xref: /csrg-svn/sys/netinet/tcp_input.c (revision 31726)
1 /*
2  * Copyright (c) 1982, 1986 Regents of the University of California.
3  * All rights reserved.  The Berkeley software License Agreement
4  * specifies the terms and conditions for redistribution.
5  *
6  *	@(#)tcp_input.c	7.6 (Berkeley) 06/30/87
7  */
8 
9 #include "param.h"
10 #include "systm.h"
11 #include "mbuf.h"
12 #include "protosw.h"
13 #include "socket.h"
14 #include "socketvar.h"
15 #include "errno.h"
16 
17 #include "../net/if.h"
18 #include "../net/route.h"
19 
20 #include "in.h"
21 #include "in_pcb.h"
22 #include "in_systm.h"
23 #include "ip.h"
24 #include "ip_var.h"
25 #include "tcp.h"
26 #include "tcp_fsm.h"
27 #include "tcp_seq.h"
28 #include "tcp_timer.h"
29 #include "tcp_var.h"
30 #include "tcpip.h"
31 #include "tcp_debug.h"
32 
33 int	tcpprintfs = 0;
34 int	tcpcksum = 1;
35 struct	tcpiphdr tcp_saveti;
36 extern	tcpnodelack;
37 
38 struct	tcpcb *tcp_newtcpcb();
39 
40 /*
41  * Insert segment ti into reassembly queue of tcp with
42  * control block tp.  Return TH_FIN if reassembly now includes
43  * a segment with FIN.  The macro form does the common case inline
44  * (segment is the next to be received on an established connection,
45  * and the queue is empty), avoiding linkage into and removal
46  * from the queue and repetition of various conversions.
47  */
48 #define	TCP_REASS(tp, ti, m, so, flags) { \
49 	if ((ti)->ti_seq == (tp)->rcv_nxt && \
50 	    (tp)->seg_next == (struct tcpiphdr *)(tp) && \
51 	    (tp)->t_state == TCPS_ESTABLISHED) { \
52 		(tp)->rcv_nxt += (ti)->ti_len; \
53 		flags = (ti)->ti_flags & TH_FIN; \
54 		tcpstat.tcps_rcvpack++;\
55 		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
56 		sbappend(&(so)->so_rcv, (m)); \
57 		sorwakeup(so); \
58 	} else \
59 		(flags) = tcp_reass((tp), (ti)); \
60 }
61 
62 tcp_reass(tp, ti)
63 	register struct tcpcb *tp;
64 	register struct tcpiphdr *ti;
65 {
66 	register struct tcpiphdr *q;
67 	struct socket *so = tp->t_inpcb->inp_socket;
68 	struct mbuf *m;
69 	int flags;
70 
71 	/*
72 	 * Call with ti==0 after become established to
73 	 * force pre-ESTABLISHED data up to user socket.
74 	 */
75 	if (ti == 0)
76 		goto present;
77 
78 	/*
79 	 * Find a segment which begins after this one does.
80 	 */
81 	for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
82 	    q = (struct tcpiphdr *)q->ti_next)
83 		if (SEQ_GT(q->ti_seq, ti->ti_seq))
84 			break;
85 
86 	/*
87 	 * If there is a preceding segment, it may provide some of
88 	 * our data already.  If so, drop the data from the incoming
89 	 * segment.  If it provides all of our data, drop us.
90 	 */
91 	if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
92 		register int i;
93 		q = (struct tcpiphdr *)q->ti_prev;
94 		/* conversion to int (in i) handles seq wraparound */
95 		i = q->ti_seq + q->ti_len - ti->ti_seq;
96 		if (i > 0) {
97 			if (i >= ti->ti_len) {
98 				tcpstat.tcps_rcvduppack++;
99 				tcpstat.tcps_rcvdupbyte += ti->ti_len;
100 				goto drop;
101 			}
102 			m_adj(dtom(ti), i);
103 			ti->ti_len -= i;
104 			ti->ti_seq += i;
105 		}
106 		q = (struct tcpiphdr *)(q->ti_next);
107 	}
108 	tcpstat.tcps_rcvoopack++;
109 	tcpstat.tcps_rcvoobyte += ti->ti_len;
110 
111 	/*
112 	 * While we overlap succeeding segments trim them or,
113 	 * if they are completely covered, dequeue them.
114 	 */
115 	while (q != (struct tcpiphdr *)tp) {
116 		register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
117 		if (i <= 0)
118 			break;
119 		if (i < q->ti_len) {
120 			q->ti_seq += i;
121 			q->ti_len -= i;
122 			m_adj(dtom(q), i);
123 			break;
124 		}
125 		q = (struct tcpiphdr *)q->ti_next;
126 		m = dtom(q->ti_prev);
127 		remque(q->ti_prev);
128 		m_freem(m);
129 	}
130 
131 	/*
132 	 * Stick new segment in its place.
133 	 */
134 	insque(ti, q->ti_prev);
135 
136 present:
137 	/*
138 	 * Present data to user, advancing rcv_nxt through
139 	 * completed sequence space.
