xref: /openbsd-src/sys/netinet/tcp_output.c (revision 5085296bb5faabaae31b0407eb8609b83129861b)
1 /*	$OpenBSD: tcp_output.c,v 1.68 2004/05/31 20:04:44 brad Exp $	*/
2 /*	$NetBSD: tcp_output.c,v 1.16 1997/06/03 16:17:09 kml Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  * 	This product includes software developed by the University of
46  * 	California, Berkeley and its contributors.
47  * 	This product includes software developed at the Information
48  * 	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/kernel.h>
78 
79 #include <net/route.h>
80 #include <net/if.h>
81 
82 #include <netinet/in.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/ip.h>
85 #include <netinet/in_pcb.h>
86 #include <netinet/ip_var.h>
87 #include <netinet/tcp.h>
88 #define	TCPOUTFLAGS
89 #include <netinet/tcp_fsm.h>
90 #include <netinet/tcp_seq.h>
91 #include <netinet/tcp_timer.h>
92 #include <netinet/tcp_var.h>
93 #include <netinet/tcpip.h>
94 #include <netinet/tcp_debug.h>
95 
96 #ifdef TUBA
97 #include <netiso/iso.h>
98 #include <netiso/tuba_table.h>
99 #endif
100 
101 #ifdef INET6
102 #include <netinet6/tcpipv6.h>
103 #include <netinet6/in6_var.h>
104 #endif /* INET6 */
105 
106 #ifdef TCP_SIGNATURE
107 #include <crypto/md5.h>
108 #endif /* TCP_SIGNATURE */
109 
110 #ifdef notyet
111 extern struct mbuf *m_copypack();
112 #endif
113 
114 #ifdef TCP_SACK
115 extern int tcprexmtthresh;
116 #endif
117 
118 #ifdef TCP_SACK
119 #ifdef TCP_SACK_DEBUG
120 void tcp_print_holes(struct tcpcb *tp);
121 
122 void
123 tcp_print_holes(struct tcpcb *tp)
124 {
125 	struct sackhole *p = tp->snd_holes;
126 	if (p == 0)
127 		return;
128 	printf("Hole report: start--end dups rxmit\n");
129 	while (p) {
130 		printf("%x--%x d %d r %x\n", p->start, p->end, p->dups,
131 		    p->rxmit);
132 		p = p->next;
133 	}
134 	printf("\n");
135 }
136 #endif /* TCP_SACK_DEBUG */
137 
138 /*
139  * Returns pointer to a sackhole if there are any pending retransmissions;
140  * NULL otherwise.
141  */
142 struct sackhole *
143 tcp_sack_output(struct tcpcb *tp)
144 {
145 	struct sackhole *p;
146 
147 	if (!tp->sack_enable)
148 		return (NULL);
149 	p = tp->snd_holes;
150 	while (p) {
151 #ifndef TCP_FACK
152 		if (p->dups >= tcprexmtthresh && SEQ_LT(p->rxmit, p->end)) {
153 #else
154 		/* In FACK, if p->dups is less than tcprexmtthresh, but
155 		 * snd_fack advances more than tcprextmtthresh * tp->t_maxseg,
156 		 * tcp_input() will try fast retransmit. This forces output.
157 		 */
158 		if ((p->dups >= tcprexmtthresh ||
159 		     tp->t_dupacks == tcprexmtthresh) &&
160 		    SEQ_LT(p->rxmit, p->end)) {
161 #endif /* TCP_FACK */
162 			if (SEQ_LT(p->rxmit, tp->snd_una)) {/* old SACK hole */
163 				p = p->next;
164 				continue;
165 			}
166 #ifdef TCP_SACK_DEBUG
167 			if (p)
168 				tcp_print_holes(tp);
169 #endif
170 			return (p);
171 		}
172         	p = p->next;
173 	}
174 	return (NULL);
175 }
176 
177 /*
178  * After a timeout, the SACK list may be rebuilt.  This SACK information
179  * should be used to avoid retransmitting SACKed data.  This function
180  * traverses the SACK list to see if snd_nxt should be moved forward.
181  */
182 
183 void
184 tcp_sack_adjust(struct tcpcb *tp)
185 {
186 	struct sackhole *cur = tp->snd_holes;
187 	if (cur == NULL)
188 		return; /* No holes */
189 	if (SEQ_GEQ(tp->snd_nxt, tp->rcv_lastsack))
190 		return; /* We're already beyond any SACKed blocks */
191 	/*
192 	 * Two cases for which we want to advance snd_nxt:
193 	 * i) snd_nxt lies between end of one hole and beginning of another
194 	 * ii) snd_nxt lies between end of last hole and rcv_lastsack
195 	 */
196 	while (cur->next) {
197 		if (SEQ_LT(tp->snd_nxt, cur->end))
198 			return;
199 		if (SEQ_GEQ(tp->snd_nxt, cur->next->start))
200 			cur = cur->next;
201 		else {
202 			tp->snd_nxt = cur->next->start;
203 			return;
204 		}
205 	}
206 	if (SEQ_LT(tp->snd_nxt, cur->end))
207 		return;
208 	tp->snd_nxt = tp->rcv_lastsack;
209 	return;
210 }
211 #endif /* TCP_SACK */
212 
213 /*
214  * Tcp output routine: figure out what should be sent and send it.
215  */
216 int
217 tcp_output(tp)
218 	struct tcpcb *tp;
219 {
220 	struct socket *so = tp->t_inpcb->inp_socket;
221 	long len, win, txmaxseg;
222 	int off, flags, error;
223 	struct mbuf *m;
224 	struct tcphdr *th;
225 	u_char opt[MAX_TCPOPTLEN];
226 	unsigned int optlen, hdrlen;
227 	int idle, sendalot = 0;
228 #ifdef TCP_SACK
229 	int i, sack_rxmit = 0;
230 	struct sackhole *p;
231 #endif
232 #if defined(TCP_SACK)
233 	int maxburst = TCP_MAXBURST;
234 #endif
235 #ifdef TCP_SIGNATURE
236 	unsigned int sigoff;
237 #endif /* TCP_SIGNATURE */
238 #ifdef TCP_ECN
239 	int needect;
240 #endif
241 
242 #if defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC)
243 	if (tp->sack_enable && (tp->t_flags & TF_SIGNATURE))
244 		return (EINVAL);
245 #endif /* defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC) */
246 
247 	/*
248 	 * Determine length of data that should be transmitted,
249 	 * and flags that will be used.
