xref: /csrg-svn/sys/netinet/tcp_input.c (revision 56908)
123190Smckusick /*
244375Skarels  * Copyright (c) 1982, 1986, 1988, 1990 Regents of the University of California.
332787Sbostic  * All rights reserved.
423190Smckusick  *
544485Sbostic  * %sccs.include.redist.c%
632787Sbostic  *
7*56908Storek  *	@(#)tcp_input.c	7.29 (Berkeley) 11/24/92
823190Smckusick  */
94601Swnj 
1056531Sbostic #include <sys/param.h>
1156531Sbostic #include <sys/systm.h>
1256531Sbostic #include <sys/malloc.h>
1356531Sbostic #include <sys/mbuf.h>
1456531Sbostic #include <sys/protosw.h>
1556531Sbostic #include <sys/socket.h>
1656531Sbostic #include <sys/socketvar.h>
1756531Sbostic #include <sys/errno.h>
1810894Ssam 
1956531Sbostic #include <net/if.h>
2056531Sbostic #include <net/route.h>
2110894Ssam 
2256531Sbostic #include <netinet/in.h>
2356531Sbostic #include <netinet/in_systm.h>
2456531Sbostic #include <netinet/ip.h>
2556531Sbostic #include <netinet/in_pcb.h>
2656531Sbostic #include <netinet/ip_var.h>
2756531Sbostic #include <netinet/tcp.h>
2856531Sbostic #include <netinet/tcp_fsm.h>
2956531Sbostic #include <netinet/tcp_seq.h>
3056531Sbostic #include <netinet/tcp_timer.h>
3156531Sbostic #include <netinet/tcp_var.h>
3256531Sbostic #include <netinet/tcpip.h>
3356531Sbostic #include <netinet/tcp_debug.h>
344601Swnj 
3532098Skarels int	tcprexmtthresh = 3;
3644375Skarels int	tcppredack;	/* XXX debugging: times hdr predict ok for acks */
3744375Skarels int	tcppreddat;	/* XXX # times header prediction ok for data packets */
3844375Skarels int	tcppcbcachemiss;
395267Sroot struct	tcpiphdr tcp_saveti;
4044375Skarels struct	inpcb *tcp_last_inpcb = &tcb;
414601Swnj 
425267Sroot struct	tcpcb *tcp_newtcpcb();
4324816Skarels 
445065Swnj /*
4524816Skarels  * Insert segment ti into reassembly queue of tcp with
4624816Skarels  * control block tp.  Return TH_FIN if reassembly now includes
4724816Skarels  * a segment with FIN.  The macro form does the common case inline
4824816Skarels  * (segment is the next to be received on an established connection,
4924816Skarels  * and the queue is empty), avoiding linkage into and removal
5024816Skarels  * from the queue and repetition of various conversions.
5134278Skarels  * Set DELACK for segments received in order, but ack immediately
5234278Skarels  * when segments are out of order (so fast retransmit can work).
5324816Skarels  */
5424816Skarels #define	TCP_REASS(tp, ti, m, so, flags) { \
5524816Skarels 	if ((ti)->ti_seq == (tp)->rcv_nxt && \
5624816Skarels 	    (tp)->seg_next == (struct tcpiphdr *)(tp) && \
5724816Skarels 	    (tp)->t_state == TCPS_ESTABLISHED) { \
5834278Skarels 		tp->t_flags |= TF_DELACK; \
5924816Skarels 		(tp)->rcv_nxt += (ti)->ti_len; \
6024816Skarels 		flags = (ti)->ti_flags & TH_FIN; \
6130525Skarels 		tcpstat.tcps_rcvpack++;\
6230525Skarels 		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
6324816Skarels 		sbappend(&(so)->so_rcv, (m)); \
6424816Skarels 		sorwakeup(so); \
6534278Skarels 	} else { \
6644375Skarels 		(flags) = tcp_reass((tp), (ti), (m)); \
6734278Skarels 		tp->t_flags |= TF_ACKNOW; \
6834278Skarels 	} \
6924816Skarels }
7024816Skarels 
7144375Skarels tcp_reass(tp, ti, m)
7224816Skarels 	register struct tcpcb *tp;
7324816Skarels 	register struct tcpiphdr *ti;
7444375Skarels 	struct mbuf *m;
7524816Skarels {
7624816Skarels 	register struct tcpiphdr *q;
7724816Skarels 	struct socket *so = tp->t_inpcb->inp_socket;
7824816Skarels 	int flags;
7924816Skarels 
8024816Skarels 	/*
8124816Skarels 	 * Call with ti==0 after become established to
8224816Skarels 	 * force pre-ESTABLISHED data up to user socket.
8324816Skarels 	 */
8424816Skarels 	if (ti == 0)
8524816Skarels 		goto present;
8624816Skarels 
8724816Skarels 	/*
8824816Skarels 	 * Find a segment which begins after this one does.
8924816Skarels 	 */
9024816Skarels 	for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
9124816Skarels 	    q = (struct tcpiphdr *)q->ti_next)
9224816Skarels 		if (SEQ_GT(q->ti_seq, ti->ti_seq))
9324816Skarels 			break;
9424816Skarels 
9524816Skarels 	/*
9624816Skarels 	 * If there is a preceding segment, it may provide some of
9724816Skarels 	 * our data already.  If so, drop the data from the incoming
9824816Skarels 	 * segment.  If it provides all of our data, drop us.
9924816Skarels 	 */
10024816Skarels 	if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
10124816Skarels 		register int i;
10224816Skarels 		q = (struct tcpiphdr *)q->ti_prev;
10324816Skarels 		/* conversion to int (in i) handles seq wraparound */
10424816Skarels 		i = q->ti_seq + q->ti_len - ti->ti_seq;
10524816Skarels 		if (i > 0) {
10630525Skarels 			if (i >= ti->ti_len) {
10730525Skarels 				tcpstat.tcps_rcvduppack++;
10830525Skarels 				tcpstat.tcps_rcvdupbyte += ti->ti_len;
10944375Skarels 				m_freem(m);
11044375Skarels 				return (0);
11130525Skarels 			}
11244375Skarels 			m_adj(m, i);
11324816Skarels 			ti->ti_len -= i;
11424816Skarels 			ti->ti_seq += i;
11524816Skarels 		}
11624816Skarels 		q = (struct tcpiphdr *)(q->ti_next);
11724816Skarels 	}
11830525Skarels 	tcpstat.tcps_rcvoopack++;
11930525Skarels 	tcpstat.tcps_rcvoobyte += ti->ti_len;
12044375Skarels 	REASS_MBUF(ti) = m;		/* XXX */
12124816Skarels 
12224816Skarels 	/*
12324816Skarels 	 * While we overlap succeeding segments trim them or,
12424816Skarels 	 * if they are completely covered, dequeue them.
12524816Skarels 	 */
12624816Skarels 	while (q != (struct tcpiphdr *)tp) {
12724816Skarels 		register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
12824816Skarels 		if (i <= 0)
12924816Skarels 			break;
13024816Skarels 		if (i < q->ti_len) {
13124816Skarels 			q->ti_seq += i;
13224816Skarels 			q->ti_len -= i;
13344375Skarels 			m_adj(REASS_MBUF(q), i);
13424816Skarels 			break;
13524816Skarels 		}
13624816Skarels 		q = (struct tcpiphdr *)q->ti_next;
13744375Skarels 		m = REASS_MBUF((struct tcpiphdr *)q->ti_prev);
13824816Skarels 		remque(q->ti_prev);
13924816Skarels 		m_freem(m);
14024816Skarels 	}
14124816Skarels 
14224816Skarels 	/*
14324816Skarels 	 * Stick new segment in its place.
14424816Skarels 	 */
14524816Skarels 	insque(ti, q->ti_prev);
14624816Skarels 
14724816Skarels present:
14824816Skarels 	/*
14924816Skarels 	 * Present data to user, advancing rcv_nxt through
15024816Skarels 	 * completed sequence space.
15124816Skarels 	 */
15224816Skarels 	if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
15324816Skarels 		return (0);
15424816Skarels 	ti = tp->seg_next;
15524816Skarels 	if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
15624816Skarels 		return (0);
15724816Skarels 	if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
15824816Skarels 		return (0);
15924816Skarels 	do {
16024816Skarels 		tp->rcv_nxt += ti->ti_len;
16124816Skarels 		flags = ti->ti_flags & TH_FIN;
16224816Skarels 		remque(ti);
16344375Skarels 		m = REASS_MBUF(ti);
16424816Skarels 		ti = (struct tcpiphdr *)ti->ti_next;
16524816Skarels 		if (so->so_state & SS_CANTRCVMORE)
16624816Skarels 			m_freem(m);
16724816Skarels 		else
16824816Skarels 			sbappend(&so->so_rcv, m);
16924816Skarels 	} while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
17024816Skarels 	sorwakeup(so);
17124816Skarels 	return (flags);
17224816Skarels }
17324816Skarels 
17424816Skarels /*
1755065Swnj  * TCP input routine, follows pages 65-76 of the
1765065Swnj  * protocol specification dated September, 1981 very closely.
1775065Swnj  */
17837320Skarels tcp_input(m, iphlen)
17937320Skarels 	register struct mbuf *m;
18037320Skarels 	int iphlen;
1814601Swnj {
1824924Swnj 	register struct tcpiphdr *ti;
18344375Skarels 	register struct inpcb *inp;
1845440Swnj 	struct mbuf *om = 0;
1854924Swnj 	int len, tlen, off;
1865391Swnj 	register struct tcpcb *tp = 0;
1874924Swnj 	register int tiflags;
1884803Swnj 	struct socket *so;
18931721Skarels 	int todrop, acked, ourfinisacked, needoutput = 0;
1905267Sroot 	short ostate;
1916028Sroot 	struct in_addr laddr;
19210769Ssam 	int dropsocket = 0;
19330525Skarels 	int iss = 0;
1944924Swnj 
19530525Skarels 	tcpstat.tcps_rcvtotal++;
1964924Swnj 	/*
1975244Sroot 	 * Get IP and TCP header together in first mbuf.
