Home | History | Annotate | Line # | Download | only in netinet
tcp_subr.c revision 1.244
      1 /*	$NetBSD: tcp_subr.c,v 1.244 2011/12/17 20:05:39 tls Exp $	*/
      2 
      3 /*
      4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. Neither the name of the project nor the names of its contributors
     16  *    may be used to endorse or promote products derived from this software
     17  *    without specific prior written permission.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  * SUCH DAMAGE.
     30  */
     31 
     32 /*-
     33  * Copyright (c) 1997, 1998, 2000, 2001, 2008 The NetBSD Foundation, Inc.
     34  * All rights reserved.
     35  *
     36  * This code is derived from software contributed to The NetBSD Foundation
     37  * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
     38  * Facility, NASA Ames Research Center.
     39  *
     40  * Redistribution and use in source and binary forms, with or without
     41  * modification, are permitted provided that the following conditions
     42  * are met:
     43  * 1. Redistributions of source code must retain the above copyright
     44  *    notice, this list of conditions and the following disclaimer.
     45  * 2. Redistributions in binary form must reproduce the above copyright
     46  *    notice, this list of conditions and the following disclaimer in the
     47  *    documentation and/or other materials provided with the distribution.
     48  *
     49  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     50  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     51  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     52  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     53  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     54  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     55  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     56  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     57  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     58  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     59  * POSSIBILITY OF SUCH DAMAGE.
     60  */
     61 
     62 /*
     63  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
     64  *	The Regents of the University of California.  All rights reserved.
     65  *
     66  * Redistribution and use in source and binary forms, with or without
     67  * modification, are permitted provided that the following conditions
     68  * are met:
     69  * 1. Redistributions of source code must retain the above copyright
     70  *    notice, this list of conditions and the following disclaimer.
     71  * 2. Redistributions in binary form must reproduce the above copyright
     72  *    notice, this list of conditions and the following disclaimer in the
     73  *    documentation and/or other materials provided with the distribution.
     74  * 3. Neither the name of the University nor the names of its contributors
     75  *    may be used to endorse or promote products derived from this software
     76  *    without specific prior written permission.
     77  *
     78  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     79  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     80  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     81  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     82  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     83  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     84  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     86  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     87  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     88  * SUCH DAMAGE.
     89  *
     90  *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
     91  */
     92 
     93 #include <sys/cdefs.h>
     94 __KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.244 2011/12/17 20:05:39 tls Exp $");
     95 
     96 #include "opt_inet.h"
     97 #include "opt_ipsec.h"
     98 #include "opt_tcp_compat_42.h"
     99 #include "opt_inet_csum.h"
    100 #include "opt_mbuftrace.h"
    101 
    102 #include <sys/param.h>
    103 #include <sys/proc.h>
    104 #include <sys/systm.h>
    105 #include <sys/malloc.h>
    106 #include <sys/mbuf.h>
    107 #include <sys/socket.h>
    108 #include <sys/socketvar.h>
    109 #include <sys/protosw.h>
    110 #include <sys/errno.h>
    111 #include <sys/kernel.h>
    112 #include <sys/pool.h>
    113 #include <sys/md5.h>
    114 #include <sys/cprng.h>
    115 
    116 #include <net/route.h>
    117 #include <net/if.h>
    118 
    119 #include <netinet/in.h>
    120 #include <netinet/in_systm.h>
    121 #include <netinet/ip.h>
    122 #include <netinet/in_pcb.h>
    123 #include <netinet/ip_var.h>
    124 #include <netinet/ip_icmp.h>
    125 
    126 #ifdef INET6
    127 #ifndef INET
    128 #include <netinet/in.h>
    129 #endif
    130 #include <netinet/ip6.h>
    131 #include <netinet6/in6_pcb.h>
    132 #include <netinet6/ip6_var.h>
    133 #include <netinet6/in6_var.h>
    134 #include <netinet6/ip6protosw.h>
    135 #include <netinet/icmp6.h>
    136 #include <netinet6/nd6.h>
    137 #endif
    138 
    139 #include <netinet/tcp.h>
    140 #include <netinet/tcp_fsm.h>
    141 #include <netinet/tcp_seq.h>
    142 #include <netinet/tcp_timer.h>
    143 #include <netinet/tcp_var.h>
    144 #include <netinet/tcp_vtw.h>
    145 #include <netinet/tcp_private.h>
    146 #include <netinet/tcp_congctl.h>
    147 #include <netinet/tcpip.h>
    148 
    149 #ifdef IPSEC
    150 #include <netinet6/ipsec.h>
    151 #include <netkey/key.h>
    152 #endif /*IPSEC*/
    153 
    154 #ifdef FAST_IPSEC
    155 #include <netipsec/ipsec.h>
    156 #include <netipsec/xform.h>
    157 #ifdef INET6
    158 #include <netipsec/ipsec6.h>
    159 #endif
    160  #include <netipsec/key.h>
    161 #endif	/* FAST_IPSEC*/
    162 
    163 
    164 struct	inpcbtable tcbtable;	/* head of queue of active tcpcb's */
    165 u_int32_t tcp_now;		/* slow ticks, for RFC 1323 timestamps */
    166 
    167 percpu_t *tcpstat_percpu;
    168 
    169 /* patchable/settable parameters for tcp */
    170 int 	tcp_mssdflt = TCP_MSS;
    171 int	tcp_minmss = TCP_MINMSS;
    172 int 	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
    173 int	tcp_do_rfc1323 = 1;	/* window scaling / timestamps (obsolete) */
    174 int	tcp_do_rfc1948 = 0;	/* ISS by cryptographic hash */
    175 int	tcp_do_sack = 1;	/* selective acknowledgement */
    176 int	tcp_do_win_scale = 1;	/* RFC1323 window scaling */
    177 int	tcp_do_timestamps = 1;	/* RFC1323 timestamps */
    178 int	tcp_ack_on_push = 0;	/* set to enable immediate ACK-on-PUSH */
    179 int	tcp_do_ecn = 0;		/* Explicit Congestion Notification */
    180 #ifndef TCP_INIT_WIN
    181 #define	TCP_INIT_WIN	0	/* initial slow start window */
    182 #endif
    183 #ifndef TCP_INIT_WIN_LOCAL
    184 #define	TCP_INIT_WIN_LOCAL 4	/* initial slow start window for local nets */
    185 #endif
    186 int	tcp_init_win = TCP_INIT_WIN;
    187 int	tcp_init_win_local = TCP_INIT_WIN_LOCAL;
    188 int	tcp_mss_ifmtu = 0;
    189 #ifdef TCP_COMPAT_42
    190 int	tcp_compat_42 = 1;
    191 #else
    192 int	tcp_compat_42 = 0;
    193 #endif
    194 int	tcp_rst_ppslim = 100;	/* 100pps */
    195 int	tcp_ackdrop_ppslim = 100;	/* 100pps */
    196 int	tcp_do_loopback_cksum = 0;
    197 int	tcp_do_abc = 1;		/* RFC3465 Appropriate byte counting. */
    198 int	tcp_abc_aggressive = 1;	/* 1: L=2*SMSS  0: L=1*SMSS */
    199 int	tcp_sack_tp_maxholes = 32;
    200 int	tcp_sack_globalmaxholes = 1024;
    201 int	tcp_sack_globalholes = 0;
    202 int	tcp_ecn_maxretries = 1;
    203 int	tcp_msl_enable = 1;		/* enable TIME_WAIT truncation	*/
    204 int	tcp_msl_loop   = PR_SLOWHZ;	/* MSL for loopback		*/
    205 int	tcp_msl_local  = 5 * PR_SLOWHZ;	/* MSL for 'local'		*/
    206 int	tcp_msl_remote = TCPTV_MSL;	/* MSL otherwise		*/
    207 int	tcp_msl_remote_threshold = TCPTV_SRTTDFLT;	/* RTT threshold */
    208 int	tcp_rttlocal = 0;		/* Use RTT to decide who's 'local' */
    209 
    210 int	tcp4_vtw_enable = 0;		/* 1 to enable */
    211 int	tcp6_vtw_enable = 0;		/* 1 to enable */
    212 int	tcp_vtw_was_enabled = 0;
    213 int	tcp_vtw_entries = 1 << 16;	/* 64K vestigial TIME_WAIT entries */
    214 
    215 /* tcb hash */
    216 #ifndef TCBHASHSIZE
    217 #define	TCBHASHSIZE	128
    218 #endif
    219 int	tcbhashsize = TCBHASHSIZE;
    220 
    221 /* syn hash parameters */
    222 #define	TCP_SYN_HASH_SIZE	293
    223 #define	TCP_SYN_BUCKET_SIZE	35
    224 int	tcp_syn_cache_size = TCP_SYN_HASH_SIZE;
    225 int	tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE;
    226 int	tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE;
    227 struct	syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE];
    228 
    229 int	tcp_freeq(struct tcpcb *);
    230 
    231 #ifdef INET
    232 void	tcp_mtudisc_callback(struct in_addr);
    233 #endif
    234 #ifdef INET6
    235 void	tcp6_mtudisc_callback(struct in6_addr *);
    236 #endif
    237 
    238 #ifdef INET6
    239 void	tcp6_mtudisc(struct in6pcb *, int);
    240 #endif
    241 
    242 static struct pool tcpcb_pool;
    243 
    244 static int tcp_drainwanted;
    245 
    246 #ifdef TCP_CSUM_COUNTERS
    247 #include <sys/device.h>
    248 
    249 #if defined(INET)
    250 struct evcnt tcp_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    251     NULL, "tcp", "hwcsum bad");
    252 struct evcnt tcp_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    253     NULL, "tcp", "hwcsum ok");
    254 struct evcnt tcp_hwcsum_data = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    255     NULL, "tcp", "hwcsum data");
    256 struct evcnt tcp_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    257     NULL, "tcp", "swcsum");
    258 
    259 EVCNT_ATTACH_STATIC(tcp_hwcsum_bad);
    260 EVCNT_ATTACH_STATIC(tcp_hwcsum_ok);
    261 EVCNT_ATTACH_STATIC(tcp_hwcsum_data);
    262 EVCNT_ATTACH_STATIC(tcp_swcsum);
    263 #endif /* defined(INET) */
    264 
    265 #if defined(INET6)
    266 struct evcnt tcp6_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    267     NULL, "tcp6", "hwcsum bad");
    268 struct evcnt tcp6_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    269     NULL, "tcp6", "hwcsum ok");
    270 struct evcnt tcp6_hwcsum_data = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    271     NULL, "tcp6", "hwcsum data");
    272 struct evcnt tcp6_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    273     NULL, "tcp6", "swcsum");
    274 
    275 EVCNT_ATTACH_STATIC(tcp6_hwcsum_bad);
    276 EVCNT_ATTACH_STATIC(tcp6_hwcsum_ok);
    277 EVCNT_ATTACH_STATIC(tcp6_hwcsum_data);
    278 EVCNT_ATTACH_STATIC(tcp6_swcsum);
    279 #endif /* defined(INET6) */
    280 #endif /* TCP_CSUM_COUNTERS */
    281 
    282 
    283 #ifdef TCP_OUTPUT_COUNTERS
    284 #include <sys/device.h>
    285 
    286 struct evcnt tcp_output_bigheader = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    287     NULL, "tcp", "output big header");
    288 struct evcnt tcp_output_predict_hit = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    289     NULL, "tcp", "output predict hit");
    290 struct evcnt tcp_output_predict_miss = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    291     NULL, "tcp", "output predict miss");
    292 struct evcnt tcp_output_copysmall = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    293     NULL, "tcp", "output copy small");
    294 struct evcnt tcp_output_copybig = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    295     NULL, "tcp", "output copy big");
    296 struct evcnt tcp_output_refbig = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    297     NULL, "tcp", "output reference big");
