Home | History | Annotate | Line # | Download | only in netinet
tcp_input.c revision 1.51
      1 /*	$NetBSD: tcp_input.c,v 1.51 1998/04/13 21:18:19 kml Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
      9  * Facility, NASA Ames Research Center.
     10  *
     11  * Redistribution and use in source and binary forms, with or without
     12  * modification, are permitted provided that the following conditions
     13  * are met:
     14  * 1. Redistributions of source code must retain the above copyright
     15  *    notice, this list of conditions and the following disclaimer.
     16  * 2. Redistributions in binary form must reproduce the above copyright
     17  *    notice, this list of conditions and the following disclaimer in the
     18  *    documentation and/or other materials provided with the distribution.
     19  * 3. All advertising materials mentioning features or use of this software
     20  *    must display the following acknowledgement:
     21  *	This product includes software developed by the NetBSD
     22  *	Foundation, Inc. and its contributors.
     23  * 4. Neither the name of The NetBSD Foundation nor the names of its
     24  *    contributors may be used to endorse or promote products derived
     25  *    from this software without specific prior written permission.
     26  *
     27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     37  * POSSIBILITY OF SUCH DAMAGE.
     38  */
     39 
     40 /*
     41  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
     42  *	The Regents of the University of California.  All rights reserved.
     43  *
     44  * Redistribution and use in source and binary forms, with or without
     45  * modification, are permitted provided that the following conditions
     46  * are met:
     47  * 1. Redistributions of source code must retain the above copyright
     48  *    notice, this list of conditions and the following disclaimer.
     49  * 2. Redistributions in binary form must reproduce the above copyright
     50  *    notice, this list of conditions and the following disclaimer in the
     51  *    documentation and/or other materials provided with the distribution.
     52  * 3. All advertising materials mentioning features or use of this software
     53  *    must display the following acknowledgement:
     54  *	This product includes software developed by the University of
     55  *	California, Berkeley and its contributors.
     56  * 4. Neither the name of the University nor the names of its contributors
     57  *    may be used to endorse or promote products derived from this software
     58  *    without specific prior written permission.
     59  *
     60  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     61  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     62  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     63  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     64  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     65  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     66  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     67  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     68  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     69  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     70  * SUCH DAMAGE.
     71  *
     72  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
     73  */
     74 
     75 /*
     76  *	TODO list for SYN cache stuff:
     77  *
     78  *	Find room for a "state" field, which is needed to keep a
     79  *	compressed state for TIME_WAIT TCBs.  It's been noted already
     80  *	that this is fairly important for very high-volume web and
     81  *	mail servers, which use a large number of short-lived
     82  *	connections.
     83  */
     84 
     85 #ifndef TUBA_INCLUDE
     86 #include <sys/param.h>
     87 #include <sys/systm.h>
     88 #include <sys/malloc.h>
     89 #include <sys/mbuf.h>
     90 #include <sys/protosw.h>
     91 #include <sys/socket.h>
     92 #include <sys/socketvar.h>
     93 #include <sys/errno.h>
     94 
     95 #include <net/if.h>
     96 #include <net/route.h>
     97 
     98 #include <netinet/in.h>
     99 #include <netinet/in_systm.h>
    100 #include <netinet/ip.h>
    101 #include <netinet/in_pcb.h>
    102 #include <netinet/ip_var.h>
    103 #include <netinet/tcp.h>
    104 #include <netinet/tcp_fsm.h>
    105 #include <netinet/tcp_seq.h>
    106 #include <netinet/tcp_timer.h>
    107 #include <netinet/tcp_var.h>
    108 #include <netinet/tcpip.h>
    109 #include <netinet/tcp_debug.h>
    110 
    111 #include <machine/stdarg.h>
    112 
    113 int	tcprexmtthresh = 3;
    114 struct	tcpiphdr tcp_saveti;
    115 
    116 extern u_long sb_max;
    117 
    118 #endif /* TUBA_INCLUDE */
    119 #define TCP_PAWS_IDLE	(24 * 24 * 60 * 60 * PR_SLOWHZ)
    120 
    121 /* for modulo comparisons of timestamps */
    122 #define TSTMP_LT(a,b)	((int)((a)-(b)) < 0)
    123 #define TSTMP_GEQ(a,b)	((int)((a)-(b)) >= 0)
    124 
    125 /*
    126  * Macro to compute ACK transmission behavior.  Delay the ACK unless
    127  * we have already delayed an ACK (must send an ACK every two segments).
    128  */
    129 #define	TCP_SETUP_ACK(tp, ti) \
    130 do { \
    131 	if ((tp)->t_flags & TF_DELACK) \
    132 		tp->t_flags |= TF_ACKNOW; \
    133 	else \
    134 		TCP_SET_DELACK(tp); \
    135 } while (0)
    136 
    137 /*
    138  * Insert segment ti into reassembly queue of tcp with
    139  * control block tp.  Return TH_FIN if reassembly now includes
    140  * a segment with FIN.  The macro form does the common case inline
    141  * (segment is the next to be received on an established connection,
    142  * and the queue is empty), avoiding linkage into and removal
    143  * from the queue and repetition of various conversions.
    144  * Set DELACK for segments received in order, but ack immediately
    145  * when segments are out of order (so fast retransmit can work).
    146  */
    147 #define	TCP_REASS(tp, ti, m, so, flags) { \
    148 	if ((ti)->ti_seq == (tp)->rcv_nxt && \
    149 	    (tp)->segq.lh_first == NULL && \
    150 	    (tp)->t_state == TCPS_ESTABLISHED) { \
    151 		TCP_SETUP_ACK(tp, ti); \
    152 		(tp)->rcv_nxt += (ti)->ti_len; \
    153 		flags = (ti)->ti_flags & TH_FIN; \
    154 		tcpstat.tcps_rcvpack++;\
    155 		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
    156 		sbappend(&(so)->so_rcv, (m)); \
    157 		sorwakeup(so); \
    158 	} else { \
    159 		(flags) = tcp_reass((tp), (ti), (m)); \
    160 		tp->t_flags |= TF_ACKNOW; \
    161 	} \
    162 }
    163 #ifndef TUBA_INCLUDE
    164 
    165 int
    166 tcp_reass(tp, ti, m)
    167 	register struct tcpcb *tp;
    168 	register struct tcpiphdr *ti;
    169 	struct mbuf *m;
    170 {
    171 	register struct ipqent *p, *q, *nq, *tiqe;
    172 	struct socket *so = tp->t_inpcb->inp_socket;
    173 	int flags;
    174 
    175 	/*
    176 	 * Call with ti==0 after become established to
    177 	 * force pre-ESTABLISHED data up to user socket.
    178 	 */
    179 	if (ti == 0)
    180 		goto present;
    181 
    182 	/*
    183 	 * Allocate a new queue entry, before we throw away any data.
    184 	 * If we can't, just drop the packet.  XXX
    185 	 */
    186 	MALLOC(tiqe, struct ipqent *, sizeof (struct ipqent), M_IPQ, M_NOWAIT);
    187 	if (tiqe == NULL) {
    188 		tcpstat.tcps_rcvmemdrop++;
    189 		m_freem(m);
    190 		return (0);
    191 	}
    192 
    193 	/*
    194 	 * Find a segment which begins after this one does.
    195 	 */
    196 	for (p = NULL, q = tp->segq.lh_first; q != NULL;
    197 	    p = q, q = q->ipqe_q.le_next)
    198 		if (SEQ_GT(q->ipqe_tcp->ti_seq, ti->ti_seq))
    199 			break;
    200 
    201 	/*
    202 	 * If there is a preceding segment, it may provide some of
    203 	 * our data already.  If so, drop the data from the incoming
    204 	 * segment.  If it provides all of our data, drop us.
    205 	 */
    206 	if (p != NULL) {
    207 		register struct tcpiphdr *phdr = p->ipqe_tcp;
    208 		register int i;
    209 
    210 		/* conversion to int (in i) handles seq wraparound */
    211 		i = phdr->ti_seq + phdr->ti_len - ti->ti_seq;
    212 		if (i > 0) {
    213 			if (i >= ti->ti_len) {
    214 				tcpstat.tcps_rcvduppack++;
    215 				tcpstat.tcps_rcvdupbyte += ti->ti_len;
    216 				m_freem(m);
    217 				FREE(tiqe, M_IPQ);
    218 				return (0);
    219 			}
    220 			m_adj(m, i);
    221 			ti->ti_len -= i;
    222 			ti->ti_seq += i;
    223 		}
    224 	}
    225 	tcpstat.tcps_rcvoopack++;
    226 	tcpstat.tcps_rcvoobyte += ti->ti_len;
    227 
    228 	/*
    229 	 * While we overlap succeeding segments trim them or,
    230 	 * if they are completely covered, dequeue them.
    231 	 */
    232 	for (; q != NULL; q = nq) {
    233 		register struct tcpiphdr *qhdr = q->ipqe_tcp;
    234 		register int i = (ti->ti_seq + ti->ti_len) - qhdr->ti_seq;
    235 
    236 		if (i <= 0)
    237 			break;
    238 		if (i < qhdr->ti_len) {
    239 			qhdr->ti_seq += i;
    240 			qhdr->ti_len -= i;
    241 			m_adj(q->ipqe_m, i);
    242 			break;
    243 		}
    244 		nq = q->ipqe_q.le_next;
    245 		m_freem(q->ipqe_m);
    246 		LIST_REMOVE(q, ipqe_q);
    247 		FREE(q, M_IPQ);
    248 	}
    249 
    250 	/* Insert the new fragment queue entry into place. */
    251 	tiqe->ipqe_m = m;
    252 	tiqe->ipqe_tcp = ti;
    253 	if (p == NULL) {
    254 		LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
    255 	} else {
    256 		LIST_INSERT_AFTER(p, tiqe, ipqe_q);
    257 	}
    258 
    259 present:
    260 	/*
    261 	 * Present data to user, advancing rcv_nxt through
    262 	 * completed sequence space.
    263 	 */
    264 	if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
    265 		return (0);
    266 	q = tp->segq.lh_first;
    267 	if (q == NULL || q->ipqe_tcp->ti_seq != tp->rcv_nxt)
    268 		return (0);
    269 	if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_tcp->ti_len)
    270 		return (0);
    271 	do {
    272 		tp->rcv_nxt += q->ipqe_tcp->ti_len;
    273 		flags = q->ipqe_tcp->ti_flags & TH_FIN;
    274 
    275 		nq = q->ipqe_q.le_next;
    276 		LIST_REMOVE(q, ipqe_q);
    277 		if (so->so_state & SS_CANTRCVMORE)
    278 			m_freem(q->ipqe_m);
    279 		else
    280 			sbappend(&so->so_rcv, q->ipqe_m);
    281 		FREE(q, M_IPQ);
    282 		q = nq;
    283 	} while (q != NULL && q->ipqe_tcp->ti_seq == tp->rcv_nxt);
    284 	sorwakeup(so);
    285 	return (flags);
    286 }
    287 
    288 /*
    289  * TCP input routine, follows pages 65-76 of the
    290  * protocol specification dated September, 1981 very closely.
    291  */
    292 void
    293 #if __STDC__
    294 tcp_input(struct mbuf *m, ...)