1985244Sroot 	 * Note: IP leaves IP header in first mbuf.
1994924Swnj 	 */
2005020Sroot 	ti = mtod(m, struct tcpiphdr *);
20137320Skarels 	if (iphlen > sizeof (struct ip))
20237320Skarels 		ip_stripoptions(m, (struct mbuf *)0);
20344375Skarels 	if (m->m_len < sizeof (struct tcpiphdr)) {
2045307Sroot 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
20530525Skarels 			tcpstat.tcps_rcvshort++;
2065307Sroot 			return;
2075085Swnj 		}
2085085Swnj 		ti = mtod(m, struct tcpiphdr *);
2095085Swnj 	}
2104601Swnj 
2114601Swnj 	/*
2125244Sroot 	 * Checksum extended TCP header and data.
2134601Swnj 	 */
2144924Swnj 	tlen = ((struct ip *)ti)->ip_len;
2154924Swnj 	len = sizeof (struct ip) + tlen;
21637320Skarels 	ti->ti_next = ti->ti_prev = 0;
21737320Skarels 	ti->ti_x1 = 0;
21837320Skarels 	ti->ti_len = (u_short)tlen;
21944375Skarels 	HTONS(ti->ti_len);
22037320Skarels 	if (ti->ti_sum = in_cksum(m, len)) {
22137320Skarels 		tcpstat.tcps_rcvbadsum++;
22237320Skarels 		goto drop;
2234601Swnj 	}
2244601Swnj 
2254601Swnj 	/*
2265244Sroot 	 * Check that TCP offset makes sense,
22744375Skarels 	 * pull out TCP options and adjust length.		XXX
2284601Swnj 	 */
2294924Swnj 	off = ti->ti_off << 2;
2305231Swnj 	if (off < sizeof (struct tcphdr) || off > tlen) {
23130525Skarels 		tcpstat.tcps_rcvbadoff++;
2325085Swnj 		goto drop;
2334924Swnj 	}
2346211Swnj 	tlen -= off;
2356211Swnj 	ti->ti_len = tlen;
2365440Swnj 	if (off > sizeof (struct tcphdr)) {
23724816Skarels 		if (m->m_len < sizeof(struct ip) + off) {
23824816Skarels 			if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
23930525Skarels 				tcpstat.tcps_rcvshort++;
24024816Skarels 				return;
24124816Skarels 			}
24224816Skarels 			ti = mtod(m, struct tcpiphdr *);
2435440Swnj 		}
2449642Ssam 		om = m_get(M_DONTWAIT, MT_DATA);
2455440Swnj 		if (om == 0)
2465440Swnj 			goto drop;
2475440Swnj 		om->m_len = off - sizeof (struct tcphdr);
2485440Swnj 		{ caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
2496161Ssam 		  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
2505440Swnj 		  m->m_len -= om->m_len;
25137320Skarels 		  m->m_pkthdr.len -= om->m_len;
2526161Ssam 		  bcopy(op+om->m_len, op,
2536161Ssam 		   (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
2545440Swnj 		}
2555440Swnj 	}
2565065Swnj 	tiflags = ti->ti_flags;
2574924Swnj 
2586093Sroot 	/*
2595244Sroot 	 * Convert TCP protocol specific fields to host format.
2605085Swnj 	 */
26144375Skarels 	NTOHL(ti->ti_seq);
26244375Skarels 	NTOHL(ti->ti_ack);
26344375Skarels 	NTOHS(ti->ti_win);
26444375Skarels 	NTOHS(ti->ti_urp);
2655085Swnj 
2665085Swnj 	/*
2678271Sroot 	 * Locate pcb for segment.
2684924Swnj 	 */
26930525Skarels findpcb:
27044375Skarels 	inp = tcp_last_inpcb;
27144375Skarels 	if (inp->inp_lport != ti->ti_dport ||
27244375Skarels 	    inp->inp_fport != ti->ti_sport ||
27344375Skarels 	    inp->inp_faddr.s_addr != ti->ti_src.s_addr ||
27444375Skarels 	    inp->inp_laddr.s_addr != ti->ti_dst.s_addr) {
27544375Skarels 		inp = in_pcblookup(&tcb, ti->ti_src, ti->ti_sport,
27644375Skarels 		    ti->ti_dst, ti->ti_dport, INPLOOKUP_WILDCARD);
27744375Skarels 		if (inp)
27844375Skarels 			tcp_last_inpcb = inp;
27944375Skarels 		++tcppcbcachemiss;
28044375Skarels 	}
2815065Swnj 
2825065Swnj 	/*
2835065Swnj 	 * If the state is CLOSED (i.e., TCB does not exist) then
2845244Sroot 	 * all data in the incoming segment is discarded.
28532098Skarels 	 * If the TCB exists but is in CLOSED state, it is embryonic,
28632098Skarels 	 * but should either do a listen or a connect soon.
2875065Swnj 	 */
2885300Sroot 	if (inp == 0)
2895085Swnj 		goto dropwithreset;
2905065Swnj 	tp = intotcpcb(inp);
2915300Sroot 	if (tp == 0)
2925085Swnj 		goto dropwithreset;
29332098Skarels 	if (tp->t_state == TCPS_CLOSED)
29432098Skarels 		goto drop;
2955109Swnj 	so = inp->inp_socket;
29644375Skarels 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
29744375Skarels 		if (so->so_options & SO_DEBUG) {
29844375Skarels 			ostate = tp->t_state;
29944375Skarels 			tcp_saveti = *ti;
30044375Skarels 		}
30144375Skarels 		if (so->so_options & SO_ACCEPTCONN) {
30244375Skarels 			so = sonewconn(so, 0);
30344375Skarels 			if (so == 0)
30444375Skarels 				goto drop;
30544375Skarels 			/*
30644375Skarels 			 * This is ugly, but ....
30744375Skarels 			 *
30844375Skarels 			 * Mark socket as temporary until we're
30944375Skarels 			 * committed to keeping it.  The code at
31044375Skarels 			 * ``drop'' and ``dropwithreset'' check the
31144375Skarels 			 * flag dropsocket to see if the temporary
31244375Skarels 			 * socket created here should be discarded.
31344375Skarels 			 * We mark the socket as discardable until
31444375Skarels 			 * we're committed to it below in TCPS_LISTEN.
31544375Skarels 			 */
31644375Skarels 			dropsocket++;
31744375Skarels 			inp = (struct inpcb *)so->so_pcb;
31844375Skarels 			inp->inp_laddr = ti->ti_dst;
31944375Skarels 			inp->inp_lport = ti->ti_dport;
32044375Skarels #if BSD>=43
32144375Skarels 			inp->inp_options = ip_srcroute();
32244375Skarels #endif
32344375Skarels 			tp = intotcpcb(inp);
32444375Skarels 			tp->t_state = TCPS_LISTEN;
32544375Skarels 		}
3265267Sroot 	}
3274601Swnj 
3284601Swnj 	/*
3295162Swnj 	 * Segment received on connection.
3305162Swnj 	 * Reset idle time and keep-alive timer.
3315162Swnj 	 */
3325162Swnj 	tp->t_idle = 0;
33333745Skarels 	tp->t_timer[TCPT_KEEP] = tcp_keepidle;
3345162Swnj 
3355162Swnj 	/*
33617272Skarels 	 * Process options if not in LISTEN state,
33717272Skarels 	 * else do it below (after getting remote address).
3385440Swnj 	 */
33917272Skarels 	if (om && tp->t_state != TCPS_LISTEN) {
34017272Skarels 		tcp_dooptions(tp, om, ti);
3415440Swnj 		om = 0;
3425440Swnj 	}
34344375Skarels 	/*
34444375Skarels 	 * Header prediction: check for the two common cases
34544375Skarels 	 * of a uni-directional data xfer.  If the packet has
34644375Skarels 	 * no control flags, is in-sequence, the window didn't
34744375Skarels 	 * change and we're not retransmitting, it's a
34844375Skarels 	 * candidate.  If the length is zero and the ack moved
34944375Skarels 	 * forward, we're the sender side of the xfer.  Just
35044375Skarels 	 * free the data acked & wake any higher level process
35144375Skarels 	 * that was blocked waiting for space.  If the length
35244375Skarels 	 * is non-zero and the ack didn't move, we're the
35344375Skarels 	 * receiver side.  If we're getting packets in-order
35444375Skarels 	 * (the reassembly queue is empty), add the data to
35544375Skarels 	 * the socket buffer and note that we need a delayed ack.
35644375Skarels 	 */
35744375Skarels 	if (tp->t_state == TCPS_ESTABLISHED &&
35844375Skarels 	    (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
35944375Skarels 	    ti->ti_seq == tp->rcv_nxt &&
36044375Skarels 	    ti->ti_win && ti->ti_win == tp->snd_wnd &&
36144375Skarels 	    tp->snd_nxt == tp->snd_max) {
36244375Skarels 		if (ti->ti_len == 0) {
36344375Skarels 			if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
36444375Skarels 			    SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
36544375Skarels 			    tp->snd_cwnd >= tp->snd_wnd) {
36644375Skarels 				/*
36744375Skarels 				 * this is a pure ack for outstanding data.
