xref: /csrg-svn/sys/netinet/tcp_input.c (revision 7510)
1*7510Sroot /*	tcp_input.c	1.72	82/07/21	*/
24601Swnj 
34601Swnj #include "../h/param.h"
44601Swnj #include "../h/systm.h"
54663Swnj #include "../h/mbuf.h"
65085Swnj #include "../h/protosw.h"
74663Swnj #include "../h/socket.h"
84803Swnj #include "../h/socketvar.h"
95085Swnj #include "../net/in.h"
106351Ssam #include "../net/route.h"
115085Swnj #include "../net/in_pcb.h"
125085Swnj #include "../net/in_systm.h"
135085Swnj #include "../net/if.h"
144803Swnj #include "../net/ip.h"
154899Swnj #include "../net/ip_var.h"
164803Swnj #include "../net/tcp.h"
174803Swnj #include "../net/tcp_fsm.h"
185085Swnj #include "../net/tcp_seq.h"
195085Swnj #include "../net/tcp_timer.h"
204803Swnj #include "../net/tcp_var.h"
215085Swnj #include "../net/tcpip.h"
225267Sroot #include "../net/tcp_debug.h"
237300Ssam #include <errno.h>
244601Swnj 
255300Sroot int	tcpprintfs = 0;
264679Swnj int	tcpcksum = 1;
275244Sroot struct	sockaddr_in tcp_in = { AF_INET };
285267Sroot struct	tcpiphdr tcp_saveti;
295440Swnj extern	tcpnodelack;
304601Swnj 
315267Sroot struct	tcpcb *tcp_newtcpcb();
325065Swnj /*
335065Swnj  * TCP input routine, follows pages 65-76 of the
345065Swnj  * protocol specification dated September, 1981 very closely.
355065Swnj  */
364924Swnj tcp_input(m0)
374924Swnj 	struct mbuf *m0;
384601Swnj {
394924Swnj 	register struct tcpiphdr *ti;
404924Swnj 	struct inpcb *inp;
414924Swnj 	register struct mbuf *m;
425440Swnj 	struct mbuf *om = 0;
434924Swnj 	int len, tlen, off;
445391Swnj 	register struct tcpcb *tp = 0;
454924Swnj 	register int tiflags;
464803Swnj 	struct socket *so;
475109Swnj 	int todrop, acked;
485267Sroot 	short ostate;
496028Sroot 	struct in_addr laddr;
504924Swnj 
514924Swnj 	/*
525244Sroot 	 * Get IP and TCP header together in first mbuf.
535244Sroot 	 * Note: IP leaves IP header in first mbuf.
544924Swnj 	 */
554924Swnj 	m = m0;
565020Sroot 	ti = mtod(m, struct tcpiphdr *);
575244Sroot 	if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
585208Swnj 		ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
595307Sroot 	if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
605307Sroot 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
615085Swnj 			tcpstat.tcps_hdrops++;
625307Sroot 			return;
635085Swnj 		}
645085Swnj 		ti = mtod(m, struct tcpiphdr *);
655085Swnj 	}
664601Swnj 
674601Swnj 	/*
685244Sroot 	 * Checksum extended TCP header and data.
694601Swnj 	 */
704924Swnj 	tlen = ((struct ip *)ti)->ip_len;
714924Swnj 	len = sizeof (struct ip) + tlen;
724679Swnj 	if (tcpcksum) {
734924Swnj 		ti->ti_next = ti->ti_prev = 0;
744924Swnj 		ti->ti_x1 = 0;
755223Swnj 		ti->ti_len = (u_short)tlen;
766320Swnj #if vax || pdp11
776161Ssam 		ti->ti_len = htons((u_short)ti->ti_len);
785223Swnj #endif
795231Swnj 		if (ti->ti_sum = in_cksum(m, len)) {
804924Swnj 			tcpstat.tcps_badsum++;
816211Swnj 			if (tcpprintfs)
826211Swnj 				printf("tcp cksum %x\n", ti->ti_sum);
835085Swnj 			goto drop;
844601Swnj 		}
854601Swnj 	}
864601Swnj 
874601Swnj 	/*
885244Sroot 	 * Check that TCP offset makes sense,
895440Swnj 	 * pull out TCP options and adjust length.
904601Swnj 	 */
914924Swnj 	off = ti->ti_off << 2;
925231Swnj 	if (off < sizeof (struct tcphdr) || off > tlen) {
934924Swnj 		tcpstat.tcps_badoff++;
945085Swnj 		goto drop;
954924Swnj 	}
966211Swnj 	tlen -= off;
976211Swnj 	ti->ti_len = tlen;
985440Swnj 	if (off > sizeof (struct tcphdr)) {
995440Swnj 		if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
1005440Swnj 			tcpstat.tcps_hdrops++;
1015440Swnj 			goto drop;
1025440Swnj 		}
1035440Swnj 		ti = mtod(m, struct tcpiphdr *);
1045440Swnj 		om = m_get(M_DONTWAIT);
1055440Swnj 		if (om == 0)
1065440Swnj 			goto drop;
1075440Swnj 		om->m_off = MMINOFF;
1085440Swnj 		om->m_len = off - sizeof (struct tcphdr);
1095440Swnj 		{ caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
1106161Ssam 		  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
1115440Swnj 		  m->m_len -= om->m_len;
1126161Ssam 		  bcopy(op+om->m_len, op,
1136161Ssam 		   (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
1145440Swnj 		}
1155440Swnj 	}
1165065Swnj 	tiflags = ti->ti_flags;
1174924Swnj 
1186093Sroot 	/*
1196211Swnj 	 * Drop TCP and IP headers.
1206093Sroot 	 */
1216093Sroot 	off += sizeof (struct ip);
1226093Sroot 	m->m_off += off;
1236093Sroot 	m->m_len -= off;
1246093Sroot 
1256320Swnj #if vax || pdp11
1264924Swnj 	/*
1275244Sroot 	 * Convert TCP protocol specific fields to host format.
