tcp_input.c revision 1.62
1 /* $NetBSD: tcp_input.c,v 1.62 1998/07/17 22:58:56 thorpej Exp $ */ 2 3 /*- 4 * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation 9 * Facility, NASA Ames Research Center. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 42 * The Regents of the University of California. All rights reserved. 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 3. All advertising materials mentioning features or use of this software 53 * must display the following acknowledgement: 54 * This product includes software developed by the University of 55 * California, Berkeley and its contributors. 56 * 4. Neither the name of the University nor the names of its contributors 57 * may be used to endorse or promote products derived from this software 58 * without specific prior written permission. 59 * 60 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 61 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 63 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 64 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 65 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 66 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 67 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 68 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 69 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 70 * SUCH DAMAGE. 71 * 72 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 73 */ 74 75 /* 76 * TODO list for SYN cache stuff: 77 * 78 * Find room for a "state" field, which is needed to keep a 79 * compressed state for TIME_WAIT TCBs. It's been noted already 80 * that this is fairly important for very high-volume web and 81 * mail servers, which use a large number of short-lived 82 * connections. 83 */ 84 85 #include <sys/param.h> 86 #include <sys/systm.h> 87 #include <sys/malloc.h> 88 #include <sys/mbuf.h> 89 #include <sys/protosw.h> 90 #include <sys/socket.h> 91 #include <sys/socketvar.h> 92 #include <sys/errno.h> 93 #include <sys/syslog.h> 94 95 #include <net/if.h> 96 #include <net/route.h> 97 98 #include <netinet/in.h> 99 #include <netinet/in_systm.h> 100 #include <netinet/ip.h> 101 #include <netinet/in_pcb.h> 102 #include <netinet/ip_var.h> 103 #include <netinet/tcp.h> 104 #include <netinet/tcp_fsm.h> 105 #include <netinet/tcp_seq.h> 106 #include <netinet/tcp_timer.h> 107 #include <netinet/tcp_var.h> 108 #include <netinet/tcpip.h> 109 #include <netinet/tcp_debug.h> 110 111 #include <machine/stdarg.h> 112 113 int tcprexmtthresh = 3; 114 struct tcpiphdr tcp_saveti; 115 116 extern u_long sb_max; 117 118 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 119 120 /* for modulo comparisons of timestamps */ 121 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 122 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 123 124 /* 125 * Macro to compute ACK transmission behavior. Delay the ACK unless 126 * we have already delayed an ACK (must send an ACK every two segments). 127 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 128 * option is enabled. 129 */ 130 #define TCP_SETUP_ACK(tp, ti) \ 131 do { \ 132 if ((tp)->t_flags & TF_DELACK || \ 133 (tcp_ack_on_push && (ti)->ti_flags & TH_PUSH)) \ 134 tp->t_flags |= TF_ACKNOW; \ 135 else \ 136 TCP_SET_DELACK(tp); \ 137 } while (0) 138 139 /* 140 * Insert segment ti into reassembly queue of tcp with 141 * control block tp. Return TH_FIN if reassembly now includes 142 * a segment with FIN. The macro form does the common case inline 143 * (segment is the next to be received on an established connection, 144 * and the queue is empty), avoiding linkage into and removal 145 * from the queue and repetition of various conversions. 146 * Set DELACK for segments received in order, but ack immediately 147 * when segments are out of order (so fast retransmit can work). 148 */ 149 #define TCP_REASS(tp, ti, m, so, flags) { \ 150 if ((ti)->ti_seq == (tp)->rcv_nxt && \ 151 (tp)->segq.lh_first == NULL && \ 152 (tp)->t_state == TCPS_ESTABLISHED) { \ 153 TCP_SETUP_ACK(tp, ti); \ 154 (tp)->rcv_nxt += (ti)->ti_len; \ 155 flags = (ti)->ti_flags & TH_FIN; \ 156 tcpstat.tcps_rcvpack++;\ 157 tcpstat.tcps_rcvbyte += (ti)->ti_len;\ 158 sbappend(&(so)->so_rcv, (m)); \ 159 sorwakeup(so); \ 160 } else { \ 161 (flags) = tcp_reass((tp), (ti), (m)); \ 162 tp->t_flags |= TF_ACKNOW; \ 163 } \ 164 } 165 166 int 167 tcp_reass(tp, ti, m) 168 register struct tcpcb *tp; 169 register struct tcpiphdr *ti; 170 struct mbuf *m; 171 { 172 register struct ipqent *p, *q, *nq, *tiqe = NULL; 173 struct socket *so = tp->t_inpcb->inp_socket; 174 int pkt_flags; 175 tcp_seq pkt_seq; 176 unsigned pkt_len; 177 u_long rcvpartdupbyte = 0; 178 u_long rcvoobyte; 179 180 /* 181 * Call with ti==0 after become established to 182 * force pre-ESTABLISHED data up to user socket. 183 */ 184 if (ti == 0) 185 goto present; 186 187 rcvoobyte = ti->ti_len; 188 /* 189 * Copy these to local variables because the tcpiphdr 190 * gets munged while we are collapsing mbufs. 191 */ 192 pkt_seq = ti->ti_seq; 193 pkt_len = ti->ti_len; 194 pkt_flags = ti->ti_flags; 195 /* 196 * Find a segment which begins after this one does. 197 */ 198 for (p = NULL, q = tp->segq.lh_first; q != NULL; q = nq) { 199 nq = q->ipqe_q.le_next; 200 /* 201 * If the received segment is just right after this 202 * fragment, merge the two together and then check 203 * for further overlaps. 204 */ 205 if (q->ipqe_seq + q->ipqe_len == pkt_seq) { 206 #ifdef TCPREASS_DEBUG 207 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n", 208 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 209 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len); 210 #endif 211 pkt_len += q->ipqe_len; 212 pkt_flags |= q->ipqe_flags; 213 pkt_seq = q->ipqe_seq; 214 m_cat(q->ipqe_m, m); 215 m = q->ipqe_m; 216 goto free_ipqe; 217 } 218 /* 219 * If the received segment is completely past this 220 * fragment, we need to go the next fragment. 221 */ 222 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 223 p = q; 224 continue; 225 } 226 /* 227 * If the fragment is past the received segment, 228 * it (or any following) can't be concatenated. 229 */ 230 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) 231 break; 232 /* 233 * We've received all the data in this segment before. 234 * mark it as a duplicate and return. 235 */ 236 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) && 237 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 238 tcpstat.tcps_rcvduppack++; 239 tcpstat.tcps_rcvdupbyte += pkt_len; 240 m_freem(m); 241 if (tiqe != NULL) 242 FREE(tiqe, M_IPQ); 243 return (0); 244 } 245 /* 246 * Received segment completely overlaps this fragment 247 * so we drop the fragment (this keeps the temporal 248 * ordering of segments correct). 249 */ 250 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) && 251 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 252 rcvpartdupbyte += q->ipqe_len; 253 m_freem(q->ipqe_m); 254 goto free_ipqe; 255 } 256 /* 257 * RX'ed segment extends past the end of the 258 * fragment. Drop the overlapping bytes. Then 259 * merge the fragment and segment then treat as 260 * a longer received packet. 261 */ 262 if (SEQ_LT(q->ipqe_seq, pkt_seq) 263 && SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 264 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq; 265 #ifdef TCPREASS_DEBUG 266 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n", 267 tp, overlap, 268 pkt_seq, pkt_seq + pkt_len, pkt_len); 269 #endif 270 m_adj(m, overlap); 271 rcvpartdupbyte += overlap; 272 m_cat(q->ipqe_m, m); 273 m = q->ipqe_m; 274 pkt_seq = q->ipqe_seq; 275 pkt_len += q->ipqe_len - overlap; 276 rcvoobyte -= overlap; 277 goto free_ipqe; 278 } 279 /* 280 * RX'ed segment extends past the front of the 281 * fragment. Drop the overlapping bytes on the 282 * received packet. The packet will then be 283 * contatentated with this fragment a bit later. 284 */ 285 if (SEQ_GT(q->ipqe_seq, pkt_seq) 286 && SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) { 287 int overlap = pkt_seq + pkt_len - q->ipqe_seq; 288 #ifdef TCPREASS_DEBUG 289 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n", 290 tp, overlap, 291 pkt_seq, pkt_seq + pkt_len, pkt_len); 292 #endif 293 m_adj(m, -overlap); 294 pkt_len -= overlap; 295 rcvpartdupbyte += overlap; 296 rcvoobyte -= overlap; 297 } 298 /* 299 * If the received segment immediates precedes this 300 * fragment then tack the fragment onto this segment 301 * and reinsert the data. 302 */ 303 if (q->ipqe_seq == pkt_seq + pkt_len) { 304 #ifdef TCPREASS_DEBUG 305 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n", 306 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len, 307 pkt_seq, pkt_seq + pkt_len, pkt_len); 308 #endif 309 pkt_len += q->ipqe_len; 310 pkt_flags |= q->ipqe_flags; 311 m_cat(m, q->ipqe_m); 312 LIST_REMOVE(q, ipqe_q); 313 LIST_REMOVE(q, ipqe_timeq); 314 if (tiqe == NULL) { 315 tiqe = q; 316 } else { 317 FREE(q, M_IPQ); 318 } 319 break; 320 } 321 /* 322 * If the fragment is before the segment, remember it. 323 * When this loop is terminated, p will contain the 324 * pointer to fragment that is right before the received 325 * segment. 