250 	 * If there is some data or critical controls (SYN, RST)
251 	 * to send, then transmit; otherwise, investigate further.
252 	 */
253 	idle = (tp->snd_max == tp->snd_una);
254 	if (idle && (tcp_now - tp->t_rcvtime) >= tp->t_rxtcur)
255 		/*
256 		 * We have been idle for "a while" and no acks are
257 		 * expected to clock out any data we send --
258 		 * slow start to get ack "clock" running again.
259 		 */
260 		tp->snd_cwnd = tp->t_maxseg;
261 again:
262 #ifdef TCP_SACK
263 	/*
264 	 * If we've recently taken a timeout, snd_max will be greater than
265 	 * snd_nxt.  There may be SACK information that allows us to avoid
266 	 * resending already delivered data.  Adjust snd_nxt accordingly.
267 	 */
268 	if (tp->sack_enable && SEQ_LT(tp->snd_nxt, tp->snd_max))
269 		tcp_sack_adjust(tp);
270 #endif
271 	off = tp->snd_nxt - tp->snd_una;
272 #if defined(TCP_SACK) && defined(TCP_FACK)
273 	/* Normally, sendable data is limited by off < tp->snd_cwnd.
274 	 * But in FACK, sendable data is limited by snd_awnd < snd_cwnd,
275 	 * regardless of offset.
276 	 */
277 	if (tp->sack_enable && (tp->t_dupacks > tcprexmtthresh))
278 		win = tp->snd_wnd;
279 	else
280 #endif
281 	win = ulmin(tp->snd_wnd, tp->snd_cwnd);
282 
283 	flags = tcp_outflags[tp->t_state];
284 
285 #ifdef TCP_SACK
286 	/*
287 	 * Send any SACK-generated retransmissions.  If we're explicitly trying
288 	 * to send out new data (when sendalot is 1), bypass this function.
289 	 * If we retransmit in fast recovery mode, decrement snd_cwnd, since
290 	 * we're replacing a (future) new transmission with a retransmission
291 	 * now, and we previously incremented snd_cwnd in tcp_input().
292 	 */
293 	if (tp->sack_enable && !sendalot) {
294 		if (tp->t_dupacks >= tcprexmtthresh &&
295 		    (p = tcp_sack_output(tp))) {
296 			off = p->rxmit - tp->snd_una;
297 			sack_rxmit = 1;
298 #if 0
299 			/* Coalesce holes into a single retransmission */
300 #endif
301 			len = min(tp->t_maxseg, p->end - p->rxmit);
302 #ifndef TCP_FACK
303 			/* in FACK, hold snd_cwnd constant during recovery */
304 			if (SEQ_LT(tp->snd_una, tp->snd_last))
305 				tp->snd_cwnd -= tp->t_maxseg;
306 #endif
307     		}
308 	}
309 #endif /* TCP_SACK */
310 
311 	sendalot = 0;
312 	/*
313 	 * If in persist timeout with window of 0, send 1 byte.
314 	 * Otherwise, if window is small but nonzero
315 	 * and timer expired, we will send what we can
316 	 * and go to transmit state.
317 	 */
318 	if (tp->t_force) {
319 		if (win == 0) {
320 			/*
321 			 * If we still have some data to send, then
322 			 * clear the FIN bit.  Usually this would
323 			 * happen below when it realizes that we
324 			 * aren't sending all the data.  However,
325 			 * if we have exactly 1 byte of unset data,
326 			 * then it won't clear the FIN bit below,
327 			 * and if we are in persist state, we wind
328 			 * up sending the packet without recording
329 			 * that we sent the FIN bit.
330 			 *
331 			 * We can't just blindly clear the FIN bit,
332 			 * because if we don't have any more data
333 			 * to send then the probe will be the FIN
334 			 * itself.
335 			 */
336 			if (off < so->so_snd.sb_cc)
337 				flags &= ~TH_FIN;
338 			win = 1;
339 		} else {
340 			TCP_TIMER_DISARM(tp, TCPT_PERSIST);
341 			tp->t_rxtshift = 0;
342 		}
343 	}
344 
345 #ifdef TCP_SACK
346 	if (!sack_rxmit) {
347 #endif
348 	len = ulmin(so->so_snd.sb_cc, win) - off;
349 
350 #if defined(TCP_SACK) && defined(TCP_FACK)
351 	/*
352 	 * If we're in fast recovery (SEQ_GT(tp->snd_last, tp->snd_una)), and
353 	 * amount of outstanding data (snd_awnd) is >= snd_cwnd, then
354 	 * do not send data (like zero window conditions)
355 	 */
356 	if (tp->sack_enable && len && SEQ_GT(tp->snd_last, tp->snd_una) &&
357 	    (tp->snd_awnd >= tp->snd_cwnd))
358 		len = 0;
359 #endif /* TCP_FACK */
360 #ifdef TCP_SACK
361 	}
362 #endif
363 
364 	if (len < 0) {
365 		/*
366 		 * If FIN has been sent but not acked,
367 		 * but we haven't been called to retransmit,
368 		 * len will be -1.  Otherwise, window shrank
369 		 * after we sent into it.  If window shrank to 0,
370 		 * cancel pending retransmit, pull snd_nxt back
371 		 * to (closed) window, and set the persist timer
372 		 * if it isn't already going.  If the window didn't
373 		 * close completely, just wait for an ACK.