140 	 */
141 	if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
142 		return (0);
143 	ti = tp->seg_next;
144 	if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
145 		return (0);
146 	if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
147 		return (0);
148 	do {
149 		tp->rcv_nxt += ti->ti_len;
150 		flags = ti->ti_flags & TH_FIN;
151 		remque(ti);
152 		m = dtom(ti);
153 		ti = (struct tcpiphdr *)ti->ti_next;
154 		if (so->so_state & SS_CANTRCVMORE)
155 			m_freem(m);
156 		else
157 			sbappend(&so->so_rcv, m);
158 	} while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
159 	sorwakeup(so);
160 	return (flags);
161 drop:
162 	m_freem(dtom(ti));
163 	return (0);
164 }
165 
166 /*
167  * TCP input routine, follows pages 65-76 of the
168  * protocol specification dated September, 1981 very closely.
169  */
170 tcp_input(m0)
171 	struct mbuf *m0;
172 {
173 	register struct tcpiphdr *ti;
174 	struct inpcb *inp;
175 	register struct mbuf *m;
176 	struct mbuf *om = 0;
177 	int len, tlen, off;
178 	register struct tcpcb *tp = 0;
179 	register int tiflags;
180 	struct socket *so;
181 	int todrop, acked, ourfinisacked, needoutput = 0;
182 	short ostate;
183 	struct in_addr laddr;
184 	int dropsocket = 0;
185 	int iss = 0;
186 
187 	tcpstat.tcps_rcvtotal++;
188 	/*
189 	 * Get IP and TCP header together in first mbuf.
190 	 * Note: IP leaves IP header in first mbuf.
191 	 */
192 	m = m0;
193 	ti = mtod(m, struct tcpiphdr *);
194 	if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
195 		ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
196 	if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
197 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
198 			tcpstat.tcps_rcvshort++;
199 			return;
200 		}
201 		ti = mtod(m, struct tcpiphdr *);
202 	}
203 
204 	/*
205 	 * Checksum extended TCP header and data.
206 	 */
207 	tlen = ((struct ip *)ti)->ip_len;
208 	len = sizeof (struct ip) + tlen;
209 	if (tcpcksum) {
210 		ti->ti_next = ti->ti_prev = 0;
211 		ti->ti_x1 = 0;
212 		ti->ti_len = (u_short)tlen;
213 		ti->ti_len = htons((u_short)ti->ti_len);
214 		if (ti->ti_sum = in_cksum(m, len)) {
215 			if (tcpprintfs)
216 				printf("tcp sum: src %x\n", ti->ti_src);
217 			tcpstat.tcps_rcvbadsum++;
218 			goto drop;
219 		}
220 	}
221 
222 	/*
223 	 * Check that TCP offset makes sense,
224 	 * pull out TCP options and adjust length.
225 	 */
226 	off = ti->ti_off << 2;
227 	if (off < sizeof (struct tcphdr) || off > tlen) {
228 		if (tcpprintfs)
229 			printf("tcp off: src %x off %d\n", ti->ti_src, off);
230 		tcpstat.tcps_rcvbadoff++;
231 		goto drop;
232 	}
233 	tlen -= off;
234 	ti->ti_len = tlen;
235 	if (off > sizeof (struct tcphdr)) {
236 		if (m->m_len < sizeof(struct ip) + off) {
237 			if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
238 				tcpstat.tcps_rcvshort++;
239 				return;
240 			}
241 			ti = mtod(m, struct tcpiphdr *);
242 		}
243 		om = m_get(M_DONTWAIT, MT_DATA);
244 		if (om == 0)
245 			goto drop;
246 		om->m_len = off - sizeof (struct tcphdr);
247 		{ caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
248 		  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
249 		  m->m_len -= om->m_len;
250 		  bcopy(op+om->m_len, op,
251 		   (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
252 		}
253 	}
254 	tiflags = ti->ti_flags;
255 
256 	/*
257 	 * Drop TCP and IP headers; TCP options were dropped above.
258 	 */
259 	m->m_off += sizeof(struct tcpiphdr);
260 	m->m_len -= sizeof(struct tcpiphdr);
261 
262 	/*
263 	 * Convert TCP protocol specific fields to host format.
264 	 */
265 	ti->ti_seq = ntohl(ti->ti_seq);
266 	ti->ti_ack = ntohl(ti->ti_ack);
267 	ti->ti_win = ntohs(ti->ti_win);
268 	ti->ti_urp = ntohs(ti->ti_urp);
269 
270 	/*
271 	 * Locate pcb for segment.
272 	 */
273 findpcb:
274 	inp = in_pcblookup
275 		(&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
276 		INPLOOKUP_WILDCARD);
277 
278 	/*
279 	 * If the state is CLOSED (i.e., TCB does not exist) then
280 	 * all data in the incoming segment is discarded.
281 	 */
282 	if (inp == 0)
283 		goto dropwithreset;
284 	tp = intotcpcb(inp);
285 	if (tp == 0)
286 		goto dropwithreset;
287 	so = inp->inp_socket;
288 	if (so->so_options & SO_DEBUG) {
289 		ostate = tp->t_state;
290 		tcp_saveti = *ti;
291 	}
292 	if (so->so_options & SO_ACCEPTCONN) {
293 		so = sonewconn(so);
294 		if (so == 0)
295 			goto drop;
296 		/*
297 		 * This is ugly, but ....
