xref: /csrg-svn/sys/netinet/tcp_input.c (revision 32034)
1 /*
2  * Copyright (c) 1982, 1986 Regents of the University of California.
3  * All rights reserved.  The Berkeley software License Agreement
4  * specifies the terms and conditions for redistribution.
5  *
6  *	@(#)tcp_input.c	7.10 (Berkeley) 08/10/87
7  */
8 
9 #include "param.h"
10 #include "systm.h"
11 #include "mbuf.h"
12 #include "protosw.h"
13 #include "socket.h"
14 #include "socketvar.h"
15 #include "errno.h"
16 
17 #include "../net/if.h"
18 #include "../net/route.h"
19 
20 #include "in.h"
21 #include "in_pcb.h"
22 #include "in_systm.h"
23 #include "ip.h"
24 #include "ip_var.h"
25 #include "tcp.h"
26 #include "tcp_fsm.h"
27 #include "tcp_seq.h"
28 #include "tcp_timer.h"
29 #include "tcp_var.h"
30 #include "tcpip.h"
31 #include "tcp_debug.h"
32 
33 int	tcpprintfs = 0;
34 int	tcpcksum = 1;
35 struct	tcpiphdr tcp_saveti;
36 extern	tcpnodelack;
37 
38 struct	tcpcb *tcp_newtcpcb();
39 
40 /*
41  * Insert segment ti into reassembly queue of tcp with
42  * control block tp.  Return TH_FIN if reassembly now includes
43  * a segment with FIN.  The macro form does the common case inline
44  * (segment is the next to be received on an established connection,
45  * and the queue is empty), avoiding linkage into and removal
46  * from the queue and repetition of various conversions.
47  */
48 #define	TCP_REASS(tp, ti, m, so, flags) { \
49 	if ((ti)->ti_seq == (tp)->rcv_nxt && \
50 	    (tp)->seg_next == (struct tcpiphdr *)(tp) && \
51 	    (tp)->t_state == TCPS_ESTABLISHED) { \
52 		(tp)->rcv_nxt += (ti)->ti_len; \
53 		flags = (ti)->ti_flags & TH_FIN; \
54 		tcpstat.tcps_rcvpack++;\
55 		tcpstat.tcps_rcvbyte += (ti)->ti_len;\
56 		sbappend(&(so)->so_rcv, (m)); \
57 		sorwakeup(so); \
58 	} else \
59 		(flags) = tcp_reass((tp), (ti)); \
60 }
61 
62 tcp_reass(tp, ti)
63 	register struct tcpcb *tp;
64 	register struct tcpiphdr *ti;
65 {
66 	register struct tcpiphdr *q;
67 	struct socket *so = tp->t_inpcb->inp_socket;
68 	struct mbuf *m;
69 	int flags;
70 
71 	/*
72 	 * Call with ti==0 after become established to
73 	 * force pre-ESTABLISHED data up to user socket.
74 	 */
75 	if (ti == 0)
76 		goto present;
77 
78 	/*
79 	 * Find a segment which begins after this one does.
80 	 */
81 	for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
82 	    q = (struct tcpiphdr *)q->ti_next)
83 		if (SEQ_GT(q->ti_seq, ti->ti_seq))
84 			break;
85 
86 	/*
87 	 * If there is a preceding segment, it may provide some of
88 	 * our data already.  If so, drop the data from the incoming
89 	 * segment.  If it provides all of our data, drop us.
90 	 */
91 	if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
92 		register int i;
93 		q = (struct tcpiphdr *)q->ti_prev;
94 		/* conversion to int (in i) handles seq wraparound */
95 		i = q->ti_seq + q->ti_len - ti->ti_seq;
96 		if (i > 0) {
97 			if (i >= ti->ti_len) {
98 				tcpstat.tcps_rcvduppack++;
99 				tcpstat.tcps_rcvdupbyte += ti->ti_len;
100 				goto drop;
101 			}
102 			m_adj(dtom(ti), i);
103 			ti->ti_len -= i;
104 			ti->ti_seq += i;
105 		}
106 		q = (struct tcpiphdr *)(q->ti_next);
107 	}
108 	tcpstat.tcps_rcvoopack++;
109 	tcpstat.tcps_rcvoobyte += ti->ti_len;
110 
111 	/*
112 	 * While we overlap succeeding segments trim them or,
113 	 * if they are completely covered, dequeue them.
114 	 */
115 	while (q != (struct tcpiphdr *)tp) {
116 		register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
117 		if (i <= 0)
118 			break;
119 		if (i < q->ti_len) {
120 			q->ti_seq += i;
121 			q->ti_len -= i;
122 			m_adj(dtom(q), i);
123 			break;
124 		}
125 		q = (struct tcpiphdr *)q->ti_next;
126 		m = dtom(q->ti_prev);
127 		remque(q->ti_prev);
128 		m_freem(m);
129 	}
130 
131 	/*
132 	 * Stick new segment in its place.