326 */ 327 if (SEQ_LEQ(q->ipqe_seq, pkt_seq)) 328 p = q; 329 330 continue; 331 332 /* 333 * This is a common operation. It also will allow 334 * to save doing a malloc/free in most instances. 335 */ 336 free_ipqe: 337 LIST_REMOVE(q, ipqe_q); 338 LIST_REMOVE(q, ipqe_timeq); 339 if (tiqe == NULL) { 340 tiqe = q; 341 } else { 342 FREE(q, M_IPQ); 343 } 344 } 345 346 /* 347 * Allocate a new queue entry since the received segment did not 348 * collapse onto any other out-of-order block; thus we are allocating 349 * a new block. If it had collapsed, tiqe would not be NULL and 350 * we would be reusing it. 351 * XXX If we can't, just drop the packet. XXX 352 */ 353 if (tiqe == NULL) { 354 MALLOC(tiqe, struct ipqent *, sizeof (struct ipqent), M_IPQ, M_NOWAIT); 355 if (tiqe == NULL) { 356 tcpstat.tcps_rcvmemdrop++; 357 m_freem(m); 358 return (0); 359 } 360 } 361 362 /* 363 * Update the counters. 364 */ 365 tcpstat.tcps_rcvoopack++; 366 tcpstat.tcps_rcvoobyte += rcvoobyte; 367 if (rcvpartdupbyte) { 368 tcpstat.tcps_rcvpartduppack++; 369 tcpstat.tcps_rcvpartdupbyte += rcvpartdupbyte; 370 } 371 372 /* 373 * Insert the new fragment queue entry into both queues. 374 */ 375 tiqe->ipqe_m = m; 376 tiqe->ipqe_seq = pkt_seq; 377 tiqe->ipqe_len = pkt_len; 378 tiqe->ipqe_flags = pkt_flags; 379 if (p == NULL) { 380 LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q); 381 #ifdef TCPREASS_DEBUG 382 if (tiqe->ipqe_seq != tp->rcv_nxt) 383 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n", 384 tp, pkt_seq, pkt_seq + pkt_len, pkt_len); 385 #endif 386 } else { 387 LIST_INSERT_AFTER(p, tiqe, ipqe_q); 388 #ifdef TCPREASS_DEBUG 389 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n", 390 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 391 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len); 392 #endif 393 } 394 395 LIST_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq); 396 397 present: 398 /* 399 * Present data to user, advancing rcv_nxt through 400 * completed sequence space. 401 */ 402 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 403 return (0); 404 q = tp->segq.lh_first; 405 if (q == NULL || q->ipqe_seq != tp->rcv_nxt) 406 return (0); 407 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len) 408 return (0); 409 410 tp->rcv_nxt += q->ipqe_len; 411 pkt_flags = q->ipqe_flags & TH_FIN; 412 413 LIST_REMOVE(q, ipqe_q); 414 LIST_REMOVE(q, ipqe_timeq); 415 if (so->so_state & SS_CANTRCVMORE) 416 m_freem(q->ipqe_m); 417 else 418 sbappend(&so->so_rcv, q->ipqe_m); 419 FREE(q, M_IPQ); 420 sorwakeup(so); 421 return (pkt_flags); 422 } 423 424 /* 425 * TCP input routine, follows pages 65-76 of the 426 * protocol specification dated September, 1981 very closely. 427 */ 428 void 429 #if __STDC__ 430 tcp_input(struct mbuf *m, ...) 431 #else 432 tcp_input(m, va_alist) 433 register struct mbuf *m; 434 #endif 435 { 436 register struct tcpiphdr *ti; 437 register struct inpcb *inp; 438 caddr_t optp = NULL; 439 int optlen = 0; 440 int len, tlen, off, hdroptlen; 441 register struct tcpcb *tp = 0; 442 register int tiflags; 443 struct socket *so = NULL; 444 int todrop, acked, ourfinisacked, needoutput = 0; 445 short ostate = 0; 446 int iss = 0; 447 u_long tiwin; 448 struct tcp_opt_info opti; 449 int iphlen; 450 va_list ap; 451 452 va_start(ap, m); 453 iphlen = va_arg(ap, int); 454 va_end(ap); 455 456 tcpstat.tcps_rcvtotal++; 457 458 opti.ts_present = 0; 459 opti.maxseg = 0; 460 461 /* 462 * Get IP and TCP header together in first mbuf. 463 * Note: IP leaves IP header in first mbuf. 464 */ 465 ti = mtod(m, struct tcpiphdr *); 466 if (iphlen > sizeof (struct ip)) 467 ip_stripoptions(m, (struct mbuf *)0); 468 if (m->m_len < sizeof (struct tcpiphdr)) { 469 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { 470 tcpstat.tcps_rcvshort++; 471 return; 472 } 473 ti = mtod(m, struct tcpiphdr *); 474 } 475 476 /* 477 * Checksum extended TCP header and data. 478 */ 479 tlen = ((struct ip *)ti)->ip_len; 480 len = sizeof (struct ip) + tlen; 481 bzero(ti->ti_x1, sizeof ti->ti_x1); 482 ti->ti_len = (u_int16_t)tlen; 483 HTONS(ti->ti_len); 484 if ((ti->ti_sum = in_cksum(m, len)) != 0) { 485 tcpstat.tcps_rcvbadsum++; 486 goto drop; 487 } 488 489 /* 490 * Check that TCP offset makes sense, 491 * pull out TCP options and adjust length. XXX 492 */ 493 off = ti->ti_off << 2; 494 if (off < sizeof (struct tcphdr) || off > tlen) { 495 tcpstat.tcps_rcvbadoff++; 496 goto drop; 497 } 498 tlen -= off; 499 ti->ti_len = tlen; 500 if (off > sizeof (struct tcphdr)) { 501 if (m->m_len < sizeof(struct ip) + off) { 502 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) { 503 tcpstat.tcps_rcvshort++; 504 return; 505 } 506 ti = mtod(m, struct tcpiphdr *); 507 } 508 optlen = off - sizeof (struct tcphdr); 509 optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr); 510 /* 511 * Do quick retrieval of timestamp options ("options 512 * prediction?"). If timestamp is the only option and it's 513 * formatted as recommended in RFC 1323 appendix A, we 514 * quickly get the values now and not bother calling 515 * tcp_dooptions(), etc. 516 */ 517 if ((optlen == TCPOLEN_TSTAMP_APPA || 518 (optlen > TCPOLEN_TSTAMP_APPA && 519 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 520 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 521 (ti->ti_flags & TH_SYN) == 0) { 522 opti.ts_present = 1; 523 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 524 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 525 optp = NULL; /* we've parsed the options */ 526 } 527 } 528 tiflags = ti->ti_flags; 529 530 /* 531 * Convert TCP protocol specific fields to host format. 532 */ 533 NTOHL(ti->ti_seq); 534 NTOHL(ti->ti_ack); 535 NTOHS(ti->ti_win); 536 NTOHS(ti->ti_urp); 537 538 /* 539 * Locate pcb for segment. 540 */ 541 findpcb: 542 inp = in_pcblookup_connect(&tcbtable, ti->ti_src, ti->ti_sport, 543 ti->ti_dst, ti->ti_dport); 544 if (inp == 0) { 545 ++tcpstat.tcps_pcbhashmiss; 546 inp = in_pcblookup_bind(&tcbtable, ti->ti_dst, ti->ti_dport); 547 if (inp == 0) { 548 ++tcpstat.tcps_noport; 549 goto dropwithreset; 550 } 551 } 552 553 /* 554 * If the state is CLOSED (i.e., TCB does not exist) then 555 * all data in the incoming segment is discarded. 556 * If the TCB exists but is in CLOSED state, it is embryonic, 557 * but should either do a listen or a connect soon. 558 */ 559 tp = intotcpcb(inp); 560 if (tp == 0) 561 goto dropwithreset; 562 if (tp->t_state == TCPS_CLOSED) 563 goto drop; 564 565 /* Unscale the window into a 32-bit value. */ 566 if ((tiflags & TH_SYN) == 0) 567 tiwin = ti->ti_win << tp->snd_scale; 568 else 569 tiwin = ti->ti_win; 570 571 so = inp->inp_socket; 572 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 573 if (so->so_options & SO_DEBUG) { 574 ostate = tp->t_state; 575 tcp_saveti = *ti; 576 } 577 if (so->so_options & SO_ACCEPTCONN) { 578 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 579 if (tiflags & TH_RST) { 580 syn_cache_reset(ti); 581 } else if ((tiflags & (TH_ACK|TH_SYN)) == 582 (TH_ACK|TH_SYN)) { 583 /* 584 * Received a SYN,ACK. This should 585 * never happen while we are in 586 * LISTEN. Send an RST. 587 */ 588 goto badsyn; 589 } else if (tiflags & TH_ACK) { 590 so = syn_cache_get(so, m); 591 if (so == NULL) { 592 /* 593 * We don't have a SYN for 594 * this ACK; send an RST. 595 */ 596 goto badsyn; 597 } else if (so == 598 (struct socket *)(-1)) { 599 /* 600 * We were unable to create 601 * the connection. If the 602 * 3-way handshake was 603 * completeed, and RST has 604 * been sent to the peer. 605 * Since the mbuf might be 606 * in use for the reply, 607 * do not free it. 608 */ 609 m = NULL; 610 } else { 611 /* 612 * We have created a 613 * full-blown connection. 614 */ 615 inp = sotoinpcb(so); 616 tp = intotcpcb(inp); 617 tiwin <<= tp->snd_scale; 618 goto after_listen; 619 } 620 } 621 } else { 622 /* 623 * Received a SYN. 624 */ 625 if (in_hosteq(ti->ti_src, ti->ti_dst) && 626 ti->ti_sport == ti->ti_dport) { 627 /* 628 * LISTEN socket received a SYN 629 * from itself? This can't possibly 630 * be valid; drop the packet. 