374 		 */
375 		len = 0;
376 		if (win == 0) {
377 			TCP_TIMER_DISARM(tp, TCPT_REXMT);
378 			tp->t_rxtshift = 0;
379 			tp->snd_nxt = tp->snd_una;
380 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
381 				tcp_setpersist(tp);
382 		}
383 	}
384 
385         /*
386          * Never send more than half a buffer full.  This insures that we can
387          * always keep 2 packets on the wire, no matter what SO_SNDBUF is, and
388          * therefore acks will never be delayed unless we run out of data to
389          * transmit.
390          */
391 	txmaxseg = ulmin(so->so_snd.sb_hiwat / 2, tp->t_maxseg);
392 
393 	if (len > txmaxseg) {
394 		len = txmaxseg;
395 		sendalot = 1;
396 	}
397 	if (off + len < so->so_snd.sb_cc)
398 		flags &= ~TH_FIN;
399 
400 	win = sbspace(&so->so_rcv);
401 
402 	/*
403 	 * Sender silly window avoidance.  If connection is idle
404 	 * and can send all data, a maximum segment,
405 	 * at least a maximum default-size segment do it,
406 	 * or are forced, do it; otherwise don't bother.
407 	 * If peer's buffer is tiny, then send
408 	 * when window is at least half open.
409 	 * If retransmitting (possibly after persist timer forced us
410 	 * to send into a small window), then must resend.
411 	 */
412 	if (len) {
413 		if (len == txmaxseg)
414 			goto send;
415 		if ((idle || tp->t_flags & TF_NODELAY) &&
416 		    len + off >= so->so_snd.sb_cc)
417 			goto send;
418 		if (tp->t_force)
419 			goto send;
420 		if (len >= tp->max_sndwnd / 2 && tp->max_sndwnd > 0)
421 			goto send;
422 		if (SEQ_LT(tp->snd_nxt, tp->snd_max))
423 			goto send;
424 #ifdef TCP_SACK
425 		if (sack_rxmit)
426 			goto send;
427 #endif
428 	}
429 
430 	/*
431 	 * Compare available window to amount of window
432 	 * known to peer (as advertised window less
433 	 * next expected input).  If the difference is at least two
434 	 * max size segments, or at least 50% of the maximum possible
435 	 * window, then want to send a window update to peer.
436 	 */
437 	if (win > 0) {
438 		/*
439 		 * "adv" is the amount we can increase the window,
440 		 * taking into account that we are limited by
441 		 * TCP_MAXWIN << tp->rcv_scale.
442 		 */
443 		long adv = lmin(win, (long)TCP_MAXWIN << tp->rcv_scale) -
444 			(tp->rcv_adv - tp->rcv_nxt);
445 
446 		if (adv >= (long) (2 * tp->t_maxseg))
447 			goto send;
448 		if (2 * adv >= (long) so->so_rcv.sb_hiwat)
449 			goto send;
450 	}
451 
452 	/*
453 	 * Send if we owe peer an ACK.
454 	 */
455 	if (tp->t_flags & TF_ACKNOW)
456 		goto send;
457 	if (flags & (TH_SYN|TH_RST))
458 		goto send;
459 	if (SEQ_GT(tp->snd_up, tp->snd_una))
460 		goto send;
461 	/*
462 	 * If our state indicates that FIN should be sent
463 	 * and we have not yet done so, or we're retransmitting the FIN,
464 	 * then we need to send.
465 	 */
466 	if (flags & TH_FIN &&
467 	    ((tp->t_flags & TF_SENTFIN) == 0 || tp->snd_nxt == tp->snd_una))
468 		goto send;
469 #ifdef TCP_SACK
470 	/*
471 	 * In SACK, it is possible for tcp_output to fail to send a segment
472 	 * after the retransmission timer has been turned off.  Make sure
473 	 * that the retransmission timer is set.
474 	 */
475 	if (SEQ_GT(tp->snd_max, tp->snd_una) &&
476 	    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
477 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
478 		TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
479 		return (0);
480 	}
481 #endif /* TCP_SACK */
482 
483 	/*
484 	 * TCP window updates are not reliable, rather a polling protocol
485 	 * using ``persist'' packets is used to insure receipt of window
486 	 * updates.  The three ``states'' for the output side are:
487 	 *	idle			not doing retransmits or persists
488 	 *	persisting		to move a small or zero window
489 	 *	(re)transmitting	and thereby not persisting
490 	 *
491 	 * tp->t_timer[TCPT_PERSIST]
492 	 *	is set when we are in persist state.
493 	 * tp->t_force
494 	 *	is set when we are called to send a persist packet.
495 	 * tp->t_timer[TCPT_REXMT]
496 	 *	is set when we are retransmitting
497 	 * The output side is idle when both timers are zero.
498 	 *
499 	 * If send window is too small, there is data to transmit, and no
500 	 * retransmit or persist is pending, then go to persist state.
501 	 * If nothing happens soon, send when timer expires:
502 	 * if window is nonzero, transmit what we can,
503 	 * otherwise force out a byte.
504 	 */
505 	if (so->so_snd.sb_cc && TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
506 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
507 		tp->t_rxtshift = 0;
508 		tcp_setpersist(tp);
509 	}
510 
511 	/*
512 	 * No reason to send a segment, just return.
513 	 */
514 	return (0);
515 
516 send:
517 	/*
518 	 * Before ESTABLISHED, force sending of initial options
519 	 * unless TCP set not to do any options.
520 	 * NOTE: we assume that the IP/TCP header plus TCP options
521 	 * always fit in a single mbuf, leaving room for a maximum
522 	 * link header, i.e.