    295 #else
    296 tcp_input(m, va_alist)
    297 	register struct mbuf *m;
    298 #endif
    299 {
    300 	register struct tcpiphdr *ti;
    301 	register struct inpcb *inp;
    302 	caddr_t optp = NULL;
    303 	int optlen = 0;
    304 	int len, tlen, off, hdroptlen;
    305 	register struct tcpcb *tp = 0;
    306 	register int tiflags;
    307 	struct socket *so = NULL;
    308 	int todrop, acked, ourfinisacked, needoutput = 0;
    309 	short ostate = 0;
    310 	int iss = 0;
    311 	u_long tiwin;
    312 	struct tcp_opt_info opti;
    313 	int iphlen;
    314 	va_list ap;
    315 
    316 	va_start(ap, m);
    317 	iphlen = va_arg(ap, int);
    318 	va_end(ap);
    319 
    320 	tcpstat.tcps_rcvtotal++;
    321 
    322 	opti.ts_present = 0;
    323 	opti.maxseg = 0;
    324 
    325 	/*
    326 	 * Get IP and TCP header together in first mbuf.
    327 	 * Note: IP leaves IP header in first mbuf.
    328 	 */
    329 	ti = mtod(m, struct tcpiphdr *);
    330 	if (iphlen > sizeof (struct ip))
    331 		ip_stripoptions(m, (struct mbuf *)0);
    332 	if (m->m_len < sizeof (struct tcpiphdr)) {
    333 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
    334 			tcpstat.tcps_rcvshort++;
    335 			return;
    336 		}
    337 		ti = mtod(m, struct tcpiphdr *);
    338 	}
    339 
    340 	/*
    341 	 * Checksum extended TCP header and data.
    342 	 */
    343 	tlen = ((struct ip *)ti)->ip_len;
    344 	len = sizeof (struct ip) + tlen;
    345 	bzero(ti->ti_x1, sizeof ti->ti_x1);
    346 	ti->ti_len = (u_int16_t)tlen;
    347 	HTONS(ti->ti_len);
    348 	if ((ti->ti_sum = in_cksum(m, len)) != 0) {
    349 		tcpstat.tcps_rcvbadsum++;
    350 		goto drop;
    351 	}
    352 #endif /* TUBA_INCLUDE */
    353 
    354 	/*
    355 	 * Check that TCP offset makes sense,
    356 	 * pull out TCP options and adjust length.		XXX
    357 	 */
    358 	off = ti->ti_off << 2;
    359 	if (off < sizeof (struct tcphdr) || off > tlen) {
    360 		tcpstat.tcps_rcvbadoff++;
    361 		goto drop;
    362 	}
    363 	tlen -= off;
    364 	ti->ti_len = tlen;
    365 	if (off > sizeof (struct tcphdr)) {
    366 		if (m->m_len < sizeof(struct ip) + off) {
    367 			if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
    368 				tcpstat.tcps_rcvshort++;
    369 				return;
    370 			}
    371 			ti = mtod(m, struct tcpiphdr *);
    372 		}
    373 		optlen = off - sizeof (struct tcphdr);
    374 		optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
    375 		/*
    376 		 * Do quick retrieval of timestamp options ("options
    377 		 * prediction?").  If timestamp is the only option and it's
    378 		 * formatted as recommended in RFC 1323 appendix A, we
    379 		 * quickly get the values now and not bother calling
    380 		 * tcp_dooptions(), etc.
    381 		 */
    382 		if ((optlen == TCPOLEN_TSTAMP_APPA ||
    383 		     (optlen > TCPOLEN_TSTAMP_APPA &&
    384 			optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
    385 		     *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
    386 		     (ti->ti_flags & TH_SYN) == 0) {
    387 			opti.ts_present = 1;
    388 			opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
    389 			opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
    390 			optp = NULL;	/* we've parsed the options */
    391 		}
    392 	}
    393 	tiflags = ti->ti_flags;
    394 
    395 	/*
    396 	 * Convert TCP protocol specific fields to host format.
    397 	 */
    398 	NTOHL(ti->ti_seq);
    399 	NTOHL(ti->ti_ack);
    400 	NTOHS(ti->ti_win);
    401 	NTOHS(ti->ti_urp);
    402 
    403 	/*
    404 	 * Locate pcb for segment.
    405 	 */
    406 findpcb:
    407 	inp = in_pcblookup_connect(&tcbtable, ti->ti_src, ti->ti_sport,
    408 	    ti->ti_dst, ti->ti_dport);
    409 	if (inp == 0) {
    410 		++tcpstat.tcps_pcbhashmiss;
    411 		inp = in_pcblookup_bind(&tcbtable, ti->ti_dst, ti->ti_dport);
    412 		if (inp == 0) {
    413 			++tcpstat.tcps_noport;
    414 			goto dropwithreset;
    415 		}
    416 	}
    417 
    418 	/*
    419 	 * If the state is CLOSED (i.e., TCB does not exist) then
    420 	 * all data in the incoming segment is discarded.
    421 	 * If the TCB exists but is in CLOSED state, it is embryonic,
    422 	 * but should either do a listen or a connect soon.
    423 	 */
    424 	tp = intotcpcb(inp);
    425 	if (tp == 0)
    426 		goto dropwithreset;
    427 	if (tp->t_state == TCPS_CLOSED)
    428 		goto drop;
    429 
    430 	/* Unscale the window into a 32-bit value. */
    431 	if ((tiflags & TH_SYN) == 0)
    432 		tiwin = ti->ti_win << tp->snd_scale;
    433 	else
    434 		tiwin = ti->ti_win;
    435 
    436 	so = inp->inp_socket;
    437 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
    438 		if (so->so_options & SO_DEBUG) {
    439 			ostate = tp->t_state;
    440 			tcp_saveti = *ti;
    441 		}
    442 		if (so->so_options & SO_ACCEPTCONN) {
    443   			if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
    444 				if (tiflags & TH_RST) {
    445 					syn_cache_reset(ti);
    446 				} else if ((tiflags & (TH_ACK|TH_SYN)) ==
    447 				    (TH_ACK|TH_SYN)) {
    448 					/*
    449 					 * Received a SYN,ACK.  This should
    450 					 * never happen while we are in
    451 					 * LISTEN.  Send an RST.
    452 					 */
    453 					goto badsyn;
    454 				} else if (tiflags & TH_ACK) {
    455 					so = syn_cache_get(so, m);
    456 					if (so == NULL) {
    457 						/*
    458 						 * We don't have a SYN for
    459 						 * this ACK; send an RST.
    460 						 */
    461 						goto badsyn;
    462 					} else if (so ==
    463 					    (struct socket *)(-1)) {
    464 						/*
    465 						 * We were unable to create
    466 						 * the connection.  If the
    467 						 * 3-way handshake was
    468 						 * completeed, and RST has
    469 						 * been sent to the peer.
    470 						 * Since the mbuf might be
    471 						 * in use for the reply,
    472 						 * do not free it.
    473 						 */
    474 						m = NULL;
    475 					} else {
    476 						/*
    477 						 * We have created a
    478 						 * full-blown connection.
    479 						 */
    480 						inp = sotoinpcb(so);
    481 						tp = intotcpcb(inp);
    482 						tiwin <<= tp->snd_scale;
    483 						goto after_listen;
    484 					}
    485   				}
    486   			} else {
    487 				/*
    488 				 * Received a SYN.
    489 				 */
    490 				if (in_hosteq(ti->ti_src, ti->ti_dst) &&
    491 				    ti->ti_sport == ti->ti_dport) {
    492 					/*
    493 					 * LISTEN socket received a SYN
    494 					 * from itself?  This can't possibly
    495 					 * be valid; drop the packet.
    496 					 */
    497 					tcpstat.tcps_badsyn++;
    498 					goto drop;
    499 				}
    500 				/*
    501 				 * SYN looks ok; create compressed TCP
    502 				 * state for it.
    503 				 */
    504 				if (so->so_qlen <= so->so_qlimit &&
    505 				    syn_cache_add(so, m, optp, optlen, &opti))
    506 					m = NULL;
    507 			}
    508 			goto drop;
    509 		}
    510 	}
    511 
    512 after_listen:
    513 #ifdef DIAGNOSTIC
    514 	/*
    515 	 * Should not happen now that all embryonic connections
    516 	 * are handled with compressed state.
    517 	 */
    518 	if (tp->t_state == TCPS_LISTEN)
    519 		panic("tcp_input: TCPS_LISTEN");
    520 #endif
    521 
    522 	/*
    523 	 * Segment received on connection.
    524 	 * Reset idle time and keep-alive timer.
    525 	 */
    526 	tp->t_idle = 0;
    527 	if (TCPS_HAVEESTABLISHED(tp->t_state))
    528 		tp->t_timer[TCPT_KEEP] = tcp_keepidle;
    529 
    530 	/*
    531 	 * Process options.
    532 	 */
    533 	if (optp)
    534 		tcp_dooptions(tp, optp, optlen, ti, &opti);
    535 
    536 	/*
    537 	 * Header prediction: check for the two common cases
    538 	 * of a uni-directional data xfer.  If the packet has
    539 	 * no control flags, is in-sequence, the window didn't
    540 	 * change and we're not retransmitting, it's a
    541 	 * candidate.  If the length is zero and the ack moved
    542 	 * forward, we're the sender side of the xfer.  Just
    543 	 * free the data acked & wake any higher level process
    544 	 * that was blocked waiting for space.  If the length
    545 	 * is non-zero and the ack didn't move, we're the
    546 	 * receiver side.  If we're getting packets in-order
    547 	 * (the reassembly queue is empty), add the data to
    548 	 * the socket buffer and note that we need a delayed ack.
    549 	 */
    550 	if (tp->t_state == TCPS_ESTABLISHED &&
    551 	    (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
    552 	    (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
    553 	    ti->ti_seq == tp->rcv_nxt &&
    554 	    tiwin && tiwin == tp->snd_wnd &&
    555 	    tp->snd_nxt == tp->snd_max) {
    556 
    557 		/*
    558 		 * If last ACK falls within this segment's sequence numbers,
    559 		 *  record the timestamp.
    560 		 */
    561 		if (opti.ts_present &&
    562 		    SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
    563 		    SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len)) {
    564 			tp->ts_recent_age = tcp_now;
    565 			tp->ts_recent = opti.ts_val;
    566 		}
    567 
    568 		if (ti->ti_len == 0) {
    569 			if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
    570 			    SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
    571 			    tp->snd_cwnd >= tp->snd_wnd &&
    572 			    tp->t_dupacks < tcprexmtthresh) {
    573 				/*
    574 				 * this is a pure ack for outstanding data.
    575 				 */
    576 				++tcpstat.tcps_predack;
    577 				if (opti.ts_present)
    578 					tcp_xmit_timer(tp,
    579 					    tcp_now-opti.ts_ecr+1);
    580 				else if (tp->t_rtt &&
    581 				    SEQ_GT(ti->ti_ack, tp->t_rtseq))
    582 					tcp_xmit_timer(tp, tp->t_rtt);
    583 				acked = ti->ti_ack - tp->snd_una;
    584 				tcpstat.tcps_rcvackpack++;
    585 				tcpstat.tcps_rcvackbyte += acked;
    586 				sbdrop(&so->so_snd, acked);
    587 				tp->snd_una = ti->ti_ack;
    588 				m_freem(m);
    589 
    590 				/*
    591 				 * If all outstanding data are acked, stop
    592 				 * retransmit timer, otherwise restart timer
    593 				 * using current (possibly backed-off) value.
