Home | History | Annotate | Line # | Download | only in netinet
tcp_subr.c revision 1.231
      1 /*	$NetBSD: tcp_subr.c,v 1.231 2008/05/02 13:40:33 ad Exp $	*/
      2 
      3 /*
      4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. Neither the name of the project nor the names of its contributors
     16  *    may be used to endorse or promote products derived from this software
     17  *    without specific prior written permission.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  * SUCH DAMAGE.
     30  */
     31 
     32 /*-
     33  * Copyright (c) 1997, 1998, 2000, 2001, 2008 The NetBSD Foundation, Inc.
     34  * All rights reserved.
     35  *
     36  * This code is derived from software contributed to The NetBSD Foundation
     37  * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
     38  * Facility, NASA Ames Research Center.
     39  *
     40  * Redistribution and use in source and binary forms, with or without
     41  * modification, are permitted provided that the following conditions
     42  * are met:
     43  * 1. Redistributions of source code must retain the above copyright
     44  *    notice, this list of conditions and the following disclaimer.
     45  * 2. Redistributions in binary form must reproduce the above copyright
     46  *    notice, this list of conditions and the following disclaimer in the
     47  *    documentation and/or other materials provided with the distribution.
     48  *
     49  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     50  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     51  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     52  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     53  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     54  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     55  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     56  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     57  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     58  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     59  * POSSIBILITY OF SUCH DAMAGE.
     60  */
     61 
     62 /*
     63  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
     64  *	The Regents of the University of California.  All rights reserved.
     65  *
     66  * Redistribution and use in source and binary forms, with or without
     67  * modification, are permitted provided that the following conditions
     68  * are met:
     69  * 1. Redistributions of source code must retain the above copyright
     70  *    notice, this list of conditions and the following disclaimer.
     71  * 2. Redistributions in binary form must reproduce the above copyright
     72  *    notice, this list of conditions and the following disclaimer in the
     73  *    documentation and/or other materials provided with the distribution.
     74  * 3. Neither the name of the University nor the names of its contributors
     75  *    may be used to endorse or promote products derived from this software
     76  *    without specific prior written permission.
     77  *
     78  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     79  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     80  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     81  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     82  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     83  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     84  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     86  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     87  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     88  * SUCH DAMAGE.
     89  *
     90  *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
     91  */
     92 
     93 #include <sys/cdefs.h>
     94 __KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.231 2008/05/02 13:40:33 ad Exp $");
     95 
     96 #include "opt_inet.h"
     97 #include "opt_ipsec.h"
     98 #include "opt_tcp_compat_42.h"
     99 #include "opt_inet_csum.h"
    100 #include "opt_mbuftrace.h"
    101 #include "rnd.h"
    102 
    103 #include <sys/param.h>
    104 #include <sys/proc.h>
    105 #include <sys/systm.h>
    106 #include <sys/malloc.h>
    107 #include <sys/mbuf.h>
    108 #include <sys/socket.h>
    109 #include <sys/socketvar.h>
    110 #include <sys/protosw.h>
    111 #include <sys/errno.h>
    112 #include <sys/kernel.h>
    113 #include <sys/pool.h>
    114 #if NRND > 0
    115 #include <sys/md5.h>
    116 #include <sys/rnd.h>
    117 #endif
    118 
    119 #include <net/route.h>
    120 #include <net/if.h>
    121 
    122 #include <netinet/in.h>
    123 #include <netinet/in_systm.h>
    124 #include <netinet/ip.h>
    125 #include <netinet/in_pcb.h>
    126 #include <netinet/ip_var.h>
    127 #include <netinet/ip_icmp.h>
    128 
    129 #ifdef INET6
    130 #ifndef INET
    131 #include <netinet/in.h>
    132 #endif
    133 #include <netinet/ip6.h>
    134 #include <netinet6/in6_pcb.h>
    135 #include <netinet6/ip6_var.h>
    136 #include <netinet6/in6_var.h>
    137 #include <netinet6/ip6protosw.h>
    138 #include <netinet/icmp6.h>
    139 #include <netinet6/nd6.h>
    140 #endif
    141 
    142 #include <netinet/tcp.h>
    143 #include <netinet/tcp_fsm.h>
    144 #include <netinet/tcp_seq.h>
    145 #include <netinet/tcp_timer.h>
    146 #include <netinet/tcp_var.h>
    147 #include <netinet/tcp_private.h>
    148 #include <netinet/tcp_congctl.h>
    149 #include <netinet/tcpip.h>
    150 
    151 #ifdef IPSEC
    152 #include <netinet6/ipsec.h>
    153 #include <netkey/key.h>
    154 #endif /*IPSEC*/
    155 
    156 #ifdef FAST_IPSEC
    157 #include <netipsec/ipsec.h>
    158 #include <netipsec/xform.h>
    159 #ifdef INET6
    160 #include <netipsec/ipsec6.h>
    161 #endif
    162  #include <netipsec/key.h>
    163 #endif	/* FAST_IPSEC*/
    164 
    165 
    166 struct	inpcbtable tcbtable;	/* head of queue of active tcpcb's */
    167 u_int32_t tcp_now;		/* for RFC 1323 timestamps */
    168 
    169 percpu_t *tcpstat_percpu;
    170 
    171 /* patchable/settable parameters for tcp */
    172 int 	tcp_mssdflt = TCP_MSS;
    173 int	tcp_minmss = TCP_MINMSS;
    174 int 	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
    175 int	tcp_do_rfc1323 = 1;	/* window scaling / timestamps (obsolete) */
    176 #if NRND > 0
    177 int	tcp_do_rfc1948 = 0;	/* ISS by cryptographic hash */
    178 #endif
    179 int	tcp_do_sack = 1;	/* selective acknowledgement */
    180 int	tcp_do_win_scale = 1;	/* RFC1323 window scaling */
    181 int	tcp_do_timestamps = 1;	/* RFC1323 timestamps */
    182 int	tcp_ack_on_push = 0;	/* set to enable immediate ACK-on-PUSH */
    183 int	tcp_do_ecn = 0;		/* Explicit Congestion Notification */
    184 #ifndef TCP_INIT_WIN
    185 #define	TCP_INIT_WIN	0	/* initial slow start window */
    186 #endif
    187 #ifndef TCP_INIT_WIN_LOCAL
    188 #define	TCP_INIT_WIN_LOCAL 4	/* initial slow start window for local nets */
    189 #endif
    190 int	tcp_init_win = TCP_INIT_WIN;
    191 int	tcp_init_win_local = TCP_INIT_WIN_LOCAL;
    192 int	tcp_mss_ifmtu = 0;
    193 #ifdef TCP_COMPAT_42
    194 int	tcp_compat_42 = 1;
    195 #else
    196 int	tcp_compat_42 = 0;
    197 #endif
    198 int	tcp_rst_ppslim = 100;	/* 100pps */
    199 int	tcp_ackdrop_ppslim = 100;	/* 100pps */
    200 int	tcp_do_loopback_cksum = 0;
    201 int	tcp_do_abc = 1;		/* RFC3465 Appropriate byte counting. */
    202 int	tcp_abc_aggressive = 1;	/* 1: L=2*SMSS  0: L=1*SMSS */
    203 int	tcp_sack_tp_maxholes = 32;
    204 int	tcp_sack_globalmaxholes = 1024;
    205 int	tcp_sack_globalholes = 0;
    206 int	tcp_ecn_maxretries = 1;
    207 
    208 /* tcb hash */
    209 #ifndef TCBHASHSIZE
    210 #define	TCBHASHSIZE	128
    211 #endif
    212 int	tcbhashsize = TCBHASHSIZE;
    213 
    214 /* syn hash parameters */
    215 #define	TCP_SYN_HASH_SIZE	293
    216 #define	TCP_SYN_BUCKET_SIZE	35
    217 int	tcp_syn_cache_size = TCP_SYN_HASH_SIZE;
    218 int	tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE;
    219 int	tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE;
    220 struct	syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE];
    221 
    222 int	tcp_freeq(struct tcpcb *);
    223 
    224 #ifdef INET
    225 void	tcp_mtudisc_callback(struct in_addr);
    226 #endif
    227 #ifdef INET6
    228 void	tcp6_mtudisc_callback(struct in6_addr *);
    229 #endif
    230 
    231 #ifdef INET6
    232 void	tcp6_mtudisc(struct in6pcb *, int);
    233 #endif
    234 
    235 POOL_INIT(tcpcb_pool, sizeof(struct tcpcb), 0, 0, 0, "tcpcbpl", NULL,
    236     IPL_SOFTNET);
    237 
    238 #ifdef TCP_CSUM_COUNTERS
    239 #include <sys/device.h>
    240 
    241 #if defined(INET)
    242 struct evcnt tcp_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    243     NULL, "tcp", "hwcsum bad");
    244 struct evcnt tcp_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    245     NULL, "tcp", "hwcsum ok");
    246 struct evcnt tcp_hwcsum_data = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    247     NULL, "tcp", "hwcsum data");
    248 struct evcnt tcp_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    249     NULL, "tcp", "swcsum");
    250 
    251 EVCNT_ATTACH_STATIC(tcp_hwcsum_bad);
    252 EVCNT_ATTACH_STATIC(tcp_hwcsum_ok);
    253 EVCNT_ATTACH_STATIC(tcp_hwcsum_data);
    254 EVCNT_ATTACH_STATIC(tcp_swcsum);
    255 #endif /* defined(INET) */
    256 
    257 #if defined(INET6)
    258 struct evcnt tcp6_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    259     NULL, "tcp6", "hwcsum bad");
    260 struct evcnt tcp6_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    261     NULL, "tcp6", "hwcsum ok");
    262 struct evcnt tcp6_hwcsum_data = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    263     NULL, "tcp6", "hwcsum data");
    264 struct evcnt tcp6_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    265     NULL, "tcp6", "swcsum");
    266 
    267 EVCNT_ATTACH_STATIC(tcp6_hwcsum_bad);
    268 EVCNT_ATTACH_STATIC(tcp6_hwcsum_ok);
    269 EVCNT_ATTACH_STATIC(tcp6_hwcsum_data);
    270 EVCNT_ATTACH_STATIC(tcp6_swcsum);
    271 #endif /* defined(INET6) */
    272 #endif /* TCP_CSUM_COUNTERS */
    273 
    274 
    275 #ifdef TCP_OUTPUT_COUNTERS
    276 #include <sys/device.h>
    277 
    278 struct evcnt tcp_output_bigheader = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    279     NULL, "tcp", "output big header");
    280 struct evcnt tcp_output_predict_hit = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    281     NULL, "tcp", "output predict hit");
    282 struct evcnt tcp_output_predict_miss = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    283     NULL, "tcp", "output predict miss");
    284 struct evcnt tcp_output_copysmall = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    285     NULL, "tcp", "output copy small");
    286 struct evcnt tcp_output_copybig = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    287     NULL, "tcp", "output copy big");
    288 struct evcnt tcp_output_refbig = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    289     NULL, "tcp", "output reference big");
    290 
    291 EVCNT_ATTACH_STATIC(tcp_output_bigheader);
    292 EVCNT_ATTACH_STATIC(tcp_output_predict_hit);
    293 EVCNT_ATTACH_STATIC(tcp_output_predict_miss);
    294 EVCNT_ATTACH_STATIC(tcp_output_copysmall);
    295 EVCNT_ATTACH_STATIC(tcp_output_copybig);