36844375Skarels 				 */
36944375Skarels 				++tcppredack;
37044375Skarels 				if (tp->t_rtt && SEQ_GT(ti->ti_ack,tp->t_rtseq))
37144375Skarels 					tcp_xmit_timer(tp);
37244375Skarels 				acked = ti->ti_ack - tp->snd_una;
37344375Skarels 				tcpstat.tcps_rcvackpack++;
37444375Skarels 				tcpstat.tcps_rcvackbyte += acked;
37544375Skarels 				sbdrop(&so->so_snd, acked);
37644375Skarels 				tp->snd_una = ti->ti_ack;
37744375Skarels 				m_freem(m);
3785440Swnj 
37944375Skarels 				/*
38044375Skarels 				 * If all outstanding data are acked, stop
38144375Skarels 				 * retransmit timer, otherwise restart timer
38244375Skarels 				 * using current (possibly backed-off) value.
38344375Skarels 				 * If process is waiting for space,
38444375Skarels 				 * wakeup/selwakeup/signal.  If data
38544375Skarels 				 * are ready to send, let tcp_output
38644375Skarels 				 * decide between more output or persist.
38744375Skarels 				 */
38844375Skarels 				if (tp->snd_una == tp->snd_max)
38944375Skarels 					tp->t_timer[TCPT_REXMT] = 0;
39044375Skarels 				else if (tp->t_timer[TCPT_PERSIST] == 0)
39144375Skarels 					tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
39244375Skarels 
39344375Skarels 				if (so->so_snd.sb_flags & SB_NOTIFY)
39444375Skarels 					sowwakeup(so);
39544375Skarels 				if (so->so_snd.sb_cc)
39644375Skarels 					(void) tcp_output(tp);
39744375Skarels 				return;
39844375Skarels 			}
39944375Skarels 		} else if (ti->ti_ack == tp->snd_una &&
40044375Skarels 		    tp->seg_next == (struct tcpiphdr *)tp &&
40144375Skarels 		    ti->ti_len <= sbspace(&so->so_rcv)) {
40244375Skarels 			/*
40344375Skarels 			 * this is a pure, in-sequence data packet
40444375Skarels 			 * with nothing on the reassembly queue and
40544375Skarels 			 * we have enough buffer space to take it.
40644375Skarels 			 */
40744375Skarels 			++tcppreddat;
40844375Skarels 			tp->rcv_nxt += ti->ti_len;
40944375Skarels 			tcpstat.tcps_rcvpack++;
41044375Skarels 			tcpstat.tcps_rcvbyte += ti->ti_len;
41144375Skarels 			/*
41244375Skarels 			 * Drop TCP and IP headers then add data
41344375Skarels 			 * to socket buffer
41444375Skarels 			 */
41544375Skarels 			m->m_data += sizeof(struct tcpiphdr);
41644375Skarels 			m->m_len -= sizeof(struct tcpiphdr);
41744375Skarels 			sbappend(&so->so_rcv, m);
41844375Skarels 			sorwakeup(so);
41944375Skarels 			tp->t_flags |= TF_DELACK;
42044375Skarels 			return;
42144375Skarels 		}
42244375Skarels 	}
42344375Skarels 
4245440Swnj 	/*
42544375Skarels 	 * Drop TCP and IP headers; TCP options were dropped above.
42644375Skarels 	 */
42744375Skarels 	m->m_data += sizeof(struct tcpiphdr);
42844375Skarels 	m->m_len -= sizeof(struct tcpiphdr);
42944375Skarels 
43044375Skarels 	/*
4315085Swnj 	 * Calculate amount of space in receive window,
4325085Swnj 	 * and then do TCP input processing.
43324816Skarels 	 * Receive window is amount of space in rcv queue,
43424816Skarels 	 * but not less than advertised window.
4354601Swnj 	 */
43625939Skarels 	{ int win;
4374601Swnj 
43825939Skarels 	win = sbspace(&so->so_rcv);
43925939Skarels 	if (win < 0)
44025939Skarels 		win = 0;
44137320Skarels 	tp->rcv_wnd = max(win, (int)(tp->rcv_adv - tp->rcv_nxt));
44225939Skarels 	}
44325939Skarels 
4444601Swnj 	switch (tp->t_state) {
4454601Swnj 
4465065Swnj 	/*
4475065Swnj 	 * If the state is LISTEN then ignore segment if it contains an RST.
4485065Swnj 	 * If the segment contains an ACK then it is bad and send a RST.
4495065Swnj 	 * If it does not contain a SYN then it is not interesting; drop it.
45025197Skarels 	 * Don't bother responding if the destination was a broadcast.
4515085Swnj 	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
4525065Swnj 	 * tp->iss, and send a segment:
4535085Swnj 	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
4545065Swnj 	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
4555065Swnj 	 * Fill in remote peer address fields if not previously specified.
4565065Swnj 	 * Enter SYN_RECEIVED state, and process any other fields of this
4575244Sroot 	 * segment in this state.
4585065Swnj 	 */
4598271Sroot 	case TCPS_LISTEN: {
46010145Ssam 		struct mbuf *am;
4618271Sroot 		register struct sockaddr_in *sin;
4628271Sroot 
4635065Swnj 		if (tiflags & TH_RST)
4645065Swnj 			goto drop;
4655300Sroot 		if (tiflags & TH_ACK)
4665085Swnj 			goto dropwithreset;
4675300Sroot 		if ((tiflags & TH_SYN) == 0)
4685065Swnj 			goto drop;
46937320Skarels 		if (m->m_flags & M_BCAST)
47025197Skarels 			goto drop;
47144375Skarels 		am = m_get(M_DONTWAIT, MT_SONAME);	/* XXX */
47210145Ssam 		if (am == NULL)
47310145Ssam 			goto drop;
47410145Ssam 		am->m_len = sizeof (struct sockaddr_in);
4758599Sroot 		sin = mtod(am, struct sockaddr_in *);
4768271Sroot 		sin->sin_family = AF_INET;
47737320Skarels 		sin->sin_len = sizeof(*sin);
4788271Sroot 		sin->sin_addr = ti->ti_src;
4798271Sroot 		sin->sin_port = ti->ti_sport;
48056399Ssklower 		bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
4816028Sroot 		laddr = inp->inp_laddr;
48210145Ssam 		if (inp->inp_laddr.s_addr == INADDR_ANY)
4836028Sroot 			inp->inp_laddr = ti->ti_dst;
4848599Sroot 		if (in_pcbconnect(inp, am)) {
4856028Sroot 			inp->inp_laddr = laddr;
4868716Sroot 			(void) m_free(am);
4875244Sroot 			goto drop;
4886028Sroot 		}
4898716Sroot 		(void) m_free(am);
4905244Sroot 		tp->t_template = tcp_template(tp);
4915244Sroot 		if (tp->t_template == 0) {
49226386Skarels 			tp = tcp_drop(tp, ENOBUFS);
49317264Skarels 			dropsocket = 0;		/* socket is already gone */
4945244Sroot 			goto drop;
4955244Sroot 		}
49617272Skarels 		if (om) {
49717272Skarels 			tcp_dooptions(tp, om, ti);
49817272Skarels 			om = 0;
49917272Skarels 		}
50030525Skarels 		if (iss)
50130525Skarels 			tp->iss = iss;
50230525Skarels 		else
50330525Skarels 			tp->iss = tcp_iss;
50430525Skarels 		tcp_iss += TCP_ISSINCR/2;
5055065Swnj 		tp->irs = ti->ti_seq;
5065085Swnj 		tcp_sendseqinit(tp);
5075085Swnj 		tcp_rcvseqinit(tp);
50825939Skarels 		tp->t_flags |= TF_ACKNOW;
5095065Swnj 		tp->t_state = TCPS_SYN_RECEIVED;
51033745Skarels 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
51110769Ssam 		dropsocket = 0;		/* committed to socket */
51230525Skarels 		tcpstat.tcps_accepts++;
5135085Swnj 		goto trimthenstep6;
5148271Sroot 		}
5154601Swnj 
5165065Swnj 	/*
5175065Swnj 	 * If the state is SYN_SENT:
5185065Swnj 	 *	if seg contains an ACK, but not for our SYN, drop the input.
5195065Swnj 	 *	if seg contains a RST, then drop the connection.
5205065Swnj 	 *	if seg does not contain SYN, then drop it.
5215065Swnj 	 * Otherwise this is an acceptable SYN segment
5225065Swnj 	 *	initialize tp->rcv_nxt and tp->irs
5235065Swnj 	 *	if seg contains ack then advance tp->snd_una
5245065Swnj 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
5255065Swnj 	 *	arrange for segment to be acked (eventually)
5265065Swnj 	 *	continue processing rest of data/controls, beginning with URG
5275065Swnj 	 */
5285065Swnj 	case TCPS_SYN_SENT:
5295065Swnj 		if ((tiflags & TH_ACK) &&
53024816Skarels 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
5315231Swnj 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
5325085Swnj 			goto dropwithreset;
5335065Swnj 		if (tiflags & TH_RST) {
53410394Ssam 			if (tiflags & TH_ACK)
53510394Ssam 				tp = tcp_drop(tp, ECONNREFUSED);
5365065Swnj 			goto drop;
5374601Swnj 		}
5385065Swnj 		if ((tiflags & TH_SYN) == 0)
5395065Swnj 			goto drop;
54030974Skarels 		if (tiflags & TH_ACK) {
54130974Skarels 			tp->snd_una = ti->ti_ack;
54230974Skarels 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
54330974Skarels 				tp->snd_nxt = tp->snd_una;
54430974Skarels 		}
5455244Sroot 		tp->t_timer[TCPT_REXMT] = 0;
5465065Swnj 		tp->irs = ti->ti_seq;
5475085Swnj 		tcp_rcvseqinit(tp);
5485085Swnj 		tp->t_flags |= TF_ACKNOW;
54930974Skarels 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
55030525Skarels 			tcpstat.tcps_connects++;
5515244Sroot 			soisconnected(so);
5525065Swnj 			tp->t_state = TCPS_ESTABLISHED;
55344375Skarels 			(void) tcp_reass(tp, (struct tcpiphdr *)0,
55444375Skarels 				(struct mbuf *)0);
55532098Skarels 			/*
55632098Skarels 			 * if we didn't have to retransmit the SYN,
55732098Skarels 			 * use its rtt as our initial srtt & rtt var.