    298 
    299 EVCNT_ATTACH_STATIC(tcp_output_bigheader);
    300 EVCNT_ATTACH_STATIC(tcp_output_predict_hit);
    301 EVCNT_ATTACH_STATIC(tcp_output_predict_miss);
    302 EVCNT_ATTACH_STATIC(tcp_output_copysmall);
    303 EVCNT_ATTACH_STATIC(tcp_output_copybig);
    304 EVCNT_ATTACH_STATIC(tcp_output_refbig);
    305 
    306 #endif /* TCP_OUTPUT_COUNTERS */
    307 
    308 #ifdef TCP_REASS_COUNTERS
    309 #include <sys/device.h>
    310 
    311 struct evcnt tcp_reass_ = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    312     NULL, "tcp_reass", "calls");
    313 struct evcnt tcp_reass_empty = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    314     &tcp_reass_, "tcp_reass", "insert into empty queue");
    315 struct evcnt tcp_reass_iteration[8] = {
    316     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", ">7 iterations"),
    317     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "1 iteration"),
    318     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "2 iterations"),
    319     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "3 iterations"),
    320     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "4 iterations"),
    321     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "5 iterations"),
    322     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "6 iterations"),
    323     EVCNT_INITIALIZER(EVCNT_TYPE_MISC, &tcp_reass_, "tcp_reass", "7 iterations"),
    324 };
    325 struct evcnt tcp_reass_prependfirst = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    326     &tcp_reass_, "tcp_reass", "prepend to first");
    327 struct evcnt tcp_reass_prepend = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    328     &tcp_reass_, "tcp_reass", "prepend");
    329 struct evcnt tcp_reass_insert = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    330     &tcp_reass_, "tcp_reass", "insert");
    331 struct evcnt tcp_reass_inserttail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    332     &tcp_reass_, "tcp_reass", "insert at tail");
    333 struct evcnt tcp_reass_append = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    334     &tcp_reass_, "tcp_reass", "append");
    335 struct evcnt tcp_reass_appendtail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    336     &tcp_reass_, "tcp_reass", "append to tail fragment");
    337 struct evcnt tcp_reass_overlaptail = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    338     &tcp_reass_, "tcp_reass", "overlap at end");
    339 struct evcnt tcp_reass_overlapfront = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    340     &tcp_reass_, "tcp_reass", "overlap at start");
    341 struct evcnt tcp_reass_segdup = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    342     &tcp_reass_, "tcp_reass", "duplicate segment");
    343 struct evcnt tcp_reass_fragdup = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    344     &tcp_reass_, "tcp_reass", "duplicate fragment");
    345 
    346 EVCNT_ATTACH_STATIC(tcp_reass_);
    347 EVCNT_ATTACH_STATIC(tcp_reass_empty);
    348 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 0);
    349 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 1);
    350 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 2);
    351 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 3);
    352 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 4);
    353 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 5);
    354 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 6);
    355 EVCNT_ATTACH_STATIC2(tcp_reass_iteration, 7);
    356 EVCNT_ATTACH_STATIC(tcp_reass_prependfirst);
    357 EVCNT_ATTACH_STATIC(tcp_reass_prepend);
    358 EVCNT_ATTACH_STATIC(tcp_reass_insert);
    359 EVCNT_ATTACH_STATIC(tcp_reass_inserttail);
    360 EVCNT_ATTACH_STATIC(tcp_reass_append);
    361 EVCNT_ATTACH_STATIC(tcp_reass_appendtail);
    362 EVCNT_ATTACH_STATIC(tcp_reass_overlaptail);
    363 EVCNT_ATTACH_STATIC(tcp_reass_overlapfront);
    364 EVCNT_ATTACH_STATIC(tcp_reass_segdup);
    365 EVCNT_ATTACH_STATIC(tcp_reass_fragdup);
    366 
    367 #endif /* TCP_REASS_COUNTERS */
    368 
    369 #ifdef MBUFTRACE
    370 struct mowner tcp_mowner = MOWNER_INIT("tcp", "");
    371 struct mowner tcp_rx_mowner = MOWNER_INIT("tcp", "rx");
    372 struct mowner tcp_tx_mowner = MOWNER_INIT("tcp", "tx");
    373 struct mowner tcp_sock_mowner = MOWNER_INIT("tcp", "sock");
    374 struct mowner tcp_sock_rx_mowner = MOWNER_INIT("tcp", "sock rx");
    375 struct mowner tcp_sock_tx_mowner = MOWNER_INIT("tcp", "sock tx");
    376 #endif
    377 
    378 /*
    379  * Tcp initialization
    380  */
    381 void
    382 tcp_init(void)
    383 {
    384 	int hlen;
    385 
    386 	in_pcbinit(&tcbtable, tcbhashsize, tcbhashsize);
    387 	pool_init(&tcpcb_pool, sizeof(struct tcpcb), 0, 0, 0, "tcpcbpl",
    388 	    NULL, IPL_SOFTNET);
    389 
    390 	hlen = sizeof(struct ip) + sizeof(struct tcphdr);
    391 #ifdef INET6
    392 	if (sizeof(struct ip) < sizeof(struct ip6_hdr))
    393 		hlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
    394 #endif
    395 	if (max_protohdr < hlen)
    396 		max_protohdr = hlen;
    397 	if (max_linkhdr + hlen > MHLEN)
    398 		panic("tcp_init");
    399 
    400 #ifdef INET
    401 	icmp_mtudisc_callback_register(tcp_mtudisc_callback);
    402 #endif
    403 #ifdef INET6
    404 	icmp6_mtudisc_callback_register(tcp6_mtudisc_callback);
    405 #endif
    406 
    407 	tcp_usrreq_init();
    408 
    409 	/* Initialize timer state. */
    410 	tcp_timer_init();
    411 
    412 	/* Initialize the compressed state engine. */
    413 	syn_cache_init();
    414 
    415 	/* Initialize the congestion control algorithms. */
    416 	tcp_congctl_init();
    417 
    418 	/* Initialize the TCPCB template. */
    419 	tcp_tcpcb_template();
    420 
    421 	/* Initialize reassembly queue */
    422 	tcpipqent_init();
    423 
    424 	/* SACK */
    425 	tcp_sack_init();
    426 
    427 	MOWNER_ATTACH(&tcp_tx_mowner);
    428 	MOWNER_ATTACH(&tcp_rx_mowner);
    429 	MOWNER_ATTACH(&tcp_reass_mowner);
    430 	MOWNER_ATTACH(&tcp_sock_mowner);
    431 	MOWNER_ATTACH(&tcp_sock_tx_mowner);
    432 	MOWNER_ATTACH(&tcp_sock_rx_mowner);
    433 	MOWNER_ATTACH(&tcp_mowner);
    434 
    435 	tcpstat_percpu = percpu_alloc(sizeof(uint64_t) * TCP_NSTATS);
    436 
    437 	vtw_earlyinit();
    438 }
    439 
    440 /*
    441  * Create template to be used to send tcp packets on a connection.
    442  * Call after host entry created, allocates an mbuf and fills
    443  * in a skeletal tcp/ip header, minimizing the amount of work
    444  * necessary when the connection is used.
    445  */
    446 struct mbuf *
    447 tcp_template(struct tcpcb *tp)
    448 {
    449 	struct inpcb *inp = tp->t_inpcb;
    450 #ifdef INET6
    451 	struct in6pcb *in6p = tp->t_in6pcb;
    452 #endif
    453 	struct tcphdr *n;
    454 	struct mbuf *m;
    455 	int hlen;
    456 
    457 	switch (tp->t_family) {
    458 	case AF_INET:
    459 		hlen = sizeof(struct ip);
    460 		if (inp)
    461 			break;
    462 #ifdef INET6
    463 		if (in6p) {
    464 			/* mapped addr case */
    465 			if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr)
    466 			 && IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr))
    467 				break;
    468 		}
    469 #endif
    470 		return NULL;	/*EINVAL*/
    471 #ifdef INET6
    472 	case AF_INET6:
    473 		hlen = sizeof(struct ip6_hdr);
    474 		if (in6p) {
    475 			/* more sainty check? */
    476 			break;
    477 		}
    478 		return NULL;	/*EINVAL*/
    479 #endif
    480 	default:
    481 		hlen = 0;	/*pacify gcc*/
    482 		return NULL;	/*EAFNOSUPPORT*/
    483 	}
    484 #ifdef DIAGNOSTIC
    485 	if (hlen + sizeof(struct tcphdr) > MCLBYTES)
    486 		panic("mclbytes too small for t_template");
    487 #endif
    488 	m = tp->t_template;
    489 	if (m && m->m_len == hlen + sizeof(struct tcphdr))
    490 		;
    491 	else {
    492 		if (m)
    493 			m_freem(m);
    494 		m = tp->t_template = NULL;
    495 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
    496 		if (m && hlen + sizeof(struct tcphdr) > MHLEN) {
    497 			MCLGET(m, M_DONTWAIT);
    498 			if ((m->m_flags & M_EXT) == 0) {
    499 				m_free(m);
    500 				m = NULL;
    501 			}
    502 		}
    503 		if (m == NULL)
    504 			return NULL;
    505 		MCLAIM(m, &tcp_mowner);
    506 		m->m_pkthdr.len = m->m_len = hlen + sizeof(struct tcphdr);
    507 	}
    508 
    509 	memset(mtod(m, void *), 0, m->m_len);
    510 
    511 	n = (struct tcphdr *)(mtod(m, char *) + hlen);
    512 
    513 	switch (tp->t_family) {
    514 	case AF_INET:
    515 	    {
    516 		struct ipovly *ipov;
    517 		mtod(m, struct ip *)->ip_v = 4;
    518 		mtod(m, struct ip *)->ip_hl = hlen >> 2;
    519 		ipov = mtod(m, struct ipovly *);
    520 		ipov->ih_pr = IPPROTO_TCP;
    521 		ipov->ih_len = htons(sizeof(struct tcphdr));
    522 		if (inp) {
    523 			ipov->ih_src = inp->inp_laddr;
    524 			ipov->ih_dst = inp->inp_faddr;
    525 		}
    526 #ifdef INET6
    527 		else if (in6p) {
    528 			/* mapped addr case */
    529 			bcopy(&in6p->in6p_laddr.s6_addr32[3], &ipov->ih_src,
    530 				sizeof(ipov->ih_src));
    531 			bcopy(&in6p->in6p_faddr.s6_addr32[3], &ipov->ih_dst,
    532 				sizeof(ipov->ih_dst));
    533 		}
    534 #endif
    535 		/*
    536 		 * Compute the pseudo-header portion of the checksum
    537 		 * now.  We incrementally add in the TCP option and
    538 		 * payload lengths later, and then compute the TCP
    539 		 * checksum right before the packet is sent off onto
    540 		 * the wire.
    541 		 */
    542 		n->th_sum = in_cksum_phdr(ipov->ih_src.s_addr,
    543 		    ipov->ih_dst.s_addr,
    544 		    htons(sizeof(struct tcphdr) + IPPROTO_TCP));
    545 		break;
    546 	    }
    547 #ifdef INET6
    548 	case AF_INET6:
    549 	    {
    550 		struct ip6_hdr *ip6;
    551 		mtod(m, struct ip *)->ip_v = 6;
    552 		ip6 = mtod(m, struct ip6_hdr *);
    553 		ip6->ip6_nxt = IPPROTO_TCP;
    554 		ip6->ip6_plen = htons(sizeof(struct tcphdr));
    555 		ip6->ip6_src = in6p->in6p_laddr;
    556 		ip6->ip6_dst = in6p->in6p_faddr;
    557 		ip6->ip6_flow = in6p->in6p_flowinfo & IPV6_FLOWINFO_MASK;
    558 		if (ip6_auto_flowlabel) {
    559 			ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK;
    560 			ip6->ip6_flow |=
    561 			    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
    562 		}
    563 		ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
    564 		ip6->ip6_vfc |= IPV6_VERSION;
    565 
    566 		/*
    567 		 * Compute the pseudo-header portion of the checksum
    568 		 * now.  We incrementally add in the TCP option and
    569 		 * payload lengths later, and then compute the TCP
    570 		 * checksum right before the packet is sent off onto
    571 		 * the wire.
    572 		 */
    573 		n->th_sum = in6_cksum_phdr(&in6p->in6p_laddr,
    574 		    &in6p->in6p_faddr, htonl(sizeof(struct tcphdr)),
    575 		    htonl(IPPROTO_TCP));
    576 		break;
    577 	    }
    578 #endif
    579 	}
    580 	if (inp) {
    581 		n->th_sport = inp->inp_lport;
    582 		n->th_dport = inp->inp_fport;
    583 	}
    584 #ifdef INET6
    585 	else if (in6p) {
    586 		n->th_sport = in6p->in6p_lport;
    587 		n->th_dport = in6p->in6p_fport;
    588 	}
    589 #endif
    590 	n->th_seq = 0;
    591 	n->th_ack = 0;
    592 	n->th_x2 = 0;
    593 	n->th_off = 5;
    594 	n->th_flags = 0;
    595 	n->th_win = 0;
    596 	n->th_urp = 0;
    597 	return (m);
    598 }
    599 
    600 /*
    601  * Send a single message to the TCP at address specified by
    602  * the given TCP/IP header.  If m == 0, then we make a copy
    603  * of the tcpiphdr at ti and send directly to the addressed host.