    296 EVCNT_ATTACH_STATIC(tcp_output_refbig);
    297 
    298 #endif /* TCP_OUTPUT_COUNTERS */
    299 
    300 #ifdef TCP_REASS_COUNTERS
    301 #include <sys/device.h>
    302 
    303 struct evcnt tcp_reass_ = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    304     NULL, "tcp_reass", "calls");
    305 struct evcnt tcp_reass_empty = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    306     &tcp_reass_, "tcp_reass", "insert into empty queue");
    307 struct evcnt tcp_reass_iteration[8] = {
    308     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", ">7 iterations"),
    309     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "1 iteration"),
    310     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "2 iterations"),
    311     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "3 iterations"),
    312     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "4 iterations"),
    313     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "5 iterations"),
    314     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "6 iterations"),
    315     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "7 iterations"),
    316 };
    317 struct evcnt tcp_reass_prependfirst = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    318     &tcp_reass_, "tcp_reass", "prepend to first");
    319 struct evcnt tcp_reass_prepend = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    320     &tcp_reass_, "tcp_reass", "prepend");
    321 struct evcnt tcp_reass_insert = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    322     &tcp_reass_, "tcp_reass", "insert");
    323 struct evcnt tcp_reass_inserttail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    324     &tcp_reass_, "tcp_reass", "insert at tail");
    325 struct evcnt tcp_reass_append = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    326     &tcp_reass_, "tcp_reass", "append");
    327 struct evcnt tcp_reass_appendtail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    328     &tcp_reass_, "tcp_reass", "append to tail fragment");
    329 struct evcnt tcp_reass_overlaptail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    330     &tcp_reass_, "tcp_reass", "overlap at end");
    331 struct evcnt tcp_reass_overlapfront = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    332     &tcp_reass_, "tcp_reass", "overlap at start");
    333 struct evcnt tcp_reass_segdup = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    334     &tcp_reass_, "tcp_reass", "duplicate segment");
    335 struct evcnt tcp_reass_fragdup = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    336     &tcp_reass_, "tcp_reass", "duplicate fragment");
    337 
    338 EVCNT_ATTACH_STATIC(tcp_reass_);
    339 EVCNT_ATTACH_STATIC(tcp_reass_empty);
    340 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 0);
    341 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 1);
    342 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 2);
    343 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 3);
    344 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 4);
    345 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 5);
    346 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 6);
    347 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 7);
    348 EVCNT_ATTACH_STATIC(tcp_reass_prependfirst);
    349 EVCNT_ATTACH_STATIC(tcp_reass_prepend);
    350 EVCNT_ATTACH_STATIC(tcp_reass_insert);
    351 EVCNT_ATTACH_STATIC(tcp_reass_inserttail);
    352 EVCNT_ATTACH_STATIC(tcp_reass_append);
    353 EVCNT_ATTACH_STATIC(tcp_reass_appendtail);
    354 EVCNT_ATTACH_STATIC(tcp_reass_overlaptail);
    355 EVCNT_ATTACH_STATIC(tcp_reass_overlapfront);
    356 EVCNT_ATTACH_STATIC(tcp_reass_segdup);
    357 EVCNT_ATTACH_STATIC(tcp_reass_fragdup);
    358 
    359 #endif /* TCP_REASS_COUNTERS */
    360 
    361 #ifdef MBUFTRACE
    362 struct mowner tcp_mowner = MOWNER_INIT("tcp", "");
    363 struct mowner tcp_rx_mowner = MOWNER_INIT("tcp", "rx");
    364 struct mowner tcp_tx_mowner = MOWNER_INIT("tcp", "tx");
    365 struct mowner tcp_sock_mowner = MOWNER_INIT("tcp", "sock");
    366 struct mowner tcp_sock_rx_mowner = MOWNER_INIT("tcp", "sock rx");
    367 struct mowner tcp_sock_tx_mowner = MOWNER_INIT("tcp", "sock tx");
    368 #endif
    369 
    370 /*
    371  * Tcp initialization
    372  */
    373 void
    374 tcp_init(void)
    375 {
    376 	int hlen;
    377 
    378 	in_pcbinit(&tcbtable, tcbhashsize, tcbhashsize);
    379 
    380 	hlen = sizeof(struct ip) + sizeof(struct tcphdr);
    381 #ifdef INET6
    382 	if (sizeof(struct ip) < sizeof(struct ip6_hdr))
    383 		hlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
    384 #endif
    385 	if (max_protohdr < hlen)
    386 		max_protohdr = hlen;
    387 	if (max_linkhdr + hlen > MHLEN)
    388 		panic("tcp_init");
    389 
    390 #ifdef INET
    391 	icmp_mtudisc_callback_register(tcp_mtudisc_callback);
    392 #endif
    393 #ifdef INET6
    394 	icmp6_mtudisc_callback_register(tcp6_mtudisc_callback);
    395 #endif
    396 
    397 	/* Initialize timer state. */
    398 	tcp_timer_init();
    399 
    400 	/* Initialize the compressed state engine. */
    401 	syn_cache_init();
    402 
    403 	/* Initialize the congestion control algorithms. */
    404 	tcp_congctl_init();
    405 
    406 	/* Initialize the TCPCB template. */
    407 	tcp_tcpcb_template();
    408 
    409 	MOWNER_ATTACH(&tcp_tx_mowner);
    410 	MOWNER_ATTACH(&tcp_rx_mowner);
    411 	MOWNER_ATTACH(&tcp_reass_mowner);
    412 	MOWNER_ATTACH(&tcp_sock_mowner);
    413 	MOWNER_ATTACH(&tcp_sock_tx_mowner);
    414 	MOWNER_ATTACH(&tcp_sock_rx_mowner);
    415 	MOWNER_ATTACH(&tcp_mowner);
    416 
    417 	tcpstat_percpu = percpu_alloc(sizeof(uint64_t) * TCP_NSTATS);
    418 }
    419 
    420 /*
    421  * Create template to be used to send tcp packets on a connection.
    422  * Call after host entry created, allocates an mbuf and fills
    423  * in a skeletal tcp/ip header, minimizing the amount of work
    424  * necessary when the connection is used.
    425  */
    426 struct mbuf *
    427 tcp_template(struct tcpcb *tp)
    428 {
    429 	struct inpcb *inp = tp->t_inpcb;
    430 #ifdef INET6
    431 	struct in6pcb *in6p = tp->t_in6pcb;
    432 #endif
    433 	struct tcphdr *n;
    434 	struct mbuf *m;
    435 	int hlen;
    436 
    437 	switch (tp->t_family) {
    438 	case AF_INET:
    439 		hlen = sizeof(struct ip);
    440 		if (inp)
    441 			break;
    442 #ifdef INET6
    443 		if (in6p) {
    444 			/* mapped addr case */
    445 			if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr)
    446 			 && IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr))
    447 				break;
    448 		}
    449 #endif
    450 		return NULL;	/*EINVAL*/
    451 #ifdef INET6
    452 	case AF_INET6:
    453 		hlen = sizeof(struct ip6_hdr);
    454 		if (in6p) {
    455 			/* more sainty check? */
    456 			break;
    457 		}
    458 		return NULL;	/*EINVAL*/
    459 #endif
    460 	default:
    461 		hlen = 0;	/*pacify gcc*/
    462 		return NULL;	/*EAFNOSUPPORT*/
    463 	}
    464 #ifdef DIAGNOSTIC
    465 	if (hlen + sizeof(struct tcphdr) > MCLBYTES)
    466 		panic("mclbytes too small for t_template");
    467 #endif
    468 	m = tp->t_template;
    469 	if (m && m->m_len == hlen + sizeof(struct tcphdr))
    470 		;
    471 	else {
    472 		if (m)
    473 			m_freem(m);
    474 		m = tp->t_template = NULL;
    475 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
    476 		if (m && hlen + sizeof(struct tcphdr) > MHLEN) {
    477 			MCLGET(m, M_DONTWAIT);
    478 			if ((m->m_flags & M_EXT) == 0) {
    479 				m_free(m);
    480 				m = NULL;
    481 			}
    482 		}
    483 		if (m == NULL)
    484 			return NULL;
    485 		MCLAIM(m, &tcp_mowner);
    486 		m->m_pkthdr.len = m->m_len = hlen + sizeof(struct tcphdr);
    487 	}
    488 
    489 	bzero(mtod(m, void *), m->m_len);
    490 
    491 	n = (struct tcphdr *)(mtod(m, char *) + hlen);
    492 
    493 	switch (tp->t_family) {
    494 	case AF_INET:
    495 	    {
    496 		struct ipovly *ipov;
    497 		mtod(m, struct ip *)->ip_v = 4;
    498 		mtod(m, struct ip *)->ip_hl = hlen >> 2;
    499 		ipov = mtod(m, struct ipovly *);
    500 		ipov->ih_pr = IPPROTO_TCP;
    501 		ipov->ih_len = htons(sizeof(struct tcphdr));
    502 		if (inp) {
    503 			ipov->ih_src = inp->inp_laddr;
    504 			ipov->ih_dst = inp->inp_faddr;
    505 		}
    506 #ifdef INET6
    507 		else if (in6p) {
    508 			/* mapped addr case */
    509 			bcopy(&in6p->in6p_laddr.s6_addr32[3], &ipov->ih_src,
    510 				sizeof(ipov->ih_src));
    511 			bcopy(&in6p->in6p_faddr.s6_addr32[3], &ipov->ih_dst,
    512 				sizeof(ipov->ih_dst));
    513 		}
    514 #endif
    515 		/*
    516 		 * Compute the pseudo-header portion of the checksum
    517 		 * now.  We incrementally add in the TCP option and
    518 		 * payload lengths later, and then compute the TCP
    519 		 * checksum right before the packet is sent off onto
    520 		 * the wire.
    521 		 */
    522 		n->th_sum = in_cksum_phdr(ipov->ih_src.s_addr,
    523 		    ipov->ih_dst.s_addr,
    524 		    htons(sizeof(struct tcphdr) + IPPROTO_TCP));
    525 		break;
    526 	    }
    527 #ifdef INET6
    528 	case AF_INET6:
    529 	    {
    530 		struct ip6_hdr *ip6;
    531 		mtod(m, struct ip *)->ip_v = 6;
    532 		ip6 = mtod(m, struct ip6_hdr *);
    533 		ip6->ip6_nxt = IPPROTO_TCP;
    534 		ip6->ip6_plen = htons(sizeof(struct tcphdr));
    535 		ip6->ip6_src = in6p->in6p_laddr;
    536 		ip6->ip6_dst = in6p->in6p_faddr;
    537 		ip6->ip6_flow = in6p->in6p_flowinfo & IPV6_FLOWINFO_MASK;
    538 		if (ip6_auto_flowlabel) {
    539 			ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK;
    540 			ip6->ip6_flow |=
    541 			    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
    542 		}
    543 		ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
    544 		ip6->ip6_vfc |= IPV6_VERSION;
    545 
    546 		/*
    547 		 * Compute the pseudo-header portion of the checksum
    548 		 * now.  We incrementally add in the TCP option and
    549 		 * payload lengths later, and then compute the TCP
    550 		 * checksum right before the packet is sent off onto
    551 		 * the wire.
    552 		 */
    553 		n->th_sum = in6_cksum_phdr(&in6p->in6p_laddr,
    554 		    &in6p->in6p_faddr, htonl(sizeof(struct tcphdr)),
    555 		    htonl(IPPROTO_TCP));
    556 		break;
    557 	    }
    558 #endif
    559 	}
    560 	if (inp) {
    561 		n->th_sport = inp->inp_lport;
    562 		n->th_dport = inp->inp_fport;
    563 	}
    564 #ifdef INET6
    565 	else if (in6p) {
    566 		n->th_sport = in6p->in6p_lport;
    567 		n->th_dport = in6p->in6p_fport;
    568 	}
    569 #endif
    570 	n->th_seq = 0;
    571 	n->th_ack = 0;
    572 	n->th_x2 = 0;
    573 	n->th_off = 5;
    574 	n->th_flags = 0;
    575 	n->th_win = 0;
    576 	n->th_urp = 0;
    577 	return (m);
    578 }
    579 
    580 /*
    581  * Send a single message to the TCP at address specified by
    582  * the given TCP/IP header.  If m == 0, then we make a copy
    583  * of the tcpiphdr at ti and send directly to the addressed host.
    584  * This is used to force keep alive messages out using the TCP
    585  * template for a connection tp->t_template.  If flags are given
    586  * then we send a message back to the TCP which originated the
    587  * segment ti, and discard the mbuf containing it and any other
    588  * attached mbufs.
