xref: /csrg-svn/sys/netinet/tcp_input.c (revision 10203)
1 /*	tcp_input.c	1.86	83/01/08	*/
2 
3 #include "../h/param.h"
4 #include "../h/systm.h"
5 #include "../h/mbuf.h"
6 #include "../h/protosw.h"
7 #include "../h/socket.h"
8 #include "../h/socketvar.h"
9 #include "../netinet/in.h"
10 #include "../net/route.h"
11 #include "../netinet/in_pcb.h"
12 #include "../netinet/in_systm.h"
13 #include "../net/if.h"
14 #include "../netinet/ip.h"
15 #include "../netinet/ip_var.h"
16 #include "../netinet/tcp.h"
17 #include "../netinet/tcp_fsm.h"
18 #include "../netinet/tcp_seq.h"
19 #include "../netinet/tcp_timer.h"
20 #include "../netinet/tcp_var.h"
21 #include "../netinet/tcpip.h"
22 #include "../netinet/tcp_debug.h"
23 #include <errno.h>
24 
25 int	tcpprintfs = 0;
26 int	tcpcksum = 1;
27 struct	tcpiphdr tcp_saveti;
28 extern	tcpnodelack;
29 
30 struct	tcpcb *tcp_newtcpcb();
31 /*
32  * TCP input routine, follows pages 65-76 of the
33  * protocol specification dated September, 1981 very closely.
34  */
35 tcp_input(m0)
36 	struct mbuf *m0;
37 {
38 	register struct tcpiphdr *ti;
39 	struct inpcb *inp;
40 	register struct mbuf *m;
41 	struct mbuf *om = 0;
42 	int len, tlen, off;
43 	register struct tcpcb *tp = 0;
44 	register int tiflags;
45 	struct socket *so;
46 	int todrop, acked;
47 	short ostate;
48 	struct in_addr laddr;
49 
50 	/*
51 	 * Get IP and TCP header together in first mbuf.
52 	 * Note: IP leaves IP header in first mbuf.
53 	 */
54 	m = m0;
55 	ti = mtod(m, struct tcpiphdr *);
56 	if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
57 		ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
58 	if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
59 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
60 			tcpstat.tcps_hdrops++;
61 			return;
62 		}
63 		ti = mtod(m, struct tcpiphdr *);
64 	}
65 
66 	/*
67 	 * Checksum extended TCP header and data.
68 	 */
69 	tlen = ((struct ip *)ti)->ip_len;
70 	len = sizeof (struct ip) + tlen;
71 	if (tcpcksum) {
72 		ti->ti_next = ti->ti_prev = 0;
73 		ti->ti_x1 = 0;
74 		ti->ti_len = (u_short)tlen;
75 		ti->ti_len = htons((u_short)ti->ti_len);
76 		if (ti->ti_sum = in_cksum(m, len)) {
77 			tcpstat.tcps_badsum++;
78 			if (tcpprintfs)
79 				printf("tcp cksum %x\n", ti->ti_sum);
80 			goto drop;
81 		}
82 	}
83 
84 	/*
85 	 * Check that TCP offset makes sense,
86 	 * pull out TCP options and adjust length.
87 	 */
88 	off = ti->ti_off << 2;
89 	if (off < sizeof (struct tcphdr) || off > tlen) {
90 		tcpstat.tcps_badoff++;
91 		goto drop;
92 	}
93 	tlen -= off;
94 	ti->ti_len = tlen;
95 	if (off > sizeof (struct tcphdr)) {
96 		if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
97 			tcpstat.tcps_hdrops++;
98 			goto drop;
99 		}
100 		ti = mtod(m, struct tcpiphdr *);
101 		om = m_get(M_DONTWAIT, MT_DATA);
102 		if (om == 0)
103 			goto drop;
104 		om->m_len = off - sizeof (struct tcphdr);
105 		{ caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
106 		  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
107 		  m->m_len -= om->m_len;
108 		  bcopy(op+om->m_len, op,
109 		   (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
110 		}
111 	}
112 	tiflags = ti->ti_flags;
113 
114 	/*
115 	 * Drop TCP and IP headers.
116 	 */
117 	off += sizeof (struct ip);
118 	m->m_off += off;
119 	m->m_len -= off;
120 
121 	/*
122 	 * Convert TCP protocol specific fields to host format.