1285085Swnj 	 */
1295085Swnj 	ti->ti_seq = ntohl(ti->ti_seq);
1305085Swnj 	ti->ti_ack = ntohl(ti->ti_ack);
1315085Swnj 	ti->ti_win = ntohs(ti->ti_win);
1325085Swnj 	ti->ti_urp = ntohs(ti->ti_urp);
1335231Swnj #endif
1345085Swnj 
1355085Swnj 	/*
1365994Swnj 	 * Locate pcb for segment.  On match, update the local
1375994Swnj 	 * address stored in the block to reflect anchoring.
1384924Swnj 	 */
1395065Swnj 	inp = in_pcblookup
1406028Sroot 		(&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
1416028Sroot 		INPLOOKUP_WILDCARD);
1425065Swnj 
1435065Swnj 	/*
1445065Swnj 	 * If the state is CLOSED (i.e., TCB does not exist) then
1455244Sroot 	 * all data in the incoming segment is discarded.
1465065Swnj 	 */
1475300Sroot 	if (inp == 0)
1485085Swnj 		goto dropwithreset;
1495065Swnj 	tp = intotcpcb(inp);
1505300Sroot 	if (tp == 0)
1515085Swnj 		goto dropwithreset;
1525109Swnj 	so = inp->inp_socket;
1535267Sroot 	if (so->so_options & SO_DEBUG) {
1545267Sroot 		ostate = tp->t_state;
1555267Sroot 		tcp_saveti = *ti;
1565267Sroot 	}
157*7510Sroot 	if (so->so_options & SO_ACCEPTCONN) {
158*7510Sroot 		so = sonewconn(so);
159*7510Sroot 		if (so == 0)
160*7510Sroot 			goto drop;
161*7510Sroot 		inp = (struct inpcb *)so->so_pcb;
162*7510Sroot 		inp->inp_laddr = ti->ti_dst;
163*7510Sroot 		inp->inp_lport = ti->ti_dport;
164*7510Sroot 		tp = intotcpcb(inp);
165*7510Sroot 		tp->t_state = TCPS_LISTEN;
166*7510Sroot 	}
1674601Swnj 
1684601Swnj 	/*
1695162Swnj 	 * Segment received on connection.
1705162Swnj 	 * Reset idle time and keep-alive timer.
1715162Swnj 	 */
1725162Swnj 	tp->t_idle = 0;
1735162Swnj 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
1745162Swnj 
1755162Swnj 	/*
1765440Swnj 	 * Process options.
1775440Swnj 	 */
1785440Swnj 	if (om) {
1795440Swnj 		tcp_dooptions(tp, om);
1805440Swnj 		om = 0;
1815440Swnj 	}
1825440Swnj 
1835440Swnj 	/*
1845085Swnj 	 * Calculate amount of space in receive window,
1855085Swnj 	 * and then do TCP input processing.
1864601Swnj 	 */
1875085Swnj 	tp->rcv_wnd = sbspace(&so->so_rcv);
1885231Swnj 	if (tp->rcv_wnd < 0)
1895231Swnj 		tp->rcv_wnd = 0;
1904601Swnj 
1914601Swnj 	switch (tp->t_state) {
1924601Swnj 
1935065Swnj 	/*
1945065Swnj 	 * If the state is LISTEN then ignore segment if it contains an RST.
1955065Swnj 	 * If the segment contains an ACK then it is bad and send a RST.
1965065Swnj 	 * If it does not contain a SYN then it is not interesting; drop it.
1975085Swnj 	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
1985065Swnj 	 * tp->iss, and send a segment:
1995085Swnj 	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
2005065Swnj 	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
2015065Swnj 	 * Fill in remote peer address fields if not previously specified.
2025065Swnj 	 * Enter SYN_RECEIVED state, and process any other fields of this
2035244Sroot 	 * segment in this state.
2045065Swnj 	 */
2055065Swnj 	case TCPS_LISTEN:
2065065Swnj 		if (tiflags & TH_RST)
2075065Swnj 			goto drop;
2085300Sroot 		if (tiflags & TH_ACK)
2095085Swnj 			goto dropwithreset;
2105300Sroot 		if ((tiflags & TH_SYN) == 0)
2115065Swnj 			goto drop;
2125244Sroot 		tcp_in.sin_addr = ti->ti_src;
2135244Sroot 		tcp_in.sin_port = ti->ti_sport;
2146028Sroot 		laddr = inp->inp_laddr;
2156028Sroot 		if (inp->inp_laddr.s_addr == 0)
2166028Sroot 			inp->inp_laddr = ti->ti_dst;
2176161Ssam 		if (in_pcbconnect(inp, (struct sockaddr_in *)&tcp_in)) {
2186028Sroot 			inp->inp_laddr = laddr;
2195244Sroot 			goto drop;
2206028Sroot 		}
2215244Sroot 		tp->t_template = tcp_template(tp);
2225244Sroot 		if (tp->t_template == 0) {
2235244Sroot 			in_pcbdisconnect(inp);
2246028Sroot 			inp->inp_laddr = laddr;
2256320Swnj 			tp = 0;
2265244Sroot 			goto drop;
2275244Sroot 		}
2285085Swnj 		tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
2295065Swnj 		tp->irs = ti->ti_seq;
2305085Swnj 		tcp_sendseqinit(tp);
2315085Swnj 		tcp_rcvseqinit(tp);
2325065Swnj 		tp->t_state = TCPS_SYN_RECEIVED;
2335244Sroot 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
2345085Swnj 		goto trimthenstep6;
2354601Swnj 
2365065Swnj 	/*
2375065Swnj 	 * If the state is SYN_SENT:
2385065Swnj 	 *	if seg contains an ACK, but not for our SYN, drop the input.
