tcp_input.c revision 1.51 1 /* $NetBSD: tcp_input.c,v 1.51 1998/04/13 21:18:19 kml Exp $ */
2
3 /*-
4 * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
9 * Facility, NASA Ames Research Center.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. All advertising materials mentioning features or use of this software
20 * must display the following acknowledgement:
21 * This product includes software developed by the NetBSD
22 * Foundation, Inc. and its contributors.
23 * 4. Neither the name of The NetBSD Foundation nor the names of its
24 * contributors may be used to endorse or promote products derived
25 * from this software without specific prior written permission.
26 *
27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37 * POSSIBILITY OF SUCH DAMAGE.
38 */
39
40 /*
41 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
42 * The Regents of the University of California. All rights reserved.
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 * 3. All advertising materials mentioning features or use of this software
53 * must display the following acknowledgement:
54 * This product includes software developed by the University of
55 * California, Berkeley and its contributors.
56 * 4. Neither the name of the University nor the names of its contributors
57 * may be used to endorse or promote products derived from this software
58 * without specific prior written permission.
59 *
60 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
61 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
63 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
64 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
65 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
66 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
67 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
68 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
69 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
70 * SUCH DAMAGE.
71 *
72 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
73 */
74
75 /*
76 * TODO list for SYN cache stuff:
77 *
78 * Find room for a "state" field, which is needed to keep a
79 * compressed state for TIME_WAIT TCBs. It's been noted already
80 * that this is fairly important for very high-volume web and
81 * mail servers, which use a large number of short-lived
82 * connections.
83 */
84
85 #ifndef TUBA_INCLUDE
86 #include <sys/param.h>
87 #include <sys/systm.h>
88 #include <sys/malloc.h>
89 #include <sys/mbuf.h>
90 #include <sys/protosw.h>
91 #include <sys/socket.h>
92 #include <sys/socketvar.h>
93 #include <sys/errno.h>
94
95 #include <net/if.h>
96 #include <net/route.h>
97
98 #include <netinet/in.h>
99 #include <netinet/in_systm.h>
100 #include <netinet/ip.h>
101 #include <netinet/in_pcb.h>
102 #include <netinet/ip_var.h>
103 #include <netinet/tcp.h>
104 #include <netinet/tcp_fsm.h>
105 #include <netinet/tcp_seq.h>
106 #include <netinet/tcp_timer.h>
107 #include <netinet/tcp_var.h>
108 #include <netinet/tcpip.h>
109 #include <netinet/tcp_debug.h>
110
111 #include <machine/stdarg.h>
112
113 int tcprexmtthresh = 3;
114 struct tcpiphdr tcp_saveti;
115
116 extern u_long sb_max;
117
118 #endif /* TUBA_INCLUDE */
119 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ)
120
121 /* for modulo comparisons of timestamps */
122 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
123 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
124
125 /*
126 * Macro to compute ACK transmission behavior. Delay the ACK unless
127 * we have already delayed an ACK (must send an ACK every two segments).
128 */
129 #define TCP_SETUP_ACK(tp, ti) \
130 do { \
131 if ((tp)->t_flags & TF_DELACK) \
132 tp->t_flags |= TF_ACKNOW; \
133 else \
134 TCP_SET_DELACK(tp); \
135 } while (0)
136
137 /*
138 * Insert segment ti into reassembly queue of tcp with
139 * control block tp. Return TH_FIN if reassembly now includes
140 * a segment with FIN. The macro form does the common case inline
141 * (segment is the next to be received on an established connection,
142 * and the queue is empty), avoiding linkage into and removal
143 * from the queue and repetition of various conversions.
144 * Set DELACK for segments received in order, but ack immediately
145 * when segments are out of order (so fast retransmit can work).
146 */
147 #define TCP_REASS(tp, ti, m, so, flags) { \
148 if ((ti)->ti_seq == (tp)->rcv_nxt && \
149 (tp)->segq.lh_first == NULL && \
150 (tp)->t_state == TCPS_ESTABLISHED) { \
151 TCP_SETUP_ACK(tp, ti); \
152 (tp)->rcv_nxt += (ti)->ti_len; \
153 flags = (ti)->ti_flags & TH_FIN; \
154 tcpstat.tcps_rcvpack++;\
155 tcpstat.tcps_rcvbyte += (ti)->ti_len;\
156 sbappend(&(so)->so_rcv, (m)); \
157 sorwakeup(so); \
158 } else { \
159 (flags) = tcp_reass((tp), (ti), (m)); \
160 tp->t_flags |= TF_ACKNOW; \
161 } \
162 }
163 #ifndef TUBA_INCLUDE
164
165 int
166 tcp_reass(tp, ti, m)
167 register struct tcpcb *tp;
168 register struct tcpiphdr *ti;
169 struct mbuf *m;
170 {
171 register struct ipqent *p, *q, *nq, *tiqe;
172 struct socket *so = tp->t_inpcb->inp_socket;
173 int flags;
174
175 /*
176 * Call with ti==0 after become established to
177 * force pre-ESTABLISHED data up to user socket.
178 */
179 if (ti == 0)
180 goto present;
181
182 /*
183 * Allocate a new queue entry, before we throw away any data.
184 * If we can't, just drop the packet. XXX
185 */
186 MALLOC(tiqe, struct ipqent *, sizeof (struct ipqent), M_IPQ, M_NOWAIT);
187 if (tiqe == NULL) {
188 tcpstat.tcps_rcvmemdrop++;
189 m_freem(m);
190 return (0);
191 }
192
193 /*
194 * Find a segment which begins after this one does.
195 */
196 for (p = NULL, q = tp->segq.lh_first; q != NULL;
197 p = q, q = q->ipqe_q.le_next)
198 if (SEQ_GT(q->ipqe_tcp->ti_seq, ti->ti_seq))
199 break;
200
201 /*
202 * If there is a preceding segment, it may provide some of
203 * our data already. If so, drop the data from the incoming
204 * segment. If it provides all of our data, drop us.
205 */
206 if (p != NULL) {
207 register struct tcpiphdr *phdr = p->ipqe_tcp;
208 register int i;
209
210 /* conversion to int (in i) handles seq wraparound */
211 i = phdr->ti_seq + phdr->ti_len - ti->ti_seq;
212 if (i > 0) {
213 if (i >= ti->ti_len) {
214 tcpstat.tcps_rcvduppack++;
215 tcpstat.tcps_rcvdupbyte += ti->ti_len;
216 m_freem(m);
217 FREE(tiqe, M_IPQ);
218 return (0);
219 }
220 m_adj(m, i);
221 ti->ti_len -= i;
222 ti->ti_seq += i;
223 }
224 }
225 tcpstat.tcps_rcvoopack++;
226 tcpstat.tcps_rcvoobyte += ti->ti_len;
227
228 /*
229 * While we overlap succeeding segments trim them or,
230 * if they are completely covered, dequeue them.
231 */
232 for (; q != NULL; q = nq) {
233 register struct tcpiphdr *qhdr = q->ipqe_tcp;
234 register int i = (ti->ti_seq + ti->ti_len) - qhdr->ti_seq;
235
236 if (i <= 0)
237 break;
238 if (i < qhdr->ti_len) {
239 qhdr->ti_seq += i;
240 qhdr->ti_len -= i;
241 m_adj(q->ipqe_m, i);
242 break;
243 }
244 nq = q->ipqe_q.le_next;
245 m_freem(q->ipqe_m);
246 LIST_REMOVE(q, ipqe_q);
247 FREE(q, M_IPQ);
248 }
249
250 /* Insert the new fragment queue entry into place. */
251 tiqe->ipqe_m = m;
252 tiqe->ipqe_tcp = ti;
253 if (p == NULL) {
254 LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
255 } else {
256 LIST_INSERT_AFTER(p, tiqe, ipqe_q);
257 }
258
259 present:
260 /*
261 * Present data to user, advancing rcv_nxt through
262 * completed sequence space.
263 */
264 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
265 return (0);
266 q = tp->segq.lh_first;
267 if (q == NULL || q->ipqe_tcp->ti_seq != tp->rcv_nxt)
268 return (0);
269 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_tcp->ti_len)
270 return (0);
271 do {
272 tp->rcv_nxt += q->ipqe_tcp->ti_len;
273 flags = q->ipqe_tcp->ti_flags & TH_FIN;
274
275 nq = q->ipqe_q.le_next;
276 LIST_REMOVE(q, ipqe_q);
277 if (so->so_state & SS_CANTRCVMORE)
278 m_freem(q->ipqe_m);
279 else
280 sbappend(&so->so_rcv, q->ipqe_m);
281 FREE(q, M_IPQ);
282 q = nq;
283 } while (q != NULL && q->ipqe_tcp->ti_seq == tp->rcv_nxt);
284 sorwakeup(so);
285 return (flags);
286 }
287
288 /*
289 * TCP input routine, follows pages 65-76 of the
290 * protocol specification dated September, 1981 very closely.
291 */
292 void
293 #if __STDC__
294 tcp_input(struct mbuf *m, ...)
295 #else
296 tcp_input(m, va_alist)
297 register struct mbuf *m;
298 #endif
299 {
300 register struct tcpiphdr *ti;
301 register struct inpcb *inp;
302 caddr_t optp = NULL;
303 int optlen = 0;
304 int len, tlen, off, hdroptlen;
305 register struct tcpcb *tp = 0;
306 register int tiflags;
307 struct socket *so = NULL;
308 int todrop, acked, ourfinisacked, needoutput = 0;
309 short ostate = 0;
310 int iss = 0;
311 u_long tiwin;
312 struct tcp_opt_info opti;
313 int iphlen;
314 va_list ap;
315
316 va_start(ap, m);
317 iphlen = va_arg(ap, int);
318 va_end(ap);
319
320 tcpstat.tcps_rcvtotal++;
321
322 opti.ts_present = 0;
323 opti.maxseg = 0;
324
325 /*
326 * Get IP and TCP header together in first mbuf.