    594 				 * If process is waiting for space,
    595 				 * wakeup/selwakeup/signal.  If data
    596 				 * are ready to send, let tcp_output
    597 				 * decide between more output or persist.
    598 				 */
    599 				if (tp->snd_una == tp->snd_max)
    600 					tp->t_timer[TCPT_REXMT] = 0;
    601 				else if (tp->t_timer[TCPT_PERSIST] == 0)
    602 					tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
    603 
    604 				if (sb_notify(&so->so_snd))
    605 					sowwakeup(so);
    606 				if (so->so_snd.sb_cc)
    607 					(void) tcp_output(tp);
    608 				return;
    609 			}
    610 		} else if (ti->ti_ack == tp->snd_una &&
    611 		    tp->segq.lh_first == NULL &&
    612 		    ti->ti_len <= sbspace(&so->so_rcv)) {
    613 			/*
    614 			 * this is a pure, in-sequence data packet
    615 			 * with nothing on the reassembly queue and
    616 			 * we have enough buffer space to take it.
    617 			 */
    618 			++tcpstat.tcps_preddat;
    619 			tp->rcv_nxt += ti->ti_len;
    620 			tcpstat.tcps_rcvpack++;
    621 			tcpstat.tcps_rcvbyte += ti->ti_len;
    622 			/*
    623 			 * Drop TCP, IP headers and TCP options then add data
    624 			 * to socket buffer.
    625 			 */
    626 			m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
    627 			m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
    628 			sbappend(&so->so_rcv, m);
    629 			sorwakeup(so);
    630 			TCP_SETUP_ACK(tp, ti);
    631 			if (tp->t_flags & TF_ACKNOW)
    632 				(void) tcp_output(tp);
    633 			return;
    634 		}
    635 	}
    636 
    637 	/*
    638 	 * Drop TCP, IP headers and TCP options.
    639 	 */
    640 	hdroptlen  = sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
    641 	m->m_data += hdroptlen;
    642 	m->m_len  -= hdroptlen;
    643 
    644 	/*
    645 	 * Calculate amount of space in receive window,
    646 	 * and then do TCP input processing.
    647 	 * Receive window is amount of space in rcv queue,
    648 	 * but not less than advertised window.
    649 	 */
    650 	{ int win;
    651 
    652 	win = sbspace(&so->so_rcv);
    653 	if (win < 0)
    654 		win = 0;
    655 	tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
    656 	}
    657 
    658 	switch (tp->t_state) {
    659 
    660 	/*
    661 	 * If the state is SYN_SENT:
    662 	 *	if seg contains an ACK, but not for our SYN, drop the input.
    663 	 *	if seg contains a RST, then drop the connection.
    664 	 *	if seg does not contain SYN, then drop it.
    665 	 * Otherwise this is an acceptable SYN segment
    666 	 *	initialize tp->rcv_nxt and tp->irs
    667 	 *	if seg contains ack then advance tp->snd_una
    668 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
    669 	 *	arrange for segment to be acked (eventually)
    670 	 *	continue processing rest of data/controls, beginning with URG
    671 	 */
    672 	case TCPS_SYN_SENT:
    673 		if ((tiflags & TH_ACK) &&
    674 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
    675 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
    676 			goto dropwithreset;
    677 		if (tiflags & TH_RST) {
    678 			if (tiflags & TH_ACK)
    679 				tp = tcp_drop(tp, ECONNREFUSED);
    680 			goto drop;
    681 		}
    682 		if ((tiflags & TH_SYN) == 0)
    683 			goto drop;
    684 		if (tiflags & TH_ACK) {
    685 			tp->snd_una = ti->ti_ack;
    686 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
    687 				tp->snd_nxt = tp->snd_una;
    688 		}
    689 		tp->t_timer[TCPT_REXMT] = 0;
    690 		tp->irs = ti->ti_seq;
    691 		tcp_rcvseqinit(tp);
    692 		tp->t_flags |= TF_ACKNOW;
    693 		tcp_mss_from_peer(tp, opti.maxseg);
    694 
    695 		/*
    696 		 * Initialize the initial congestion window.  If we
    697 		 * had to retransmit the SYN, we must initialize cwnd
    698 		 * to 1 segment.
    699 		 */
    700 		tp->snd_cwnd =
    701 		    TCP_INITIAL_WINDOW((tp->t_flags & TF_SYN_REXMT) ? 1 :
    702 		    tcp_init_win, tp->t_peermss);
    703 
    704 		tcp_rmx_rtt(tp);
    705 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
    706 			tcpstat.tcps_connects++;
    707 			soisconnected(so);
    708 			tcp_established(tp);
    709 			/* Do window scaling on this connection? */
    710 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
    711 				(TF_RCVD_SCALE|TF_REQ_SCALE)) {
    712 				tp->snd_scale = tp->requested_s_scale;
    713 				tp->rcv_scale = tp->request_r_scale;
    714 			}
    715 			(void) tcp_reass(tp, (struct tcpiphdr *)0,
    716 				(struct mbuf *)0);
    717 			/*
    718 			 * if we didn't have to retransmit the SYN,
    719 			 * use its rtt as our initial srtt & rtt var.
    720 			 */
    721 			if (tp->t_rtt)
    722 				tcp_xmit_timer(tp, tp->t_rtt);
    723 		} else
    724 			tp->t_state = TCPS_SYN_RECEIVED;
    725 
    726 		/*
    727 		 * Advance ti->ti_seq to correspond to first data byte.
    728 		 * If data, trim to stay within window,
    729 		 * dropping FIN if necessary.
    730 		 */
    731 		ti->ti_seq++;
    732 		if (ti->ti_len > tp->rcv_wnd) {
    733 			todrop = ti->ti_len - tp->rcv_wnd;
    734 			m_adj(m, -todrop);
    735 			ti->ti_len = tp->rcv_wnd;
    736 			tiflags &= ~TH_FIN;
    737 			tcpstat.tcps_rcvpackafterwin++;
    738 			tcpstat.tcps_rcvbyteafterwin += todrop;
    739 		}
    740 		tp->snd_wl1 = ti->ti_seq - 1;
    741 		tp->rcv_up = ti->ti_seq;
    742 		goto step6;
    743 
    744 	/*
    745 	 * If the state is SYN_RECEIVED:
    746 	 *	If seg contains an ACK, but not for our SYN, drop the input
    747 	 *	and generate an RST.  See page 36, rfc793
    748 	 */
    749 	case TCPS_SYN_RECEIVED:
    750 		if ((tiflags & TH_ACK) &&
    751 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
    752 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
    753 			goto dropwithreset;
    754 		break;
    755 	}
    756 
    757 	/*
    758 	 * States other than LISTEN or SYN_SENT.
    759 	 * First check timestamp, if present.
    760 	 * Then check that at least some bytes of segment are within
    761 	 * receive window.  If segment begins before rcv_nxt,
    762 	 * drop leading data (and SYN); if nothing left, just ack.
    763 	 *
    764 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
    765 	 * and it's less than ts_recent, drop it.
    766 	 */
    767 	if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
    768 	    TSTMP_LT(opti.ts_val, tp->ts_recent)) {
    769 
    770 		/* Check to see if ts_recent is over 24 days old.  */
    771 		if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) {
    772 			/*
    773 			 * Invalidate ts_recent.  If this segment updates
    774 			 * ts_recent, the age will be reset later and ts_recent
    775 			 * will get a valid value.  If it does not, setting
    776 			 * ts_recent to zero will at least satisfy the
    777 			 * requirement that zero be placed in the timestamp
    778 			 * echo reply when ts_recent isn't valid.  The
    779 			 * age isn't reset until we get a valid ts_recent
    780 			 * because we don't want out-of-order segments to be
    781 			 * dropped when ts_recent is old.
    782 			 */
    783 			tp->ts_recent = 0;
    784 		} else {
    785 			tcpstat.tcps_rcvduppack++;
    786 			tcpstat.tcps_rcvdupbyte += ti->ti_len;
    787 			tcpstat.tcps_pawsdrop++;
    788 			goto dropafterack;
    789 		}
    790 	}
    791 
    792 	todrop = tp->rcv_nxt - ti->ti_seq;
    793 	if (todrop > 0) {
    794 		if (tiflags & TH_SYN) {
    795 			tiflags &= ~TH_SYN;
    796 			ti->ti_seq++;
    797 			if (ti->ti_urp > 1)
    798 				ti->ti_urp--;
    799 			else {
    800 				tiflags &= ~TH_URG;
    801 				ti->ti_urp = 0;
    802 			}
    803 			todrop--;
    804 		}
    805 		if (todrop > ti->ti_len ||
    806 		    (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) {
    807 			/*
    808 			 * Any valid FIN must be to the left of the window.
    809 			 * At this point the FIN must be a duplicate or
    810 			 * out of sequence; drop it.
    811 			 */
    812 			tiflags &= ~TH_FIN;
    813 			/*
    814 			 * Send an ACK to resynchronize and drop any data.
    815 			 * But keep on processing for RST or ACK.
    816 			 */
    817 			tp->t_flags |= TF_ACKNOW;
    818 			todrop = ti->ti_len;
    819 			tcpstat.tcps_rcvdupbyte += todrop;
    820 			tcpstat.tcps_rcvduppack++;
    821 		} else {
    822 			tcpstat.tcps_rcvpartduppack++;
    823 			tcpstat.tcps_rcvpartdupbyte += todrop;
    824 		}
    825 		m_adj(m, todrop);
    826 		ti->ti_seq += todrop;
    827 		ti->ti_len -= todrop;
    828 		if (ti->ti_urp > todrop)
    829 			ti->ti_urp -= todrop;
    830 		else {
    831 			tiflags &= ~TH_URG;
    832 			ti->ti_urp = 0;
    833 		}
    834 	}
    835 
    836 	/*
    837 	 * If new data are received on a connection after the
    838 	 * user processes are gone, then RST the other end.
    839 	 */
    840 	if ((so->so_state & SS_NOFDREF) &&
    841 	    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
    842 		tp = tcp_close(tp);
    843 		tcpstat.tcps_rcvafterclose++;
    844 		goto dropwithreset;
    845 	}
    846 
    847 	/*
    848 	 * If segment ends after window, drop trailing data
    849 	 * (and PUSH and FIN); if nothing left, just ACK.
    850 	 */
    851 	todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
    852 	if (todrop > 0) {
    853 		tcpstat.tcps_rcvpackafterwin++;
    854 		if (todrop >= ti->ti_len) {
    855 			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
    856 			/*
    857 			 * If a new connection request is received
    858 			 * while in TIME_WAIT, drop the old connection
    859 			 * and start over if the sequence numbers
    860 			 * are above the previous ones.
    861 			 */
    862 			if (tiflags & TH_SYN &&
    863 			    tp->t_state == TCPS_TIME_WAIT &&
    864 			    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
    865 				iss = tcp_new_iss(tp, sizeof(struct tcpcb),
    866 						  tp->rcv_nxt);
    867 				tp = tcp_close(tp);
    868 				/*
    869 				 * We have already advanced the mbuf
    870 				 * pointers past the IP+TCP headers and
    871 				 * options.  Restore those pointers before
    872 				 * attempting to use the TCP header again.
    873 				 */
    874 				m->m_data -= hdroptlen;
    875 				m->m_len  += hdroptlen;
    876 				goto findpcb;
    877 			}
    878 			/*
    879 			 * If window is closed can only take segments at
    880 			 * window edge, and have to drop data and PUSH from
    881 			 * incoming segments.  Continue processing, but
    882 			 * remember to ack.  Otherwise, drop segment
    883 			 * and ack.