55832098Skarels 			 */
55944375Skarels 			if (tp->t_rtt)
56044375Skarels 				tcp_xmit_timer(tp);
5615162Swnj 		} else
5625085Swnj 			tp->t_state = TCPS_SYN_RECEIVED;
5635085Swnj 
5645085Swnj trimthenstep6:
5655085Swnj 		/*
5665231Swnj 		 * Advance ti->ti_seq to correspond to first data byte.
5675085Swnj 		 * If data, trim to stay within window,
5685085Swnj 		 * dropping FIN if necessary.
5695085Swnj 		 */
5705231Swnj 		ti->ti_seq++;
5715085Swnj 		if (ti->ti_len > tp->rcv_wnd) {
5725085Swnj 			todrop = ti->ti_len - tp->rcv_wnd;
5735085Swnj 			m_adj(m, -todrop);
5745085Swnj 			ti->ti_len = tp->rcv_wnd;
57525939Skarels 			tiflags &= ~TH_FIN;
57630525Skarels 			tcpstat.tcps_rcvpackafterwin++;
57730525Skarels 			tcpstat.tcps_rcvbyteafterwin += todrop;
5785065Swnj 		}
5795263Swnj 		tp->snd_wl1 = ti->ti_seq - 1;
58025939Skarels 		tp->rcv_up = ti->ti_seq;
5815085Swnj 		goto step6;
5825065Swnj 	}
5834601Swnj 
5845065Swnj 	/*
58530525Skarels 	 * States other than LISTEN or SYN_SENT.
58630525Skarels 	 * First check that at least some bytes of segment are within
58730525Skarels 	 * receive window.  If segment begins before rcv_nxt,
58830525Skarels 	 * drop leading data (and SYN); if nothing left, just ack.
58916222Skarels 	 */
59030525Skarels 	todrop = tp->rcv_nxt - ti->ti_seq;
59130525Skarels 	if (todrop > 0) {
59230525Skarels 		if (tiflags & TH_SYN) {
59330525Skarels 			tiflags &= ~TH_SYN;
59430525Skarels 			ti->ti_seq++;
59530525Skarels 			if (ti->ti_urp > 1)
59630525Skarels 				ti->ti_urp--;
59730525Skarels 			else
59830525Skarels 				tiflags &= ~TH_URG;
59930525Skarels 			todrop--;
60030525Skarels 		}
60130525Skarels 		if (todrop > ti->ti_len ||
60230525Skarels 		    todrop == ti->ti_len && (tiflags&TH_FIN) == 0) {
60333745Skarels 			tcpstat.tcps_rcvduppack++;
60433745Skarels 			tcpstat.tcps_rcvdupbyte += ti->ti_len;
60531730Skarels 			/*
60633745Skarels 			 * If segment is just one to the left of the window,
60733745Skarels 			 * check two special cases:
60833745Skarels 			 * 1. Don't toss RST in response to 4.2-style keepalive.
60933745Skarels 			 * 2. If the only thing to drop is a FIN, we can drop
61033745Skarels 			 *    it, but check the ACK or we will get into FIN
61133745Skarels 			 *    wars if our FINs crossed (both CLOSING).
61233745Skarels 			 * In either case, send ACK to resynchronize,
61333745Skarels 			 * but keep on processing for RST or ACK.
61431730Skarels 			 */
61533745Skarels 			if ((tiflags & TH_FIN && todrop == ti->ti_len + 1)
61633745Skarels #ifdef TCP_COMPAT_42
61733745Skarels 			  || (tiflags & TH_RST && ti->ti_seq == tp->rcv_nxt - 1)
61831730Skarels #endif
61933745Skarels 			   ) {
62033745Skarels 				todrop = ti->ti_len;
62133745Skarels 				tiflags &= ~TH_FIN;
62233745Skarels 				tp->t_flags |= TF_ACKNOW;
62333745Skarels 			} else
62433745Skarels 				goto dropafterack;
62532034Skarels 		} else {
62632034Skarels 			tcpstat.tcps_rcvpartduppack++;
62732034Skarels 			tcpstat.tcps_rcvpartdupbyte += todrop;
62830525Skarels 		}
62930525Skarels 		m_adj(m, todrop);
63030525Skarels 		ti->ti_seq += todrop;
63130525Skarels 		ti->ti_len -= todrop;
63230525Skarels 		if (ti->ti_urp > todrop)
63330525Skarels 			ti->ti_urp -= todrop;
63430525Skarels 		else {
63530525Skarels 			tiflags &= ~TH_URG;
63630525Skarels 			ti->ti_urp = 0;
63730525Skarels 		}
63816222Skarels 	}
63916222Skarels 
64032612Skarels 	/*
64133745Skarels 	 * If new data are received on a connection after the
64232612Skarels 	 * user processes are gone, then RST the other end.
64332612Skarels 	 */
64432612Skarels 	if ((so->so_state & SS_NOFDREF) &&
64532612Skarels 	    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
64632612Skarels 		tp = tcp_close(tp);
64732612Skarels 		tcpstat.tcps_rcvafterclose++;
64832612Skarels 		goto dropwithreset;
64932612Skarels 	}
65032612Skarels 
65133445Skarels 	/*
65233445Skarels 	 * If segment ends after window, drop trailing data
65333445Skarels 	 * (and PUSH and FIN); if nothing left, just ACK.
65433445Skarels 	 */
65533445Skarels 	todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
65633445Skarels 	if (todrop > 0) {
65733445Skarels 		tcpstat.tcps_rcvpackafterwin++;
65833445Skarels 		if (todrop >= ti->ti_len) {
65930525Skarels 			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
66033445Skarels 			/*
66133445Skarels 			 * If a new connection request is received
66233445Skarels 			 * while in TIME_WAIT, drop the old connection
66333445Skarels 			 * and start over if the sequence numbers
66433445Skarels 			 * are above the previous ones.
66533445Skarels 			 */
66633445Skarels 			if (tiflags & TH_SYN &&
66733445Skarels 			    tp->t_state == TCPS_TIME_WAIT &&
66833445Skarels 			    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
66933445Skarels 				iss = tp->rcv_nxt + TCP_ISSINCR;
67044375Skarels 				tp = tcp_close(tp);
67133445Skarels 				goto findpcb;
67233445Skarels 			}
67333445Skarels 			/*
67433445Skarels 			 * If window is closed can only take segments at
67533445Skarels 			 * window edge, and have to drop data and PUSH from
67633445Skarels 			 * incoming segments.  Continue processing, but
67733445Skarels 			 * remember to ack.  Otherwise, drop segment
67833445Skarels 			 * and ack.
67933445Skarels 			 */
68033445Skarels 			if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
68133445Skarels 				tp->t_flags |= TF_ACKNOW;
68230525Skarels 				tcpstat.tcps_rcvwinprobe++;
68333445Skarels 			} else
6845065Swnj 				goto dropafterack;
68533445Skarels 		} else
68630525Skarels 			tcpstat.tcps_rcvbyteafterwin += todrop;
68733445Skarels 		m_adj(m, -todrop);
68833445Skarels 		ti->ti_len -= todrop;
68933445Skarels 		tiflags &= ~(TH_PUSH|TH_FIN);
6905065Swnj 	}
6914601Swnj 
6925065Swnj 	/*
6935065Swnj 	 * If the RST bit is set examine the state:
6945065Swnj 	 *    SYN_RECEIVED STATE:
6955065Swnj 	 *	If passive open, return to LISTEN state.
6965065Swnj 	 *	If active open, inform user that connection was refused.
6975065Swnj 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
6985065Swnj 	 *	Inform user that connection was reset, and close tcb.
6995065Swnj 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
7005065Swnj 	 *	Close the tcb.
7015065Swnj 	 */
7025065Swnj 	if (tiflags&TH_RST) switch (tp->t_state) {
7035267Sroot 
7045065Swnj 	case TCPS_SYN_RECEIVED:
70533745Skarels 		so->so_error = ECONNREFUSED;
70633745Skarels 		goto close;
7074601Swnj 
7085065Swnj 	case TCPS_ESTABLISHED:
7095065Swnj 	case TCPS_FIN_WAIT_1:
7105065Swnj 	case TCPS_FIN_WAIT_2:
7115065Swnj 	case TCPS_CLOSE_WAIT:
71233745Skarels 		so->so_error = ECONNRESET;
71333745Skarels 	close:
71433745Skarels 		tp->t_state = TCPS_CLOSED;
71533745Skarels 		tcpstat.tcps_drops++;
71633745Skarels 		tp = tcp_close(tp);
7175065Swnj 		goto drop;
7185065Swnj 
7195065Swnj 	case TCPS_CLOSING:
7205065Swnj 	case TCPS_LAST_ACK:
7215065Swnj 	case TCPS_TIME_WAIT:
72210394Ssam 		tp = tcp_close(tp);
7235065Swnj 		goto drop;
7244601Swnj 	}
7254601Swnj 
7264601Swnj 	/*
7275065Swnj 	 * If a SYN is in the window, then this is an
7285065Swnj 	 * error and we send an RST and drop the connection.