    604  * This is used to force keep alive messages out using the TCP
    605  * template for a connection tp->t_template.  If flags are given
    606  * then we send a message back to the TCP which originated the
    607  * segment ti, and discard the mbuf containing it and any other
    608  * attached mbufs.
    609  *
    610  * In any case the ack and sequence number of the transmitted
    611  * segment are as specified by the parameters.
    612  */
    613 int
    614 tcp_respond(struct tcpcb *tp, struct mbuf *template, struct mbuf *m,
    615     struct tcphdr *th0, tcp_seq ack, tcp_seq seq, int flags)
    616 {
    617 #ifdef INET6
    618 	struct rtentry *rt;
    619 #endif
    620 	struct route *ro;
    621 	int error, tlen, win = 0;
    622 	int hlen;
    623 	struct ip *ip;
    624 #ifdef INET6
    625 	struct ip6_hdr *ip6;
    626 #endif
    627 	int family;	/* family on packet, not inpcb/in6pcb! */
    628 	struct tcphdr *th;
    629 	struct socket *so;
    630 
    631 	if (tp != NULL && (flags & TH_RST) == 0) {
    632 #ifdef DIAGNOSTIC
    633 		if (tp->t_inpcb && tp->t_in6pcb)
    634 			panic("tcp_respond: both t_inpcb and t_in6pcb are set");
    635 #endif
    636 #ifdef INET
    637 		if (tp->t_inpcb)
    638 			win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
    639 #endif
    640 #ifdef INET6
    641 		if (tp->t_in6pcb)
    642 			win = sbspace(&tp->t_in6pcb->in6p_socket->so_rcv);
    643 #endif
    644 	}
    645 
    646 	th = NULL;	/* Quell uninitialized warning */
    647 	ip = NULL;
    648 #ifdef INET6
    649 	ip6 = NULL;
    650 #endif
    651 	if (m == 0) {
    652 		if (!template)
    653 			return EINVAL;
    654 
    655 		/* get family information from template */
    656 		switch (mtod(template, struct ip *)->ip_v) {
    657 		case 4:
    658 			family = AF_INET;
    659 			hlen = sizeof(struct ip);
    660 			break;
    661 #ifdef INET6
    662 		case 6:
    663 			family = AF_INET6;
    664 			hlen = sizeof(struct ip6_hdr);
    665 			break;
    666 #endif
    667 		default:
    668 			return EAFNOSUPPORT;
    669 		}
    670 
    671 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
    672 		if (m) {
    673 			MCLAIM(m, &tcp_tx_mowner);
    674 			MCLGET(m, M_DONTWAIT);
    675 			if ((m->m_flags & M_EXT) == 0) {
    676 				m_free(m);
    677 				m = NULL;
    678 			}
    679 		}
    680 		if (m == NULL)
    681 			return (ENOBUFS);
    682 
    683 		if (tcp_compat_42)
    684 			tlen = 1;
    685 		else
    686 			tlen = 0;
    687 
    688 		m->m_data += max_linkhdr;
    689 		bcopy(mtod(template, void *), mtod(m, void *),
    690 			template->m_len);
    691 		switch (family) {
    692 		case AF_INET:
    693 			ip = mtod(m, struct ip *);
    694 			th = (struct tcphdr *)(ip + 1);
    695 			break;
    696 #ifdef INET6
    697 		case AF_INET6:
    698 			ip6 = mtod(m, struct ip6_hdr *);
    699 			th = (struct tcphdr *)(ip6 + 1);
    700 			break;
    701 #endif
    702 #if 0
    703 		default:
    704 			/* noone will visit here */
    705 			m_freem(m);
    706 			return EAFNOSUPPORT;
    707 #endif
    708 		}
    709 		flags = TH_ACK;
    710 	} else {
    711 
    712 		if ((m->m_flags & M_PKTHDR) == 0) {
    713 #if 0
    714 			printf("non PKTHDR to tcp_respond\n");
    715 #endif
    716 			m_freem(m);
    717 			return EINVAL;
    718 		}
    719 #ifdef DIAGNOSTIC
    720 		if (!th0)
    721 			panic("th0 == NULL in tcp_respond");
    722 #endif
    723 
    724 		/* get family information from m */
    725 		switch (mtod(m, struct ip *)->ip_v) {
    726 		case 4:
    727 			family = AF_INET;
    728 			hlen = sizeof(struct ip);
    729 			ip = mtod(m, struct ip *);
    730 			break;
    731 #ifdef INET6
    732 		case 6:
    733 			family = AF_INET6;
    734 			hlen = sizeof(struct ip6_hdr);
    735 			ip6 = mtod(m, struct ip6_hdr *);
    736 			break;
    737 #endif
    738 		default:
    739 			m_freem(m);
    740 			return EAFNOSUPPORT;
    741 		}
    742 		/* clear h/w csum flags inherited from rx packet */
    743 		m->m_pkthdr.csum_flags = 0;
    744 
    745 		if ((flags & TH_SYN) == 0 || sizeof(*th0) > (th0->th_off << 2))
    746 			tlen = sizeof(*th0);
    747 		else
    748 			tlen = th0->th_off << 2;
    749 
    750 		if (m->m_len > hlen + tlen && (m->m_flags & M_EXT) == 0 &&
    751 		    mtod(m, char *) + hlen == (char *)th0) {
    752 			m->m_len = hlen + tlen;
    753 			m_freem(m->m_next);
    754 			m->m_next = NULL;
    755 		} else {
    756 			struct mbuf *n;
    757 
    758 #ifdef DIAGNOSTIC
    759 			if (max_linkhdr + hlen + tlen > MCLBYTES) {
    760 				m_freem(m);
    761 				return EMSGSIZE;
    762 			}
    763 #endif
    764 			MGETHDR(n, M_DONTWAIT, MT_HEADER);
    765 			if (n && max_linkhdr + hlen + tlen > MHLEN) {
    766 				MCLGET(n, M_DONTWAIT);
    767 				if ((n->m_flags & M_EXT) == 0) {
    768 					m_freem(n);
    769 					n = NULL;
    770 				}
    771 			}
    772 			if (!n) {
    773 				m_freem(m);
    774 				return ENOBUFS;
    775 			}
    776 
    777 			MCLAIM(n, &tcp_tx_mowner);
    778 			n->m_data += max_linkhdr;
    779 			n->m_len = hlen + tlen;
    780 			m_copyback(n, 0, hlen, mtod(m, void *));
    781 			m_copyback(n, hlen, tlen, (void *)th0);
    782 
    783 			m_freem(m);
    784 			m = n;
    785 			n = NULL;
    786 		}
    787 
    788 #define xchg(a,b,type) { type t; t=a; a=b; b=t; }
    789 		switch (family) {
    790 		case AF_INET:
    791 			ip = mtod(m, struct ip *);
    792 			th = (struct tcphdr *)(ip + 1);
    793 			ip->ip_p = IPPROTO_TCP;
    794 			xchg(ip->ip_dst, ip->ip_src, struct in_addr);
    795 			ip->ip_p = IPPROTO_TCP;
    796 			break;
    797 #ifdef INET6
    798 		case AF_INET6:
    799 			ip6 = mtod(m, struct ip6_hdr *);
    800 			th = (struct tcphdr *)(ip6 + 1);
    801 			ip6->ip6_nxt = IPPROTO_TCP;
    802 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
    803 			ip6->ip6_nxt = IPPROTO_TCP;
    804 			break;
    805 #endif
    806 #if 0
    807 		default:
    808 			/* noone will visit here */
    809 			m_freem(m);
    810 			return EAFNOSUPPORT;
    811 #endif
    812 		}
    813 		xchg(th->th_dport, th->th_sport, u_int16_t);
    814 #undef xchg
    815 		tlen = 0;	/*be friendly with the following code*/
    816 	}
    817 	th->th_seq = htonl(seq);
    818 	th->th_ack = htonl(ack);
    819 	th->th_x2 = 0;
    820 	if ((flags & TH_SYN) == 0) {
    821 		if (tp)
    822 			win >>= tp->rcv_scale;
    823 		if (win > TCP_MAXWIN)
    824 			win = TCP_MAXWIN;
    825 		th->th_win = htons((u_int16_t)win);
    826 		th->th_off = sizeof (struct tcphdr) >> 2;
    827 		tlen += sizeof(*th);
    828 	} else
    829 		tlen += th->th_off << 2;
    830 	m->m_len = hlen + tlen;
    831 	m->m_pkthdr.len = hlen + tlen;
    832 	m->m_pkthdr.rcvif = (struct ifnet *) 0;
    833 	th->th_flags = flags;
    834 	th->th_urp = 0;
    835 
    836 	switch (family) {
    837 #ifdef INET
    838 	case AF_INET:
    839 	    {
    840 		struct ipovly *ipov = (struct ipovly *)ip;
    841 		memset(ipov->ih_x1, 0, sizeof ipov->ih_x1);
    842 		ipov->ih_len = htons((u_int16_t)tlen);
    843 
    844 		th->th_sum = 0;
    845 		th->th_sum = in_cksum(m, hlen + tlen);
    846 		ip->ip_len = htons(hlen + tlen);
    847 		ip->ip_ttl = ip_defttl;
    848 		break;
    849 	    }
    850 #endif
    851 #ifdef INET6
    852 	case AF_INET6:
    853 	    {
    854 		th->th_sum = 0;
    855 		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
    856 				tlen);
    857 		ip6->ip6_plen = htons(tlen);
    858 		if (tp && tp->t_in6pcb) {
    859 			struct ifnet *oifp;
    860 			ro = &tp->t_in6pcb->in6p_route;
    861 			oifp = (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
    862 			                                           : NULL;
    863 			ip6->ip6_hlim = in6_selecthlim(tp->t_in6pcb, oifp);
    864 		} else
    865 			ip6->ip6_hlim = ip6_defhlim;
    866 		ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
    867 		if (ip6_auto_flowlabel) {
    868 			ip6->ip6_flow |=
    869 			    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
    870 		}
    871 		break;
    872 	    }
    873 #endif
    874 	}
    875 
    876 	if (tp && tp->t_inpcb)
    877 		so = tp->t_inpcb->inp_socket;
    878 #ifdef INET6
    879 	else if (tp && tp->t_in6pcb)
    880 		so = tp->t_in6pcb->in6p_socket;
    881 #endif
    882 	else
    883 		so = NULL;
    884 
    885 	if (tp != NULL && tp->t_inpcb != NULL) {
    886 		ro = &tp->t_inpcb->inp_route;
    887 #ifdef DIAGNOSTIC
    888 		if (family != AF_INET)
    889 			panic("tcp_respond: address family mismatch");
    890 		if (!in_hosteq(ip->ip_dst, tp->t_inpcb->inp_faddr)) {
    891 			panic("tcp_respond: ip_dst %x != inp_faddr %x",
    892 			    ntohl(ip->ip_dst.s_addr),
    893 			    ntohl(tp->t_inpcb->inp_faddr.s_addr));
    894 		}
    895 #endif
    896 	}
    897 #ifdef INET6
    898 	else if (tp != NULL && tp->t_in6pcb != NULL) {
    899 		ro = (struct route *)&tp->t_in6pcb->in6p_route;
    900 #ifdef DIAGNOSTIC
    901 		if (family == AF_INET) {
    902 			if (!IN6_IS_ADDR_V4MAPPED(&tp->t_in6pcb->in6p_faddr))
    903 				panic("tcp_respond: not mapped addr");
    904 			if (memcmp(&ip->ip_dst,
    905 			    &tp->t_in6pcb->in6p_faddr.s6_addr32[3],
    906 			    sizeof(ip->ip_dst)) != 0) {
    907 				panic("tcp_respond: ip_dst != in6p_faddr");
    908 			}
    909 		} else if (family == AF_INET6) {
    910 			if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
    911 			    &tp->t_in6pcb->in6p_faddr))
    912 				panic("tcp_respond: ip6_dst != in6p_faddr");
    913 		} else
    914 			panic("tcp_respond: address family mismatch");
    915 #endif
    916 	}
    917 #endif
    918 	else
    919 		ro = NULL;
    920 
    921 	switch (family) {
    922 #ifdef INET
    923 	case AF_INET:
    924 		error = ip_output(m, NULL, ro,
    925 		    (tp && tp->t_mtudisc ? IP_MTUDISC : 0),
    926 		    (struct ip_moptions *)0, so);
    927 		break;
    928 #endif
    929 #ifdef INET6
    930 	case AF_INET6:
    931 		error = ip6_output(m, NULL, ro, 0, NULL, so, NULL);
    932 		break;
    933 #endif
    934 	default:
    935 		error = EAFNOSUPPORT;
    936 		break;
    937 	}
    938 
    939 	return (error);
    940 }
    941 
    942 /*
    943  * Template TCPCB.  Rather than zeroing a new TCPCB and initializing
    944  * a bunch of members individually, we maintain this template for the
    945  * static and mostly-static components of the TCPCB, and copy it into
    946  * the new TCPCB instead.
