - 4363 sizeof(struct tcphdr) - optlen - hlen, oi) < 0) 4364 return (0); 4365 } else 4366 tb.t_flags = 0; 4367 4368 /* 4369 * See if we already have an entry for this connection. 4370 * If we do, resend the SYN,ACK. We do not count this 4371 * as a retransmission (XXX though maybe we should). 4372 */ 4373 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) { 4374 TCP_STATINC(TCP_STAT_SC_DUPESYN); 4375 if (ipopts) { 4376 /* 4377 * If we were remembering a previous source route, 4378 * forget it and use the new one we've been given. 4379 */ 4380 if (sc->sc_ipopts) 4381 (void) m_free(sc->sc_ipopts); 4382 sc->sc_ipopts = ipopts; 4383 } 4384 sc->sc_timestamp = tb.ts_recent; 4385 if (syn_cache_respond(sc, m) == 0) { 4386 uint64_t *tcps = TCP_STAT_GETREF(); 4387 tcps[TCP_STAT_SNDACKS]++; 4388 tcps[TCP_STAT_SNDTOTAL]++; 4389 TCP_STAT_PUTREF(); 4390 } 4391 return (1); 4392 } 4393 4394 s = splsoftnet(); 4395 sc = pool_get(&syn_cache_pool, PR_NOWAIT); 4396 splx(s); 4397 if (sc == NULL) { 4398 if (ipopts) 4399 (void) m_free(ipopts); 4400 return (0); 4401 } 4402 4403 /* 4404 * Fill in the cache, and put the necessary IP and TCP 4405 * options into the reply. 4406 */ 4407 memset(sc, 0, sizeof(struct syn_cache)); 4408 callout_init(&sc->sc_timer, CALLOUT_MPSAFE); 4409 bcopy(src, &sc->sc_src, src->sa_len); 4410 bcopy(dst, &sc->sc_dst, dst->sa_len); 4411 sc->sc_flags = 0; 4412 sc->sc_ipopts = ipopts; 4413 sc->sc_irs = th->th_seq; 4414 switch (src->sa_family) { 4415 #ifdef INET 4416 case AF_INET: 4417 { 4418 struct sockaddr_in *srcin = (void *) src; 4419 struct sockaddr_in *dstin = (void *) dst; 4420 4421 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr, 4422 &srcin->sin_addr, dstin->sin_port, 4423 srcin->sin_port, sizeof(dstin->sin_addr), 0); 4424 break; 4425 } 4426 #endif /* INET */ 4427 #ifdef INET6 4428 case AF_INET6: 4429 { 4430 struct sockaddr_in6 *srcin6 = (void *) src; 4431 struct sockaddr_in6 *dstin6 = (void *) dst; 4432 4433 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr, 4434 &srcin6->sin6_addr, dstin6->sin6_port, 4435 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0); 4436 break; 4437 } 4438 #endif /* INET6 */ 4439 } 4440 sc->sc_peermaxseg = oi->maxseg; 4441 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ? 4442 m_get_rcvif_NOMPSAFE(m) : NULL, 4443 sc->sc_src.sa.sa_family); 4444 sc->sc_win = win; 4445 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */ 4446 sc->sc_timestamp = tb.ts_recent; 4447 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) == 4448 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) 4449 sc->sc_flags |= SCF_TIMESTAMP; 4450 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 4451 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 4452 sc->sc_requested_s_scale = tb.requested_s_scale; 4453 sc->sc_request_r_scale = 0; 4454 /* 4455 * Pick the smallest possible scaling factor that 4456 * will still allow us to scale up to sb_max. 4457 * 4458 * We do this because there are broken firewalls that 4459 * will corrupt the window scale option, leading to 4460 * the other endpoint believing that our advertised 4461 * window is unscaled. At scale factors larger than 4462 * 5 the unscaled window will drop below 1500 bytes, 4463 * leading to serious problems when traversing these 4464 * broken firewalls. 