133 	 */
134 	insque(ti, q->ti_prev);
135 
136 present:
137 	/*
138 	 * Present data to user, advancing rcv_nxt through
139 	 * completed sequence space.
140 	 */
141 	if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
142 		return (0);
143 	ti = tp->seg_next;
144 	if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
145 		return (0);
146 	if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
147 		return (0);
148 	do {
149 		tp->rcv_nxt += ti->ti_len;
150 		flags = ti->ti_flags & TH_FIN;
151 		remque(ti);
152 		m = dtom(ti);
153 		ti = (struct tcpiphdr *)ti->ti_next;
154 		if (so->so_state & SS_CANTRCVMORE)
155 			m_freem(m);
156 		else
157 			sbappend(&so->so_rcv, m);
158 	} while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
159 	sorwakeup(so);
160 	return (flags);
161 drop:
162 	m_freem(dtom(ti));
163 	return (0);
164 }
165 
166 /*
167  * TCP input routine, follows pages 65-76 of the
168  * protocol specification dated September, 1981 very closely.
169  */
170 tcp_input(m0)
171 	struct mbuf *m0;
172 {
173 	register struct tcpiphdr *ti;
174 	struct inpcb *inp;
175 	register struct mbuf *m;
176 	struct mbuf *om = 0;
177 	int len, tlen, off;
178 	register struct tcpcb *tp = 0;
179 	register int tiflags;
180 	struct socket *so;
181 	int todrop, acked, ourfinisacked, needoutput = 0;
182 	short ostate;
183 	struct in_addr laddr;
184 	int dropsocket = 0;
185 	int iss = 0;
186 
187 	tcpstat.tcps_rcvtotal++;
188 	/*
189 	 * Get IP and TCP header together in first mbuf.
190 	 * Note: IP leaves IP header in first mbuf.
191 	 */
192 	m = m0;
193 	ti = mtod(m, struct tcpiphdr *);
194 	if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
195 		ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
196 	if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
197 		if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
198 			tcpstat.tcps_rcvshort++;
199 			return;
200 		}
201 		ti = mtod(m, struct tcpiphdr *);
202 	}
203 
204 	/*
205 	 * Checksum extended TCP header and data.
206 	 */
207 	tlen = ((struct ip *)ti)->ip_len;
208 	len = sizeof (struct ip) + tlen;
209 	if (tcpcksum) {
210 		ti->ti_next = ti->ti_prev = 0;
211 		ti->ti_x1 = 0;
212 		ti->ti_len = (u_short)tlen;
213 		ti->ti_len = htons((u_short)ti->ti_len);
214 		if (ti->ti_sum = in_cksum(m, len)) {
215 			if (tcpprintfs)
216 				printf("tcp sum: src %x\n", ti->ti_src);
217 			tcpstat.tcps_rcvbadsum++;
218 			goto drop;
219 		}
220 	}
221 
222 	/*
223 	 * Check that TCP offset makes sense,
224 	 * pull out TCP options and adjust length.
225 	 */
226 	off = ti->ti_off << 2;
227 	if (off < sizeof (struct tcphdr) || off > tlen) {
228 		if (tcpprintfs)
229 			printf("tcp off: src %x off %d\n", ti->ti_src, off);
230 		tcpstat.tcps_rcvbadoff++;
231 		goto drop;
232 	}
233 	tlen -= off;
234 	ti->ti_len = tlen;
235 	if (off > sizeof (struct tcphdr)) {
236 		if (m->m_len < sizeof(struct ip) + off) {
237 			if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
238 				tcpstat.tcps_rcvshort++;
239 				return;
240 			}
241 			ti = mtod(m, struct tcpiphdr *);
242 		}
243 		om = m_get(M_DONTWAIT, MT_DATA);
244 		if (om == 0)
245 			goto drop;
246 		om->m_len = off - sizeof (struct tcphdr);
247 		{ caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
248 		  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
249 		  m->m_len -= om->m_len;
250 		  bcopy(op+om->m_len, op,
251 		   (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
252 		}
253 	}
254 	tiflags = ti->ti_flags;
255 
256 	/*
257 	 * Drop TCP and IP headers; TCP options were dropped above.
258 	 */
259 	m->m_off += sizeof(struct tcpiphdr);
260 	m->m_len -= sizeof(struct tcpiphdr);
261 
262 	/*
263 	 * Convert TCP protocol specific fields to host format.
264 	 */
265 	ti->ti_seq = ntohl(ti->ti_seq);
266 	ti->ti_ack = ntohl(ti->ti_ack);
267 	ti->ti_win = ntohs(ti->ti_win);
268 	ti->ti_urp = ntohs(ti->ti_urp);
269 
270 	/*
271 	 * Locate pcb for segment.
