xref: /openbsd-src/sys/netinet/tcp_subr.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: tcp_subr.c,v 1.131 2014/07/12 21:06:34 yasuoka Exp $	*/
2 /*	$NetBSD: tcp_subr.c,v 1.22 1996/02/13 23:44:00 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  * 	This product includes software developed by the University of
46  * 	California, Berkeley and its contributors.
47  * 	This product includes software developed at the Information
48  * 	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/timeout.h>
77 #include <sys/protosw.h>
78 #include <sys/kernel.h>
79 #include <sys/pool.h>
80 
81 #include <net/route.h>
82 #include <net/if.h>
83 
84 #include <netinet/in.h>
85 #include <netinet/in_systm.h>
86 #include <netinet/ip.h>
87 #include <netinet/in_pcb.h>
88 #include <netinet/ip_var.h>
89 #include <netinet/ip_icmp.h>
90 #include <netinet/tcp.h>
91 #include <netinet/tcp_fsm.h>
92 #include <netinet/tcp_seq.h>
93 #include <netinet/tcp_timer.h>
94 #include <netinet/tcp_var.h>
95 #include <netinet/tcpip.h>
96 #include <dev/rndvar.h>
97 
98 #ifdef INET6
99 #include <netinet6/ip6protosw.h>
100 #endif /* INET6 */
101 
102 #include <crypto/md5.h>
103 
104 /* patchable/settable parameters for tcp */
105 int	tcp_mssdflt = TCP_MSS;
106 int	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
107 
108 /* values controllable via sysctl */
109 int	tcp_do_rfc1323 = 1;
110 #ifdef TCP_SACK
111 int	tcp_do_sack = 1;	/* RFC 2018 selective ACKs */
112 #endif
113 int	tcp_ack_on_push = 0;	/* set to enable immediate ACK-on-PUSH */
114 #ifdef TCP_ECN
115 int	tcp_do_ecn = 0;		/* RFC3168 ECN enabled/disabled? */
116 #endif
117 int	tcp_do_rfc3390 = 2;	/* Increase TCP's Initial Window to 10*mss */
118 
119 u_int32_t	tcp_now = 1;
120 
121 #ifndef TCB_INITIAL_HASH_SIZE
122 #define	TCB_INITIAL_HASH_SIZE	128
123 #endif
124 
125 /* syn hash parameters */
126 #define	TCP_SYN_HASH_SIZE	293
127 #define	TCP_SYN_BUCKET_SIZE	35
128 int	tcp_syn_cache_size = TCP_SYN_HASH_SIZE;
129 int	tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE;
130 int	tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE;
131 struct	syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE];
132 
133 int tcp_reass_limit = NMBCLUSTERS / 2; /* hardlimit for tcpqe_pool */
134 #ifdef TCP_SACK
135 int tcp_sackhole_limit = 32*1024; /* hardlimit for sackhl_pool */
136 #endif
137 
138 struct pool tcpcb_pool;
139 struct pool tcpqe_pool;
140 #ifdef TCP_SACK
141 struct pool sackhl_pool;
142 #endif
143 
144 struct tcpstat tcpstat;		/* tcp statistics */
145 tcp_seq  tcp_iss;
146 
147 /*
148  * Tcp initialization
149  */
150 void
151 tcp_init()
152 {
153 	tcp_iss = 1;		/* wrong */
154 	pool_init(&tcpcb_pool, sizeof(struct tcpcb), 0, 0, 0, "tcpcbpl",
155 	    NULL);
156 	pool_init(&tcpqe_pool, sizeof(struct tcpqent), 0, 0, 0, "tcpqepl",
157 	    NULL);
158 	pool_sethardlimit(&tcpqe_pool, tcp_reass_limit, NULL, 0);
159 #ifdef TCP_SACK
160 	pool_init(&sackhl_pool, sizeof(struct sackhole), 0, 0, 0, "sackhlpl",
161 	    NULL);
162 	pool_sethardlimit(&sackhl_pool, tcp_sackhole_limit, NULL, 0);
163 #endif /* TCP_SACK */
164 	in_pcbinit(&tcbtable, TCB_INITIAL_HASH_SIZE);
165 
166 #ifdef INET6
167 	/*
168 	 * Since sizeof(struct ip6_hdr) > sizeof(struct ip), we
169 	 * do max length checks/computations only on the former.
170 	 */
171 	if (max_protohdr < (sizeof(struct ip6_hdr) + sizeof(struct tcphdr)))
172 		max_protohdr = (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
173 	if ((max_linkhdr + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) >
174 	    MHLEN)
175 		panic("tcp_init");
176 
177 	icmp6_mtudisc_callback_register(tcp6_mtudisc_callback);
178 #endif /* INET6 */
179 
180 	/* Initialize the compressed state engine. */
181 	syn_cache_init();
182 
183 	/* Initialize timer state. */
184 	tcp_timer_init();
185 }
186 
187 /*
188  * Create template to be used to send tcp packets on a connection.
189  * Call after host entry created, allocates an mbuf and fills
190  * in a skeletal tcp/ip header, minimizing the amount of work
191  * necessary when the connection is used.