2395065Swnj 	 *	if seg contains a RST, then drop the connection.
2405065Swnj 	 *	if seg does not contain SYN, then drop it.
2415065Swnj 	 * Otherwise this is an acceptable SYN segment
2425065Swnj 	 *	initialize tp->rcv_nxt and tp->irs
2435065Swnj 	 *	if seg contains ack then advance tp->snd_una
2445065Swnj 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2455065Swnj 	 *	arrange for segment to be acked (eventually)
2465065Swnj 	 *	continue processing rest of data/controls, beginning with URG
2475065Swnj 	 */
2485065Swnj 	case TCPS_SYN_SENT:
2495065Swnj 		if ((tiflags & TH_ACK) &&
2505300Sroot /* this should be SEQ_LT; is SEQ_LEQ for BBN vax TCP only */
2515300Sroot 		    (SEQ_LT(ti->ti_ack, tp->iss) ||
2525231Swnj 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
2535085Swnj 			goto dropwithreset;
2545065Swnj 		if (tiflags & TH_RST) {
2556320Swnj 			if (tiflags & TH_ACK) {
2565267Sroot 				tcp_drop(tp, ECONNREFUSED);
2576320Swnj 				tp = 0;
2586320Swnj 			}
2595065Swnj 			goto drop;
2604601Swnj 		}
2615065Swnj 		if ((tiflags & TH_SYN) == 0)
2625065Swnj 			goto drop;
2635231Swnj 		tp->snd_una = ti->ti_ack;
2645357Sroot 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2655357Sroot 			tp->snd_nxt = tp->snd_una;
2665244Sroot 		tp->t_timer[TCPT_REXMT] = 0;
2675065Swnj 		tp->irs = ti->ti_seq;
2685085Swnj 		tcp_rcvseqinit(tp);
2695085Swnj 		tp->t_flags |= TF_ACKNOW;
2705162Swnj 		if (SEQ_GT(tp->snd_una, tp->iss)) {
2715244Sroot 			soisconnected(so);
2725065Swnj 			tp->t_state = TCPS_ESTABLISHED;
2735162Swnj 			(void) tcp_reass(tp, (struct tcpiphdr *)0);
2745162Swnj 		} else
2755085Swnj 			tp->t_state = TCPS_SYN_RECEIVED;
2765085Swnj 		goto trimthenstep6;
2775085Swnj 
2785085Swnj trimthenstep6:
2795085Swnj 		/*
2805231Swnj 		 * Advance ti->ti_seq to correspond to first data byte.
2815085Swnj 		 * If data, trim to stay within window,
2825085Swnj 		 * dropping FIN if necessary.
2835085Swnj 		 */
2845231Swnj 		ti->ti_seq++;
2855085Swnj 		if (ti->ti_len > tp->rcv_wnd) {
2865085Swnj 			todrop = ti->ti_len - tp->rcv_wnd;
2875085Swnj 			m_adj(m, -todrop);
2885085Swnj 			ti->ti_len = tp->rcv_wnd;
2895085Swnj 			ti->ti_flags &= ~TH_FIN;
2905065Swnj 		}
2915263Swnj 		tp->snd_wl1 = ti->ti_seq - 1;
2925085Swnj 		goto step6;
2935065Swnj 	}
2944601Swnj 
2955065Swnj 	/*
2965065Swnj 	 * States other than LISTEN or SYN_SENT.
2975065Swnj 	 * First check that at least some bytes of segment are within
2985065Swnj 	 * receive window.
2995065Swnj 	 */
3005065Swnj 	if (tp->rcv_wnd == 0) {
3015065Swnj 		/*
3025065Swnj 		 * If window is closed can only take segments at
3035231Swnj 		 * window edge, and have to drop data and PUSH from
3045065Swnj 		 * incoming segments.
3055065Swnj 		 */
3065300Sroot 		if (tp->rcv_nxt != ti->ti_seq)
3075065Swnj 			goto dropafterack;
3085085Swnj 		if (ti->ti_len > 0) {
3095690Swnj 			m_adj(m, ti->ti_len);
3105085Swnj 			ti->ti_len = 0;
3115085Swnj 			ti->ti_flags &= ~(TH_PUSH|TH_FIN);
3125065Swnj 		}
3135065Swnj 	} else {
3145065Swnj 		/*
3155231Swnj 		 * If segment begins before rcv_nxt, drop leading
3165065Swnj 		 * data (and SYN); if nothing left, just ack.
3175065Swnj 		 */
3185690Swnj 		todrop = tp->rcv_nxt - ti->ti_seq;
3195690Swnj 		if (todrop > 0) {
3205085Swnj 			if (tiflags & TH_SYN) {
3215300Sroot 				tiflags &= ~TH_SYN;
3225690Swnj 				ti->ti_flags &= ~TH_SYN;
3235085Swnj 				ti->ti_seq++;
3245085Swnj 				if (ti->ti_urp > 1)
3255085Swnj 					ti->ti_urp--;
3265085Swnj 				else
3275085Swnj 					tiflags &= ~TH_URG;
3285085Swnj 				todrop--;
3295085Swnj 			}
3306211Swnj 			if (todrop > ti->ti_len ||
3316211Swnj 			    todrop == ti->ti_len && (tiflags&TH_FIN) == 0)
3325065Swnj 				goto dropafterack;
3335065Swnj 			m_adj(m, todrop);
3345065Swnj 			ti->ti_seq += todrop;
3355065Swnj 			ti->ti_len -= todrop;
3365085Swnj 			if (ti->ti_urp > todrop)
3375085Swnj 				ti->ti_urp -= todrop;
3385085Swnj 			else {
3395085Swnj 				tiflags &= ~TH_URG;
3405690Swnj 				ti->ti_flags &= ~TH_URG;
3415690Swnj 				ti->ti_urp = 0;
3425085Swnj 			}
3435065Swnj 		}
3445065Swnj 		/*
3455065Swnj 		 * If segment ends after window, drop trailing data
3465085Swnj 		 * (and PUSH and FIN); if nothing left, just ACK.