327 * Note: IP leaves IP header in first mbuf.
328 */
329 ti = mtod(m, struct tcpiphdr *);
330 if (iphlen > sizeof (struct ip))
331 ip_stripoptions(m, (struct mbuf *)0);
332 if (m->m_len < sizeof (struct tcpiphdr)) {
333 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
334 tcpstat.tcps_rcvshort++;
335 return;
336 }
337 ti = mtod(m, struct tcpiphdr *);
338 }
339
340 /*
341 * Checksum extended TCP header and data.
342 */
343 tlen = ((struct ip *)ti)->ip_len;
344 len = sizeof (struct ip) + tlen;
345 bzero(ti->ti_x1, sizeof ti->ti_x1);
346 ti->ti_len = (u_int16_t)tlen;
347 HTONS(ti->ti_len);
348 if ((ti->ti_sum = in_cksum(m, len)) != 0) {
349 tcpstat.tcps_rcvbadsum++;
350 goto drop;
351 }
352 #endif /* TUBA_INCLUDE */
353
354 /*
355 * Check that TCP offset makes sense,
356 * pull out TCP options and adjust length. XXX
357 */
358 off = ti->ti_off << 2;
359 if (off < sizeof (struct tcphdr) || off > tlen) {
360 tcpstat.tcps_rcvbadoff++;
361 goto drop;
362 }
363 tlen -= off;
364 ti->ti_len = tlen;
365 if (off > sizeof (struct tcphdr)) {
366 if (m->m_len < sizeof(struct ip) + off) {
367 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
368 tcpstat.tcps_rcvshort++;
369 return;
370 }
371 ti = mtod(m, struct tcpiphdr *);
372 }
373 optlen = off - sizeof (struct tcphdr);
374 optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
375 /*
376 * Do quick retrieval of timestamp options ("options
377 * prediction?"). If timestamp is the only option and it's
378 * formatted as recommended in RFC 1323 appendix A, we
379 * quickly get the values now and not bother calling
380 * tcp_dooptions(), etc.
381 */
382 if ((optlen == TCPOLEN_TSTAMP_APPA ||
383 (optlen > TCPOLEN_TSTAMP_APPA &&
384 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
385 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
386 (ti->ti_flags & TH_SYN) == 0) {
387 opti.ts_present = 1;
388 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
389 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
390 optp = NULL; /* we've parsed the options */
391 }
392 }
393 tiflags = ti->ti_flags;
394
395 /*
396 * Convert TCP protocol specific fields to host format.
397 */
398 NTOHL(ti->ti_seq);
399 NTOHL(ti->ti_ack);
400 NTOHS(ti->ti_win);
401 NTOHS(ti->ti_urp);
402
403 /*
404 * Locate pcb for segment.
405 */
406 findpcb:
407 inp = in_pcblookup_connect(&tcbtable, ti->ti_src, ti->ti_sport,
408 ti->ti_dst, ti->ti_dport);
409 if (inp == 0) {
410 ++tcpstat.tcps_pcbhashmiss;
411 inp = in_pcblookup_bind(&tcbtable, ti->ti_dst, ti->ti_dport);
412 if (inp == 0) {
413 ++tcpstat.tcps_noport;
414 goto dropwithreset;
415 }
416 }
417
418 /*
419 * If the state is CLOSED (i.e., TCB does not exist) then
420 * all data in the incoming segment is discarded.
421 * If the TCB exists but is in CLOSED state, it is embryonic,
422 * but should either do a listen or a connect soon.
423 */
424 tp = intotcpcb(inp);
425 if (tp == 0)
426 goto dropwithreset;
427 if (tp->t_state == TCPS_CLOSED)
428 goto drop;
429
430 /* Unscale the window into a 32-bit value. */
431 if ((tiflags & TH_SYN) == 0)
432 tiwin = ti->ti_win << tp->snd_scale;
433 else
434 tiwin = ti->ti_win;
435
436 so = inp->inp_socket;
437 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
438 if (so->so_options & SO_DEBUG) {
439 ostate = tp->t_state;
440 tcp_saveti = *ti;
441 }
442 if (so->so_options & SO_ACCEPTCONN) {
443 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
444 if (tiflags & TH_RST) {
445 syn_cache_reset(ti);
446 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
447 (TH_ACK|TH_SYN)) {
448 /*
449 * Received a SYN,ACK. This should
450 * never happen while we are in
451 * LISTEN. Send an RST.
452 */
453 goto badsyn;
454 } else if (tiflags & TH_ACK) {
455 so = syn_cache_get(so, m);
456 if (so == NULL) {
457 /*
458 * We don't have a SYN for
459 * this ACK; send an RST.
460 */
461 goto badsyn;
462 } else if (so ==
463 (struct socket *)(-1)) {
464 /*
465 * We were unable to create
466 * the connection. If the
467 * 3-way handshake was
468 * completeed, and RST has
469 * been sent to the peer.
470 * Since the mbuf might be
471 * in use for the reply,
472 * do not free it.
473 */
474 m = NULL;
475 } else {
476 /*
477 * We have created a
478 * full-blown connection.
479 */
480 inp = sotoinpcb(so);
481 tp = intotcpcb(inp);
482 tiwin <<= tp->snd_scale;
483 goto after_listen;
484 }
485 }
486 } else {
487 /*
488 * Received a SYN.
489 */
490 if (in_hosteq(ti->ti_src, ti->ti_dst) &&
491 ti->ti_sport == ti->ti_dport) {
492 /*
493 * LISTEN socket received a SYN
494 * from itself? This can't possibly
495 * be valid; drop the packet.
496 */
497 tcpstat.tcps_badsyn++;
498 goto drop;
499 }
500 /*
501 * SYN looks ok; create compressed TCP
502 * state for it.
503 */
504 if (so->so_qlen <= so->so_qlimit &&
505 syn_cache_add(so, m, optp, optlen, &opti))
506 m = NULL;
507 }
508 goto drop;
509 }
510 }
511
512 after_listen:
513 #ifdef DIAGNOSTIC
514 /*
515 * Should not happen now that all embryonic connections
516 * are handled with compressed state.
517 */
518 if (tp->t_state == TCPS_LISTEN)
519 panic("tcp_input: TCPS_LISTEN");
520 #endif
521
522 /*
523 * Segment received on connection.
524 * Reset idle time and keep-alive timer.
525 */
526 tp->t_idle = 0;
527 if (TCPS_HAVEESTABLISHED(tp->t_state))
528 tp->t_timer[TCPT_KEEP] = tcp_keepidle;
529
530 /*
531 * Process options.
532 */
533 if (optp)
534 tcp_dooptions(tp, optp, optlen, ti, &opti);
535
536 /*
537 * Header prediction: check for the two common cases
538 * of a uni-directional data xfer. If the packet has
539 * no control flags, is in-sequence, the window didn't
540 * change and we're not retransmitting, it's a
541 * candidate. If the length is zero and the ack moved
542 * forward, we're the sender side of the xfer. Just
543 * free the data acked & wake any higher level process
544 * that was blocked waiting for space. If the length
545 * is non-zero and the ack didn't move, we're the
546 * receiver side. If we're getting packets in-order
547 * (the reassembly queue is empty), add the data to
548 * the socket buffer and note that we need a delayed ack.
549 */
550 if (tp->t_state == TCPS_ESTABLISHED &&
551 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
552 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
553 ti->ti_seq == tp->rcv_nxt &&
554 tiwin && tiwin == tp->snd_wnd &&
555 tp->snd_nxt == tp->snd_max) {
556
557 /*
558 * If last ACK falls within this segment's sequence numbers,
559 * record the timestamp.
560 */
561 if (opti.ts_present &&
562 SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
563 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len)) {
564 tp->ts_recent_age = tcp_now;
565 tp->ts_recent = opti.ts_val;
566 }
567
568 if (ti->ti_len == 0) {
569 if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
570 SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
571 tp->snd_cwnd >= tp->snd_wnd &&
572 tp->t_dupacks < tcprexmtthresh) {
573 /*
574 * this is a pure ack for outstanding data.
575 */
576 ++tcpstat.tcps_predack;
577 if (opti.ts_present)
578 tcp_xmit_timer(tp,
579 tcp_now-opti.ts_ecr+1);
580 else if (tp->t_rtt &&
581 SEQ_GT(ti->ti_ack, tp->t_rtseq))
582 tcp_xmit_timer(tp, tp->t_rtt);
583 acked = ti->ti_ack - tp->snd_una;
584 tcpstat.tcps_rcvackpack++;
585 tcpstat.tcps_rcvackbyte += acked;
586 sbdrop(&so->so_snd, acked);
587 tp->snd_una = ti->ti_ack;
588 m_freem(m);
589
590 /*
591 * If all outstanding data are acked, stop
592 * retransmit timer, otherwise restart timer
593 * using current (possibly backed-off) value.
594 * If process is waiting for space,
595 * wakeup/selwakeup/signal. If data
596 * are ready to send, let tcp_output
597 * decide between more output or persist.
598 */
599 if (tp->snd_una == tp->snd_max)
600 tp->t_timer[TCPT_REXMT] = 0;
601 else if (tp->t_timer[TCPT_PERSIST] == 0)
602 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
603
604 if (sb_notify(&so->so_snd))
605 sowwakeup(so);
606 if (so->so_snd.sb_cc)
607 (void) tcp_output(tp);
608 return;
609 }
610 } else if (ti->ti_ack == tp->snd_una &&
611 tp->segq.lh_first == NULL &&
612 ti->ti_len <= sbspace(&so->so_rcv)) {
613 /*
614 * this is a pure, in-sequence data packet
615 * with nothing on the reassembly queue and
616 * we have enough buffer space to take it.