631 */ 632 tcpstat.tcps_badsyn++; 633 goto drop; 634 } 635 /* 636 * SYN looks ok; create compressed TCP 637 * state for it. 638 */ 639 if (so->so_qlen <= so->so_qlimit && 640 syn_cache_add(so, m, optp, optlen, &opti)) 641 m = NULL; 642 } 643 goto drop; 644 } 645 } 646 647 after_listen: 648 #ifdef DIAGNOSTIC 649 /* 650 * Should not happen now that all embryonic connections 651 * are handled with compressed state. 652 */ 653 if (tp->t_state == TCPS_LISTEN) 654 panic("tcp_input: TCPS_LISTEN"); 655 #endif 656 657 /* 658 * Segment received on connection. 659 * Reset idle time and keep-alive timer. 660 */ 661 tp->t_idle = 0; 662 if (TCPS_HAVEESTABLISHED(tp->t_state)) 663 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 664 665 /* 666 * Process options. 667 */ 668 if (optp) 669 tcp_dooptions(tp, optp, optlen, ti, &opti); 670 671 /* 672 * Header prediction: check for the two common cases 673 * of a uni-directional data xfer. If the packet has 674 * no control flags, is in-sequence, the window didn't 675 * change and we're not retransmitting, it's a 676 * candidate. If the length is zero and the ack moved 677 * forward, we're the sender side of the xfer. Just 678 * free the data acked & wake any higher level process 679 * that was blocked waiting for space. If the length 680 * is non-zero and the ack didn't move, we're the 681 * receiver side. If we're getting packets in-order 682 * (the reassembly queue is empty), add the data to 683 * the socket buffer and note that we need a delayed ack. 684 */ 685 if (tp->t_state == TCPS_ESTABLISHED && 686 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 687 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 688 ti->ti_seq == tp->rcv_nxt && 689 tiwin && tiwin == tp->snd_wnd && 690 tp->snd_nxt == tp->snd_max) { 691 692 /* 693 * If last ACK falls within this segment's sequence numbers, 694 * record the timestamp. 695 */ 696 if (opti.ts_present && 697 SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) && 698 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len)) { 699 tp->ts_recent_age = tcp_now; 700 tp->ts_recent = opti.ts_val; 701 } 702 703 if (ti->ti_len == 0) { 704 if (SEQ_GT(ti->ti_ack, tp->snd_una) && 705 SEQ_LEQ(ti->ti_ack, tp->snd_max) && 706 tp->snd_cwnd >= tp->snd_wnd && 707 tp->t_dupacks < tcprexmtthresh) { 708 /* 709 * this is a pure ack for outstanding data. 710 */ 711 ++tcpstat.tcps_predack; 712 if (opti.ts_present) 713 tcp_xmit_timer(tp, 714 tcp_now-opti.ts_ecr+1); 715 else if (tp->t_rtt && 716 SEQ_GT(ti->ti_ack, tp->t_rtseq)) 717 tcp_xmit_timer(tp, tp->t_rtt); 718 acked = ti->ti_ack - tp->snd_una; 719 tcpstat.tcps_rcvackpack++; 720 tcpstat.tcps_rcvackbyte += acked; 721 sbdrop(&so->so_snd, acked); 722 tp->snd_una = ti->ti_ack; 723 m_freem(m); 724 725 /* 726 * If all outstanding data are acked, stop 727 * retransmit timer, otherwise restart timer 728 * using current (possibly backed-off) value. 729 * If process is waiting for space, 730 * wakeup/selwakeup/signal. If data 731 * are ready to send, let tcp_output 732 * decide between more output or persist. 733 */ 734 if (tp->snd_una == tp->snd_max) 735 TCP_TIMER_DISARM(tp, TCPT_REXMT); 736 else if (TCP_TIMER_ISARMED(tp, 737 TCPT_PERSIST) == 0) 738 TCP_TIMER_ARM(tp, TCPT_REXMT, 739 tp->t_rxtcur); 740 741 sowwakeup(so); 742 if (so->so_snd.sb_cc) 743 (void) tcp_output(tp); 744 return; 745 } 746 } else if (ti->ti_ack == tp->snd_una && 747 tp->segq.lh_first == NULL && 748 ti->ti_len <= sbspace(&so->so_rcv)) { 749 /* 750 * this is a pure, in-sequence data packet 751 * with nothing on the reassembly queue and 752 * we have enough buffer space to take it. 753 */ 754 ++tcpstat.tcps_preddat; 755 tp->rcv_nxt += ti->ti_len; 756 tcpstat.tcps_rcvpack++; 757 tcpstat.tcps_rcvbyte += ti->ti_len; 758 /* 759 * Drop TCP, IP headers and TCP options then add data 760 * to socket buffer. 761 */ 762 m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); 763 m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); 764 sbappend(&so->so_rcv, m); 765 sorwakeup(so); 766 TCP_SETUP_ACK(tp, ti); 767 if (tp->t_flags & TF_ACKNOW) 768 (void) tcp_output(tp); 769 return; 770 } 771 } 772 773 /* 774 * Drop TCP, IP headers and TCP options. 775 */ 776 hdroptlen = sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr); 777 m->m_data += hdroptlen; 778 m->m_len -= hdroptlen; 779 780 /* 781 * Calculate amount of space in receive window, 782 * and then do TCP input processing. 783 * Receive window is amount of space in rcv queue, 784 * but not less than advertised window. 785 */ 786 { int win; 787 788 win = sbspace(&so->so_rcv); 789 if (win < 0) 790 win = 0; 791 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 792 } 793 794 switch (tp->t_state) { 795 796 /* 797 * If the state is SYN_SENT: 798 * if seg contains an ACK, but not for our SYN, drop the input. 799 * if seg contains a RST, then drop the connection. 800 * if seg does not contain SYN, then drop it. 801 * Otherwise this is an acceptable SYN segment 802 * initialize tp->rcv_nxt and tp->irs 803 * if seg contains ack then advance tp->snd_una 804 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 805 * arrange for segment to be acked (eventually) 806 * continue processing rest of data/controls, beginning with URG 807 */ 808 case TCPS_SYN_SENT: 809 if ((tiflags & TH_ACK) && 810 (SEQ_LEQ(ti->ti_ack, tp->iss) || 811 SEQ_GT(ti->ti_ack, tp->snd_max))) 812 goto dropwithreset; 813 if (tiflags & TH_RST) { 814 if (tiflags & TH_ACK) 815 tp = tcp_drop(tp, ECONNREFUSED); 816 goto drop; 817 } 818 if ((tiflags & TH_SYN) == 0) 819 goto drop; 820 if (tiflags & TH_ACK) { 821 tp->snd_una = ti->ti_ack; 822 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 823 tp->snd_nxt = tp->snd_una; 824 } 825 TCP_TIMER_DISARM(tp, TCPT_REXMT); 826 tp->irs = ti->ti_seq; 827 tcp_rcvseqinit(tp); 828 tp->t_flags |= TF_ACKNOW; 829 tcp_mss_from_peer(tp, opti.maxseg); 830 831 /* 832 * Initialize the initial congestion window. If we 833 * had to retransmit the SYN, we must initialize cwnd 834 * to 1 segment (i.e. the Loss Window). 835 */ 836 if (tp->t_flags & TF_SYN_REXMT) 837 tp->snd_cwnd = tp->t_peermss; 838 else 839 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, 840 tp->t_peermss); 841 842 tcp_rmx_rtt(tp); 843 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 844 tcpstat.tcps_connects++; 845 soisconnected(so); 846 tcp_established(tp); 847 /* Do window scaling on this connection? */ 848 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 849 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 850 tp->snd_scale = tp->requested_s_scale; 851 tp->rcv_scale = tp->request_r_scale; 852 } 853 (void) tcp_reass(tp, (struct tcpiphdr *)0, 854 (struct mbuf *)0); 855 /* 856 * if we didn't have to retransmit the SYN, 857 * use its rtt as our initial srtt & rtt var. 858 */ 859 if (tp->t_rtt) 860 tcp_xmit_timer(tp, tp->t_rtt); 861 } else 862 tp->t_state = TCPS_SYN_RECEIVED; 863 864 /* 865 * Advance ti->ti_seq to correspond to first data byte. 866 * If data, trim to stay within window, 867 * dropping FIN if necessary. 868 */ 869 ti->ti_seq++; 870 if (ti->ti_len > tp->rcv_wnd) { 871 todrop = ti->ti_len - tp->rcv_wnd; 872 m_adj(m, -todrop); 873 ti->ti_len = tp->rcv_wnd; 874 tiflags &= ~TH_FIN; 875 tcpstat.tcps_rcvpackafterwin++; 876 tcpstat.tcps_rcvbyteafterwin += todrop; 877 } 878 tp->snd_wl1 = ti->ti_seq - 1; 879 tp->rcv_up = ti->ti_seq; 880 goto step6; 881 882 /* 883 * If the state is SYN_RECEIVED: 884 * If seg contains an ACK, but not for our SYN, drop the input 885 * and generate an RST. See page 36, rfc793 886 */ 887 case TCPS_SYN_RECEIVED: 888 if ((tiflags & TH_ACK) && 889 (SEQ_LEQ(ti->ti_ack, tp->iss) || 890 SEQ_GT(ti->ti_ack, tp->snd_max))) 891 goto dropwithreset; 892 break; 893 } 894 895 /* 896 * States other than LISTEN or SYN_SENT. 897 * First check timestamp, if present. 898 * Then check that at least some bytes of segment are within 899 * receive window. If segment begins before rcv_nxt, 900 * drop leading data (and SYN); if nothing left, just ack. 901 * 902 * RFC 1323 PAWS: If we have a timestamp reply on this segment 903 * and it's less than ts_recent, drop it. 904 */ 905 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 906 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 907 908 /* Check to see if ts_recent is over 24 days old. */ 909 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 910 /* 911 * Invalidate ts_recent. If this segment updates 912 * ts_recent, the age will be reset later and ts_recent 913 * will get a valid value. If it does not, setting 914 * ts_recent to zero will at least satisfy the 915 * requirement that zero be placed in the timestamp 916 * echo reply when ts_recent isn't valid. The 917 * age isn't reset until we get a valid ts_recent 918 * because we don't want out-of-order segments to be 919 * dropped when ts_recent is old. 920 */ 921 tp->ts_recent = 0; 922 } else { 923 tcpstat.tcps_rcvduppack++; 924 tcpstat.tcps_rcvdupbyte += ti->ti_len; 925 tcpstat.tcps_pawsdrop++; 926 goto dropafterack; 927 } 928 } 929 930 todrop = tp->rcv_nxt - ti->ti_seq; 931 if (todrop > 0) { 932 if (tiflags & TH_SYN) { 933 tiflags &= ~TH_SYN; 934 ti->ti_seq++; 935 if (ti->ti_urp > 1) 936 ti->ti_urp--; 937 else { 938 tiflags &= ~TH_URG; 939 ti->ti_urp = 0; 940 } 941 todrop--; 942 } 943 if (todrop > ti->ti_len || 944 (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) { 945 /* 946 * Any valid FIN must be to the left of the window. 