123 	 */
124 	ti->ti_seq = ntohl(ti->ti_seq);
125 	ti->ti_ack = ntohl(ti->ti_ack);
126 	ti->ti_win = ntohs(ti->ti_win);
127 	ti->ti_urp = ntohs(ti->ti_urp);
128 
129 	/*
130 	 * Locate pcb for segment.
131 	 */
132 	inp = in_pcblookup
133 		(&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
134 		INPLOOKUP_WILDCARD);
135 
136 	/*
137 	 * If the state is CLOSED (i.e., TCB does not exist) then
138 	 * all data in the incoming segment is discarded.
139 	 */
140 	if (inp == 0)
141 		goto dropwithreset;
142 	tp = intotcpcb(inp);
143 	if (tp == 0)
144 		goto dropwithreset;
145 	so = inp->inp_socket;
146 	if (so->so_options & SO_DEBUG) {
147 		ostate = tp->t_state;
148 		tcp_saveti = *ti;
149 	}
150 	if (so->so_options & SO_ACCEPTCONN) {
151 		so = sonewconn(so);
152 		if (so == 0)
153 			goto drop;
154 		inp = (struct inpcb *)so->so_pcb;
155 		inp->inp_laddr = ti->ti_dst;
156 		inp->inp_lport = ti->ti_dport;
157 		tp = intotcpcb(inp);
158 		tp->t_state = TCPS_LISTEN;
159 	}
160 
161 	/*
162 	 * Segment received on connection.
163 	 * Reset idle time and keep-alive timer.
164 	 */
165 	tp->t_idle = 0;
166 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
167 
168 	/*
169 	 * Process options.
170 	 */
171 	if (om) {
172 		tcp_dooptions(tp, om);
173 		om = 0;
174 	}
175 
176 	/*
177 	 * Calculate amount of space in receive window,
178 	 * and then do TCP input processing.
179 	 */
180 	tp->rcv_wnd = sbspace(&so->so_rcv);
181 	if (tp->rcv_wnd < 0)
182 		tp->rcv_wnd = 0;
183 
184 	switch (tp->t_state) {
185 
186 	/*
187 	 * If the state is LISTEN then ignore segment if it contains an RST.
188 	 * If the segment contains an ACK then it is bad and send a RST.
189 	 * If it does not contain a SYN then it is not interesting; drop it.
190 	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
191 	 * tp->iss, and send a segment:
192 	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
193 	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
194 	 * Fill in remote peer address fields if not previously specified.
195 	 * Enter SYN_RECEIVED state, and process any other fields of this
196 	 * segment in this state.
197 	 */
198 	case TCPS_LISTEN: {
199 		struct mbuf *am;
200 		register struct sockaddr_in *sin;
201 
202 		if (tiflags & TH_RST)
203 			goto drop;
204 		if (tiflags & TH_ACK)
205 			goto dropwithreset;
206 		if ((tiflags & TH_SYN) == 0)
207 			goto drop;
208 		am = m_get(M_DONTWAIT, MT_SONAME);
209 		if (am == NULL)
210 			goto drop;
211 		am->m_len = sizeof (struct sockaddr_in);
212 		sin = mtod(am, struct sockaddr_in *);
213 		sin->sin_family = AF_INET;
214 		sin->sin_addr = ti->ti_src;
215 		sin->sin_port = ti->ti_sport;
216 		laddr = inp->inp_laddr;
217 		if (inp->inp_laddr.s_addr == INADDR_ANY)
218 			inp->inp_laddr = ti->ti_dst;
219 		if (in_pcbconnect(inp, am)) {
220 			inp->inp_laddr = laddr;
221 			(void) m_free(am);
222 			goto drop;
223 		}
224 		(void) m_free(am);
225 		tp->t_template = tcp_template(tp);
226 		if (tp->t_template == 0) {
227 			in_pcbdisconnect(inp);
228 			inp->inp_laddr = laddr;
229 			tp = 0;
230 			goto drop;
231 		}
232 		tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
233 		tp->irs = ti->ti_seq;
234 		tcp_sendseqinit(tp);
235 		tcp_rcvseqinit(tp);
236 		tp->t_state = TCPS_SYN_RECEIVED;
237 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
238 		goto trimthenstep6;
239 		}
240 
241 	/*
242 	 * If the state is SYN_SENT:
243 	 *	if seg contains an ACK, but not for our SYN, drop the input.
244 	 *	if seg contains a RST, then drop the connection.
245 	 *	if seg does not contain SYN, then drop it.