192  *
193  * To support IPv6 in addition to IPv4 and considering that the sizes of
194  * the IPv4 and IPv6 headers are not the same, we now use a separate pointer
195  * for the TCP header.  Also, we made the former tcpiphdr header pointer
196  * into just an IP overlay pointer, with casting as appropriate for v6. rja
197  */
198 struct mbuf *
199 tcp_template(tp)
200 	struct tcpcb *tp;
201 {
202 	struct inpcb *inp = tp->t_inpcb;
203 	struct mbuf *m;
204 	struct tcphdr *th;
205 
206 	if ((m = tp->t_template) == 0) {
207 		m = m_get(M_DONTWAIT, MT_HEADER);
208 		if (m == NULL)
209 			return (0);
210 
211 		switch (tp->pf) {
212 		case 0:	/*default to PF_INET*/
213 #ifdef INET
214 		case AF_INET:
215 			m->m_len = sizeof(struct ip);
216 			break;
217 #endif /* INET */
218 #ifdef INET6
219 		case AF_INET6:
220 			m->m_len = sizeof(struct ip6_hdr);
221 			break;
222 #endif /* INET6 */
223 		}
224 		m->m_len += sizeof (struct tcphdr);
225 
226 		/*
227 		 * The link header, network header, TCP header, and TCP options
228 		 * all must fit in this mbuf. For now, assume the worst case of
229 		 * TCP options size. Eventually, compute this from tp flags.
230 		 */
231 		if (m->m_len + MAX_TCPOPTLEN + max_linkhdr >= MHLEN) {
232 			MCLGET(m, M_DONTWAIT);
233 			if ((m->m_flags & M_EXT) == 0) {
234 				m_free(m);
235 				return (0);
236 			}
237 		}
238 	}
239 
240 	switch(tp->pf) {
241 #ifdef INET
242 	case AF_INET:
243 		{
244 			struct ipovly *ipovly;
245 
246 			ipovly = mtod(m, struct ipovly *);
247 
248 			bzero(ipovly->ih_x1, sizeof ipovly->ih_x1);
249 			ipovly->ih_pr = IPPROTO_TCP;
250 			ipovly->ih_len = htons(sizeof (struct tcphdr));
251 			ipovly->ih_src = inp->inp_laddr;
252 			ipovly->ih_dst = inp->inp_faddr;
253 
254 			th = (struct tcphdr *)(mtod(m, caddr_t) +
255 				sizeof(struct ip));
256 		}
257 		break;
258 #endif /* INET */
259 #ifdef INET6
260 	case AF_INET6:
261 		{
262 			struct ip6_hdr *ip6;
263 
264 			ip6 = mtod(m, struct ip6_hdr *);
265 
266 			ip6->ip6_src = inp->inp_laddr6;
267 			ip6->ip6_dst = inp->inp_faddr6;
268 			ip6->ip6_flow = htonl(0x60000000) |
269 			    (inp->inp_flowinfo & IPV6_FLOWLABEL_MASK);
270 
271 			ip6->ip6_nxt = IPPROTO_TCP;
272 			ip6->ip6_plen = htons(sizeof(struct tcphdr)); /*XXX*/
273 			ip6->ip6_hlim = in6_selecthlim(inp, NULL);	/*XXX*/
274 
275 			th = (struct tcphdr *)(mtod(m, caddr_t) +
276 				sizeof(struct ip6_hdr));
277 		}
278 		break;
279 #endif /* INET6 */
280 	}
281 
282 	th->th_sport = inp->inp_lport;
283 	th->th_dport = inp->inp_fport;
284 	th->th_seq = 0;
285 	th->th_ack = 0;
286 	th->th_x2  = 0;
287 	th->th_off = 5;
288 	th->th_flags = 0;
289 	th->th_win = 0;
290 	th->th_urp = 0;
291 	th->th_sum = 0;
292 	return (m);
293 }
294 
295 /*
296  * Send a single message to the TCP at address specified by
297  * the given TCP/IP header.  If m == 0, then we make a copy
298  * of the tcpiphdr at ti and send directly to the addressed host.
299  * This is used to force keep alive messages out using the TCP
300  * template for a connection tp->t_template.  If flags are given
301  * then we send a message back to the TCP which originated the
302  * segment ti, and discard the mbuf containing it and any other
303  * attached mbufs.
304  *
305  * In any case the ack and sequence number of the transmitted
306  * segment are as specified by the parameters.
307  */
308 #ifdef INET6
309 /* This function looks hairy, because it was so IPv4-dependent. */
310 #endif /* INET6 */
311 void
312 tcp_respond(struct tcpcb *tp, caddr_t template, struct tcphdr *th0,
313     tcp_seq ack, tcp_seq seq, int flags, u_int rtableid)
314 {
315 	int tlen;
316 	int win = 0;
317 	struct mbuf *m = 0;
318 	struct route *ro = 0;
319 	struct tcphdr *th;
320 	struct ip *ip;
321 #ifdef INET6
322 	struct ip6_hdr *ip6;
323 #endif
324 	int af;		/* af on wire */
325 
326 	if (tp) {
327 		win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
328 		/*
329 		 * If this is called with an unconnected
330 		 * socket/tp/pcb (tp->pf is 0), we lose.