617 */
618 ++tcpstat.tcps_preddat;
619 tp->rcv_nxt += ti->ti_len;
620 tcpstat.tcps_rcvpack++;
621 tcpstat.tcps_rcvbyte += ti->ti_len;
622 /*
623 * Drop TCP, IP headers and TCP options then add data
624 * to socket buffer.
625 */
626 m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
627 m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
628 sbappend(&so->so_rcv, m);
629 sorwakeup(so);
630 TCP_SETUP_ACK(tp, ti);
631 if (tp->t_flags & TF_ACKNOW)
632 (void) tcp_output(tp);
633 return;
634 }
635 }
636
637 /*
638 * Drop TCP, IP headers and TCP options.
639 */
640 hdroptlen = sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
641 m->m_data += hdroptlen;
642 m->m_len -= hdroptlen;
643
644 /*
645 * Calculate amount of space in receive window,
646 * and then do TCP input processing.
647 * Receive window is amount of space in rcv queue,
648 * but not less than advertised window.
649 */
650 { int win;
651
652 win = sbspace(&so->so_rcv);
653 if (win < 0)
654 win = 0;
655 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
656 }
657
658 switch (tp->t_state) {
659
660 /*
661 * If the state is SYN_SENT:
662 * if seg contains an ACK, but not for our SYN, drop the input.
663 * if seg contains a RST, then drop the connection.
664 * if seg does not contain SYN, then drop it.
665 * Otherwise this is an acceptable SYN segment
666 * initialize tp->rcv_nxt and tp->irs
667 * if seg contains ack then advance tp->snd_una
668 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
669 * arrange for segment to be acked (eventually)
670 * continue processing rest of data/controls, beginning with URG
671 */
672 case TCPS_SYN_SENT:
673 if ((tiflags & TH_ACK) &&
674 (SEQ_LEQ(ti->ti_ack, tp->iss) ||
675 SEQ_GT(ti->ti_ack, tp->snd_max)))
676 goto dropwithreset;
677 if (tiflags & TH_RST) {
678 if (tiflags & TH_ACK)
679 tp = tcp_drop(tp, ECONNREFUSED);
680 goto drop;
681 }
682 if ((tiflags & TH_SYN) == 0)
683 goto drop;
684 if (tiflags & TH_ACK) {
685 tp->snd_una = ti->ti_ack;
686 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
687 tp->snd_nxt = tp->snd_una;
688 }
689 tp->t_timer[TCPT_REXMT] = 0;
690 tp->irs = ti->ti_seq;
691 tcp_rcvseqinit(tp);
692 tp->t_flags |= TF_ACKNOW;
693 tcp_mss_from_peer(tp, opti.maxseg);
694
695 /*
696 * Initialize the initial congestion window. If we
697 * had to retransmit the SYN, we must initialize cwnd
698 * to 1 segment.
699 */
700 tp->snd_cwnd =
701 TCP_INITIAL_WINDOW((tp->t_flags & TF_SYN_REXMT) ? 1 :
702 tcp_init_win, tp->t_peermss);
703
704 tcp_rmx_rtt(tp);
705 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
706 tcpstat.tcps_connects++;
707 soisconnected(so);
708 tcp_established(tp);
709 /* Do window scaling on this connection? */
710 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
711 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
712 tp->snd_scale = tp->requested_s_scale;
713 tp->rcv_scale = tp->request_r_scale;
714 }
715 (void) tcp_reass(tp, (struct tcpiphdr *)0,
716 (struct mbuf *)0);
717 /*
718 * if we didn't have to retransmit the SYN,
719 * use its rtt as our initial srtt & rtt var.
720 */
721 if (tp->t_rtt)
722 tcp_xmit_timer(tp, tp->t_rtt);
723 } else
724 tp->t_state = TCPS_SYN_RECEIVED;
725
726 /*
727 * Advance ti->ti_seq to correspond to first data byte.
728 * If data, trim to stay within window,
729 * dropping FIN if necessary.
730 */
731 ti->ti_seq++;
732 if (ti->ti_len > tp->rcv_wnd) {
733 todrop = ti->ti_len - tp->rcv_wnd;
734 m_adj(m, -todrop);
735 ti->ti_len = tp->rcv_wnd;
736 tiflags &= ~TH_FIN;
737 tcpstat.tcps_rcvpackafterwin++;
738 tcpstat.tcps_rcvbyteafterwin += todrop;
739 }
740 tp->snd_wl1 = ti->ti_seq - 1;
741 tp->rcv_up = ti->ti_seq;
742 goto step6;
743
744 /*
745 * If the state is SYN_RECEIVED:
746 * If seg contains an ACK, but not for our SYN, drop the input
747 * and generate an RST. See page 36, rfc793
748 */
749 case TCPS_SYN_RECEIVED:
750 if ((tiflags & TH_ACK) &&
751 (SEQ_LEQ(ti->ti_ack, tp->iss) ||
752 SEQ_GT(ti->ti_ack, tp->snd_max)))
753 goto dropwithreset;
754 break;
755 }
756
757 /*
758 * States other than LISTEN or SYN_SENT.
759 * First check timestamp, if present.
760 * Then check that at least some bytes of segment are within
761 * receive window. If segment begins before rcv_nxt,
762 * drop leading data (and SYN); if nothing left, just ack.
763 *
764 * RFC 1323 PAWS: If we have a timestamp reply on this segment
765 * and it's less than ts_recent, drop it.
766 */
767 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
768 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
769
770 /* Check to see if ts_recent is over 24 days old. */
771 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) {
772 /*
773 * Invalidate ts_recent. If this segment updates
774 * ts_recent, the age will be reset later and ts_recent
775 * will get a valid value. If it does not, setting
776 * ts_recent to zero will at least satisfy the
777 * requirement that zero be placed in the timestamp
778 * echo reply when ts_recent isn't valid. The
779 * age isn't reset until we get a valid ts_recent
780 * because we don't want out-of-order segments to be
781 * dropped when ts_recent is old.
782 */
783 tp->ts_recent = 0;
784 } else {
785 tcpstat.tcps_rcvduppack++;
786 tcpstat.tcps_rcvdupbyte += ti->ti_len;
787 tcpstat.tcps_pawsdrop++;
788 goto dropafterack;
789 }
790 }
791
792 todrop = tp->rcv_nxt - ti->ti_seq;
793 if (todrop > 0) {
794 if (tiflags & TH_SYN) {
795 tiflags &= ~TH_SYN;
796 ti->ti_seq++;
797 if (ti->ti_urp > 1)
798 ti->ti_urp--;
799 else {
800 tiflags &= ~TH_URG;
801 ti->ti_urp = 0;
802 }
803 todrop--;
804 }
805 if (todrop > ti->ti_len ||
806 (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) {
807 /*
808 * Any valid FIN must be to the left of the window.
809 * At this point the FIN must be a duplicate or
810 * out of sequence; drop it.
811 */
812 tiflags &= ~TH_FIN;
813 /*
814 * Send an ACK to resynchronize and drop any data.
815 * But keep on processing for RST or ACK.
816 */
817 tp->t_flags |= TF_ACKNOW;
818 todrop = ti->ti_len;
819 tcpstat.tcps_rcvdupbyte += todrop;
820 tcpstat.tcps_rcvduppack++;
821 } else {
822 tcpstat.tcps_rcvpartduppack++;
823 tcpstat.tcps_rcvpartdupbyte += todrop;
824 }
825 m_adj(m, todrop);
826 ti->ti_seq += todrop;
827 ti->ti_len -= todrop;
828 if (ti->ti_urp > todrop)
829 ti->ti_urp -= todrop;
830 else {
831 tiflags &= ~TH_URG;
832 ti->ti_urp = 0;
833 }
834 }
835
836 /*
837 * If new data are received on a connection after the
838 * user processes are gone, then RST the other end.
839 */
840 if ((so->so_state & SS_NOFDREF) &&
841 tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
842 tp = tcp_close(tp);
843 tcpstat.tcps_rcvafterclose++;
844 goto dropwithreset;
845 }
846
847 /*
848 * If segment ends after window, drop trailing data
849 * (and PUSH and FIN); if nothing left, just ACK.
850 */
851 todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
852 if (todrop > 0) {
853 tcpstat.tcps_rcvpackafterwin++;
854 if (todrop >= ti->ti_len) {
855 tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
856 /*
857 * If a new connection request is received
858 * while in TIME_WAIT, drop the old connection
859 * and start over if the sequence numbers
860 * are above the previous ones.
861 */
862 if (tiflags & TH_SYN &&
863 tp->t_state == TCPS_TIME_WAIT &&
864 SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
865 iss = tcp_new_iss(tp, sizeof(struct tcpcb),
866 tp->rcv_nxt);
867 tp = tcp_close(tp);
868 /*
869 * We have already advanced the mbuf
870 * pointers past the IP+TCP headers and
871 * options. Restore those pointers before
872 * attempting to use the TCP header again.
873 */
874 m->m_data -= hdroptlen;
875 m->m_len += hdroptlen;
876 goto findpcb;
877 }
878 /*
879 * If window is closed can only take segments at
880 * window edge, and have to drop data and PUSH from
881 * incoming segments. Continue processing, but
882 * remember to ack. Otherwise, drop segment
883 * and ack.
884 */
885 if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
886 tp->t_flags |= TF_ACKNOW;
887 tcpstat.tcps_rcvwinprobe++;
888 } else
889 goto dropafterack;
890 } else
891 tcpstat.tcps_rcvbyteafterwin += todrop;
892 m_adj(m, -todrop);
893 ti->ti_len -= todrop;
894 tiflags &= ~(TH_PUSH|TH_FIN);
895 }
896
897 /*
898 * If last ACK falls within this segment's sequence numbers,
899 * record its timestamp.