523 	 *	max_linkhdr + sizeof(network header) + sizeof(struct tcphdr +
524 	 * 		optlen <= MHLEN
525 	 */
526 	optlen = 0;
527 
528 	switch (tp->pf) {
529 	case 0:	/*default to PF_INET*/
530 #ifdef INET
531 	case PF_INET:
532 		hdrlen = sizeof(struct ip) + sizeof(struct tcphdr);
533 		break;
534 #endif /* INET */
535 #ifdef INET6
536 	case PF_INET6:
537 		hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
538 		break;
539 #endif /* INET6 */
540 	default:
541 		return (EPFNOSUPPORT);
542 	}
543 
544 	if (flags & TH_SYN) {
545 		tp->snd_nxt = tp->iss;
546 		if ((tp->t_flags & TF_NOOPT) == 0) {
547 			u_int16_t mss;
548 
549 			opt[0] = TCPOPT_MAXSEG;
550 			opt[1] = 4;
551 			mss = htons((u_int16_t) tcp_mss(tp, 0));
552 			bcopy((caddr_t)&mss, (caddr_t)(opt + 2), sizeof(mss));
553 			optlen = 4;
554 
555 			if (flags & TH_ACK)
556 				tcp_mss_update(tp);
557 #ifdef TCP_SACK
558 			/*
559 			 * If this is the first SYN of connection (not a SYN
560 			 * ACK), include SACK_PERMIT_HDR option.  If this is a
561 			 * SYN ACK, include SACK_PERMIT_HDR option if peer has
562 			 * already done so.
563 			 */
564 			if (tp->sack_enable && ((flags & TH_ACK) == 0 ||
565 			    (tp->t_flags & TF_SACK_PERMIT))) {
566 				*((u_int32_t *) (opt + optlen)) =
567 				    htonl(TCPOPT_SACK_PERMIT_HDR);
568 				optlen += 4;
569 			}
570 #endif
571 
572 			if ((tp->t_flags & TF_REQ_SCALE) &&
573 			    ((flags & TH_ACK) == 0 ||
574 			    (tp->t_flags & TF_RCVD_SCALE))) {
575 				*((u_int32_t *) (opt + optlen)) = htonl(
576 					TCPOPT_NOP << 24 |
577 					TCPOPT_WINDOW << 16 |
578 					TCPOLEN_WINDOW << 8 |
579 					tp->request_r_scale);
580 				optlen += 4;
581 			}
582 		}
583 	}
584 
585 	/*
586 	 * Send a timestamp and echo-reply if this is a SYN and our side
587 	 * wants to use timestamps (TF_REQ_TSTMP is set) or both our side
588 	 * and our peer have sent timestamps in our SYN's.
589 	 */
590 	if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
591 	     (flags & TH_RST) == 0 &&
592 	    ((flags & (TH_SYN|TH_ACK)) == TH_SYN ||
593 	     (tp->t_flags & TF_RCVD_TSTMP))) {
594 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
595 
596 		/* Form timestamp option as shown in appendix A of RFC 1323. */
597 		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
598 		*lp++ = htonl(tcp_now);
599 		*lp   = htonl(tp->ts_recent);
600 		optlen += TCPOLEN_TSTAMP_APPA;
601 	}
602 
603 #ifdef TCP_SIGNATURE
604 	if (tp->t_flags & TF_SIGNATURE) {
605 		u_int8_t *bp = (u_int8_t *)(opt + optlen);
606 
607 		/* Send signature option */
608 		*(bp++) = TCPOPT_SIGNATURE;
609 		*(bp++) = TCPOLEN_SIGNATURE;
610 		sigoff = optlen + 2;
611 
612 		{
613 			unsigned int i;
614 
615 			for (i = 0; i < 16; i++)
616 				*(bp++) = 0;
617 		}
618 
619 
620 		/* Pad options list to the next 32 bit boundary and
621 		 * terminate it.
622 		 */
623 		*bp++ = TCPOPT_NOP;
624 		*bp++ = TCPOPT_EOL;
625 
626 		optlen += TCPOLEN_SIGLEN;
627 	}
628 #endif /* TCP_SIGNATURE */
629 
630 #ifdef TCP_SACK
631 	/*
632 	 * Send SACKs if necessary.  This should be the last option processed.
633 	 * Only as many SACKs are sent as are permitted by the maximum options
634 	 * size.  No more than three SACKs are sent.
635 	 */
636 	if (tp->sack_enable && tp->t_state == TCPS_ESTABLISHED &&
637 	    (tp->t_flags & (TF_SACK_PERMIT|TF_NOOPT)) == TF_SACK_PERMIT &&
638 	    tp->rcv_numsacks) {
639 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
640 		u_int32_t *olp = lp++;
641 		int count = 0;  /* actual number of SACKs inserted */
642 		int maxsack = (MAX_TCPOPTLEN - (optlen + 4))/TCPOLEN_SACK;
643 
644 		maxsack = min(maxsack, TCP_MAX_SACK);
645 		for (i = 0; (i < tp->rcv_numsacks && count < maxsack); i++) {
646 			struct sackblk sack = tp->sackblks[i];
647 			if (sack.start == 0 && sack.end == 0)
648 				continue;
649 			*lp++ = htonl(sack.start);
650 			*lp++ = htonl(sack.end);
651 			count++;
652 		}
653 		*olp = htonl(TCPOPT_SACK_HDR|(TCPOLEN_SACK*count+2));
654 		optlen += TCPOLEN_SACK*count + 4; /* including leading NOPs */
655 	}
656 #endif /* TCP_SACK */
657 
658 #ifdef DIAGNOSTIC
659 	if (optlen > MAX_TCPOPTLEN)
660 		panic("tcp_output: options too long");
661 #endif /* DIAGNOSTIC */
662 
663 	hdrlen += optlen;
664 
665 	/*
666 	 * Adjust data length if insertion of options will
667 	 * bump the packet length beyond the t_maxopd length.