4465 * 4466 * With the default sbmax of 256K, a scale factor 4467 * of 3 will be chosen by this algorithm. Those who 4468 * choose a larger sbmax should watch out 4469 * for the compatiblity problems mentioned above. 4470 * 4471 * RFC1323: The Window field in a SYN (i.e., a <SYN> 4472 * or <SYN,ACK>) segment itself is never scaled. 4473 */ 4474 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 4475 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max) 4476 sc->sc_request_r_scale++; 4477 } else { 4478 sc->sc_requested_s_scale = 15; 4479 sc->sc_request_r_scale = 15; 4480 } 4481 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack) 4482 sc->sc_flags |= SCF_SACK_PERMIT; 4483 4484 /* 4485 * ECN setup packet recieved. 4486 */ 4487 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn) 4488 sc->sc_flags |= SCF_ECN_PERMIT; 4489 4490 #ifdef TCP_SIGNATURE 4491 if (tb.t_flags & TF_SIGNATURE) 4492 sc->sc_flags |= SCF_SIGNATURE; 4493 #endif 4494 sc->sc_tp = tp; 4495 if (syn_cache_respond(sc, m) == 0) { 4496 uint64_t *tcps = TCP_STAT_GETREF(); 4497 tcps[TCP_STAT_SNDACKS]++; 4498 tcps[TCP_STAT_SNDTOTAL]++; 4499 TCP_STAT_PUTREF(); 4500 syn_cache_insert(sc, tp); 4501 } else { 4502 s = splsoftnet(); 4503 /* 4504 * syn_cache_put() will try to schedule the timer, so 4505 * we need to initialize it 4506 */ 4507 SYN_CACHE_TIMER_ARM(sc); 4508 syn_cache_put(sc); 4509 splx(s); 4510 TCP_STATINC(TCP_STAT_SC_DROPPED); 4511 } 4512 return (1); 4513 } 4514 4515 /* 4516 * syn_cache_respond: (re)send SYN+ACK. 4517 * 4518 * returns 0 on success. otherwise returns an errno, typically ENOBUFS. 4519 */ 4520 4521 int 4522 syn_cache_respond(struct syn_cache *sc, struct mbuf *m) 4523 { 4524 #ifdef INET6 4525 struct rtentry *rt = NULL; 4526 #endif 4527 struct route *ro; 4528 u_int8_t *optp; 4529 int optlen, error; 4530 u_int16_t tlen; 4531 struct ip *ip = NULL; 4532 #ifdef INET6 4533 struct ip6_hdr *ip6 = NULL; 4534 #endif 4535 struct tcpcb *tp = NULL; 4536 struct tcphdr *th; 4537 u_int hlen; 4538 #ifdef TCP_SIGNATURE 4539 struct secasvar *sav = NULL; 4540 u_int8_t *sigp = NULL; 4541 #endif 4542 4543 ro = &sc->sc_route; 4544 switch (sc->sc_src.sa.sa_family) { 4545 case AF_INET: 4546 hlen = sizeof(struct ip); 4547 break; 4548 #ifdef INET6 4549 case AF_INET6: 4550 hlen = sizeof(struct ip6_hdr); 4551 break; 4552 #endif 4553 default: 4554 if (m) 4555 m_freem(m); 4556 return (EAFNOSUPPORT); 4557 } 4558 4559 /* worst case scanario, since we don't know the option size yet */ 4560 tlen = hlen + sizeof(struct tcphdr) + MAX_TCPOPTLEN; 4561 4562 /* 4563 * Create the IP+TCP header from scratch. 4564 */ 4565 if (m) 4566 m_freem(m); 4567 #ifdef DIAGNOSTIC 4568 if (max_linkhdr + tlen > MCLBYTES) 4569 return ENOBUFS; 4570 #endif 4571 4572 MGETHDR(m, M_DONTWAIT, MT_DATA); 4573 if (m && (max_linkhdr + tlen) > MHLEN) { 4574 MCLGET(m, M_DONTWAIT); 4575 if ((m->m_flags & M_EXT) == 0) { 4576 m_freem(m); 4577 m = NULL; 4578 } 4579 } 4580 if (m == NULL) 4581 return ENOBUFS; 4582 MCLAIM(m, &tcp_tx_mowner); 4583 4584 /* Fixup the mbuf. */ 4585 m->m_data += max_linkhdr; 4586 if (sc->sc_tp) 4587 tp = sc->sc_tp; 4588 m_reset_rcvif(m); 4589 memset(mtod(m, u_char *), 0, tlen); 4590 4591 switch (sc->sc_src.sa.sa_family) { 4592 case AF_INET: 4593 ip = mtod(m, struct ip *); 4594 ip->ip_v = 4; 4595 ip->ip_dst = sc->sc_src.sin.sin_addr; 4596 ip->ip_src = sc->sc_dst.sin.sin_addr; 4597 ip->ip_p = IPPROTO_TCP; 4598 th = (struct tcphdr *)(ip + 1); 