    947  */
    948 static struct tcpcb tcpcb_template = {
    949 	.t_srtt = TCPTV_SRTTBASE,
    950 	.t_rttmin = TCPTV_MIN,
    951 
    952 	.snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT,
    953 	.snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT,
    954 	.snd_numholes = 0,
    955 
    956 	.t_partialacks = -1,
    957 	.t_bytes_acked = 0,
    958 };
    959 
    960 /*
    961  * Updates the TCPCB template whenever a parameter that would affect
    962  * the template is changed.
    963  */
    964 void
    965 tcp_tcpcb_template(void)
    966 {
    967 	struct tcpcb *tp = &tcpcb_template;
    968 	int flags;
    969 
    970 	tp->t_peermss = tcp_mssdflt;
    971 	tp->t_ourmss = tcp_mssdflt;
    972 	tp->t_segsz = tcp_mssdflt;
    973 
    974 	flags = 0;
    975 	if (tcp_do_rfc1323 && tcp_do_win_scale)
    976 		flags |= TF_REQ_SCALE;
    977 	if (tcp_do_rfc1323 && tcp_do_timestamps)
    978 		flags |= TF_REQ_TSTMP;
    979 	tp->t_flags = flags;
    980 
    981 	/*
    982 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
    983 	 * rtt estimate.  Set rttvar so that srtt + 2 * rttvar gives
    984 	 * reasonable initial retransmit time.
    985 	 */
    986 	tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ << (TCP_RTTVAR_SHIFT + 2 - 1);
    987 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
    988 	    TCPTV_MIN, TCPTV_REXMTMAX);
    989 
    990 	/* Keep Alive */
    991 	tp->t_keepinit = tcp_keepinit;
    992 	tp->t_keepidle = tcp_keepidle;
    993 	tp->t_keepintvl = tcp_keepintvl;
    994 	tp->t_keepcnt = tcp_keepcnt;
    995 	tp->t_maxidle = tp->t_keepcnt * tp->t_keepintvl;
    996 
    997 	/* MSL */
    998 	tp->t_msl = TCPTV_MSL;
    999 }
   1000 
   1001 /*
   1002  * Create a new TCP control block, making an
   1003  * empty reassembly queue and hooking it to the argument
   1004  * protocol control block.
   1005  */
   1006 /* family selects inpcb, or in6pcb */
   1007 struct tcpcb *
   1008 tcp_newtcpcb(int family, void *aux)
   1009 {
   1010 #ifdef INET6
   1011 	struct rtentry *rt;
   1012 #endif
   1013 	struct tcpcb *tp;
   1014 	int i;
   1015 
   1016 	/* XXX Consider using a pool_cache for speed. */
   1017 	tp = pool_get(&tcpcb_pool, PR_NOWAIT);	/* splsoftnet via tcp_usrreq */
   1018 	if (tp == NULL)
   1019 		return (NULL);
   1020 	memcpy(tp, &tcpcb_template, sizeof(*tp));
   1021 	TAILQ_INIT(&tp->segq);
   1022 	TAILQ_INIT(&tp->timeq);
   1023 	tp->t_family = family;		/* may be overridden later on */
   1024 	TAILQ_INIT(&tp->snd_holes);
   1025 	LIST_INIT(&tp->t_sc);		/* XXX can template this */
   1026 
   1027 	/* Don't sweat this loop; hopefully the compiler will unroll it. */
   1028 	for (i = 0; i < TCPT_NTIMERS; i++) {
   1029 		callout_init(&tp->t_timer[i], CALLOUT_MPSAFE);
   1030 		TCP_TIMER_INIT(tp, i);
   1031 	}
   1032 	callout_init(&tp->t_delack_ch, CALLOUT_MPSAFE);
   1033 
   1034 	switch (family) {
   1035 	case AF_INET:
   1036 	    {
   1037 		struct inpcb *inp = (struct inpcb *)aux;
   1038 
   1039 		inp->inp_ip.ip_ttl = ip_defttl;
   1040 		inp->inp_ppcb = (void *)tp;
   1041 
   1042 		tp->t_inpcb = inp;
   1043 		tp->t_mtudisc = ip_mtudisc;
   1044 		break;
   1045 	    }
   1046 #ifdef INET6
   1047 	case AF_INET6:
   1048 	    {
   1049 		struct in6pcb *in6p = (struct in6pcb *)aux;
   1050 
   1051 		in6p->in6p_ip6.ip6_hlim = in6_selecthlim(in6p,
   1052 			(rt = rtcache_validate(&in6p->in6p_route)) != NULL
   1053 			    ? rt->rt_ifp
   1054 			    : NULL);
   1055 		in6p->in6p_ppcb = (void *)tp;
   1056 
   1057 		tp->t_in6pcb = in6p;
   1058 		/* for IPv6, always try to run path MTU discovery */
   1059 		tp->t_mtudisc = 1;
   1060 		break;
   1061 	    }
   1062 #endif /* INET6 */
   1063 	default:
   1064 		for (i = 0; i < TCPT_NTIMERS; i++)
   1065 			callout_destroy(&tp->t_timer[i]);
   1066 		callout_destroy(&tp->t_delack_ch);
   1067 		pool_put(&tcpcb_pool, tp);	/* splsoftnet via tcp_usrreq */
   1068 		return (NULL);
   1069 	}
   1070 
   1071 	/*
   1072 	 * Initialize our timebase.  When we send timestamps, we take
   1073 	 * the delta from tcp_now -- this means each connection always
   1074 	 * gets a timebase of 1, which makes it, among other things,
   1075 	 * more difficult to determine how long a system has been up,
   1076 	 * and thus how many TCP sequence increments have occurred.
   1077 	 *
   1078 	 * We start with 1, because 0 doesn't work with linux, which
   1079 	 * considers timestamp 0 in a SYN packet as a bug and disables
   1080 	 * timestamps.
   1081 	 */
   1082 	tp->ts_timebase = tcp_now - 1;
   1083 
   1084 	tcp_congctl_select(tp, tcp_congctl_global_name);
   1085 
   1086 	return (tp);
   1087 }
   1088 
   1089 /*
   1090  * Drop a TCP connection, reporting
   1091  * the specified error.  If connection is synchronized,
   1092  * then send a RST to peer.
   1093  */
   1094 struct tcpcb *
   1095 tcp_drop(struct tcpcb *tp, int errno)
   1096 {
   1097 	struct socket *so = NULL;
   1098 
   1099 #ifdef DIAGNOSTIC
   1100 	if (tp->t_inpcb && tp->t_in6pcb)
   1101 		panic("tcp_drop: both t_inpcb and t_in6pcb are set");
   1102 #endif
   1103 #ifdef INET
   1104 	if (tp->t_inpcb)
   1105 		so = tp->t_inpcb->inp_socket;
   1106 #endif
   1107 #ifdef INET6
   1108 	if (tp->t_in6pcb)
   1109 		so = tp->t_in6pcb->in6p_socket;
   1110 #endif
   1111 	if (!so)
   1112 		return NULL;
   1113 
   1114 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
   1115 		tp->t_state = TCPS_CLOSED;
   1116 		(void) tcp_output(tp);
   1117 		TCP_STATINC(TCP_STAT_DROPS);
   1118 	} else
   1119 		TCP_STATINC(TCP_STAT_CONNDROPS);
   1120 	if (errno == ETIMEDOUT && tp->t_softerror)
   1121 		errno = tp->t_softerror;
   1122 	so->so_error = errno;
   1123 	return (tcp_close(tp));
   1124 }
   1125 
   1126 /*
   1127  * Close a TCP control block:
   1128  *	discard all space held by the tcp
   1129  *	discard internet protocol block
   1130  *	wake up any sleepers
   1131  */
   1132 struct tcpcb *
   1133 tcp_close(struct tcpcb *tp)
   1134 {
   1135 	struct inpcb *inp;
   1136 #ifdef INET6
   1137 	struct in6pcb *in6p;
   1138 #endif
   1139 	struct socket *so;
   1140 #ifdef RTV_RTT
   1141 	struct rtentry *rt;
   1142 #endif
   1143 	struct route *ro;
   1144 	int j;
   1145 
   1146 	inp = tp->t_inpcb;
   1147 #ifdef INET6
   1148 	in6p = tp->t_in6pcb;
   1149 #endif
   1150 	so = NULL;
   1151 	ro = NULL;
   1152 	if (inp) {
   1153 		so = inp->inp_socket;
   1154 		ro = &inp->inp_route;
   1155 	}
   1156 #ifdef INET6
   1157 	else if (in6p) {
   1158 		so = in6p->in6p_socket;
   1159 		ro = (struct route *)&in6p->in6p_route;
   1160 	}
   1161 #endif
   1162 
   1163 #ifdef RTV_RTT
   1164 	/*
   1165 	 * If we sent enough data to get some meaningful characteristics,
   1166 	 * save them in the routing entry.  'Enough' is arbitrarily
   1167 	 * defined as the sendpipesize (default 4K) * 16.  This would
   1168 	 * give us 16 rtt samples assuming we only get one sample per
   1169 	 * window (the usual case on a long haul net).  16 samples is
   1170 	 * enough for the srtt filter to converge to within 5% of the correct
   1171 	 * value; fewer samples and we could save a very bogus rtt.
   1172 	 *
   1173 	 * Don't update the default route's characteristics and don't
   1174 	 * update anything that the user "locked".
   1175 	 */
   1176 	if (SEQ_LT(tp->iss + so->so_snd.sb_hiwat * 16, tp->snd_max) &&
   1177 	    ro && (rt = rtcache_validate(ro)) != NULL &&
   1178 	    !in_nullhost(satocsin(rt_getkey(rt))->sin_addr)) {
   1179 		u_long i = 0;
   1180 
   1181 		if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
   1182 			i = tp->t_srtt *
   1183 			    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTT_SHIFT + 2));
   1184 			if (rt->rt_rmx.rmx_rtt && i)
   1185 				/*
   1186 				 * filter this update to half the old & half
   1187 				 * the new values, converting scale.
   1188 				 * See route.h and tcp_var.h for a
   1189 				 * description of the scaling constants.
   1190 				 */
   1191 				rt->rt_rmx.rmx_rtt =
   1192 				    (rt->rt_rmx.rmx_rtt + i) / 2;
   1193 			else
   1194 				rt->rt_rmx.rmx_rtt = i;
   1195 		}
   1196 		if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
   1197 			i = tp->t_rttvar *
   1198 			    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTTVAR_SHIFT + 2));
   1199 			if (rt->rt_rmx.rmx_rttvar && i)
   1200 				rt->rt_rmx.rmx_rttvar =
   1201 				    (rt->rt_rmx.rmx_rttvar + i) / 2;
   1202 			else
   1203 				rt->rt_rmx.rmx_rttvar = i;
   1204 		}
   1205 		/*
   1206 		 * update the pipelimit (ssthresh) if it has been updated
   1207 		 * already or if a pipesize was specified & the threshhold
   1208 		 * got below half the pipesize.  I.e., wait for bad news
   1209 		 * before we start updating, then update on both good
   1210 		 * and bad news.
   1211 		 */
   1212 		if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
   1213 		    (i = tp->snd_ssthresh) && rt->rt_rmx.rmx_ssthresh) ||
   1214 		    i < (rt->rt_rmx.rmx_sendpipe / 2)) {
   1215 			/*
   1216 			 * convert the limit from user data bytes to
   1217 			 * packets then to packet data bytes.