7294601Swnj 	 */
7305065Swnj 	if (tiflags & TH_SYN) {
73110394Ssam 		tp = tcp_drop(tp, ECONNRESET);
7325085Swnj 		goto dropwithreset;
7334601Swnj 	}
7344601Swnj 
7354601Swnj 	/*
7365065Swnj 	 * If the ACK bit is off we drop the segment and return.
7374601Swnj 	 */
7385085Swnj 	if ((tiflags & TH_ACK) == 0)
7395065Swnj 		goto drop;
7405065Swnj 
7415065Swnj 	/*
7425065Swnj 	 * Ack processing.
7435065Swnj 	 */
7444601Swnj 	switch (tp->t_state) {
7454601Swnj 
7465065Swnj 	/*
7475065Swnj 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
74831721Skarels 	 * ESTABLISHED state and continue processing, otherwise
7495065Swnj 	 * send an RST.
7505065Swnj 	 */
7515065Swnj 	case TCPS_SYN_RECEIVED:
7525085Swnj 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
7535231Swnj 		    SEQ_GT(ti->ti_ack, tp->snd_max))
7545085Swnj 			goto dropwithreset;
75530525Skarels 		tcpstat.tcps_connects++;
7565085Swnj 		soisconnected(so);
7575085Swnj 		tp->t_state = TCPS_ESTABLISHED;
75844375Skarels 		(void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
7595244Sroot 		tp->snd_wl1 = ti->ti_seq - 1;
7605085Swnj 		/* fall into ... */
7614601Swnj 
7625065Swnj 	/*
7635065Swnj 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
7645065Swnj 	 * ACKs.  If the ack is in the range
7655231Swnj 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
7665065Swnj 	 * then advance tp->snd_una to ti->ti_ack and drop
7675065Swnj 	 * data from the retransmission queue.  If this ACK reflects
7685065Swnj 	 * more up to date window information we update our window information.
7695065Swnj 	 */
7705065Swnj 	case TCPS_ESTABLISHED:
7715065Swnj 	case TCPS_FIN_WAIT_1:
7725065Swnj 	case TCPS_FIN_WAIT_2:
7735065Swnj 	case TCPS_CLOSE_WAIT:
7745065Swnj 	case TCPS_CLOSING:
7755244Sroot 	case TCPS_LAST_ACK:
7765244Sroot 	case TCPS_TIME_WAIT:
7775085Swnj 
77830525Skarels 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
77932098Skarels 			if (ti->ti_len == 0 && ti->ti_win == tp->snd_wnd) {
78030525Skarels 				tcpstat.tcps_rcvdupack++;
78132098Skarels 				/*
78244375Skarels 				 * If we have outstanding data (other than
78344375Skarels 				 * a window probe), this is a completely
78432098Skarels 				 * duplicate ack (ie, window info didn't
78532098Skarels 				 * change), the ack is the biggest we've
78632098Skarels 				 * seen and we've seen exactly our rexmt
78732098Skarels 				 * threshhold of them, assume a packet
78832098Skarels 				 * has been dropped and retransmit it.
78932098Skarels 				 * Kludge snd_nxt & the congestion
79032098Skarels 				 * window so we send only this one
79144375Skarels 				 * packet.
79244375Skarels 				 *
79344375Skarels 				 * We know we're losing at the current
79444375Skarels 				 * window size so do congestion avoidance
79544375Skarels 				 * (set ssthresh to half the current window
79644375Skarels 				 * and pull our congestion window back to
79744375Skarels 				 * the new ssthresh).
79844375Skarels 				 *
79944375Skarels 				 * Dup acks mean that packets have left the
80044375Skarels 				 * network (they're now cached at the receiver)
80144375Skarels 				 * so bump cwnd by the amount in the receiver
80244375Skarels 				 * to keep a constant cwnd packets in the
80344375Skarels 				 * network.
80432098Skarels 				 */
80532098Skarels 				if (tp->t_timer[TCPT_REXMT] == 0 ||
80632098Skarels 				    ti->ti_ack != tp->snd_una)
80732098Skarels 					tp->t_dupacks = 0;
80832098Skarels 				else if (++tp->t_dupacks == tcprexmtthresh) {
80932098Skarels 					tcp_seq onxt = tp->snd_nxt;
81032376Skarels 					u_int win =
81137320Skarels 					    min(tp->snd_wnd, tp->snd_cwnd) / 2 /
81232376Skarels 						tp->t_maxseg;
81332098Skarels 
81432376Skarels 					if (win < 2)
81532376Skarels 						win = 2;
81632376Skarels 					tp->snd_ssthresh = win * tp->t_maxseg;
81732098Skarels 					tp->t_timer[TCPT_REXMT] = 0;
81832098Skarels 					tp->t_rtt = 0;
81932098Skarels 					tp->snd_nxt = ti->ti_ack;
82032098Skarels 					tp->snd_cwnd = tp->t_maxseg;
82132098Skarels 					(void) tcp_output(tp);
82244375Skarels 					tp->snd_cwnd = tp->snd_ssthresh +
82344375Skarels 					       tp->t_maxseg * tp->t_dupacks;
82432098Skarels 					if (SEQ_GT(onxt, tp->snd_nxt))
82532098Skarels 						tp->snd_nxt = onxt;
82632098Skarels 					goto drop;
82744375Skarels 				} else if (tp->t_dupacks > tcprexmtthresh) {
82844375Skarels 					tp->snd_cwnd += tp->t_maxseg;
82944375Skarels 					(void) tcp_output(tp);
83044375Skarels 					goto drop;
83132098Skarels 				}
83232098Skarels 			} else
83332098Skarels 				tp->t_dupacks = 0;
8345065Swnj 			break;
83530525Skarels 		}
83644375Skarels 		/*
83744375Skarels 		 * If the congestion window was inflated to account
83844375Skarels 		 * for the other side's cached packets, retract it.
83944375Skarels 		 */
84044375Skarels 		if (tp->t_dupacks > tcprexmtthresh &&
84144375Skarels 		    tp->snd_cwnd > tp->snd_ssthresh)
84244375Skarels 			tp->snd_cwnd = tp->snd_ssthresh;
84332098Skarels 		tp->t_dupacks = 0;
84430525Skarels 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
84530525Skarels 			tcpstat.tcps_rcvacktoomuch++;
8465065Swnj 			goto dropafterack;
84730525Skarels 		}
8485085Swnj 		acked = ti->ti_ack - tp->snd_una;
84930525Skarels 		tcpstat.tcps_rcvackpack++;
85030525Skarels 		tcpstat.tcps_rcvackbyte += acked;
8515951Swnj 
8525951Swnj 		/*
8535951Swnj 		 * If transmit timer is running and timed sequence
8545951Swnj 		 * number was acked, update smoothed round trip time.
85532034Skarels 		 * Since we now have an rtt measurement, cancel the
85632034Skarels 		 * timer backoff (cf., Phil Karn's retransmit alg.).
85732034Skarels 		 * Recompute the initial retransmit timer.
8585951Swnj 		 */
85944375Skarels 		if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
86044375Skarels 			tcp_xmit_timer(tp);
86131726Skarels 
86226824Skarels 		/*
86326824Skarels 		 * If all outstanding data is acked, stop retransmit
86426824Skarels 		 * timer and remember to restart (more output or persist).
86526824Skarels 		 * If there is more data to be acked, restart retransmit
86632034Skarels 		 * timer, using current (possibly backed-off) value.
86726824Skarels 		 */
86826824Skarels 		if (ti->ti_ack == tp->snd_max) {
8695244Sroot 			tp->t_timer[TCPT_REXMT] = 0;
87026824Skarels 			needoutput = 1;
87132034Skarels 		} else if (tp->t_timer[TCPT_PERSIST] == 0)
87232034Skarels 			tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
87317360Skarels 		/*
87432098Skarels 		 * When new data is acked, open the congestion window.
87532098Skarels 		 * If the window gives us less than ssthresh packets
87632098Skarels 		 * in flight, open exponentially (maxseg per packet).
87744375Skarels 		 * Otherwise open linearly: maxseg per window
87844375Skarels 		 * (maxseg^2 / cwnd per packet), plus a constant
87944375Skarels 		 * fraction of a packet (maxseg/8) to help larger windows
88044375Skarels 		 * open quickly enough.
88117360Skarels 		 */
88232098Skarels 		{
88344375Skarels 		register u_int cw = tp->snd_cwnd;
88444375Skarels 		register u_int incr = tp->t_maxseg;
88532098Skarels 
88644375Skarels 		if (cw > tp->snd_ssthresh)
88744375Skarels 			incr = incr * incr / cw + incr / 8;
88844375Skarels 		tp->snd_cwnd = min(cw + incr, TCP_MAXWIN);
88932098Skarels 		}
8905307Sroot 		if (acked > so->so_snd.sb_cc) {
89115386Ssam 			tp->snd_wnd -= so->so_snd.sb_cc;
89226386Skarels 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
89331721Skarels 			ourfinisacked = 1;
8945307Sroot 		} else {
8956161Ssam 			sbdrop(&so->so_snd, acked);
8965307Sroot 			tp->snd_wnd -= acked;
89731721Skarels 			ourfinisacked = 0;
8985307Sroot 		}
89944375Skarels 		if (so->so_snd.sb_flags & SB_NOTIFY)
90044375Skarels 			sowwakeup(so);
9015231Swnj 		tp->snd_una = ti->ti_ack;
9025357Sroot 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
9035357Sroot 			tp->snd_nxt = tp->snd_una;
9045162Swnj 
9054601Swnj 		switch (tp->t_state) {
9064601Swnj 
9075065Swnj 		/*
9085065Swnj 		 * In FIN_WAIT_1 STATE in addition to the processing
9095065Swnj 		 * for the ESTABLISHED state if our FIN is now acknowledged
9105085Swnj 		 * then enter FIN_WAIT_2.