3475065Swnj 		 */
3485690Swnj 		todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
3495690Swnj 		if (todrop > 0) {
3506211Swnj 			if (todrop >= ti->ti_len)
3515065Swnj 				goto dropafterack;
3525065Swnj 			m_adj(m, -todrop);
3535065Swnj 			ti->ti_len -= todrop;
3545085Swnj 			ti->ti_flags &= ~(TH_PUSH|TH_FIN);
3555065Swnj 		}
3565065Swnj 	}
3574601Swnj 
3585065Swnj 	/*
3595951Swnj 	 * If a segment is received on a connection after the
3605951Swnj 	 * user processes are gone, then RST the other end.
3615951Swnj 	 */
362*7510Sroot 	if (so->so_state & SS_NOFDREF) {
3635951Swnj 		tcp_close(tp);
3646266Swnj 		tp = 0;
3655951Swnj 		goto dropwithreset;
3665951Swnj 	}
3675951Swnj 
3685951Swnj 	/*
3695065Swnj 	 * If the RST bit is set examine the state:
3705065Swnj 	 *    SYN_RECEIVED STATE:
3715065Swnj 	 *	If passive open, return to LISTEN state.
3725065Swnj 	 *	If active open, inform user that connection was refused.
3735065Swnj 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
3745065Swnj 	 *	Inform user that connection was reset, and close tcb.
3755065Swnj 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
3765065Swnj 	 *	Close the tcb.
3775065Swnj 	 */
3785065Swnj 	if (tiflags&TH_RST) switch (tp->t_state) {
3795267Sroot 
3805065Swnj 	case TCPS_SYN_RECEIVED:
3815085Swnj 		tcp_drop(tp, ECONNREFUSED);
3826320Swnj 		tp = 0;
3835065Swnj 		goto drop;
3844601Swnj 
3855065Swnj 	case TCPS_ESTABLISHED:
3865065Swnj 	case TCPS_FIN_WAIT_1:
3875065Swnj 	case TCPS_FIN_WAIT_2:
3885065Swnj 	case TCPS_CLOSE_WAIT:
3895065Swnj 		tcp_drop(tp, ECONNRESET);
3906320Swnj 		tp = 0;
3915065Swnj 		goto drop;
3925065Swnj 
3935065Swnj 	case TCPS_CLOSING:
3945065Swnj 	case TCPS_LAST_ACK:
3955065Swnj 	case TCPS_TIME_WAIT:
3965065Swnj 		tcp_close(tp);
3976320Swnj 		tp = 0;
3985065Swnj 		goto drop;
3994601Swnj 	}
4004601Swnj 
4014601Swnj 	/*
4025065Swnj 	 * If a SYN is in the window, then this is an
4035065Swnj 	 * error and we send an RST and drop the connection.
4044601Swnj 	 */
4055065Swnj 	if (tiflags & TH_SYN) {
4065231Swnj 		tcp_drop(tp, ECONNRESET);
4076266Swnj 		tp = 0;
4085085Swnj 		goto dropwithreset;
4094601Swnj 	}
4104601Swnj 
4114601Swnj 	/*
4125065Swnj 	 * If the ACK bit is off we drop the segment and return.
4134601Swnj 	 */
4145085Swnj 	if ((tiflags & TH_ACK) == 0)
4155065Swnj 		goto drop;
4165065Swnj 
4175065Swnj 	/*
4185065Swnj 	 * Ack processing.
4195065Swnj 	 */
4204601Swnj 	switch (tp->t_state) {
4214601Swnj 
4225065Swnj 	/*
4235065Swnj 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
4245065Swnj 	 * ESTABLISHED state and continue processing, othewise
4255065Swnj 	 * send an RST.
4265065Swnj 	 */
4275065Swnj 	case TCPS_SYN_RECEIVED:
4285085Swnj 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
4295231Swnj 		    SEQ_GT(ti->ti_ack, tp->snd_max))
4305085Swnj 			goto dropwithreset;
4315244Sroot 		tp->snd_una++;			/* SYN acked */
4325357Sroot 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
4335357Sroot 			tp->snd_nxt = tp->snd_una;
4345244Sroot 		tp->t_timer[TCPT_REXMT] = 0;
4355085Swnj 		soisconnected(so);
4365085Swnj 		tp->t_state = TCPS_ESTABLISHED;
4375162Swnj 		(void) tcp_reass(tp, (struct tcpiphdr *)0);
4385244Sroot 		tp->snd_wl1 = ti->ti_seq - 1;
4395085Swnj 		/* fall into ... */
4404601Swnj 
4415065Swnj 	/*
4425065Swnj 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
4435065Swnj 	 * ACKs.  If the ack is in the range
4445231Swnj 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
4455065Swnj 	 * then advance tp->snd_una to ti->ti_ack and drop
4465065Swnj 	 * data from the retransmission queue.  If this ACK reflects
4475065Swnj 	 * more up to date window information we update our window information.
4485065Swnj 	 */
4495065Swnj 	case TCPS_ESTABLISHED:
4505065Swnj 	case TCPS_FIN_WAIT_1:
4515065Swnj 	case TCPS_FIN_WAIT_2:
4525065Swnj 	case TCPS_CLOSE_WAIT:
4535065Swnj 	case TCPS_CLOSING:
4545244Sroot 	case TCPS_LAST_ACK:
4555244Sroot 	case TCPS_TIME_WAIT:
4565085Swnj #define	ourfinisacked	(acked > 0)
4575085Swnj 
4585244Sroot 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una))
4595065Swnj 			break;
4605300Sroot 		if (SEQ_GT(ti->ti_ack, tp->snd_max))
4615065Swnj 			goto dropafterack;
4625085Swnj 		acked = ti->ti_ack - tp->snd_una;
4635951Swnj 
4645951Swnj 		/*
4655951Swnj 		 * If transmit timer is running and timed sequence
4665951Swnj 		 * number was acked, update smoothed round trip time.