4599 th->th_dport = sc->sc_src.sin.sin_port; 4600 th->th_sport = sc->sc_dst.sin.sin_port; 4601 break; 4602 #ifdef INET6 4603 case AF_INET6: 4604 ip6 = mtod(m, struct ip6_hdr *); 4605 ip6->ip6_vfc = IPV6_VERSION; 4606 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 4607 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 4608 ip6->ip6_nxt = IPPROTO_TCP; 4609 /* ip6_plen will be updated in ip6_output() */ 4610 th = (struct tcphdr *)(ip6 + 1); 4611 th->th_dport = sc->sc_src.sin6.sin6_port; 4612 th->th_sport = sc->sc_dst.sin6.sin6_port; 4613 break; 4614 #endif 4615 default: 4616 return ENOBUFS; 4617 } 4618 4619 th->th_seq = htonl(sc->sc_iss); 4620 th->th_ack = htonl(sc->sc_irs + 1); 4621 th->th_flags = TH_SYN|TH_ACK; 4622 th->th_win = htons(sc->sc_win); 4623 /* th_x2, th_sum, th_urp already 0 from memset */ 4624 4625 /* Tack on the TCP options. */ 4626 optp = (u_int8_t *)(th + 1); 4627 optlen = 0; 4628 *optp++ = TCPOPT_MAXSEG; 4629 *optp++ = TCPOLEN_MAXSEG; 4630 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 4631 *optp++ = sc->sc_ourmaxseg & 0xff; 4632 optlen += TCPOLEN_MAXSEG; 4633 4634 if (sc->sc_request_r_scale != 15) { 4635 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 4636 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 4637 sc->sc_request_r_scale); 4638 optp += TCPOLEN_WINDOW + TCPOLEN_NOP; 4639 optlen += TCPOLEN_WINDOW + TCPOLEN_NOP; 4640 } 4641 4642 if (sc->sc_flags & SCF_SACK_PERMIT) { 4643 /* Let the peer know that we will SACK. */ 4644 *optp++ = TCPOPT_SACK_PERMITTED; 4645 *optp++ = TCPOLEN_SACK_PERMITTED; 4646 optlen += TCPOLEN_SACK_PERMITTED; 4647 } 4648 4649 if (sc->sc_flags & SCF_TIMESTAMP) { 4650 while (optlen % 4 != 2) { 4651 optlen += TCPOLEN_NOP; 4652 *optp++ = TCPOPT_NOP; 4653 } 4654 *optp++ = TCPOPT_TIMESTAMP; 4655 *optp++ = TCPOLEN_TIMESTAMP; 4656 u_int32_t *lp = (u_int32_t *)(optp); 4657 /* Form timestamp option as shown in appendix A of RFC 1323. */ 4658 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc)); 4659 *lp = htonl(sc->sc_timestamp); 4660 optp += TCPOLEN_TIMESTAMP - 2; 4661 optlen += TCPOLEN_TIMESTAMP; 4662 } 4663 4664 #ifdef TCP_SIGNATURE 4665 if (sc->sc_flags & SCF_SIGNATURE) { 4666 4667 sav = tcp_signature_getsav(m, th); 4668 4669 if (sav == NULL) { 4670 if (m) 4671 m_freem(m); 4672 return (EPERM); 4673 } 4674 4675 *optp++ = TCPOPT_SIGNATURE; 4676 *optp++ = TCPOLEN_SIGNATURE; 4677 sigp = optp; 4678 memset(optp, 0, TCP_SIGLEN); 4679 optp += TCP_SIGLEN; 4680 optlen += TCPOLEN_SIGNATURE; 4681 4682 } 4683 #endif 4684 /* Terminate and pad TCP options to a 4 byte boundary. */ 4685 if (optlen % 4) { 4686 optlen += TCPOLEN_EOL; 4687 *optp++ = TCPOPT_EOL; 4688 } 4689 /* 4690 * According to RFC 793 (STD0007): 4691 * "The content of the header beyond the End-of-Option option 4692 * must be header padding (i.e., zero)." 4693 * and later: "The padding is composed of zeros." 4694 */ 4695 while (optlen % 4) { 4696 optlen += TCPOLEN_PAD; 4697 *optp++ = TCPOPT_PAD; 4698 } 4699 4700 /* compute the actual values now that we've added the options */ 4701 tlen = hlen + sizeof(struct tcphdr) + optlen; 4702 m->m_len = m->m_pkthdr.len = tlen; 4703 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 4704 4705 #ifdef TCP_SIGNATURE 4706 if (sav) { 4707 (void)tcp_signature(m, th, hlen, sav, sigp); 4708 key_sa_recordxfer(sav, m); 4709 KEY_FREESAV(&sav); 4710 } 4711 #endif 4712 4713 /* 4714 * Send ECN SYN-ACK setup packet. 