    589  *
    590  * In any case the ack and sequence number of the transmitted
    591  * segment are as specified by the parameters.
    592  */
    593 int
    594 tcp_respond(struct tcpcb *tp, struct mbuf *template, struct mbuf *m,
    595     struct tcphdr *th0, tcp_seq ack, tcp_seq seq, int flags)
    596 {
    597 #ifdef INET6
    598 	struct rtentry *rt;
    599 #endif
    600 	struct route *ro;
    601 	int error, tlen, win = 0;
    602 	int hlen;
    603 	struct ip *ip;
    604 #ifdef INET6
    605 	struct ip6_hdr *ip6;
    606 #endif
    607 	int family;	/* family on packet, not inpcb/in6pcb! */
    608 	struct tcphdr *th;
    609 	struct socket *so;
    610 
    611 	if (tp != NULL && (flags & TH_RST) == 0) {
    612 #ifdef DIAGNOSTIC
    613 		if (tp->t_inpcb && tp->t_in6pcb)
    614 			panic("tcp_respond: both t_inpcb and t_in6pcb are set");
    615 #endif
    616 #ifdef INET
    617 		if (tp->t_inpcb)
    618 			win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
    619 #endif
    620 #ifdef INET6
    621 		if (tp->t_in6pcb)
    622 			win = sbspace(&tp->t_in6pcb->in6p_socket->so_rcv);
    623 #endif
    624 	}
    625 
    626 	th = NULL;	/* Quell uninitialized warning */
    627 	ip = NULL;
    628 #ifdef INET6
    629 	ip6 = NULL;
    630 #endif
    631 	if (m == 0) {
    632 		if (!template)
    633 			return EINVAL;
    634 
    635 		/* get family information from template */
    636 		switch (mtod(template, struct ip *)->ip_v) {
    637 		case 4:
    638 			family = AF_INET;
    639 			hlen = sizeof(struct ip);
    640 			break;
    641 #ifdef INET6
    642 		case 6:
    643 			family = AF_INET6;
    644 			hlen = sizeof(struct ip6_hdr);
    645 			break;
    646 #endif
    647 		default:
    648 			return EAFNOSUPPORT;
    649 		}
    650 
    651 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
    652 		if (m) {
    653 			MCLAIM(m, &tcp_tx_mowner);
    654 			MCLGET(m, M_DONTWAIT);
    655 			if ((m->m_flags & M_EXT) == 0) {
    656 				m_free(m);
    657 				m = NULL;
    658 			}
    659 		}
    660 		if (m == NULL)
    661 			return (ENOBUFS);
    662 
    663 		if (tcp_compat_42)
    664 			tlen = 1;
    665 		else
    666 			tlen = 0;
    667 
    668 		m->m_data += max_linkhdr;
    669 		bcopy(mtod(template, void *), mtod(m, void *),
    670 			template->m_len);
    671 		switch (family) {
    672 		case AF_INET:
    673 			ip = mtod(m, struct ip *);
    674 			th = (struct tcphdr *)(ip + 1);
    675 			break;
    676 #ifdef INET6
    677 		case AF_INET6:
    678 			ip6 = mtod(m, struct ip6_hdr *);
    679 			th = (struct tcphdr *)(ip6 + 1);
    680 			break;
    681 #endif
    682 #if 0
    683 		default:
    684 			/* noone will visit here */
    685 			m_freem(m);
    686 			return EAFNOSUPPORT;
    687 #endif
    688 		}
    689 		flags = TH_ACK;
    690 	} else {
    691 
    692 		if ((m->m_flags & M_PKTHDR) == 0) {
    693 #if 0
    694 			printf("non PKTHDR to tcp_respond\n");
    695 #endif
    696 			m_freem(m);
    697 			return EINVAL;
    698 		}
    699 #ifdef DIAGNOSTIC
    700 		if (!th0)
    701 			panic("th0 == NULL in tcp_respond");
    702 #endif
    703 
    704 		/* get family information from m */
    705 		switch (mtod(m, struct ip *)->ip_v) {
    706 		case 4:
    707 			family = AF_INET;
    708 			hlen = sizeof(struct ip);
    709 			ip = mtod(m, struct ip *);
    710 			break;
    711 #ifdef INET6
    712 		case 6:
    713 			family = AF_INET6;
    714 			hlen = sizeof(struct ip6_hdr);
    715 			ip6 = mtod(m, struct ip6_hdr *);
    716 			break;
    717 #endif
    718 		default:
    719 			m_freem(m);
    720 			return EAFNOSUPPORT;
    721 		}
    722 		/* clear h/w csum flags inherited from rx packet */
    723 		m->m_pkthdr.csum_flags = 0;
    724 
    725 		if ((flags & TH_SYN) == 0 || sizeof(*th0) > (th0->th_off << 2))
    726 			tlen = sizeof(*th0);
    727 		else
    728 			tlen = th0->th_off << 2;
    729 
    730 		if (m->m_len > hlen + tlen && (m->m_flags & M_EXT) == 0 &&
    731 		    mtod(m, char *) + hlen == (char *)th0) {
    732 			m->m_len = hlen + tlen;
    733 			m_freem(m->m_next);
    734 			m->m_next = NULL;
    735 		} else {
    736 			struct mbuf *n;
    737 
    738 #ifdef DIAGNOSTIC
    739 			if (max_linkhdr + hlen + tlen > MCLBYTES) {
    740 				m_freem(m);
    741 				return EMSGSIZE;
    742 			}
    743 #endif
    744 			MGETHDR(n, M_DONTWAIT, MT_HEADER);
    745 			if (n && max_linkhdr + hlen + tlen > MHLEN) {
    746 				MCLGET(n, M_DONTWAIT);
    747 				if ((n->m_flags & M_EXT) == 0) {
    748 					m_freem(n);
    749 					n = NULL;
    750 				}
    751 			}
    752 			if (!n) {
    753 				m_freem(m);
    754 				return ENOBUFS;
    755 			}
    756 
    757 			MCLAIM(n, &tcp_tx_mowner);
    758 			n->m_data += max_linkhdr;
    759 			n->m_len = hlen + tlen;
    760 			m_copyback(n, 0, hlen, mtod(m, void *));
    761 			m_copyback(n, hlen, tlen, (void *)th0);
    762 
    763 			m_freem(m);
    764 			m = n;
    765 			n = NULL;
    766 		}
    767 
    768 #define xchg(a,b,type) { type t; t=a; a=b; b=t; }
    769 		switch (family) {
    770 		case AF_INET:
    771 			ip = mtod(m, struct ip *);
    772 			th = (struct tcphdr *)(ip + 1);
    773 			ip->ip_p = IPPROTO_TCP;
    774 			xchg(ip->ip_dst, ip->ip_src, struct in_addr);
    775 			ip->ip_p = IPPROTO_TCP;
    776 			break;
    777 #ifdef INET6
    778 		case AF_INET6:
    779 			ip6 = mtod(m, struct ip6_hdr *);
    780 			th = (struct tcphdr *)(ip6 + 1);
    781 			ip6->ip6_nxt = IPPROTO_TCP;
    782 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
    783 			ip6->ip6_nxt = IPPROTO_TCP;
    784 			break;
    785 #endif
    786 #if 0
    787 		default:
    788 			/* noone will visit here */
    789 			m_freem(m);
    790 			return EAFNOSUPPORT;
    791 #endif
    792 		}
    793 		xchg(th->th_dport, th->th_sport, u_int16_t);
    794 #undef xchg
    795 		tlen = 0;	/*be friendly with the following code*/
    796 	}
    797 	th->th_seq = htonl(seq);
    798 	th->th_ack = htonl(ack);
    799 	th->th_x2 = 0;
    800 	if ((flags & TH_SYN) == 0) {
    801 		if (tp)
    802 			win >>= tp->rcv_scale;
    803 		if (win > TCP_MAXWIN)
    804 			win = TCP_MAXWIN;
    805 		th->th_win = htons((u_int16_t)win);
    806 		th->th_off = sizeof (struct tcphdr) >> 2;
    807 		tlen += sizeof(*th);
    808 	} else
    809 		tlen += th->th_off << 2;
    810 	m->m_len = hlen + tlen;
    811 	m->m_pkthdr.len = hlen + tlen;
    812 	m->m_pkthdr.rcvif = (struct ifnet *) 0;
    813 	th->th_flags = flags;
    814 	th->th_urp = 0;
    815 
    816 	switch (family) {
    817 #ifdef INET
    818 	case AF_INET:
    819 	    {
    820 		struct ipovly *ipov = (struct ipovly *)ip;
    821 		bzero(ipov->ih_x1, sizeof ipov->ih_x1);
    822 		ipov->ih_len = htons((u_int16_t)tlen);
    823 
    824 		th->th_sum = 0;
    825 		th->th_sum = in_cksum(m, hlen + tlen);
    826 		ip->ip_len = htons(hlen + tlen);
    827 		ip->ip_ttl = ip_defttl;
    828 		break;
    829 	    }
    830 #endif
    831 #ifdef INET6
    832 	case AF_INET6:
    833 	    {
    834 		th->th_sum = 0;
    835 		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
    836 				tlen);
    837 		ip6->ip6_plen = htons(tlen);
    838 		if (tp && tp->t_in6pcb) {
    839 			struct ifnet *oifp;
    840 			ro = &tp->t_in6pcb->in6p_route;
    841 			oifp = (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
    842 			                                           : NULL;
    843 			ip6->ip6_hlim = in6_selecthlim(tp->t_in6pcb, oifp);
    844 		} else
    845 			ip6->ip6_hlim = ip6_defhlim;
    846 		ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
    847 		if (ip6_auto_flowlabel) {
    848 			ip6->ip6_flow |=
    849 			    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
    850 		}
    851 		break;
    852 	    }
    853 #endif
    854 	}
    855 
    856 	if (tp && tp->t_inpcb)
    857 		so = tp->t_inpcb->inp_socket;
    858 #ifdef INET6
    859 	else if (tp && tp->t_in6pcb)
    860 		so = tp->t_in6pcb->in6p_socket;
    861 #endif
    862 	else
    863 		so = NULL;
    864 
    865 	if (tp != NULL && tp->t_inpcb != NULL) {
    866 		ro = &tp->t_inpcb->inp_route;
    867 #ifdef DIAGNOSTIC
    868 		if (family != AF_INET)
    869 			panic("tcp_respond: address family mismatch");
    870 		if (!in_hosteq(ip->ip_dst, tp->t_inpcb->inp_faddr)) {
    871 			panic("tcp_respond: ip_dst %x != inp_faddr %x",
    872 			    ntohl(ip->ip_dst.s_addr),
    873 			    ntohl(tp->t_inpcb->inp_faddr.s_addr));
    874 		}
    875 #endif
    876 	}
    877 #ifdef INET6
    878 	else if (tp != NULL && tp->t_in6pcb != NULL) {
    879 		ro = (struct route *)&tp->t_in6pcb->in6p_route;
    880 #ifdef DIAGNOSTIC
    881 		if (family == AF_INET) {
    882 			if (!IN6_IS_ADDR_V4MAPPED(&tp->t_in6pcb->in6p_faddr))
    883 				panic("tcp_respond: not mapped addr");
    884 			if (bcmp(&ip->ip_dst,
    885 			    &tp->t_in6pcb->in6p_faddr.s6_addr32[3],
    886 			    sizeof(ip->ip_dst)) != 0) {
    887 				panic("tcp_respond: ip_dst != in6p_faddr");
    888 			}
    889 		} else if (family == AF_INET6) {
    890 			if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
    891 			    &tp->t_in6pcb->in6p_faddr))
    892 				panic("tcp_respond: ip6_dst != in6p_faddr");
    893 		} else
    894 			panic("tcp_respond: address family mismatch");
    895 #endif
    896 	}
    897 #endif
    898 	else
    899 		ro = NULL;
    900 
    901 	switch (family) {
    902 #ifdef INET
    903 	case AF_INET:
    904 		error = ip_output(m, NULL, ro,
    905 		    (tp && tp->t_mtudisc ? IP_MTUDISC : 0),
    906 		    (struct ip_moptions *)0, so);
    907 		break;
    908 #endif
    909 #ifdef INET6
    910 	case AF_INET6:
    911 		error = ip6_output(m, NULL, ro, 0, NULL, so, NULL);
    912 		break;
    913 #endif
    914 	default:
    915 		error = EAFNOSUPPORT;
    916 		break;
    917 	}
    918 
    919 	return (error);
    920 }
    921 
    922 /*
    923  * Template TCPCB.  Rather than zeroing a new TCPCB and initializing
    924  * a bunch of members individually, we maintain this template for the
    925  * static and mostly-static components of the TCPCB, and copy it into
    926  * the new TCPCB instead.