246 	 * Otherwise this is an acceptable SYN segment
247 	 *	initialize tp->rcv_nxt and tp->irs
248 	 *	if seg contains ack then advance tp->snd_una
249 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
250 	 *	arrange for segment to be acked (eventually)
251 	 *	continue processing rest of data/controls, beginning with URG
252 	 */
253 	case TCPS_SYN_SENT:
254 		if ((tiflags & TH_ACK) &&
255 /* this should be SEQ_LT; is SEQ_LEQ for BBN vax TCP only */
256 		    (SEQ_LT(ti->ti_ack, tp->iss) ||
257 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
258 			goto dropwithreset;
259 		if (tiflags & TH_RST) {
260 			if (tiflags & TH_ACK) {
261 				tcp_drop(tp, ECONNREFUSED);
262 				tp = 0;
263 			}
264 			goto drop;
265 		}
266 		if ((tiflags & TH_SYN) == 0)
267 			goto drop;
268 		tp->snd_una = ti->ti_ack;
269 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
270 			tp->snd_nxt = tp->snd_una;
271 		tp->t_timer[TCPT_REXMT] = 0;
272 		tp->irs = ti->ti_seq;
273 		tcp_rcvseqinit(tp);
274 		tp->t_flags |= TF_ACKNOW;
275 		if (SEQ_GT(tp->snd_una, tp->iss)) {
276 			soisconnected(so);
277 			tp->t_state = TCPS_ESTABLISHED;
278 			(void) tcp_reass(tp, (struct tcpiphdr *)0);
279 		} else
280 			tp->t_state = TCPS_SYN_RECEIVED;
281 		goto trimthenstep6;
282 
283 trimthenstep6:
284 		/*
285 		 * Advance ti->ti_seq to correspond to first data byte.
286 		 * If data, trim to stay within window,
287 		 * dropping FIN if necessary.
288 		 */
289 		ti->ti_seq++;
290 		if (ti->ti_len > tp->rcv_wnd) {
291 			todrop = ti->ti_len - tp->rcv_wnd;
292 			m_adj(m, -todrop);
293 			ti->ti_len = tp->rcv_wnd;
294 			ti->ti_flags &= ~TH_FIN;
295 		}
296 		tp->snd_wl1 = ti->ti_seq - 1;
297 		goto step6;
298 	}
299 
300 	/*
301 	 * States other than LISTEN or SYN_SENT.
302 	 * First check that at least some bytes of segment are within
303 	 * receive window.
304 	 */
305 	if (tp->rcv_wnd == 0) {
306 		/*
307 		 * If window is closed can only take segments at
308 		 * window edge, and have to drop data and PUSH from
309 		 * incoming segments.
310 		 */
311 		if (tp->rcv_nxt != ti->ti_seq)
312 			goto dropafterack;
313 		if (ti->ti_len > 0) {
314 			m_adj(m, ti->ti_len);
315 			ti->ti_len = 0;
316 			ti->ti_flags &= ~(TH_PUSH|TH_FIN);
317 		}
318 	} else {
319 		/*
320 		 * If segment begins before rcv_nxt, drop leading
321 		 * data (and SYN); if nothing left, just ack.
322 		 */
323 		todrop = tp->rcv_nxt - ti->ti_seq;
324 		if (todrop > 0) {
325 			if (tiflags & TH_SYN) {
326 				tiflags &= ~TH_SYN;
327 				ti->ti_flags &= ~TH_SYN;
328 				ti->ti_seq++;
329 				if (ti->ti_urp > 1)
330 					ti->ti_urp--;
331 				else
332 					tiflags &= ~TH_URG;
333 				todrop--;
334 			}
335 			if (todrop > ti->ti_len ||
336 			    todrop == ti->ti_len && (tiflags&TH_FIN) == 0)
337 				goto dropafterack;
338 			m_adj(m, todrop);
339 			ti->ti_seq += todrop;
340 			ti->ti_len -= todrop;
341 			if (ti->ti_urp > todrop)
342 				ti->ti_urp -= todrop;
343 			else {
344 				tiflags &= ~TH_URG;
345 				ti->ti_flags &= ~TH_URG;
346 				ti->ti_urp = 0;
347 			}
348 		}
349 		/*
350 		 * If segment ends after window, drop trailing data
351 		 * (and PUSH and FIN); if nothing left, just ACK.