331 		 */
332 		af = tp->pf;
333 
334 		/*
335 		 * The route/route6 distinction is meaningless
336 		 * unless you're allocating space or passing parameters.
337 		 */
338 		ro = &tp->t_inpcb->inp_route;
339 	} else
340 		af = (((struct ip *)template)->ip_v == 6) ? AF_INET6 : AF_INET;
341 
342 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
343 	if (m == NULL)
344 		return;
345 	m->m_data += max_linkhdr;
346 	tlen = 0;
347 
348 #define xchg(a,b,type) do { type t; t=a; a=b; b=t; } while (0)
349 	switch (af) {
350 #ifdef INET6
351 	case AF_INET6:
352 		ip6 = mtod(m, struct ip6_hdr *);
353 		th = (struct tcphdr *)(ip6 + 1);
354 		tlen = sizeof(*ip6) + sizeof(*th);
355 		if (th0) {
356 			bcopy(template, ip6, sizeof(*ip6));
357 			bcopy(th0, th, sizeof(*th));
358 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
359 		} else {
360 			bcopy(template, ip6, tlen);
361 		}
362 		break;
363 #endif /* INET6 */
364 	case AF_INET:
365 		ip = mtod(m, struct ip *);
366 		th = (struct tcphdr *)(ip + 1);
367 		tlen = sizeof(*ip) + sizeof(*th);
368 		if (th0) {
369 			bcopy(template, ip, sizeof(*ip));
370 			bcopy(th0, th, sizeof(*th));
371 			xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, u_int32_t);
372 		} else {
373 			bcopy(template, ip, tlen);
374 		}
375 		break;
376 	}
377 	if (th0)
378 		xchg(th->th_dport, th->th_sport, u_int16_t);
379 	else
380 		flags = TH_ACK;
381 #undef xchg
382 
383 	m->m_len = tlen;
384 	m->m_pkthdr.len = tlen;
385 	m->m_pkthdr.rcvif = (struct ifnet *) 0;
386 	m->m_pkthdr.csum_flags |= M_TCP_CSUM_OUT;
387 	th->th_seq = htonl(seq);
388 	th->th_ack = htonl(ack);
389 	th->th_x2 = 0;
390 	th->th_off = sizeof (struct tcphdr) >> 2;
391 	th->th_flags = flags;
392 	if (tp)
393 		win >>= tp->rcv_scale;
394 	if (win > TCP_MAXWIN)
395 		win = TCP_MAXWIN;
396 	th->th_win = htons((u_int16_t)win);
397 	th->th_urp = 0;
398 
399 	/* force routing table */
400 	if (tp)
401 		m->m_pkthdr.ph_rtableid = tp->t_inpcb->inp_rtableid;
402 	else
403 		m->m_pkthdr.ph_rtableid = rtableid;
404 
405 	switch (af) {
406 #ifdef INET6
407 	case AF_INET6:
408 		ip6->ip6_flow = htonl(0x60000000);
409 		ip6->ip6_nxt  = IPPROTO_TCP;
410 		ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL, NULL);	/*XXX*/
411 		ip6->ip6_plen = tlen - sizeof(struct ip6_hdr);
412 		HTONS(ip6->ip6_plen);
413 		ip6_output(m, tp ? tp->t_inpcb->inp_outputopts6 : NULL,
414 		    (struct route_in6 *)ro, 0, NULL, NULL,
415 		    tp ? tp->t_inpcb : NULL);
416 		break;
417 #endif /* INET6 */
418 	case AF_INET:
419 		ip->ip_len = htons(tlen);
420 		ip->ip_ttl = ip_defttl;
421 		ip->ip_tos = 0;
422 		ip_output(m, NULL, ro, ip_mtudisc ? IP_MTUDISC : 0,
423 		    NULL, tp ? tp->t_inpcb : NULL, 0);
424 	}
425 }
426 
427 /*
428  * Create a new TCP control block, making an
429  * empty reassembly queue and hooking it to the argument
430  * protocol control block.
431  */
432 struct tcpcb *
433 tcp_newtcpcb(struct inpcb *inp)
434 {
435 	struct tcpcb *tp;
436 	int i;
437 
438 	tp = pool_get(&tcpcb_pool, PR_NOWAIT|PR_ZERO);
439 	if (tp == NULL)
440 		return (NULL);
441 	TAILQ_INIT(&tp->t_segq);
442 	tp->t_maxseg = tcp_mssdflt;
443 	tp->t_maxopd = 0;
444 
445 	TCP_INIT_DELACK(tp);
446 	for (i = 0; i < TCPT_NTIMERS; i++)
447 		TCP_TIMER_INIT(tp, i);
448 	timeout_set(&tp->t_reap_to, tcp_reaper, tp);
449 
450 #ifdef TCP_SACK
451 	tp->sack_enable = tcp_do_sack;
452 #endif
453 	tp->t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
454 	tp->t_inpcb = inp;
455 	/*
456 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
457 	 * rtt estimate.  Set rttvar so that srtt + 2 * rttvar gives
458 	 * reasonable initial retransmit time.