272 	 */
273 findpcb:
274 	inp = in_pcblookup
275 		(&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
276 		INPLOOKUP_WILDCARD);
277 
278 	/*
279 	 * If the state is CLOSED (i.e., TCB does not exist) then
280 	 * all data in the incoming segment is discarded.
281 	 */
282 	if (inp == 0)
283 		goto dropwithreset;
284 	tp = intotcpcb(inp);
285 	if (tp == 0)
286 		goto dropwithreset;
287 	so = inp->inp_socket;
288 	if (so->so_options & SO_DEBUG) {
289 		ostate = tp->t_state;
290 		tcp_saveti = *ti;
291 	}
292 	if (so->so_options & SO_ACCEPTCONN) {
293 		so = sonewconn(so);
294 		if (so == 0)
295 			goto drop;
296 		/*
297 		 * This is ugly, but ....
298 		 *
299 		 * Mark socket as temporary until we're
300 		 * committed to keeping it.  The code at
301 		 * ``drop'' and ``dropwithreset'' check the
302 		 * flag dropsocket to see if the temporary
303 		 * socket created here should be discarded.
304 		 * We mark the socket as discardable until
305 		 * we're committed to it below in TCPS_LISTEN.
306 		 */
307 		dropsocket++;
308 		inp = (struct inpcb *)so->so_pcb;
309 		inp->inp_laddr = ti->ti_dst;
310 		inp->inp_lport = ti->ti_dport;
311 		inp->inp_options = ip_srcroute();
312 		tp = intotcpcb(inp);
313 		tp->t_state = TCPS_LISTEN;
314 	}
315 
316 	/*
317 	 * Segment received on connection.
318 	 * Reset idle time and keep-alive timer.
319 	 */
320 	tp->t_idle = 0;
321 	tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
322 
323 	/*
324 	 * Process options if not in LISTEN state,
325 	 * else do it below (after getting remote address).
326 	 */
327 	if (om && tp->t_state != TCPS_LISTEN) {
328 		tcp_dooptions(tp, om, ti);
329 		om = 0;
330 	}
331 
332 	/*
333 	 * Calculate amount of space in receive window,
334 	 * and then do TCP input processing.
335 	 * Receive window is amount of space in rcv queue,
336 	 * but not less than advertised window.
337 	 */
338 	{ int win;
339 
340 	win = sbspace(&so->so_rcv);
341 	if (win < 0)
342 		win = 0;
343 	tp->rcv_wnd = MAX(win, (int)(tp->rcv_adv - tp->rcv_nxt));
344 	}
345 
346 	switch (tp->t_state) {
347 
348 	/*
349 	 * If the state is LISTEN then ignore segment if it contains an RST.
350 	 * If the segment contains an ACK then it is bad and send a RST.
351 	 * If it does not contain a SYN then it is not interesting; drop it.
352 	 * Don't bother responding if the destination was a broadcast.
353 	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
354 	 * tp->iss, and send a segment:
355 	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
356 	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
357 	 * Fill in remote peer address fields if not previously specified.
358 	 * Enter SYN_RECEIVED state, and process any other fields of this
359 	 * segment in this state.
360 	 */
361 	case TCPS_LISTEN: {
362 		struct mbuf *am;
363 		register struct sockaddr_in *sin;
364 
365 		if (tiflags & TH_RST)
366 			goto drop;
367 		if (tiflags & TH_ACK)
368 			goto dropwithreset;
369 		if ((tiflags & TH_SYN) == 0)
370 			goto drop;
371 		if (in_broadcast(ti->ti_dst))
372 			goto drop;
373 		am = m_get(M_DONTWAIT, MT_SONAME);
374 		if (am == NULL)
375 			goto drop;
376 		am->m_len = sizeof (struct sockaddr_in);
377 		sin = mtod(am, struct sockaddr_in *);
378 		sin->sin_family = AF_INET;
379 		sin->sin_addr = ti->ti_src;
380 		sin->sin_port = ti->ti_sport;
381 		laddr = inp->inp_laddr;
382 		if (inp->inp_laddr.s_addr == INADDR_ANY)
383 			inp->inp_laddr = ti->ti_dst;
384 		if (in_pcbconnect(inp, am)) {
385 			inp->inp_laddr = laddr;
386 			(void) m_free(am);
387 			goto drop;
388 		}
389 		(void) m_free(am);
390 		tp->t_template = tcp_template(tp);
391 		if (tp->t_template == 0) {
392 			tp = tcp_drop(tp, ENOBUFS);
393 			dropsocket = 0;		/* socket is already gone */
394 			goto drop;
395 		}
396 		if (om) {
397 			tcp_dooptions(tp, om, ti);
398 			om = 0;
399 		}
400 		if (iss)
401 			tp->iss = iss;
402 		else
403 			tp->iss = tcp_iss;
404 		tcp_iss += TCP_ISSINCR/2;
405 		tp->irs = ti->ti_seq;
406 		tcp_sendseqinit(tp);
407 		tcp_rcvseqinit(tp);
408 		tp->t_flags |= TF_ACKNOW;
409 		tp->t_state = TCPS_SYN_RECEIVED;
410 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
411 		dropsocket = 0;		/* committed to socket */
412 		tcpstat.tcps_accepts++;
413 		goto trimthenstep6;
414 		}
415 
416 	/*
417 	 * If the state is SYN_SENT:
418 	 *	if seg contains an ACK, but not for our SYN, drop the input.