4675951Swnj 		 */
4685951Swnj 		if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
4695951Swnj 			if (tp->t_srtt == 0)
4705951Swnj 				tp->t_srtt = tp->t_rtt;
4715951Swnj 			else
4725951Swnj 				tp->t_srtt =
4735951Swnj 				    tcp_alpha * tp->t_srtt +
4745951Swnj 				    (1 - tcp_alpha) * tp->t_rtt;
4755951Swnj /* printf("rtt %d srtt*100 now %d\n", tp->t_rtt, (int)(tp->t_srtt*100)); */
4765951Swnj 			tp->t_rtt = 0;
4775951Swnj 		}
4785951Swnj 
4795307Sroot 		if (ti->ti_ack == tp->snd_max)
4805244Sroot 			tp->t_timer[TCPT_REXMT] = 0;
4815307Sroot 		else {
4825244Sroot 			TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
4835244Sroot 			    tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
4845951Swnj 			tp->t_rtt = 1;
4855300Sroot 			tp->t_rxtshift = 0;
4865085Swnj 		}
4875307Sroot 		if (acked > so->so_snd.sb_cc) {
4885307Sroot 			sbdrop(&so->so_snd, so->so_snd.sb_cc);
4895307Sroot 			tp->snd_wnd -= so->so_snd.sb_cc;
4905307Sroot 		} else {
4916161Ssam 			sbdrop(&so->so_snd, acked);
4925307Sroot 			tp->snd_wnd -= acked;
4935307Sroot 			acked = 0;
4945307Sroot 		}
4956434Swnj 		if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
4965300Sroot 			sowwakeup(so);
4975231Swnj 		tp->snd_una = ti->ti_ack;
4985357Sroot 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
4995357Sroot 			tp->snd_nxt = tp->snd_una;
5005162Swnj 
5014601Swnj 		switch (tp->t_state) {
5024601Swnj 
5035065Swnj 		/*
5045065Swnj 		 * In FIN_WAIT_1 STATE in addition to the processing
5055065Swnj 		 * for the ESTABLISHED state if our FIN is now acknowledged
5065085Swnj 		 * then enter FIN_WAIT_2.
5075065Swnj 		 */
5085065Swnj 		case TCPS_FIN_WAIT_1:
5095896Swnj 			if (ourfinisacked) {
5105896Swnj 				/*
5115896Swnj 				 * If we can't receive any more
5125896Swnj 				 * data, then closing user can proceed.
5135896Swnj 				 */
5145896Swnj 				if (so->so_state & SS_CANTRCVMORE)
5155896Swnj 					soisdisconnected(so);
5165085Swnj 				tp->t_state = TCPS_FIN_WAIT_2;
5175896Swnj 			}
5184601Swnj 			break;
5194601Swnj 
5205065Swnj 	 	/*
5215065Swnj 		 * In CLOSING STATE in addition to the processing for
5225065Swnj 		 * the ESTABLISHED state if the ACK acknowledges our FIN
5235065Swnj 		 * then enter the TIME-WAIT state, otherwise ignore
5245065Swnj 		 * the segment.
5255065Swnj 		 */
5265065Swnj 		case TCPS_CLOSING:
5275244Sroot 			if (ourfinisacked) {
5285065Swnj 				tp->t_state = TCPS_TIME_WAIT;
5295244Sroot 				tcp_canceltimers(tp);
5305244Sroot 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
5315244Sroot 				soisdisconnected(so);
5325244Sroot 			}
5335244Sroot 			break;
5344601Swnj 
5355065Swnj 		/*
5365085Swnj 		 * The only thing that can arrive in  LAST_ACK state
5375085Swnj 		 * is an acknowledgment of our FIN.  If our FIN is now
5385085Swnj 		 * acknowledged, delete the TCB, enter the closed state
5395085Swnj 		 * and return.
5405065Swnj 		 */
5415065Swnj 		case TCPS_LAST_ACK:
5426320Swnj 			if (ourfinisacked) {
5435065Swnj 				tcp_close(tp);
5446320Swnj 				tp = 0;
5456320Swnj 			}
5465065Swnj 			goto drop;
5474601Swnj 
5485065Swnj 		/*
5495065Swnj 		 * In TIME_WAIT state the only thing that should arrive
5505065Swnj 		 * is a retransmission of the remote FIN.  Acknowledge
5515065Swnj 		 * it and restart the finack timer.
5525065Swnj 		 */
5535065Swnj 		case TCPS_TIME_WAIT:
5545162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
5555065Swnj 			goto dropafterack;
5564601Swnj 		}
5575085Swnj #undef ourfinisacked
5585085Swnj 	}
5594601Swnj 
5605065Swnj step6:
5615065Swnj 	/*
5625244Sroot 	 * Update window information.
5635244Sroot 	 */
5645300Sroot 	if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
5655391Swnj 	    (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
5665300Sroot 	     tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
5675244Sroot 		tp->snd_wnd = ti->ti_win;
5685244Sroot 		tp->snd_wl1 = ti->ti_seq;
5695244Sroot 		tp->snd_wl2 = ti->ti_ack;
5705244Sroot 		if (tp->snd_wnd > 0)
5715244Sroot 			tp->t_timer[TCPT_PERSIST] = 0;
5725244Sroot 	}
5735244Sroot 
5745244Sroot 	/*
5755547Swnj 	 * Process segments with URG.