352 		 */
353 		todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
354 		if (todrop > 0) {
355 			if (todrop >= ti->ti_len)
356 				goto dropafterack;
357 			m_adj(m, -todrop);
358 			ti->ti_len -= todrop;
359 			ti->ti_flags &= ~(TH_PUSH|TH_FIN);
360 		}
361 	}
362 
363 	/*
364 	 * If data is received on a connection after the
365 	 * user processes are gone, then RST the other end.
366 	 */
367 	if (so->so_state & SS_NOFDREF && tp->t_state > TCPS_CLOSE_WAIT &&
368 	    ti->ti_len) {
369 		tcp_close(tp);
370 		tp = 0;
371 		goto dropwithreset;
372 	}
373 
374 	/*
375 	 * If the RST bit is set examine the state:
376 	 *    SYN_RECEIVED STATE:
377 	 *	If passive open, return to LISTEN state.
378 	 *	If active open, inform user that connection was refused.
379 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
380 	 *	Inform user that connection was reset, and close tcb.
381 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
382 	 *	Close the tcb.
383 	 */
384 	if (tiflags&TH_RST) switch (tp->t_state) {
385 
386 	case TCPS_SYN_RECEIVED:
387 		tcp_drop(tp, ECONNREFUSED);
388 		tp = 0;
389 		goto drop;
390 
391 	case TCPS_ESTABLISHED:
392 	case TCPS_FIN_WAIT_1:
393 	case TCPS_FIN_WAIT_2:
394 	case TCPS_CLOSE_WAIT:
395 		tcp_drop(tp, ECONNRESET);
396 		tp = 0;
397 		goto drop;
398 
399 	case TCPS_CLOSING:
400 	case TCPS_LAST_ACK:
401 	case TCPS_TIME_WAIT:
402 		tcp_close(tp);
403 		tp = 0;
404 		goto drop;
405 	}
406 
407 	/*
408 	 * If a SYN is in the window, then this is an
409 	 * error and we send an RST and drop the connection.
410 	 */
411 	if (tiflags & TH_SYN) {
412 		tcp_drop(tp, ECONNRESET);
413 		tp = 0;
414 		goto dropwithreset;
415 	}
416 
417 	/*
418 	 * If the ACK bit is off we drop the segment and return.
419 	 */
420 	if ((tiflags & TH_ACK) == 0)
421 		goto drop;
422 
423 	/*
424 	 * Ack processing.
425 	 */
426 	switch (tp->t_state) {
427 
428 	/*
429 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
430 	 * ESTABLISHED state and continue processing, othewise
431 	 * send an RST.
432 	 */
433 	case TCPS_SYN_RECEIVED:
434 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
435 		    SEQ_GT(ti->ti_ack, tp->snd_max))
436 			goto dropwithreset;
437 		tp->snd_una++;			/* SYN acked */
438 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
439 			tp->snd_nxt = tp->snd_una;
440 		tp->t_timer[TCPT_REXMT] = 0;
441 		soisconnected(so);
442 		tp->t_state = TCPS_ESTABLISHED;
443 		(void) tcp_reass(tp, (struct tcpiphdr *)0);
444 		tp->snd_wl1 = ti->ti_seq - 1;
445 		/* fall into ... */
446 
447 	/*
448 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
449 	 * ACKs.  If the ack is in the range
450 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
451 	 * then advance tp->snd_una to ti->ti_ack and drop
452 	 * data from the retransmission queue.  If this ACK reflects
453 	 * more up to date window information we update our window information.
454 	 */
455 	case TCPS_ESTABLISHED:
456 	case TCPS_FIN_WAIT_1:
457 	case TCPS_FIN_WAIT_2:
458 	case TCPS_CLOSE_WAIT:
459 	case TCPS_CLOSING:
460 	case TCPS_LAST_ACK:
461 	case TCPS_TIME_WAIT:
462 #define	ourfinisacked	(acked > 0)
463 
464 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una))
465 			break;
466 		if (SEQ_GT(ti->ti_ack, tp->snd_max))
467 			goto dropafterack;
468 		acked = ti->ti_ack - tp->snd_una;
469 
470 		/*
471 		 * If transmit timer is running and timed sequence
472 		 * number was acked, update smoothed round trip time.