419 	 *	if seg contains a RST, then drop the connection.
420 	 *	if seg does not contain SYN, then drop it.
421 	 * Otherwise this is an acceptable SYN segment
422 	 *	initialize tp->rcv_nxt and tp->irs
423 	 *	if seg contains ack then advance tp->snd_una
424 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
425 	 *	arrange for segment to be acked (eventually)
426 	 *	continue processing rest of data/controls, beginning with URG
427 	 */
428 	case TCPS_SYN_SENT:
429 		if ((tiflags & TH_ACK) &&
430 		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
431 		     SEQ_GT(ti->ti_ack, tp->snd_max)))
432 			goto dropwithreset;
433 		if (tiflags & TH_RST) {
434 			if (tiflags & TH_ACK)
435 				tp = tcp_drop(tp, ECONNREFUSED);
436 			goto drop;
437 		}
438 		if ((tiflags & TH_SYN) == 0)
439 			goto drop;
440 		if (tiflags & TH_ACK) {
441 			tp->snd_una = ti->ti_ack;
442 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
443 				tp->snd_nxt = tp->snd_una;
444 		}
445 		tp->t_timer[TCPT_REXMT] = 0;
446 		/*
447 		 * If we didn't have to retransmit,
448 		 * set the initial estimate of srtt.
449 		 * Set the variance to half the rtt
450 		 * (so our first retransmit happens at 2*rtt).
451 		 */
452 		if (tp->t_rtt) {
453 			tp->t_srtt = tp->t_rtt << 3;
454 			tp->t_rttvar = tp->t_rtt << 1;
455 			tp->t_rtt = 0;
456 			tp->t_rxtshift = 0;
457 			TCPT_RANGESET(tp->t_rxtcur,
458 			    ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
459 			    TCPTV_MIN, TCPTV_REXMTMAX);
460 		}
461 		tp->irs = ti->ti_seq;
462 		tcp_rcvseqinit(tp);
463 		tp->t_flags |= TF_ACKNOW;
464 		if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
465 			tcpstat.tcps_connects++;
466 			soisconnected(so);
467 			tp->t_state = TCPS_ESTABLISHED;
468 			tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
469 			(void) tcp_reass(tp, (struct tcpiphdr *)0);
470 		} else
471 			tp->t_state = TCPS_SYN_RECEIVED;
472 
473 trimthenstep6:
474 		/*
475 		 * Advance ti->ti_seq to correspond to first data byte.
476 		 * If data, trim to stay within window,
477 		 * dropping FIN if necessary.
478 		 */
479 		ti->ti_seq++;
480 		if (ti->ti_len > tp->rcv_wnd) {
481 			todrop = ti->ti_len - tp->rcv_wnd;
482 			m_adj(m, -todrop);
483 			ti->ti_len = tp->rcv_wnd;
484 			tiflags &= ~TH_FIN;
485 			tcpstat.tcps_rcvpackafterwin++;
486 			tcpstat.tcps_rcvbyteafterwin += todrop;
487 		}
488 		tp->snd_wl1 = ti->ti_seq - 1;
489 		tp->rcv_up = ti->ti_seq;
490 		goto step6;
491 	}
492 
493 	/*
494 	 * States other than LISTEN or SYN_SENT.
495 	 * First check that at least some bytes of segment are within
496 	 * receive window.  If segment begins before rcv_nxt,
497 	 * drop leading data (and SYN); if nothing left, just ack.
498 	 */
499 	todrop = tp->rcv_nxt - ti->ti_seq;
500 	if (todrop > 0) {
501 		if (tiflags & TH_SYN) {
502 			tiflags &= ~TH_SYN;
503 			ti->ti_seq++;
504 			if (ti->ti_urp > 1)
505 				ti->ti_urp--;
506 			else
507 				tiflags &= ~TH_URG;
508 			todrop--;
509 		}
510 		if (todrop > ti->ti_len ||
511 		    todrop == ti->ti_len && (tiflags&TH_FIN) == 0) {
512 #ifdef TCP_COMPAT_42
513 			/*
514 			 * Don't toss RST in response to 4.2-style keepalive.