    927  */
    928 static struct tcpcb tcpcb_template = {
    929 	.t_srtt = TCPTV_SRTTBASE,
    930 	.t_rttmin = TCPTV_MIN,
    931 
    932 	.snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT,
    933 	.snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT,
    934 	.snd_numholes = 0,
    935 
    936 	.t_partialacks = -1,
    937 	.t_bytes_acked = 0,
    938 };
    939 
    940 /*
    941  * Updates the TCPCB template whenever a parameter that would affect
    942  * the template is changed.
    943  */
    944 void
    945 tcp_tcpcb_template(void)
    946 {
    947 	struct tcpcb *tp = &tcpcb_template;
    948 	int flags;
    949 
    950 	tp->t_peermss = tcp_mssdflt;
    951 	tp->t_ourmss = tcp_mssdflt;
    952 	tp->t_segsz = tcp_mssdflt;
    953 
    954 	flags = 0;
    955 	if (tcp_do_rfc1323 && tcp_do_win_scale)
    956 		flags |= TF_REQ_SCALE;
    957 	if (tcp_do_rfc1323 && tcp_do_timestamps)
    958 		flags |= TF_REQ_TSTMP;
    959 	tp->t_flags = flags;
    960 
    961 	/*
    962 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
    963 	 * rtt estimate.  Set rttvar so that srtt + 2 * rttvar gives
    964 	 * reasonable initial retransmit time.
    965 	 */
    966 	tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ << (TCP_RTTVAR_SHIFT + 2 - 1);
    967 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
    968 	    TCPTV_MIN, TCPTV_REXMTMAX);
    969 
    970 	/* Keep Alive */
    971 	tp->t_keepinit = tcp_keepinit;
    972 	tp->t_keepidle = tcp_keepidle;
    973 	tp->t_keepintvl = tcp_keepintvl;
    974 	tp->t_keepcnt = tcp_keepcnt;
    975 	tp->t_maxidle = tp->t_keepcnt * tp->t_keepintvl;
    976 }
    977 
    978 /*
    979  * Create a new TCP control block, making an
    980  * empty reassembly queue and hooking it to the argument
    981  * protocol control block.
    982  */
    983 /* family selects inpcb, or in6pcb */
    984 struct tcpcb *
    985 tcp_newtcpcb(int family, void *aux)
    986 {
    987 #ifdef INET6
    988 	struct rtentry *rt;
    989 #endif
    990 	struct tcpcb *tp;
    991 	int i;
    992 
    993 	/* XXX Consider using a pool_cache for speed. */
    994 	tp = pool_get(&tcpcb_pool, PR_NOWAIT);	/* splsoftnet via tcp_usrreq */
    995 	if (tp == NULL)
    996 		return (NULL);
    997 	memcpy(tp, &tcpcb_template, sizeof(*tp));
    998 	TAILQ_INIT(&tp->segq);
    999 	TAILQ_INIT(&tp->timeq);
   1000 	tp->t_family = family;		/* may be overridden later on */
   1001 	TAILQ_INIT(&tp->snd_holes);
   1002 	LIST_INIT(&tp->t_sc);		/* XXX can template this */
   1003 
   1004 	/* Don't sweat this loop; hopefully the compiler will unroll it. */
   1005 	for (i = 0; i < TCPT_NTIMERS; i++) {
   1006 		callout_init(&tp->t_timer[i], CALLOUT_MPSAFE);
   1007 		TCP_TIMER_INIT(tp, i);
   1008 	}
   1009 	callout_init(&tp->t_delack_ch, CALLOUT_MPSAFE);
   1010 
   1011 	switch (family) {
   1012 	case AF_INET:
   1013 	    {
   1014 		struct inpcb *inp = (struct inpcb *)aux;
   1015 
   1016 		inp->inp_ip.ip_ttl = ip_defttl;
   1017 		inp->inp_ppcb = (void *)tp;
   1018 
   1019 		tp->t_inpcb = inp;
   1020 		tp->t_mtudisc = ip_mtudisc;
   1021 		break;
   1022 	    }
   1023 #ifdef INET6
   1024 	case AF_INET6:
   1025 	    {
   1026 		struct in6pcb *in6p = (struct in6pcb *)aux;
   1027 
   1028 		in6p->in6p_ip6.ip6_hlim = in6_selecthlim(in6p,
   1029 			(rt = rtcache_validate(&in6p->in6p_route)) != NULL
   1030 			    ? rt->rt_ifp
   1031 			    : NULL);
   1032 		in6p->in6p_ppcb = (void *)tp;
   1033 
   1034 		tp->t_in6pcb = in6p;
   1035 		/* for IPv6, always try to run path MTU discovery */
   1036 		tp->t_mtudisc = 1;
   1037 		break;
   1038 	    }
   1039 #endif /* INET6 */
   1040 	default:
   1041 		for (i = 0; i < TCPT_NTIMERS; i++)
   1042 			callout_destroy(&tp->t_timer[i]);
   1043 		callout_destroy(&tp->t_delack_ch);
   1044 		pool_put(&tcpcb_pool, tp);	/* splsoftnet via tcp_usrreq */
   1045 		return (NULL);
   1046 	}
   1047 
   1048 	/*
   1049 	 * Initialize our timebase.  When we send timestamps, we take
   1050 	 * the delta from tcp_now -- this means each connection always
   1051 	 * gets a timebase of 1, which makes it, among other things,
   1052 	 * more difficult to determine how long a system has been up,
   1053 	 * and thus how many TCP sequence increments have occurred.
   1054 	 *
   1055 	 * We start with 1, because 0 doesn't work with linux, which
   1056 	 * considers timestamp 0 in a SYN packet as a bug and disables
   1057 	 * timestamps.
   1058 	 */
   1059 	tp->ts_timebase = tcp_now - 1;
   1060 
   1061 	tcp_congctl_select(tp, tcp_congctl_global_name);
   1062 
   1063 	return (tp);
   1064 }
   1065 
   1066 /*
   1067  * Drop a TCP connection, reporting
   1068  * the specified error.  If connection is synchronized,
   1069  * then send a RST to peer.
   1070  */
   1071 struct tcpcb *
   1072 tcp_drop(struct tcpcb *tp, int errno)
   1073 {
   1074 	struct socket *so = NULL;
   1075 
   1076 #ifdef DIAGNOSTIC
   1077 	if (tp->t_inpcb && tp->t_in6pcb)
   1078 		panic("tcp_drop: both t_inpcb and t_in6pcb are set");
   1079 #endif
   1080 #ifdef INET
   1081 	if (tp->t_inpcb)
   1082 		so = tp->t_inpcb->inp_socket;
   1083 #endif
   1084 #ifdef INET6
   1085 	if (tp->t_in6pcb)
   1086 		so = tp->t_in6pcb->in6p_socket;
   1087 #endif
   1088 	if (!so)
   1089 		return NULL;
   1090 
   1091 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
   1092 		tp->t_state = TCPS_CLOSED;
   1093 		(void) tcp_output(tp);
   1094 		TCP_STATINC(TCP_STAT_DROPS);
   1095 	} else
   1096 		TCP_STATINC(TCP_STAT_CONNDROPS);
   1097 	if (errno == ETIMEDOUT && tp->t_softerror)
   1098 		errno = tp->t_softerror;
   1099 	so->so_error = errno;
   1100 	return (tcp_close(tp));
   1101 }
   1102 
   1103 /*
   1104  * Close a TCP control block:
   1105  *	discard all space held by the tcp
   1106  *	discard internet protocol block
   1107  *	wake up any sleepers
   1108  */
   1109 struct tcpcb *
   1110 tcp_close(struct tcpcb *tp)
   1111 {
   1112 	struct inpcb *inp;
   1113 #ifdef INET6
   1114 	struct in6pcb *in6p;
   1115 #endif
   1116 	struct socket *so;
   1117 #ifdef RTV_RTT
   1118 	struct rtentry *rt;
   1119 #endif
   1120 	struct route *ro;
   1121 	int j;
   1122 
   1123 	inp = tp->t_inpcb;
   1124 #ifdef INET6
   1125 	in6p = tp->t_in6pcb;
   1126 #endif
   1127 	so = NULL;
   1128 	ro = NULL;
   1129 	if (inp) {
   1130 		so = inp->inp_socket;
   1131 		ro = &inp->inp_route;
   1132 	}
   1133 #ifdef INET6
   1134 	else if (in6p) {
   1135 		so = in6p->in6p_socket;
   1136 		ro = (struct route *)&in6p->in6p_route;
   1137 	}
   1138 #endif
   1139 
   1140 #ifdef RTV_RTT
   1141 	/*
   1142 	 * If we sent enough data to get some meaningful characteristics,
   1143 	 * save them in the routing entry.  'Enough' is arbitrarily
   1144 	 * defined as the sendpipesize (default 4K) * 16.  This would
   1145 	 * give us 16 rtt samples assuming we only get one sample per
   1146 	 * window (the usual case on a long haul net).  16 samples is
   1147 	 * enough for the srtt filter to converge to within 5% of the correct
   1148 	 * value; fewer samples and we could save a very bogus rtt.
   1149 	 *
   1150 	 * Don't update the default route's characteristics and don't
   1151 	 * update anything that the user "locked".
   1152 	 */
   1153 	if (SEQ_LT(tp->iss + so->so_snd.sb_hiwat * 16, tp->snd_max) &&
   1154 	    ro && (rt = rtcache_validate(ro)) != NULL &&
   1155 	    !in_nullhost(satocsin(rt_getkey(rt))->sin_addr)) {
   1156 		u_long i = 0;
   1157 
   1158 		if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
   1159 			i = tp->t_srtt *
   1160 			    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTT_SHIFT + 2));
   1161 			if (rt->rt_rmx.rmx_rtt && i)
   1162 				/*
   1163 				 * filter this update to half the old & half
   1164 				 * the new values, converting scale.
   1165 				 * See route.h and tcp_var.h for a
   1166 				 * description of the scaling constants.
   1167 				 */
   1168 				rt->rt_rmx.rmx_rtt =
   1169 				    (rt->rt_rmx.rmx_rtt + i) / 2;
   1170 			else
   1171 				rt->rt_rmx.rmx_rtt = i;
   1172 		}
   1173 		if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
   1174 			i = tp->t_rttvar *
   1175 			    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTTVAR_SHIFT + 2));
   1176 			if (rt->rt_rmx.rmx_rttvar && i)
   1177 				rt->rt_rmx.rmx_rttvar =
   1178 				    (rt->rt_rmx.rmx_rttvar + i) / 2;
   1179 			else
   1180 				rt->rt_rmx.rmx_rttvar = i;
   1181 		}
   1182 		/*
   1183 		 * update the pipelimit (ssthresh) if it has been updated
   1184 		 * already or if a pipesize was specified & the threshhold
   1185 		 * got below half the pipesize.  I.e., wait for bad news
   1186 		 * before we start updating, then update on both good
   1187 		 * and bad news.
   1188 		 */
   1189 		if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
   1190 		    (i = tp->snd_ssthresh) && rt->rt_rmx.rmx_ssthresh) ||
   1191 		    i < (rt->rt_rmx.rmx_sendpipe / 2)) {
   1192 			/*
   1193 			 * convert the limit from user data bytes to
   1194 			 * packets then to packet data bytes.