668 	 */
669 	if (len > tp->t_maxopd - optlen) {
670 		len = tp->t_maxopd - optlen;
671 		sendalot = 1;
672 		flags &= ~TH_FIN;
673 	 }
674 
675 #ifdef DIAGNOSTIC
676 	if (max_linkhdr + hdrlen > MCLBYTES)
677 		panic("tcphdr too big");
678 #endif
679 
680 	/*
681 	 * Grab a header mbuf, attaching a copy of data to
682 	 * be transmitted, and initialize the header from
683 	 * the template for sends on this connection.
684 	 */
685 	if (len) {
686 		if (tp->t_force && len == 1)
687 			tcpstat.tcps_sndprobe++;
688 		else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) {
689 			tcpstat.tcps_sndrexmitpack++;
690 			tcpstat.tcps_sndrexmitbyte += len;
691 		} else {
692 			tcpstat.tcps_sndpack++;
693 			tcpstat.tcps_sndbyte += len;
694 		}
695 #ifdef notyet
696 		if ((m = m_copypack(so->so_snd.sb_mb, off,
697 		    (int)len, max_linkhdr + hdrlen)) == 0) {
698 			error = ENOBUFS;
699 			goto out;
700 		}
701 		/*
702 		 * m_copypack left space for our hdr; use it.
703 		 */
704 		m->m_len += hdrlen;
705 		m->m_data -= hdrlen;
706 #else
707 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
708 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
709 			MCLGET(m, M_DONTWAIT);
710 			if ((m->m_flags & M_EXT) == 0) {
711 				m_freem(m);
712 				m = NULL;
713 			}
714 		}
715 		if (m == NULL) {
716 			error = ENOBUFS;
717 			goto out;
718 		}
719 		m->m_data += max_linkhdr;
720 		m->m_len = hdrlen;
721 		if (len <= M_TRAILINGSPACE(m)) {
722 			m_copydata(so->so_snd.sb_mb, off, (int) len,
723 			    mtod(m, caddr_t) + hdrlen);
724 			m->m_len += len;
725 		} else {
726 			m->m_next = m_copy(so->so_snd.sb_mb, off, (int) len);
727 			if (m->m_next == 0) {
728 				(void) m_free(m);
729 				error = ENOBUFS;
730 				goto out;
731 			}
732 		}
733 #endif
734 		/*
735 		 * If we're sending everything we've got, set PUSH.
736 		 * (This will keep happy those implementations which only
737 		 * give data to the user when a buffer fills or
738 		 * a PUSH comes in.)
739 		 */
740 		if (off + len == so->so_snd.sb_cc)
741 			flags |= TH_PUSH;
742 	} else {
743 		if (tp->t_flags & TF_ACKNOW)
744 			tcpstat.tcps_sndacks++;
745 		else if (flags & (TH_SYN|TH_FIN|TH_RST))
746 			tcpstat.tcps_sndctrl++;
747 		else if (SEQ_GT(tp->snd_up, tp->snd_una))
748 			tcpstat.tcps_sndurg++;
749 		else
750 			tcpstat.tcps_sndwinup++;
751 
752 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
753 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
754 			MCLGET(m, M_DONTWAIT);
755 			if ((m->m_flags & M_EXT) == 0) {
756 				m_freem(m);
757 				m = NULL;
758 			}
759 		}
760 		if (m == NULL) {
761 			error = ENOBUFS;
762 			goto out;
763 		}
764 		m->m_data += max_linkhdr;
765 		m->m_len = hdrlen;
766 	}
767 	m->m_pkthdr.rcvif = (struct ifnet *)0;
768 
769 	if (!tp->t_template)
770 		panic("tcp_output");
771 #ifdef DIAGNOSTIC
772 	if (tp->t_template->m_len != hdrlen - optlen)
773 		panic("tcp_output: template len != hdrlen - optlen");
774 #endif /* DIAGNOSTIC */
775 	bcopy(mtod(tp->t_template, caddr_t), mtod(m, caddr_t),
776 		tp->t_template->m_len);
777 	th = (struct tcphdr *)(mtod(m, caddr_t) + tp->t_template->m_len -
778 		sizeof(struct tcphdr));
779 
780 	/*
781 	 * Fill in fields, remembering maximum advertised
782 	 * window for use in delaying messages about window sizes.
783 	 * If resending a FIN, be sure not to use a new sequence number.
784 	 */
785 	if ((flags & TH_FIN) && (tp->t_flags & TF_SENTFIN) &&
786 	    (tp->snd_nxt == tp->snd_max))
787 		tp->snd_nxt--;
788 	/*
789 	 * If we are doing retransmissions, then snd_nxt will
790 	 * not reflect the first unsent octet.  For ACK only
791 	 * packets, we do not want the sequence number of the
792 	 * retransmitted packet, we want the sequence number
793 	 * of the next unsent octet.  So, if there is no data
794 	 * (and no SYN or FIN), use snd_max instead of snd_nxt
795 	 * when filling in ti_seq.  But if we are in persist
796 	 * state, snd_max might reflect one byte beyond the
797 	 * right edge of the window, so use snd_nxt in that
798 	 * case, since we know we aren't doing a retransmission.
799 	 * (retransmit and persist are mutually exclusive...)
800 	 */
801 	if (len || (flags & (TH_SYN|TH_FIN)) || TCP_TIMER_ISARMED(tp, TCPT_PERSIST))
802 		th->th_seq = htonl(tp->snd_nxt);
803 	else
804 		th->th_seq = htonl(tp->snd_max);
805 
806 #ifdef TCP_SACK
807 	if (sack_rxmit) {
808 		/*
809 		 * If sendalot was turned on (due to option stuffing), turn it
810 		 * off. Properly set th_seq field.  Advance the ret'x pointer
811 		 * by len.