473 		 */
474 		if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
475 			if (tp->t_srtt == 0)
476 				tp->t_srtt = tp->t_rtt;
477 			else
478 				tp->t_srtt =
479 				    tcp_alpha * tp->t_srtt +
480 				    (1 - tcp_alpha) * tp->t_rtt;
481 			tp->t_rtt = 0;
482 		}
483 
484 		if (ti->ti_ack == tp->snd_max)
485 			tp->t_timer[TCPT_REXMT] = 0;
486 		else {
487 			TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
488 			    tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
489 			tp->t_rtt = 1;
490 			tp->t_rxtshift = 0;
491 		}
492 		if (acked > so->so_snd.sb_cc) {
493 			sbdrop(&so->so_snd, so->so_snd.sb_cc);
494 			tp->snd_wnd -= so->so_snd.sb_cc;
495 		} else {
496 			sbdrop(&so->so_snd, acked);
497 			tp->snd_wnd -= acked;
498 			acked = 0;
499 		}
500 		if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
501 			sowwakeup(so);
502 		tp->snd_una = ti->ti_ack;
503 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
504 			tp->snd_nxt = tp->snd_una;
505 
506 		switch (tp->t_state) {
507 
508 		/*
509 		 * In FIN_WAIT_1 STATE in addition to the processing
510 		 * for the ESTABLISHED state if our FIN is now acknowledged
511 		 * then enter FIN_WAIT_2.
512 		 */
513 		case TCPS_FIN_WAIT_1:
514 			if (ourfinisacked) {
515 				/*
516 				 * If we can't receive any more
517 				 * data, then closing user can proceed.
518 				 */
519 				if (so->so_state & SS_CANTRCVMORE)
520 					soisdisconnected(so);
521 				tp->t_state = TCPS_FIN_WAIT_2;
522 			}
523 			break;
524 
525 	 	/*
526 		 * In CLOSING STATE in addition to the processing for
527 		 * the ESTABLISHED state if the ACK acknowledges our FIN
528 		 * then enter the TIME-WAIT state, otherwise ignore
529 		 * the segment.
530 		 */
531 		case TCPS_CLOSING:
532 			if (ourfinisacked) {
533 				tp->t_state = TCPS_TIME_WAIT;
534 				tcp_canceltimers(tp);
535 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
536 				soisdisconnected(so);
537 			}
538 			break;
539 
540 		/*
541 		 * The only thing that can arrive in  LAST_ACK state
542 		 * is an acknowledgment of our FIN.  If our FIN is now
543 		 * acknowledged, delete the TCB, enter the closed state
544 		 * and return.
545 		 */
546 		case TCPS_LAST_ACK:
547 			if (ourfinisacked) {
548 				tcp_close(tp);
549 				tp = 0;
550 			}
551 			goto drop;
552 
553 		/*
554 		 * In TIME_WAIT state the only thing that should arrive
555 		 * is a retransmission of the remote FIN.  Acknowledge
556 		 * it and restart the finack timer.
557 		 */
558 		case TCPS_TIME_WAIT:
559 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
560 			goto dropafterack;
561 		}
562 #undef ourfinisacked
563 	}
564 
565 step6:
566 	/*
567 	 * Update window information.
568 	 */
569 	if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
570 	    (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
571 	     tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
572 		tp->snd_wnd = ti->ti_win;
573 		tp->snd_wl1 = ti->ti_seq;
574 		tp->snd_wl2 = ti->ti_ack;
575 		if (tp->snd_wnd != 0)
576 			tp->t_timer[TCPT_PERSIST] = 0;
577 	}
578 
579 	/*
580 	 * Process segments with URG.
581 	 */
582 	if ((tiflags & TH_URG) && ti->ti_urp &&
583 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
584 		/*
585 		 * If this segment advances the known urgent pointer,
586 		 * then mark the data stream.  This should not happen
587 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
588 		 * a FIN has been received from the remote side.
589 		 * In these states we ignore the URG.
590 		 */
591 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
592 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
593 			so->so_oobmark = so->so_rcv.sb_cc +
594 			    (tp->rcv_up - tp->rcv_nxt) - 1;
595 			if (so->so_oobmark == 0)
596 				so->so_state |= SS_RCVATMARK;
597 			sohasoutofband(so);
598 			tp->t_oobflags &= ~TCPOOB_HAVEDATA;
599 		}
600 		/*
601 		 * Remove out of band data so doesn't get presented to user.
602 		 * This can happen independent of advancing the URG pointer,
603 		 * but if two URG's are pending at once, some out-of-band
604 		 * data may creep in... ick.