900 */
901 if (opti.ts_present && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) &&
902 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len +
903 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
904 tp->ts_recent_age = tcp_now;
905 tp->ts_recent = opti.ts_val;
906 }
907
908 /*
909 * If the RST bit is set examine the state:
910 * SYN_RECEIVED STATE:
911 * If passive open, return to LISTEN state.
912 * If active open, inform user that connection was refused.
913 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
914 * Inform user that connection was reset, and close tcb.
915 * CLOSING, LAST_ACK, TIME_WAIT STATES
916 * Close the tcb.
917 */
918 if (tiflags&TH_RST) switch (tp->t_state) {
919
920 case TCPS_SYN_RECEIVED:
921 so->so_error = ECONNREFUSED;
922 goto close;
923
924 case TCPS_ESTABLISHED:
925 case TCPS_FIN_WAIT_1:
926 case TCPS_FIN_WAIT_2:
927 case TCPS_CLOSE_WAIT:
928 so->so_error = ECONNRESET;
929 close:
930 tp->t_state = TCPS_CLOSED;
931 tcpstat.tcps_drops++;
932 tp = tcp_close(tp);
933 goto drop;
934
935 case TCPS_CLOSING:
936 case TCPS_LAST_ACK:
937 case TCPS_TIME_WAIT:
938 tp = tcp_close(tp);
939 goto drop;
940 }
941
942 /*
943 * If a SYN is in the window, then this is an
944 * error and we send an RST and drop the connection.
945 */
946 if (tiflags & TH_SYN) {
947 tp = tcp_drop(tp, ECONNRESET);
948 goto dropwithreset;
949 }
950
951 /*
952 * If the ACK bit is off we drop the segment and return.
953 */
954 if ((tiflags & TH_ACK) == 0)
955 goto drop;
956
957 /*
958 * Ack processing.
959 */
960 switch (tp->t_state) {
961
962 /*
963 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
964 * ESTABLISHED state and continue processing, otherwise
965 * send an RST.
966 */
967 case TCPS_SYN_RECEIVED:
968 if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
969 SEQ_GT(ti->ti_ack, tp->snd_max))
970 goto dropwithreset;
971 tcpstat.tcps_connects++;
972 soisconnected(so);
973 tcp_established(tp);
974 /* Do window scaling? */
975 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
976 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
977 tp->snd_scale = tp->requested_s_scale;
978 tp->rcv_scale = tp->request_r_scale;
979 }
980 (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
981 tp->snd_wl1 = ti->ti_seq - 1;
982 /* fall into ... */
983
984 /*
985 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
986 * ACKs. If the ack is in the range
987 * tp->snd_una < ti->ti_ack <= tp->snd_max
988 * then advance tp->snd_una to ti->ti_ack and drop
989 * data from the retransmission queue. If this ACK reflects
990 * more up to date window information we update our window information.
991 */
992 case TCPS_ESTABLISHED:
993 case TCPS_FIN_WAIT_1:
994 case TCPS_FIN_WAIT_2:
995 case TCPS_CLOSE_WAIT:
996 case TCPS_CLOSING:
997 case TCPS_LAST_ACK:
998 case TCPS_TIME_WAIT:
999
1000 if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
1001 if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
1002 tcpstat.tcps_rcvdupack++;
1003 /*
1004 * If we have outstanding data (other than
1005 * a window probe), this is a completely
1006 * duplicate ack (ie, window info didn't
1007 * change), the ack is the biggest we've
1008 * seen and we've seen exactly our rexmt
1009 * threshhold of them, assume a packet
1010 * has been dropped and retransmit it.
1011 * Kludge snd_nxt & the congestion
1012 * window so we send only this one
1013 * packet.
1014 *
1015 * We know we're losing at the current
1016 * window size so do congestion avoidance
1017 * (set ssthresh to half the current window
1018 * and pull our congestion window back to
1019 * the new ssthresh).
1020 *
1021 * Dup acks mean that packets have left the
1022 * network (they're now cached at the receiver)
1023 * so bump cwnd by the amount in the receiver
1024 * to keep a constant cwnd packets in the
1025 * network.
1026 */
1027 if (tp->t_timer[TCPT_REXMT] == 0 ||
1028 ti->ti_ack != tp->snd_una)
1029 tp->t_dupacks = 0;
1030 else if (++tp->t_dupacks == tcprexmtthresh) {
1031 tcp_seq onxt = tp->snd_nxt;
1032 u_int win =
1033 min(tp->snd_wnd, tp->snd_cwnd) /
1034 2 / tp->t_segsz;
1035
1036 if (win < 2)
1037 win = 2;
1038 tp->snd_ssthresh = win * tp->t_segsz;
1039 tp->t_timer[TCPT_REXMT] = 0;
1040 tp->t_rtt = 0;
1041 tp->snd_nxt = ti->ti_ack;
1042 tp->snd_cwnd = tp->t_segsz;
1043 (void) tcp_output(tp);
1044 tp->snd_cwnd = tp->snd_ssthresh +
1045 tp->t_segsz * tp->t_dupacks;
1046 if (SEQ_GT(onxt, tp->snd_nxt))
1047 tp->snd_nxt = onxt;
1048 goto drop;
1049 } else if (tp->t_dupacks > tcprexmtthresh) {
1050 tp->snd_cwnd += tp->t_segsz;
1051 (void) tcp_output(tp);
1052 goto drop;
1053 }
1054 } else
1055 tp->t_dupacks = 0;
1056 break;
1057 }
1058 /*
1059 * If the congestion window was inflated to account
1060 * for the other side's cached packets, retract it.
1061 */
1062 if (tp->t_dupacks >= tcprexmtthresh &&
1063 tp->snd_cwnd > tp->snd_ssthresh)
1064 tp->snd_cwnd = tp->snd_ssthresh;
1065 tp->t_dupacks = 0;
1066 if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
1067 tcpstat.tcps_rcvacktoomuch++;
1068 goto dropafterack;
1069 }
1070 acked = ti->ti_ack - tp->snd_una;
1071 tcpstat.tcps_rcvackpack++;
1072 tcpstat.tcps_rcvackbyte += acked;
1073
1074 /*
1075 * If we have a timestamp reply, update smoothed
1076 * round trip time. If no timestamp is present but
1077 * transmit timer is running and timed sequence
1078 * number was acked, update smoothed round trip time.
1079 * Since we now have an rtt measurement, cancel the
1080 * timer backoff (cf., Phil Karn's retransmit alg.).
1081 * Recompute the initial retransmit timer.
1082 */
1083 if (opti.ts_present)
1084 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1);
1085 else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
1086 tcp_xmit_timer(tp,tp->t_rtt);
1087
1088 /*
1089 * If all outstanding data is acked, stop retransmit
1090 * timer and remember to restart (more output or persist).
1091 * If there is more data to be acked, restart retransmit
1092 * timer, using current (possibly backed-off) value.
1093 */
1094 if (ti->ti_ack == tp->snd_max) {
1095 tp->t_timer[TCPT_REXMT] = 0;
1096 needoutput = 1;
1097 } else if (tp->t_timer[TCPT_PERSIST] == 0)
1098 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
1099 /*
1100 * When new data is acked, open the congestion window.
1101 * If the window gives us less than ssthresh packets
1102 * in flight, open exponentially (segsz per packet).
1103 * Otherwise open linearly: segsz per window
1104 * (segsz^2 / cwnd per packet), plus a constant
1105 * fraction of a packet (segsz/8) to help larger windows
1106 * open quickly enough.
1107 */
1108 {
1109 register u_int cw = tp->snd_cwnd;
1110 register u_int incr = tp->t_segsz;
1111
1112 if (cw > tp->snd_ssthresh)
1113 incr = incr * incr / cw;
1114 tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale);
1115 }
1116 if (acked > so->so_snd.sb_cc) {
1117 tp->snd_wnd -= so->so_snd.sb_cc;
1118 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
1119 ourfinisacked = 1;
1120 } else {
1121 sbdrop(&so->so_snd, acked);
1122 tp->snd_wnd -= acked;
1123 ourfinisacked = 0;
1124 }
1125 if (sb_notify(&so->so_snd))
1126 sowwakeup(so);
1127 tp->snd_una = ti->ti_ack;
1128 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1129 tp->snd_nxt = tp->snd_una;
1130
1131 switch (tp->t_state) {
1132
1133 /*
1134 * In FIN_WAIT_1 STATE in addition to the processing
1135 * for the ESTABLISHED state if our FIN is now acknowledged
1136 * then enter FIN_WAIT_2.
1137 */
1138 case TCPS_FIN_WAIT_1:
1139 if (ourfinisacked) {
1140 /*
1141 * If we can't receive any more
1142 * data, then closing user can proceed.
1143 * Starting the timer is contrary to the
1144 * specification, but if we don't get a FIN
1145 * we'll hang forever.
1146 */
1147 if (so->so_state & SS_CANTRCVMORE) {
1148 soisdisconnected(so);
1149 tp->t_timer[TCPT_2MSL] = tcp_maxidle;
1150 }
1151 tp->t_state = TCPS_FIN_WAIT_2;
1152 }
1153 break;
1154
1155 /*
1156 * In CLOSING STATE in addition to the processing for
1157 * the ESTABLISHED state if the ACK acknowledges our FIN
1158 * then enter the TIME-WAIT state, otherwise ignore
1159 * the segment.
1160 */
1161 case TCPS_CLOSING:
1162 if (ourfinisacked) {
1163 tp->t_state = TCPS_TIME_WAIT;
1164 tcp_canceltimers(tp);
1165 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1166 soisdisconnected(so);
1167 }
1168 break;
1169
1170 /*
1171 * In LAST_ACK, we may still be waiting for data to drain
1172 * and/or to be acked, as well as for the ack of our FIN.
1173 * If our FIN is now acknowledged, delete the TCB,
1174 * enter the closed state and return.