812 		 */
813 		if (sendalot)
814 			sendalot = 0;
815 		th->th_seq = htonl(p->rxmit);
816 		p->rxmit += len;
817 #if defined(TCP_SACK) && defined(TCP_FACK)
818 		tp->retran_data += len;
819 #endif /* TCP_FACK */
820 	}
821 #endif /* TCP_SACK */
822 
823 	th->th_ack = htonl(tp->rcv_nxt);
824 	if (optlen) {
825 		bcopy((caddr_t)opt, (caddr_t)(th + 1), optlen);
826 		th->th_off = (sizeof (struct tcphdr) + optlen) >> 2;
827 	}
828 #ifdef TCP_ECN
829 	if (tcp_do_ecn) {
830 		/*
831 		 * if we have received congestion experienced segs,
832 		 * set ECE bit.
833 		 */
834 		if (tp->t_flags & TF_RCVD_CE) {
835 			flags |= TH_ECE;
836 			tcpstat.tcps_ecn_sndece++;
837 		}
838 		if (!(tp->t_flags & TF_DISABLE_ECN)) {
839 			/*
840 			 * if this is a SYN seg, set ECE and CWR.
841 			 * set only ECE for SYN-ACK if peer supports ECN.
842 			 */
843 			if ((flags & (TH_SYN|TH_ACK)) == TH_SYN)
844 				flags |= (TH_ECE|TH_CWR);
845 			else if ((tp->t_flags & TF_ECN_PERMIT) &&
846 				 (flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK))
847 				flags |= TH_ECE;
848 		}
849 		/*
850 		 * if we have reduced the congestion window, notify
851 		 * the peer by setting CWR bit.
852 		 */
853 		if ((tp->t_flags & TF_ECN_PERMIT) &&
854 		    (tp->t_flags & TF_SEND_CWR)) {
855 			flags |= TH_CWR;
856 			tp->t_flags &= ~TF_SEND_CWR;
857 			tcpstat.tcps_ecn_sndcwr++;
858 		}
859 	}
860 #endif
861 	th->th_flags = flags;
862 
863 	/*
864 	 * Calculate receive window.  Don't shrink window,
865 	 * but avoid silly window syndrome.
866 	 */
867 	if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg)
868 		win = 0;
869 	if (win > (long)TCP_MAXWIN << tp->rcv_scale)
870 		win = (long)TCP_MAXWIN << tp->rcv_scale;
871 	if (win < (long)(int32_t)(tp->rcv_adv - tp->rcv_nxt))
872 		win = (long)(int32_t)(tp->rcv_adv - tp->rcv_nxt);
873 	if (flags & TH_RST)
874 		win = 0;
875 	th->th_win = htons((u_int16_t) (win>>tp->rcv_scale));
876 	if (SEQ_GT(tp->snd_up, tp->snd_nxt)) {
877 		u_int32_t urp = tp->snd_up - tp->snd_nxt;
878 		if (urp > IP_MAXPACKET)
879 			urp = IP_MAXPACKET;
880 		th->th_urp = htons((u_int16_t)urp);
881 		th->th_flags |= TH_URG;
882 	} else
883 		/*
884 		 * If no urgent pointer to send, then we pull
885 		 * the urgent pointer to the left edge of the send window
886 		 * so that it doesn't drift into the send window on sequence
887 		 * number wraparound.
888 		 */
889 		tp->snd_up = tp->snd_una;		/* drag it along */
890 
891 #ifdef TCP_SIGNATURE
892 	if (tp->t_flags & TF_SIGNATURE) {
893 		MD5_CTX ctx;
894 		union sockaddr_union src, dst;
895 		struct tdb *tdb;
896 
897 		bzero(&src, sizeof(union sockaddr_union));
898 		bzero(&dst, sizeof(union sockaddr_union));
899 
900 		switch (tp->pf) {
901 		case 0:	/*default to PF_INET*/
902 #ifdef INET
903 		case AF_INET:
904 			src.sa.sa_len = sizeof(struct sockaddr_in);
905 			src.sa.sa_family = AF_INET;
906 			src.sin.sin_addr = mtod(m, struct ip *)->ip_src;
907 			dst.sa.sa_len = sizeof(struct sockaddr_in);
908 			dst.sa.sa_family = AF_INET;
909 			dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst;
910 			break;
911 #endif /* INET */
912 #ifdef INET6
913 		case AF_INET6:
914 			src.sa.sa_len = sizeof(struct sockaddr_in6);
915 			src.sa.sa_family = AF_INET6;
916 			src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src;
917 			dst.sa.sa_len = sizeof(struct sockaddr_in6);
918 			dst.sa.sa_family = AF_INET6;
919 			dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst;
920 			break;
921 #endif /* INET6 */
922 		}
923 
924 		/* XXX gettdbbysrcdst() should really be called at spltdb().      */
925 		/* XXX this is splsoftnet(), currently they are the same. */
926 		tdb = gettdbbysrcdst(0, &src, &dst, IPPROTO_TCP);
927 		if (tdb == NULL)
928 			return (EPERM);
929 
930 		MD5Init(&ctx);
931 
932 		switch (tp->pf) {
933 		case 0:	/*default to PF_INET*/
934 #ifdef INET
935 		case AF_INET:
936 			{
937 				struct ippseudo ippseudo;
938 				struct ipovly *ipovly;
939 
940 				ipovly = mtod(m, struct ipovly *);
941 
942 				ippseudo.ippseudo_src = ipovly->ih_src;
943 				ippseudo.ippseudo_dst = ipovly->ih_dst;
944 				ippseudo.ippseudo_pad = 0;
945 				ippseudo.ippseudo_p   = IPPROTO_TCP;
946 				ippseudo.ippseudo_len = ntohs(ipovly->ih_len) + len +
947 				    optlen;
948 				ippseudo.ippseudo_len = htons(ippseudo.ippseudo_len);
949 				MD5Update(&ctx, (char *)&ippseudo,
950 				    sizeof(struct ippseudo));
951 			}
952 			break;
953 #endif /* INET */
954 #ifdef INET6
955 		case AF_INET6:
956 			{
957 				struct ip6_hdr_pseudo ip6pseudo;
958 				struct ip6_hdr *ip6;
959 
960 				ip6 = mtod(m, struct ip6_hdr *);
961 				bzero(&ip6pseudo, sizeof(ip6pseudo));
962 				ip6pseudo.ip6ph_src = ip6->ip6_src;
963 				ip6pseudo.ip6ph_dst = ip6->ip6_dst;
964 				in6_clearscope(&ip6pseudo.ip6ph_src);
965 				in6_clearscope(&ip6pseudo.ip6ph_dst);
966 				ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
967 				ip6pseudo.ip6ph_len =
968 				    htonl(sizeof(struct tcphdr) + len + optlen);
969 
970 				MD5Update(&ctx, (char *)&ip6pseudo,
971 				    sizeof(ip6pseudo));
972 			}
973 			break;
974 #endif /* INET6 */
975 		}
976 
977 		{
978 			u_int16_t thsum = th->th_sum;
979 
980 			/* RFC 2385 requires th_sum == 0 */
981 			th->th_sum = 0;
982 			MD5Update(&ctx, (char *)th, sizeof(struct tcphdr));
983 			th->th_sum = thsum;
984 		}
985 
986 		if (len && m_apply(m, hdrlen, len, tcp_signature_apply,
987 		    (caddr_t)&ctx))
988 			return (EINVAL);
989 
990 		MD5Update(&ctx, tdb->tdb_amxkey, tdb->tdb_amxkeylen);
991 		MD5Final(mtod(m, caddr_t) + hdrlen - optlen + sigoff, &ctx);
992 	}
993 #endif /* TCP_SIGNATURE */
994 
995 	/*
996 	 * Put TCP length in extended header, and then
997 	 * checksum extended header and data.