459 	 */
460 	tp->t_srtt = TCPTV_SRTTBASE;
461 	tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ <<
462 	    (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1);
463 	tp->t_rttmin = TCPTV_MIN;
464 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
465 	    TCPTV_MIN, TCPTV_REXMTMAX);
466 	tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
467 	tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
468 
469 	tp->t_pmtud_mtu_sent = 0;
470 	tp->t_pmtud_mss_acked = 0;
471 
472 #ifdef INET6
473 	/* we disallow IPv4 mapped address completely. */
474 	if ((inp->inp_flags & INP_IPV6) == 0)
475 		tp->pf = PF_INET;
476 	else
477 		tp->pf = PF_INET6;
478 #else
479 	tp->pf = PF_INET;
480 #endif
481 
482 #ifdef INET6
483 	if (inp->inp_flags & INP_IPV6)
484 		inp->inp_ipv6.ip6_hlim = ip6_defhlim;
485 	else
486 #endif /* INET6 */
487 		inp->inp_ip.ip_ttl = ip_defttl;
488 
489 	inp->inp_ppcb = (caddr_t)tp;
490 	return (tp);
491 }
492 
493 /*
494  * Drop a TCP connection, reporting
495  * the specified error.  If connection is synchronized,
496  * then send a RST to peer.
497  */
498 struct tcpcb *
499 tcp_drop(tp, errno)
500 	struct tcpcb *tp;
501 	int errno;
502 {
503 	struct socket *so = tp->t_inpcb->inp_socket;
504 
505 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
506 		tp->t_state = TCPS_CLOSED;
507 		(void) tcp_output(tp);
508 		tcpstat.tcps_drops++;
509 	} else
510 		tcpstat.tcps_conndrops++;
511 	if (errno == ETIMEDOUT && tp->t_softerror)
512 		errno = tp->t_softerror;
513 	so->so_error = errno;
514 	return (tcp_close(tp));
515 }
516 
517 /*
518  * Close a TCP control block:
519  *	discard all space held by the tcp
520  *	discard internet protocol block
521  *	wake up any sleepers
522  */
523 struct tcpcb *
524 tcp_close(struct tcpcb *tp)
525 {
526 	struct inpcb *inp = tp->t_inpcb;
527 	struct socket *so = inp->inp_socket;
528 #ifdef TCP_SACK
529 	struct sackhole *p, *q;
530 #endif
531 
532 	/* free the reassembly queue, if any */
533 	tcp_freeq(tp);
534 
535 	tcp_canceltimers(tp);
536 	TCP_CLEAR_DELACK(tp);
537 	syn_cache_cleanup(tp);
538 
539 #ifdef TCP_SACK
540 	/* Free SACK holes. */
541 	q = p = tp->snd_holes;
542 	while (p != 0) {
543 		q = p->next;
544 		pool_put(&sackhl_pool, p);
545 		p = q;
546 	}
547 #endif
548 	if (tp->t_template)
549 		(void) m_free(tp->t_template);
550 
551 	tp->t_flags |= TF_DEAD;
552 	timeout_add(&tp->t_reap_to, 0);
553 
554 	inp->inp_ppcb = 0;
555 	soisdisconnected(so);
556 	in_pcbdetach(inp);
557 	return (NULL);
558 }
559 
560 void
561 tcp_reaper(void *arg)
562 {
563 	struct tcpcb *tp = arg;
564 	int s;
565 
566 	s = splsoftnet();
567 	pool_put(&tcpcb_pool, tp);
568 	splx(s);
569 	tcpstat.tcps_closed++;
570 }
571 
572 int
573 tcp_freeq(struct tcpcb *tp)
574 {
575 	struct tcpqent *qe;
576 	int rv = 0;
577 
578 	while ((qe = TAILQ_FIRST(&tp->t_segq)) != NULL) {
579 		TAILQ_REMOVE(&tp->t_segq, qe, tcpqe_q);
580 		m_freem(qe->tcpqe_m);
581 		pool_put(&tcpqe_pool, qe);
582 		rv = 1;
583 	}
584 	return (rv);
585 }
586 
587 /*
588  * Compute proper scaling value for receiver window from buffer space
589  */
590 
591 void
592 tcp_rscale(struct tcpcb *tp, u_long hiwat)
593 {
594 	tp->request_r_scale = 0;
595 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
596 	       TCP_MAXWIN << tp->request_r_scale < hiwat)
597 		tp->request_r_scale++;
598 }
599 
600 /*
601  * Notify a tcp user of an asynchronous error;
602  * store error as soft error, but wake up user
603  * (for now, won't do anything until can select for soft error).
604  */
605 void
606 tcp_notify(inp, error)
607 	struct inpcb *inp;
608 	int error;
609 {
610 	struct tcpcb *tp = intotcpcb(inp);
611 	struct socket *so = inp->inp_socket;
612 
613 	/*
614 	 * Ignore some errors if we are hooked up.