    884 			 */
    885 			if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
    886 				tp->t_flags |= TF_ACKNOW;
    887 				tcpstat.tcps_rcvwinprobe++;
    888 			} else
    889 				goto dropafterack;
    890 		} else
    891 			tcpstat.tcps_rcvbyteafterwin += todrop;
    892 		m_adj(m, -todrop);
    893 		ti->ti_len -= todrop;
    894 		tiflags &= ~(TH_PUSH|TH_FIN);
    895 	}
    896 
    897 	/*
    898 	 * If last ACK falls within this segment's sequence numbers,
    899 	 * record its timestamp.
    900 	 */
    901 	if (opti.ts_present && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
    902 	    SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len +
    903 		   ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
    904 		tp->ts_recent_age = tcp_now;
    905 		tp->ts_recent = opti.ts_val;
    906 	}
    907 
    908 	/*
    909 	 * If the RST bit is set examine the state:
    910 	 *    SYN_RECEIVED STATE:
    911 	 *	If passive open, return to LISTEN state.
    912 	 *	If active open, inform user that connection was refused.
    913 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
    914 	 *	Inform user that connection was reset, and close tcb.
    915 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
    916 	 *	Close the tcb.
    917 	 */
    918 	if (tiflags&TH_RST) switch (tp->t_state) {
    919 
    920 	case TCPS_SYN_RECEIVED:
    921 		so->so_error = ECONNREFUSED;
    922 		goto close;
    923 
    924 	case TCPS_ESTABLISHED:
    925 	case TCPS_FIN_WAIT_1:
    926 	case TCPS_FIN_WAIT_2:
    927 	case TCPS_CLOSE_WAIT:
    928 		so->so_error = ECONNRESET;
    929 	close:
    930 		tp->t_state = TCPS_CLOSED;
    931 		tcpstat.tcps_drops++;
    932 		tp = tcp_close(tp);
    933 		goto drop;
    934 
    935 	case TCPS_CLOSING:
    936 	case TCPS_LAST_ACK:
    937 	case TCPS_TIME_WAIT:
    938 		tp = tcp_close(tp);
    939 		goto drop;
    940 	}
    941 
    942 	/*
    943 	 * If a SYN is in the window, then this is an
    944 	 * error and we send an RST and drop the connection.
    945 	 */
    946 	if (tiflags & TH_SYN) {
    947 		tp = tcp_drop(tp, ECONNRESET);
    948 		goto dropwithreset;
    949 	}
    950 
    951 	/*
    952 	 * If the ACK bit is off we drop the segment and return.
    953 	 */
    954 	if ((tiflags & TH_ACK) == 0)
    955 		goto drop;
    956 
    957 	/*
    958 	 * Ack processing.
    959 	 */
    960 	switch (tp->t_state) {
    961 
    962 	/*
    963 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
    964 	 * ESTABLISHED state and continue processing, otherwise
    965 	 * send an RST.
    966 	 */
    967 	case TCPS_SYN_RECEIVED:
    968 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
    969 		    SEQ_GT(ti->ti_ack, tp->snd_max))
    970 			goto dropwithreset;
    971 		tcpstat.tcps_connects++;
    972 		soisconnected(so);
    973 		tcp_established(tp);
    974 		/* Do window scaling? */
    975 		if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
    976 			(TF_RCVD_SCALE|TF_REQ_SCALE)) {
    977 			tp->snd_scale = tp->requested_s_scale;
    978 			tp->rcv_scale = tp->request_r_scale;
    979 		}
    980 		(void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
    981 		tp->snd_wl1 = ti->ti_seq - 1;
    982 		/* fall into ... */
    983 
    984 	/*
    985 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
    986 	 * ACKs.  If the ack is in the range
    987 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
    988 	 * then advance tp->snd_una to ti->ti_ack and drop
    989 	 * data from the retransmission queue.  If this ACK reflects
    990 	 * more up to date window information we update our window information.
    991 	 */
    992 	case TCPS_ESTABLISHED:
    993 	case TCPS_FIN_WAIT_1:
    994 	case TCPS_FIN_WAIT_2:
    995 	case TCPS_CLOSE_WAIT:
    996 	case TCPS_CLOSING:
    997 	case TCPS_LAST_ACK:
    998 	case TCPS_TIME_WAIT:
    999 
   1000 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
   1001 			if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
   1002 				tcpstat.tcps_rcvdupack++;
   1003 				/*
   1004 				 * If we have outstanding data (other than
   1005 				 * a window probe), this is a completely
   1006 				 * duplicate ack (ie, window info didn't
   1007 				 * change), the ack is the biggest we've
   1008 				 * seen and we've seen exactly our rexmt
   1009 				 * threshhold of them, assume a packet
   1010 				 * has been dropped and retransmit it.
   1011 				 * Kludge snd_nxt & the congestion
   1012 				 * window so we send only this one
   1013 				 * packet.
   1014 				 *
   1015 				 * We know we're losing at the current
   1016 				 * window size so do congestion avoidance
   1017 				 * (set ssthresh to half the current window
   1018 				 * and pull our congestion window back to
   1019 				 * the new ssthresh).
   1020 				 *
   1021 				 * Dup acks mean that packets have left the
   1022 				 * network (they're now cached at the receiver)
   1023 				 * so bump cwnd by the amount in the receiver
   1024 				 * to keep a constant cwnd packets in the
   1025 				 * network.
   1026 				 */
   1027 				if (tp->t_timer[TCPT_REXMT] == 0 ||
   1028 				    ti->ti_ack != tp->snd_una)
   1029 					tp->t_dupacks = 0;
   1030 				else if (++tp->t_dupacks == tcprexmtthresh) {
   1031 					tcp_seq onxt = tp->snd_nxt;
   1032 					u_int win =
   1033 					    min(tp->snd_wnd, tp->snd_cwnd) /
   1034 					    2 /	tp->t_segsz;
   1035 
   1036 					if (win < 2)
   1037 						win = 2;
   1038 					tp->snd_ssthresh = win * tp->t_segsz;
   1039 					tp->t_timer[TCPT_REXMT] = 0;
   1040 					tp->t_rtt = 0;
   1041 					tp->snd_nxt = ti->ti_ack;
   1042 					tp->snd_cwnd = tp->t_segsz;
   1043 					(void) tcp_output(tp);
   1044 					tp->snd_cwnd = tp->snd_ssthresh +
   1045 					       tp->t_segsz * tp->t_dupacks;
   1046 					if (SEQ_GT(onxt, tp->snd_nxt))
   1047 						tp->snd_nxt = onxt;
   1048 					goto drop;
   1049 				} else if (tp->t_dupacks > tcprexmtthresh) {
   1050 					tp->snd_cwnd += tp->t_segsz;
   1051 					(void) tcp_output(tp);
   1052 					goto drop;
   1053 				}
   1054 			} else
   1055 				tp->t_dupacks = 0;
   1056 			break;
   1057 		}
   1058 		/*
   1059 		 * If the congestion window was inflated to account
   1060 		 * for the other side's cached packets, retract it.
   1061 		 */
   1062 		if (tp->t_dupacks >= tcprexmtthresh &&
   1063 		    tp->snd_cwnd > tp->snd_ssthresh)
   1064 			tp->snd_cwnd = tp->snd_ssthresh;
   1065 		tp->t_dupacks = 0;
   1066 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
   1067 			tcpstat.tcps_rcvacktoomuch++;
   1068 			goto dropafterack;
   1069 		}
   1070 		acked = ti->ti_ack - tp->snd_una;
   1071 		tcpstat.tcps_rcvackpack++;
   1072 		tcpstat.tcps_rcvackbyte += acked;
   1073 
   1074 		/*
   1075 		 * If we have a timestamp reply, update smoothed
   1076 		 * round trip time.  If no timestamp is present but
   1077 		 * transmit timer is running and timed sequence
   1078 		 * number was acked, update smoothed round trip time.
   1079 		 * Since we now have an rtt measurement, cancel the
   1080 		 * timer backoff (cf., Phil Karn's retransmit alg.).
   1081 		 * Recompute the initial retransmit timer.
   1082 		 */
   1083 		if (opti.ts_present)
   1084 			tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1);
   1085 		else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
   1086 			tcp_xmit_timer(tp,tp->t_rtt);
   1087 
   1088 		/*
   1089 		 * If all outstanding data is acked, stop retransmit
   1090 		 * timer and remember to restart (more output or persist).
   1091 		 * If there is more data to be acked, restart retransmit
   1092 		 * timer, using current (possibly backed-off) value.
   1093 		 */
   1094 		if (ti->ti_ack == tp->snd_max) {
   1095 			tp->t_timer[TCPT_REXMT] = 0;
   1096 			needoutput = 1;
   1097 		} else if (tp->t_timer[TCPT_PERSIST] == 0)
   1098 			tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
   1099 		/*
   1100 		 * When new data is acked, open the congestion window.
   1101 		 * If the window gives us less than ssthresh packets
   1102 		 * in flight, open exponentially (segsz per packet).
   1103 		 * Otherwise open linearly: segsz per window
   1104 		 * (segsz^2 / cwnd per packet), plus a constant
   1105 		 * fraction of a packet (segsz/8) to help larger windows
   1106 		 * open quickly enough.
   1107 		 */
   1108 		{
   1109 		register u_int cw = tp->snd_cwnd;
   1110 		register u_int incr = tp->t_segsz;
   1111 
   1112 		if (cw > tp->snd_ssthresh)
   1113 			incr = incr * incr / cw;
   1114 		tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale);
   1115 		}
   1116 		if (acked > so->so_snd.sb_cc) {
   1117 			tp->snd_wnd -= so->so_snd.sb_cc;
   1118 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
   1119 			ourfinisacked = 1;
   1120 		} else {
   1121 			sbdrop(&so->so_snd, acked);
   1122 			tp->snd_wnd -= acked;
   1123 			ourfinisacked = 0;
   1124 		}
   1125 		if (sb_notify(&so->so_snd))
   1126 			sowwakeup(so);
   1127 		tp->snd_una = ti->ti_ack;
   1128 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
   1129 			tp->snd_nxt = tp->snd_una;
   1130 
   1131 		switch (tp->t_state) {
   1132 
   1133 		/*
   1134 		 * In FIN_WAIT_1 STATE in addition to the processing
   1135 		 * for the ESTABLISHED state if our FIN is now acknowledged
   1136 		 * then enter FIN_WAIT_2.
   1137 		 */
   1138 		case TCPS_FIN_WAIT_1:
   1139 			if (ourfinisacked) {
   1140 				/*
   1141 				 * If we can't receive any more
   1142 				 * data, then closing user can proceed.
   1143 				 * Starting the timer is contrary to the
   1144 				 * specification, but if we don't get a FIN
   1145 				 * we'll hang forever.
   1146 				 */
   1147 				if (so->so_state & SS_CANTRCVMORE) {
   1148 					soisdisconnected(so);
   1149 					tp->t_timer[TCPT_2MSL] = tcp_maxidle;
   1150 				}
   1151 				tp->t_state = TCPS_FIN_WAIT_2;
   1152 			}
   1153 			break;
   1154 
   1155 	 	/*
   1156 		 * In CLOSING STATE in addition to the processing for
   1157 		 * the ESTABLISHED state if the ACK acknowledges our FIN
   1158 		 * then enter the TIME-WAIT state, otherwise ignore
   1159 		 * the segment.