298 		 *
299 		 * Mark socket as temporary until we're
300 		 * committed to keeping it.  The code at
301 		 * ``drop'' and ``dropwithreset'' check the
302 		 * flag dropsocket to see if the temporary
303 		 * socket created here should be discarded.
304 		 * We mark the socket as discardable until
305 		 * we're committed to it below in TCPS_LISTEN.
306 		 */
307 		dropsocket++;
308 		inp = (struct inpcb *)so->so_pcb;
309 		inp->inp_laddr = ti->ti_dst;
310 		inp->inp_lport = ti->ti_dport;
311 		inp->inp_options = ip_srcroute();
312 		tp = intotcpcb(inp);
313 		tp->t_state = TCPS_LISTEN;
314 	}
315 
316 	/*
317 	 * Segment received on connection.
318 	 * Reset idle time and keep-alive timer.
319 	 */
320 	tp->t_idle = 0;
321 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
322 
323 	/*
324 	 * Process options if not in LISTEN state,
325 	 * else do it below (after getting remote address).
326 	 */
327 	if (om && tp->t_state != TCPS_LISTEN) {
328 		tcp_dooptions(tp, om, ti);
329 		om = 0;
330 	}
331 
332 	/*
333 	 * Calculate amount of space in receive window,
334 	 * and then do TCP input processing.
335 	 * Receive window is amount of space in rcv queue,
336 	 * but not less than advertised window.
337 	 */
338 	{ int win;
339 
340 	win = sbspace(&so->so_rcv);
341 	if (win < 0)
342 		win = 0;
343 	tp->rcv_wnd = MAX(win, (int)(tp->rcv_adv - tp->rcv_nxt));
344 	}
345 
346 	switch (tp->t_state) {
347 
348 	/*
349 	 * If the state is LISTEN then ignore segment if it contains an RST.
350 	 * If the segment contains an ACK then it is bad and send a RST.
351 	 * If it does not contain a SYN then it is not interesting; drop it.
352 	 * Don't bother responding if the destination was a broadcast.
353 	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
354 	 * tp->iss, and send a segment:
355 	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
356 	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
357 	 * Fill in remote peer address fields if not previously specified.
358 	 * Enter SYN_RECEIVED state, and process any other fields of this
359 	 * segment in this state.
360 	 */
361 	case TCPS_LISTEN: {
362 		struct mbuf *am;
363 		register struct sockaddr_in *sin;
364 
365 		if (tiflags & TH_RST)
366 			goto drop;
367 		if (tiflags & TH_ACK)
368 			goto dropwithreset;
369 		if ((tiflags & TH_SYN) == 0)
370 			goto drop;
371 		if (in_broadcast(ti->ti_dst))
372 			goto drop;
373 		am = m_get(M_DONTWAIT, MT_SONAME);
374 		if (am == NULL)
375 			goto drop;
376 		am->m_len = sizeof (struct sockaddr_in);
377 		sin = mtod(am, struct sockaddr_in *);
378 		sin->sin_family = AF_INET;
379 		sin->sin_addr = ti->ti_src;
380 		sin->sin_port = ti->ti_sport;
381 		laddr = inp->inp_laddr;
382 		if (inp->inp_laddr.s_addr == INADDR_ANY)
383 			inp->inp_laddr = ti->ti_dst;
384 		if (in_pcbconnect(inp, am)) {
385 			inp->inp_laddr = laddr;
386 			(void) m_free(am);
387 			goto drop;
388 		}
389 		(void) m_free(am);
390 		tp->t_template = tcp_template(tp);
391 		if (tp->t_template == 0) {
392 			tp = tcp_drop(tp, ENOBUFS);
393 			dropsocket = 0;		/* socket is already gone */
394 			goto drop;
395 		}
396 		if (om) {
397 			tcp_dooptions(tp, om, ti);
398 			om = 0;
399 		}
400 		if (iss)
401 			tp->iss = iss;
402 		else
403 			tp->iss = tcp_iss;
404 		tcp_iss += TCP_ISSINCR/2;
405 		tp->irs = ti->ti_seq;
406 		tcp_sendseqinit(tp);
407 		tcp_rcvseqinit(tp);
408 		tp->t_flags |= TF_ACKNOW;
409 		tp->t_state = TCPS_SYN_RECEIVED;
410 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
411 		dropsocket = 0;		/* committed to socket */
412 		tcpstat.tcps_accepts++;
413 		goto trimthenstep6;
414 		}
415 
416 	/*
417 	 * If the state is SYN_SENT:
418 	 *	if seg contains an ACK, but not for our SYN, drop the input.
419 	 *	if seg contains a RST, then drop the connection.
420 	 *	if seg does not contain SYN, then drop it.