   1195 			 */
   1196 			i = (i + tp->t_segsz / 2) / tp->t_segsz;
   1197 			if (i < 2)
   1198 				i = 2;
   1199 			i *= (u_long)(tp->t_segsz + sizeof (struct tcpiphdr));
   1200 			if (rt->rt_rmx.rmx_ssthresh)
   1201 				rt->rt_rmx.rmx_ssthresh =
   1202 				    (rt->rt_rmx.rmx_ssthresh + i) / 2;
   1203 			else
   1204 				rt->rt_rmx.rmx_ssthresh = i;
   1205 		}
   1206 	}
   1207 #endif /* RTV_RTT */
   1208 	/* free the reassembly queue, if any */
   1209 	TCP_REASS_LOCK(tp);
   1210 	(void) tcp_freeq(tp);
   1211 	TCP_REASS_UNLOCK(tp);
   1212 
   1213 	/* free the SACK holes list. */
   1214 	tcp_free_sackholes(tp);
   1215 
   1216 	tcp_congctl_release(tp);
   1217 
   1218 	tcp_canceltimers(tp);
   1219 	TCP_CLEAR_DELACK(tp);
   1220 	syn_cache_cleanup(tp);
   1221 
   1222 	if (tp->t_template) {
   1223 		m_free(tp->t_template);
   1224 		tp->t_template = NULL;
   1225 	}
   1226 	tp->t_flags |= TF_DEAD;
   1227 	for (j = 0; j < TCPT_NTIMERS; j++) {
   1228 		callout_halt(&tp->t_timer[j], softnet_lock);
   1229 		callout_destroy(&tp->t_timer[j]);
   1230 	}
   1231 	callout_halt(&tp->t_delack_ch, softnet_lock);
   1232 	callout_destroy(&tp->t_delack_ch);
   1233 	pool_put(&tcpcb_pool, tp);
   1234 
   1235 	if (inp) {
   1236 		inp->inp_ppcb = 0;
   1237 		soisdisconnected(so);
   1238 		in_pcbdetach(inp);
   1239 	}
   1240 #ifdef INET6
   1241 	else if (in6p) {
   1242 		in6p->in6p_ppcb = 0;
   1243 		soisdisconnected(so);
   1244 		in6_pcbdetach(in6p);
   1245 	}
   1246 #endif
   1247 	TCP_STATINC(TCP_STAT_CLOSED);
   1248 	return ((struct tcpcb *)0);
   1249 }
   1250 
   1251 int
   1252 tcp_freeq(struct tcpcb *tp)
   1253 {
   1254 	struct ipqent *qe;
   1255 	int rv = 0;
   1256 #ifdef TCPREASS_DEBUG
   1257 	int i = 0;
   1258 #endif
   1259 
   1260 	TCP_REASS_LOCK_CHECK(tp);
   1261 
   1262 	while ((qe = TAILQ_FIRST(&tp->segq)) != NULL) {
   1263 #ifdef TCPREASS_DEBUG
   1264 		printf("tcp_freeq[%p,%d]: %u:%u(%u) 0x%02x\n",
   1265 			tp, i++, qe->ipqe_seq, qe->ipqe_seq + qe->ipqe_len,
   1266 			qe->ipqe_len, qe->ipqe_flags & (TH_SYN|TH_FIN|TH_RST));
   1267 #endif
   1268 		TAILQ_REMOVE(&tp->segq, qe, ipqe_q);
   1269 		TAILQ_REMOVE(&tp->timeq, qe, ipqe_timeq);
   1270 		m_freem(qe->ipqe_m);
   1271 		tcpipqent_free(qe);
   1272 		rv = 1;
   1273 	}
   1274 	tp->t_segqlen = 0;
   1275 	KASSERT(TAILQ_EMPTY(&tp->timeq));
   1276 	return (rv);
   1277 }
   1278 
   1279 /*
   1280  * Protocol drain routine.  Called when memory is in short supply.
   1281  * Don't acquire softnet_lock as can be called from hardware
   1282  * interrupt handler.
   1283  */
   1284 void
   1285 tcp_drain(void)
   1286 {
   1287 	struct inpcb_hdr *inph;
   1288 	struct tcpcb *tp;
   1289 
   1290 	KERNEL_LOCK(1, NULL);
   1291 
   1292 	/*
   1293 	 * Free the sequence queue of all TCP connections.
   1294 	 */
   1295 	CIRCLEQ_FOREACH(inph, &tcbtable.inpt_queue, inph_queue) {
   1296 		switch (inph->inph_af) {
   1297 		case AF_INET:
   1298 			tp = intotcpcb((struct inpcb *)inph);
   1299 			break;
   1300 #ifdef INET6
   1301 		case AF_INET6:
   1302 			tp = in6totcpcb((struct in6pcb *)inph);
   1303 			break;
   1304 #endif
   1305 		default:
   1306 			tp = NULL;
   1307 			break;
   1308 		}
   1309 		if (tp != NULL) {
   1310 			/*
   1311 			 * We may be called from a device's interrupt
   1312 			 * context.  If the tcpcb is already busy,
   1313 			 * just bail out now.
   1314 			 */
   1315 			if (tcp_reass_lock_try(tp) == 0)
   1316 				continue;
   1317 			if (tcp_freeq(tp))
   1318 				TCP_STATINC(TCP_STAT_CONNSDRAINED);
   1319 			TCP_REASS_UNLOCK(tp);
   1320 		}
   1321 	}
   1322 
   1323 	KERNEL_UNLOCK_ONE(NULL);
   1324 }
   1325 
   1326 /*
   1327  * Notify a tcp user of an asynchronous error;
   1328  * store error as soft error, but wake up user
   1329  * (for now, won't do anything until can select for soft error).
   1330  */
   1331 void
   1332 tcp_notify(struct inpcb *inp, int error)
   1333 {
   1334 	struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
   1335 	struct socket *so = inp->inp_socket;
   1336 
   1337 	/*
   1338 	 * Ignore some errors if we are hooked up.
   1339 	 * If connection hasn't completed, has retransmitted several times,
   1340 	 * and receives a second error, give up now.  This is better
   1341 	 * than waiting a long time to establish a connection that
   1342 	 * can never complete.
   1343 	 */
   1344 	if (tp->t_state == TCPS_ESTABLISHED &&
   1345 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
   1346 	      error == EHOSTDOWN)) {
   1347 		return;
   1348 	} else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
   1349 	    tp->t_rxtshift > 3 && tp->t_softerror)
   1350 		so->so_error = error;
   1351 	else
   1352 		tp->t_softerror = error;
   1353 	cv_broadcast(&so->so_cv);
   1354 	sorwakeup(so);
   1355 	sowwakeup(so);
   1356 }
   1357 
   1358 #ifdef INET6
   1359 void
   1360 tcp6_notify(struct in6pcb *in6p, int error)
   1361 {
   1362 	struct tcpcb *tp = (struct tcpcb *)in6p->in6p_ppcb;
   1363 	struct socket *so = in6p->in6p_socket;
   1364 
   1365 	/*
   1366 	 * Ignore some errors if we are hooked up.
   1367 	 * If connection hasn't completed, has retransmitted several times,
   1368 	 * and receives a second error, give up now.  This is better
   1369 	 * than waiting a long time to establish a connection that
   1370 	 * can never complete.
   1371 	 */
   1372 	if (tp->t_state == TCPS_ESTABLISHED &&
   1373 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
   1374 	      error == EHOSTDOWN)) {
   1375 		return;
   1376 	} else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
   1377 	    tp->t_rxtshift > 3 && tp->t_softerror)
   1378 		so->so_error = error;
   1379 	else
   1380 		tp->t_softerror = error;
   1381 	cv_broadcast(&so->so_cv);
   1382 	sorwakeup(so);
   1383 	sowwakeup(so);
   1384 }
   1385 #endif
   1386 
   1387 #ifdef INET6
   1388 void *
   1389 tcp6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
   1390 {
   1391 	struct tcphdr th;
   1392 	void (*notify)(struct in6pcb *, int) = tcp6_notify;
   1393 	int nmatch;
   1394 	struct ip6_hdr *ip6;
   1395 	const struct sockaddr_in6 *sa6_src = NULL;
   1396 	const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
   1397 	struct mbuf *m;
   1398 	int off;
   1399 
   1400 	if (sa->sa_family != AF_INET6 ||
   1401 	    sa->sa_len != sizeof(struct sockaddr_in6))
   1402 		return NULL;
   1403 	if ((unsigned)cmd >= PRC_NCMDS)
   1404 		return NULL;
   1405 	else if (cmd == PRC_QUENCH) {
   1406 		/*
   1407 		 * Don't honor ICMP Source Quench messages meant for
   1408 		 * TCP connections.
   1409 		 */
   1410 		return NULL;
   1411 	} else if (PRC_IS_REDIRECT(cmd))
   1412 		notify = in6_rtchange, d = NULL;
   1413 	else if (cmd == PRC_MSGSIZE)
   1414 		; /* special code is present, see below */
   1415 	else if (cmd == PRC_HOSTDEAD)
   1416 		d = NULL;
   1417 	else if (inet6ctlerrmap[cmd] == 0)
   1418 		return NULL;
   1419 
   1420 	/* if the parameter is from icmp6, decode it. */
   1421 	if (d != NULL) {
   1422 		struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
   1423 		m = ip6cp->ip6c_m;
   1424 		ip6 = ip6cp->ip6c_ip6;
   1425 		off = ip6cp->ip6c_off;
   1426 		sa6_src = ip6cp->ip6c_src;
   1427 	} else {
   1428 		m = NULL;
   1429 		ip6 = NULL;
   1430 		sa6_src = &sa6_any;
   1431 		off = 0;
   1432 	}
   1433 
   1434 	if (ip6) {
   1435 		/*
   1436 		 * XXX: We assume that when ip6 is non NULL,
   1437 		 * M and OFF are valid.
   1438 		 */
   1439 
   1440 		/* check if we can safely examine src and dst ports */
   1441 		if (m->m_pkthdr.len < off + sizeof(th)) {
   1442 			if (cmd == PRC_MSGSIZE)
   1443 				icmp6_mtudisc_update((struct ip6ctlparam *)d, 0);
   1444 			return NULL;
   1445 		}
   1446 
   1447 		bzero(&th, sizeof(th));
   1448 		m_copydata(m, off, sizeof(th), (void *)&th);
   1449 
   1450 		if (cmd == PRC_MSGSIZE) {
   1451 			int valid = 0;
   1452 
   1453 			/*
   1454 			 * Check to see if we have a valid TCP connection
   1455 			 * corresponding to the address in the ICMPv6 message
   1456 			 * payload.
   1457 			 */
   1458 			if (in6_pcblookup_connect(&tcbtable, &sa6->sin6_addr,
   1459 			    th.th_dport,
   1460 			    (const struct in6_addr *)&sa6_src->sin6_addr,
   1461 			    th.th_sport, 0))
   1462 				valid++;
   1463 
   1464 			/*
   1465 			 * Depending on the value of "valid" and routing table
   1466 			 * size (mtudisc_{hi,lo}wat), we will:
   1467 			 * - recalcurate the new MTU and create the
   1468 			 *   corresponding routing entry, or
   1469 			 * - ignore the MTU change notification.