615 	 * If connection hasn't completed, has retransmitted several times,
616 	 * and receives a second error, give up now.  This is better
617 	 * than waiting a long time to establish a connection that
618 	 * can never complete.
619 	 */
620 	if (tp->t_state == TCPS_ESTABLISHED &&
621 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
622 	      error == EHOSTDOWN)) {
623 		return;
624 	} else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
625 	    tp->t_rxtshift > 3 && tp->t_softerror)
626 		so->so_error = error;
627 	else
628 		tp->t_softerror = error;
629 	wakeup((caddr_t) &so->so_timeo);
630 	sorwakeup(so);
631 	sowwakeup(so);
632 }
633 
634 #ifdef INET6
635 void
636 tcp6_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *d)
637 {
638 	struct tcphdr th;
639 	struct tcpcb *tp;
640 	void (*notify)(struct inpcb *, int) = tcp_notify;
641 	struct ip6_hdr *ip6;
642 	const struct sockaddr_in6 *sa6_src = NULL;
643 	struct sockaddr_in6 *sa6 = satosin6(sa);
644 	struct inpcb *inp;
645 	struct mbuf *m;
646 	tcp_seq seq;
647 	int off;
648 	struct {
649 		u_int16_t th_sport;
650 		u_int16_t th_dport;
651 		u_int32_t th_seq;
652 	} *thp;
653 
654 	if (sa->sa_family != AF_INET6 ||
655 	    sa->sa_len != sizeof(struct sockaddr_in6) ||
656 	    IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
657 	    IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr))
658 		return;
659 	if ((unsigned)cmd >= PRC_NCMDS)
660 		return;
661 	else if (cmd == PRC_QUENCH) {
662 		/*
663 		 * Don't honor ICMP Source Quench messages meant for
664 		 * TCP connections.
665 		 */
666 		/* XXX there's no PRC_QUENCH in IPv6 */
667 		return;
668 	} else if (PRC_IS_REDIRECT(cmd))
669 		notify = in_rtchange, d = NULL;
670 	else if (cmd == PRC_MSGSIZE)
671 		; /* special code is present, see below */
672 	else if (cmd == PRC_HOSTDEAD)
673 		d = NULL;
674 	else if (inet6ctlerrmap[cmd] == 0)
675 		return;
676 
677 	/* if the parameter is from icmp6, decode it. */
678 	if (d != NULL) {
679 		struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
680 		m = ip6cp->ip6c_m;
681 		ip6 = ip6cp->ip6c_ip6;
682 		off = ip6cp->ip6c_off;
683 		sa6_src = ip6cp->ip6c_src;
684 	} else {
685 		m = NULL;
686 		ip6 = NULL;
687 		sa6_src = &sa6_any;
688 	}
689 
690 	if (ip6) {
691 		/*
692 		 * XXX: We assume that when ip6 is non NULL,
693 		 * M and OFF are valid.
694 		 */
695 
696 		/* check if we can safely examine src and dst ports */
697 		if (m->m_pkthdr.len < off + sizeof(*thp))
698 			return;
699 
700 		bzero(&th, sizeof(th));
701 #ifdef DIAGNOSTIC
702 		if (sizeof(*thp) > sizeof(th))
703 			panic("assumption failed in tcp6_ctlinput");
704 #endif
705 		m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
706 
707 		/*
708 		 * Check to see if we have a valid TCP connection
709 		 * corresponding to the address in the ICMPv6 message
710 		 * payload.
711 		 */
712 		inp = in6_pcbhashlookup(&tcbtable, &sa6->sin6_addr,
713 		    th.th_dport, (struct in6_addr *)&sa6_src->sin6_addr,
714 		    th.th_sport, rdomain);
715 		if (cmd == PRC_MSGSIZE) {
716 			/*
717 			 * Depending on the value of "valid" and routing table
718 			 * size (mtudisc_{hi,lo}wat), we will:
719 			 * - recalcurate the new MTU and create the
720 			 *   corresponding routing entry, or
721 			 * - ignore the MTU change notification.