   1160 		 */
   1161 		case TCPS_CLOSING:
   1162 			if (ourfinisacked) {
   1163 				tp->t_state = TCPS_TIME_WAIT;
   1164 				tcp_canceltimers(tp);
   1165 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1166 				soisdisconnected(so);
   1167 			}
   1168 			break;
   1169 
   1170 		/*
   1171 		 * In LAST_ACK, we may still be waiting for data to drain
   1172 		 * and/or to be acked, as well as for the ack of our FIN.
   1173 		 * If our FIN is now acknowledged, delete the TCB,
   1174 		 * enter the closed state and return.
   1175 		 */
   1176 		case TCPS_LAST_ACK:
   1177 			if (ourfinisacked) {
   1178 				tp = tcp_close(tp);
   1179 				goto drop;
   1180 			}
   1181 			break;
   1182 
   1183 		/*
   1184 		 * In TIME_WAIT state the only thing that should arrive
   1185 		 * is a retransmission of the remote FIN.  Acknowledge
   1186 		 * it and restart the finack timer.
   1187 		 */
   1188 		case TCPS_TIME_WAIT:
   1189 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1190 			goto dropafterack;
   1191 		}
   1192 	}
   1193 
   1194 step6:
   1195 	/*
   1196 	 * Update window information.
   1197 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
   1198 	 */
   1199 	if (((tiflags & TH_ACK) && SEQ_LT(tp->snd_wl1, ti->ti_seq)) ||
   1200 	    (tp->snd_wl1 == ti->ti_seq && SEQ_LT(tp->snd_wl2, ti->ti_ack)) ||
   1201 	    (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)) {
   1202 		/* keep track of pure window updates */
   1203 		if (ti->ti_len == 0 &&
   1204 		    tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)
   1205 			tcpstat.tcps_rcvwinupd++;
   1206 		tp->snd_wnd = tiwin;
   1207 		tp->snd_wl1 = ti->ti_seq;
   1208 		tp->snd_wl2 = ti->ti_ack;
   1209 		if (tp->snd_wnd > tp->max_sndwnd)
   1210 			tp->max_sndwnd = tp->snd_wnd;
   1211 		needoutput = 1;
   1212 	}
   1213 
   1214 	/*
   1215 	 * Process segments with URG.
   1216 	 */
   1217 	if ((tiflags & TH_URG) && ti->ti_urp &&
   1218 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1219 		/*
   1220 		 * This is a kludge, but if we receive and accept
   1221 		 * random urgent pointers, we'll crash in
   1222 		 * soreceive.  It's hard to imagine someone
   1223 		 * actually wanting to send this much urgent data.
   1224 		 */
   1225 		if (ti->ti_urp + so->so_rcv.sb_cc > sb_max) {
   1226 			ti->ti_urp = 0;			/* XXX */
   1227 			tiflags &= ~TH_URG;		/* XXX */
   1228 			goto dodata;			/* XXX */
   1229 		}
   1230 		/*
   1231 		 * If this segment advances the known urgent pointer,
   1232 		 * then mark the data stream.  This should not happen
   1233 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
   1234 		 * a FIN has been received from the remote side.
   1235 		 * In these states we ignore the URG.
   1236 		 *
   1237 		 * According to RFC961 (Assigned Protocols),
   1238 		 * the urgent pointer points to the last octet
   1239 		 * of urgent data.  We continue, however,
   1240 		 * to consider it to indicate the first octet
   1241 		 * of data past the urgent section as the original
   1242 		 * spec states (in one of two places).
   1243 		 */
   1244 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
   1245 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
   1246 			so->so_oobmark = so->so_rcv.sb_cc +
   1247 			    (tp->rcv_up - tp->rcv_nxt) - 1;
   1248 			if (so->so_oobmark == 0)
   1249 				so->so_state |= SS_RCVATMARK;
   1250 			sohasoutofband(so);
   1251 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
   1252 		}
   1253 		/*
   1254 		 * Remove out of band data so doesn't get presented to user.
   1255 		 * This can happen independent of advancing the URG pointer,
   1256 		 * but if two URG's are pending at once, some out-of-band
   1257 		 * data may creep in... ick.
   1258 		 */
   1259 		if (ti->ti_urp <= (u_int16_t) ti->ti_len
   1260 #ifdef SO_OOBINLINE
   1261 		     && (so->so_options & SO_OOBINLINE) == 0
   1262 #endif
   1263 		     )
   1264 			tcp_pulloutofband(so, ti, m);
   1265 	} else
   1266 		/*
   1267 		 * If no out of band data is expected,
   1268 		 * pull receive urgent pointer along
   1269 		 * with the receive window.
   1270 		 */
   1271 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
   1272 			tp->rcv_up = tp->rcv_nxt;
   1273 dodata:							/* XXX */
   1274 
   1275 	/*
   1276 	 * Process the segment text, merging it into the TCP sequencing queue,
   1277 	 * and arranging for acknowledgment of receipt if necessary.
   1278 	 * This process logically involves adjusting tp->rcv_wnd as data
   1279 	 * is presented to the user (this happens in tcp_usrreq.c,
   1280 	 * case PRU_RCVD).  If a FIN has already been received on this
   1281 	 * connection then we just ignore the text.
   1282 	 */
   1283 	if ((ti->ti_len || (tiflags & TH_FIN)) &&
   1284 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1285 		TCP_REASS(tp, ti, m, so, tiflags);
   1286 		/*
   1287 		 * Note the amount of data that peer has sent into
   1288 		 * our window, in order to estimate the sender's
   1289 		 * buffer size.
   1290 		 */
   1291 		len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
   1292 	} else {
   1293 		m_freem(m);
   1294 		tiflags &= ~TH_FIN;
   1295 	}
   1296 
   1297 	/*
   1298 	 * If FIN is received ACK the FIN and let the user know
   1299 	 * that the connection is closing.  Ignore a FIN received before
   1300 	 * the connection is fully established.
   1301 	 */
   1302 	if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
   1303 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
   1304 			socantrcvmore(so);
   1305 			tp->t_flags |= TF_ACKNOW;
   1306 			tp->rcv_nxt++;
   1307 		}
   1308 		switch (tp->t_state) {
   1309 
   1310 	 	/*
   1311 		 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
   1312 		 */
   1313 		case TCPS_ESTABLISHED:
   1314 			tp->t_state = TCPS_CLOSE_WAIT;
   1315 			break;
   1316 
   1317 	 	/*
   1318 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
   1319 		 * enter the CLOSING state.
   1320 		 */
   1321 		case TCPS_FIN_WAIT_1:
   1322 			tp->t_state = TCPS_CLOSING;
   1323 			break;
   1324 
   1325 	 	/*
   1326 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
   1327 		 * starting the time-wait timer, turning off the other
   1328 		 * standard timers.
   1329 		 */
   1330 		case TCPS_FIN_WAIT_2:
   1331 			tp->t_state = TCPS_TIME_WAIT;
   1332 			tcp_canceltimers(tp);
   1333 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1334 			soisdisconnected(so);
   1335 			break;
   1336 
   1337 		/*
   1338 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
   1339 		 */
   1340 		case TCPS_TIME_WAIT:
   1341 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
   1342 			break;
   1343 		}
   1344 	}
   1345 	if (so->so_options & SO_DEBUG)
   1346 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
   1347 
   1348 	/*
   1349 	 * Return any desired output.
   1350 	 */
   1351 	if (needoutput || (tp->t_flags & TF_ACKNOW))
   1352 		(void) tcp_output(tp);
   1353 	return;
   1354 
   1355 badsyn:
   1356 	/*
   1357 	 * Received a bad SYN.  Increment counters and dropwithreset.
   1358 	 */
   1359 	tcpstat.tcps_badsyn++;
   1360 	tp = NULL;
   1361 	goto dropwithreset;
   1362 
   1363 dropafterack:
   1364 	/*
   1365 	 * Generate an ACK dropping incoming segment if it occupies
   1366 	 * sequence space, where the ACK reflects our state.
   1367 	 */
   1368 	if (tiflags & TH_RST)
   1369 		goto drop;
   1370 	m_freem(m);
   1371 	tp->t_flags |= TF_ACKNOW;
   1372 	(void) tcp_output(tp);
   1373 	return;
   1374 
   1375 dropwithreset:
   1376 	/*
   1377 	 * Generate a RST, dropping incoming segment.
   1378 	 * Make ACK acceptable to originator of segment.
   1379 	 * Don't bother to respond if destination was broadcast/multicast.
   1380 	 */
   1381 	if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) ||
   1382 	    IN_MULTICAST(ti->ti_dst.s_addr))
   1383 		goto drop;
   1384 	if (tiflags & TH_ACK)
   1385 		(void)tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST);
   1386 	else {
   1387 		if (tiflags & TH_SYN)
   1388 			ti->ti_len++;
   1389 		(void)tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0,
   1390 		    TH_RST|TH_ACK);
   1391 	}
   1392 	return;
   1393 
   1394 drop:
   1395 	/*
   1396 	 * Drop space held by incoming segment and return.
   1397 	 */
   1398 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
   1399 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
   1400 	m_freem(m);
   1401 	return;
   1402 #ifndef TUBA_INCLUDE
   1403 }
   1404 
   1405 void
   1406 tcp_dooptions(tp, cp, cnt, ti, oi)
   1407 	struct tcpcb *tp;
   1408 	u_char *cp;
   1409 	int cnt;
   1410 	struct tcpiphdr *ti;
   1411 	struct tcp_opt_info *oi;
   1412 {
   1413 	u_int16_t mss;
   1414 	int opt, optlen;
   1415 
   1416 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
   1417 		opt = cp[0];
   1418 		if (opt == TCPOPT_EOL)
   1419 			break;
   1420 		if (opt == TCPOPT_NOP)
   1421 			optlen = 1;
   1422 		else {
   1423 			optlen = cp[1];
   1424 			if (optlen <= 0)
   1425 				break;
   1426 		}
   1427 		switch (opt) {
   1428 
   1429 		default:
   1430 			continue;
   1431 
   1432 		case TCPOPT_MAXSEG:
   1433 			if (optlen != TCPOLEN_MAXSEG)
   1434 				continue;
   1435 			if (!(ti->ti_flags & TH_SYN))
   1436 				continue;
   1437 			bcopy(cp + 2, &mss, sizeof(mss));
   1438 			oi->maxseg = ntohs(mss);
   1439 			break;
   1440 
   1441 		case TCPOPT_WINDOW:
   1442 			if (optlen != TCPOLEN_WINDOW)
   1443 				continue;
   1444 			if (!(ti->ti_flags & TH_SYN))
   1445 				continue;
   1446 			tp->t_flags |= TF_RCVD_SCALE;
   1447 			tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
   1448 			break;
   1449 
   1450 		case TCPOPT_TIMESTAMP:
   1451 			if (optlen != TCPOLEN_TIMESTAMP)
   1452 				continue;
   1453 			oi->ts_present = 1;
   1454 			bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
   1455 			NTOHL(oi->ts_val);
   1456 			bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
   1457 			NTOHL(oi->ts_ecr);
   1458 
   1459 			/*
   1460 			 * A timestamp received in a SYN makes
   1461 			 * it ok to send timestamp requests and replies.