   1470 			 */
   1471 			icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
   1472 
   1473 			/*
   1474 			 * no need to call in6_pcbnotify, it should have been
   1475 			 * called via callback if necessary
   1476 			 */
   1477 			return NULL;
   1478 		}
   1479 
   1480 		nmatch = in6_pcbnotify(&tcbtable, sa, th.th_dport,
   1481 		    (const struct sockaddr *)sa6_src, th.th_sport, cmd, NULL, notify);
   1482 		if (nmatch == 0 && syn_cache_count &&
   1483 		    (inet6ctlerrmap[cmd] == EHOSTUNREACH ||
   1484 		     inet6ctlerrmap[cmd] == ENETUNREACH ||
   1485 		     inet6ctlerrmap[cmd] == EHOSTDOWN))
   1486 			syn_cache_unreach((const struct sockaddr *)sa6_src,
   1487 					  sa, &th);
   1488 	} else {
   1489 		(void) in6_pcbnotify(&tcbtable, sa, 0,
   1490 		    (const struct sockaddr *)sa6_src, 0, cmd, NULL, notify);
   1491 	}
   1492 
   1493 	return NULL;
   1494 }
   1495 #endif
   1496 
   1497 #ifdef INET
   1498 /* assumes that ip header and tcp header are contiguous on mbuf */
   1499 void *
   1500 tcp_ctlinput(int cmd, const struct sockaddr *sa, void *v)
   1501 {
   1502 	struct ip *ip = v;
   1503 	struct tcphdr *th;
   1504 	struct icmp *icp;
   1505 	extern const int inetctlerrmap[];
   1506 	void (*notify)(struct inpcb *, int) = tcp_notify;
   1507 	int errno;
   1508 	int nmatch;
   1509 	struct tcpcb *tp;
   1510 	u_int mtu;
   1511 	tcp_seq seq;
   1512 	struct inpcb *inp;
   1513 #ifdef INET6
   1514 	struct in6pcb *in6p;
   1515 	struct in6_addr src6, dst6;
   1516 #endif
   1517 
   1518 	if (sa->sa_family != AF_INET ||
   1519 	    sa->sa_len != sizeof(struct sockaddr_in))
   1520 		return NULL;
   1521 	if ((unsigned)cmd >= PRC_NCMDS)
   1522 		return NULL;
   1523 	errno = inetctlerrmap[cmd];
   1524 	if (cmd == PRC_QUENCH)
   1525 		/*
   1526 		 * Don't honor ICMP Source Quench messages meant for
   1527 		 * TCP connections.
   1528 		 */
   1529 		return NULL;
   1530 	else if (PRC_IS_REDIRECT(cmd))
   1531 		notify = in_rtchange, ip = 0;
   1532 	else if (cmd == PRC_MSGSIZE && ip && ip->ip_v == 4) {
   1533 		/*
   1534 		 * Check to see if we have a valid TCP connection
   1535 		 * corresponding to the address in the ICMP message
   1536 		 * payload.
   1537 		 *
   1538 		 * Boundary check is made in icmp_input(), with ICMP_ADVLENMIN.
   1539 		 */
   1540 		th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2));
   1541 #ifdef INET6
   1542 		memset(&src6, 0, sizeof(src6));
   1543 		memset(&dst6, 0, sizeof(dst6));
   1544 		src6.s6_addr16[5] = dst6.s6_addr16[5] = 0xffff;
   1545 		memcpy(&src6.s6_addr32[3], &ip->ip_src, sizeof(struct in_addr));
   1546 		memcpy(&dst6.s6_addr32[3], &ip->ip_dst, sizeof(struct in_addr));
   1547 #endif
   1548 		if ((inp = in_pcblookup_connect(&tcbtable, ip->ip_dst,
   1549 		    th->th_dport, ip->ip_src, th->th_sport)) != NULL)
   1550 #ifdef INET6
   1551 			in6p = NULL;
   1552 #else
   1553 			;
   1554 #endif
   1555 #ifdef INET6
   1556 		else if ((in6p = in6_pcblookup_connect(&tcbtable, &dst6,
   1557 		    th->th_dport, &src6, th->th_sport, 0)) != NULL)
   1558 			;
   1559 #endif
   1560 		else
   1561 			return NULL;
   1562 
   1563 		/*
   1564 		 * Now that we've validated that we are actually communicating
   1565 		 * with the host indicated in the ICMP message, locate the
   1566 		 * ICMP header, recalculate the new MTU, and create the
   1567 		 * corresponding routing entry.
   1568 		 */
   1569 		icp = (struct icmp *)((char *)ip -
   1570 		    offsetof(struct icmp, icmp_ip));
   1571 		if (inp) {
   1572 			if ((tp = intotcpcb(inp)) == NULL)
   1573 				return NULL;
   1574 		}
   1575 #ifdef INET6
   1576 		else if (in6p) {
   1577 			if ((tp = in6totcpcb(in6p)) == NULL)
   1578 				return NULL;
   1579 		}
   1580 #endif
   1581 		else
   1582 			return NULL;
   1583 		seq = ntohl(th->th_seq);
   1584 		if (SEQ_LT(seq, tp->snd_una) || SEQ_GT(seq, tp->snd_max))
   1585 			return NULL;
   1586 		/*
   1587 		 * If the ICMP message advertises a Next-Hop MTU
   1588 		 * equal or larger than the maximum packet size we have
   1589 		 * ever sent, drop the message.
   1590 		 */
   1591 		mtu = (u_int)ntohs(icp->icmp_nextmtu);
   1592 		if (mtu >= tp->t_pmtud_mtu_sent)
   1593 			return NULL;
   1594 		if (mtu >= tcp_hdrsz(tp) + tp->t_pmtud_mss_acked) {
   1595 			/*
   1596 			 * Calculate new MTU, and create corresponding
   1597 			 * route (traditional PMTUD).
   1598 			 */
   1599 			tp->t_flags &= ~TF_PMTUD_PEND;
   1600 			icmp_mtudisc(icp, ip->ip_dst);
   1601 		} else {
   1602 			/*
   1603 			 * Record the information got in the ICMP
   1604 			 * message; act on it later.
   1605 			 * If we had already recorded an ICMP message,
   1606 			 * replace the old one only if the new message
   1607 			 * refers to an older TCP segment
   1608 			 */
   1609 			if (tp->t_flags & TF_PMTUD_PEND) {
   1610 				if (SEQ_LT(tp->t_pmtud_th_seq, seq))
   1611 					return NULL;
   1612 			} else
   1613 				tp->t_flags |= TF_PMTUD_PEND;
   1614 			tp->t_pmtud_th_seq = seq;
   1615 			tp->t_pmtud_nextmtu = icp->icmp_nextmtu;
   1616 			tp->t_pmtud_ip_len = icp->icmp_ip.ip_len;
   1617 			tp->t_pmtud_ip_hl = icp->icmp_ip.ip_hl;
   1618 		}
   1619 		return NULL;
   1620 	} else if (cmd == PRC_HOSTDEAD)
   1621 		ip = 0;
   1622 	else if (errno == 0)
   1623 		return NULL;
   1624 	if (ip && ip->ip_v == 4 && sa->sa_family == AF_INET) {
   1625 		th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2));
   1626 		nmatch = in_pcbnotify(&tcbtable, satocsin(sa)->sin_addr,
   1627 		    th->th_dport, ip->ip_src, th->th_sport, errno, notify);
   1628 		if (nmatch == 0 && syn_cache_count &&
   1629 		    (inetctlerrmap[cmd] == EHOSTUNREACH ||
   1630 		    inetctlerrmap[cmd] == ENETUNREACH ||
   1631 		    inetctlerrmap[cmd] == EHOSTDOWN)) {
   1632 			struct sockaddr_in sin;
   1633 			bzero(&sin, sizeof(sin));
   1634 			sin.sin_len = sizeof(sin);
   1635 			sin.sin_family = AF_INET;
   1636 			sin.sin_port = th->th_sport;
   1637 			sin.sin_addr = ip->ip_src;
   1638 			syn_cache_unreach((struct sockaddr *)&sin, sa, th);
   1639 		}
   1640 
   1641 		/* XXX mapped address case */
   1642 	} else
   1643 		in_pcbnotifyall(&tcbtable, satocsin(sa)->sin_addr, errno,
   1644 		    notify);
   1645 	return NULL;
   1646 }
   1647 
   1648 /*
   1649  * When a source quench is received, we are being notified of congestion.
   1650  * Close the congestion window down to the Loss Window (one segment).
   1651  * We will gradually open it again as we proceed.
   1652  */
   1653 void
   1654 tcp_quench(struct inpcb *inp, int errno)
   1655 {
   1656 	struct tcpcb *tp = intotcpcb(inp);
   1657 
   1658 	if (tp) {
   1659 		tp->snd_cwnd = tp->t_segsz;
   1660 		tp->t_bytes_acked = 0;
   1661 	}
   1662 }
   1663 #endif
   1664 
   1665 #ifdef INET6
   1666 void
   1667 tcp6_quench(struct in6pcb *in6p, int errno)
   1668 {
   1669 	struct tcpcb *tp = in6totcpcb(in6p);
   1670 
   1671 	if (tp) {
   1672 		tp->snd_cwnd = tp->t_segsz;
   1673 		tp->t_bytes_acked = 0;
   1674 	}
   1675 }
   1676 #endif
   1677 
   1678 #ifdef INET
   1679 /*
   1680  * Path MTU Discovery handlers.
   1681  */
   1682 void
   1683 tcp_mtudisc_callback(struct in_addr faddr)
   1684 {
   1685 #ifdef INET6
   1686 	struct in6_addr in6;
   1687 #endif
   1688 
   1689 	in_pcbnotifyall(&tcbtable, faddr, EMSGSIZE, tcp_mtudisc);
   1690 #ifdef INET6
   1691 	memset(&in6, 0, sizeof(in6));
   1692 	in6.s6_addr16[5] = 0xffff;
   1693 	memcpy(&in6.s6_addr32[3], &faddr, sizeof(struct in_addr));
   1694 	tcp6_mtudisc_callback(&in6);
   1695 #endif
   1696 }
   1697 
   1698 /*
   1699  * On receipt of path MTU corrections, flush old route and replace it
   1700  * with the new one.  Retransmit all unacknowledged packets, to ensure
   1701  * that all packets will be received.
   1702  */
   1703 void
   1704 tcp_mtudisc(struct inpcb *inp, int errno)
   1705 {
   1706 	struct tcpcb *tp = intotcpcb(inp);
   1707 	struct rtentry *rt = in_pcbrtentry(inp);
   1708 
   1709 	if (tp != 0) {
   1710 		if (rt != 0) {
   1711 			/*
   1712 			 * If this was not a host route, remove and realloc.
   1713 			 */
   1714 			if ((rt->rt_flags & RTF_HOST) == 0) {
   1715 				in_rtchange(inp, errno);
   1716 				if ((rt = in_pcbrtentry(inp)) == 0)
   1717 					return;
   1718 			}
   1719 
   1720 			/*
   1721 			 * Slow start out of the error condition.  We
   1722 			 * use the MTU because we know it's smaller
   1723 			 * than the previously transmitted segment.
   1724 			 *
   1725 			 * Note: This is more conservative than the
   1726 			 * suggestion in draft-floyd-incr-init-win-03.
   1727 			 */
   1728 			if (rt->rt_rmx.rmx_mtu != 0)
   1729 				tp->snd_cwnd =
   1730 				    TCP_INITIAL_WINDOW(tcp_init_win,
   1731 				    rt->rt_rmx.rmx_mtu);
   1732 		}
   1733 
   1734 		/*
   1735 		 * Resend unacknowledged packets.
   1736 		 */
   1737 		tp->snd_nxt = tp->sack_newdata = tp->snd_una;
   1738 		tcp_output(tp);
   1739 	}
   1740 }
   1741 #endif
   1742 
   1743 #ifdef INET6
   1744 /*
   1745  * Path MTU Discovery handlers.
   1746  */
   1747 void
   1748 tcp6_mtudisc_callback(struct in6_addr *faddr)
   1749 {
   1750 	struct sockaddr_in6 sin6;
   1751 
   1752 	bzero(&sin6, sizeof(sin6));
   1753 	sin6.sin6_family = AF_INET6;
   1754 	sin6.sin6_len = sizeof(struct sockaddr_in6);
   1755 	sin6.sin6_addr = *faddr;
   1756 	(void) in6_pcbnotify(&tcbtable, (struct sockaddr *)&sin6, 0,
   1757 	    (const struct sockaddr *)&sa6_any, 0, PRC_MSGSIZE, NULL, tcp6_mtudisc);
   1758 }
   1759 
   1760 void
   1761 tcp6_mtudisc(struct in6pcb *in6p, int errno)
   1762 {
   1763 	struct tcpcb *tp = in6totcpcb(in6p);
   1764 	struct rtentry *rt = in6_pcbrtentry(in6p);
   1765 
   1766 	if (tp != 0) {
   1767 		if (rt != 0) {
   1768 			/*
   1769 			 * If this was not a host route, remove and realloc.