947 * At this point the FIN must be a duplicate or 948 * out of sequence; drop it. 949 */ 950 tiflags &= ~TH_FIN; 951 /* 952 * Send an ACK to resynchronize and drop any data. 953 * But keep on processing for RST or ACK. 954 */ 955 tp->t_flags |= TF_ACKNOW; 956 todrop = ti->ti_len; 957 tcpstat.tcps_rcvdupbyte += todrop; 958 tcpstat.tcps_rcvduppack++; 959 } else { 960 tcpstat.tcps_rcvpartduppack++; 961 tcpstat.tcps_rcvpartdupbyte += todrop; 962 } 963 m_adj(m, todrop); 964 ti->ti_seq += todrop; 965 ti->ti_len -= todrop; 966 if (ti->ti_urp > todrop) 967 ti->ti_urp -= todrop; 968 else { 969 tiflags &= ~TH_URG; 970 ti->ti_urp = 0; 971 } 972 } 973 974 /* 975 * If new data are received on a connection after the 976 * user processes are gone, then RST the other end. 977 */ 978 if ((so->so_state & SS_NOFDREF) && 979 tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) { 980 tp = tcp_close(tp); 981 tcpstat.tcps_rcvafterclose++; 982 goto dropwithreset; 983 } 984 985 /* 986 * If segment ends after window, drop trailing data 987 * (and PUSH and FIN); if nothing left, just ACK. 988 */ 989 todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd); 990 if (todrop > 0) { 991 tcpstat.tcps_rcvpackafterwin++; 992 if (todrop >= ti->ti_len) { 993 tcpstat.tcps_rcvbyteafterwin += ti->ti_len; 994 /* 995 * If a new connection request is received 996 * while in TIME_WAIT, drop the old connection 997 * and start over if the sequence numbers 998 * are above the previous ones. 999 */ 1000 if (tiflags & TH_SYN && 1001 tp->t_state == TCPS_TIME_WAIT && 1002 SEQ_GT(ti->ti_seq, tp->rcv_nxt)) { 1003 iss = tcp_new_iss(tp, sizeof(struct tcpcb), 1004 tp->rcv_nxt); 1005 tp = tcp_close(tp); 1006 /* 1007 * We have already advanced the mbuf 1008 * pointers past the IP+TCP headers and 1009 * options. Restore those pointers before 1010 * attempting to use the TCP header again. 1011 */ 1012 m->m_data -= hdroptlen; 1013 m->m_len += hdroptlen; 1014 goto findpcb; 1015 } 1016 /* 1017 * If window is closed can only take segments at 1018 * window edge, and have to drop data and PUSH from 1019 * incoming segments. Continue processing, but 1020 * remember to ack. Otherwise, drop segment 1021 * and ack. 1022 */ 1023 if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) { 1024 tp->t_flags |= TF_ACKNOW; 1025 tcpstat.tcps_rcvwinprobe++; 1026 } else 1027 goto dropafterack; 1028 } else 1029 tcpstat.tcps_rcvbyteafterwin += todrop; 1030 m_adj(m, -todrop); 1031 ti->ti_len -= todrop; 1032 tiflags &= ~(TH_PUSH|TH_FIN); 1033 } 1034 1035 /* 1036 * If last ACK falls within this segment's sequence numbers, 1037 * and the timestamp is newer, record it. 1038 */ 1039 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1040 SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) && 1041 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len + 1042 ((tiflags & (TH_SYN|TH_FIN)) != 0))) { 1043 tp->ts_recent_age = tcp_now; 1044 tp->ts_recent = opti.ts_val; 1045 } 1046 1047 /* 1048 * If the RST bit is set examine the state: 1049 * SYN_RECEIVED STATE: 1050 * If passive open, return to LISTEN state. 1051 * If active open, inform user that connection was refused. 1052 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1053 * Inform user that connection was reset, and close tcb. 1054 * CLOSING, LAST_ACK, TIME_WAIT STATES 1055 * Close the tcb. 1056 */ 1057 if (tiflags&TH_RST) switch (tp->t_state) { 1058 1059 case TCPS_SYN_RECEIVED: 1060 so->so_error = ECONNREFUSED; 1061 goto close; 1062 1063 case TCPS_ESTABLISHED: 1064 case TCPS_FIN_WAIT_1: 1065 case TCPS_FIN_WAIT_2: 1066 case TCPS_CLOSE_WAIT: 1067 so->so_error = ECONNRESET; 1068 close: 1069 tp->t_state = TCPS_CLOSED; 1070 tcpstat.tcps_drops++; 1071 tp = tcp_close(tp); 1072 goto drop; 1073 1074 case TCPS_CLOSING: 1075 case TCPS_LAST_ACK: 1076 case TCPS_TIME_WAIT: 1077 tp = tcp_close(tp); 1078 goto drop; 1079 } 1080 1081 /* 1082 * If a SYN is in the window, then this is an 1083 * error and we send an RST and drop the connection. 1084 */ 1085 if (tiflags & TH_SYN) { 1086 tp = tcp_drop(tp, ECONNRESET); 1087 goto dropwithreset; 1088 } 1089 1090 /* 1091 * If the ACK bit is off we drop the segment and return. 1092 */ 1093 if ((tiflags & TH_ACK) == 0) 1094 goto drop; 1095 1096 /* 1097 * Ack processing. 1098 */ 1099 switch (tp->t_state) { 1100 1101 /* 1102 * In SYN_RECEIVED state if the ack ACKs our SYN then enter 1103 * ESTABLISHED state and continue processing, otherwise 1104 * send an RST. 1105 */ 1106 case TCPS_SYN_RECEIVED: 1107 if (SEQ_GT(tp->snd_una, ti->ti_ack) || 1108 SEQ_GT(ti->ti_ack, tp->snd_max)) 1109 goto dropwithreset; 1110 tcpstat.tcps_connects++; 1111 soisconnected(so); 1112 tcp_established(tp); 1113 /* Do window scaling? */ 1114 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1115 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1116 tp->snd_scale = tp->requested_s_scale; 1117 tp->rcv_scale = tp->request_r_scale; 1118 } 1119 (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0); 1120 tp->snd_wl1 = ti->ti_seq - 1; 1121 /* fall into ... */ 1122 1123 /* 1124 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1125 * ACKs. If the ack is in the range 1126 * tp->snd_una < ti->ti_ack <= tp->snd_max 1127 * then advance tp->snd_una to ti->ti_ack and drop 1128 * data from the retransmission queue. If this ACK reflects 1129 * more up to date window information we update our window information. 1130 */ 1131 case TCPS_ESTABLISHED: 1132 case TCPS_FIN_WAIT_1: 1133 case TCPS_FIN_WAIT_2: 1134 case TCPS_CLOSE_WAIT: 1135 case TCPS_CLOSING: 1136 case TCPS_LAST_ACK: 1137 case TCPS_TIME_WAIT: 1138 1139 if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) { 1140 if (ti->ti_len == 0 && tiwin == tp->snd_wnd) { 1141 tcpstat.tcps_rcvdupack++; 1142 /* 1143 * If we have outstanding data (other than 1144 * a window probe), this is a completely 1145 * duplicate ack (ie, window info didn't 1146 * change), the ack is the biggest we've 1147 * seen and we've seen exactly our rexmt 1148 * threshhold of them, assume a packet 1149 * has been dropped and retransmit it. 1150 * Kludge snd_nxt & the congestion 1151 * window so we send only this one 1152 * packet. 1153 * 1154 * We know we're losing at the current 1155 * window size so do congestion avoidance 1156 * (set ssthresh to half the current window 1157 * and pull our congestion window back to 1158 * the new ssthresh). 1159 * 1160 * Dup acks mean that packets have left the 1161 * network (they're now cached at the receiver) 1162 * so bump cwnd by the amount in the receiver 1163 * to keep a constant cwnd packets in the 1164 * network. 1165 */ 1166 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 || 1167 ti->ti_ack != tp->snd_una) 1168 tp->t_dupacks = 0; 1169 else if (++tp->t_dupacks == tcprexmtthresh) { 1170 tcp_seq onxt = tp->snd_nxt; 1171 u_int win = 1172 min(tp->snd_wnd, tp->snd_cwnd) / 1173 2 / tp->t_segsz; 1174 1175 if (win < 2) 1176 win = 2; 1177 tp->snd_ssthresh = win * tp->t_segsz; 1178 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1179 tp->t_rtt = 0; 1180 tp->snd_nxt = ti->ti_ack; 1181 tp->snd_cwnd = tp->t_segsz; 1182 (void) tcp_output(tp); 1183 tp->snd_cwnd = tp->snd_ssthresh + 1184 tp->t_segsz * tp->t_dupacks; 1185 if (SEQ_GT(onxt, tp->snd_nxt)) 1186 tp->snd_nxt = onxt; 1187 goto drop; 1188 } else if (tp->t_dupacks > tcprexmtthresh) { 1189 tp->snd_cwnd += tp->t_segsz; 1190 (void) tcp_output(tp); 1191 goto drop; 1192 } 1193 } else 1194 tp->t_dupacks = 0; 1195 break; 1196 } 1197 /* 1198 * If the congestion window was inflated to account 1199 * for the other side's cached packets, retract it. 1200 */ 1201 if (tp->t_dupacks >= tcprexmtthresh && 1202 tp->snd_cwnd > tp->snd_ssthresh) 1203 tp->snd_cwnd = tp->snd_ssthresh; 1204 tp->t_dupacks = 0; 1205 if (SEQ_GT(ti->ti_ack, tp->snd_max)) { 1206 tcpstat.tcps_rcvacktoomuch++; 1207 goto dropafterack; 1208 } 1209 acked = ti->ti_ack - tp->snd_una; 1210 tcpstat.tcps_rcvackpack++; 1211 tcpstat.tcps_rcvackbyte += acked; 1212 1213 /* 1214 * If we have a timestamp reply, update smoothed 1215 * round trip time. If no timestamp is present but 1216 * transmit timer is running and timed sequence 1217 * number was acked, update smoothed round trip time. 1218 * Since we now have an rtt measurement, cancel the 1219 * timer backoff (cf., Phil Karn's retransmit alg.). 