605 		 */
606 		if (ti->ti_urp <= ti->ti_len)
607 			tcp_pulloutofband(so, ti);
608 	}
609 
610 	/*
611 	 * Process the segment text, merging it into the TCP sequencing queue,
612 	 * and arranging for acknowledgment of receipt if necessary.
613 	 * This process logically involves adjusting tp->rcv_wnd as data
614 	 * is presented to the user (this happens in tcp_usrreq.c,
615 	 * case PRU_RCVD).  If a FIN has already been received on this
616 	 * connection then we just ignore the text.
617 	 */
618 	if ((ti->ti_len || (tiflags&TH_FIN)) &&
619 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
620 		tiflags = tcp_reass(tp, ti);
621 		if (tcpnodelack == 0)
622 			tp->t_flags |= TF_DELACK;
623 		else
624 			tp->t_flags |= TF_ACKNOW;
625 	} else {
626 		m_freem(m);
627 		tiflags &= ~TH_FIN;
628 	}
629 
630 	/*
631 	 * If FIN is received ACK the FIN and let the user know
632 	 * that the connection is closing.
633 	 */
634 	if (tiflags & TH_FIN) {
635 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
636 			socantrcvmore(so);
637 			tp->t_flags |= TF_ACKNOW;
638 			tp->rcv_nxt++;
639 		}
640 		switch (tp->t_state) {
641 
642 	 	/*
643 		 * In SYN_RECEIVED and ESTABLISHED STATES
644 		 * enter the CLOSE_WAIT state.
645 		 */
646 		case TCPS_SYN_RECEIVED:
647 		case TCPS_ESTABLISHED:
648 			tp->t_state = TCPS_CLOSE_WAIT;
649 			break;
650 
651 	 	/*
652 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
653 		 * enter the CLOSING state.
654 		 */
655 		case TCPS_FIN_WAIT_1:
656 			tp->t_state = TCPS_CLOSING;
657 			break;
658 
659 	 	/*
660 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
661 		 * starting the time-wait timer, turning off the other
662 		 * standard timers.
663 		 */
664 		case TCPS_FIN_WAIT_2:
665 			tp->t_state = TCPS_TIME_WAIT;
666 			tcp_canceltimers(tp);
667 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
668 			soisdisconnected(so);
669 			break;
670 
671 		/*
672 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
673 		 */
674 		case TCPS_TIME_WAIT:
675 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
676 			break;
677 		}
678 	}
679 	if (so->so_options & SO_DEBUG)
680 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
681 
682 	/*
683 	 * Return any desired output.
684 	 */
685 	(void) tcp_output(tp);
686 	return;
687 
688 dropafterack:
689 	/*
690 	 * Generate an ACK dropping incoming segment if it occupies
691 	 * sequence space, where the ACK reflects our state.
692 	 */
693 	if ((tiflags&TH_RST) ||
694 	    tlen == 0 && (tiflags&(TH_SYN|TH_FIN)) == 0)
695 		goto drop;
696 	if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
697 		tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
698 	tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
699 	return;
700 
701 dropwithreset:
702 	if (om)
703 		(void) m_free(om);
704 	/*
705 	 * Generate a RST, dropping incoming segment.
706 	 * Make ACK acceptable to originator of segment.
707 	 */
708 	if (tiflags & TH_RST)
709 		goto drop;
710 	if (tiflags & TH_ACK)
711 		tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
712 	else {
713 		if (tiflags & TH_SYN)
714 			ti->ti_len++;
715 		tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
716 		    TH_RST|TH_ACK);
717 	}
718 	return;
719 
720 drop:
721 	/*
722 	 * Drop space held by incoming segment and return.
723 	 */
724 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
725 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
726 	m_freem(m);
727 	return;
728 }
729 
730 tcp_dooptions(tp, om)
731 	struct tcpcb *tp;
732 	struct mbuf *om;
733 {
734 	register u_char *cp;
735 	int opt, optlen, cnt;
736 
737 	cp = mtod(om, u_char *);
738 	cnt = om->m_len;
739 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
740 		opt = cp[0];
741 		if (opt == TCPOPT_EOL)
742 			break;
743 		if (opt == TCPOPT_NOP)
744 			optlen = 1;
745 		else
746 			optlen = cp[1];
747 		switch (opt) {
748 
749 		default:
750 			break;
751 
752 		case TCPOPT_MAXSEG:
753 			if (optlen != 4)
754 				continue;
755 			tp->t_maxseg = *(u_short *)(cp + 2);
756 			tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
757 			break;
758 		}
759 	}
760 	(void) m_free(om);
761 }
762 
763 /*
764  * Pull out of band byte out of a segment so
765  * it doesn't appear in the user's data queue.