   1770 			 */
   1771 			if ((rt->rt_flags & RTF_HOST) == 0) {
   1772 				in6_rtchange(in6p, errno);
   1773 				if ((rt = in6_pcbrtentry(in6p)) == 0)
   1774 					return;
   1775 			}
   1776 
   1777 			/*
   1778 			 * Slow start out of the error condition.  We
   1779 			 * use the MTU because we know it's smaller
   1780 			 * than the previously transmitted segment.
   1781 			 *
   1782 			 * Note: This is more conservative than the
   1783 			 * suggestion in draft-floyd-incr-init-win-03.
   1784 			 */
   1785 			if (rt->rt_rmx.rmx_mtu != 0)
   1786 				tp->snd_cwnd =
   1787 				    TCP_INITIAL_WINDOW(tcp_init_win,
   1788 				    rt->rt_rmx.rmx_mtu);
   1789 		}
   1790 
   1791 		/*
   1792 		 * Resend unacknowledged packets.
   1793 		 */
   1794 		tp->snd_nxt = tp->sack_newdata = tp->snd_una;
   1795 		tcp_output(tp);
   1796 	}
   1797 }
   1798 #endif /* INET6 */
   1799 
   1800 /*
   1801  * Compute the MSS to advertise to the peer.  Called only during
   1802  * the 3-way handshake.  If we are the server (peer initiated
   1803  * connection), we are called with a pointer to the interface
   1804  * on which the SYN packet arrived.  If we are the client (we
   1805  * initiated connection), we are called with a pointer to the
   1806  * interface out which this connection should go.
   1807  *
   1808  * NOTE: Do not subtract IP option/extension header size nor IPsec
   1809  * header size from MSS advertisement.  MSS option must hold the maximum
   1810  * segment size we can accept, so it must always be:
   1811  *	 max(if mtu) - ip header - tcp header
   1812  */
   1813 u_long
   1814 tcp_mss_to_advertise(const struct ifnet *ifp, int af)
   1815 {
   1816 	extern u_long in_maxmtu;
   1817 	u_long mss = 0;
   1818 	u_long hdrsiz;
   1819 
   1820 	/*
   1821 	 * In order to avoid defeating path MTU discovery on the peer,
   1822 	 * we advertise the max MTU of all attached networks as our MSS,
   1823 	 * per RFC 1191, section 3.1.
   1824 	 *
   1825 	 * We provide the option to advertise just the MTU of
   1826 	 * the interface on which we hope this connection will
   1827 	 * be receiving.  If we are responding to a SYN, we
   1828 	 * will have a pretty good idea about this, but when
   1829 	 * initiating a connection there is a bit more doubt.
   1830 	 *
   1831 	 * We also need to ensure that loopback has a large enough
   1832 	 * MSS, as the loopback MTU is never included in in_maxmtu.
   1833 	 */
   1834 
   1835 	if (ifp != NULL)
   1836 		switch (af) {
   1837 		case AF_INET:
   1838 			mss = ifp->if_mtu;
   1839 			break;
   1840 #ifdef INET6
   1841 		case AF_INET6:
   1842 			mss = IN6_LINKMTU(ifp);
   1843 			break;
   1844 #endif
   1845 		}
   1846 
   1847 	if (tcp_mss_ifmtu == 0)
   1848 		switch (af) {
   1849 		case AF_INET:
   1850 			mss = max(in_maxmtu, mss);
   1851 			break;
   1852 #ifdef INET6
   1853 		case AF_INET6:
   1854 			mss = max(in6_maxmtu, mss);
   1855 			break;
   1856 #endif
   1857 		}
   1858 
   1859 	switch (af) {
   1860 	case AF_INET:
   1861 		hdrsiz = sizeof(struct ip);
   1862 		break;
   1863 #ifdef INET6
   1864 	case AF_INET6:
   1865 		hdrsiz = sizeof(struct ip6_hdr);
   1866 		break;
   1867 #endif
   1868 	default:
   1869 		hdrsiz = 0;
   1870 		break;
   1871 	}
   1872 	hdrsiz += sizeof(struct tcphdr);
   1873 	if (mss > hdrsiz)
   1874 		mss -= hdrsiz;
   1875 
   1876 	mss = max(tcp_mssdflt, mss);
   1877 	return (mss);
   1878 }
   1879 
   1880 /*
   1881  * Set connection variables based on the peer's advertised MSS.
   1882  * We are passed the TCPCB for the actual connection.  If we
   1883  * are the server, we are called by the compressed state engine
   1884  * when the 3-way handshake is complete.  If we are the client,
   1885  * we are called when we receive the SYN,ACK from the server.
   1886  *
   1887  * NOTE: Our advertised MSS value must be initialized in the TCPCB
   1888  * before this routine is called!
   1889  */
   1890 void
   1891 tcp_mss_from_peer(struct tcpcb *tp, int offer)
   1892 {
   1893 	struct socket *so;
   1894 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1895 	struct rtentry *rt;
   1896 #endif
   1897 	u_long bufsize;
   1898 	int mss;
   1899 
   1900 #ifdef DIAGNOSTIC
   1901 	if (tp->t_inpcb && tp->t_in6pcb)
   1902 		panic("tcp_mss_from_peer: both t_inpcb and t_in6pcb are set");
   1903 #endif
   1904 	so = NULL;
   1905 	rt = NULL;
   1906 #ifdef INET
   1907 	if (tp->t_inpcb) {
   1908 		so = tp->t_inpcb->inp_socket;
   1909 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1910 		rt = in_pcbrtentry(tp->t_inpcb);
   1911 #endif
   1912 	}
   1913 #endif
   1914 #ifdef INET6
   1915 	if (tp->t_in6pcb) {
   1916 		so = tp->t_in6pcb->in6p_socket;
   1917 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1918 		rt = in6_pcbrtentry(tp->t_in6pcb);
   1919 #endif
   1920 	}
   1921 #endif
   1922 
   1923 	/*
   1924 	 * As per RFC1122, use the default MSS value, unless they
   1925 	 * sent us an offer.  Do not accept offers less than 256 bytes.
   1926 	 */
   1927 	mss = tcp_mssdflt;
   1928 	if (offer)
   1929 		mss = offer;
   1930 	mss = max(mss, 256);		/* sanity */
   1931 	tp->t_peermss = mss;
   1932 	mss -= tcp_optlen(tp);
   1933 #ifdef INET
   1934 	if (tp->t_inpcb)
   1935 		mss -= ip_optlen(tp->t_inpcb);
   1936 #endif
   1937 #ifdef INET6
   1938 	if (tp->t_in6pcb)
   1939 		mss -= ip6_optlen(tp->t_in6pcb);
   1940 #endif
   1941 
   1942 	/*
   1943 	 * If there's a pipesize, change the socket buffer to that size.
   1944 	 * Make the socket buffer an integral number of MSS units.  If
   1945 	 * the MSS is larger than the socket buffer, artificially decrease
   1946 	 * the MSS.
   1947 	 */
   1948 #ifdef RTV_SPIPE
   1949 	if (rt != NULL && rt->rt_rmx.rmx_sendpipe != 0)
   1950 		bufsize = rt->rt_rmx.rmx_sendpipe;
   1951 	else
   1952 #endif
   1953 	{
   1954 		KASSERT(so != NULL);
   1955 		bufsize = so->so_snd.sb_hiwat;
   1956 	}
   1957 	if (bufsize < mss)
   1958 		mss = bufsize;
   1959 	else {
   1960 		bufsize = roundup(bufsize, mss);
   1961 		if (bufsize > sb_max)
   1962 			bufsize = sb_max;
   1963 		(void) sbreserve(&so->so_snd, bufsize, so);
   1964 	}
   1965 	tp->t_segsz = mss;
   1966 
   1967 #ifdef RTV_SSTHRESH
   1968 	if (rt != NULL && rt->rt_rmx.rmx_ssthresh) {
   1969 		/*
   1970 		 * There's some sort of gateway or interface buffer
   1971 		 * limit on the path.  Use this to set the slow
   1972 		 * start threshold, but set the threshold to no less
   1973 		 * than 2 * MSS.
   1974 		 */
   1975 		tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
   1976 	}
   1977 #endif
   1978 }
   1979 
   1980 /*
   1981  * Processing necessary when a TCP connection is established.
   1982  */
   1983 void
   1984 tcp_established(struct tcpcb *tp)
   1985 {
   1986 	struct socket *so;
   1987 #ifdef RTV_RPIPE
   1988 	struct rtentry *rt;
   1989 #endif
   1990 	u_long bufsize;
   1991 
   1992 #ifdef DIAGNOSTIC
   1993 	if (tp->t_inpcb && tp->t_in6pcb)
   1994 		panic("tcp_established: both t_inpcb and t_in6pcb are set");
   1995 #endif
   1996 	so = NULL;
   1997 	rt = NULL;
   1998 #ifdef INET
   1999 	if (tp->t_inpcb) {
   2000 		so = tp->t_inpcb->inp_socket;
   2001 #if defined(RTV_RPIPE)
   2002 		rt = in_pcbrtentry(tp->t_inpcb);
   2003 #endif
   2004 	}
   2005 #endif
   2006 #ifdef INET6
   2007 	if (tp->t_in6pcb) {
   2008 		so = tp->t_in6pcb->in6p_socket;
   2009 #if defined(RTV_RPIPE)
   2010 		rt = in6_pcbrtentry(tp->t_in6pcb);
   2011 #endif
   2012 	}
   2013 #endif
   2014 
   2015 	tp->t_state = TCPS_ESTABLISHED;
   2016 	TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
   2017 
   2018 #ifdef RTV_RPIPE
   2019 	if (rt != NULL && rt->rt_rmx.rmx_recvpipe != 0)
   2020 		bufsize = rt->rt_rmx.rmx_recvpipe;
   2021 	else
   2022 #endif
   2023 	{
   2024 		KASSERT(so != NULL);
   2025 		bufsize = so->so_rcv.sb_hiwat;
   2026 	}
   2027 	if (bufsize > tp->t_ourmss) {
   2028 		bufsize = roundup(bufsize, tp->t_ourmss);
   2029 		if (bufsize > sb_max)
   2030 			bufsize = sb_max;
   2031 		(void) sbreserve(&so->so_rcv, bufsize, so);
   2032 	}
   2033 }
   2034 
   2035 /*
   2036  * Check if there's an initial rtt or rttvar.  Convert from the
   2037  * route-table units to scaled multiples of the slow timeout timer.
   2038  * Called only during the 3-way handshake.
   2039  */
   2040 void
   2041 tcp_rmx_rtt(struct tcpcb *tp)
   2042 {
   2043 #ifdef RTV_RTT
   2044 	struct rtentry *rt = NULL;
   2045 	int rtt;
   2046 
   2047 #ifdef DIAGNOSTIC
   2048 	if (tp->t_inpcb && tp->t_in6pcb)
   2049 		panic("tcp_rmx_rtt: both t_inpcb and t_in6pcb are set");
   2050 #endif
   2051 #ifdef INET
   2052 	if (tp->t_inpcb)
   2053 		rt = in_pcbrtentry(tp->t_inpcb);
   2054 #endif
   2055 #ifdef INET6
   2056 	if (tp->t_in6pcb)
   2057 		rt = in6_pcbrtentry(tp->t_in6pcb);
   2058 #endif
   2059 	if (rt == NULL)
   2060 		return;
   2061 
   2062 	if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
   2063 		/*
   2064 		 * XXX The lock bit for MTU indicates that the value
   2065 		 * is also a minimum value; this is subject to time.