515 			 */
516 			if (ti->ti_seq == tp->rcv_nxt - 1 && tiflags & TH_RST)
517 				goto do_rst;
518 #endif
519 			tcpstat.tcps_rcvduppack++;
520 			tcpstat.tcps_rcvdupbyte += ti->ti_len;
521 			todrop = ti->ti_len;
522 			tp->t_flags |= TF_ACKNOW;
523 		} else {
524 			tcpstat.tcps_rcvpartduppack++;
525 			tcpstat.tcps_rcvpartdupbyte += todrop;
526 		}
527 		m_adj(m, todrop);
528 		ti->ti_seq += todrop;
529 		ti->ti_len -= todrop;
530 		if (ti->ti_urp > todrop)
531 			ti->ti_urp -= todrop;
532 		else {
533 			tiflags &= ~TH_URG;
534 			ti->ti_urp = 0;
535 		}
536 	}
537 
538 	if (tp->rcv_wnd == 0) {
539 		/*
540 		 * If window is closed can only take segments at
541 		 * window edge, and have to drop data and PUSH from
542 		 * incoming segments.
543 		 *
544 		 * If new data is received on a connection after the
545 		 * user processes are gone, then RST the other end.
546 		 */
547 		if ((so->so_state & SS_NOFDREF) &&
548 		    tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
549 			tp = tcp_close(tp);
550 			tcpstat.tcps_rcvafterclose++;
551 			goto dropwithreset;
552 		}
553 		if (tp->rcv_nxt != ti->ti_seq) {
554 			tcpstat.tcps_rcvpackafterwin++;
555 			tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
556 			goto dropafterack;
557 		}
558 		if (ti->ti_len > 0) {
559 			if (ti->ti_len == 1)
560 				tcpstat.tcps_rcvwinprobe++;
561 			else {
562 				tcpstat.tcps_rcvpackafterwin++;
563 				tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
564 			}
565 			m_adj(m, ti->ti_len);
566 			ti->ti_len = 0;
567 			tiflags &= ~(TH_PUSH|TH_FIN);
568 		}
569 	} else {
570 		/*
571 		 * If segment ends after window, drop trailing data
572 		 * (and PUSH and FIN); if nothing left, just ACK.
573 		 */
574 		todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
575 		if (todrop > 0) {
576 			if (todrop >= ti->ti_len) {
577 				/*
578 				 * If a new connection request is received
579 				 * while in TIME_WAIT, drop the old connection
580 				 * and start over if the sequence numbers
581 				 * are above the previous ones.
582 				 */
583 				if (tiflags & TH_SYN &&
584 				    tp->t_state == TCPS_TIME_WAIT &&
585 				    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
586 					iss = tp->rcv_nxt + TCP_ISSINCR;
587 					(void) tcp_close(tp);
588 					goto findpcb;
589 				}
590 				if (todrop == 1)
591 					tcpstat.tcps_rcvwinprobe++;
592 				else {
593 					tcpstat.tcps_rcvpackafterwin++;
594 					tcpstat.tcps_rcvbyteafterwin += ti->ti_len;
595 				}
596 				goto dropafterack;
597 			}
598 			tcpstat.tcps_rcvpackafterwin++;
599 			tcpstat.tcps_rcvbyteafterwin += todrop;
600 			m_adj(m, -todrop);
601 			ti->ti_len -= todrop;
602 			tiflags &= ~(TH_PUSH|TH_FIN);
603 		}
604 	}
605 
606 #ifdef TCP_COMPAT_42
607 do_rst:
608 #endif
609 	/*
610 	 * If the RST bit is set examine the state:
611 	 *    SYN_RECEIVED STATE:
612 	 *	If passive open, return to LISTEN state.
613 	 *	If active open, inform user that connection was refused.
614 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
615 	 *	Inform user that connection was reset, and close tcb.
616 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
617 	 *	Close the tcb.
618 	 */
619 	if (tiflags&TH_RST) switch (tp->t_state) {
620 
621 	case TCPS_SYN_RECEIVED:
622 		tp = tcp_drop(tp, ECONNREFUSED);
623 		goto drop;
624 
625 	case TCPS_ESTABLISHED:
626 	case TCPS_FIN_WAIT_1:
627 	case TCPS_FIN_WAIT_2:
628 	case TCPS_CLOSE_WAIT:
629 		tp = tcp_drop(tp, ECONNRESET);
630 		goto drop;
631 
632 	case TCPS_CLOSING:
633 	case TCPS_LAST_ACK:
634 	case TCPS_TIME_WAIT:
635 		tp = tcp_close(tp);
636 		goto drop;
637 	}
638 
639 	/*
640 	 * If a SYN is in the window, then this is an
641 	 * error and we send an RST and drop the connection.