   1218 			 */
   1219 			i = (i + tp->t_segsz / 2) / tp->t_segsz;
   1220 			if (i < 2)
   1221 				i = 2;
   1222 			i *= (u_long)(tp->t_segsz + sizeof (struct tcpiphdr));
   1223 			if (rt->rt_rmx.rmx_ssthresh)
   1224 				rt->rt_rmx.rmx_ssthresh =
   1225 				    (rt->rt_rmx.rmx_ssthresh + i) / 2;
   1226 			else
   1227 				rt->rt_rmx.rmx_ssthresh = i;
   1228 		}
   1229 	}
   1230 #endif /* RTV_RTT */
   1231 	/* free the reassembly queue, if any */
   1232 	TCP_REASS_LOCK(tp);
   1233 	(void) tcp_freeq(tp);
   1234 	TCP_REASS_UNLOCK(tp);
   1235 
   1236 	/* free the SACK holes list. */
   1237 	tcp_free_sackholes(tp);
   1238 	tcp_congctl_release(tp);
   1239 	syn_cache_cleanup(tp);
   1240 
   1241 	if (tp->t_template) {
   1242 		m_free(tp->t_template);
   1243 		tp->t_template = NULL;
   1244 	}
   1245 
   1246 	/*
   1247 	 * Detaching the pcb will unlock the socket/tcpcb, and stopping
   1248 	 * the timers can also drop the lock.  We need to prevent access
   1249 	 * to the tcpcb as it's half torn down.  Flag the pcb as dead
   1250 	 * (prevents access by timers) and only then detach it.
   1251 	 */
   1252 	tp->t_flags |= TF_DEAD;
   1253 	if (inp) {
   1254 		inp->inp_ppcb = 0;
   1255 		soisdisconnected(so);
   1256 		in_pcbdetach(inp);
   1257 	}
   1258 #ifdef INET6
   1259 	else if (in6p) {
   1260 		in6p->in6p_ppcb = 0;
   1261 		soisdisconnected(so);
   1262 		in6_pcbdetach(in6p);
   1263 	}
   1264 #endif
   1265 	/*
   1266 	 * pcb is no longer visble elsewhere, so we can safely release
   1267 	 * the lock in callout_halt() if needed.
   1268 	 */
   1269 	TCP_STATINC(TCP_STAT_CLOSED);
   1270 	for (j = 0; j < TCPT_NTIMERS; j++) {
   1271 		callout_halt(&tp->t_timer[j], softnet_lock);
   1272 		callout_destroy(&tp->t_timer[j]);
   1273 	}
   1274 	callout_halt(&tp->t_delack_ch, softnet_lock);
   1275 	callout_destroy(&tp->t_delack_ch);
   1276 	pool_put(&tcpcb_pool, tp);
   1277 
   1278 	return ((struct tcpcb *)0);
   1279 }
   1280 
   1281 int
   1282 tcp_freeq(struct tcpcb *tp)
   1283 {
   1284 	struct ipqent *qe;
   1285 	int rv = 0;
   1286 #ifdef TCPREASS_DEBUG
   1287 	int i = 0;
   1288 #endif
   1289 
   1290 	TCP_REASS_LOCK_CHECK(tp);
   1291 
   1292 	while ((qe = TAILQ_FIRST(&tp->segq)) != NULL) {
   1293 #ifdef TCPREASS_DEBUG
   1294 		printf("tcp_freeq[%p,%d]: %u:%u(%u) 0x%02x\n",
   1295 			tp, i++, qe->ipqe_seq, qe->ipqe_seq + qe->ipqe_len,
   1296 			qe->ipqe_len, qe->ipqe_flags & (TH_SYN|TH_FIN|TH_RST));
   1297 #endif
   1298 		TAILQ_REMOVE(&tp->segq, qe, ipqe_q);
   1299 		TAILQ_REMOVE(&tp->timeq, qe, ipqe_timeq);
   1300 		m_freem(qe->ipqe_m);
   1301 		tcpipqent_free(qe);
   1302 		rv = 1;
   1303 	}
   1304 	tp->t_segqlen = 0;
   1305 	KASSERT(TAILQ_EMPTY(&tp->timeq));
   1306 	return (rv);
   1307 }
   1308 
   1309 void
   1310 tcp_fasttimo(void)
   1311 {
   1312 	if (tcp_drainwanted) {
   1313 		tcp_drain();
   1314 		tcp_drainwanted = 0;
   1315 	}
   1316 }
   1317 
   1318 void
   1319 tcp_drainstub(void)
   1320 {
   1321 	tcp_drainwanted = 1;
   1322 }
   1323 
   1324 /*
   1325  * Protocol drain routine.  Called when memory is in short supply.
   1326  * Called from pr_fasttimo thus a callout context.
   1327  */
   1328 void
   1329 tcp_drain(void)
   1330 {
   1331 	struct inpcb_hdr *inph;
   1332 	struct tcpcb *tp;
   1333 
   1334 	mutex_enter(softnet_lock);
   1335 	KERNEL_LOCK(1, NULL);
   1336 
   1337 	/*
   1338 	 * Free the sequence queue of all TCP connections.
   1339 	 */
   1340 	CIRCLEQ_FOREACH(inph, &tcbtable.inpt_queue, inph_queue) {
   1341 		switch (inph->inph_af) {
   1342 		case AF_INET:
   1343 			tp = intotcpcb((struct inpcb *)inph);
   1344 			break;
   1345 #ifdef INET6
   1346 		case AF_INET6:
   1347 			tp = in6totcpcb((struct in6pcb *)inph);
   1348 			break;
   1349 #endif
   1350 		default:
   1351 			tp = NULL;
   1352 			break;
   1353 		}
   1354 		if (tp != NULL) {
   1355 			/*
   1356 			 * We may be called from a device's interrupt
   1357 			 * context.  If the tcpcb is already busy,
   1358 			 * just bail out now.
   1359 			 */
   1360 			if (tcp_reass_lock_try(tp) == 0)
   1361 				continue;
   1362 			if (tcp_freeq(tp))
   1363 				TCP_STATINC(TCP_STAT_CONNSDRAINED);
   1364 			TCP_REASS_UNLOCK(tp);
   1365 		}
   1366 	}
   1367 
   1368 	KERNEL_UNLOCK_ONE(NULL);
   1369 	mutex_exit(softnet_lock);
   1370 }
   1371 
   1372 /*
   1373  * Notify a tcp user of an asynchronous error;
   1374  * store error as soft error, but wake up user
   1375  * (for now, won't do anything until can select for soft error).
   1376  */
   1377 void
   1378 tcp_notify(struct inpcb *inp, int error)
   1379 {
   1380 	struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
   1381 	struct socket *so = inp->inp_socket;
   1382 
   1383 	/*
   1384 	 * Ignore some errors if we are hooked up.
   1385 	 * If connection hasn't completed, has retransmitted several times,
   1386 	 * and receives a second error, give up now.  This is better
   1387 	 * than waiting a long time to establish a connection that
   1388 	 * can never complete.
   1389 	 */
   1390 	if (tp->t_state == TCPS_ESTABLISHED &&
   1391 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
   1392 	      error == EHOSTDOWN)) {
   1393 		return;
   1394 	} else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
   1395 	    tp->t_rxtshift > 3 && tp->t_softerror)
   1396 		so->so_error = error;
   1397 	else
   1398 		tp->t_softerror = error;
   1399 	cv_broadcast(&so->so_cv);
   1400 	sorwakeup(so);
   1401 	sowwakeup(so);
   1402 }
   1403 
   1404 #ifdef INET6
   1405 void
   1406 tcp6_notify(struct in6pcb *in6p, int error)
   1407 {
   1408 	struct tcpcb *tp = (struct tcpcb *)in6p->in6p_ppcb;
   1409 	struct socket *so = in6p->in6p_socket;
   1410 
   1411 	/*
   1412 	 * Ignore some errors if we are hooked up.
   1413 	 * If connection hasn't completed, has retransmitted several times,
   1414 	 * and receives a second error, give up now.  This is better
   1415 	 * than waiting a long time to establish a connection that
   1416 	 * can never complete.
   1417 	 */
   1418 	if (tp->t_state == TCPS_ESTABLISHED &&
   1419 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
   1420 	      error == EHOSTDOWN)) {
   1421 		return;
   1422 	} else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
   1423 	    tp->t_rxtshift > 3 && tp->t_softerror)
   1424 		so->so_error = error;
   1425 	else
   1426 		tp->t_softerror = error;
   1427 	cv_broadcast(&so->so_cv);
   1428 	sorwakeup(so);
   1429 	sowwakeup(so);
   1430 }
   1431 #endif
   1432 
   1433 #ifdef INET6
   1434 void *
   1435 tcp6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
   1436 {
   1437 	struct tcphdr th;
   1438 	void (*notify)(struct in6pcb *, int) = tcp6_notify;
   1439 	int nmatch;
   1440 	struct ip6_hdr *ip6;
   1441 	const struct sockaddr_in6 *sa6_src = NULL;
   1442 	const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
   1443 	struct mbuf *m;
   1444 	int off;
   1445 
   1446 	if (sa->sa_family != AF_INET6 ||
   1447 	    sa->sa_len != sizeof(struct sockaddr_in6))
   1448 		return NULL;
   1449 	if ((unsigned)cmd >= PRC_NCMDS)
   1450 		return NULL;
   1451 	else if (cmd == PRC_QUENCH) {
   1452 		/*
   1453 		 * Don't honor ICMP Source Quench messages meant for
   1454 		 * TCP connections.
   1455 		 */
   1456 		return NULL;
   1457 	} else if (PRC_IS_REDIRECT(cmd))
   1458 		notify = in6_rtchange, d = NULL;
   1459 	else if (cmd == PRC_MSGSIZE)
   1460 		; /* special code is present, see below */
   1461 	else if (cmd == PRC_HOSTDEAD)
   1462 		d = NULL;
   1463 	else if (inet6ctlerrmap[cmd] == 0)
   1464 		return NULL;
   1465 
   1466 	/* if the parameter is from icmp6, decode it. */
   1467 	if (d != NULL) {
   1468 		struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
   1469 		m = ip6cp->ip6c_m;
   1470 		ip6 = ip6cp->ip6c_ip6;
   1471 		off = ip6cp->ip6c_off;
   1472 		sa6_src = ip6cp->ip6c_src;
   1473 	} else {
   1474 		m = NULL;
   1475 		ip6 = NULL;
   1476 		sa6_src = &sa6_any;
   1477 		off = 0;
   1478 	}
   1479 
   1480 	if (ip6) {
   1481 		/*
   1482 		 * XXX: We assume that when ip6 is non NULL,
   1483 		 * M and OFF are valid.
   1484 		 */
   1485 
   1486 		/* check if we can safely examine src and dst ports */
   1487 		if (m->m_pkthdr.len < off + sizeof(th)) {
   1488 			if (cmd == PRC_MSGSIZE)
   1489 				icmp6_mtudisc_update((struct ip6ctlparam *)d, 0);
   1490 			return NULL;
   1491 		}
   1492 
   1493 		memset(&th, 0, sizeof(th));
   1494 		m_copydata(m, off, sizeof(th), (void *)&th);
   1495 
   1496 		if (cmd == PRC_MSGSIZE) {
   1497 			int valid = 0;
   1498 
   1499 			/*
   1500 			 * Check to see if we have a valid TCP connection
   1501 			 * corresponding to the address in the ICMPv6 message
   1502 			 * payload.
   1503 			 */
   1504 			if (in6_pcblookup_connect(&tcbtable, &sa6->sin6_addr,
   1505 			    th.th_dport,
   1506 			    (const struct in6_addr *)&sa6_src->sin6_addr,
   1507 						  th.th_sport, 0, 0))
   1508 				valid++;
   1509 
   1510 			/*
   1511 			 * Depending on the value of "valid" and routing table
   1512 			 * size (mtudisc_{hi,lo}wat), we will:
   1513 			 * - recalcurate the new MTU and create the
   1514 			 *   corresponding routing entry, or
   1515 			 * - ignore the MTU change notification.