766  * It is still reflected in the segment length for
767  * sequencing purposes.
768  */
769 tcp_pulloutofband(so, ti)
770 	struct socket *so;
771 	struct tcpiphdr *ti;
772 {
773 	register struct mbuf *m;
774 	int cnt = ti->ti_urp - 1;
775 
776 	m = dtom(ti);
777 	while (cnt >= 0) {
778 		if (m->m_len > cnt) {
779 			char *cp = mtod(m, caddr_t) + cnt;
780 			struct tcpcb *tp = sototcpcb(so);
781 
782 			tp->t_iobc = *cp;
783 			tp->t_oobflags |= TCPOOB_HAVEDATA;
784 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
785 			m->m_len--;
786 			return;
787 		}
788 		cnt -= m->m_len;
789 		m = m->m_next;
790 		if (m == 0)
791 			break;
792 	}
793 	panic("tcp_pulloutofband");
794 }
795 
796 /*
797  * Insert segment ti into reassembly queue of tcp with
798  * control block tp.  Return TH_FIN if reassembly now includes
799  * a segment with FIN.
800  */
801 tcp_reass(tp, ti)
802 	register struct tcpcb *tp;
803 	register struct tcpiphdr *ti;
804 {
805 	register struct tcpiphdr *q;
806 	struct socket *so = tp->t_inpcb->inp_socket;
807 	struct mbuf *m;
808 	int flags;
809 
810 	/*
811 	 * Call with ti==0 after become established to
812 	 * force pre-ESTABLISHED data up to user socket.
813 	 */
814 	if (ti == 0)
815 		goto present;
816 
817 	/*
818 	 * Find a segment which begins after this one does.
819 	 */
820 	for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
821 	    q = (struct tcpiphdr *)q->ti_next)
822 		if (SEQ_GT(q->ti_seq, ti->ti_seq))
823 			break;
824 
825 	/*
826 	 * If there is a preceding segment, it may provide some of
827 	 * our data already.  If so, drop the data from the incoming
828 	 * segment.  If it provides all of our data, drop us.
829 	 */
830 	if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
831 		register int i;
832 		q = (struct tcpiphdr *)q->ti_prev;
833 		/* conversion to int (in i) handles seq wraparound */
834 		i = q->ti_seq + q->ti_len - ti->ti_seq;
835 		if (i > 0) {
836 			if (i >= ti->ti_len)
837 				goto drop;
838 			m_adj(dtom(ti), i);
839 			ti->ti_len -= i;
840 			ti->ti_seq += i;
841 		}
842 		q = (struct tcpiphdr *)(q->ti_next);
843 	}
844 
845 	/*
846 	 * While we overlap succeeding segments trim them or,
847 	 * if they are completely covered, dequeue them.
848 	 */
849 	while (q != (struct tcpiphdr *)tp) {
850 		register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
851 		if (i <= 0)
852 			break;
853 		if (i < q->ti_len) {
854 			q->ti_seq += i;
855 			q->ti_len -= i;
856 			m_adj(dtom(q), i);
857 			break;
858 		}
859 		q = (struct tcpiphdr *)q->ti_next;
860 		m = dtom(q->ti_prev);
861 		remque(q->ti_prev);
862 		m_freem(m);
863 	}
864 
865 	/*
866 	 * Stick new segment in its place.
867 	 */
868 	insque(ti, q->ti_prev);
869 
870 present:
871 	/*
872 	 * Present data to user, advancing rcv_nxt through
873 	 * completed sequence space.
874 	 */
875 	if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
876 		return (0);
877 	ti = tp->seg_next;
878 	if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
879 		return (0);
880 	if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
881 		return (0);
882 	do {
883 		tp->rcv_nxt += ti->ti_len;
884 		flags = ti->ti_flags & TH_FIN;
885 		remque(ti);
886 		m = dtom(ti);
887 		ti = (struct tcpiphdr *)ti->ti_next;
888 		if (so->so_state & SS_CANTRCVMORE)
889 			m_freem(m);
890 		else
891 			sbappend(&so->so_rcv, m);
892 	} while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
893 	sorwakeup(so);
894 	return (flags);
895 drop:
896 	m_freem(dtom(ti));
897 	return (0);
898 }
899