642 	 */
643 	if (tiflags & TH_SYN) {
644 		tp = tcp_drop(tp, ECONNRESET);
645 		goto dropwithreset;
646 	}
647 
648 	/*
649 	 * If the ACK bit is off we drop the segment and return.
650 	 */
651 	if ((tiflags & TH_ACK) == 0)
652 		goto drop;
653 
654 	/*
655 	 * Ack processing.
656 	 */
657 	switch (tp->t_state) {
658 
659 	/*
660 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
661 	 * ESTABLISHED state and continue processing, otherwise
662 	 * send an RST.
663 	 */
664 	case TCPS_SYN_RECEIVED:
665 		if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
666 		    SEQ_GT(ti->ti_ack, tp->snd_max))
667 			goto dropwithreset;
668 		tcpstat.tcps_connects++;
669 		soisconnected(so);
670 		tp->t_state = TCPS_ESTABLISHED;
671 		tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
672 		(void) tcp_reass(tp, (struct tcpiphdr *)0);
673 		tp->snd_wl1 = ti->ti_seq - 1;
674 		/* fall into ... */
675 
676 	/*
677 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
678 	 * ACKs.  If the ack is in the range
679 	 *	tp->snd_una < ti->ti_ack <= tp->snd_max
680 	 * then advance tp->snd_una to ti->ti_ack and drop
681 	 * data from the retransmission queue.  If this ACK reflects
682 	 * more up to date window information we update our window information.
683 	 */
684 	case TCPS_ESTABLISHED:
685 	case TCPS_FIN_WAIT_1:
686 	case TCPS_FIN_WAIT_2:
687 	case TCPS_CLOSE_WAIT:
688 	case TCPS_CLOSING:
689 	case TCPS_LAST_ACK:
690 	case TCPS_TIME_WAIT:
691 
692 		if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
693 			if (ti->ti_len == 0)
694 				tcpstat.tcps_rcvdupack++;
695 			break;
696 		}
697 		if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
698 			tcpstat.tcps_rcvacktoomuch++;
699 			goto dropafterack;
700 		}
701 		acked = ti->ti_ack - tp->snd_una;
702 		tcpstat.tcps_rcvackpack++;
703 		tcpstat.tcps_rcvackbyte += acked;
704 
705 		/*
706 		 * If transmit timer is running and timed sequence
707 		 * number was acked, update smoothed round trip time.
708 		 * Since we now have an rtt measurement, cancel the
709 		 * timer backoff (cf., Phil Karn's retransmit alg.).
710 		 * Recompute the initial retransmit timer.
711 		 */
712 		if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
713 			tcpstat.tcps_rttupdated++;
714 			if (tp->t_srtt != 0) {
715 				register short delta;
716 
717 				/*
718 				 * srtt is stored as fixed point with 3 bits
719 				 * after the binary point (i.e., scaled by 8).
720 				 * The following magic is equivalent
721 				 * to the smoothing algorithm in rfc793
722 				 * with an alpha of .875
723 				 * (srtt = rtt/8 + srtt*7/8 in fixed point).
724 				 */
725 				delta = tp->t_rtt - (tp->t_srtt >> 3);
726 				if ((tp->t_srtt += delta) <= 0)
727 					tp->t_srtt = 1;
728 				/*
729 				 * We accumulate a smoothed rtt variance
730 				 * (actually, a smoothed mean difference),
731 				 * then set the retransmit timer to smoothed
732 				 * rtt + 2 times the smoothed variance.
733 				 * rttvar is strored as fixed point
734 				 * with 2 bits after the binary point
735 				 * (scaled by 4).  The following is equivalent
736 				 * to rfc793 smoothing with an alpha of .75
737 				 * (rttvar = rttvar*3/4 + |delta| / 4).
738 				 * This replaces rfc793's wired-in beta.
739 				 */
740 				if (delta < 0)
741 					delta = -delta;
742 				delta -= (tp->t_rttvar >> 2);
743 				if ((tp->t_rttvar += delta) <= 0)
744 					tp->t_rttvar = 1;
745 			} else {
746 				/*
747 				 * No rtt measurement yet - use the
748 				 * unsmoothed rtt.  Set the variance
749 				 * to half the rtt (so our first
750 				 * retransmit happens at 2*rtt)
751 				 */
752 				tp->t_srtt = tp->t_rtt << 3;
753 				tp->t_rttvar = tp->t_rtt << 1;
754 			}
755 			tp->t_rtt = 0;
756 			tp->t_rxtshift = 0;
757 			TCPT_RANGESET(tp->t_rxtcur,
758 			    ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
759 			    TCPTV_MIN, TCPTV_REXMTMAX);
760 		}
761 
762 		/*
763 		 * If all outstanding data is acked, stop retransmit
764 		 * timer and remember to restart (more output or persist).