722 			 */
723 			icmp6_mtudisc_update((struct ip6ctlparam *)d, inp != NULL);
724 			return;
725 		}
726 		if (inp) {
727 			seq = ntohl(th.th_seq);
728 			if (inp->inp_socket &&
729 			    (tp = intotcpcb(inp)) &&
730 			    SEQ_GEQ(seq, tp->snd_una) &&
731 			    SEQ_LT(seq, tp->snd_max))
732 				notify(inp, inet6ctlerrmap[cmd]);
733 		} else if (syn_cache_count &&
734 		    (inet6ctlerrmap[cmd] == EHOSTUNREACH ||
735 		     inet6ctlerrmap[cmd] == ENETUNREACH ||
736 		     inet6ctlerrmap[cmd] == EHOSTDOWN))
737 			syn_cache_unreach((struct sockaddr *)sa6_src,
738 			    sa, &th, rdomain);
739 	} else {
740 		(void) in6_pcbnotify(&tcbtable, sa6, 0,
741 		    sa6_src, 0, rdomain, cmd, NULL, notify);
742 	}
743 }
744 #endif
745 
746 void *
747 tcp_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
748 {
749 	struct ip *ip = v;
750 	struct tcphdr *th;
751 	struct tcpcb *tp;
752 	struct inpcb *inp;
753 	struct in_addr faddr;
754 	tcp_seq seq;
755 	u_int mtu;
756 	void (*notify)(struct inpcb *, int) = tcp_notify;
757 	int errno;
758 
759 	if (sa->sa_family != AF_INET)
760 		return NULL;
761 	faddr = satosin(sa)->sin_addr;
762 	if (faddr.s_addr == INADDR_ANY)
763 		return NULL;
764 
765 	if ((unsigned)cmd >= PRC_NCMDS)
766 		return NULL;
767 	errno = inetctlerrmap[cmd];
768 	if (cmd == PRC_QUENCH)
769 		/*
770 		 * Don't honor ICMP Source Quench messages meant for
771 		 * TCP connections.
772 		 */
773 		return NULL;
774 	else if (PRC_IS_REDIRECT(cmd))
775 		notify = in_rtchange, ip = 0;
776 	else if (cmd == PRC_MSGSIZE && ip_mtudisc && ip) {
777 		/*
778 		 * Verify that the packet in the icmp payload refers
779 		 * to an existing TCP connection.
780 		 */
781 		th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
782 		seq = ntohl(th->th_seq);
783 		inp = in_pcbhashlookup(&tcbtable,
784 		    ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport,
785 		    rdomain);
786 		if (inp && (tp = intotcpcb(inp)) &&
787 		    SEQ_GEQ(seq, tp->snd_una) &&
788 		    SEQ_LT(seq, tp->snd_max)) {
789 			struct icmp *icp;
790 			icp = (struct icmp *)((caddr_t)ip -
791 					      offsetof(struct icmp, icmp_ip));
792 
793 			/*
794 			 * If the ICMP message advertises a Next-Hop MTU
795 			 * equal or larger than the maximum packet size we have
796 			 * ever sent, drop the message.
797 			 */
798 			mtu = (u_int)ntohs(icp->icmp_nextmtu);
799 			if (mtu >= tp->t_pmtud_mtu_sent)
800 				return NULL;
801 			if (mtu >= tcp_hdrsz(tp) + tp->t_pmtud_mss_acked) {
802 				/*
803 				 * Calculate new MTU, and create corresponding
804 				 * route (traditional PMTUD).
805 				 */
806 				tp->t_flags &= ~TF_PMTUD_PEND;
807 				icmp_mtudisc(icp, inp->inp_rtableid);
808 			} else {
809 				/*
810 				 * Record the information got in the ICMP
811 				 * message; act on it later.
812 				 * If we had already recorded an ICMP message,
813 				 * replace the old one only if the new message
814 				 * refers to an older TCP segment
815 				 */
816 				if (tp->t_flags & TF_PMTUD_PEND) {
817 					if (SEQ_LT(tp->t_pmtud_th_seq, seq))
818 						return NULL;
819 				} else
820 					tp->t_flags |= TF_PMTUD_PEND;
821 				tp->t_pmtud_th_seq = seq;
822 				tp->t_pmtud_nextmtu = icp->icmp_nextmtu;
823 				tp->t_pmtud_ip_len = icp->icmp_ip.ip_len;
824 				tp->t_pmtud_ip_hl = icp->icmp_ip.ip_hl;
825 				return NULL;
826 			}
827 		} else {
828 			/* ignore if we don't have a matching connection */
829 			return NULL;
830 		}
831 		notify = tcp_mtudisc, ip = 0;
832 	} else if (cmd == PRC_MTUINC)
833 		notify = tcp_mtudisc_increase, ip = 0;
834 	else if (cmd == PRC_HOSTDEAD)
835 		ip = 0;
836 	else if (errno == 0)
837 		return NULL;
838 
839 	if (ip) {
840 		th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
841 		inp = in_pcbhashlookup(&tcbtable,
842 		    ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport,
843 		    rdomain);
844 		if (inp) {
845 			seq = ntohl(th->th_seq);
846 			if (inp->inp_socket &&
847 			    (tp = intotcpcb(inp)) &&
848 			    SEQ_GEQ(seq, tp->snd_una) &&
849 			    SEQ_LT(seq, tp->snd_max))
850 				notify(inp, errno);
851 		} else if (syn_cache_count &&
852 		    (inetctlerrmap[cmd] == EHOSTUNREACH ||
853 		     inetctlerrmap[cmd] == ENETUNREACH ||
854 		     inetctlerrmap[cmd] == EHOSTDOWN)) {
855 			struct sockaddr_in sin;
856 
857 			bzero(&sin, sizeof(sin));
858 			sin.sin_len = sizeof(sin);
859 			sin.sin_family = AF_INET;
860 			sin.sin_port = th->th_sport;
861 			sin.sin_addr = ip->ip_src;
862 			syn_cache_unreach((struct sockaddr *)&sin,
863 			    sa, th, rdomain);
864 		}
865 	} else
866 		in_pcbnotifyall(&tcbtable, sa, rdomain, errno, notify);
867 
868 	return NULL;
869 }
870 
871 
872 #ifdef INET6
873 /*
874  * Path MTU Discovery handlers.