5765065Swnj 	 */
5777267Swnj 	if ((tiflags & TH_URG) && ti->ti_urp &&
5787267Swnj 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
5795547Swnj 		/*
5805547Swnj 		 * If this segment advances the known urgent pointer,
5815547Swnj 		 * then mark the data stream.  This should not happen
5825547Swnj 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
5835547Swnj 		 * a FIN has been received from the remote side.
5845547Swnj 		 * In these states we ignore the URG.
5855547Swnj 		 */
5865547Swnj 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
5875547Swnj 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
5885547Swnj 			so->so_oobmark = so->so_rcv.sb_cc +
5895547Swnj 			    (tp->rcv_up - tp->rcv_nxt) - 1;
5905547Swnj 			if (so->so_oobmark == 0)
5915547Swnj 				so->so_state |= SS_RCVATMARK;
5925440Swnj #ifdef TCPTRUEOOB
5935547Swnj 			if ((tp->t_flags & TF_DOOOB) == 0)
5945440Swnj #endif
5955547Swnj 				sohasoutofband(so);
5965547Swnj 			tp->t_oobflags &= ~TCPOOB_HAVEDATA;
5975440Swnj 		}
5985547Swnj 		/*
5995547Swnj 		 * Remove out of band data so doesn't get presented to user.
6005547Swnj 		 * This can happen independent of advancing the URG pointer,
6015547Swnj 		 * but if two URG's are pending at once, some out-of-band
6025547Swnj 		 * data may creep in... ick.
6035547Swnj 		 */
604*7510Sroot 		if (ti->ti_urp <= ti->ti_len)
6055547Swnj 			tcp_pulloutofband(so, ti);
6065419Swnj 	}
6074601Swnj 
6084601Swnj 	/*
6095065Swnj 	 * Process the segment text, merging it into the TCP sequencing queue,
6105065Swnj 	 * and arranging for acknowledgment of receipt if necessary.
6115065Swnj 	 * This process logically involves adjusting tp->rcv_wnd as data
6125065Swnj 	 * is presented to the user (this happens in tcp_usrreq.c,
6135065Swnj 	 * case PRU_RCVD).  If a FIN has already been received on this
6145065Swnj 	 * connection then we just ignore the text.
6154601Swnj 	 */
6165263Swnj 	if ((ti->ti_len || (tiflags&TH_FIN)) &&
6175263Swnj 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
6185065Swnj 		tiflags = tcp_reass(tp, ti);
6195440Swnj 		if (tcpnodelack == 0)
6205440Swnj 			tp->t_flags |= TF_DELACK;
6215440Swnj 		else
6225440Swnj 			tp->t_flags |= TF_ACKNOW;
6235244Sroot 	} else {
6244924Swnj 		m_freem(m);
6255263Swnj 		tiflags &= ~TH_FIN;
6265244Sroot 	}
6274601Swnj 
6284601Swnj 	/*
6295263Swnj 	 * If FIN is received ACK the FIN and let the user know
6305263Swnj 	 * that the connection is closing.
6314601Swnj 	 */
6325263Swnj 	if (tiflags & TH_FIN) {
6335244Sroot 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
6345244Sroot 			socantrcvmore(so);
6355244Sroot 			tp->t_flags |= TF_ACKNOW;
6365244Sroot 			tp->rcv_nxt++;
6375244Sroot 		}
6385065Swnj 		switch (tp->t_state) {
6394601Swnj 
6405065Swnj 	 	/*
6415065Swnj 		 * In SYN_RECEIVED and ESTABLISHED STATES
6425065Swnj 		 * enter the CLOSE_WAIT state.
6434884Swnj 		 */
6445065Swnj 		case TCPS_SYN_RECEIVED:
6455065Swnj 		case TCPS_ESTABLISHED:
6465065Swnj 			tp->t_state = TCPS_CLOSE_WAIT;
6475065Swnj 			break;
6484884Swnj 
6495065Swnj 	 	/*
6505085Swnj 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
6515085Swnj 		 * enter the CLOSING state.
6524884Swnj 		 */
6535065Swnj 		case TCPS_FIN_WAIT_1:
6545085Swnj 			tp->t_state = TCPS_CLOSING;
6555065Swnj 			break;
6564601Swnj 
6575065Swnj 	 	/*
6585065Swnj 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
6595065Swnj 		 * starting the time-wait timer, turning off the other
6605065Swnj 		 * standard timers.
6615065Swnj 		 */
6625065Swnj 		case TCPS_FIN_WAIT_2:
6635244Sroot 			tp->t_state = TCPS_TIME_WAIT;
6645074Swnj 			tcp_canceltimers(tp);
6655162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
6665244Sroot 			soisdisconnected(so);
6675065Swnj 			break;
6685065Swnj 
6694884Swnj 		/*
6705065Swnj 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
6714884Swnj 		 */
6725065Swnj 		case TCPS_TIME_WAIT:
6735162Swnj 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
6745065Swnj 			break;
6755085Swnj 		}
6764601Swnj 	}
6775267Sroot 	if (so->so_options & SO_DEBUG)
6785267Sroot 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
6795085Swnj 
6805085Swnj 	/*
6815085Swnj 	 * Return any desired output.
6825085Swnj 	 */
6836161Ssam 	(void) tcp_output(tp);
6845065Swnj 	return;
6855085Swnj 
6865065Swnj dropafterack:
6875085Swnj 	/*
6886211Swnj 	 * Generate an ACK dropping incoming segment if it occupies
6896211Swnj 	 * sequence space, where the ACK reflects our state.
6905085Swnj 	 */
6916211Swnj 	if ((tiflags&TH_RST) ||
6926211Swnj 	    tlen == 0 && (tiflags&(TH_SYN|TH_FIN)) == 0)
6935085Swnj 		goto drop;
6946303Sroot 	if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
6956303Sroot 		tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
6965391Swnj 	tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
6975231Swnj 	return;
6985085Swnj 
6995085Swnj dropwithreset:
7005440Swnj 	if (om)
7016161Ssam 		(void) m_free(om);
7025085Swnj 	/*
7035244Sroot 	 * Generate a RST, dropping incoming segment.