1220 * Recompute the initial retransmit timer. 1221 */ 1222 if (opti.ts_present) 1223 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1); 1224 else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) 1225 tcp_xmit_timer(tp,tp->t_rtt); 1226 1227 /* 1228 * If all outstanding data is acked, stop retransmit 1229 * timer and remember to restart (more output or persist). 1230 * If there is more data to be acked, restart retransmit 1231 * timer, using current (possibly backed-off) value. 1232 */ 1233 if (ti->ti_ack == tp->snd_max) { 1234 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1235 needoutput = 1; 1236 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1237 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1238 /* 1239 * When new data is acked, open the congestion window. 1240 * If the window gives us less than ssthresh packets 1241 * in flight, open exponentially (segsz per packet). 1242 * Otherwise open linearly: segsz per window 1243 * (segsz^2 / cwnd per packet), plus a constant 1244 * fraction of a packet (segsz/8) to help larger windows 1245 * open quickly enough. 1246 */ 1247 { 1248 register u_int cw = tp->snd_cwnd; 1249 register u_int incr = tp->t_segsz; 1250 1251 if (cw > tp->snd_ssthresh) 1252 incr = incr * incr / cw; 1253 tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale); 1254 } 1255 if (acked > so->so_snd.sb_cc) { 1256 tp->snd_wnd -= so->so_snd.sb_cc; 1257 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1258 ourfinisacked = 1; 1259 } else { 1260 sbdrop(&so->so_snd, acked); 1261 tp->snd_wnd -= acked; 1262 ourfinisacked = 0; 1263 } 1264 sowwakeup(so); 1265 tp->snd_una = ti->ti_ack; 1266 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1267 tp->snd_nxt = tp->snd_una; 1268 1269 switch (tp->t_state) { 1270 1271 /* 1272 * In FIN_WAIT_1 STATE in addition to the processing 1273 * for the ESTABLISHED state if our FIN is now acknowledged 1274 * then enter FIN_WAIT_2. 1275 */ 1276 case TCPS_FIN_WAIT_1: 1277 if (ourfinisacked) { 1278 /* 1279 * If we can't receive any more 1280 * data, then closing user can proceed. 1281 * Starting the timer is contrary to the 1282 * specification, but if we don't get a FIN 1283 * we'll hang forever. 1284 */ 1285 if (so->so_state & SS_CANTRCVMORE) { 1286 soisdisconnected(so); 1287 TCP_TIMER_ARM(tp, TCPT_2MSL, 1288 tcp_maxidle); 1289 } 1290 tp->t_state = TCPS_FIN_WAIT_2; 1291 } 1292 break; 1293 1294 /* 1295 * In CLOSING STATE in addition to the processing for 1296 * the ESTABLISHED state if the ACK acknowledges our FIN 1297 * then enter the TIME-WAIT state, otherwise ignore 1298 * the segment. 1299 */ 1300 case TCPS_CLOSING: 1301 if (ourfinisacked) { 1302 tp->t_state = TCPS_TIME_WAIT; 1303 tcp_canceltimers(tp); 1304 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1305 soisdisconnected(so); 1306 } 1307 break; 1308 1309 /* 1310 * In LAST_ACK, we may still be waiting for data to drain 1311 * and/or to be acked, as well as for the ack of our FIN. 1312 * If our FIN is now acknowledged, delete the TCB, 1313 * enter the closed state and return. 1314 */ 1315 case TCPS_LAST_ACK: 1316 if (ourfinisacked) { 1317 tp = tcp_close(tp); 1318 goto drop; 1319 } 1320 break; 1321 1322 /* 1323 * In TIME_WAIT state the only thing that should arrive 1324 * is a retransmission of the remote FIN. Acknowledge 1325 * it and restart the finack timer. 1326 */ 1327 case TCPS_TIME_WAIT: 1328 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1329 goto dropafterack; 1330 } 1331 } 1332 1333 step6: 1334 /* 1335 * Update window information. 1336 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1337 */ 1338 if (((tiflags & TH_ACK) && SEQ_LT(tp->snd_wl1, ti->ti_seq)) || 1339 (tp->snd_wl1 == ti->ti_seq && SEQ_LT(tp->snd_wl2, ti->ti_ack)) || 1340 (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)) { 1341 /* keep track of pure window updates */ 1342 if (ti->ti_len == 0 && 1343 tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd) 1344 tcpstat.tcps_rcvwinupd++; 1345 tp->snd_wnd = tiwin; 1346 tp->snd_wl1 = ti->ti_seq; 1347 tp->snd_wl2 = ti->ti_ack; 1348 if (tp->snd_wnd > tp->max_sndwnd) 1349 tp->max_sndwnd = tp->snd_wnd; 1350 needoutput = 1; 1351 } 1352 1353 /* 1354 * Process segments with URG. 1355 */ 1356 if ((tiflags & TH_URG) && ti->ti_urp && 1357 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1358 /* 1359 * This is a kludge, but if we receive and accept 1360 * random urgent pointers, we'll crash in 1361 * soreceive. It's hard to imagine someone 1362 * actually wanting to send this much urgent data. 1363 */ 1364 if (ti->ti_urp + so->so_rcv.sb_cc > sb_max) { 1365 ti->ti_urp = 0; /* XXX */ 1366 tiflags &= ~TH_URG; /* XXX */ 1367 goto dodata; /* XXX */ 1368 } 1369 /* 1370 * If this segment advances the known urgent pointer, 1371 * then mark the data stream. This should not happen 1372 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 1373 * a FIN has been received from the remote side. 1374 * In these states we ignore the URG. 1375 * 1376 * According to RFC961 (Assigned Protocols), 1377 * the urgent pointer points to the last octet 1378 * of urgent data. We continue, however, 1379 * to consider it to indicate the first octet 1380 * of data past the urgent section as the original 1381 * spec states (in one of two places). 1382 */ 1383 if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) { 1384 tp->rcv_up = ti->ti_seq + ti->ti_urp; 1385 so->so_oobmark = so->so_rcv.sb_cc + 1386 (tp->rcv_up - tp->rcv_nxt) - 1; 1387 if (so->so_oobmark == 0) 1388 so->so_state |= SS_RCVATMARK; 1389 sohasoutofband(so); 1390 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 1391 } 1392 /* 1393 * Remove out of band data so doesn't get presented to user. 1394 * This can happen independent of advancing the URG pointer, 1395 * but if two URG's are pending at once, some out-of-band 1396 * data may creep in... ick. 1397 */ 1398 if (ti->ti_urp <= (u_int16_t) ti->ti_len 1399 #ifdef SO_OOBINLINE 1400 && (so->so_options & SO_OOBINLINE) == 0 1401 #endif 1402 ) 1403 tcp_pulloutofband(so, ti, m); 1404 } else 1405 /* 1406 * If no out of band data is expected, 1407 * pull receive urgent pointer along 1408 * with the receive window. 1409 */ 1410 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 1411 tp->rcv_up = tp->rcv_nxt; 1412 dodata: /* XXX */ 1413 1414 /* 1415 * Process the segment text, merging it into the TCP sequencing queue, 1416 * and arranging for acknowledgment of receipt if necessary. 1417 * This process logically involves adjusting tp->rcv_wnd as data 1418 * is presented to the user (this happens in tcp_usrreq.c, 1419 * case PRU_RCVD). If a FIN has already been received on this 1420 * connection then we just ignore the text. 1421 */ 1422 if ((ti->ti_len || (tiflags & TH_FIN)) && 1423 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1424 TCP_REASS(tp, ti, m, so, tiflags); 1425 /* 1426 * Note the amount of data that peer has sent into 1427 * our window, in order to estimate the sender's 1428 * buffer size. 1429 */ 1430 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 1431 } else { 1432 m_freem(m); 1433 tiflags &= ~TH_FIN; 1434 } 1435 1436 /* 1437 * If FIN is received ACK the FIN and let the user know 1438 * that the connection is closing. Ignore a FIN received before 1439 * the connection is fully established. 1440 */ 1441 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 1442 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1443 socantrcvmore(so); 1444 tp->t_flags |= TF_ACKNOW; 1445 tp->rcv_nxt++; 1446 } 1447 switch (tp->t_state) { 1448 1449 /* 1450 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 1451 */ 1452 case TCPS_ESTABLISHED: 1453 tp->t_state = TCPS_CLOSE_WAIT; 1454 break; 1455 1456 /* 1457 * If still in FIN_WAIT_1 STATE FIN has not been acked so 1458 * enter the CLOSING state. 1459 */ 1460 case TCPS_FIN_WAIT_1: 1461 tp->t_state = TCPS_CLOSING; 1462 break; 1463 1464 /* 1465 * In FIN_WAIT_2 state enter the TIME_WAIT state, 1466 * starting the time-wait timer, turning off the other 1467 * standard timers. 