421 	 * Otherwise this is an acceptable SYN segment
422 	 *	initialize tp->rcv_nxt and tp->irs
423 	 *	if seg contains ack then advance tp->snd_una
424 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
425 	 *	arrange for segment to be acked (eventually)
426 	 *	continue processing rest of data/controls, beginning with URG
427 	 */
428 	case TCPS_SYN_SENT:
429 		if ((tiflags & TH_ACK) &&
430 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
431 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
432 			goto dropwithreset;
433 		if (tiflags & TH_RST) {
434 			if (tiflags & TH_ACK)
435 				tp = tcp_drop(tp, ECONNREFUSED);
436 			goto drop;
437 		}
438 		if ((tiflags & TH_SYN) == 0)
439 			goto drop;
440 		if (tiflags & TH_ACK) {
441 			tp->snd_una = ti->ti_ack;
442 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
443 				tp->snd_nxt = tp->snd_una;
444 		}
445 		tp->t_timer[TCPT_REXMT] = 0;
446 		tp->irs = ti->ti_seq;
447 		tcp_rcvseqinit(tp);
448 		tp->t_flags |= TF_ACKNOW;
449 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
450 			tcpstat.tcps_connects++;
451 			soisconnected(so);
452 			tp->t_state = TCPS_ESTABLISHED;
453 			tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
454 			(void) tcp_reass(tp, (struct tcpiphdr *)0);
455 		} else
456 			tp->t_state = TCPS_SYN_RECEIVED;
457 
458 trimthenstep6:
459 		/*
460 		 * Advance ti->ti_seq to correspond to first data byte.
461 		 * If data, trim to stay within window,
462 		 * dropping FIN if necessary.
463 		 */
464 		ti->ti_seq++;
465 		if (ti->ti_len > tp->rcv_wnd) {
466 			todrop = ti->ti_len - tp->rcv_wnd;
467 			m_adj(m, -todrop);
468 			ti->ti_len = tp->rcv_wnd;
469 			tiflags &= ~TH_FIN;
470 			tcpstat.tcps_rcvpackafterwin++;
471 			tcpstat.tcps_rcvbyteafterwin += todrop;
472 		}
473 		tp->snd_wl1 = ti->ti_seq - 1;
474 		tp->rcv_up = ti->ti_seq;
475 		goto step6;
476 	}
477 
478 	/*
479 	 * States other than LISTEN or SYN_SENT.
480 	 * First check that at least some bytes of segment are within
481 	 * receive window.  If segment begins before rcv_nxt,
482 	 * drop leading data (and SYN); if nothing left, just ack.
483 	 */
484 	todrop = tp->rcv_nxt - ti->ti_seq;
485 	if (todrop > 0) {
486 		if (tiflags & TH_SYN) {
487 			tiflags &= ~TH_SYN;
488 			ti->ti_seq++;
489 			if (ti->ti_urp > 1)
490 				ti->ti_urp--;
491 			else
492 				tiflags &= ~TH_URG;
493 			todrop--;
494 		}
495 		if (todrop > ti->ti_len ||
496 		    todrop == ti->ti_len && (tiflags&TH_FIN) == 0) {
497 			tcpstat.tcps_rcvduppack++;
498 			tcpstat.tcps_rcvdupbyte += ti->ti_len;
499 			goto dropafterack;
500 		}
501 		tcpstat.tcps_rcvpartduppack++;
502 		tcpstat.tcps_rcvpartdupbyte += todrop;
503 		m_adj(m, todrop);
504 		ti->ti_seq += todrop;
505 		ti->ti_len -= todrop;
506 		if (ti->ti_urp > todrop)
507 			ti->ti_urp -= todrop;
508 		else {
509 			tiflags &= ~TH_URG;
510 			ti->ti_urp = 0;
511 		}
512 	}
513 
514 	if (tp->rcv_wnd == 0) {
515 		/*
516 		 * If window is closed can only take segments at
517 		 * window edge, and have to drop data and PUSH from
518 		 * incoming segments.
519 		 *
520 		 * If new data is received on a connection after the
521 		 * user processes are gone, then RST the other end.
522 		 */
523 		if ((so->so_state & SS_NOFDREF) &&
524 		    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
525 			tp = tcp_close(tp);
526 			tcpstat.tcps_rcvafterclose++;
527 			goto dropwithreset;
528 		}
529 		if (tp->rcv_nxt != ti->ti_seq) {
530 			tcpstat.tcps_rcvpackafterwin++;
531 			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
532 			goto dropafterack;
533 		}
534 		if (ti->ti_len > 0) {
535 			if (ti->ti_len == 1)
536 				tcpstat.tcps_rcvwinprobe++;
537 			else {
538 				tcpstat.tcps_rcvpackafterwin++;
539 				tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
540 			}
541 			m_adj(m, ti->ti_len);
542 			ti->ti_len = 0;
543 			tiflags &= ~(TH_PUSH|TH_FIN);
544 		}
545 	} else {
546 		/*
547 		 * If segment ends after window, drop trailing data
548 		 * (and PUSH and FIN); if nothing left, just ACK.
549 		 */
550 		todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
551 		if (todrop > 0) {
552 			if (todrop >= ti->ti_len) {
553 				/*
554 				 * If a new connection request is received
555 				 * while in TIME_WAIT, drop the old connection
556 				 * and start over if the sequence numbers
557 				 * are above the previous ones.
558 				 */
559 				if (tiflags & TH_SYN &&
560 				    tp->t_state == TCPS_TIME_WAIT &&
561 				    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
562 					iss = tp->rcv_nxt + TCP_ISSINCR;
563 					(void) tcp_close(tp);
564 					goto findpcb;
565 				}
566 				if (todrop == 1)
567 					tcpstat.tcps_rcvwinprobe++;
568 				else {
569 					tcpstat.tcps_rcvpackafterwin++;
570 					tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
571 				}
572 				goto dropafterack;
573 			}
574 			tcpstat.tcps_rcvpackafterwin++;
575 			tcpstat.tcps_rcvbyteafterwin += todrop;
576 			m_adj(m, -todrop);
577 			ti->ti_len -= todrop;
578 			tiflags &= ~(TH_PUSH|TH_FIN);
579 		}
580 	}
581 
582 	/*
583 	 * If the RST bit is set examine the state:
584 	 *    SYN_RECEIVED STATE:
585 	 *	If passive open, return to LISTEN state.