   1462 			 */
   1463 			if (ti->ti_flags & TH_SYN) {
   1464 				tp->t_flags |= TF_RCVD_TSTMP;
   1465 				tp->ts_recent = oi->ts_val;
   1466 				tp->ts_recent_age = tcp_now;
   1467 			}
   1468 			break;
   1469 		}
   1470 	}
   1471 }
   1472 
   1473 /*
   1474  * Pull out of band byte out of a segment so
   1475  * it doesn't appear in the user's data queue.
   1476  * It is still reflected in the segment length for
   1477  * sequencing purposes.
   1478  */
   1479 void
   1480 tcp_pulloutofband(so, ti, m)
   1481 	struct socket *so;
   1482 	struct tcpiphdr *ti;
   1483 	register struct mbuf *m;
   1484 {
   1485 	int cnt = ti->ti_urp - 1;
   1486 
   1487 	while (cnt >= 0) {
   1488 		if (m->m_len > cnt) {
   1489 			char *cp = mtod(m, caddr_t) + cnt;
   1490 			struct tcpcb *tp = sototcpcb(so);
   1491 
   1492 			tp->t_iobc = *cp;
   1493 			tp->t_oobflags |= TCPOOB_HAVEDATA;
   1494 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
   1495 			m->m_len--;
   1496 			return;
   1497 		}
   1498 		cnt -= m->m_len;
   1499 		m = m->m_next;
   1500 		if (m == 0)
   1501 			break;
   1502 	}
   1503 	panic("tcp_pulloutofband");
   1504 }
   1505 
   1506 /*
   1507  * Collect new round-trip time estimate
   1508  * and update averages and current timeout.
   1509  */
   1510 void
   1511 tcp_xmit_timer(tp, rtt)
   1512 	register struct tcpcb *tp;
   1513 	short rtt;
   1514 {
   1515 	register short delta;
   1516 	short rttmin;
   1517 
   1518 	tcpstat.tcps_rttupdated++;
   1519 	--rtt;
   1520 	if (tp->t_srtt != 0) {
   1521 		/*
   1522 		 * srtt is stored as fixed point with 3 bits after the
   1523 		 * binary point (i.e., scaled by 8).  The following magic
   1524 		 * is equivalent to the smoothing algorithm in rfc793 with
   1525 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
   1526 		 * point).  Adjust rtt to origin 0.
   1527 		 */
   1528 		delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
   1529 		if ((tp->t_srtt += delta) <= 0)
   1530 			tp->t_srtt = 1 << 2;
   1531 		/*
   1532 		 * We accumulate a smoothed rtt variance (actually, a
   1533 		 * smoothed mean difference), then set the retransmit
   1534 		 * timer to smoothed rtt + 4 times the smoothed variance.
   1535 		 * rttvar is stored as fixed point with 2 bits after the
   1536 		 * binary point (scaled by 4).  The following is
   1537 		 * equivalent to rfc793 smoothing with an alpha of .75
   1538 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
   1539 		 * rfc793's wired-in beta.
   1540 		 */
   1541 		if (delta < 0)
   1542 			delta = -delta;
   1543 		delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
   1544 		if ((tp->t_rttvar += delta) <= 0)
   1545 			tp->t_rttvar = 1 << 2;
   1546 	} else {
   1547 		/*
   1548 		 * No rtt measurement yet - use the unsmoothed rtt.
   1549 		 * Set the variance to half the rtt (so our first
   1550 		 * retransmit happens at 3*rtt).
   1551 		 */
   1552 		tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
   1553 		tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
   1554 	}
   1555 	tp->t_rtt = 0;
   1556 	tp->t_rxtshift = 0;
   1557 
   1558 	/*
   1559 	 * the retransmit should happen at rtt + 4 * rttvar.
   1560 	 * Because of the way we do the smoothing, srtt and rttvar
   1561 	 * will each average +1/2 tick of bias.  When we compute
   1562 	 * the retransmit timer, we want 1/2 tick of rounding and
   1563 	 * 1 extra tick because of +-1/2 tick uncertainty in the
   1564 	 * firing of the timer.  The bias will give us exactly the
   1565 	 * 1.5 tick we need.  But, because the bias is
   1566 	 * statistical, we have to test that we don't drop below
   1567 	 * the minimum feasible timer (which is 2 ticks).
   1568 	 */
   1569 	if (tp->t_rttmin > rtt + 2)
   1570 		rttmin = tp->t_rttmin;
   1571 	else
   1572 		rttmin = rtt + 2;
   1573 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX);
   1574 
   1575 	/*
   1576 	 * We received an ack for a packet that wasn't retransmitted;
   1577 	 * it is probably safe to discard any error indications we've
   1578 	 * received recently.  This isn't quite right, but close enough
   1579 	 * for now (a route might have failed after we sent a segment,
   1580 	 * and the return path might not be symmetrical).
   1581 	 */
   1582 	tp->t_softerror = 0;
   1583 }
   1584 
   1585 /*
   1586  * TCP compressed state engine.  Currently used to hold compressed
   1587  * state for SYN_RECEIVED.
   1588  */
   1589 
   1590 u_long	syn_cache_count;
   1591 u_int32_t syn_hash1, syn_hash2;
   1592 
   1593 #define SYN_HASH(sa, sp, dp) \
   1594 	((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
   1595 				     ((u_int32_t)(sp)))^syn_hash2)))
   1596 
   1597 #define	eptosp(ep, e, s)	((struct s *)((char *)(ep) - \
   1598 			    ((char *)(&((struct s *)0)->e) - (char *)0)))
   1599 
   1600 #define	SYN_CACHE_RM(sc, p, scp) {					\
   1601 	*(p) = (sc)->sc_next;						\
   1602 	if ((sc)->sc_next)						\
   1603 		(sc)->sc_next->sc_timer += (sc)->sc_timer;		\
   1604 	else {								\
   1605 		(scp)->sch_timer_sum -= (sc)->sc_timer;			\
   1606 		if ((scp)->sch_timer_sum <= 0)				\
   1607 			(scp)->sch_timer_sum = -1;			\
   1608 		/* If need be, fix up the last pointer */		\
   1609 		if ((scp)->sch_first)					\
   1610 			(scp)->sch_last = eptosp(p, sc_next, syn_cache); \
   1611 	}								\
   1612 	(scp)->sch_length--;						\
   1613 	syn_cache_count--;						\
   1614 }
   1615 
   1616 void
   1617 syn_cache_insert(sc, prevp, headp)
   1618 	struct syn_cache *sc;
   1619 	struct syn_cache ***prevp;
   1620 	struct syn_cache_head **headp;
   1621 {
   1622 	struct syn_cache_head *scp, *scp2, *sce;
   1623 	struct syn_cache *sc2;
   1624 	static u_int timeo_val;
   1625 	int s;
   1626 
   1627 	/* Initialize the hash secrets when adding the first entry */
   1628 	if (syn_cache_count == 0) {
   1629 		struct timeval tv;
   1630 		microtime(&tv);
   1631 		syn_hash1 = random() ^ (u_long)&sc;
   1632 		syn_hash2 = random() ^ tv.tv_usec;
   1633 	}
   1634 
   1635 	sc->sc_hash = SYN_HASH(&sc->sc_src, sc->sc_sport, sc->sc_dport);
   1636 	sc->sc_next = NULL;
   1637 	scp = &tcp_syn_cache[sc->sc_hash % tcp_syn_cache_size];
   1638 	*headp = scp;
   1639 
   1640 	/*
   1641 	 * Make sure that we don't overflow the per-bucket
   1642 	 * limit or the total cache size limit.
   1643 	 */
   1644 	s = splsoftnet();
   1645 	if (scp->sch_length >= tcp_syn_bucket_limit) {
   1646 		tcpstat.tcps_sc_bucketoverflow++;
   1647 		sc2 = scp->sch_first;
   1648 		scp->sch_first = sc2->sc_next;
   1649 		if (sc2->sc_ipopts)
   1650 			(void) m_free(sc2->sc_ipopts);
   1651 		FREE(sc2, M_PCB);
   1652 	} else if (syn_cache_count >= tcp_syn_cache_limit) {
   1653 		tcpstat.tcps_sc_overflowed++;
   1654 		/*
   1655 		 * The cache is full.  Toss the first (i.e, oldest)
   1656 		 * element in this bucket.
   1657 		 */
   1658 		scp2 = scp;
   1659 		if (scp2->sch_first == NULL) {
   1660 			sce = &tcp_syn_cache[tcp_syn_cache_size];
   1661 			for (++scp2; scp2 != scp; scp2++) {
   1662 				if (scp2 >= sce)
   1663 					scp2 = &tcp_syn_cache[0];
   1664 				if (scp2->sch_first)
   1665 					break;
   1666 			}
   1667 		}
   1668 		sc2 = scp2->sch_first;
   1669 		if (sc2 == NULL) {
   1670 			if (sc->sc_ipopts)
   1671 				(void) m_free(sc->sc_ipopts);
   1672 			FREE(sc, M_PCB);
   1673 			return;
   1674 		}
   1675 		if ((scp2->sch_first = sc2->sc_next) == NULL)
   1676 			scp2->sch_last = NULL;
   1677 		else
   1678 			sc2->sc_next->sc_timer += sc2->sc_timer;
   1679 		if (sc2->sc_ipopts)
   1680 			(void) m_free(sc2->sc_ipopts);
   1681 		FREE(sc2, M_PCB);
   1682 	} else {
   1683 		scp->sch_length++;
   1684 		syn_cache_count++;
   1685 	}
   1686 	tcpstat.tcps_sc_added++;
   1687 
   1688 	/*
   1689 	 * Put it into the bucket.
   1690 	 */
   1691 	if (scp->sch_first == NULL)
   1692 		*prevp = &scp->sch_first;
   1693 	else {
   1694 		*prevp = &scp->sch_last->sc_next;
   1695 		tcpstat.tcps_sc_collisions++;
   1696 	}
   1697 	**prevp = sc;
   1698 	scp->sch_last = sc;
   1699 
   1700 	/*
   1701 	 * If the timeout value has changed
   1702 	 *   1) force it to fit in a u_char
   1703 	 *   2) Run the timer routine to truncate all
   1704 	 *	existing entries to the new timeout value.
   1705 	 */
   1706 	if (timeo_val != tcp_syn_cache_timeo) {
   1707 		tcp_syn_cache_timeo = min(tcp_syn_cache_timeo, UCHAR_MAX);
   1708 		if (timeo_val > tcp_syn_cache_timeo)
   1709 			syn_cache_timer(timeo_val - tcp_syn_cache_timeo);
   1710 		timeo_val = tcp_syn_cache_timeo;
   1711 	}
   1712 	if (scp->sch_timer_sum > 0)
   1713 		sc->sc_timer = tcp_syn_cache_timeo - scp->sch_timer_sum;
   1714 	else {
   1715 		if (scp->sch_timer_sum == 0) {
   1716 			/*
   1717 			 * When the bucket timer is 0, it is not in the
   1718 			 * cache queue.
   1719 			 */
   1720 			scp->sch_headq = tcp_syn_cache_first;
   1721 			tcp_syn_cache_first = scp;
   1722 		}
   1723 		sc->sc_timer = tcp_syn_cache_timeo;
   1724 	}
   1725 	scp->sch_timer_sum = tcp_syn_cache_timeo;
   1726 	splx(s);
   1727 }
   1728 
   1729 /*
   1730  * Walk down the cache list, decrementing the timer of
   1731  * the first element on each entry.  If the timer goes
   1732  * to zero, remove it and all successive entries with
   1733  * a zero timer.