1175 */
1176 case TCPS_LAST_ACK:
1177 if (ourfinisacked) {
1178 tp = tcp_close(tp);
1179 goto drop;
1180 }
1181 break;
1182
1183 /*
1184 * In TIME_WAIT state the only thing that should arrive
1185 * is a retransmission of the remote FIN. Acknowledge
1186 * it and restart the finack timer.
1187 */
1188 case TCPS_TIME_WAIT:
1189 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1190 goto dropafterack;
1191 }
1192 }
1193
1194 step6:
1195 /*
1196 * Update window information.
1197 * Don't look at window if no ACK: TAC's send garbage on first SYN.
1198 */
1199 if (((tiflags & TH_ACK) && SEQ_LT(tp->snd_wl1, ti->ti_seq)) ||
1200 (tp->snd_wl1 == ti->ti_seq && SEQ_LT(tp->snd_wl2, ti->ti_ack)) ||
1201 (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)) {
1202 /* keep track of pure window updates */
1203 if (ti->ti_len == 0 &&
1204 tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)
1205 tcpstat.tcps_rcvwinupd++;
1206 tp->snd_wnd = tiwin;
1207 tp->snd_wl1 = ti->ti_seq;
1208 tp->snd_wl2 = ti->ti_ack;
1209 if (tp->snd_wnd > tp->max_sndwnd)
1210 tp->max_sndwnd = tp->snd_wnd;
1211 needoutput = 1;
1212 }
1213
1214 /*
1215 * Process segments with URG.
1216 */
1217 if ((tiflags & TH_URG) && ti->ti_urp &&
1218 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1219 /*
1220 * This is a kludge, but if we receive and accept
1221 * random urgent pointers, we'll crash in
1222 * soreceive. It's hard to imagine someone
1223 * actually wanting to send this much urgent data.
1224 */
1225 if (ti->ti_urp + so->so_rcv.sb_cc > sb_max) {
1226 ti->ti_urp = 0; /* XXX */
1227 tiflags &= ~TH_URG; /* XXX */
1228 goto dodata; /* XXX */
1229 }
1230 /*
1231 * If this segment advances the known urgent pointer,
1232 * then mark the data stream. This should not happen
1233 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1234 * a FIN has been received from the remote side.
1235 * In these states we ignore the URG.
1236 *
1237 * According to RFC961 (Assigned Protocols),
1238 * the urgent pointer points to the last octet
1239 * of urgent data. We continue, however,
1240 * to consider it to indicate the first octet
1241 * of data past the urgent section as the original
1242 * spec states (in one of two places).
1243 */
1244 if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
1245 tp->rcv_up = ti->ti_seq + ti->ti_urp;
1246 so->so_oobmark = so->so_rcv.sb_cc +
1247 (tp->rcv_up - tp->rcv_nxt) - 1;
1248 if (so->so_oobmark == 0)
1249 so->so_state |= SS_RCVATMARK;
1250 sohasoutofband(so);
1251 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1252 }
1253 /*
1254 * Remove out of band data so doesn't get presented to user.
1255 * This can happen independent of advancing the URG pointer,
1256 * but if two URG's are pending at once, some out-of-band
1257 * data may creep in... ick.
1258 */
1259 if (ti->ti_urp <= (u_int16_t) ti->ti_len
1260 #ifdef SO_OOBINLINE
1261 && (so->so_options & SO_OOBINLINE) == 0
1262 #endif
1263 )
1264 tcp_pulloutofband(so, ti, m);
1265 } else
1266 /*
1267 * If no out of band data is expected,
1268 * pull receive urgent pointer along
1269 * with the receive window.
1270 */
1271 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1272 tp->rcv_up = tp->rcv_nxt;
1273 dodata: /* XXX */
1274
1275 /*
1276 * Process the segment text, merging it into the TCP sequencing queue,
1277 * and arranging for acknowledgment of receipt if necessary.
1278 * This process logically involves adjusting tp->rcv_wnd as data
1279 * is presented to the user (this happens in tcp_usrreq.c,
1280 * case PRU_RCVD). If a FIN has already been received on this
1281 * connection then we just ignore the text.
1282 */
1283 if ((ti->ti_len || (tiflags & TH_FIN)) &&
1284 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1285 TCP_REASS(tp, ti, m, so, tiflags);
1286 /*
1287 * Note the amount of data that peer has sent into
1288 * our window, in order to estimate the sender's
1289 * buffer size.
1290 */
1291 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
1292 } else {
1293 m_freem(m);
1294 tiflags &= ~TH_FIN;
1295 }
1296
1297 /*
1298 * If FIN is received ACK the FIN and let the user know
1299 * that the connection is closing. Ignore a FIN received before
1300 * the connection is fully established.
1301 */
1302 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
1303 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1304 socantrcvmore(so);
1305 tp->t_flags |= TF_ACKNOW;
1306 tp->rcv_nxt++;
1307 }
1308 switch (tp->t_state) {
1309
1310 /*
1311 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
1312 */
1313 case TCPS_ESTABLISHED:
1314 tp->t_state = TCPS_CLOSE_WAIT;
1315 break;
1316
1317 /*
1318 * If still in FIN_WAIT_1 STATE FIN has not been acked so
1319 * enter the CLOSING state.
1320 */
1321 case TCPS_FIN_WAIT_1:
1322 tp->t_state = TCPS_CLOSING;
1323 break;
1324
1325 /*
1326 * In FIN_WAIT_2 state enter the TIME_WAIT state,
1327 * starting the time-wait timer, turning off the other
1328 * standard timers.
1329 */
1330 case TCPS_FIN_WAIT_2:
1331 tp->t_state = TCPS_TIME_WAIT;
1332 tcp_canceltimers(tp);
1333 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1334 soisdisconnected(so);
1335 break;
1336
1337 /*
1338 * In TIME_WAIT state restart the 2 MSL time_wait timer.
1339 */
1340 case TCPS_TIME_WAIT:
1341 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1342 break;
1343 }
1344 }
1345 if (so->so_options & SO_DEBUG)
1346 tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
1347
1348 /*
1349 * Return any desired output.
1350 */
1351 if (needoutput || (tp->t_flags & TF_ACKNOW))
1352 (void) tcp_output(tp);
1353 return;
1354
1355 badsyn:
1356 /*
1357 * Received a bad SYN. Increment counters and dropwithreset.
1358 */
1359 tcpstat.tcps_badsyn++;
1360 tp = NULL;
1361 goto dropwithreset;
1362
1363 dropafterack:
1364 /*
1365 * Generate an ACK dropping incoming segment if it occupies
1366 * sequence space, where the ACK reflects our state.
1367 */
1368 if (tiflags & TH_RST)
1369 goto drop;
1370 m_freem(m);
1371 tp->t_flags |= TF_ACKNOW;
1372 (void) tcp_output(tp);
1373 return;
1374
1375 dropwithreset:
1376 /*
1377 * Generate a RST, dropping incoming segment.
1378 * Make ACK acceptable to originator of segment.
1379 * Don't bother to respond if destination was broadcast/multicast.
1380 */
1381 if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) ||
1382 IN_MULTICAST(ti->ti_dst.s_addr))
1383 goto drop;
1384 if (tiflags & TH_ACK)
1385 (void)tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST);
1386 else {
1387 if (tiflags & TH_SYN)
1388 ti->ti_len++;
1389 (void)tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0,
1390 TH_RST|TH_ACK);
1391 }
1392 return;
1393
1394 drop:
1395 /*
1396 * Drop space held by incoming segment and return.
1397 */
1398 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
1399 tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
1400 m_freem(m);
1401 return;
1402 #ifndef TUBA_INCLUDE
1403 }
1404
1405 void
1406 tcp_dooptions(tp, cp, cnt, ti, oi)
1407 struct tcpcb *tp;
1408 u_char *cp;
1409 int cnt;
1410 struct tcpiphdr *ti;
1411 struct tcp_opt_info *oi;
1412 {
1413 u_int16_t mss;
1414 int opt, optlen;
1415
1416 for (; cnt > 0; cnt -= optlen, cp += optlen) {
1417 opt = cp[0];
1418 if (opt == TCPOPT_EOL)
1419 break;
1420 if (opt == TCPOPT_NOP)
1421 optlen = 1;
1422 else {
1423 optlen = cp[1];
1424 if (optlen <= 0)
1425 break;
1426 }
1427 switch (opt) {
1428
1429 default:
1430 continue;
1431
1432 case TCPOPT_MAXSEG:
1433 if (optlen != TCPOLEN_MAXSEG)
1434 continue;
1435 if (!(ti->ti_flags & TH_SYN))
1436 continue;
1437 bcopy(cp + 2, &mss, sizeof(mss));
1438 oi->maxseg = ntohs(mss);
1439 break;
1440
1441 case TCPOPT_WINDOW:
1442 if (optlen != TCPOLEN_WINDOW)
1443 continue;
1444 if (!(ti->ti_flags & TH_SYN))
1445 continue;
1446 tp->t_flags |= TF_RCVD_SCALE;
1447 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
1448 break;
1449
1450 case TCPOPT_TIMESTAMP:
1451 if (optlen != TCPOLEN_TIMESTAMP)
1452 continue;
1453 oi->ts_present = 1;
1454 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
1455 NTOHL(oi->ts_val);
1456 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
1457 NTOHL(oi->ts_ecr);
1458
1459 /*
1460 * A timestamp received in a SYN makes
1461 * it ok to send timestamp requests and replies.
1462 */
1463 if (ti->ti_flags & TH_SYN) {
1464 tp->t_flags |= TF_RCVD_TSTMP;
1465 tp->ts_recent = oi->ts_val;
1466 tp->ts_recent_age = tcp_now;
1467 }
1468 break;
1469 }
1470 }
1471 }
1472
1473 /*
1474 * Pull out of band byte out of a segment so
1475 * it doesn't appear in the user's data queue.