586 	 *	If active open, inform user that connection was refused.
587 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
588 	 *	Inform user that connection was reset, and close tcb.
589 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
590 	 *	Close the tcb.
591 	 */
592 	if (tiflags&TH_RST) switch (tp->t_state) {
593 
594 	case TCPS_SYN_RECEIVED:
595 		tp = tcp_drop(tp, ECONNREFUSED);
596 		goto drop;
597 
598 	case TCPS_ESTABLISHED:
599 	case TCPS_FIN_WAIT_1:
600 	case TCPS_FIN_WAIT_2:
601 	case TCPS_CLOSE_WAIT:
602 		tp = tcp_drop(tp, ECONNRESET);
603 		goto drop;
604 
605 	case TCPS_CLOSING:
606 	case TCPS_LAST_ACK:
607 	case TCPS_TIME_WAIT:
608 		tp = tcp_close(tp);
609 		goto drop;
610 	}
611 
612 	/*
613 	 * If a SYN is in the window, then this is an
614 	 * error and we send an RST and drop the connection.
615 	 */
616 	if (tiflags & TH_SYN) {
617 		tp = tcp_drop(tp, ECONNRESET);
618 		goto dropwithreset;
619 	}
620 
621 	/*
622 	 * If the ACK bit is off we drop the segment and return.
623 	 */
624 	if ((tiflags & TH_ACK) == 0)
625 		goto drop;
626 
627 	/*
628 	 * Ack processing.
629 	 */
630 	switch (tp->t_state) {
631 
632 	/*
633 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
634 	 * ESTABLISHED state and continue processing, otherwise
635 	 * send an RST.
636 	 */
637 	case TCPS_SYN_RECEIVED:
638 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
639 		    SEQ_GT(ti->ti_ack, tp->snd_max))
640 			goto dropwithreset;
641 		tcpstat.tcps_connects++;
642 		soisconnected(so);
643 		tp->t_state = TCPS_ESTABLISHED;
644 		tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
645 		(void) tcp_reass(tp, (struct tcpiphdr *)0);
646 		tp->snd_wl1 = ti->ti_seq - 1;
647 		/* fall into ... */
648 
649 	/*
650 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
651 	 * ACKs.  If the ack is in the range
652 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
653 	 * then advance tp->snd_una to ti->ti_ack and drop
654 	 * data from the retransmission queue.  If this ACK reflects
655 	 * more up to date window information we update our window information.
656 	 */
657 	case TCPS_ESTABLISHED:
658 	case TCPS_FIN_WAIT_1:
659 	case TCPS_FIN_WAIT_2:
660 	case TCPS_CLOSE_WAIT:
661 	case TCPS_CLOSING:
662 	case TCPS_LAST_ACK:
663 	case TCPS_TIME_WAIT:
664 
665 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
666 			if (ti->ti_len == 0)
667 				tcpstat.tcps_rcvdupack++;
668 			break;
669 		}
670 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
671 			tcpstat.tcps_rcvacktoomuch++;
672 			goto dropafterack;
673 		}
674 		acked = ti->ti_ack - tp->snd_una;
675 		tcpstat.tcps_rcvackpack++;
676 		tcpstat.tcps_rcvackbyte += acked;
677 
678 		/*
679 		 * If transmit timer is running and timed sequence
680 		 * number was acked, update smoothed round trip time.
681 		 */
682 		if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
683 			tcpstat.tcps_rttupdated++;
684 			if (tp->t_srtt != 0) {
685 				register short delta;
686 
687 				/*
688 				 * srtt is stored as fixed point with 3 bits
689 				 * after the binary point (i.e., scaled by 8).
690 				 * The following magic is equivalent
691 				 * to the smoothing algorithm in rfc793
692 				 * with an alpha of .875
693 				 * (srtt = rtt/8 + srtt*7/8 in fixed point).
694 				 */
695 				delta = tp->t_rtt - (tp->t_srtt >> 3);
696 				if ((tp->t_srtt += delta) <= 0)
697 					tp->t_srtt = 1;
698 				/*
699 				 * We accumulate a smoothed rtt variance,
700 				 * then set the retransmit timer to smoothed
701 				 * rtt + 2 times the smoothed variance.
702 				 * rttvar is strored as fixed point
703 				 * with 2 bits after the binary point
704 				 * (scaled by 4).  The following is equivalent
705 				 * to rfc793 smoothing with an alpha of .75
706 				 * (rttvar = rttvar*3/4 + |delta| / 4).
707 				 * This replaces rfc793's wired-in beta.