   2066 		 */
   2067 		if (rt->rt_rmx.rmx_locks & RTV_RTT)
   2068 			TCPT_RANGESET(tp->t_rttmin,
   2069 			    rtt / (RTM_RTTUNIT / PR_SLOWHZ),
   2070 			    TCPTV_MIN, TCPTV_REXMTMAX);
   2071 		tp->t_srtt = rtt /
   2072 		    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTT_SHIFT + 2));
   2073 		if (rt->rt_rmx.rmx_rttvar) {
   2074 			tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
   2075 			    ((RTM_RTTUNIT / PR_SLOWHZ) >>
   2076 				(TCP_RTTVAR_SHIFT + 2));
   2077 		} else {
   2078 			/* Default variation is +- 1 rtt */
   2079 			tp->t_rttvar =
   2080 			    tp->t_srtt >> (TCP_RTT_SHIFT - TCP_RTTVAR_SHIFT);
   2081 		}
   2082 		TCPT_RANGESET(tp->t_rxtcur,
   2083 		    ((tp->t_srtt >> 2) + tp->t_rttvar) >> (1 + 2),
   2084 		    tp->t_rttmin, TCPTV_REXMTMAX);
   2085 	}
   2086 #endif
   2087 }
   2088 
   2089 tcp_seq	 tcp_iss_seq = 0;	/* tcp initial seq # */
   2090 #if NRND > 0
   2091 u_int8_t tcp_iss_secret[16];	/* 128 bits; should be plenty */
   2092 #endif
   2093 
   2094 /*
   2095  * Get a new sequence value given a tcp control block
   2096  */
   2097 tcp_seq
   2098 tcp_new_iss(struct tcpcb *tp, tcp_seq addin)
   2099 {
   2100 
   2101 #ifdef INET
   2102 	if (tp->t_inpcb != NULL) {
   2103 		return (tcp_new_iss1(&tp->t_inpcb->inp_laddr,
   2104 		    &tp->t_inpcb->inp_faddr, tp->t_inpcb->inp_lport,
   2105 		    tp->t_inpcb->inp_fport, sizeof(tp->t_inpcb->inp_laddr),
   2106 		    addin));
   2107 	}
   2108 #endif
   2109 #ifdef INET6
   2110 	if (tp->t_in6pcb != NULL) {
   2111 		return (tcp_new_iss1(&tp->t_in6pcb->in6p_laddr,
   2112 		    &tp->t_in6pcb->in6p_faddr, tp->t_in6pcb->in6p_lport,
   2113 		    tp->t_in6pcb->in6p_fport, sizeof(tp->t_in6pcb->in6p_laddr),
   2114 		    addin));
   2115 	}
   2116 #endif
   2117 	/* Not possible. */
   2118 	panic("tcp_new_iss");
   2119 }
   2120 
   2121 /*
   2122  * This routine actually generates a new TCP initial sequence number.
   2123  */
   2124 tcp_seq
   2125 tcp_new_iss1(void *laddr, void *faddr, u_int16_t lport, u_int16_t fport,
   2126     size_t addrsz, tcp_seq addin)
   2127 {
   2128 	tcp_seq tcp_iss;
   2129 
   2130 #if NRND > 0
   2131 	static bool tcp_iss_gotten_secret;
   2132 
   2133 	/*
   2134 	 * If we haven't been here before, initialize our cryptographic
   2135 	 * hash secret.
   2136 	 */
   2137 	if (tcp_iss_gotten_secret == false) {
   2138 		rnd_extract_data(tcp_iss_secret, sizeof(tcp_iss_secret),
   2139 		    RND_EXTRACT_ANY);
   2140 		tcp_iss_gotten_secret = true;
   2141 	}
   2142 
   2143 	if (tcp_do_rfc1948) {
   2144 		MD5_CTX ctx;
   2145 		u_int8_t hash[16];	/* XXX MD5 knowledge */
   2146 
   2147 		/*
   2148 		 * Compute the base value of the ISS.  It is a hash
   2149 		 * of (saddr, sport, daddr, dport, secret).
   2150 		 */
   2151 		MD5Init(&ctx);
   2152 
   2153 		MD5Update(&ctx, (u_char *) laddr, addrsz);
   2154 		MD5Update(&ctx, (u_char *) &lport, sizeof(lport));
   2155 
   2156 		MD5Update(&ctx, (u_char *) faddr, addrsz);
   2157 		MD5Update(&ctx, (u_char *) &fport, sizeof(fport));
   2158 
   2159 		MD5Update(&ctx, tcp_iss_secret, sizeof(tcp_iss_secret));
   2160 
   2161 		MD5Final(hash, &ctx);
   2162 
   2163 		memcpy(&tcp_iss, hash, sizeof(tcp_iss));
   2164 
   2165 		/*
   2166 		 * Now increment our "timer", and add it in to
   2167 		 * the computed value.
   2168 		 *
   2169 		 * XXX Use `addin'?
   2170 		 * XXX TCP_ISSINCR too large to use?
   2171 		 */
   2172 		tcp_iss_seq += TCP_ISSINCR;
   2173 #ifdef TCPISS_DEBUG
   2174 		printf("ISS hash 0x%08x, ", tcp_iss);
   2175 #endif
   2176 		tcp_iss += tcp_iss_seq + addin;
   2177 #ifdef TCPISS_DEBUG
   2178 		printf("new ISS 0x%08x\n", tcp_iss);
   2179 #endif
   2180 	} else
   2181 #endif /* NRND > 0 */
   2182 	{
   2183 		/*
   2184 		 * Randomize.
   2185 		 */
   2186 #if NRND > 0
   2187 		rnd_extract_data(&tcp_iss, sizeof(tcp_iss), RND_EXTRACT_ANY);
   2188 #else
   2189 		tcp_iss = arc4random();
   2190 #endif
   2191 
   2192 		/*
   2193 		 * If we were asked to add some amount to a known value,
   2194 		 * we will take a random value obtained above, mask off
   2195 		 * the upper bits, and add in the known value.  We also
   2196 		 * add in a constant to ensure that we are at least a
   2197 		 * certain distance from the original value.
   2198 		 *
   2199 		 * This is used when an old connection is in timed wait
   2200 		 * and we have a new one coming in, for instance.
   2201 		 */
   2202 		if (addin != 0) {
   2203 #ifdef TCPISS_DEBUG
   2204 			printf("Random %08x, ", tcp_iss);
   2205 #endif
   2206 			tcp_iss &= TCP_ISS_RANDOM_MASK;
   2207 			tcp_iss += addin + TCP_ISSINCR;
   2208 #ifdef TCPISS_DEBUG
   2209 			printf("Old ISS %08x, ISS %08x\n", addin, tcp_iss);
   2210 #endif
   2211 		} else {
   2212 			tcp_iss &= TCP_ISS_RANDOM_MASK;
   2213 			tcp_iss += tcp_iss_seq;
   2214 			tcp_iss_seq += TCP_ISSINCR;
   2215 #ifdef TCPISS_DEBUG
   2216 			printf("ISS %08x\n", tcp_iss);
   2217 #endif
   2218 		}
   2219 	}
   2220 
   2221 	if (tcp_compat_42) {
   2222 		/*
   2223 		 * Limit it to the positive range for really old TCP
   2224 		 * implementations.
   2225 		 * Just AND off the top bit instead of checking if
   2226 		 * is set first - saves a branch 50% of the time.
   2227 		 */
   2228 		tcp_iss &= 0x7fffffff;		/* XXX */
   2229 	}
   2230 
   2231 	return (tcp_iss);
   2232 }
   2233 
   2234 #if defined(IPSEC) || defined(FAST_IPSEC)
   2235 /* compute ESP/AH header size for TCP, including outer IP header. */
   2236 size_t
   2237 ipsec4_hdrsiz_tcp(struct tcpcb *tp)
   2238 {
   2239 	struct inpcb *inp;
   2240 	size_t hdrsiz;
   2241 
   2242 	/* XXX mapped addr case (tp->t_in6pcb) */
   2243 	if (!tp || !tp->t_template || !(inp = tp->t_inpcb))
   2244 		return 0;
   2245 	switch (tp->t_family) {
   2246 	case AF_INET:
   2247 		/* XXX: should use currect direction. */
   2248 		hdrsiz = ipsec4_hdrsiz(tp->t_template, IPSEC_DIR_OUTBOUND, inp);
   2249 		break;
   2250 	default:
   2251 		hdrsiz = 0;
   2252 		break;
   2253 	}
   2254 
   2255 	return hdrsiz;
   2256 }
   2257 
   2258 #ifdef INET6
   2259 size_t
   2260 ipsec6_hdrsiz_tcp(struct tcpcb *tp)
   2261 {
   2262 	struct in6pcb *in6p;
   2263 	size_t hdrsiz;
   2264 
   2265 	if (!tp || !tp->t_template || !(in6p = tp->t_in6pcb))
   2266 		return 0;
   2267 	switch (tp->t_family) {
   2268 	case AF_INET6:
   2269 		/* XXX: should use currect direction. */
   2270 		hdrsiz = ipsec6_hdrsiz(tp->t_template, IPSEC_DIR_OUTBOUND, in6p);
   2271 		break;
   2272 	case AF_INET:
   2273 		/* mapped address case - tricky */
   2274 	default:
   2275 		hdrsiz = 0;
   2276 		break;
   2277 	}
   2278 
   2279 	return hdrsiz;
   2280 }
   2281 #endif
   2282 #endif /*IPSEC*/
   2283 
   2284 /*
   2285  * Determine the length of the TCP options for this connection.
   2286  *
   2287  * XXX:  What do we do for SACK, when we add that?  Just reserve
   2288  *       all of the space?  Otherwise we can't exactly be incrementing
   2289  *       cwnd by an amount that varies depending on the amount we last
   2290  *       had to SACK!
   2291  */
   2292 
   2293 u_int
   2294 tcp_optlen(struct tcpcb *tp)
   2295 {
   2296 	u_int optlen;
   2297 
   2298 	optlen = 0;
   2299 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP|TF_NOOPT)) ==
   2300 	    (TF_REQ_TSTMP | TF_RCVD_TSTMP))
   2301 		optlen += TCPOLEN_TSTAMP_APPA;
   2302 
   2303 #ifdef TCP_SIGNATURE
   2304 	if (tp->t_flags & TF_SIGNATURE)
   2305 		optlen += TCPOLEN_SIGNATURE + 2;
   2306 #endif /* TCP_SIGNATURE */
   2307 
   2308 	return optlen;
   2309 }
   2310 
   2311 u_int
   2312 tcp_hdrsz(struct tcpcb *tp)
   2313 {
   2314 	u_int hlen;
   2315 
   2316 	switch (tp->t_family) {
   2317 #ifdef INET6
   2318 	case AF_INET6:
   2319 		hlen = sizeof(struct ip6_hdr);
   2320 		break;
   2321 #endif
   2322 	case AF_INET:
   2323 		hlen = sizeof(struct ip);
   2324 		break;
   2325 	default:
   2326 		hlen = 0;
   2327 		break;
   2328 	}
   2329 	hlen += sizeof(struct tcphdr);
   2330 
   2331 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
   2332 	    (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
   2333 		hlen += TCPOLEN_TSTAMP_APPA;
   2334 #ifdef TCP_SIGNATURE
   2335 	if (tp->t_flags & TF_SIGNATURE)
   2336 		hlen += TCPOLEN_SIGLEN;
   2337 #endif
   2338 	return hlen;
   2339 }
   2340 
   2341 void
   2342 tcp_statinc(u_int stat)
   2343 {
   2344 
   2345 	KASSERT(stat < TCP_NSTATS);
   2346 	TCP_STATINC(stat);
   2347 }
   2348 
   2349 void
   2350 tcp_statadd(u_int stat, uint64_t val)
   2351 {
   2352 
   2353 	KASSERT(stat < TCP_NSTATS);
   2354 	TCP_STATADD(stat, val);
   2355 }
   2356