   1516 			 */
   1517 			icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
   1518 
   1519 			/*
   1520 			 * no need to call in6_pcbnotify, it should have been
   1521 			 * called via callback if necessary
   1522 			 */
   1523 			return NULL;
   1524 		}
   1525 
   1526 		nmatch = in6_pcbnotify(&tcbtable, sa, th.th_dport,
   1527 		    (const struct sockaddr *)sa6_src, th.th_sport, cmd, NULL, notify);
   1528 		if (nmatch == 0 && syn_cache_count &&
   1529 		    (inet6ctlerrmap[cmd] == EHOSTUNREACH ||
   1530 		     inet6ctlerrmap[cmd] == ENETUNREACH ||
   1531 		     inet6ctlerrmap[cmd] == EHOSTDOWN))
   1532 			syn_cache_unreach((const struct sockaddr *)sa6_src,
   1533 					  sa, &th);
   1534 	} else {
   1535 		(void) in6_pcbnotify(&tcbtable, sa, 0,
   1536 		    (const struct sockaddr *)sa6_src, 0, cmd, NULL, notify);
   1537 	}
   1538 
   1539 	return NULL;
   1540 }
   1541 #endif
   1542 
   1543 #ifdef INET
   1544 /* assumes that ip header and tcp header are contiguous on mbuf */
   1545 void *
   1546 tcp_ctlinput(int cmd, const struct sockaddr *sa, void *v)
   1547 {
   1548 	struct ip *ip = v;
   1549 	struct tcphdr *th;
   1550 	struct icmp *icp;
   1551 	extern const int inetctlerrmap[];
   1552 	void (*notify)(struct inpcb *, int) = tcp_notify;
   1553 	int errno;
   1554 	int nmatch;
   1555 	struct tcpcb *tp;
   1556 	u_int mtu;
   1557 	tcp_seq seq;
   1558 	struct inpcb *inp;
   1559 #ifdef INET6
   1560 	struct in6pcb *in6p;
   1561 	struct in6_addr src6, dst6;
   1562 #endif
   1563 
   1564 	if (sa->sa_family != AF_INET ||
   1565 	    sa->sa_len != sizeof(struct sockaddr_in))
   1566 		return NULL;
   1567 	if ((unsigned)cmd >= PRC_NCMDS)
   1568 		return NULL;
   1569 	errno = inetctlerrmap[cmd];
   1570 	if (cmd == PRC_QUENCH)
   1571 		/*
   1572 		 * Don't honor ICMP Source Quench messages meant for
   1573 		 * TCP connections.
   1574 		 */
   1575 		return NULL;
   1576 	else if (PRC_IS_REDIRECT(cmd))
   1577 		notify = in_rtchange, ip = 0;
   1578 	else if (cmd == PRC_MSGSIZE && ip && ip->ip_v == 4) {
   1579 		/*
   1580 		 * Check to see if we have a valid TCP connection
   1581 		 * corresponding to the address in the ICMP message
   1582 		 * payload.
   1583 		 *
   1584 		 * Boundary check is made in icmp_input(), with ICMP_ADVLENMIN.
   1585 		 */
   1586 		th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2));
   1587 #ifdef INET6
   1588 		memset(&src6, 0, sizeof(src6));
   1589 		memset(&dst6, 0, sizeof(dst6));
   1590 		src6.s6_addr16[5] = dst6.s6_addr16[5] = 0xffff;
   1591 		memcpy(&src6.s6_addr32[3], &ip->ip_src, sizeof(struct in_addr));
   1592 		memcpy(&dst6.s6_addr32[3], &ip->ip_dst, sizeof(struct in_addr));
   1593 #endif
   1594 		if ((inp = in_pcblookup_connect(&tcbtable, ip->ip_dst,
   1595 						th->th_dport, ip->ip_src, th->th_sport, 0)) != NULL)
   1596 #ifdef INET6
   1597 			in6p = NULL;
   1598 #else
   1599 			;
   1600 #endif
   1601 #ifdef INET6
   1602 		else if ((in6p = in6_pcblookup_connect(&tcbtable, &dst6,
   1603 						       th->th_dport, &src6, th->th_sport, 0, 0)) != NULL)
   1604 			;
   1605 #endif
   1606 		else
   1607 			return NULL;
   1608 
   1609 		/*
   1610 		 * Now that we've validated that we are actually communicating
   1611 		 * with the host indicated in the ICMP message, locate the
   1612 		 * ICMP header, recalculate the new MTU, and create the
   1613 		 * corresponding routing entry.
   1614 		 */
   1615 		icp = (struct icmp *)((char *)ip -
   1616 		    offsetof(struct icmp, icmp_ip));
   1617 		if (inp) {
   1618 			if ((tp = intotcpcb(inp)) == NULL)
   1619 				return NULL;
   1620 		}
   1621 #ifdef INET6
   1622 		else if (in6p) {
   1623 			if ((tp = in6totcpcb(in6p)) == NULL)
   1624 				return NULL;
   1625 		}
   1626 #endif
   1627 		else
   1628 			return NULL;
   1629 		seq = ntohl(th->th_seq);
   1630 		if (SEQ_LT(seq, tp->snd_una) || SEQ_GT(seq, tp->snd_max))
   1631 			return NULL;
   1632 		/*
   1633 		 * If the ICMP message advertises a Next-Hop MTU
   1634 		 * equal or larger than the maximum packet size we have
   1635 		 * ever sent, drop the message.
   1636 		 */
   1637 		mtu = (u_int)ntohs(icp->icmp_nextmtu);
   1638 		if (mtu >= tp->t_pmtud_mtu_sent)
   1639 			return NULL;
   1640 		if (mtu >= tcp_hdrsz(tp) + tp->t_pmtud_mss_acked) {
   1641 			/*
   1642 			 * Calculate new MTU, and create corresponding
   1643 			 * route (traditional PMTUD).
   1644 			 */
   1645 			tp->t_flags &= ~TF_PMTUD_PEND;
   1646 			icmp_mtudisc(icp, ip->ip_dst);
   1647 		} else {
   1648 			/*
   1649 			 * Record the information got in the ICMP
   1650 			 * message; act on it later.
   1651 			 * If we had already recorded an ICMP message,
   1652 			 * replace the old one only if the new message
   1653 			 * refers to an older TCP segment
   1654 			 */
   1655 			if (tp->t_flags & TF_PMTUD_PEND) {
   1656 				if (SEQ_LT(tp->t_pmtud_th_seq, seq))
   1657 					return NULL;
   1658 			} else
   1659 				tp->t_flags |= TF_PMTUD_PEND;
   1660 			tp->t_pmtud_th_seq = seq;
   1661 			tp->t_pmtud_nextmtu = icp->icmp_nextmtu;
   1662 			tp->t_pmtud_ip_len = icp->icmp_ip.ip_len;
   1663 			tp->t_pmtud_ip_hl = icp->icmp_ip.ip_hl;
   1664 		}
   1665 		return NULL;
   1666 	} else if (cmd == PRC_HOSTDEAD)
   1667 		ip = 0;
   1668 	else if (errno == 0)
   1669 		return NULL;
   1670 	if (ip && ip->ip_v == 4 && sa->sa_family == AF_INET) {
   1671 		th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2));
   1672 		nmatch = in_pcbnotify(&tcbtable, satocsin(sa)->sin_addr,
   1673 		    th->th_dport, ip->ip_src, th->th_sport, errno, notify);
   1674 		if (nmatch == 0 && syn_cache_count &&
   1675 		    (inetctlerrmap[cmd] == EHOSTUNREACH ||
   1676 		    inetctlerrmap[cmd] == ENETUNREACH ||
   1677 		    inetctlerrmap[cmd] == EHOSTDOWN)) {
   1678 			struct sockaddr_in sin;
   1679 			memset(&sin, 0, sizeof(sin));
   1680 			sin.sin_len = sizeof(sin);
   1681 			sin.sin_family = AF_INET;
   1682 			sin.sin_port = th->th_sport;
   1683 			sin.sin_addr = ip->ip_src;
   1684 			syn_cache_unreach((struct sockaddr *)&sin, sa, th);
   1685 		}
   1686 
   1687 		/* XXX mapped address case */
   1688 	} else
   1689 		in_pcbnotifyall(&tcbtable, satocsin(sa)->sin_addr, errno,
   1690 		    notify);
   1691 	return NULL;
   1692 }
   1693 
   1694 /*
   1695  * When a source quench is received, we are being notified of congestion.
   1696  * Close the congestion window down to the Loss Window (one segment).
   1697  * We will gradually open it again as we proceed.
   1698  */
   1699 void
   1700 tcp_quench(struct inpcb *inp, int errno)
   1701 {
   1702 	struct tcpcb *tp = intotcpcb(inp);
   1703 
   1704 	if (tp) {
   1705 		tp->snd_cwnd = tp->t_segsz;
   1706 		tp->t_bytes_acked = 0;
   1707 	}
   1708 }
   1709 #endif
   1710 
   1711 #ifdef INET6
   1712 void
   1713 tcp6_quench(struct in6pcb *in6p, int errno)
   1714 {
   1715 	struct tcpcb *tp = in6totcpcb(in6p);
   1716 
   1717 	if (tp) {
   1718 		tp->snd_cwnd = tp->t_segsz;
   1719 		tp->t_bytes_acked = 0;
   1720 	}
   1721 }
   1722 #endif
   1723 
   1724 #ifdef INET
   1725 /*
   1726  * Path MTU Discovery handlers.
   1727  */
   1728 void
   1729 tcp_mtudisc_callback(struct in_addr faddr)
   1730 {
   1731 #ifdef INET6
   1732 	struct in6_addr in6;
   1733 #endif
   1734 
   1735 	in_pcbnotifyall(&tcbtable, faddr, EMSGSIZE, tcp_mtudisc);
   1736 #ifdef INET6
   1737 	memset(&in6, 0, sizeof(in6));
   1738 	in6.s6_addr16[5] = 0xffff;
   1739 	memcpy(&in6.s6_addr32[3], &faddr, sizeof(struct in_addr));
   1740 	tcp6_mtudisc_callback(&in6);
   1741 #endif
   1742 }
   1743 
   1744 /*
   1745  * On receipt of path MTU corrections, flush old route and replace it
   1746  * with the new one.  Retransmit all unacknowledged packets, to ensure
   1747  * that all packets will be received.
   1748  */
   1749 void
   1750 tcp_mtudisc(struct inpcb *inp, int errno)
   1751 {
   1752 	struct tcpcb *tp = intotcpcb(inp);
   1753 	struct rtentry *rt = in_pcbrtentry(inp);
   1754 
   1755 	if (tp != 0) {
   1756 		if (rt != 0) {
   1757 			/*
   1758 			 * If this was not a host route, remove and realloc.
   1759 			 */
   1760 			if ((rt->rt_flags & RTF_HOST) == 0) {
   1761 				in_rtchange(inp, errno);
   1762 				if ((rt = in_pcbrtentry(inp)) == 0)
   1763 					return;
   1764 			}
   1765 
   1766 			/*
   1767 			 * Slow start out of the error condition.  We
   1768 			 * use the MTU because we know it's smaller
   1769 			 * than the previously transmitted segment.
   1770 			 *
   1771 			 * Note: This is more conservative than the
   1772 			 * suggestion in draft-floyd-incr-init-win-03.
   1773 			 */
   1774 			if (rt->rt_rmx.rmx_mtu != 0)
   1775 				tp->snd_cwnd =
   1776 				    TCP_INITIAL_WINDOW(tcp_init_win,
   1777 				    rt->rt_rmx.rmx_mtu);
   1778 		}
   1779 
   1780 		/*
   1781 		 * Resend unacknowledged packets.
   1782 		 */
   1783 		tp->snd_nxt = tp->sack_newdata = tp->snd_una;
   1784 		tcp_output(tp);
   1785 	}
   1786 }
   1787 #endif
   1788 
   1789 #ifdef INET6
   1790 /*
   1791  * Path MTU Discovery handlers.
   1792  */
   1793 void
   1794 tcp6_mtudisc_callback(struct in6_addr *faddr)
   1795 {
   1796 	struct sockaddr_in6 sin6;
   1797 
   1798 	memset(&sin6, 0, sizeof(sin6));
   1799 	sin6.sin6_family = AF_INET6;
   1800 	sin6.sin6_len = sizeof(struct sockaddr_in6);
   1801 	sin6.sin6_addr = *faddr;
   1802 	(void) in6_pcbnotify(&tcbtable, (struct sockaddr *)&sin6, 0,
   1803 	    (const struct sockaddr *)&sa6_any, 0, PRC_MSGSIZE, NULL, tcp6_mtudisc);
   1804 }
   1805 
   1806 void
   1807 tcp6_mtudisc(struct in6pcb *in6p, int errno)
   1808 {
   1809 	struct tcpcb *tp = in6totcpcb(in6p);
   1810 	struct rtentry *rt = in6_pcbrtentry(in6p);
   1811 
   1812 	if (tp != 0) {
   1813 		if (rt != 0) {
   1814 			/*
   1815 			 * If this was not a host route, remove and realloc.
   1816 			 */
   1817 			if ((rt->rt_flags & RTF_HOST) == 0) {
   1818 				in6_rtchange(in6p, errno);
   1819 				if ((rt = in6_pcbrtentry(in6p)) == 0)
   1820 					return;
   1821 			}
   1822 
   1823 			/*
   1824 			 * Slow start out of the error condition.  We
   1825 			 * use the MTU because we know it's smaller
   1826 			 * than the previously transmitted segment.
   1827 			 *
   1828 			 * Note: This is more conservative than the
   1829 			 * suggestion in draft-floyd-incr-init-win-03.