708 				 */
709 				if (delta < 0)
710 					delta = -delta;
711 				delta -= (tp->t_rttvar >> 2);
712 				if ((tp->t_rttvar += delta) <= 0)
713 					tp->t_rttvar = 1;
714 			} else {
715 				/*
716 				 * No rtt measurement yet - use the
717 				 * unsmoothed rtt.  Set the variance
718 				 * to half the rtt (so our first
719 				 * retransmit happens at 2*rtt)
720 				 */
721 				tp->t_srtt = tp->t_rtt << 3;
722 				tp->t_rttvar = tp->t_rtt << 1;
723 			}
724 			tp->t_rtt = 0;
725 		}
726 
727 		/*
728 		 * If all outstanding data is acked, stop retransmit
729 		 * timer and remember to restart (more output or persist).
730 		 * If there is more data to be acked, restart retransmit
731 		 * timer; set to smoothed rtt + 2*rttvar.
732 		 */
733 		if (ti->ti_ack == tp->snd_max) {
734 			tp->t_timer[TCPT_REXMT] = 0;
735 			needoutput = 1;
736 		} else if (tp->t_timer[TCPT_PERSIST] == 0) {
737 			TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
738 			    ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
739 			    TCPTV_MIN, TCPTV_REXMTMAX);
740 			tp->t_rxtshift = 0;
741 		}
742 		/*
743 		 * When new data is acked, open the congestion window
744 		 * by one max sized segment.
745 		 */
746 		tp->snd_cwnd = MIN(tp->snd_cwnd + tp->t_maxseg, 65535);
747 		if (acked > so->so_snd.sb_cc) {
748 			tp->snd_wnd -= so->so_snd.sb_cc;
749 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
750 			ourfinisacked = 1;
751 		} else {
752 			sbdrop(&so->so_snd, acked);
753 			tp->snd_wnd -= acked;
754 			ourfinisacked = 0;
755 		}
756 		if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
757 			sowwakeup(so);
758 		tp->snd_una = ti->ti_ack;
759 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
760 			tp->snd_nxt = tp->snd_una;
761 
762 		switch (tp->t_state) {
763 
764 		/*
765 		 * In FIN_WAIT_1 STATE in addition to the processing
766 		 * for the ESTABLISHED state if our FIN is now acknowledged
767 		 * then enter FIN_WAIT_2.
768 		 */
769 		case TCPS_FIN_WAIT_1:
770 			if (ourfinisacked) {
771 				/*
772 				 * If we can't receive any more
773 				 * data, then closing user can proceed.
774 				 * Starting the timer is contrary to the
775 				 * specification, but if we don't get a FIN
776 				 * we'll hang forever.
777 				 */
778 				if (so->so_state & SS_CANTRCVMORE) {
779 					soisdisconnected(so);
780 					tp->t_timer[TCPT_2MSL] = TCPTV_MAXIDLE;
781 				}
782 				tp->t_state = TCPS_FIN_WAIT_2;
783 			}
784 			break;
785 
786 	 	/*
787 		 * In CLOSING STATE in addition to the processing for
788 		 * the ESTABLISHED state if the ACK acknowledges our FIN
789 		 * then enter the TIME-WAIT state, otherwise ignore
790 		 * the segment.
791 		 */
792 		case TCPS_CLOSING:
793 			if (ourfinisacked) {
794 				tp->t_state = TCPS_TIME_WAIT;
795 				tcp_canceltimers(tp);
796 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
797 				soisdisconnected(so);
798 			}
799 			break;
800 
801 		/*
802 		 * The only thing that can arrive in  LAST_ACK state
803 		 * is an acknowledgment of our FIN.  If our FIN is now
804 		 * acknowledged, delete the TCB, enter the closed state
805 		 * and return.
806 		 */
807 		case TCPS_LAST_ACK:
808 			if (ourfinisacked)
809 				tp = tcp_close(tp);
810 			goto drop;
811 
812 		/*
813 		 * In TIME_WAIT state the only thing that should arrive
814 		 * is a retransmission of the remote FIN.  Acknowledge
815 		 * it and restart the finack timer.
816 		 */
817 		case TCPS_TIME_WAIT:
818 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
819 			goto dropafterack;
820 		}
821 	}
822 
823 step6:
824 	/*
825 	 * Update window information.
826 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
827 	 */
828 	if ((tiflags & TH_ACK) &&
829 	    (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
830 	    (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
831 	     tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd))) {
832 		/* keep track of pure window updates */
833 		if (ti->ti_len == 0 &&
834 		    tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd) {
835 			tcpstat.tcps_rcvwinupd++;
836 			tcpstat.tcps_rcvdupack--;
837 		}
838 		tp->snd_wnd = ti->ti_win;
839 		tp->snd_wl1 = ti->ti_seq;
840 		tp->snd_wl2 = ti->ti_ack;
841 		if (tp->snd_wnd > tp->max_sndwnd)
842 			tp->max_sndwnd = tp->snd_wnd;
843 		needoutput = 1;
844 	}
845 
846 	/*
847 	 * Process segments with URG.
848 	 */
849 	if ((tiflags & TH_URG) && ti->ti_urp &&
850 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
851 		/*
852 		 * This is a kludge, but if we receive and accept
853 		 * random urgent pointers, we'll crash in
854 		 * soreceive.  It's hard to imagine someone
855 		 * actually wanting to send this much urgent data.