765 		 * If there is more data to be acked, restart retransmit
766 		 * timer, using current (possibly backed-off) value.
767 		 */
768 		if (ti->ti_ack == tp->snd_max) {
769 			tp->t_timer[TCPT_REXMT] = 0;
770 			needoutput = 1;
771 		} else if (tp->t_timer[TCPT_PERSIST] == 0)
772 			tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
773 		/*
774 		 * When new data is acked, open the congestion window
775 		 * by one max-sized segment.
776 		 */
777 		tp->snd_cwnd = MIN(tp->snd_cwnd + tp->t_maxseg, 65535);
778 		if (acked > so->so_snd.sb_cc) {
779 			tp->snd_wnd -= so->so_snd.sb_cc;
780 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
781 			ourfinisacked = 1;
782 		} else {
783 			sbdrop(&so->so_snd, acked);
784 			tp->snd_wnd -= acked;
785 			ourfinisacked = 0;
786 		}
787 		if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
788 			sowwakeup(so);
789 		tp->snd_una = ti->ti_ack;
790 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
791 			tp->snd_nxt = tp->snd_una;
792 
793 		switch (tp->t_state) {
794 
795 		/*
796 		 * In FIN_WAIT_1 STATE in addition to the processing
797 		 * for the ESTABLISHED state if our FIN is now acknowledged
798 		 * then enter FIN_WAIT_2.
799 		 */
800 		case TCPS_FIN_WAIT_1:
801 			if (ourfinisacked) {
802 				/*
803 				 * If we can't receive any more
804 				 * data, then closing user can proceed.
805 				 * Starting the timer is contrary to the
806 				 * specification, but if we don't get a FIN
807 				 * we'll hang forever.
808 				 */
809 				if (so->so_state & SS_CANTRCVMORE) {
810 					soisdisconnected(so);
811 					tp->t_timer[TCPT_2MSL] = TCPTV_MAXIDLE;
812 				}
813 				tp->t_state = TCPS_FIN_WAIT_2;
814 			}
815 			break;
816 
817 	 	/*
818 		 * In CLOSING STATE in addition to the processing for
819 		 * the ESTABLISHED state if the ACK acknowledges our FIN
820 		 * then enter the TIME-WAIT state, otherwise ignore
821 		 * the segment.
822 		 */
823 		case TCPS_CLOSING:
824 			if (ourfinisacked) {
825 				tp->t_state = TCPS_TIME_WAIT;
826 				tcp_canceltimers(tp);
827 				tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
828 				soisdisconnected(so);
829 			}
830 			break;
831 
832 		/*
833 		 * In LAST_ACK, we may still be waiting for data to drain
834 		 * and/or to be acked, as well as for the ack of our FIN.
835 		 * If our FIN is now acknowledged, delete the TCB,
836 		 * enter the closed state and return.
837 		 */
838 		case TCPS_LAST_ACK:
839 			if (ourfinisacked) {
840 				tp = tcp_close(tp);
841 				goto drop;
842 			}
843 			break;
844 
845 		/*
846 		 * In TIME_WAIT state the only thing that should arrive
847 		 * is a retransmission of the remote FIN.  Acknowledge
848 		 * it and restart the finack timer.
849 		 */
850 		case TCPS_TIME_WAIT:
851 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
852 			goto dropafterack;
853 		}
854 	}
855 
856 step6:
857 	/*
858 	 * Update window information.
859 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
860 	 */
861 	if ((tiflags & TH_ACK) &&
862 	    (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
863 	    (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
864 	     tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd))) {
865 		/* keep track of pure window updates */
866 		if (ti->ti_len == 0 &&
867 		    tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd) {
868 			tcpstat.tcps_rcvwinupd++;
869 			tcpstat.tcps_rcvdupack--;
870 		}
871 		tp->snd_wnd = ti->ti_win;
872 		tp->snd_wl1 = ti->ti_seq;
873 		tp->snd_wl2 = ti->ti_ack;
874 		if (tp->snd_wnd > tp->max_sndwnd)
875 			tp->max_sndwnd = tp->snd_wnd;
876 		needoutput = 1;
877 	}
878 
879 	/*
880 	 * Process segments with URG.
881 	 */
882 	if ((tiflags & TH_URG) && ti->ti_urp &&
883 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
884 		/*
885 		 * This is a kludge, but if we receive and accept
886 		 * random urgent pointers, we'll crash in
887 		 * soreceive.  It's hard to imagine someone
888 		 * actually wanting to send this much urgent data.