   1830 			 */
   1831 			if (rt->rt_rmx.rmx_mtu != 0)
   1832 				tp->snd_cwnd =
   1833 				    TCP_INITIAL_WINDOW(tcp_init_win,
   1834 				    rt->rt_rmx.rmx_mtu);
   1835 		}
   1836 
   1837 		/*
   1838 		 * Resend unacknowledged packets.
   1839 		 */
   1840 		tp->snd_nxt = tp->sack_newdata = tp->snd_una;
   1841 		tcp_output(tp);
   1842 	}
   1843 }
   1844 #endif /* INET6 */
   1845 
   1846 /*
   1847  * Compute the MSS to advertise to the peer.  Called only during
   1848  * the 3-way handshake.  If we are the server (peer initiated
   1849  * connection), we are called with a pointer to the interface
   1850  * on which the SYN packet arrived.  If we are the client (we
   1851  * initiated connection), we are called with a pointer to the
   1852  * interface out which this connection should go.
   1853  *
   1854  * NOTE: Do not subtract IP option/extension header size nor IPsec
   1855  * header size from MSS advertisement.  MSS option must hold the maximum
   1856  * segment size we can accept, so it must always be:
   1857  *	 max(if mtu) - ip header - tcp header
   1858  */
   1859 u_long
   1860 tcp_mss_to_advertise(const struct ifnet *ifp, int af)
   1861 {
   1862 	extern u_long in_maxmtu;
   1863 	u_long mss = 0;
   1864 	u_long hdrsiz;
   1865 
   1866 	/*
   1867 	 * In order to avoid defeating path MTU discovery on the peer,
   1868 	 * we advertise the max MTU of all attached networks as our MSS,
   1869 	 * per RFC 1191, section 3.1.
   1870 	 *
   1871 	 * We provide the option to advertise just the MTU of
   1872 	 * the interface on which we hope this connection will
   1873 	 * be receiving.  If we are responding to a SYN, we
   1874 	 * will have a pretty good idea about this, but when
   1875 	 * initiating a connection there is a bit more doubt.
   1876 	 *
   1877 	 * We also need to ensure that loopback has a large enough
   1878 	 * MSS, as the loopback MTU is never included in in_maxmtu.
   1879 	 */
   1880 
   1881 	if (ifp != NULL)
   1882 		switch (af) {
   1883 		case AF_INET:
   1884 			mss = ifp->if_mtu;
   1885 			break;
   1886 #ifdef INET6
   1887 		case AF_INET6:
   1888 			mss = IN6_LINKMTU(ifp);
   1889 			break;
   1890 #endif
   1891 		}
   1892 
   1893 	if (tcp_mss_ifmtu == 0)
   1894 		switch (af) {
   1895 		case AF_INET:
   1896 			mss = max(in_maxmtu, mss);
   1897 			break;
   1898 #ifdef INET6
   1899 		case AF_INET6:
   1900 			mss = max(in6_maxmtu, mss);
   1901 			break;
   1902 #endif
   1903 		}
   1904 
   1905 	switch (af) {
   1906 	case AF_INET:
   1907 		hdrsiz = sizeof(struct ip);
   1908 		break;
   1909 #ifdef INET6
   1910 	case AF_INET6:
   1911 		hdrsiz = sizeof(struct ip6_hdr);
   1912 		break;
   1913 #endif
   1914 	default:
   1915 		hdrsiz = 0;
   1916 		break;
   1917 	}
   1918 	hdrsiz += sizeof(struct tcphdr);
   1919 	if (mss > hdrsiz)
   1920 		mss -= hdrsiz;
   1921 
   1922 	mss = max(tcp_mssdflt, mss);
   1923 	return (mss);
   1924 }
   1925 
   1926 /*
   1927  * Set connection variables based on the peer's advertised MSS.
   1928  * We are passed the TCPCB for the actual connection.  If we
   1929  * are the server, we are called by the compressed state engine
   1930  * when the 3-way handshake is complete.  If we are the client,
   1931  * we are called when we receive the SYN,ACK from the server.
   1932  *
   1933  * NOTE: Our advertised MSS value must be initialized in the TCPCB
   1934  * before this routine is called!
   1935  */
   1936 void
   1937 tcp_mss_from_peer(struct tcpcb *tp, int offer)
   1938 {
   1939 	struct socket *so;
   1940 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1941 	struct rtentry *rt;
   1942 #endif
   1943 	u_long bufsize;
   1944 	int mss;
   1945 
   1946 #ifdef DIAGNOSTIC
   1947 	if (tp->t_inpcb && tp->t_in6pcb)
   1948 		panic("tcp_mss_from_peer: both t_inpcb and t_in6pcb are set");
   1949 #endif
   1950 	so = NULL;
   1951 	rt = NULL;
   1952 #ifdef INET
   1953 	if (tp->t_inpcb) {
   1954 		so = tp->t_inpcb->inp_socket;
   1955 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1956 		rt = in_pcbrtentry(tp->t_inpcb);
   1957 #endif
   1958 	}
   1959 #endif
   1960 #ifdef INET6
   1961 	if (tp->t_in6pcb) {
   1962 		so = tp->t_in6pcb->in6p_socket;
   1963 #if defined(RTV_SPIPE) || defined(RTV_SSTHRESH)
   1964 		rt = in6_pcbrtentry(tp->t_in6pcb);
   1965 #endif
   1966 	}
   1967 #endif
   1968 
   1969 	/*
   1970 	 * As per RFC1122, use the default MSS value, unless they
   1971 	 * sent us an offer.  Do not accept offers less than 256 bytes.
   1972 	 */
   1973 	mss = tcp_mssdflt;
   1974 	if (offer)
   1975 		mss = offer;
   1976 	mss = max(mss, 256);		/* sanity */
   1977 	tp->t_peermss = mss;
   1978 	mss -= tcp_optlen(tp);
   1979 #ifdef INET
   1980 	if (tp->t_inpcb)
   1981 		mss -= ip_optlen(tp->t_inpcb);
   1982 #endif
   1983 #ifdef INET6
   1984 	if (tp->t_in6pcb)
   1985 		mss -= ip6_optlen(tp->t_in6pcb);
   1986 #endif
   1987 
   1988 	/*
   1989 	 * If there's a pipesize, change the socket buffer to that size.
   1990 	 * Make the socket buffer an integral number of MSS units.  If
   1991 	 * the MSS is larger than the socket buffer, artificially decrease
   1992 	 * the MSS.
   1993 	 */
   1994 #ifdef RTV_SPIPE
   1995 	if (rt != NULL && rt->rt_rmx.rmx_sendpipe != 0)
   1996 		bufsize = rt->rt_rmx.rmx_sendpipe;
   1997 	else
   1998 #endif
   1999 	{
   2000 		KASSERT(so != NULL);
   2001 		bufsize = so->so_snd.sb_hiwat;
   2002 	}
   2003 	if (bufsize < mss)
   2004 		mss = bufsize;
   2005 	else {
   2006 		bufsize = roundup(bufsize, mss);
   2007 		if (bufsize > sb_max)
   2008 			bufsize = sb_max;
   2009 		(void) sbreserve(&so->so_snd, bufsize, so);
   2010 	}
   2011 	tp->t_segsz = mss;
   2012 
   2013 #ifdef RTV_SSTHRESH
   2014 	if (rt != NULL && rt->rt_rmx.rmx_ssthresh) {
   2015 		/*
   2016 		 * There's some sort of gateway or interface buffer
   2017 		 * limit on the path.  Use this to set the slow
   2018 		 * start threshold, but set the threshold to no less
   2019 		 * than 2 * MSS.
   2020 		 */
   2021 		tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
   2022 	}
   2023 #endif
   2024 }
   2025 
   2026 /*
   2027  * Processing necessary when a TCP connection is established.
   2028  */
   2029 void
   2030 tcp_established(struct tcpcb *tp)
   2031 {
   2032 	struct socket *so;
   2033 #ifdef RTV_RPIPE
   2034 	struct rtentry *rt;
   2035 #endif
   2036 	u_long bufsize;
   2037 
   2038 #ifdef DIAGNOSTIC
   2039 	if (tp->t_inpcb && tp->t_in6pcb)
   2040 		panic("tcp_established: both t_inpcb and t_in6pcb are set");
   2041 #endif
   2042 	so = NULL;
   2043 	rt = NULL;
   2044 #ifdef INET
   2045 	/* This is a while() to reduce the dreadful stairstepping below */
   2046 	while (tp->t_inpcb) {
   2047 		so = tp->t_inpcb->inp_socket;
   2048 #if defined(RTV_RPIPE)
   2049 		rt = in_pcbrtentry(tp->t_inpcb);
   2050 #endif
   2051 		if (__predict_true(tcp_msl_enable)) {
   2052 			if (tp->t_inpcb->inp_laddr.s_addr == INADDR_LOOPBACK) {
   2053 				tp->t_msl = tcp_msl_loop ? tcp_msl_loop : (TCPTV_MSL >> 2);
   2054 				break;
   2055 			}
   2056 
   2057 			if (__predict_false(tcp_rttlocal)) {
   2058 				/* This may be adjusted by tcp_input */
   2059 				tp->t_msl = tcp_msl_local ? tcp_msl_local : (TCPTV_MSL >> 1);
   2060 				break;
   2061 			}
   2062 			if (in_localaddr(tp->t_inpcb->inp_faddr)) {
   2063 				tp->t_msl = tcp_msl_local ? tcp_msl_local : (TCPTV_MSL >> 1);
   2064 				break;
   2065 			}
   2066 		}
   2067 		tp->t_msl = tcp_msl_remote ? tcp_msl_remote : TCPTV_MSL;
   2068 		break;
   2069 	}
   2070 #endif
   2071 #ifdef INET6
   2072 	/* The !tp->t_inpcb lets the compiler know it can't be v4 *and* v6 */
   2073 	while (!tp->t_inpcb && tp->t_in6pcb) {
   2074 		so = tp->t_in6pcb->in6p_socket;
   2075 #if defined(RTV_RPIPE)
   2076 		rt = in6_pcbrtentry(tp->t_in6pcb);
   2077 #endif
   2078 		if (__predict_true(tcp_msl_enable)) {
   2079 			extern const struct in6_addr in6addr_loopback;
   2080 
   2081 			if (IN6_ARE_ADDR_EQUAL(&tp->t_in6pcb->in6p_laddr,
   2082 					       &in6addr_loopback)) {
   2083 				tp->t_msl = tcp_msl_loop ? tcp_msl_loop : (TCPTV_MSL >> 2);
   2084 				break;
   2085 			}
   2086 
   2087 			if (__predict_false(tcp_rttlocal)) {
   2088 				/* This may be adjusted by tcp_input */
   2089 				tp->t_msl = tcp_msl_local ? tcp_msl_local : (TCPTV_MSL >> 1);
   2090 				break;
   2091 			}
   2092 			if (in6_localaddr(&tp->t_in6pcb->in6p_faddr)) {
   2093 				tp->t_msl = tcp_msl_local ? tcp_msl_local : (TCPTV_MSL >> 1);
   2094 				break;
   2095 			}
   2096 		}
   2097 		tp->t_msl = tcp_msl_remote ? tcp_msl_remote : TCPTV_MSL;
   2098 		break;
   2099 	}
   2100 #endif
   2101 
   2102 	tp->t_state = TCPS_ESTABLISHED;
   2103 	TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
   2104 
   2105 #ifdef RTV_RPIPE
   2106 	if (rt != NULL && rt->rt_rmx.rmx_recvpipe != 0)
   2107 		bufsize = rt->rt_rmx.rmx_recvpipe;
   2108 	else
   2109 #endif
   2110 	{
   2111 		KASSERT(so != NULL);
   2112 		bufsize = so->so_rcv.sb_hiwat;
   2113 	}
   2114 	if (bufsize > tp->t_ourmss) {
   2115 		bufsize = roundup(bufsize, tp->t_ourmss);
   2116 		if (bufsize > sb_max)
   2117 			bufsize = sb_max;
   2118 		(void) sbreserve(&so->so_rcv, bufsize, so);
   2119 	}
   2120 }
   2121 
   2122 /*
   2123  * Check if there's an initial rtt or rttvar.  Convert from the
   2124  * route-table units to scaled multiples of the slow timeout timer.
   2125  * Called only during the 3-way handshake.