856 		 */
857 		if (ti->ti_urp + so->so_rcv.sb_cc > SB_MAX) {
858 			ti->ti_urp = 0;			/* XXX */
859 			tiflags &= ~TH_URG;		/* XXX */
860 			goto dodata;			/* XXX */
861 		}
862 		/*
863 		 * If this segment advances the known urgent pointer,
864 		 * then mark the data stream.  This should not happen
865 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
866 		 * a FIN has been received from the remote side.
867 		 * In these states we ignore the URG.
868 		 *
869 		 * According to RFC961 (Assigned Protocols),
870 		 * the urgent pointer points to the last octet
871 		 * of urgent data.  We continue, however,
872 		 * to consider it to indicate the first octet
873 		 * of data past the urgent section
874 		 * as the original spec states.
875 		 */
876 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
877 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
878 			so->so_oobmark = so->so_rcv.sb_cc +
879 			    (tp->rcv_up - tp->rcv_nxt) - 1;
880 			if (so->so_oobmark == 0)
881 				so->so_state |= SS_RCVATMARK;
882 			sohasoutofband(so);
883 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
884 		}
885 		/*
886 		 * Remove out of band data so doesn't get presented to user.
887 		 * This can happen independent of advancing the URG pointer,
888 		 * but if two URG's are pending at once, some out-of-band
889 		 * data may creep in... ick.
890 		 */
891 		if (ti->ti_urp <= ti->ti_len &&
892 		    (so->so_options & SO_OOBINLINE) == 0)
893 			tcp_pulloutofband(so, ti);
894 	} else
895 		/*
896 		 * If no out of band data is expected,
897 		 * pull receive urgent pointer along
898 		 * with the receive window.
899 		 */
900 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
901 			tp->rcv_up = tp->rcv_nxt;
902 dodata:							/* XXX */
903 
904 	/*
905 	 * Process the segment text, merging it into the TCP sequencing queue,
906 	 * and arranging for acknowledgment of receipt if necessary.
907 	 * This process logically involves adjusting tp->rcv_wnd as data
908 	 * is presented to the user (this happens in tcp_usrreq.c,
909 	 * case PRU_RCVD).  If a FIN has already been received on this
910 	 * connection then we just ignore the text.
911 	 */
912 	if ((ti->ti_len || (tiflags&TH_FIN)) &&
913 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
914 		TCP_REASS(tp, ti, m, so, tiflags);
915 		if (tcpnodelack == 0)
916 			tp->t_flags |= TF_DELACK;
917 		else
918 			tp->t_flags |= TF_ACKNOW;
919 		/*
920 		 * Note the amount of data that peer has sent into
921 		 * our window, in order to estimate the sender's
922 		 * buffer size.
923 		 */
924 		len = so->so_rcv.sb_hiwat - (tp->rcv_nxt - tp->rcv_adv);
925 		if (len > tp->max_rcvd)
926 			tp->max_rcvd = len;
927 	} else {
928 		m_freem(m);
929 		tiflags &= ~TH_FIN;
930 	}
931 
932 	/*
933 	 * If FIN is received ACK the FIN and let the user know
934 	 * that the connection is closing.
935 	 */
936 	if (tiflags & TH_FIN) {
937 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
938 			socantrcvmore(so);
939 			tp->t_flags |= TF_ACKNOW;
940 			tp->rcv_nxt++;
941 		}
942 		switch (tp->t_state) {
943 
944 	 	/*
945 		 * In SYN_RECEIVED and ESTABLISHED STATES
946 		 * enter the CLOSE_WAIT state.
947 		 */
948 		case TCPS_SYN_RECEIVED:
949 		case TCPS_ESTABLISHED:
950 			tp->t_state = TCPS_CLOSE_WAIT;
951 			break;
952 
953 	 	/*
954 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
955 		 * enter the CLOSING state.
956 		 */
957 		case TCPS_FIN_WAIT_1:
958 			tp->t_state = TCPS_CLOSING;
959 			break;
960 
961 	 	/*
962 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
963 		 * starting the time-wait timer, turning off the other
964 		 * standard timers.
965 		 */
966 		case TCPS_FIN_WAIT_2:
967 			tp->t_state = TCPS_TIME_WAIT;
968 			tcp_canceltimers(tp);
969 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
970 			soisdisconnected(so);
971 			break;
972 
973 		/*
974 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
975 		 */
976 		case TCPS_TIME_WAIT:
977 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
978 			break;
979 		}
980 	}
981 	if (so->so_options & SO_DEBUG)
982 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
983 
984 	/*
985 	 * Return any desired output.
986 	 */
987 	if (needoutput || (tp->t_flags & TF_ACKNOW))
988 		(void) tcp_output(tp);
989 	return;
990 
991 dropafterack:
992 	/*
993 	 * Generate an ACK dropping incoming segment if it occupies
994 	 * sequence space, where the ACK reflects our state.
995 	 */
996 	if (tiflags & TH_RST)
997 		goto drop;
998 	if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
999 		tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
1000 	tp->t_flags |= TF_ACKNOW;
1001 	(void) tcp_output(tp);
1002 	return;
1003 
1004 dropwithreset:
1005 	if (om) {
1006 		(void) m_free(om);
1007 		om = 0;
1008 	}
1009 	/*
1010 	 * Generate a RST, dropping incoming segment.
1011 	 * Make ACK acceptable to originator of segment.
1012 	 * Don't bother to respond if destination was broadcast.