   1734  */
   1735 void
   1736 syn_cache_timer(interval)
   1737 	int interval;
   1738 {
   1739 	struct syn_cache_head *scp, **pscp;
   1740 	struct syn_cache *sc, *scn;
   1741 	int n, s;
   1742 
   1743 	pscp = &tcp_syn_cache_first;
   1744 	scp = tcp_syn_cache_first;
   1745 	s = splsoftnet();
   1746 	while (scp) {
   1747 		/*
   1748 		 * Remove any empty hash buckets
   1749 		 * from the cache queue.
   1750 		 */
   1751 		if ((sc = scp->sch_first) == NULL) {
   1752 			*pscp = scp->sch_headq;
   1753 			scp->sch_headq = NULL;
   1754 			scp->sch_timer_sum = 0;
   1755 			scp->sch_first = scp->sch_last = NULL;
   1756 			scp->sch_length = 0;
   1757 			scp = *pscp;
   1758 			continue;
   1759 		}
   1760 
   1761 		scp->sch_timer_sum -= interval;
   1762 		if (scp->sch_timer_sum <= 0)
   1763 			scp->sch_timer_sum = -1;
   1764 		n = interval;
   1765 		while (sc->sc_timer <= n) {
   1766 			n -= sc->sc_timer;
   1767 			scn = sc->sc_next;
   1768 			tcpstat.tcps_sc_timed_out++;
   1769 			syn_cache_count--;
   1770 			if (sc->sc_ipopts)
   1771 				(void) m_free(sc->sc_ipopts);
   1772 			FREE(sc, M_PCB);
   1773 			scp->sch_length--;
   1774 			if ((sc = scn) == NULL)
   1775 				break;
   1776 		}
   1777 		if ((scp->sch_first = sc) != NULL) {
   1778 			sc->sc_timer -= n;
   1779 			pscp = &scp->sch_headq;
   1780 			scp = scp->sch_headq;
   1781 		}
   1782 	}
   1783 	splx(s);
   1784 }
   1785 
   1786 /*
   1787  * Find an entry in the syn cache.
   1788  */
   1789 struct syn_cache *
   1790 syn_cache_lookup(ti, prevp, headp)
   1791 	struct tcpiphdr *ti;
   1792 	struct syn_cache ***prevp;
   1793 	struct syn_cache_head **headp;
   1794 {
   1795 	struct syn_cache *sc, **prev;
   1796 	struct syn_cache_head *head;
   1797 	u_int32_t hash;
   1798 	int s;
   1799 
   1800 	hash = SYN_HASH(&ti->ti_src, ti->ti_sport, ti->ti_dport);
   1801 
   1802 	head = &tcp_syn_cache[hash % tcp_syn_cache_size];
   1803 	*headp = head;
   1804 	prev = &head->sch_first;
   1805 	s = splsoftnet();
   1806 	for (sc = head->sch_first; sc; prev = &sc->sc_next, sc = sc->sc_next) {
   1807 		if (sc->sc_hash != hash)
   1808 			continue;
   1809 		if (sc->sc_src.s_addr == ti->ti_src.s_addr &&
   1810 		    sc->sc_sport == ti->ti_sport &&
   1811 		    sc->sc_dport == ti->ti_dport &&
   1812 		    sc->sc_dst.s_addr == ti->ti_dst.s_addr) {
   1813 			*prevp = prev;
   1814 			splx(s);
   1815 			return (sc);
   1816 		}
   1817 	}
   1818 	splx(s);
   1819 	return (NULL);
   1820 }
   1821 
   1822 /*
   1823  * This function gets called when we receive an ACK for a
   1824  * socket in the LISTEN state.  We look up the connection
   1825  * in the syn cache, and if its there, we pull it out of
   1826  * the cache and turn it into a full-blown connection in
   1827  * the SYN-RECEIVED state.
   1828  *
   1829  * The return values may not be immediately obvious, and their effects
   1830  * can be subtle, so here they are:
   1831  *
   1832  *	NULL	SYN was not found in cache; caller should drop the
   1833  *		packet and send an RST.
   1834  *
   1835  *	-1	We were unable to create the new connection, and are
   1836  *		aborting it.  An ACK,RST is being sent to the peer
   1837  *		(unless we got screwey sequence numbners; see below),
   1838  *		because the 3-way handshake has been completed.  Caller
   1839  *		should not free the mbuf, since we may be using it.  If
   1840  *		we are not, we will free it.
   1841  *
   1842  *	Otherwise, the return value is a pointer to the new socket
   1843  *	associated with the connection.
   1844  */
   1845 struct socket *
   1846 syn_cache_get(so, m)
   1847 	struct socket *so;
   1848 	struct mbuf *m;
   1849 {
   1850 	struct syn_cache *sc, **sc_prev;
   1851 	struct syn_cache_head *head;
   1852 	register struct inpcb *inp;
   1853 	register struct tcpcb *tp = 0;
   1854 	register struct tcpiphdr *ti;
   1855 	struct sockaddr_in *sin;
   1856 	struct mbuf *am;
   1857 	long win;
   1858 	int s;
   1859 
   1860 	ti = mtod(m, struct tcpiphdr *);
   1861 	s = splsoftnet();
   1862 	if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
   1863 		splx(s);
   1864 		return (NULL);
   1865 	}
   1866 
   1867 	win = sbspace(&so->so_rcv);
   1868 	if (win > TCP_MAXWIN)
   1869 		win = TCP_MAXWIN;
   1870 
   1871 	/*
   1872 	 * Verify the sequence and ack numbers.
   1873 	 */
   1874 	if ((ti->ti_ack != sc->sc_iss + 1) ||
   1875 	    SEQ_LEQ(ti->ti_seq, sc->sc_irs) ||
   1876 	    SEQ_GT(ti->ti_seq, sc->sc_irs + 1 + win)) {
   1877 		(void) syn_cache_respond(sc, m, ti, win, 0);
   1878 		splx(s);
   1879 		return ((struct socket *)(-1));
   1880 	}
   1881 
   1882 	/* Remove this cache entry */
   1883 	SYN_CACHE_RM(sc, sc_prev, head);
   1884 	splx(s);
   1885 
   1886 	/*
   1887 	 * Ok, create the full blown connection, and set things up
   1888 	 * as they would have been set up if we had created the
   1889 	 * connection when the SYN arrived.  If we can't create
   1890 	 * the connection, abort it.
   1891 	 */
   1892 	so = sonewconn(so, SS_ISCONNECTED);
   1893 	if (so == NULL)
   1894 		goto resetandabort;
   1895 
   1896 	inp = sotoinpcb(so);
   1897 	inp->inp_laddr = sc->sc_dst;
   1898 	inp->inp_lport = sc->sc_dport;
   1899 	in_pcbstate(inp, INP_BOUND);
   1900 	inp->inp_options = ip_srcroute();
   1901 	if (inp->inp_options == NULL) {
   1902 		inp->inp_options = sc->sc_ipopts;
   1903 		sc->sc_ipopts = NULL;
   1904 	}
   1905 
   1906 	am = m_get(M_DONTWAIT, MT_SONAME);	/* XXX */
   1907 	if (am == NULL)
   1908 		goto resetandabort;
   1909 	am->m_len = sizeof(struct sockaddr_in);
   1910 	sin = mtod(am, struct sockaddr_in *);
   1911 	sin->sin_family = AF_INET;
   1912 	sin->sin_len = sizeof(*sin);
   1913 	sin->sin_addr = sc->sc_src;
   1914 	sin->sin_port = sc->sc_sport;
   1915 	bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
   1916 	if (in_pcbconnect(inp, am)) {
   1917 		(void) m_free(am);
   1918 		goto resetandabort;
   1919 	}
   1920 	(void) m_free(am);
   1921 
   1922 	tp = intotcpcb(inp);
   1923 	if (sc->sc_request_r_scale != 15) {
   1924 		tp->requested_s_scale = sc->sc_requested_s_scale;
   1925 		tp->request_r_scale = sc->sc_request_r_scale;
   1926 		tp->snd_scale = sc->sc_requested_s_scale;
   1927 		tp->rcv_scale = sc->sc_request_r_scale;
   1928 		tp->t_flags |= TF_RCVD_SCALE;
   1929 	}
   1930 	if (sc->sc_flags & SCF_TIMESTAMP)
   1931 		tp->t_flags |= TF_RCVD_TSTMP;
   1932 
   1933 	tp->t_template = tcp_template(tp);
   1934 	if (tp->t_template == 0) {
   1935 		tp = tcp_drop(tp, ENOBUFS);	/* destroys socket */
   1936 		so = NULL;
   1937 		m_freem(m);
   1938 		goto abort;
   1939 	}
   1940 
   1941 	tp->iss = sc->sc_iss;
   1942 	tp->irs = sc->sc_irs;
   1943 	tcp_sendseqinit(tp);
   1944 	tcp_rcvseqinit(tp);
   1945 	tp->t_state = TCPS_SYN_RECEIVED;
   1946 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
   1947 	tcpstat.tcps_accepts++;
   1948 
   1949 	/* Initialize tp->t_ourmss before we deal with the peer's! */
   1950 	tp->t_ourmss = sc->sc_ourmaxseg;
   1951 	tcp_mss_from_peer(tp, sc->sc_peermaxseg);
   1952 
   1953 	/*
   1954 	 * Initialize the initial congestion window.  If we
   1955 	 * had to retransmit the SYN,ACK, we must initialize cwnd
   1956 	 * to 1 segment.
   1957 	 */
   1958 	tp->snd_cwnd =
   1959 	    TCP_INITIAL_WINDOW((sc->sc_flags & SCF_SYNACK_REXMT) ? 1 :
   1960 	    tcp_init_win, tp->t_peermss);
   1961 
   1962 	tcp_rmx_rtt(tp);
   1963 	tp->snd_wl1 = sc->sc_irs;
   1964 	tp->rcv_up = sc->sc_irs + 1;
   1965 
   1966 	/*
   1967 	 * This is what whould have happened in tcp_ouput() when
   1968 	 * the SYN,ACK was sent.
   1969 	 */
   1970 	tp->snd_up = tp->snd_una;
   1971 	tp->snd_max = tp->snd_nxt = tp->iss+1;
   1972 	tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
   1973 	if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
   1974 		tp->rcv_adv = tp->rcv_nxt + win;
   1975 	tp->last_ack_sent = tp->rcv_nxt;
   1976 
   1977 	tcpstat.tcps_sc_completed++;
   1978 	if (sc->sc_ipopts)
   1979 		(void) m_free(sc->sc_ipopts);
   1980 	FREE(sc, M_PCB);
   1981 	return (so);
   1982 
   1983 resetandabort:
   1984 	(void) tcp_respond(NULL, ti, m, ti->ti_seq+ti->ti_len,
   1985 	    (tcp_seq)0, TH_RST|TH_ACK);
   1986 abort:
   1987 	if (so != NULL)
   1988 		(void) soabort(so);
   1989 	if (sc->sc_ipopts)
   1990 		(void) m_free(sc->sc_ipopts);
   1991 	FREE(sc, M_PCB);
   1992 	tcpstat.tcps_sc_aborted++;
   1993 	return ((struct socket *)(-1));
   1994 }
   1995 
   1996 /*
   1997  * This function is called when we get a RST for a
   1998  * non-existant connection, so that we can see if the
   1999  * connection is in the syn cache.  If it is, zap it.