875  */
876 void
877 tcp6_mtudisc_callback(sin6, rdomain)
878 	struct sockaddr_in6 *sin6;
879 	u_int rdomain;
880 {
881 	(void) in6_pcbnotify(&tcbtable, sin6, 0,
882 	    &sa6_any, 0, rdomain, PRC_MSGSIZE, NULL, tcp_mtudisc);
883 }
884 #endif /* INET6 */
885 
886 /*
887  * On receipt of path MTU corrections, flush old route and replace it
888  * with the new one.  Retransmit all unacknowledged packets, to ensure
889  * that all packets will be received.
890  */
891 void
892 tcp_mtudisc(inp, errno)
893 	struct inpcb *inp;
894 	int errno;
895 {
896 	struct tcpcb *tp = intotcpcb(inp);
897 	struct rtentry *rt = in_pcbrtentry(inp);
898 	int change = 0;
899 
900 	if (tp != 0) {
901 		int orig_maxseg = tp->t_maxseg;
902 		if (rt != 0) {
903 			/*
904 			 * If this was not a host route, remove and realloc.
905 			 */
906 			if ((rt->rt_flags & RTF_HOST) == 0) {
907 				in_rtchange(inp, errno);
908 				if ((rt = in_pcbrtentry(inp)) == 0)
909 					return;
910 			}
911 			if (orig_maxseg != tp->t_maxseg ||
912 			    (rt->rt_rmx.rmx_locks & RTV_MTU))
913 				change = 1;
914 		}
915 		tcp_mss(tp, -1);
916 
917 		/*
918 		 * Resend unacknowledged packets
919 		 */
920 		tp->snd_nxt = tp->snd_una;
921 		if (change || errno > 0)
922 			tcp_output(tp);
923 	}
924 }
925 
926 void
927 tcp_mtudisc_increase(inp, errno)
928 	struct inpcb *inp;
929 	int errno;
930 {
931 	struct tcpcb *tp = intotcpcb(inp);
932 	struct rtentry *rt = in_pcbrtentry(inp);
933 
934 	if (tp != 0 && rt != 0) {
935 		/*
936 		 * If this was a host route, remove and realloc.
937 		 */
938 		if (rt->rt_flags & RTF_HOST)
939 			in_rtchange(inp, errno);
940 
941 		/* also takes care of congestion window */
942 		tcp_mss(tp, -1);
943 	}
944 }
945 
946 #define TCP_ISS_CONN_INC 4096
947 int tcp_secret_init;
948 u_char tcp_secret[16];
949 MD5_CTX tcp_secret_ctx;
950 
951 void
952 tcp_set_iss_tsm(struct tcpcb *tp)
953 {
954 	MD5_CTX ctx;
955 	u_int32_t digest[4];
956 
957 	if (tcp_secret_init == 0) {
958 		arc4random_buf(tcp_secret, sizeof(tcp_secret));
959 		MD5Init(&tcp_secret_ctx);
960 		MD5Update(&tcp_secret_ctx, tcp_secret, sizeof(tcp_secret));
961 		tcp_secret_init = 1;
962 	}
963 	ctx = tcp_secret_ctx;
964 	MD5Update(&ctx, (char *)&tp->t_inpcb->inp_lport, sizeof(u_short));
965 	MD5Update(&ctx, (char *)&tp->t_inpcb->inp_fport, sizeof(u_short));
966 	if (tp->pf == AF_INET6) {
967 		MD5Update(&ctx, (char *)&tp->t_inpcb->inp_laddr6,
968 		    sizeof(struct in6_addr));
969 		MD5Update(&ctx, (char *)&tp->t_inpcb->inp_faddr6,
970 		    sizeof(struct in6_addr));
971 	} else {
972 		MD5Update(&ctx, (char *)&tp->t_inpcb->inp_laddr,
973 		    sizeof(struct in_addr));
974 		MD5Update(&ctx, (char *)&tp->t_inpcb->inp_faddr,
975 		    sizeof(struct in_addr));
976 	}
977 	MD5Final((u_char *)digest, &ctx);
978 	tcp_iss += TCP_ISS_CONN_INC;
979 	tp->iss = digest[0] + tcp_iss;
980 	tp->ts_modulate = digest[1];
981 }
982 
983 #ifdef TCP_SIGNATURE
984 int
985 tcp_signature_tdb_attach()
986 {
987 	return (0);
988 }
989 
990 int
991 tcp_signature_tdb_init(tdbp, xsp, ii)
992 	struct tdb *tdbp;
993 	struct xformsw *xsp;
994 	struct ipsecinit *ii;
995 {
996 	if ((ii->ii_authkeylen < 1) || (ii->ii_authkeylen > 80))