1476 * It is still reflected in the segment length for
1477 * sequencing purposes.
1478 */
1479 void
1480 tcp_pulloutofband(so, ti, m)
1481 struct socket *so;
1482 struct tcpiphdr *ti;
1483 register struct mbuf *m;
1484 {
1485 int cnt = ti->ti_urp - 1;
1486
1487 while (cnt >= 0) {
1488 if (m->m_len > cnt) {
1489 char *cp = mtod(m, caddr_t) + cnt;
1490 struct tcpcb *tp = sototcpcb(so);
1491
1492 tp->t_iobc = *cp;
1493 tp->t_oobflags |= TCPOOB_HAVEDATA;
1494 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
1495 m->m_len--;
1496 return;
1497 }
1498 cnt -= m->m_len;
1499 m = m->m_next;
1500 if (m == 0)
1501 break;
1502 }
1503 panic("tcp_pulloutofband");
1504 }
1505
1506 /*
1507 * Collect new round-trip time estimate
1508 * and update averages and current timeout.
1509 */
1510 void
1511 tcp_xmit_timer(tp, rtt)
1512 register struct tcpcb *tp;
1513 short rtt;
1514 {
1515 register short delta;
1516 short rttmin;
1517
1518 tcpstat.tcps_rttupdated++;
1519 --rtt;
1520 if (tp->t_srtt != 0) {
1521 /*
1522 * srtt is stored as fixed point with 3 bits after the
1523 * binary point (i.e., scaled by 8). The following magic
1524 * is equivalent to the smoothing algorithm in rfc793 with
1525 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
1526 * point). Adjust rtt to origin 0.
1527 */
1528 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
1529 if ((tp->t_srtt += delta) <= 0)
1530 tp->t_srtt = 1 << 2;
1531 /*
1532 * We accumulate a smoothed rtt variance (actually, a
1533 * smoothed mean difference), then set the retransmit
1534 * timer to smoothed rtt + 4 times the smoothed variance.
1535 * rttvar is stored as fixed point with 2 bits after the
1536 * binary point (scaled by 4). The following is
1537 * equivalent to rfc793 smoothing with an alpha of .75
1538 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
1539 * rfc793's wired-in beta.
1540 */
1541 if (delta < 0)
1542 delta = -delta;
1543 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
1544 if ((tp->t_rttvar += delta) <= 0)
1545 tp->t_rttvar = 1 << 2;
1546 } else {
1547 /*
1548 * No rtt measurement yet - use the unsmoothed rtt.
1549 * Set the variance to half the rtt (so our first
1550 * retransmit happens at 3*rtt).
1551 */
1552 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
1553 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
1554 }
1555 tp->t_rtt = 0;
1556 tp->t_rxtshift = 0;
1557
1558 /*
1559 * the retransmit should happen at rtt + 4 * rttvar.
1560 * Because of the way we do the smoothing, srtt and rttvar
1561 * will each average +1/2 tick of bias. When we compute
1562 * the retransmit timer, we want 1/2 tick of rounding and
1563 * 1 extra tick because of +-1/2 tick uncertainty in the
1564 * firing of the timer. The bias will give us exactly the
1565 * 1.5 tick we need. But, because the bias is
1566 * statistical, we have to test that we don't drop below
1567 * the minimum feasible timer (which is 2 ticks).
1568 */
1569 if (tp->t_rttmin > rtt + 2)
1570 rttmin = tp->t_rttmin;
1571 else
1572 rttmin = rtt + 2;
1573 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX);
1574
1575 /*
1576 * We received an ack for a packet that wasn't retransmitted;
1577 * it is probably safe to discard any error indications we've
1578 * received recently. This isn't quite right, but close enough
1579 * for now (a route might have failed after we sent a segment,
1580 * and the return path might not be symmetrical).
1581 */
1582 tp->t_softerror = 0;
1583 }
1584
1585 /*
1586 * TCP compressed state engine. Currently used to hold compressed
1587 * state for SYN_RECEIVED.
1588 */
1589
1590 u_long syn_cache_count;
1591 u_int32_t syn_hash1, syn_hash2;
1592
1593 #define SYN_HASH(sa, sp, dp) \
1594 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
1595 ((u_int32_t)(sp)))^syn_hash2)))
1596
1597 #define eptosp(ep, e, s) ((struct s *)((char *)(ep) - \
1598 ((char *)(&((struct s *)0)->e) - (char *)0)))
1599
1600 #define SYN_CACHE_RM(sc, p, scp) { \
1601 *(p) = (sc)->sc_next; \
1602 if ((sc)->sc_next) \
1603 (sc)->sc_next->sc_timer += (sc)->sc_timer; \
1604 else { \
1605 (scp)->sch_timer_sum -= (sc)->sc_timer; \
1606 if ((scp)->sch_timer_sum <= 0) \
1607 (scp)->sch_timer_sum = -1; \
1608 /* If need be, fix up the last pointer */ \
1609 if ((scp)->sch_first) \
1610 (scp)->sch_last = eptosp(p, sc_next, syn_cache); \
1611 } \
1612 (scp)->sch_length--; \
1613 syn_cache_count--; \
1614 }
1615
1616 void
1617 syn_cache_insert(sc, prevp, headp)
1618 struct syn_cache *sc;
1619 struct syn_cache ***prevp;
1620 struct syn_cache_head **headp;
1621 {
1622 struct syn_cache_head *scp, *scp2, *sce;
1623 struct syn_cache *sc2;
1624 static u_int timeo_val;
1625 int s;
1626
1627 /* Initialize the hash secrets when adding the first entry */
1628 if (syn_cache_count == 0) {
1629 struct timeval tv;
1630 microtime(&tv);
1631 syn_hash1 = random() ^ (u_long)≻
1632 syn_hash2 = random() ^ tv.tv_usec;
1633 }
1634
1635 sc->sc_hash = SYN_HASH(&sc->sc_src, sc->sc_sport, sc->sc_dport);
1636 sc->sc_next = NULL;
1637 scp = &tcp_syn_cache[sc->sc_hash % tcp_syn_cache_size];
1638 *headp = scp;
1639
1640 /*
1641 * Make sure that we don't overflow the per-bucket
1642 * limit or the total cache size limit.
1643 */
1644 s = splsoftnet();
1645 if (scp->sch_length >= tcp_syn_bucket_limit) {
1646 tcpstat.tcps_sc_bucketoverflow++;
1647 sc2 = scp->sch_first;
1648 scp->sch_first = sc2->sc_next;
1649 if (sc2->sc_ipopts)
1650 (void) m_free(sc2->sc_ipopts);
1651 FREE(sc2, M_PCB);
1652 } else if (syn_cache_count >= tcp_syn_cache_limit) {
1653 tcpstat.tcps_sc_overflowed++;
1654 /*
1655 * The cache is full. Toss the first (i.e, oldest)
1656 * element in this bucket.
1657 */
1658 scp2 = scp;
1659 if (scp2->sch_first == NULL) {
1660 sce = &tcp_syn_cache[tcp_syn_cache_size];
1661 for (++scp2; scp2 != scp; scp2++) {
1662 if (scp2 >= sce)
1663 scp2 = &tcp_syn_cache[0];
1664 if (scp2->sch_first)
1665 break;
1666 }
1667 }
1668 sc2 = scp2->sch_first;
1669 if (sc2 == NULL) {
1670 if (sc->sc_ipopts)
1671 (void) m_free(sc->sc_ipopts);
1672 FREE(sc, M_PCB);
1673 return;
1674 }
1675 if ((scp2->sch_first = sc2->sc_next) == NULL)
1676 scp2->sch_last = NULL;
1677 else
1678 sc2->sc_next->sc_timer += sc2->sc_timer;
1679 if (sc2->sc_ipopts)
1680 (void) m_free(sc2->sc_ipopts);
1681 FREE(sc2, M_PCB);
1682 } else {
1683 scp->sch_length++;
1684 syn_cache_count++;
1685 }
1686 tcpstat.tcps_sc_added++;
1687
1688 /*
1689 * Put it into the bucket.
1690 */
1691 if (scp->sch_first == NULL)
1692 *prevp = &scp->sch_first;
1693 else {
1694 *prevp = &scp->sch_last->sc_next;
1695 tcpstat.tcps_sc_collisions++;
1696 }
1697 **prevp = sc;
1698 scp->sch_last = sc;
1699
1700 /*
1701 * If the timeout value has changed
1702 * 1) force it to fit in a u_char
1703 * 2) Run the timer routine to truncate all
1704 * existing entries to the new timeout value.
1705 */
1706 if (timeo_val != tcp_syn_cache_timeo) {
1707 tcp_syn_cache_timeo = min(tcp_syn_cache_timeo, UCHAR_MAX);
1708 if (timeo_val > tcp_syn_cache_timeo)
1709 syn_cache_timer(timeo_val - tcp_syn_cache_timeo);
1710 timeo_val = tcp_syn_cache_timeo;
1711 }
1712 if (scp->sch_timer_sum > 0)
1713 sc->sc_timer = tcp_syn_cache_timeo - scp->sch_timer_sum;
1714 else {
1715 if (scp->sch_timer_sum == 0) {
1716 /*
1717 * When the bucket timer is 0, it is not in the
1718 * cache queue.
1719 */
1720 scp->sch_headq = tcp_syn_cache_first;
1721 tcp_syn_cache_first = scp;
1722 }
1723 sc->sc_timer = tcp_syn_cache_timeo;
1724 }
1725 scp->sch_timer_sum = tcp_syn_cache_timeo;
1726 splx(s);
1727 }
1728
1729 /*
1730 * Walk down the cache list, decrementing the timer of
1731 * the first element on each entry. If the timer goes
1732 * to zero, remove it and all successive entries with
1733 * a zero timer.