7045085Swnj 	 * Make ACK acceptable to originator of segment.
7055085Swnj 	 */
7065085Swnj 	if (tiflags & TH_RST)
7075085Swnj 		goto drop;
7085085Swnj 	if (tiflags & TH_ACK)
7095391Swnj 		tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
7105085Swnj 	else {
7115085Swnj 		if (tiflags & TH_SYN)
7125085Swnj 			ti->ti_len++;
7136211Swnj 		tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
7146211Swnj 		    TH_RST|TH_ACK);
7155085Swnj 	}
7165231Swnj 	return;
7175085Swnj 
7185065Swnj drop:
7195085Swnj 	/*
7205085Swnj 	 * Drop space held by incoming segment and return.
7215085Swnj 	 */
7226303Sroot 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
7236303Sroot 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
7245065Swnj 	m_freem(m);
7255267Sroot 	return;
7265065Swnj }
7275065Swnj 
7285440Swnj tcp_dooptions(tp, om)
7295440Swnj 	struct tcpcb *tp;
7305440Swnj 	struct mbuf *om;
7315419Swnj {
7325440Swnj 	register u_char *cp;
7335440Swnj 	int opt, optlen, cnt;
7345419Swnj 
7355440Swnj 	cp = mtod(om, u_char *);
7365440Swnj 	cnt = om->m_len;
7375440Swnj 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
7385440Swnj 		opt = cp[0];
7395440Swnj 		if (opt == TCPOPT_EOL)
7405440Swnj 			break;
7415440Swnj 		if (opt == TCPOPT_NOP)
7425440Swnj 			optlen = 1;
7435440Swnj 		else
7445440Swnj 			optlen = cp[1];
7455440Swnj 		switch (opt) {
7465440Swnj 
7475440Swnj 		default:
7485440Swnj 			break;
7495440Swnj 
7505440Swnj 		case TCPOPT_MAXSEG:
7515440Swnj 			if (optlen != 4)
7525440Swnj 				continue;
7535440Swnj 			tp->t_maxseg = *(u_short *)(cp + 2);
7546320Swnj #if vax || pdp11
7556161Ssam 			tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
7565440Swnj #endif
7575440Swnj 			break;
7585440Swnj 
7595440Swnj #ifdef TCPTRUEOOB
7605440Swnj 		case TCPOPT_WILLOOB:
7615440Swnj 			tp->t_flags |= TF_DOOOB;
7625440Swnj printf("tp %x dooob\n", tp);
7635440Swnj 			break;
7645440Swnj 
7655440Swnj 		case TCPOPT_OOBDATA: {
7665440Swnj 			int seq;
7675547Swnj 			register struct socket *so = tp->t_inpcb->inp_socket;
7685547Swnj 			tcp_seq mark;
7695440Swnj 
7705547Swnj 			if (optlen != 8)
7715440Swnj 				continue;
7725440Swnj 			seq = cp[2];
7735440Swnj 			if (seq < tp->t_iobseq)
7745440Swnj 				seq += 256;
7755440Swnj printf("oobdata cp[2] %d iobseq %d seq %d\n", cp[2], tp->t_iobseq, seq);
7765440Swnj 			if (seq - tp->t_iobseq > 128) {
7775440Swnj printf("bad seq\n");
7785440Swnj 				tp->t_oobflags |= TCPOOB_OWEACK;
7795440Swnj 				break;
7805440Swnj 			}
7815440Swnj 			tp->t_iobseq = cp[2];
7825440Swnj 			tp->t_iobc = cp[3];
7835547Swnj 			mark = *(tcp_seq *)(cp + 4);
7846320Swnj #if vax || pdp11
7855547Swnj 			mark = ntohl(mark);
7865547Swnj #endif
7875547Swnj 			so->so_oobmark = so->so_rcv.sb_cc + (mark-tp->rcv_nxt);
7885547Swnj 			if (so->so_oobmark == 0)
7895547Swnj 				so->so_state |= SS_RCVATMARK;
7905440Swnj printf("take oob data %x input iobseq now %x\n", tp->t_iobc, tp->t_iobseq);
7915547Swnj 			sohasoutofband(so);
7925440Swnj 			break;
7935419Swnj 		}
7945440Swnj 
7955440Swnj 		case TCPOPT_OOBACK: {
7965440Swnj 			int seq;
7975440Swnj 
7985440Swnj 			if (optlen != 4)
7995440Swnj 				continue;
8005440Swnj 			if (tp->t_oobseq != cp[2]) {
8015440Swnj printf("wrong ack\n");
8025440Swnj 				break;
8035440Swnj 			}
8045440Swnj printf("take oob ack %x and cancel rexmt\n", cp[2]);
8055440Swnj 			tp->t_oobflags &= ~TCPOOB_NEEDACK;
8065440Swnj 			tp->t_timer[TCPT_OOBREXMT] = 0;
8075419Swnj 			break;
8085440Swnj 		}
8095440Swnj #endif TCPTRUEOOB
8105440Swnj 		}
8115419Swnj 	}
8126161Ssam 	(void) m_free(om);
8135419Swnj }
8145419Swnj 
8155419Swnj /*
8165547Swnj  * Pull out of band byte out of a segment so
8175547Swnj  * it doesn't appear in the user's data queue.
8185547Swnj  * It is still reflected in the segment length for
8195547Swnj  * sequencing purposes.