   2000  */
   2001 
   2002 void
   2003 syn_cache_reset(ti)
   2004 	register struct tcpiphdr *ti;
   2005 {
   2006 	struct syn_cache *sc, **sc_prev;
   2007 	struct syn_cache_head *head;
   2008 	int s = splsoftnet();
   2009 
   2010 	if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
   2011 		splx(s);
   2012 		return;
   2013 	}
   2014 	if (SEQ_LT(ti->ti_seq,sc->sc_irs) ||
   2015 	    SEQ_GT(ti->ti_seq, sc->sc_irs+1)) {
   2016 		splx(s);
   2017 		return;
   2018 	}
   2019 	SYN_CACHE_RM(sc, sc_prev, head);
   2020 	splx(s);
   2021 	tcpstat.tcps_sc_reset++;
   2022 	if (sc->sc_ipopts)
   2023 		(void) m_free(sc->sc_ipopts);
   2024 	FREE(sc, M_PCB);
   2025 }
   2026 
   2027 void
   2028 syn_cache_unreach(ip, th)
   2029 	struct ip *ip;
   2030 	struct tcphdr *th;
   2031 {
   2032 	struct syn_cache *sc, **sc_prev;
   2033 	struct syn_cache_head *head;
   2034 	struct tcpiphdr ti2;
   2035 	int s;
   2036 
   2037 	ti2.ti_src.s_addr = ip->ip_dst.s_addr;
   2038 	ti2.ti_dst.s_addr = ip->ip_src.s_addr;
   2039 	ti2.ti_sport = th->th_dport;
   2040 	ti2.ti_dport = th->th_sport;
   2041 
   2042 	s = splsoftnet();
   2043 	if ((sc = syn_cache_lookup(&ti2, &sc_prev, &head)) == NULL) {
   2044 		splx(s);
   2045 		return;
   2046 	}
   2047 	/* If the sequence number != sc_iss, then it's a bogus ICMP msg */
   2048 	if (ntohl (th->th_seq) != sc->sc_iss) {
   2049 		splx(s);
   2050 		return;
   2051 	}
   2052 	SYN_CACHE_RM(sc, sc_prev, head);
   2053 	splx(s);
   2054 	tcpstat.tcps_sc_unreach++;
   2055 	if (sc->sc_ipopts)
   2056 		(void) m_free(sc->sc_ipopts);
   2057 	FREE(sc, M_PCB);
   2058 }
   2059 
   2060 /*
   2061  * Given a LISTEN socket and an inbound SYN request, add
   2062  * this to the syn cache, and send back a segment:
   2063  *	<SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
   2064  * to the source.
   2065  *
   2066  * XXX We don't properly handle SYN-with-data!
   2067  */
   2068 
   2069 int
   2070 syn_cache_add(so, m, optp, optlen, oi)
   2071 	struct socket *so;
   2072 	struct mbuf *m;
   2073 	u_char *optp;
   2074 	int optlen;
   2075 	struct tcp_opt_info *oi;
   2076 {
   2077 	register struct tcpiphdr *ti;
   2078 	struct tcpcb tb, *tp;
   2079 	long win;
   2080 	struct syn_cache *sc, **sc_prev;
   2081 	struct syn_cache_head *scp;
   2082 	struct mbuf *ipopts;
   2083 	extern int tcp_do_rfc1323;
   2084 
   2085 	tp = sototcpcb(so);
   2086 	ti = mtod(m, struct tcpiphdr *);
   2087 
   2088 	/*
   2089 	 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
   2090 	 * in_broadcast() should never return true on a received
   2091 	 * packet with M_BCAST not set.
   2092 	 */
   2093 	if (m->m_flags & (M_BCAST|M_MCAST) ||
   2094 	    IN_MULTICAST(ti->ti_src.s_addr) ||
   2095 	    IN_MULTICAST(ti->ti_dst.s_addr))
   2096 		return (0);
   2097 
   2098 	/*
   2099 	 * Initialize some local state.
   2100 	 */
   2101 	win = sbspace(&so->so_rcv);
   2102 	if (win > TCP_MAXWIN)
   2103 		win = TCP_MAXWIN;
   2104 
   2105 	/*
   2106 	 * Remember the IP options, if any.
   2107 	 */
   2108 	ipopts = ip_srcroute();
   2109 
   2110 	if (optp) {
   2111 		tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
   2112 		tcp_dooptions(&tb, optp, optlen, ti, oi);
   2113 	} else
   2114 		tb.t_flags = 0;
   2115 
   2116 	/*
   2117 	 * See if we already have an entry for this connection.
   2118 	 * If we do, resend the SYN,ACK, and remember since the
   2119 	 * initial congestion window must be initialized to 1
   2120 	 * segment when the connection completes.
   2121 	 */
   2122 	if ((sc = syn_cache_lookup(ti, &sc_prev, &scp)) != NULL) {
   2123 		tcpstat.tcps_sc_dupesyn++;
   2124 		sc->sc_flags |= SCF_SYNACK_REXMT;
   2125 
   2126 		if (ipopts) {
   2127 			/*
   2128 			 * If we were remembering a previous source route,
   2129 			 * forget it and use the new one we've been given.
   2130 			 */
   2131 			if (sc->sc_ipopts)
   2132 				(void) m_free(sc->sc_ipopts);
   2133 			sc->sc_ipopts = ipopts;
   2134 		}
   2135 
   2136 		if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
   2137 			tcpstat.tcps_sndacks++;
   2138 			tcpstat.tcps_sndtotal++;
   2139 		}
   2140 		return (1);
   2141 	}
   2142 
   2143 	MALLOC(sc, struct syn_cache *, sizeof(*sc), M_PCB, M_NOWAIT);
   2144 	if (sc == NULL) {
   2145 		if (ipopts)
   2146 			(void) m_free(ipopts);
   2147 		return (0);
   2148 	}
   2149 
   2150 	/*
   2151 	 * Fill in the cache, and put the necessary IP and TCP
   2152 	 * options into the reply.
   2153 	 */
   2154 	sc->sc_src.s_addr = ti->ti_src.s_addr;
   2155 	sc->sc_dst.s_addr = ti->ti_dst.s_addr;
   2156 	sc->sc_sport = ti->ti_sport;
   2157 	sc->sc_dport = ti->ti_dport;
   2158 	sc->sc_flags = 0;
   2159 	sc->sc_ipopts = ipopts;
   2160 	sc->sc_irs = ti->ti_seq;
   2161 	sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0);
   2162 	sc->sc_peermaxseg = oi->maxseg;
   2163 	sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
   2164 						m->m_pkthdr.rcvif : NULL);
   2165 	if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP))
   2166 		sc->sc_flags |= SCF_TIMESTAMP;
   2167 	if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
   2168 	    (TF_RCVD_SCALE|TF_REQ_SCALE)) {
   2169 		sc->sc_requested_s_scale = tb.requested_s_scale;
   2170 		sc->sc_request_r_scale = 0;
   2171 		while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
   2172 		    TCP_MAXWIN << sc->sc_request_r_scale <
   2173 		    so->so_rcv.sb_hiwat)
   2174 			sc->sc_request_r_scale++;
   2175 	} else {
   2176 		sc->sc_requested_s_scale = 15;
   2177 		sc->sc_request_r_scale = 15;
   2178 	}
   2179 	if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
   2180 		syn_cache_insert(sc, &sc_prev, &scp);
   2181 		tcpstat.tcps_sndacks++;
   2182 		tcpstat.tcps_sndtotal++;
   2183 	} else {
   2184 		if (sc->sc_ipopts)
   2185 			(void) m_free(sc->sc_ipopts);
   2186 		FREE(sc, M_PCB);
   2187 		tcpstat.tcps_sc_dropped++;
   2188 	}
   2189 	return (1);
   2190 }
   2191 
   2192 int
   2193 syn_cache_respond(sc, m, ti, win, ts)
   2194 	struct syn_cache *sc;
   2195 	struct mbuf *m;
   2196 	register struct tcpiphdr *ti;
   2197 	long win;
   2198 	u_long ts;
   2199 {
   2200 	u_int8_t *optp;
   2201 	int optlen;
   2202 
   2203 	/*
   2204 	 * Tack on the TCP options.  If there isn't enough trailing
   2205 	 * space for them, move up the fixed header to make space.
   2206 	 */
   2207 	optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
   2208 	    ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
   2209 	if (optlen > M_TRAILINGSPACE(m)) {
   2210 		if (M_LEADINGSPACE(m) >= optlen) {
   2211 			m->m_data -= optlen;
   2212 			m->m_len += optlen;
   2213 		} else {
   2214 			struct mbuf *m0 = m;
   2215 			if ((m = m_gethdr(M_DONTWAIT, MT_HEADER)) == NULL) {
   2216 				m_freem(m0);
   2217 				return (ENOBUFS);
   2218 			}
   2219 			MH_ALIGN(m, sizeof(*ti) + optlen);
   2220 			m->m_next = m0; /* this gets freed below */
   2221 		}
   2222 		ovbcopy((caddr_t)ti, mtod(m, caddr_t), sizeof(*ti));
   2223 		ti = mtod(m, struct tcpiphdr *);
   2224 	}
   2225 
   2226 	optp = (u_int8_t *)(ti + 1);
   2227 	optp[0] = TCPOPT_MAXSEG;
   2228 	optp[1] = 4;
   2229 	optp[2] = (sc->sc_ourmaxseg >> 8) & 0xff;
   2230 	optp[3] = sc->sc_ourmaxseg & 0xff;
   2231 	optlen = 4;
   2232 
   2233 	if (sc->sc_request_r_scale != 15) {
   2234 		*((u_int32_t *)(optp + optlen)) = htonl(TCPOPT_NOP << 24 |
   2235 		    TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
   2236 		    sc->sc_request_r_scale);
   2237 		optlen += 4;
   2238 	}
   2239 
   2240 	if (sc->sc_flags & SCF_TIMESTAMP) {
   2241 		u_int32_t *lp = (u_int32_t *)(optp + optlen);
   2242 		/* Form timestamp option as shown in appendix A of RFC 1323. */
   2243 		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
   2244 		*lp++ = htonl(tcp_now);
   2245 		*lp   = htonl(ts);
   2246 		optlen += TCPOLEN_TSTAMP_APPA;
   2247 	}
   2248 
   2249 	/*
   2250 	 * Toss any trailing mbufs.  No need to worry about
   2251 	 * m_len and m_pkthdr.len, since tcp_respond() will
   2252 	 * unconditionally set them.
   2253 	 */
   2254 	if (m->m_next) {
   2255 		m_freem(m->m_next);
   2256 		m->m_next = NULL;
   2257   	}
   2258 
   2259 	/*
   2260 	 * Fill in the fields that tcp_respond() will not touch, and
   2261 	 * then send the response.
   2262 	 */
   2263 	ti->ti_off = (sizeof(struct tcphdr) + optlen) >> 2;
   2264 	ti->ti_win = htons(win);
   2265 	return (tcp_respond(NULL, ti, m, sc->sc_irs + 1, sc->sc_iss,
   2266 	    TH_SYN|TH_ACK));
   2267 }
   2268 #endif /* TUBA_INCLUDE */
   2269