9115065Swnj 		 */
9125065Swnj 		case TCPS_FIN_WAIT_1:
9135896Swnj 			if (ourfinisacked) {
9145896Swnj 				/*
9155896Swnj 				 * If we can't receive any more
9165896Swnj 				 * data, then closing user can proceed.
91724816Skarels 				 * Starting the timer is contrary to the
91824816Skarels 				 * specification, but if we don't get a FIN
91924816Skarels 				 * we'll hang forever.
9205896Swnj 				 */
92124816Skarels 				if (so->so_state & SS_CANTRCVMORE) {
9225896Swnj 					soisdisconnected(so);
92333745Skarels 					tp->t_timer[TCPT_2MSL] = tcp_maxidle;
92424816Skarels 				}
9255085Swnj 				tp->t_state = TCPS_FIN_WAIT_2;
9265896Swnj 			}
9274601Swnj 			break;
9284601Swnj 
9295065Swnj 	 	/*
9305065Swnj 		 * In CLOSING STATE in addition to the processing for
9315065Swnj 		 * the ESTABLISHED state if the ACK acknowledges our FIN
9325065Swnj 		 * then enter the TIME-WAIT state, otherwise ignore
9335065Swnj 		 * the segment.
9345065Swnj 		 */
9355065Swnj 		case TCPS_CLOSING:
9365244Sroot 			if (ourfinisacked) {
9375065Swnj 				tp->t_state = TCPS_TIME_WAIT;
9385244Sroot 				tcp_canceltimers(tp);
9395244Sroot 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
9405244Sroot 				soisdisconnected(so);
9415244Sroot 			}
9425244Sroot 			break;
9434601Swnj 
9445065Swnj 		/*
94531743Skarels 		 * In LAST_ACK, we may still be waiting for data to drain
94631743Skarels 		 * and/or to be acked, as well as for the ack of our FIN.
94731743Skarels 		 * If our FIN is now acknowledged, delete the TCB,
94831743Skarels 		 * enter the closed state and return.
9495065Swnj 		 */
9505065Swnj 		case TCPS_LAST_ACK:
95131743Skarels 			if (ourfinisacked) {
95210394Ssam 				tp = tcp_close(tp);
95331743Skarels 				goto drop;
95431743Skarels 			}
95531743Skarels 			break;
9564601Swnj 
9575065Swnj 		/*
9585065Swnj 		 * In TIME_WAIT state the only thing that should arrive
9595065Swnj 		 * is a retransmission of the remote FIN.  Acknowledge
9605065Swnj 		 * it and restart the finack timer.
9615065Swnj 		 */
9625065Swnj 		case TCPS_TIME_WAIT:
9635162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
9645065Swnj 			goto dropafterack;
9654601Swnj 		}
9665085Swnj 	}
9674601Swnj 
9685065Swnj step6:
9695065Swnj 	/*
9705244Sroot 	 * Update window information.
97125939Skarels 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
9725244Sroot 	 */
97325939Skarels 	if ((tiflags & TH_ACK) &&
97425939Skarels 	    (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
9755391Swnj 	    (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
97625939Skarels 	     tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd))) {
97730525Skarels 		/* keep track of pure window updates */
97830525Skarels 		if (ti->ti_len == 0 &&
97932098Skarels 		    tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)
98030525Skarels 			tcpstat.tcps_rcvwinupd++;
9815244Sroot 		tp->snd_wnd = ti->ti_win;
9825244Sroot 		tp->snd_wl1 = ti->ti_seq;
9835244Sroot 		tp->snd_wl2 = ti->ti_ack;
98425260Skarels 		if (tp->snd_wnd > tp->max_sndwnd)
98525260Skarels 			tp->max_sndwnd = tp->snd_wnd;
98626824Skarels 		needoutput = 1;
98726824Skarels 	}
9885244Sroot 
9895244Sroot 	/*
9905547Swnj 	 * Process segments with URG.
9915065Swnj 	 */
9927267Swnj 	if ((tiflags & TH_URG) && ti->ti_urp &&
9937267Swnj 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
9945547Swnj 		/*
99525939Skarels 		 * This is a kludge, but if we receive and accept
99613121Ssam 		 * random urgent pointers, we'll crash in
99713121Ssam 		 * soreceive.  It's hard to imagine someone
99813121Ssam 		 * actually wanting to send this much urgent data.
99912441Ssam 		 */
100025652Skarels 		if (ti->ti_urp + so->so_rcv.sb_cc > SB_MAX) {
100112441Ssam 			ti->ti_urp = 0;			/* XXX */
100212441Ssam 			tiflags &= ~TH_URG;		/* XXX */
100325939Skarels 			goto dodata;			/* XXX */
100412441Ssam 		}
100512441Ssam 		/*
10065547Swnj 		 * If this segment advances the known urgent pointer,
10075547Swnj 		 * then mark the data stream.  This should not happen
10085547Swnj 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
10095547Swnj 		 * a FIN has been received from the remote side.
10105547Swnj 		 * In these states we ignore the URG.
101127190Skarels 		 *
101227190Skarels 		 * According to RFC961 (Assigned Protocols),
101327190Skarels 		 * the urgent pointer points to the last octet
101427190Skarels 		 * of urgent data.  We continue, however,
101527190Skarels 		 * to consider it to indicate the first octet
101644375Skarels 		 * of data past the urgent section as the original
101744375Skarels 		 * spec states (in one of two places).
10185547Swnj 		 */
10195547Swnj 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
10205547Swnj 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
10215547Swnj 			so->so_oobmark = so->so_rcv.sb_cc +
10225547Swnj 			    (tp->rcv_up - tp->rcv_nxt) - 1;
10235547Swnj 			if (so->so_oobmark == 0)
10245547Swnj 				so->so_state |= SS_RCVATMARK;
10258313Sroot 			sohasoutofband(so);
102624816Skarels 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
10275440Swnj 		}
10285547Swnj 		/*
10295547Swnj 		 * Remove out of band data so doesn't get presented to user.
10305547Swnj 		 * This can happen independent of advancing the URG pointer,
10315547Swnj 		 * but if two URG's are pending at once, some out-of-band
10325547Swnj 		 * data may creep in... ick.
10335547Swnj 		 */
103444375Skarels 		if (ti->ti_urp <= ti->ti_len
103544375Skarels #ifdef SO_OOBINLINE
103644375Skarels 		     && (so->so_options & SO_OOBINLINE) == 0
103744375Skarels #endif
103844375Skarels 		     )
103944375Skarels 			tcp_pulloutofband(so, ti, m);
104025939Skarels 	} else
104125939Skarels 		/*
104225939Skarels 		 * If no out of band data is expected,
104325939Skarels 		 * pull receive urgent pointer along
104425939Skarels 		 * with the receive window.
104525939Skarels 		 */
104625939Skarels 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
104725939Skarels 			tp->rcv_up = tp->rcv_nxt;
104825939Skarels dodata:							/* XXX */
10494601Swnj 
10504601Swnj 	/*
10515065Swnj 	 * Process the segment text, merging it into the TCP sequencing queue,
10525065Swnj 	 * and arranging for acknowledgment of receipt if necessary.
10535065Swnj 	 * This process logically involves adjusting tp->rcv_wnd as data
10545065Swnj 	 * is presented to the user (this happens in tcp_usrreq.c,
10555065Swnj 	 * case PRU_RCVD).  If a FIN has already been received on this
10565065Swnj 	 * connection then we just ignore the text.
10574601Swnj 	 */
105817946Skarels 	if ((ti->ti_len || (tiflags&TH_FIN)) &&
105917946Skarels 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
106024816Skarels 		TCP_REASS(tp, ti, m, so, tiflags);
106125260Skarels 		/*
106225260Skarels 		 * Note the amount of data that peer has sent into
106325260Skarels 		 * our window, in order to estimate the sender's
106425260Skarels 		 * buffer size.
106525260Skarels 		 */
106632098Skarels 		len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
10675244Sroot 	} else {
10684924Swnj 		m_freem(m);
10695263Swnj 		tiflags &= ~TH_FIN;
10705244Sroot 	}
10714601Swnj 
10724601Swnj 	/*
10735263Swnj 	 * If FIN is received ACK the FIN and let the user know
10745263Swnj 	 * that the connection is closing.
10754601Swnj 	 */
10765263Swnj 	if (tiflags & TH_FIN) {
10775244Sroot 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
10785244Sroot 			socantrcvmore(so);
10795244Sroot 			tp->t_flags |= TF_ACKNOW;
10805244Sroot 			tp->rcv_nxt++;
10815244Sroot 		}
10825065Swnj 		switch (tp->t_state) {
10834601Swnj 
10845065Swnj 	 	/*
10855065Swnj 		 * In SYN_RECEIVED and ESTABLISHED STATES
10865065Swnj 		 * enter the CLOSE_WAIT state.
10874884Swnj 		 */
10885065Swnj 		case TCPS_SYN_RECEIVED:
10895065Swnj 		case TCPS_ESTABLISHED:
10905065Swnj 			tp->t_state = TCPS_CLOSE_WAIT;
10915065Swnj 			break;
10924884Swnj 
10935065Swnj 	 	/*
10945085Swnj 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
10955085Swnj 		 * enter the CLOSING state.