998 	 */
999 	switch (tp->pf) {
1000 	case 0:	/*default to PF_INET*/
1001 #ifdef INET
1002 	case AF_INET:
1003 		/* Defer checksumming until later (ip_output() or hardware) */
1004 		m->m_pkthdr.csum |= M_TCPV4_CSUM_OUT;
1005 		if (len + optlen)
1006 			th->th_sum = in_cksum_addword(th->th_sum,
1007 			    htons((u_int16_t)(len + optlen)));
1008 		break;
1009 #endif /* INET */
1010 #ifdef INET6
1011 	case AF_INET6:
1012 		m->m_pkthdr.len = hdrlen + len;
1013 		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
1014 			hdrlen - sizeof(struct ip6_hdr) + len);
1015 		break;
1016 #endif /* INET6 */
1017 	}
1018 
1019 	/*
1020 	 * In transmit state, time the transmission and arrange for
1021 	 * the retransmit.  In persist state, just set snd_max.
1022 	 */
1023 	if (tp->t_force == 0 || TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
1024 		tcp_seq startseq = tp->snd_nxt;
1025 
1026 		/*
1027 		 * Advance snd_nxt over sequence space of this segment.
1028 		 */
1029 		if (flags & (TH_SYN|TH_FIN)) {
1030 			if (flags & TH_SYN)
1031 				tp->snd_nxt++;
1032 			if (flags & TH_FIN) {
1033 				tp->snd_nxt++;
1034 				tp->t_flags |= TF_SENTFIN;
1035 			}
1036 		}
1037 #ifdef TCP_SACK
1038 		if (tp->sack_enable) {
1039 			if (sack_rxmit && (p->rxmit != tp->snd_nxt)) {
1040 				goto timer;
1041 			}
1042 		}
1043 #endif
1044 		tp->snd_nxt += len;
1045 		if (SEQ_GT(tp->snd_nxt, tp->snd_max)) {
1046 			tp->snd_max = tp->snd_nxt;
1047 			/*
1048 			 * Time this transmission if not a retransmission and
1049 			 * not currently timing anything.
1050 			 */
1051 			if (tp->t_rtttime == 0) {
1052 				tp->t_rtttime = tcp_now;
1053 				tp->t_rtseq = startseq;
1054 				tcpstat.tcps_segstimed++;
1055 			}
1056 		}
1057 
1058 		/*
1059 		 * Set retransmit timer if not currently set,
1060 		 * and not doing an ack or a keep-alive probe.
1061 		 * Initial value for retransmit timer is smoothed
1062 		 * round-trip time + 2 * round-trip time variance.
1063 		 * Initialize shift counter which is used for backoff
1064 		 * of retransmit time.
1065 		 */
1066 #ifdef TCP_SACK
1067  timer:
1068 		if (tp->sack_enable && sack_rxmit &&
1069 		    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1070 		    tp->snd_nxt != tp->snd_max) {
1071 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1072 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1073 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1074 				tp->t_rxtshift = 0;
1075 			}
1076 		}
1077 #endif
1078 
1079 		if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1080 		    tp->snd_nxt != tp->snd_una) {
1081 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1082 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1083 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1084 				tp->t_rxtshift = 0;
1085 			}
1086 		}
1087 	} else
1088 		if (SEQ_GT(tp->snd_nxt + len, tp->snd_max))
1089 			tp->snd_max = tp->snd_nxt + len;
1090 
1091 	/*
1092 	 * Trace.
1093 	 */
1094 	if (so->so_options & SO_DEBUG)
1095 		tcp_trace(TA_OUTPUT, tp->t_state, tp, mtod(m, caddr_t), 0,
1096 			len);
1097 
1098 	/*
1099 	 * Fill in IP length and desired time to live and
1100 	 * send to IP level.  There should be a better way
1101 	 * to handle ttl and tos; we could keep them in
1102 	 * the template, but need a way to checksum without them.
1103 	 */
1104 	m->m_pkthdr.len = hdrlen + len;
1105 
1106 #ifdef TCP_ECN
1107 	/*
1108 	 * if peer is ECN capable, set the ECT bit in the IP header.
1109 	 * but don't set ECT for a pure ack, a retransmit or a window probe.