1734 */
1735 void
1736 syn_cache_timer(interval)
1737 int interval;
1738 {
1739 struct syn_cache_head *scp, **pscp;
1740 struct syn_cache *sc, *scn;
1741 int n, s;
1742
1743 pscp = &tcp_syn_cache_first;
1744 scp = tcp_syn_cache_first;
1745 s = splsoftnet();
1746 while (scp) {
1747 /*
1748 * Remove any empty hash buckets
1749 * from the cache queue.
1750 */
1751 if ((sc = scp->sch_first) == NULL) {
1752 *pscp = scp->sch_headq;
1753 scp->sch_headq = NULL;
1754 scp->sch_timer_sum = 0;
1755 scp->sch_first = scp->sch_last = NULL;
1756 scp->sch_length = 0;
1757 scp = *pscp;
1758 continue;
1759 }
1760
1761 scp->sch_timer_sum -= interval;
1762 if (scp->sch_timer_sum <= 0)
1763 scp->sch_timer_sum = -1;
1764 n = interval;
1765 while (sc->sc_timer <= n) {
1766 n -= sc->sc_timer;
1767 scn = sc->sc_next;
1768 tcpstat.tcps_sc_timed_out++;
1769 syn_cache_count--;
1770 if (sc->sc_ipopts)
1771 (void) m_free(sc->sc_ipopts);
1772 FREE(sc, M_PCB);
1773 scp->sch_length--;
1774 if ((sc = scn) == NULL)
1775 break;
1776 }
1777 if ((scp->sch_first = sc) != NULL) {
1778 sc->sc_timer -= n;
1779 pscp = &scp->sch_headq;
1780 scp = scp->sch_headq;
1781 }
1782 }
1783 splx(s);
1784 }
1785
1786 /*
1787 * Find an entry in the syn cache.
1788 */
1789 struct syn_cache *
1790 syn_cache_lookup(ti, prevp, headp)
1791 struct tcpiphdr *ti;
1792 struct syn_cache ***prevp;
1793 struct syn_cache_head **headp;
1794 {
1795 struct syn_cache *sc, **prev;
1796 struct syn_cache_head *head;
1797 u_int32_t hash;
1798 int s;
1799
1800 hash = SYN_HASH(&ti->ti_src, ti->ti_sport, ti->ti_dport);
1801
1802 head = &tcp_syn_cache[hash % tcp_syn_cache_size];
1803 *headp = head;
1804 prev = &head->sch_first;
1805 s = splsoftnet();
1806 for (sc = head->sch_first; sc; prev = &sc->sc_next, sc = sc->sc_next) {
1807 if (sc->sc_hash != hash)
1808 continue;
1809 if (sc->sc_src.s_addr == ti->ti_src.s_addr &&
1810 sc->sc_sport == ti->ti_sport &&
1811 sc->sc_dport == ti->ti_dport &&
1812 sc->sc_dst.s_addr == ti->ti_dst.s_addr) {
1813 *prevp = prev;
1814 splx(s);
1815 return (sc);
1816 }
1817 }
1818 splx(s);
1819 return (NULL);
1820 }
1821
1822 /*
1823 * This function gets called when we receive an ACK for a
1824 * socket in the LISTEN state. We look up the connection
1825 * in the syn cache, and if its there, we pull it out of
1826 * the cache and turn it into a full-blown connection in
1827 * the SYN-RECEIVED state.
1828 *
1829 * The return values may not be immediately obvious, and their effects
1830 * can be subtle, so here they are:
1831 *
1832 * NULL SYN was not found in cache; caller should drop the
1833 * packet and send an RST.
1834 *
1835 * -1 We were unable to create the new connection, and are
1836 * aborting it. An ACK,RST is being sent to the peer
1837 * (unless we got screwey sequence numbners; see below),
1838 * because the 3-way handshake has been completed. Caller
1839 * should not free the mbuf, since we may be using it. If
1840 * we are not, we will free it.
1841 *
1842 * Otherwise, the return value is a pointer to the new socket
1843 * associated with the connection.
1844 */
1845 struct socket *
1846 syn_cache_get(so, m)
1847 struct socket *so;
1848 struct mbuf *m;
1849 {
1850 struct syn_cache *sc, **sc_prev;
1851 struct syn_cache_head *head;
1852 register struct inpcb *inp;
1853 register struct tcpcb *tp = 0;
1854 register struct tcpiphdr *ti;
1855 struct sockaddr_in *sin;
1856 struct mbuf *am;
1857 long win;
1858 int s;
1859
1860 ti = mtod(m, struct tcpiphdr *);
1861 s = splsoftnet();
1862 if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
1863 splx(s);
1864 return (NULL);
1865 }
1866
1867 win = sbspace(&so->so_rcv);
1868 if (win > TCP_MAXWIN)
1869 win = TCP_MAXWIN;
1870
1871 /*
1872 * Verify the sequence and ack numbers.
1873 */
1874 if ((ti->ti_ack != sc->sc_iss + 1) ||
1875 SEQ_LEQ(ti->ti_seq, sc->sc_irs) ||
1876 SEQ_GT(ti->ti_seq, sc->sc_irs + 1 + win)) {
1877 (void) syn_cache_respond(sc, m, ti, win, 0);
1878 splx(s);
1879 return ((struct socket *)(-1));
1880 }
1881
1882 /* Remove this cache entry */
1883 SYN_CACHE_RM(sc, sc_prev, head);
1884 splx(s);
1885
1886 /*
1887 * Ok, create the full blown connection, and set things up
1888 * as they would have been set up if we had created the
1889 * connection when the SYN arrived. If we can't create
1890 * the connection, abort it.
1891 */
1892 so = sonewconn(so, SS_ISCONNECTED);
1893 if (so == NULL)
1894 goto resetandabort;
1895
1896 inp = sotoinpcb(so);
1897 inp->inp_laddr = sc->sc_dst;
1898 inp->inp_lport = sc->sc_dport;
1899 in_pcbstate(inp, INP_BOUND);
1900 inp->inp_options = ip_srcroute();
1901 if (inp->inp_options == NULL) {
1902 inp->inp_options = sc->sc_ipopts;
1903 sc->sc_ipopts = NULL;
1904 }
1905
1906 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
1907 if (am == NULL)
1908 goto resetandabort;
1909 am->m_len = sizeof(struct sockaddr_in);
1910 sin = mtod(am, struct sockaddr_in *);
1911 sin->sin_family = AF_INET;
1912 sin->sin_len = sizeof(*sin);
1913 sin->sin_addr = sc->sc_src;
1914 sin->sin_port = sc->sc_sport;
1915 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
1916 if (in_pcbconnect(inp, am)) {
1917 (void) m_free(am);
1918 goto resetandabort;
1919 }
1920 (void) m_free(am);
1921
1922 tp = intotcpcb(inp);
1923 if (sc->sc_request_r_scale != 15) {
1924 tp->requested_s_scale = sc->sc_requested_s_scale;
1925 tp->request_r_scale = sc->sc_request_r_scale;
1926 tp->snd_scale = sc->sc_requested_s_scale;
1927 tp->rcv_scale = sc->sc_request_r_scale;
1928 tp->t_flags |= TF_RCVD_SCALE;
1929 }
1930 if (sc->sc_flags & SCF_TIMESTAMP)
1931 tp->t_flags |= TF_RCVD_TSTMP;
1932
1933 tp->t_template = tcp_template(tp);
1934 if (tp->t_template == 0) {
1935 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
1936 so = NULL;
1937 m_freem(m);
1938 goto abort;
1939 }
1940
1941 tp->iss = sc->sc_iss;
1942 tp->irs = sc->sc_irs;
1943 tcp_sendseqinit(tp);
1944 tcp_rcvseqinit(tp);
1945 tp->t_state = TCPS_SYN_RECEIVED;
1946 tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
1947 tcpstat.tcps_accepts++;
1948
1949 /* Initialize tp->t_ourmss before we deal with the peer's! */
1950 tp->t_ourmss = sc->sc_ourmaxseg;
1951 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
1952
1953 /*
1954 * Initialize the initial congestion window. If we
1955 * had to retransmit the SYN,ACK, we must initialize cwnd
1956 * to 1 segment.
1957 */
1958 tp->snd_cwnd =
1959 TCP_INITIAL_WINDOW((sc->sc_flags & SCF_SYNACK_REXMT) ? 1 :
1960 tcp_init_win, tp->t_peermss);
1961
1962 tcp_rmx_rtt(tp);
1963 tp->snd_wl1 = sc->sc_irs;
1964 tp->rcv_up = sc->sc_irs + 1;
1965
1966 /*
1967 * This is what whould have happened in tcp_ouput() when
1968 * the SYN,ACK was sent.
1969 */
1970 tp->snd_up = tp->snd_una;
1971 tp->snd_max = tp->snd_nxt = tp->iss+1;
1972 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
1973 if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
1974 tp->rcv_adv = tp->rcv_nxt + win;
1975 tp->last_ack_sent = tp->rcv_nxt;
1976
1977 tcpstat.tcps_sc_completed++;
1978 if (sc->sc_ipopts)
1979 (void) m_free(sc->sc_ipopts);
1980 FREE(sc, M_PCB);
1981 return (so);
1982
1983 resetandabort:
1984 (void) tcp_respond(NULL, ti, m, ti->ti_seq+ti->ti_len,
1985 (tcp_seq)0, TH_RST|TH_ACK);
1986 abort:
1987 if (so != NULL)
1988 (void) soabort(so);
1989 if (sc->sc_ipopts)
1990 (void) m_free(sc->sc_ipopts);
1991 FREE(sc, M_PCB);
1992 tcpstat.tcps_sc_aborted++;
1993 return ((struct socket *)(-1));
1994 }
1995
1996 /*
1997 * This function is called when we get a RST for a
1998 * non-existant connection, so that we can see if the
1999 * connection is in the syn cache. If it is, zap it.