10964884Swnj 		 */
10975065Swnj 		case TCPS_FIN_WAIT_1:
10985085Swnj 			tp->t_state = TCPS_CLOSING;
10995065Swnj 			break;
11004601Swnj 
11015065Swnj 	 	/*
11025065Swnj 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
11035065Swnj 		 * starting the time-wait timer, turning off the other
11045065Swnj 		 * standard timers.
11055065Swnj 		 */
11065065Swnj 		case TCPS_FIN_WAIT_2:
11075244Sroot 			tp->t_state = TCPS_TIME_WAIT;
11085074Swnj 			tcp_canceltimers(tp);
11095162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
11105244Sroot 			soisdisconnected(so);
11115065Swnj 			break;
11125065Swnj 
11134884Swnj 		/*
11145065Swnj 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
11154884Swnj 		 */
11165065Swnj 		case TCPS_TIME_WAIT:
11175162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
11185065Swnj 			break;
11195085Swnj 		}
11204601Swnj 	}
11215267Sroot 	if (so->so_options & SO_DEBUG)
11225267Sroot 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
11235085Swnj 
11245085Swnj 	/*
11255085Swnj 	 * Return any desired output.
11265085Swnj 	 */
112726824Skarels 	if (needoutput || (tp->t_flags & TF_ACKNOW))
112825939Skarels 		(void) tcp_output(tp);
11295065Swnj 	return;
11305085Swnj 
11315065Swnj dropafterack:
11325085Swnj 	/*
11336211Swnj 	 * Generate an ACK dropping incoming segment if it occupies
11346211Swnj 	 * sequence space, where the ACK reflects our state.
11355085Swnj 	 */
113626057Skarels 	if (tiflags & TH_RST)
11375085Swnj 		goto drop;
113831749Skarels 	m_freem(m);
113931721Skarels 	tp->t_flags |= TF_ACKNOW;
114031721Skarels 	(void) tcp_output(tp);
11415231Swnj 	return;
11425085Swnj 
11435085Swnj dropwithreset:
114411731Ssam 	if (om) {
11456161Ssam 		(void) m_free(om);
114611731Ssam 		om = 0;
114711731Ssam 	}
11485085Swnj 	/*
11495244Sroot 	 * Generate a RST, dropping incoming segment.
11505085Swnj 	 * Make ACK acceptable to originator of segment.
115125197Skarels 	 * Don't bother to respond if destination was broadcast.
11525085Swnj 	 */
115337320Skarels 	if ((tiflags & TH_RST) || m->m_flags & M_BCAST)
11545085Swnj 		goto drop;
11555085Swnj 	if (tiflags & TH_ACK)
115637320Skarels 		tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST);
11575085Swnj 	else {
11585085Swnj 		if (tiflags & TH_SYN)
11595085Swnj 			ti->ti_len++;
116037320Skarels 		tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0,
11616211Swnj 		    TH_RST|TH_ACK);
11625085Swnj 	}
116310769Ssam 	/* destroy temporarily created socket */
116410769Ssam 	if (dropsocket)
116510769Ssam 		(void) soabort(so);
11665231Swnj 	return;
11675085Swnj 
11685065Swnj drop:
116911730Ssam 	if (om)
117011730Ssam 		(void) m_free(om);
11715085Swnj 	/*
11725085Swnj 	 * Drop space held by incoming segment and return.
11735085Swnj 	 */
11746303Sroot 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
11756303Sroot 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
11765065Swnj 	m_freem(m);
117710769Ssam 	/* destroy temporarily created socket */
117810769Ssam 	if (dropsocket)
117910769Ssam 		(void) soabort(so);
11805267Sroot 	return;
11815065Swnj }
11825065Swnj 
118317272Skarels tcp_dooptions(tp, om, ti)
11845440Swnj 	struct tcpcb *tp;
11855440Swnj 	struct mbuf *om;
118617272Skarels 	struct tcpiphdr *ti;
11875419Swnj {
11885440Swnj 	register u_char *cp;
118944375Skarels 	u_short mss;
11905440Swnj 	int opt, optlen, cnt;
11915419Swnj 
11925440Swnj 	cp = mtod(om, u_char *);
11935440Swnj 	cnt = om->m_len;
11945440Swnj 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
11955440Swnj 		opt = cp[0];
11965440Swnj 		if (opt == TCPOPT_EOL)
11975440Swnj 			break;
11985440Swnj 		if (opt == TCPOPT_NOP)
11995440Swnj 			optlen = 1;
120012169Ssam 		else {
12015440Swnj 			optlen = cp[1];
120212169Ssam 			if (optlen <= 0)
120312169Ssam 				break;
120412169Ssam 		}
12055440Swnj 		switch (opt) {
12065440Swnj 
12075440Swnj 		default:
120844375Skarels 			continue;
12095440Swnj 
12105440Swnj 		case TCPOPT_MAXSEG:
12115440Swnj 			if (optlen != 4)
12125440Swnj 				continue;
121317272Skarels 			if (!(ti->ti_flags & TH_SYN))
121417272Skarels 				continue;
121544375Skarels 			bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
121644375Skarels 			NTOHS(mss);
121744375Skarels 			(void) tcp_mss(tp, mss);	/* sets t_maxseg */
12185440Swnj 			break;
12195419Swnj 		}
12205419Swnj 	}
12216161Ssam 	(void) m_free(om);
12225419Swnj }
12235419Swnj 
12245419Swnj /*
12255547Swnj  * Pull out of band byte out of a segment so
12265547Swnj  * it doesn't appear in the user's data queue.
12275547Swnj  * It is still reflected in the segment length for
12285547Swnj  * sequencing purposes.
12295547Swnj  */
123044375Skarels tcp_pulloutofband(so, ti, m)
12315547Swnj 	struct socket *so;
12325547Swnj 	struct tcpiphdr *ti;
123344375Skarels 	register struct mbuf *m;
12345547Swnj {
12356116Swnj 	int cnt = ti->ti_urp - 1;
12365547Swnj 
12375547Swnj 	while (cnt >= 0) {
12385547Swnj 		if (m->m_len > cnt) {
12395547Swnj 			char *cp = mtod(m, caddr_t) + cnt;
12405547Swnj 			struct tcpcb *tp = sototcpcb(so);
12415547Swnj 
12425547Swnj 			tp->t_iobc = *cp;
12435547Swnj 			tp->t_oobflags |= TCPOOB_HAVEDATA;
12446161Ssam 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
12455547Swnj 			m->m_len--;
12465547Swnj 			return;
12475547Swnj 		}
12485547Swnj 		cnt -= m->m_len;
12495547Swnj 		m = m->m_next;
12505547Swnj 		if (m == 0)
12515547Swnj 			break;
12525547Swnj 	}
12535547Swnj 	panic("tcp_pulloutofband");
12545547Swnj }
12555547Swnj 
12565547Swnj /*
125744375Skarels  * Collect new round-trip time estimate
125844375Skarels  * and update averages and current timeout.
125917272Skarels  */
126044375Skarels tcp_xmit_timer(tp)
126123975Skarels 	register struct tcpcb *tp;
126217272Skarels {
126344375Skarels 	register short delta;
126444375Skarels 
126544375Skarels 	tcpstat.tcps_rttupdated++;
126644375Skarels 	if (tp->t_srtt != 0) {
126744375Skarels 		/*
126844375Skarels 		 * srtt is stored as fixed point with 3 bits after the
126944375Skarels 		 * binary point (i.e., scaled by 8).  The following magic
127044375Skarels 		 * is equivalent to the smoothing algorithm in rfc793 with
127144375Skarels 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
127244375Skarels 		 * point).  Adjust t_rtt to origin 0.
127344375Skarels 		 */
127444375Skarels 		delta = tp->t_rtt - 1 - (tp->t_srtt >> TCP_RTT_SHIFT);
127544375Skarels 		if ((tp->t_srtt += delta) <= 0)
127644375Skarels 			tp->t_srtt = 1;
127744375Skarels 		/*
127844375Skarels 		 * We accumulate a smoothed rtt variance (actually, a
127944375Skarels 		 * smoothed mean difference), then set the retransmit
128044375Skarels 		 * timer to smoothed rtt + 4 times the smoothed variance.
128144375Skarels 		 * rttvar is stored as fixed point with 2 bits after the
128244375Skarels 		 * binary point (scaled by 4).  The following is
128344375Skarels 		 * equivalent to rfc793 smoothing with an alpha of .75
128444375Skarels 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
128544375Skarels 		 * rfc793's wired-in beta.
128644375Skarels 		 */
128744375Skarels 		if (delta < 0)
128844375Skarels 			delta = -delta;
128944375Skarels 		delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
129044375Skarels 		if ((tp->t_rttvar += delta) <= 0)
129144375Skarels 			tp->t_rttvar = 1;
129244375Skarels 	} else {
129344375Skarels 		/*
129444375Skarels 		 * No rtt measurement yet - use the unsmoothed rtt.
129544375Skarels 		 * Set the variance to half the rtt (so our first
129652199Skarels 		 * retransmit happens at 3*rtt).
129744375Skarels 		 */
129844375Skarels 		tp->t_srtt = tp->t_rtt << TCP_RTT_SHIFT;
129944375Skarels 		tp->t_rttvar = tp->t_rtt << (TCP_RTTVAR_SHIFT - 1);
130044375Skarels 	}
130144375Skarels 	tp->t_rtt = 0;
130244375Skarels 	tp->t_rxtshift = 0;
130344375Skarels 
130444375Skarels 	/*
130544375Skarels 	 * the retransmit should happen at rtt + 4 * rttvar.