1110 	 */
1111 	needect = 0;
1112 	if (tcp_do_ecn && (tp->t_flags & TF_ECN_PERMIT)) {
1113 		if (len == 0 || SEQ_LT(tp->snd_nxt, tp->snd_max) ||
1114 		    (tp->t_force && len == 1)) {
1115 			/* don't set ECT */
1116 		} else {
1117 			needect = 1;
1118 			tcpstat.tcps_ecn_sndect++;
1119 		}
1120 	}
1121 #endif
1122 
1123 	switch (tp->pf) {
1124 	case 0:	/*default to PF_INET*/
1125 #ifdef INET
1126 	case AF_INET:
1127 		{
1128 			struct ip *ip;
1129 
1130 			ip = mtod(m, struct ip *);
1131 			ip->ip_len = htons(m->m_pkthdr.len);
1132 			ip->ip_ttl = tp->t_inpcb->inp_ip.ip_ttl;
1133 			ip->ip_tos = tp->t_inpcb->inp_ip.ip_tos;
1134 #ifdef TCP_ECN
1135 			if (needect)
1136 				ip->ip_tos |= IPTOS_ECN_ECT0;
1137 #endif
1138 		}
1139 		error = ip_output(m, tp->t_inpcb->inp_options,
1140 			&tp->t_inpcb->inp_route,
1141 			(ip_mtudisc ? IP_MTUDISC : 0) |
1142 				  (so->so_options & SO_DONTROUTE),
1143 			(void *)NULL, tp->t_inpcb);
1144 		break;
1145 #endif /* INET */
1146 #ifdef INET6
1147 	case AF_INET6:
1148 		{
1149 			struct ip6_hdr *ip6;
1150 
1151 			ip6 = mtod(m, struct ip6_hdr *);
1152 			ip6->ip6_plen = m->m_pkthdr.len -
1153 				sizeof(struct ip6_hdr);
1154 			ip6->ip6_nxt = IPPROTO_TCP;
1155 			ip6->ip6_hlim = in6_selecthlim(tp->t_inpcb, NULL);
1156 #ifdef TCP_ECN
1157 			if (needect)
1158 				ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
1159 #endif
1160 		}
1161 		error = ip6_output(m, tp->t_inpcb->inp_outputopts6,
1162 			  &tp->t_inpcb->inp_route6,
1163 			  (so->so_options & SO_DONTROUTE), NULL, NULL);
1164 		break;
1165 #endif /* INET6 */
1166 #ifdef TUBA
1167 	case AF_ISO:
1168 		if (tp->t_tuba_pcb)
1169 			error = tuba_output(m, tp);
1170 		break;
1171 #endif /* TUBA */
1172 	}
1173 
1174 #if defined(TCP_SACK) && defined(TCP_FACK)
1175 	/* Update snd_awnd to reflect the new data that was sent.  */
1176 	tp->snd_awnd = tcp_seq_subtract(tp->snd_max, tp->snd_fack) +
1177 		tp->retran_data;
1178 #endif /* defined(TCP_SACK) && defined(TCP_FACK) */
1179 
1180 	if (error) {
1181 out:
1182 		if (error == ENOBUFS) {
1183 			tcp_quench(tp->t_inpcb, 0);
1184 			return (0);
1185 		}
1186 		if (error == EMSGSIZE) {
1187 			/*
1188 			 * ip_output() will have already fixed the route
1189 			 * for us.  tcp_mtudisc() will, as its last action,
1190 			 * initiate retransmission, so it is important to
1191 			 * not do so here.
1192 			 */
1193 			tcp_mtudisc(tp->t_inpcb, -1);
1194 			return (0);
1195 		}
1196 		if ((error == EHOSTUNREACH || error == ENETDOWN) &&
1197 		    TCPS_HAVERCVDSYN(tp->t_state)) {
1198 			tp->t_softerror = error;
1199 			return (0);
1200 		}
1201 
1202 		/* Restart the delayed ACK timer, if necessary. */
1203 		if (tp->t_flags & TF_DELACK)
1204 			TCP_RESTART_DELACK(tp);
1205 
1206 		return (error);
1207 	}
1208 	tcpstat.tcps_sndtotal++;
1209 	if (tp->t_flags & TF_DELACK)
1210 		tcpstat.tcps_delack++;
1211 
1212 	/*
1213 	 * Data sent (as far as we can tell).
1214 	 * If this advertises a larger window than any other segment,
1215 	 * then remember the size of the advertised window.
1216 	 * Any pending ACK has now been sent.
1217 	 */
1218 	if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
1219 		tp->rcv_adv = tp->rcv_nxt + win;
1220 	tp->last_ack_sent = tp->rcv_nxt;
1221 	tp->t_flags &= ~TF_ACKNOW;
1222 	TCP_CLEAR_DELACK(tp);
1223 #if defined(TCP_SACK)
1224 	if (sendalot && --maxburst)
1225 #else
1226 	if (sendalot)
1227 #endif
1228 		goto again;
1229 	return (0);
1230 }
1231 
1232 void
1233 tcp_setpersist(struct tcpcb *tp)
1234 {
1235 	int t = ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1;
1236 	int nticks;
1237 
1238 	if (TCP_TIMER_ISARMED(tp, TCPT_REXMT))
1239 		panic("tcp_output REXMT");
1240 	/*
1241 	 * Start/restart persistance timer.
1242 	 */
1243 	if (t < tp->t_rttmin)
1244 		t = tp->t_rttmin;
1245 	TCPT_RANGESET(nticks, t * tcp_backoff[tp->t_rxtshift],
1246 	    TCPTV_PERSMIN, TCPTV_PERSMAX);
1247 	TCP_TIMER_ARM(tp, TCPT_PERSIST, nticks);
1248 	if (tp->t_rxtshift < TCP_MAXRXTSHIFT)
1249 		tp->t_rxtshift++;
1250 }
1251