1468 */ 1469 case TCPS_FIN_WAIT_2: 1470 tp->t_state = TCPS_TIME_WAIT; 1471 tcp_canceltimers(tp); 1472 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1473 soisdisconnected(so); 1474 break; 1475 1476 /* 1477 * In TIME_WAIT state restart the 2 MSL time_wait timer. 1478 */ 1479 case TCPS_TIME_WAIT: 1480 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1481 break; 1482 } 1483 } 1484 if (so->so_options & SO_DEBUG) 1485 tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0); 1486 1487 /* 1488 * Return any desired output. 1489 */ 1490 if (needoutput || (tp->t_flags & TF_ACKNOW)) 1491 (void) tcp_output(tp); 1492 return; 1493 1494 badsyn: 1495 /* 1496 * Received a bad SYN. Increment counters and dropwithreset. 1497 */ 1498 tcpstat.tcps_badsyn++; 1499 tp = NULL; 1500 goto dropwithreset; 1501 1502 dropafterack: 1503 /* 1504 * Generate an ACK dropping incoming segment if it occupies 1505 * sequence space, where the ACK reflects our state. 1506 */ 1507 if (tiflags & TH_RST) 1508 goto drop; 1509 m_freem(m); 1510 tp->t_flags |= TF_ACKNOW; 1511 (void) tcp_output(tp); 1512 return; 1513 1514 dropwithreset: 1515 /* 1516 * Generate a RST, dropping incoming segment. 1517 * Make ACK acceptable to originator of segment. 1518 * Don't bother to respond if destination was broadcast/multicast. 1519 */ 1520 if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) || 1521 IN_MULTICAST(ti->ti_dst.s_addr)) 1522 goto drop; 1523 if (tiflags & TH_ACK) 1524 (void)tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST); 1525 else { 1526 if (tiflags & TH_SYN) 1527 ti->ti_len++; 1528 (void)tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0, 1529 TH_RST|TH_ACK); 1530 } 1531 return; 1532 1533 drop: 1534 /* 1535 * Drop space held by incoming segment and return. 1536 */ 1537 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 1538 tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0); 1539 m_freem(m); 1540 return; 1541 } 1542 1543 void 1544 tcp_dooptions(tp, cp, cnt, ti, oi) 1545 struct tcpcb *tp; 1546 u_char *cp; 1547 int cnt; 1548 struct tcpiphdr *ti; 1549 struct tcp_opt_info *oi; 1550 { 1551 u_int16_t mss; 1552 int opt, optlen; 1553 1554 for (; cnt > 0; cnt -= optlen, cp += optlen) { 1555 opt = cp[0]; 1556 if (opt == TCPOPT_EOL) 1557 break; 1558 if (opt == TCPOPT_NOP) 1559 optlen = 1; 1560 else { 1561 optlen = cp[1]; 1562 if (optlen <= 0) 1563 break; 1564 } 1565 switch (opt) { 1566 1567 default: 1568 continue; 1569 1570 case TCPOPT_MAXSEG: 1571 if (optlen != TCPOLEN_MAXSEG) 1572 continue; 1573 if (!(ti->ti_flags & TH_SYN)) 1574 continue; 1575 bcopy(cp + 2, &mss, sizeof(mss)); 1576 oi->maxseg = ntohs(mss); 1577 break; 1578 1579 case TCPOPT_WINDOW: 1580 if (optlen != TCPOLEN_WINDOW) 1581 continue; 1582 if (!(ti->ti_flags & TH_SYN)) 1583 continue; 1584 tp->t_flags |= TF_RCVD_SCALE; 1585 tp->requested_s_scale = cp[2]; 1586 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) { 1587 log(LOG_ERR, "TCP: invalid wscale %d from " 1588 "0x%08x, assuming %d\n", 1589 tp->requested_s_scale, 1590 ntohl(ti->ti_src.s_addr), 1591 TCP_MAX_WINSHIFT); 1592 tp->requested_s_scale = TCP_MAX_WINSHIFT; 1593 } 1594 break; 1595 1596 case TCPOPT_TIMESTAMP: 1597 if (optlen != TCPOLEN_TIMESTAMP) 1598 continue; 1599 oi->ts_present = 1; 1600 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val)); 1601 NTOHL(oi->ts_val); 1602 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr)); 1603 NTOHL(oi->ts_ecr); 1604 1605 /* 1606 * A timestamp received in a SYN makes 1607 * it ok to send timestamp requests and replies. 1608 */ 1609 if (ti->ti_flags & TH_SYN) { 1610 tp->t_flags |= TF_RCVD_TSTMP; 1611 tp->ts_recent = oi->ts_val; 1612 tp->ts_recent_age = tcp_now; 1613 } 1614 break; 1615 case TCPOPT_SACK_PERMITTED: 1616 if (optlen != TCPOLEN_SACK_PERMITTED) 1617 continue; 1618 if (!(ti->ti_flags & TH_SYN)) 1619 continue; 1620 tp->t_flags &= ~TF_CANT_TXSACK; 1621 break; 1622 1623 case TCPOPT_SACK: 1624 if (tp->t_flags & TF_IGNR_RXSACK) 1625 continue; 1626 if (optlen % 8 != 2 || optlen < 10) 1627 continue; 1628 cp += 2; 1629 optlen -= 2; 1630 for (; optlen > 0; cp -= 8, optlen -= 8) { 1631 tcp_seq lwe, rwe; 1632 bcopy((char *)cp, (char *) &lwe, sizeof(lwe)); 1633 NTOHL(lwe); 1634 bcopy((char *)cp, (char *) &rwe, sizeof(rwe)); 1635 NTOHL(rwe); 1636 /* tcp_mark_sacked(tp, lwe, rwe); */ 1637 } 1638 break; 1639 } 1640 } 1641 } 1642 1643 /* 1644 * Pull out of band byte out of a segment so 1645 * it doesn't appear in the user's data queue. 1646 * It is still reflected in the segment length for 1647 * sequencing purposes. 1648 */ 1649 void 1650 tcp_pulloutofband(so, ti, m) 1651 struct socket *so; 1652 struct tcpiphdr *ti; 1653 register struct mbuf *m; 1654 { 1655 int cnt = ti->ti_urp - 1; 1656 1657 while (cnt >= 0) { 1658 if (m->m_len > cnt) { 1659 char *cp = mtod(m, caddr_t) + cnt; 1660 struct tcpcb *tp = sototcpcb(so); 1661 1662 tp->t_iobc = *cp; 1663 tp->t_oobflags |= TCPOOB_HAVEDATA; 1664 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 1665 m->m_len--; 1666 return; 1667 } 1668 cnt -= m->m_len; 1669 m = m->m_next; 1670 if (m == 0) 1671 break; 1672 } 1673 panic("tcp_pulloutofband"); 1674 } 1675 1676 /* 1677 * Collect new round-trip time estimate 1678 * and update averages and current timeout. 1679 */ 1680 void 1681 tcp_xmit_timer(tp, rtt) 1682 register struct tcpcb *tp; 1683 short rtt; 1684 { 1685 register short delta; 1686 short rttmin; 1687 1688 tcpstat.tcps_rttupdated++; 1689 --rtt; 1690 if (tp->t_srtt != 0) { 1691 /* 1692 * srtt is stored as fixed point with 3 bits after the 1693 * binary point (i.e., scaled by 8). The following magic 1694 * is equivalent to the smoothing algorithm in rfc793 with 1695 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 1696 * point). Adjust rtt to origin 0. 1697 */ 1698 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT); 1699 if ((tp->t_srtt += delta) <= 0) 1700 tp->t_srtt = 1 << 2; 1701 /* 1702 * We accumulate a smoothed rtt variance (actually, a 1703 * smoothed mean difference), then set the retransmit 1704 * timer to smoothed rtt + 4 times the smoothed variance. 1705 * rttvar is stored as fixed point with 2 bits after the 1706 * binary point (scaled by 4). The following is 1707 * equivalent to rfc793 smoothing with an alpha of .75 1708 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 1709 * rfc793's wired-in beta. 1710 */ 1711 if (delta < 0) 1712 delta = -delta; 1713 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 1714 if ((tp->t_rttvar += delta) <= 0) 1715 tp->t_rttvar = 1 << 2; 1716 } else { 1717 /* 1718 * No rtt measurement yet - use the unsmoothed rtt. 1719 * Set the variance to half the rtt (so our first 1720 * retransmit happens at 3*rtt). 1721 */ 1722 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2); 1723 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1); 1724 } 1725 tp->t_rtt = 0; 1726 tp->t_rxtshift = 0; 1727 1728 /* 1729 * the retransmit should happen at rtt + 4 * rttvar. 1730 * Because of the way we do the smoothing, srtt and rttvar 1731 * will each average +1/2 tick of bias. When we compute 1732 * the retransmit timer, we want 1/2 tick of rounding and 1733 * 1 extra tick because of +-1/2 tick uncertainty in the 1734 * firing of the timer. The bias will give us exactly the 1735 * 1.5 tick we need. But, because the bias is 1736 * statistical, we have to test that we don't drop below 1737 * the minimum feasible timer (which is 2 ticks). 1738 */ 1739 if (tp->t_rttmin > rtt + 2) 1740 rttmin = tp->t_rttmin; 1741 else 1742 rttmin = rtt + 2; 1743 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 1744 1745 /* 1746 * We received an ack for a packet that wasn't retransmitted; 1747 * it is probably safe to discard any error indications we've 1748 * received recently. This isn't quite right, but close enough 1749 * for now (a route might have failed after we sent a segment, 1750 * and the return path might not be symmetrical). 1751 */ 1752 tp->t_softerror = 0; 1753 } 1754 1755 /* 1756 * TCP compressed state engine. Currently used to hold compressed 1757 * state for SYN_RECEIVED. 1758 */ 1759 1760 u_long syn_cache_count; 1761 u_int32_t syn_hash1, syn_hash2; 1762 1763 #define SYN_HASH(sa, sp, dp) \ 1764 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 1765 ((u_int32_t)(sp)))^syn_hash2))) 1766 1767 LIST_HEAD(, syn_cache_head) tcp_syn_cache_queue; 1768 1769 #define SYN_CACHE_RM(sc, scp) \ 1770 do { \ 1771 TAILQ_REMOVE(&(scp)->sch_queue, (sc), sc_queue); \ 1772 if (--(scp)->sch_length == 0) \ 1773 LIST_REMOVE((scp), sch_headq); \ 1774 syn_cache_count--; \ 1775 } while (0) 1776 1777 void 1778 syn_cache_init() 1779 { 1780 int i; 1781 1782 /* Initialize the hash bucket queues. */ 1783 for (i = 0; i < tcp_syn_cache_size; i++) 1784 TAILQ_INIT(&tcp_syn_cache[i].sch_queue); 1785 1786 /* Initialize the active hash bucket cache. */ 1787 LIST_INIT(&tcp_syn_cache_queue); 1788 } 1789 1790 void 1791 syn_cache_insert(sc) 1792 struct syn_cache *sc; 1793 { 1794 struct syn_cache_head *scp, *scp2, *sce; 1795 struct syn_cache *sc2; 1796 int s; 1797 1798 /* 1799 * If there are no entries in the hash table, reinitialize 1800 * the hash secrets. 