130644375Skarels 	 * Because of the way we do the smoothing, srtt and rttvar
130744375Skarels 	 * will each average +1/2 tick of bias.  When we compute
130844375Skarels 	 * the retransmit timer, we want 1/2 tick of rounding and
130944375Skarels 	 * 1 extra tick because of +-1/2 tick uncertainty in the
131044375Skarels 	 * firing of the timer.  The bias will give us exactly the
131144375Skarels 	 * 1.5 tick we need.  But, because the bias is
131244375Skarels 	 * statistical, we have to test that we don't drop below
131344375Skarels 	 * the minimum feasible timer (which is 2 ticks).
131444375Skarels 	 */
131544375Skarels 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
131644375Skarels 	    tp->t_rttmin, TCPTV_REXMTMAX);
131744375Skarels 
131844375Skarels 	/*
131944375Skarels 	 * We received an ack for a packet that wasn't retransmitted;
132044375Skarels 	 * it is probably safe to discard any error indications we've
132144375Skarels 	 * received recently.  This isn't quite right, but close enough
132244375Skarels 	 * for now (a route might have failed after we sent a segment,
132344375Skarels 	 * and the return path might not be symmetrical).
132444375Skarels 	 */
132544375Skarels 	tp->t_softerror = 0;
132644375Skarels }
132744375Skarels 
132844375Skarels /*
132944375Skarels  * Determine a reasonable value for maxseg size.
133044375Skarels  * If the route is known, check route for mtu.
133144375Skarels  * If none, use an mss that can be handled on the outgoing
133244375Skarels  * interface without forcing IP to fragment; if bigger than
133344375Skarels  * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
133444375Skarels  * to utilize large mbufs.  If no route is found, route has no mtu,
133544375Skarels  * or the destination isn't local, use a default, hopefully conservative
133644375Skarels  * size (usually 512 or the default IP max size, but no more than the mtu
133744375Skarels  * of the interface), as we can't discover anything about intervening
133844375Skarels  * gateways or networks.  We also initialize the congestion/slow start
133944375Skarels  * window to be a single segment if the destination isn't local.
134044375Skarels  * While looking at the routing entry, we also initialize other path-dependent
134144375Skarels  * parameters from pre-set or cached values in the routing entry.
134244375Skarels  */
134344375Skarels 
134444375Skarels tcp_mss(tp, offer)
134544375Skarels 	register struct tcpcb *tp;
134644375Skarels 	u_short offer;
134744375Skarels {
134817272Skarels 	struct route *ro;
134944375Skarels 	register struct rtentry *rt;
135017272Skarels 	struct ifnet *ifp;
135144375Skarels 	register int rtt, mss;
135244375Skarels 	u_long bufsize;
135317272Skarels 	struct inpcb *inp;
135444375Skarels 	struct socket *so;
135544375Skarels 	extern int tcp_mssdflt, tcp_rttdflt;
135617272Skarels 
135717272Skarels 	inp = tp->t_inpcb;
135817272Skarels 	ro = &inp->inp_route;
135944375Skarels 
136044375Skarels 	if ((rt = ro->ro_rt) == (struct rtentry *)0) {
136117272Skarels 		/* No route yet, so try to acquire one */
136217272Skarels 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
136317272Skarels 			ro->ro_dst.sa_family = AF_INET;
136437320Skarels 			ro->ro_dst.sa_len = sizeof(ro->ro_dst);
136517272Skarels 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
136617272Skarels 				inp->inp_faddr;
136717272Skarels 			rtalloc(ro);
136817272Skarels 		}
136944375Skarels 		if ((rt = ro->ro_rt) == (struct rtentry *)0)
137044375Skarels 			return (tcp_mssdflt);
137117272Skarels 	}
137244375Skarels 	ifp = rt->rt_ifp;
137344375Skarels 	so = inp->inp_socket;
137417272Skarels 
137544375Skarels #ifdef RTV_MTU	/* if route characteristics exist ... */
137644375Skarels 	/*
137744375Skarels 	 * While we're here, check if there's an initial rtt
137844375Skarels 	 * or rttvar.  Convert from the route-table units
137944375Skarels 	 * to scaled multiples of the slow timeout timer.
138044375Skarels 	 */
138144375Skarels 	if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) {
138252199Skarels 		/*
138352199Skarels 		 * XXX the lock bit for MTU indicates that the value
138452199Skarels 		 * is also a minimum value; this is subject to time.
138552199Skarels 		 */
138652199Skarels 		if (rt->rt_rmx.rmx_locks & RTV_RTT)
138744375Skarels 			tp->t_rttmin = rtt / (RTM_RTTUNIT / PR_SLOWHZ);
138844375Skarels 		tp->t_srtt = rtt / (RTM_RTTUNIT / (PR_SLOWHZ * TCP_RTT_SCALE));
138944375Skarels 		if (rt->rt_rmx.rmx_rttvar)
139044375Skarels 			tp->t_rttvar = rt->rt_rmx.rmx_rttvar /
139144375Skarels 			    (RTM_RTTUNIT / (PR_SLOWHZ * TCP_RTTVAR_SCALE));
139244375Skarels 		else
139344375Skarels 			/* default variation is +- 1 rtt */
139444375Skarels 			tp->t_rttvar =
139544375Skarels 			    tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
139644375Skarels 		TCPT_RANGESET(tp->t_rxtcur,
139744375Skarels 		    ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
139844375Skarels 		    tp->t_rttmin, TCPTV_REXMTMAX);
139944375Skarels 	}
140044375Skarels 	/*
140144375Skarels 	 * if there's an mtu associated with the route, use it
140244375Skarels 	 */
140344375Skarels 	if (rt->rt_rmx.rmx_mtu)
140444375Skarels 		mss = rt->rt_rmx.rmx_mtu - sizeof(struct tcpiphdr);
140544375Skarels 	else
140644375Skarels #endif /* RTV_MTU */
140744375Skarels 	{
140844375Skarels 		mss = ifp->if_mtu - sizeof(struct tcpiphdr);
140931726Skarels #if	(MCLBYTES & (MCLBYTES - 1)) == 0
141044375Skarels 		if (mss > MCLBYTES)
141144375Skarels 			mss &= ~(MCLBYTES-1);
141217272Skarels #else
141344375Skarels 		if (mss > MCLBYTES)
141444375Skarels 			mss = mss / MCLBYTES * MCLBYTES;
141517272Skarels #endif
141644375Skarels 		if (!in_localaddr(inp->inp_faddr))
141744375Skarels 			mss = min(mss, tcp_mssdflt);
141844375Skarels 	}
141944375Skarels 	/*
142044375Skarels 	 * The current mss, t_maxseg, is initialized to the default value.
142144375Skarels 	 * If we compute a smaller value, reduce the current mss.
142244375Skarels 	 * If we compute a larger value, return it for use in sending
142344375Skarels 	 * a max seg size option, but don't store it for use
142444375Skarels 	 * unless we received an offer at least that large from peer.
142544375Skarels 	 * However, do not accept offers under 32 bytes.
142644375Skarels 	 */
142744375Skarels 	if (offer)
142844375Skarels 		mss = min(mss, offer);
142944375Skarels 	mss = max(mss, 32);		/* sanity */
143044375Skarels 	if (mss < tp->t_maxseg || offer != 0) {
143144375Skarels 		/*
143244375Skarels 		 * If there's a pipesize, change the socket buffer
143344375Skarels 		 * to that size.  Make the socket buffers an integral
143444375Skarels 		 * number of mss units; if the mss is larger than
143544375Skarels 		 * the socket buffer, decrease the mss.
143644375Skarels 		 */
143744375Skarels #ifdef RTV_SPIPE
143844375Skarels 		if ((bufsize = rt->rt_rmx.rmx_sendpipe) == 0)
143944375Skarels #endif
144044375Skarels 			bufsize = so->so_snd.sb_hiwat;
144144375Skarels 		if (bufsize < mss)
144244375Skarels 			mss = bufsize;
144344375Skarels 		else {
1444*56908Storek 			bufsize = roundup(bufsize, mss);
1445*56908Storek 			if (bufsize > SB_MAX)
1446*56908Storek 				bufsize = SB_MAX;
1447*56908Storek 			(void)sbreserve(&so->so_snd, bufsize);
144844375Skarels 		}
144944375Skarels 		tp->t_maxseg = mss;
145032098Skarels 
145144375Skarels #ifdef RTV_RPIPE
145244375Skarels 		if ((bufsize = rt->rt_rmx.rmx_recvpipe) == 0)
145344375Skarels #endif
145444375Skarels 			bufsize = so->so_rcv.sb_hiwat;
145544375Skarels 		if (bufsize > mss) {
1456*56908Storek 			bufsize = roundup(bufsize, mss);
1457*56908Storek 			if (bufsize > SB_MAX)
1458*56908Storek 				bufsize = SB_MAX;
1459*56908Storek 			(void)sbreserve(&so->so_rcv, bufsize);
146044375Skarels 		}
146144375Skarels 	}
146232034Skarels 	tp->snd_cwnd = mss;
146344375Skarels 
146444375Skarels #ifdef RTV_SSTHRESH
146544375Skarels 	if (rt->rt_rmx.rmx_ssthresh) {
146644375Skarels 		/*
146744375Skarels 		 * There's some sort of gateway or interface
146844375Skarels 		 * buffer limit on the path.  Use this to set
146944375Skarels 		 * the slow start threshhold, but set the
147044375Skarels 		 * threshold to no less than 2*mss.
147144375Skarels 		 */
147244375Skarels 		tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
147344375Skarels 	}
147444375Skarels #endif /* RTV_MTU */
147532034Skarels 	return (mss);
147617272Skarels }
1477