1013 	 */
1014 	if ((tiflags & TH_RST) || in_broadcast(ti->ti_dst))
1015 		goto drop;
1016 	if (tiflags & TH_ACK)
1017 		tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
1018 	else {
1019 		if (tiflags & TH_SYN)
1020 			ti->ti_len++;
1021 		tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
1022 		    TH_RST|TH_ACK);
1023 	}
1024 	/* destroy temporarily created socket */
1025 	if (dropsocket)
1026 		(void) soabort(so);
1027 	return;
1028 
1029 drop:
1030 	if (om)
1031 		(void) m_free(om);
1032 	/*
1033 	 * Drop space held by incoming segment and return.
1034 	 */
1035 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
1036 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
1037 	m_freem(m);
1038 	/* destroy temporarily created socket */
1039 	if (dropsocket)
1040 		(void) soabort(so);
1041 	return;
1042 }
1043 
1044 tcp_dooptions(tp, om, ti)
1045 	struct tcpcb *tp;
1046 	struct mbuf *om;
1047 	struct tcpiphdr *ti;
1048 {
1049 	register u_char *cp;
1050 	int opt, optlen, cnt;
1051 
1052 	cp = mtod(om, u_char *);
1053 	cnt = om->m_len;
1054 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1055 		opt = cp[0];
1056 		if (opt == TCPOPT_EOL)
1057 			break;
1058 		if (opt == TCPOPT_NOP)
1059 			optlen = 1;
1060 		else {
1061 			optlen = cp[1];
1062 			if (optlen <= 0)
1063 				break;
1064 		}
1065 		switch (opt) {
1066 
1067 		default:
1068 			break;
1069 
1070 		case TCPOPT_MAXSEG:
1071 			if (optlen != 4)
1072 				continue;
1073 			if (!(ti->ti_flags & TH_SYN))
1074 				continue;
1075 			tp->t_maxseg = *(u_short *)(cp + 2);
1076 			tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
1077 			tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
1078 			break;
1079 		}
1080 	}
1081 	(void) m_free(om);
1082 }
1083 
1084 /*
1085  * Pull out of band byte out of a segment so
1086  * it doesn't appear in the user's data queue.
1087  * It is still reflected in the segment length for
1088  * sequencing purposes.
1089  */
1090 tcp_pulloutofband(so, ti)
1091 	struct socket *so;
1092 	struct tcpiphdr *ti;
1093 {
1094 	register struct mbuf *m;
1095 	int cnt = ti->ti_urp - 1;
1096 
1097 	m = dtom(ti);
1098 	while (cnt >= 0) {
1099 		if (m->m_len > cnt) {
1100 			char *cp = mtod(m, caddr_t) + cnt;
1101 			struct tcpcb *tp = sototcpcb(so);
1102 
1103 			tp->t_iobc = *cp;
1104 			tp->t_oobflags |= TCPOOB_HAVEDATA;
1105 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
1106 			m->m_len--;
1107 			return;
1108 		}
1109 		cnt -= m->m_len;
1110 		m = m->m_next;
1111 		if (m == 0)
1112 			break;
1113 	}
1114 	panic("tcp_pulloutofband");
1115 }
1116 
1117 /*
1118  *  Determine a reasonable value for maxseg size.
1119  *  If the route is known, use one that can be handled
1120  *  on the given interface without forcing IP to fragment.
1121  *  If bigger than an mbuf cluster (MCLBYTES), round down to nearest size
1122  *  to utilize large mbufs.
1123  *  If interface pointer is unavailable, or the destination isn't local,
1124  *  use a conservative size (512 or the default IP max size, but no more
1125  *  than the mtu of the interface through which we route),
1126  *  as we can't discover anything about intervening gateways or networks.
1127  *
1128  *  This is ugly, and doesn't belong at this level, but has to happen somehow.
1129  */
1130 tcp_mss(tp)
1131 	register struct tcpcb *tp;
1132 {
1133 	struct route *ro;
1134 	struct ifnet *ifp;
1135 	int mss;
1136 	struct inpcb *inp;
1137 
1138 	inp = tp->t_inpcb;
1139 	ro = &inp->inp_route;
1140 	if ((ro->ro_rt == (struct rtentry *)0) ||
1141 	    (ifp = ro->ro_rt->rt_ifp) == (struct ifnet *)0) {
1142 		/* No route yet, so try to acquire one */
1143 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
1144 			ro->ro_dst.sa_family = AF_INET;
1145 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1146 				inp->inp_faddr;
1147 			rtalloc(ro);
1148 		}
1149 		if ((ro->ro_rt == 0) || (ifp = ro->ro_rt->rt_ifp) == 0)
1150 			return (TCP_MSS);
1151 	}
1152 
1153 	mss = ifp->if_mtu - sizeof(struct tcpiphdr);
1154 #if	(MCLBYTES & (MCLBYTES - 1)) == 0
1155 	if (mss > MCLBYTES)
1156 		mss &= ~(MCLBYTES-1);
1157 #else
1158 	if (mss > MCLBYTES)
1159 		mss = mss / MCLBYTES * MCLBYTES;
1160 #endif
1161 	if (in_localaddr(inp->inp_faddr))
1162 		return (mss);
1163 	return (MIN(mss, TCP_MSS));
1164 }
1165