8205547Swnj  */
8215547Swnj tcp_pulloutofband(so, ti)
8225547Swnj 	struct socket *so;
8235547Swnj 	struct tcpiphdr *ti;
8245547Swnj {
8255547Swnj 	register struct mbuf *m;
8266116Swnj 	int cnt = ti->ti_urp - 1;
8275547Swnj 
8285547Swnj 	m = dtom(ti);
8295547Swnj 	while (cnt >= 0) {
8305547Swnj 		if (m->m_len > cnt) {
8315547Swnj 			char *cp = mtod(m, caddr_t) + cnt;
8325547Swnj 			struct tcpcb *tp = sototcpcb(so);
8335547Swnj 
8345547Swnj 			tp->t_iobc = *cp;
8355547Swnj 			tp->t_oobflags |= TCPOOB_HAVEDATA;
8366161Ssam 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
8375547Swnj 			m->m_len--;
8385547Swnj 			return;
8395547Swnj 		}
8405547Swnj 		cnt -= m->m_len;
8415547Swnj 		m = m->m_next;
8425547Swnj 		if (m == 0)
8435547Swnj 			break;
8445547Swnj 	}
8455547Swnj 	panic("tcp_pulloutofband");
8465547Swnj }
8475547Swnj 
8485547Swnj /*
8495065Swnj  * Insert segment ti into reassembly queue of tcp with
8505065Swnj  * control block tp.  Return TH_FIN if reassembly now includes
8515065Swnj  * a segment with FIN.
8525065Swnj  */
8535109Swnj tcp_reass(tp, ti)
8545065Swnj 	register struct tcpcb *tp;
8555065Swnj 	register struct tcpiphdr *ti;
8565065Swnj {
8575065Swnj 	register struct tcpiphdr *q;
8585085Swnj 	struct socket *so = tp->t_inpcb->inp_socket;
8595263Swnj 	struct mbuf *m;
8605263Swnj 	int flags;
8615065Swnj 
8625065Swnj 	/*
8635162Swnj 	 * Call with ti==0 after become established to
8645162Swnj 	 * force pre-ESTABLISHED data up to user socket.
8655065Swnj 	 */
8665162Swnj 	if (ti == 0)
8675065Swnj 		goto present;
8684601Swnj 
8695065Swnj 	/*
8705065Swnj 	 * Find a segment which begins after this one does.
8715065Swnj 	 */
8725065Swnj 	for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
8735065Swnj 	    q = (struct tcpiphdr *)q->ti_next)
8745065Swnj 		if (SEQ_GT(q->ti_seq, ti->ti_seq))
8755065Swnj 			break;
8764601Swnj 
8775065Swnj 	/*
8785065Swnj 	 * If there is a preceding segment, it may provide some of
8795065Swnj 	 * our data already.  If so, drop the data from the incoming
8805065Swnj 	 * segment.  If it provides all of our data, drop us.
8815065Swnj 	 */
8825065Swnj 	if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
8835065Swnj 		register int i;
8845690Swnj 		q = (struct tcpiphdr *)q->ti_prev;
8855065Swnj 		/* conversion to int (in i) handles seq wraparound */
8865065Swnj 		i = q->ti_seq + q->ti_len - ti->ti_seq;
8875065Swnj 		if (i > 0) {
8884924Swnj 			if (i >= ti->ti_len)
8895065Swnj 				goto drop;
8907338Swnj 			m_adj(dtom(ti), i);
8915065Swnj 			ti->ti_len -= i;
8924924Swnj 			ti->ti_seq += i;
8934601Swnj 		}
8945065Swnj 		q = (struct tcpiphdr *)(q->ti_next);
8955065Swnj 	}
8964601Swnj 
8975065Swnj 	/*
8985065Swnj 	 * While we overlap succeeding segments trim them or,
8995065Swnj 	 * if they are completely covered, dequeue them.
9005065Swnj 	 */
9015690Swnj 	while (q != (struct tcpiphdr *)tp) {
9025065Swnj 		register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
9035690Swnj 		if (i <= 0)
9045690Swnj 			break;
9055065Swnj 		if (i < q->ti_len) {
9065690Swnj 			q->ti_seq += i;
9075065Swnj 			q->ti_len -= i;
9085065Swnj 			m_adj(dtom(q), i);
9095065Swnj 			break;
9104601Swnj 		}
9115065Swnj 		q = (struct tcpiphdr *)q->ti_next;
9125623Swnj 		m = dtom(q->ti_prev);
9135065Swnj 		remque(q->ti_prev);
9145623Swnj 		m_freem(m);
9155065Swnj 	}
9164601Swnj 
9175065Swnj 	/*
9185065Swnj 	 * Stick new segment in its place.
9195065Swnj 	 */
9205065Swnj 	insque(ti, q->ti_prev);
9214601Swnj 
9225065Swnj present:
9235065Swnj 	/*
9245244Sroot 	 * Present data to user, advancing rcv_nxt through
9255244Sroot 	 * completed sequence space.
9265065Swnj 	 */
9275263Swnj 	if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
9285244Sroot 		return (0);
9294924Swnj 	ti = tp->seg_next;
9305263Swnj 	if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
9315263Swnj 		return (0);
9325263Swnj 	if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
9335263Swnj 		return (0);
9345263Swnj 	do {
9355244Sroot 		tp->rcv_nxt += ti->ti_len;
9365244Sroot 		flags = ti->ti_flags & TH_FIN;
9374924Swnj 		remque(ti);
9385263Swnj 		m = dtom(ti);
9394924Swnj 		ti = (struct tcpiphdr *)ti->ti_next;
9405263Swnj 		if (so->so_state & SS_CANTRCVMORE)
9416161Ssam 			m_freem(m);
9425263Swnj 		else
9435263Swnj 			sbappend(&so->so_rcv, m);
9445263Swnj 	} while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
9455263Swnj 	sorwakeup(so);
9465065Swnj 	return (flags);
9475065Swnj drop:
9485065Swnj 	m_freem(dtom(ti));
9495263Swnj 	return (0);
9504601Swnj }
951