   2126  */
   2127 void
   2128 tcp_rmx_rtt(struct tcpcb *tp)
   2129 {
   2130 #ifdef RTV_RTT
   2131 	struct rtentry *rt = NULL;
   2132 	int rtt;
   2133 
   2134 #ifdef DIAGNOSTIC
   2135 	if (tp->t_inpcb && tp->t_in6pcb)
   2136 		panic("tcp_rmx_rtt: both t_inpcb and t_in6pcb are set");
   2137 #endif
   2138 #ifdef INET
   2139 	if (tp->t_inpcb)
   2140 		rt = in_pcbrtentry(tp->t_inpcb);
   2141 #endif
   2142 #ifdef INET6
   2143 	if (tp->t_in6pcb)
   2144 		rt = in6_pcbrtentry(tp->t_in6pcb);
   2145 #endif
   2146 	if (rt == NULL)
   2147 		return;
   2148 
   2149 	if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
   2150 		/*
   2151 		 * XXX The lock bit for MTU indicates that the value
   2152 		 * is also a minimum value; this is subject to time.
   2153 		 */
   2154 		if (rt->rt_rmx.rmx_locks & RTV_RTT)
   2155 			TCPT_RANGESET(tp->t_rttmin,
   2156 			    rtt / (RTM_RTTUNIT / PR_SLOWHZ),
   2157 			    TCPTV_MIN, TCPTV_REXMTMAX);
   2158 		tp->t_srtt = rtt /
   2159 		    ((RTM_RTTUNIT / PR_SLOWHZ) >> (TCP_RTT_SHIFT + 2));
   2160 		if (rt->rt_rmx.rmx_rttvar) {
   2161 			tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
   2162 			    ((RTM_RTTUNIT / PR_SLOWHZ) >>
   2163 				(TCP_RTTVAR_SHIFT + 2));
   2164 		} else {
   2165 			/* Default variation is +- 1 rtt */
   2166 			tp->t_rttvar =
   2167 			    tp->t_srtt >> (TCP_RTT_SHIFT - TCP_RTTVAR_SHIFT);
   2168 		}
   2169 		TCPT_RANGESET(tp->t_rxtcur,
   2170 		    ((tp->t_srtt >> 2) + tp->t_rttvar) >> (1 + 2),
   2171 		    tp->t_rttmin, TCPTV_REXMTMAX);
   2172 	}
   2173 #endif
   2174 }
   2175 
   2176 tcp_seq	 tcp_iss_seq = 0;	/* tcp initial seq # */
   2177 u_int8_t tcp_iss_secret[16];	/* 128 bits; should be plenty */
   2178 
   2179 /*
   2180  * Get a new sequence value given a tcp control block
   2181  */
   2182 tcp_seq
   2183 tcp_new_iss(struct tcpcb *tp, tcp_seq addin)
   2184 {
   2185 
   2186 #ifdef INET
   2187 	if (tp->t_inpcb != NULL) {
   2188 		return (tcp_new_iss1(&tp->t_inpcb->inp_laddr,
   2189 		    &tp->t_inpcb->inp_faddr, tp->t_inpcb->inp_lport,
   2190 		    tp->t_inpcb->inp_fport, sizeof(tp->t_inpcb->inp_laddr),
   2191 		    addin));
   2192 	}
   2193 #endif
   2194 #ifdef INET6
   2195 	if (tp->t_in6pcb != NULL) {
   2196 		return (tcp_new_iss1(&tp->t_in6pcb->in6p_laddr,
   2197 		    &tp->t_in6pcb->in6p_faddr, tp->t_in6pcb->in6p_lport,
   2198 		    tp->t_in6pcb->in6p_fport, sizeof(tp->t_in6pcb->in6p_laddr),
   2199 		    addin));
   2200 	}
   2201 #endif
   2202 	/* Not possible. */
   2203 	panic("tcp_new_iss");
   2204 }
   2205 
   2206 /*
   2207  * This routine actually generates a new TCP initial sequence number.
   2208  */
   2209 tcp_seq
   2210 tcp_new_iss1(void *laddr, void *faddr, u_int16_t lport, u_int16_t fport,
   2211     size_t addrsz, tcp_seq addin)
   2212 {
   2213 	tcp_seq tcp_iss;
   2214 
   2215 	static bool tcp_iss_gotten_secret;
   2216 
   2217 	/*
   2218 	 * If we haven't been here before, initialize our cryptographic
   2219 	 * hash secret.
   2220 	 */
   2221 	if (tcp_iss_gotten_secret == false) {
   2222 		cprng_strong(kern_cprng,
   2223 			     tcp_iss_secret, sizeof(tcp_iss_secret), 0);
   2224 		tcp_iss_gotten_secret = true;
   2225 	}
   2226 
   2227 	if (tcp_do_rfc1948) {
   2228 		MD5_CTX ctx;
   2229 		u_int8_t hash[16];	/* XXX MD5 knowledge */
   2230 
   2231 		/*
   2232 		 * Compute the base value of the ISS.  It is a hash
   2233 		 * of (saddr, sport, daddr, dport, secret).
   2234 		 */
   2235 		MD5Init(&ctx);
   2236 
   2237 		MD5Update(&ctx, (u_char *) laddr, addrsz);
   2238 		MD5Update(&ctx, (u_char *) &lport, sizeof(lport));
   2239 
   2240 		MD5Update(&ctx, (u_char *) faddr, addrsz);
   2241 		MD5Update(&ctx, (u_char *) &fport, sizeof(fport));
   2242 
   2243 		MD5Update(&ctx, tcp_iss_secret, sizeof(tcp_iss_secret));
   2244 
   2245 		MD5Final(hash, &ctx);
   2246 
   2247 		memcpy(&tcp_iss, hash, sizeof(tcp_iss));
   2248 
   2249 		/*
   2250 		 * Now increment our "timer", and add it in to
   2251 		 * the computed value.
   2252 		 *
   2253 		 * XXX Use `addin'?
   2254 		 * XXX TCP_ISSINCR too large to use?
   2255 		 */
   2256 		tcp_iss_seq += TCP_ISSINCR;
   2257 #ifdef TCPISS_DEBUG
   2258 		printf("ISS hash 0x%08x, ", tcp_iss);
   2259 #endif
   2260 		tcp_iss += tcp_iss_seq + addin;
   2261 #ifdef TCPISS_DEBUG
   2262 		printf("new ISS 0x%08x\n", tcp_iss);
   2263 #endif
   2264 	} else {
   2265 		/*
   2266 		 * Randomize.
   2267 		 */
   2268 		tcp_iss = cprng_fast32();
   2269 
   2270 		/*
   2271 		 * If we were asked to add some amount to a known value,
   2272 		 * we will take a random value obtained above, mask off
   2273 		 * the upper bits, and add in the known value.  We also
   2274 		 * add in a constant to ensure that we are at least a
   2275 		 * certain distance from the original value.
   2276 		 *
   2277 		 * This is used when an old connection is in timed wait
   2278 		 * and we have a new one coming in, for instance.
   2279 		 */
   2280 		if (addin != 0) {
   2281 #ifdef TCPISS_DEBUG
   2282 			printf("Random %08x, ", tcp_iss);
   2283 #endif
   2284 			tcp_iss &= TCP_ISS_RANDOM_MASK;
   2285 			tcp_iss += addin + TCP_ISSINCR;
   2286 #ifdef TCPISS_DEBUG
   2287 			printf("Old ISS %08x, ISS %08x\n", addin, tcp_iss);
   2288 #endif
   2289 		} else {
   2290 			tcp_iss &= TCP_ISS_RANDOM_MASK;
   2291 			tcp_iss += tcp_iss_seq;
   2292 			tcp_iss_seq += TCP_ISSINCR;
   2293 #ifdef TCPISS_DEBUG
   2294 			printf("ISS %08x\n", tcp_iss);
   2295 #endif
   2296 		}
   2297 	}
   2298 
   2299 	if (tcp_compat_42) {
   2300 		/*
   2301 		 * Limit it to the positive range for really old TCP
   2302 		 * implementations.
   2303 		 * Just AND off the top bit instead of checking if
   2304 		 * is set first - saves a branch 50% of the time.
   2305 		 */
   2306 		tcp_iss &= 0x7fffffff;		/* XXX */
   2307 	}
   2308 
   2309 	return (tcp_iss);
   2310 }
   2311 
   2312 #if defined(IPSEC) || defined(FAST_IPSEC)
   2313 /* compute ESP/AH header size for TCP, including outer IP header. */
   2314 size_t
   2315 ipsec4_hdrsiz_tcp(struct tcpcb *tp)
   2316 {
   2317 	struct inpcb *inp;
   2318 	size_t hdrsiz;
   2319 
   2320 	/* XXX mapped addr case (tp->t_in6pcb) */
   2321 	if (!tp || !tp->t_template || !(inp = tp->t_inpcb))
   2322 		return 0;
   2323 	switch (tp->t_family) {
   2324 	case AF_INET:
   2325 		/* XXX: should use currect direction. */
   2326 		hdrsiz = ipsec4_hdrsiz(tp->t_template, IPSEC_DIR_OUTBOUND, inp);
   2327 		break;
   2328 	default:
   2329 		hdrsiz = 0;
   2330 		break;
   2331 	}
   2332 
   2333 	return hdrsiz;
   2334 }
   2335 
   2336 #ifdef INET6
   2337 size_t
   2338 ipsec6_hdrsiz_tcp(struct tcpcb *tp)
   2339 {
   2340 	struct in6pcb *in6p;
   2341 	size_t hdrsiz;
   2342 
   2343 	if (!tp || !tp->t_template || !(in6p = tp->t_in6pcb))
   2344 		return 0;
   2345 	switch (tp->t_family) {
   2346 	case AF_INET6:
   2347 		/* XXX: should use currect direction. */
   2348 		hdrsiz = ipsec6_hdrsiz(tp->t_template, IPSEC_DIR_OUTBOUND, in6p);
   2349 		break;
   2350 	case AF_INET:
   2351 		/* mapped address case - tricky */
   2352 	default:
   2353 		hdrsiz = 0;
   2354 		break;
   2355 	}
   2356 
   2357 	return hdrsiz;
   2358 }
   2359 #endif
   2360 #endif /*IPSEC*/
   2361 
   2362 /*
   2363  * Determine the length of the TCP options for this connection.
   2364  *
   2365  * XXX:  What do we do for SACK, when we add that?  Just reserve
   2366  *       all of the space?  Otherwise we can't exactly be incrementing
   2367  *       cwnd by an amount that varies depending on the amount we last
   2368  *       had to SACK!
   2369  */
   2370 
   2371 u_int
   2372 tcp_optlen(struct tcpcb *tp)
   2373 {
   2374 	u_int optlen;
   2375 
   2376 	optlen = 0;
   2377 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP|TF_NOOPT)) ==
   2378 	    (TF_REQ_TSTMP | TF_RCVD_TSTMP))
   2379 		optlen += TCPOLEN_TSTAMP_APPA;
   2380 
   2381 #ifdef TCP_SIGNATURE
   2382 	if (tp->t_flags & TF_SIGNATURE)
   2383 		optlen += TCPOLEN_SIGNATURE + 2;
   2384 #endif /* TCP_SIGNATURE */
   2385 
   2386 	return optlen;
   2387 }
   2388 
   2389 u_int
   2390 tcp_hdrsz(struct tcpcb *tp)
   2391 {
   2392 	u_int hlen;
   2393 
   2394 	switch (tp->t_family) {
   2395 #ifdef INET6
   2396 	case AF_INET6:
   2397 		hlen = sizeof(struct ip6_hdr);
   2398 		break;
   2399 #endif
   2400 	case AF_INET:
   2401 		hlen = sizeof(struct ip);
   2402 		break;
   2403 	default:
   2404 		hlen = 0;
   2405 		break;
   2406 	}
   2407 	hlen += sizeof(struct tcphdr);
   2408 
   2409 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
   2410 	    (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
   2411 		hlen += TCPOLEN_TSTAMP_APPA;
   2412 #ifdef TCP_SIGNATURE
   2413 	if (tp->t_flags & TF_SIGNATURE)
   2414 		hlen += TCPOLEN_SIGLEN;
   2415 #endif
   2416 	return hlen;
   2417 }
   2418 
   2419 void
   2420 tcp_statinc(u_int stat)
   2421 {
   2422 
   2423 	KASSERT(stat < TCP_NSTATS);
   2424 	TCP_STATINC(stat);
   2425 }
   2426 
   2427 void
   2428 tcp_statadd(u_int stat, uint64_t val)
   2429 {
   2430 
   2431 	KASSERT(stat < TCP_NSTATS);
   2432 	TCP_STATADD(stat, val);
   2433 }
   2434