4715 * Routes can be asymetric, so, even if we receive a packet 4716 * with ECE and CWR set, we must not assume no one will block 4717 * the ECE packet we are about to send. 4718 */ 4719 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp && 4720 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) { 4721 th->th_flags |= TH_ECE; 4722 TCP_STATINC(TCP_STAT_ECN_SHS); 4723 4724 /* 4725 * draft-ietf-tcpm-ecnsyn-00.txt 4726 * 4727 * "[...] a TCP node MAY respond to an ECN-setup 4728 * SYN packet by setting ECT in the responding 4729 * ECN-setup SYN/ACK packet, indicating to routers 4730 * that the SYN/ACK packet is ECN-Capable. 4731 * This allows a congested router along the path 4732 * to mark the packet instead of dropping the 4733 * packet as an indication of congestion." 4734 * 4735 * "[...] There can be a great benefit in setting 4736 * an ECN-capable codepoint in SYN/ACK packets [...] 4737 * Congestion is most likely to occur in 4738 * the server-to-client direction. As a result, 4739 * setting an ECN-capable codepoint in SYN/ACK 4740 * packets can reduce the occurence of three-second 4741 * retransmit timeouts resulting from the drop 4742 * of SYN/ACK packets." 4743 * 4744 * Page 4 and 6, January 2006. 4745 */ 4746 4747 switch (sc->sc_src.sa.sa_family) { 4748 #ifdef INET 4749 case AF_INET: 4750 ip->ip_tos |= IPTOS_ECN_ECT0; 4751 break; 4752 #endif 4753 #ifdef INET6 4754 case AF_INET6: 4755 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20); 4756 break; 4757 #endif 4758 } 4759 TCP_STATINC(TCP_STAT_ECN_ECT); 4760 } 4761 4762 4763 /* Compute the packet's checksum. */ 4764 switch (sc->sc_src.sa.sa_family) { 4765 case AF_INET: 4766 ip->ip_len = htons(tlen - hlen); 4767 th->th_sum = 0; 4768 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 4769 break; 4770 #ifdef INET6 4771 case AF_INET6: 4772 ip6->ip6_plen = htons(tlen - hlen); 4773 th->th_sum = 0; 4774 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 4775 break; 4776 #endif 4777 } 4778 4779 /* 4780 * Fill in some straggling IP bits. Note the stack expects 4781 * ip_len to be in host order, for convenience. 4782 */ 4783 switch (sc->sc_src.sa.sa_family) { 4784 #ifdef INET 4785 case AF_INET: 4786 ip->ip_len = htons(tlen); 4787 ip->ip_ttl = ip_defttl; 4788 /* XXX tos? */ 4789 break; 4790 #endif 4791 #ifdef INET6 4792 case AF_INET6: 4793 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 4794 ip6->ip6_vfc |= IPV6_VERSION; 4795 ip6->ip6_plen = htons(tlen - hlen); 4796 /* ip6_hlim will be initialized afterwards */ 4797 /* XXX flowlabel? */ 4798 break; 4799 #endif 4800 } 4801 4802 /* XXX use IPsec policy on listening socket, on SYN ACK */ 4803 tp = sc->sc_tp; 4804 4805 switch (sc->sc_src.sa.sa_family) { 4806 #ifdef INET 4807 case AF_INET: 4808 error = ip_output(m, sc->sc_ipopts, ro, 4809 (ip_mtudisc ? IP_MTUDISC : 0), 4810 NULL, tp ? tp->t_inpcb : NULL); 4811 break; 4812 #endif 4813 #ifdef INET6 4814 case AF_INET6: 4815 ip6->ip6_hlim = in6_selecthlim(NULL, 4816 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp : NULL); 4817 rtcache_unref(rt, ro); 4818 4819 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, 4820 tp ? tp->t_in6pcb : NULL, NULL); 4821 break; 4822 #endif 4823 default: 4824 error = EAFNOSUPPORT; 4825 break; 4826 } 4827 return (error); 4828 } 4829
Indexes created Wed Sep 24 05:09:52 GMT 2025