1801 */ 1802 if (syn_cache_count == 0) { 1803 struct timeval tv; 1804 microtime(&tv); 1805 syn_hash1 = random() ^ (u_long)≻ 1806 syn_hash2 = random() ^ tv.tv_usec; 1807 } 1808 1809 sc->sc_hash = SYN_HASH(&sc->sc_src, sc->sc_sport, sc->sc_dport); 1810 scp = &tcp_syn_cache[sc->sc_hash % tcp_syn_cache_size]; 1811 1812 /* 1813 * Make sure that we don't overflow the per-bucket 1814 * limit or the total cache size limit. 1815 */ 1816 s = splsoftnet(); 1817 if (scp->sch_length >= tcp_syn_bucket_limit) { 1818 tcpstat.tcps_sc_bucketoverflow++; 1819 /* 1820 * The bucket is full. Toss the first (i.e. oldest) 1821 * element in this bucket. 1822 */ 1823 sc2 = TAILQ_FIRST(&scp->sch_queue); 1824 SYN_CACHE_RM(sc2, scp); 1825 if (sc2->sc_ipopts) 1826 (void) m_free(sc2->sc_ipopts); 1827 FREE(sc2, M_PCB); 1828 } else if (syn_cache_count >= tcp_syn_cache_limit) { 1829 tcpstat.tcps_sc_overflowed++; 1830 /* 1831 * The cache is full. Toss the first (i.e. oldest) 1832 * element in the first non-empty bucket we can find. 1833 */ 1834 scp2 = scp; 1835 if (TAILQ_FIRST(&scp2->sch_queue) == NULL) { 1836 sce = &tcp_syn_cache[tcp_syn_cache_size]; 1837 for (++scp2; scp2 != scp; scp2++) { 1838 if (scp2 >= sce) 1839 scp2 = &tcp_syn_cache[0]; 1840 if (TAILQ_FIRST(&scp2->sch_queue) != NULL) 1841 break; 1842 } 1843 } 1844 sc2 = TAILQ_FIRST(&scp2->sch_queue); 1845 if (sc2 == NULL) { 1846 if (sc->sc_ipopts) 1847 (void) m_free(sc->sc_ipopts); 1848 FREE(sc, M_PCB); 1849 return; 1850 } 1851 SYN_CACHE_RM(sc2, scp2); 1852 if (sc2->sc_ipopts) 1853 (void) m_free(sc2->sc_ipopts); 1854 FREE(sc2, M_PCB); 1855 } 1856 1857 /* Set entry's timer. */ 1858 PRT_SLOW_ARM(sc->sc_timer, tcp_syn_cache_timeo); 1859 1860 /* Put it into the bucket. */ 1861 TAILQ_INSERT_TAIL(&scp->sch_queue, sc, sc_queue); 1862 if (++scp->sch_length == 1) 1863 LIST_INSERT_HEAD(&tcp_syn_cache_queue, scp, sch_headq); 1864 syn_cache_count++; 1865 1866 tcpstat.tcps_sc_added++; 1867 splx(s); 1868 } 1869 1870 /* 1871 * Walk down the cache list, looking for expired entries in each bucket. 1872 */ 1873 void 1874 syn_cache_timer() 1875 { 1876 struct syn_cache_head *scp, *nscp; 1877 struct syn_cache *sc, *nsc; 1878 int s; 1879 1880 s = splsoftnet(); 1881 for (scp = LIST_FIRST(&tcp_syn_cache_queue); scp != NULL; scp = nscp) { 1882 #ifdef DIAGNOSTIC 1883 if (TAILQ_FIRST(&scp->sch_queue) == NULL) 1884 panic("syn_cache_timer: queue inconsistency"); 1885 #endif 1886 nscp = LIST_NEXT(scp, sch_headq); 1887 for (sc = TAILQ_FIRST(&scp->sch_queue); 1888 sc != NULL && PRT_SLOW_ISEXPIRED(sc->sc_timer); 1889 sc = nsc) { 1890 nsc = TAILQ_NEXT(sc, sc_queue); 1891 tcpstat.tcps_sc_timed_out++; 1892 SYN_CACHE_RM(sc, scp); 1893 if (sc->sc_ipopts) 1894 (void) m_free(sc->sc_ipopts); 1895 FREE(sc, M_PCB); 1896 } 1897 } 1898 splx(s); 1899 } 1900 1901 /* 1902 * Find an entry in the syn cache. 1903 */ 1904 struct syn_cache * 1905 syn_cache_lookup(ti, headp) 1906 struct tcpiphdr *ti; 1907 struct syn_cache_head **headp; 1908 { 1909 struct syn_cache *sc; 1910 struct syn_cache_head *scp; 1911 u_int32_t hash; 1912 int s; 1913 1914 hash = SYN_HASH(&ti->ti_src, ti->ti_sport, ti->ti_dport); 1915 1916 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 1917 *headp = scp; 1918 s = splsoftnet(); 1919 for (sc = TAILQ_FIRST(&scp->sch_queue); sc != NULL; 1920 sc = TAILQ_NEXT(sc, sc_queue)) { 1921 if (sc->sc_hash != hash) 1922 continue; 1923 if (sc->sc_src.s_addr == ti->ti_src.s_addr && 1924 sc->sc_sport == ti->ti_sport && 1925 sc->sc_dport == ti->ti_dport && 1926 sc->sc_dst.s_addr == ti->ti_dst.s_addr) { 1927 splx(s); 1928 return (sc); 1929 } 1930 } 1931 splx(s); 1932 return (NULL); 1933 } 1934 1935 /* 1936 * This function gets called when we receive an ACK for a 1937 * socket in the LISTEN state. We look up the connection 1938 * in the syn cache, and if its there, we pull it out of 1939 * the cache and turn it into a full-blown connection in 1940 * the SYN-RECEIVED state. 1941 * 1942 * The return values may not be immediately obvious, and their effects 1943 * can be subtle, so here they are: 1944 * 1945 * NULL SYN was not found in cache; caller should drop the 1946 * packet and send an RST. 1947 * 1948 * -1 We were unable to create the new connection, and are 1949 * aborting it. An ACK,RST is being sent to the peer 1950 * (unless we got screwey sequence numbners; see below), 1951 * because the 3-way handshake has been completed. Caller 1952 * should not free the mbuf, since we may be using it. If 1953 * we are not, we will free it. 1954 * 1955 * Otherwise, the return value is a pointer to the new socket 1956 * associated with the connection. 1957 */ 1958 struct socket * 1959 syn_cache_get(so, m) 1960 struct socket *so; 1961 struct mbuf *m; 1962 { 1963 struct syn_cache *sc; 1964 struct syn_cache_head *scp; 1965 register struct inpcb *inp; 1966 register struct tcpcb *tp = 0; 1967 register struct tcpiphdr *ti; 1968 struct sockaddr_in *sin; 1969 struct mbuf *am; 1970 long win; 1971 int s; 1972 1973 ti = mtod(m, struct tcpiphdr *); 1974 s = splsoftnet(); 1975 if ((sc = syn_cache_lookup(ti, &scp)) == NULL) { 1976 splx(s); 1977 return (NULL); 1978 } 1979 1980 win = sbspace(&so->so_rcv); 1981 if (win > TCP_MAXWIN) 1982 win = TCP_MAXWIN; 1983 1984 /* 1985 * Verify the sequence and ack numbers. 1986 */ 1987 if ((ti->ti_ack != sc->sc_iss + 1) || 1988 SEQ_LEQ(ti->ti_seq, sc->sc_irs) || 1989 SEQ_GT(ti->ti_seq, sc->sc_irs + 1 + win)) { 1990 (void) syn_cache_respond(sc, m, ti, win, 0); 1991 splx(s); 1992 return ((struct socket *)(-1)); 1993 } 1994 1995 /* Remove this cache entry */ 1996 SYN_CACHE_RM(sc, scp); 1997 splx(s); 1998 1999 /* 2000 * Ok, create the full blown connection, and set things up 2001 * as they would have been set up if we had created the 2002 * connection when the SYN arrived. If we can't create 2003 * the connection, abort it. 2004 */ 2005 so = sonewconn(so, SS_ISCONNECTED); 2006 if (so == NULL) 2007 goto resetandabort; 2008 2009 inp = sotoinpcb(so); 2010 inp->inp_laddr = sc->sc_dst; 2011 inp->inp_lport = sc->sc_dport; 2012 in_pcbstate(inp, INP_BOUND); 2013 inp->inp_options = ip_srcroute(); 2014 if (inp->inp_options == NULL) { 2015 inp->inp_options = sc->sc_ipopts; 2016 sc->sc_ipopts = NULL; 2017 } 2018 2019 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 2020 if (am == NULL) 2021 goto resetandabort; 2022 am->m_len = sizeof(struct sockaddr_in); 2023 sin = mtod(am, struct sockaddr_in *); 2024 sin->sin_family = AF_INET; 2025 sin->sin_len = sizeof(*sin); 2026 sin->sin_addr = sc->sc_src; 2027 sin->sin_port = sc->sc_sport; 2028 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero)); 2029 if (in_pcbconnect(inp, am)) { 2030 (void) m_free(am); 2031 goto resetandabort; 2032 } 2033 (void) m_free(am); 2034 2035 tp = intotcpcb(inp); 2036 if (sc->sc_request_r_scale != 15) { 2037 tp->requested_s_scale = sc->sc_requested_s_scale; 2038 tp->request_r_scale = sc->sc_request_r_scale; 2039 tp->snd_scale = sc->sc_requested_s_scale; 2040 tp->rcv_scale = sc->sc_request_r_scale; 2041 tp->t_flags |= TF_RCVD_SCALE; 2042 } 2043 if (sc->sc_flags & SCF_TIMESTAMP) 2044 tp->t_flags |= TF_RCVD_TSTMP; 2045 2046 tp->t_template = tcp_template(tp); 2047 if (tp->t_template == 0) { 2048 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 2049 so = NULL; 2050 m_freem(m); 2051 goto abort; 2052 } 2053 2054 tp->iss = sc->sc_iss; 2055 tp->irs = sc->sc_irs; 2056 tcp_sendseqinit(tp); 2057 tcp_rcvseqinit(tp); 2058 tp->t_state = TCPS_SYN_RECEIVED; 2059 TCP_TIMER_ARM(tp, TCPT_KEEP, TCPTV_KEEP_INIT); 2060 tcpstat.tcps_accepts++; 2061 2062 /* Initialize tp->t_ourmss before we deal with the peer's! */ 2063 tp->t_ourmss = sc->sc_ourmaxseg; 2064 tcp_mss_from_peer(tp, sc->sc_peermaxseg); 2065 2066 /* 2067 * Initialize the initial congestion window. If we 2068 * had to retransmit the SYN,ACK, we must initialize cwnd 2069 * to 1 segment (i.e. the Loss Window). 