2000 */
2001
2002 void
2003 syn_cache_reset(ti)
2004 register struct tcpiphdr *ti;
2005 {
2006 struct syn_cache *sc, **sc_prev;
2007 struct syn_cache_head *head;
2008 int s = splsoftnet();
2009
2010 if ((sc = syn_cache_lookup(ti, &sc_prev, &head)) == NULL) {
2011 splx(s);
2012 return;
2013 }
2014 if (SEQ_LT(ti->ti_seq,sc->sc_irs) ||
2015 SEQ_GT(ti->ti_seq, sc->sc_irs+1)) {
2016 splx(s);
2017 return;
2018 }
2019 SYN_CACHE_RM(sc, sc_prev, head);
2020 splx(s);
2021 tcpstat.tcps_sc_reset++;
2022 if (sc->sc_ipopts)
2023 (void) m_free(sc->sc_ipopts);
2024 FREE(sc, M_PCB);
2025 }
2026
2027 void
2028 syn_cache_unreach(ip, th)
2029 struct ip *ip;
2030 struct tcphdr *th;
2031 {
2032 struct syn_cache *sc, **sc_prev;
2033 struct syn_cache_head *head;
2034 struct tcpiphdr ti2;
2035 int s;
2036
2037 ti2.ti_src.s_addr = ip->ip_dst.s_addr;
2038 ti2.ti_dst.s_addr = ip->ip_src.s_addr;
2039 ti2.ti_sport = th->th_dport;
2040 ti2.ti_dport = th->th_sport;
2041
2042 s = splsoftnet();
2043 if ((sc = syn_cache_lookup(&ti2, &sc_prev, &head)) == NULL) {
2044 splx(s);
2045 return;
2046 }
2047 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
2048 if (ntohl (th->th_seq) != sc->sc_iss) {
2049 splx(s);
2050 return;
2051 }
2052 SYN_CACHE_RM(sc, sc_prev, head);
2053 splx(s);
2054 tcpstat.tcps_sc_unreach++;
2055 if (sc->sc_ipopts)
2056 (void) m_free(sc->sc_ipopts);
2057 FREE(sc, M_PCB);
2058 }
2059
2060 /*
2061 * Given a LISTEN socket and an inbound SYN request, add
2062 * this to the syn cache, and send back a segment:
2063 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
2064 * to the source.
2065 *
2066 * XXX We don't properly handle SYN-with-data!
2067 */
2068
2069 int
2070 syn_cache_add(so, m, optp, optlen, oi)
2071 struct socket *so;
2072 struct mbuf *m;
2073 u_char *optp;
2074 int optlen;
2075 struct tcp_opt_info *oi;
2076 {
2077 register struct tcpiphdr *ti;
2078 struct tcpcb tb, *tp;
2079 long win;
2080 struct syn_cache *sc, **sc_prev;
2081 struct syn_cache_head *scp;
2082 struct mbuf *ipopts;
2083 extern int tcp_do_rfc1323;
2084
2085 tp = sototcpcb(so);
2086 ti = mtod(m, struct tcpiphdr *);
2087
2088 /*
2089 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
2090 * in_broadcast() should never return true on a received
2091 * packet with M_BCAST not set.
2092 */
2093 if (m->m_flags & (M_BCAST|M_MCAST) ||
2094 IN_MULTICAST(ti->ti_src.s_addr) ||
2095 IN_MULTICAST(ti->ti_dst.s_addr))
2096 return (0);
2097
2098 /*
2099 * Initialize some local state.
2100 */
2101 win = sbspace(&so->so_rcv);
2102 if (win > TCP_MAXWIN)
2103 win = TCP_MAXWIN;
2104
2105 /*
2106 * Remember the IP options, if any.
2107 */
2108 ipopts = ip_srcroute();
2109
2110 if (optp) {
2111 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
2112 tcp_dooptions(&tb, optp, optlen, ti, oi);
2113 } else
2114 tb.t_flags = 0;
2115
2116 /*
2117 * See if we already have an entry for this connection.
2118 * If we do, resend the SYN,ACK, and remember since the
2119 * initial congestion window must be initialized to 1
2120 * segment when the connection completes.
2121 */
2122 if ((sc = syn_cache_lookup(ti, &sc_prev, &scp)) != NULL) {
2123 tcpstat.tcps_sc_dupesyn++;
2124 sc->sc_flags |= SCF_SYNACK_REXMT;
2125
2126 if (ipopts) {
2127 /*
2128 * If we were remembering a previous source route,
2129 * forget it and use the new one we've been given.
2130 */
2131 if (sc->sc_ipopts)
2132 (void) m_free(sc->sc_ipopts);
2133 sc->sc_ipopts = ipopts;
2134 }
2135
2136 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
2137 tcpstat.tcps_sndacks++;
2138 tcpstat.tcps_sndtotal++;
2139 }
2140 return (1);
2141 }
2142
2143 MALLOC(sc, struct syn_cache *, sizeof(*sc), M_PCB, M_NOWAIT);
2144 if (sc == NULL) {
2145 if (ipopts)
2146 (void) m_free(ipopts);
2147 return (0);
2148 }
2149
2150 /*
2151 * Fill in the cache, and put the necessary IP and TCP
2152 * options into the reply.
2153 */
2154 sc->sc_src.s_addr = ti->ti_src.s_addr;
2155 sc->sc_dst.s_addr = ti->ti_dst.s_addr;
2156 sc->sc_sport = ti->ti_sport;
2157 sc->sc_dport = ti->ti_dport;
2158 sc->sc_flags = 0;
2159 sc->sc_ipopts = ipopts;
2160 sc->sc_irs = ti->ti_seq;
2161 sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0);
2162 sc->sc_peermaxseg = oi->maxseg;
2163 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
2164 m->m_pkthdr.rcvif : NULL);
2165 if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP))
2166 sc->sc_flags |= SCF_TIMESTAMP;
2167 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2168 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2169 sc->sc_requested_s_scale = tb.requested_s_scale;
2170 sc->sc_request_r_scale = 0;
2171 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
2172 TCP_MAXWIN << sc->sc_request_r_scale <
2173 so->so_rcv.sb_hiwat)
2174 sc->sc_request_r_scale++;
2175 } else {
2176 sc->sc_requested_s_scale = 15;
2177 sc->sc_request_r_scale = 15;
2178 }
2179 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) {
2180 syn_cache_insert(sc, &sc_prev, &scp);
2181 tcpstat.tcps_sndacks++;
2182 tcpstat.tcps_sndtotal++;
2183 } else {
2184 if (sc->sc_ipopts)
2185 (void) m_free(sc->sc_ipopts);
2186 FREE(sc, M_PCB);
2187 tcpstat.tcps_sc_dropped++;
2188 }
2189 return (1);
2190 }
2191
2192 int
2193 syn_cache_respond(sc, m, ti, win, ts)
2194 struct syn_cache *sc;
2195 struct mbuf *m;
2196 register struct tcpiphdr *ti;
2197 long win;
2198 u_long ts;
2199 {
2200 u_int8_t *optp;
2201 int optlen;
2202
2203 /*
2204 * Tack on the TCP options. If there isn't enough trailing
2205 * space for them, move up the fixed header to make space.
2206 */
2207 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
2208 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
2209 if (optlen > M_TRAILINGSPACE(m)) {
2210 if (M_LEADINGSPACE(m) >= optlen) {
2211 m->m_data -= optlen;
2212 m->m_len += optlen;
2213 } else {
2214 struct mbuf *m0 = m;
2215 if ((m = m_gethdr(M_DONTWAIT, MT_HEADER)) == NULL) {
2216 m_freem(m0);
2217 return (ENOBUFS);
2218 }
2219 MH_ALIGN(m, sizeof(*ti) + optlen);
2220 m->m_next = m0; /* this gets freed below */
2221 }
2222 ovbcopy((caddr_t)ti, mtod(m, caddr_t), sizeof(*ti));
2223 ti = mtod(m, struct tcpiphdr *);
2224 }
2225
2226 optp = (u_int8_t *)(ti + 1);
2227 optp[0] = TCPOPT_MAXSEG;
2228 optp[1] = 4;
2229 optp[2] = (sc->sc_ourmaxseg >> 8) & 0xff;
2230 optp[3] = sc->sc_ourmaxseg & 0xff;
2231 optlen = 4;
2232
2233 if (sc->sc_request_r_scale != 15) {
2234 *((u_int32_t *)(optp + optlen)) = htonl(TCPOPT_NOP << 24 |
2235 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
2236 sc->sc_request_r_scale);
2237 optlen += 4;
2238 }
2239
2240 if (sc->sc_flags & SCF_TIMESTAMP) {
2241 u_int32_t *lp = (u_int32_t *)(optp + optlen);
2242 /* Form timestamp option as shown in appendix A of RFC 1323. */
2243 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
2244 *lp++ = htonl(tcp_now);
2245 *lp = htonl(ts);
2246 optlen += TCPOLEN_TSTAMP_APPA;
2247 }
2248
2249 /*
2250 * Toss any trailing mbufs. No need to worry about
2251 * m_len and m_pkthdr.len, since tcp_respond() will
2252 * unconditionally set them.
2253 */
2254 if (m->m_next) {
2255 m_freem(m->m_next);
2256 m->m_next = NULL;
2257 }
2258
2259 /*
2260 * Fill in the fields that tcp_respond() will not touch, and
2261 * then send the response.
2262 */
2263 ti->ti_off = (sizeof(struct tcphdr) + optlen) >> 2;
2264 ti->ti_win = htons(win);
2265 return (tcp_respond(NULL, ti, m, sc->sc_irs + 1, sc->sc_iss,
2266 TH_SYN|TH_ACK));
2267 }
2268 #endif /* TUBA_INCLUDE */
2269