997 		return (EINVAL);
998 
999 	tdbp->tdb_amxkey = malloc(ii->ii_authkeylen, M_XDATA, M_NOWAIT);
1000 	if (tdbp->tdb_amxkey == NULL)
1001 		return (ENOMEM);
1002 	bcopy(ii->ii_authkey, tdbp->tdb_amxkey, ii->ii_authkeylen);
1003 	tdbp->tdb_amxkeylen = ii->ii_authkeylen;
1004 
1005 	return (0);
1006 }
1007 
1008 int
1009 tcp_signature_tdb_zeroize(tdbp)
1010 	struct tdb *tdbp;
1011 {
1012 	if (tdbp->tdb_amxkey) {
1013 		explicit_bzero(tdbp->tdb_amxkey, tdbp->tdb_amxkeylen);
1014 		free(tdbp->tdb_amxkey, M_XDATA, 0);
1015 		tdbp->tdb_amxkey = NULL;
1016 	}
1017 
1018 	return (0);
1019 }
1020 
1021 int
1022 tcp_signature_tdb_input(m, tdbp, skip, protoff)
1023 	struct mbuf *m;
1024 	struct tdb *tdbp;
1025 	int skip, protoff;
1026 {
1027 	return (0);
1028 }
1029 
1030 int
1031 tcp_signature_tdb_output(m, tdbp, mp, skip, protoff)
1032 	struct mbuf *m;
1033 	struct tdb *tdbp;
1034 	struct mbuf **mp;
1035 	int skip, protoff;
1036 {
1037 	return (EINVAL);
1038 }
1039 
1040 int
1041 tcp_signature_apply(fstate, data, len)
1042 	caddr_t fstate;
1043 	caddr_t data;
1044 	unsigned int len;
1045 {
1046 	MD5Update((MD5_CTX *)fstate, (char *)data, len);
1047 	return 0;
1048 }
1049 
1050 int
1051 tcp_signature(struct tdb *tdb, int af, struct mbuf *m, struct tcphdr *th,
1052     int iphlen, int doswap, char *sig)
1053 {
1054 	MD5_CTX ctx;
1055 	int len;
1056 	struct tcphdr th0;
1057 
1058 	MD5Init(&ctx);
1059 
1060 	switch(af) {
1061 	case 0:
1062 #ifdef INET
1063 	case AF_INET: {
1064 		struct ippseudo ippseudo;
1065 		struct ip *ip;
1066 
1067 		ip = mtod(m, struct ip *);
1068 
1069 		ippseudo.ippseudo_src = ip->ip_src;
1070 		ippseudo.ippseudo_dst = ip->ip_dst;
1071 		ippseudo.ippseudo_pad = 0;
1072 		ippseudo.ippseudo_p = IPPROTO_TCP;
1073 		ippseudo.ippseudo_len = htons(m->m_pkthdr.len - iphlen);
1074 
1075 		MD5Update(&ctx, (char *)&ippseudo,
1076 		    sizeof(struct ippseudo));
1077 		break;
1078 		}
1079 #endif
1080 #ifdef INET6
1081 	case AF_INET6: {
1082 		struct ip6_hdr_pseudo ip6pseudo;
1083 		struct ip6_hdr *ip6;
1084 
1085 		ip6 = mtod(m, struct ip6_hdr *);
1086 		bzero(&ip6pseudo, sizeof(ip6pseudo));
1087 		ip6pseudo.ip6ph_src = ip6->ip6_src;
1088 		ip6pseudo.ip6ph_dst = ip6->ip6_dst;
1089 		in6_clearscope(&ip6pseudo.ip6ph_src);
1090 		in6_clearscope(&ip6pseudo.ip6ph_dst);
1091 		ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
1092 		ip6pseudo.ip6ph_len = htonl(m->m_pkthdr.len - iphlen);
1093 
1094 		MD5Update(&ctx, (char *)&ip6pseudo,
1095 		    sizeof(ip6pseudo));
1096 		break;
1097 		}
1098 #endif
1099 	}
1100 
1101 	th0 = *th;
1102 	th0.th_sum = 0;
1103 
1104 	if (doswap) {
1105 		HTONL(th0.th_seq);
1106 		HTONL(th0.th_ack);
1107 		HTONS(th0.th_win);
1108 		HTONS(th0.th_urp);
1109 	}
1110 	MD5Update(&ctx, (char *)&th0, sizeof(th0));
1111 
1112 	len = m->m_pkthdr.len - iphlen - th->th_off * sizeof(uint32_t);
1113 
1114 	if (len > 0 &&
1115 	    m_apply(m, iphlen + th->th_off * sizeof(uint32_t), len,
1116 	    tcp_signature_apply, (caddr_t)&ctx))
1117 		return (-1);
1118 
1119 	MD5Update(&ctx, tdb->tdb_amxkey, tdb->tdb_amxkeylen);
1120 	MD5Final(sig, &ctx);
1121 
1122 	return (0);
1123 }
1124 #endif /* TCP_SIGNATURE */
1125