2070 */ 2071 if (sc->sc_flags & SCF_SYNACK_REXMT) 2072 tp->snd_cwnd = tp->t_peermss; 2073 else 2074 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, tp->t_peermss); 2075 2076 tcp_rmx_rtt(tp); 2077 tp->snd_wl1 = sc->sc_irs; 2078 tp->rcv_up = sc->sc_irs + 1; 2079 2080 /* 2081 * This is what whould have happened in tcp_ouput() when 2082 * the SYN,ACK was sent. 2083 */ 2084 tp->snd_up = tp->snd_una; 2085 tp->snd_max = tp->snd_nxt = tp->iss+1; 2086 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 2087 if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv)) 2088 tp->rcv_adv = tp->rcv_nxt + win; 2089 tp->last_ack_sent = tp->rcv_nxt; 2090 2091 tcpstat.tcps_sc_completed++; 2092 if (sc->sc_ipopts) 2093 (void) m_free(sc->sc_ipopts); 2094 FREE(sc, M_PCB); 2095 return (so); 2096 2097 resetandabort: 2098 (void) tcp_respond(NULL, ti, m, ti->ti_seq+ti->ti_len, 2099 (tcp_seq)0, TH_RST|TH_ACK); 2100 abort: 2101 if (so != NULL) 2102 (void) soabort(so); 2103 if (sc->sc_ipopts) 2104 (void) m_free(sc->sc_ipopts); 2105 FREE(sc, M_PCB); 2106 tcpstat.tcps_sc_aborted++; 2107 return ((struct socket *)(-1)); 2108 } 2109 2110 /* 2111 * This function is called when we get a RST for a 2112 * non-existant connection, so that we can see if the 2113 * connection is in the syn cache. If it is, zap it. 2114 */ 2115 2116 void 2117 syn_cache_reset(ti) 2118 register struct tcpiphdr *ti; 2119 { 2120 struct syn_cache *sc; 2121 struct syn_cache_head *scp; 2122 int s = splsoftnet(); 2123 2124 if ((sc = syn_cache_lookup(ti, &scp)) == NULL) { 2125 splx(s); 2126 return; 2127 } 2128 if (SEQ_LT(ti->ti_seq,sc->sc_irs) || 2129 SEQ_GT(ti->ti_seq, sc->sc_irs+1)) { 2130 splx(s); 2131 return; 2132 } 2133 SYN_CACHE_RM(sc, scp); 2134 splx(s); 2135 tcpstat.tcps_sc_reset++; 2136 if (sc->sc_ipopts) 2137 (void) m_free(sc->sc_ipopts); 2138 FREE(sc, M_PCB); 2139 } 2140 2141 void 2142 syn_cache_unreach(ip, th) 2143 struct ip *ip; 2144 struct tcphdr *th; 2145 { 2146 struct syn_cache *sc; 2147 struct syn_cache_head *scp; 2148 struct tcpiphdr ti2; 2149 int s; 2150 2151 ti2.ti_src.s_addr = ip->ip_dst.s_addr; 2152 ti2.ti_dst.s_addr = ip->ip_src.s_addr; 2153 ti2.ti_sport = th->th_dport; 2154 ti2.ti_dport = th->th_sport; 2155 2156 s = splsoftnet(); 2157 if ((sc = syn_cache_lookup(&ti2, &scp)) == NULL) { 2158 splx(s); 2159 return; 2160 } 2161 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 2162 if (ntohl (th->th_seq) != sc->sc_iss) { 2163 splx(s); 2164 return; 2165 } 2166 SYN_CACHE_RM(sc, scp); 2167 splx(s); 2168 tcpstat.tcps_sc_unreach++; 2169 if (sc->sc_ipopts) 2170 (void) m_free(sc->sc_ipopts); 2171 FREE(sc, M_PCB); 2172 } 2173 2174 /* 2175 * Given a LISTEN socket and an inbound SYN request, add 2176 * this to the syn cache, and send back a segment: 2177 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 2178 * to the source. 2179 * 2180 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 2181 * Doing so would require that we hold onto the data and deliver it 2182 * to the application. However, if we are the target of a SYN-flood 2183 * DoS attack, an attacker could send data which would eventually 2184 * consume all available buffer space if it were ACKed. By not ACKing 2185 * the data, we avoid this DoS scenario. 2186 */ 2187 2188 int 2189 syn_cache_add(so, m, optp, optlen, oi) 2190 struct socket *so; 2191 struct mbuf *m; 2192 u_char *optp; 2193 int optlen; 2194 struct tcp_opt_info *oi; 2195 { 2196 register struct tcpiphdr *ti; 2197 struct tcpcb tb, *tp; 2198 long win; 2199 struct syn_cache *sc; 2200 struct syn_cache_head *scp; 2201 struct mbuf *ipopts; 2202 2203 tp = sototcpcb(so); 2204 ti = mtod(m, struct tcpiphdr *); 2205 2206 /* 2207 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 2208 * in_broadcast() should never return true on a received 2209 * packet with M_BCAST not set. 2210 */ 2211 if (m->m_flags & (M_BCAST|M_MCAST) || 2212 IN_MULTICAST(ti->ti_src.s_addr) || 2213 IN_MULTICAST(ti->ti_dst.s_addr)) 2214 return (0); 2215 2216 /* 2217 * Initialize some local state. 2218 */ 2219 win = sbspace(&so->so_rcv); 2220 if (win > TCP_MAXWIN) 2221 win = TCP_MAXWIN; 2222 2223 /* 2224 * Remember the IP options, if any. 2225 */ 2226 ipopts = ip_srcroute(); 2227 2228 if (optp) { 2229 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 2230 tcp_dooptions(&tb, optp, optlen, ti, oi); 2231 } else 2232 tb.t_flags = 0; 2233 2234 /* 2235 * See if we already have an entry for this connection. 2236 * If we do, resend the SYN,ACK, and remember since the 2237 * initial congestion window must be initialized to 1 2238 * segment when the connection completes. 2239 */ 2240 if ((sc = syn_cache_lookup(ti, &scp)) != NULL) { 2241 tcpstat.tcps_sc_dupesyn++; 2242 sc->sc_flags |= SCF_SYNACK_REXMT; 2243 2244 if (ipopts) { 2245 /* 2246 * If we were remembering a previous source route, 2247 * forget it and use the new one we've been given. 2248 */ 2249 if (sc->sc_ipopts) 2250 (void) m_free(sc->sc_ipopts); 2251 sc->sc_ipopts = ipopts; 2252 } 2253 2254 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) { 2255 tcpstat.tcps_sndacks++; 2256 tcpstat.tcps_sndtotal++; 2257 } 2258 return (1); 2259 } 2260 2261 MALLOC(sc, struct syn_cache *, sizeof(*sc), M_PCB, M_NOWAIT); 2262 if (sc == NULL) { 2263 if (ipopts) 2264 (void) m_free(ipopts); 2265 return (0); 2266 } 2267 2268 /* 2269 * Fill in the cache, and put the necessary IP and TCP 2270 * options into the reply. 2271 */ 2272 sc->sc_src.s_addr = ti->ti_src.s_addr; 2273 sc->sc_dst.s_addr = ti->ti_dst.s_addr; 2274 sc->sc_sport = ti->ti_sport; 2275 sc->sc_dport = ti->ti_dport; 2276 sc->sc_flags = 0; 2277 sc->sc_ipopts = ipopts; 2278 sc->sc_irs = ti->ti_seq; 2279 sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0); 2280 sc->sc_peermaxseg = oi->maxseg; 2281 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ? 2282 m->m_pkthdr.rcvif : NULL); 2283 if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP)) 2284 sc->sc_flags |= SCF_TIMESTAMP; 2285 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 2286 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 2287 sc->sc_requested_s_scale = tb.requested_s_scale; 2288 sc->sc_request_r_scale = 0; 2289 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 2290 TCP_MAXWIN << sc->sc_request_r_scale < 2291 so->so_rcv.sb_hiwat) 2292 sc->sc_request_r_scale++; 2293 } else { 2294 sc->sc_requested_s_scale = 15; 2295 sc->sc_request_r_scale = 15; 2296 } 2297 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) { 2298 syn_cache_insert(sc); 2299 tcpstat.tcps_sndacks++; 2300 tcpstat.tcps_sndtotal++; 2301 } else { 2302 if (sc->sc_ipopts) 2303 (void) m_free(sc->sc_ipopts); 2304 FREE(sc, M_PCB); 2305 tcpstat.tcps_sc_dropped++; 2306 } 2307 return (1); 2308 } 2309 2310 int 2311 syn_cache_respond(sc, m, ti, win, ts) 2312 struct syn_cache *sc; 2313 struct mbuf *m; 2314 register struct tcpiphdr *ti; 2315 long win; 2316 u_long ts; 2317 { 2318 u_int8_t *optp; 2319 int optlen; 2320 2321 /* 2322 * Tack on the TCP options. If there isn't enough trailing 2323 * space for them, move up the fixed header to make space. 2324 */ 2325 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 2326 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 2327 if (optlen > M_TRAILINGSPACE(m)) { 2328 if (M_LEADINGSPACE(m) >= optlen) { 2329 m->m_data -= optlen; 2330 m->m_len += optlen; 2331 } else { 2332 struct mbuf *m0 = m; 2333 if ((m = m_gethdr(M_DONTWAIT, MT_HEADER)) == NULL) { 2334 m_freem(m0); 2335 return (ENOBUFS); 2336 } 2337 MH_ALIGN(m, sizeof(*ti) + optlen); 2338 m->m_next = m0; /* this gets freed below */ 2339 } 2340 bcopy((caddr_t)ti, mtod(m, caddr_t), sizeof(*ti)); 2341 ti = mtod(m, struct tcpiphdr *); 2342 } 2343 2344 optp = (u_int8_t *)(ti + 1); 2345 optp[0] = TCPOPT_MAXSEG; 2346 optp[1] = 4; 2347 optp[2] = (sc->sc_ourmaxseg >> 8) & 0xff; 2348 optp[3] = sc->sc_ourmaxseg & 0xff; 2349 optlen = 4; 2350 2351 if (sc->sc_request_r_scale != 15) { 2352 *((u_int32_t *)(optp + optlen)) = htonl(TCPOPT_NOP << 24 | 2353 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 2354 sc->sc_request_r_scale); 2355 optlen += 4; 2356 } 2357 2358 if (sc->sc_flags & SCF_TIMESTAMP) { 2359 u_int32_t *lp = (u_int32_t *)(optp + optlen); 2360 /* Form timestamp option as shown in appendix A of RFC 1323. */ 2361 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 2362 *lp++ = htonl(tcp_now); 2363 *lp = htonl(ts); 2364 optlen += TCPOLEN_TSTAMP_APPA; 2365 } 2366 2367 /* 2368 * Toss any trailing mbufs. No need to worry about 2369 * m_len and m_pkthdr.len, since tcp_respond() will 2370 * unconditionally set them. 2371 */ 2372 if (m->m_next) { 2373 m_freem(m->m_next); 2374 m->m_next = NULL; 2375 } 2376 2377 /* 2378 * Fill in the fields that tcp_respond() will not touch, and 2379 * then send the response. 2380 */ 2381 ti->ti_off = (sizeof(struct tcphdr) + optlen) >> 2; 2382 ti->ti_win = htons(win); 2383 return (tcp_respond(NULL, ti, m, sc->sc_irs + 1, sc->sc_iss, 2384 TH_SYN|TH_ACK)); 2385 } 2386
Indexes created Tue Sep 23 20:09:58 GMT 2025