889 		 */
890 		if (ti->ti_urp + so->so_rcv.sb_cc > SB_MAX) {
891 			ti->ti_urp = 0;			/* XXX */
892 			tiflags &= ~TH_URG;		/* XXX */
893 			goto dodata;			/* XXX */
894 		}
895 		/*
896 		 * If this segment advances the known urgent pointer,
897 		 * then mark the data stream.  This should not happen
898 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
899 		 * a FIN has been received from the remote side.
900 		 * In these states we ignore the URG.
901 		 *
902 		 * According to RFC961 (Assigned Protocols),
903 		 * the urgent pointer points to the last octet
904 		 * of urgent data.  We continue, however,
905 		 * to consider it to indicate the first octet
906 		 * of data past the urgent section
907 		 * as the original spec states.
908 		 */
909 		if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
910 			tp->rcv_up = ti->ti_seq + ti->ti_urp;
911 			so->so_oobmark = so->so_rcv.sb_cc +
912 			    (tp->rcv_up - tp->rcv_nxt) - 1;
913 			if (so->so_oobmark == 0)
914 				so->so_state |= SS_RCVATMARK;
915 			sohasoutofband(so);
916 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
917 		}
918 		/*
919 		 * Remove out of band data so doesn't get presented to user.
920 		 * This can happen independent of advancing the URG pointer,
921 		 * but if two URG's are pending at once, some out-of-band
922 		 * data may creep in... ick.
923 		 */
924 		if (ti->ti_urp <= ti->ti_len &&
925 		    (so->so_options & SO_OOBINLINE) == 0)
926 			tcp_pulloutofband(so, ti);
927 	} else
928 		/*
929 		 * If no out of band data is expected,
930 		 * pull receive urgent pointer along
931 		 * with the receive window.
932 		 */
933 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
934 			tp->rcv_up = tp->rcv_nxt;
935 dodata:							/* XXX */
936 
937 	/*
938 	 * Process the segment text, merging it into the TCP sequencing queue,
939 	 * and arranging for acknowledgment of receipt if necessary.
940 	 * This process logically involves adjusting tp->rcv_wnd as data
941 	 * is presented to the user (this happens in tcp_usrreq.c,
942 	 * case PRU_RCVD).  If a FIN has already been received on this
943 	 * connection then we just ignore the text.
944 	 */
945 	if ((ti->ti_len || (tiflags&TH_FIN)) &&
946 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
947 		TCP_REASS(tp, ti, m, so, tiflags);
948 		if (tcpnodelack == 0)
949 			tp->t_flags |= TF_DELACK;
950 		else
951 			tp->t_flags |= TF_ACKNOW;
952 		/*
953 		 * Note the amount of data that peer has sent into
954 		 * our window, in order to estimate the sender's
955 		 * buffer size.
956 		 */
957 		len = tp->rcv_nxt - tp->rcv_adv;
958 		if (len > tp->max_rcvd)
959 			tp->max_rcvd = len;
960 	} else {
961 		m_freem(m);
962 		tiflags &= ~TH_FIN;
963 	}
964 
965 	/*
966 	 * If FIN is received ACK the FIN and let the user know
967 	 * that the connection is closing.
968 	 */
969 	if (tiflags & TH_FIN) {
970 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
971 			socantrcvmore(so);
972 			tp->t_flags |= TF_ACKNOW;
973 			tp->rcv_nxt++;
974 		}
975 		switch (tp->t_state) {
976 
977 	 	/*
978 		 * In SYN_RECEIVED and ESTABLISHED STATES
979 		 * enter the CLOSE_WAIT state.
980 		 */
981 		case TCPS_SYN_RECEIVED:
982 		case TCPS_ESTABLISHED:
983 			tp->t_state = TCPS_CLOSE_WAIT;
984 			break;
985 
986 	 	/*
987 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
988 		 * enter the CLOSING state.
989 		 */
990 		case TCPS_FIN_WAIT_1:
991 			tp->t_state = TCPS_CLOSING;
992 			break;
993 
994 	 	/*
995 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
996 		 * starting the time-wait timer, turning off the other
997 		 * standard timers.
998 		 */
999 		case TCPS_FIN_WAIT_2:
1000 			tp->t_state = TCPS_TIME_WAIT;
1001 			tcp_canceltimers(tp);
1002 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1003 			soisdisconnected(so);
1004 			break;
1005 
1006 		/*
1007 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
1008 		 */
1009 		case TCPS_TIME_WAIT:
1010 			tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1011 			break;
1012 		}
1013 	}
1014 	if (so->so_options & SO_DEBUG)
1015 		tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
1016 
1017 	/*
1018 	 * Return any desired output.
1019 	 */
1020 	if (needoutput || (tp->t_flags & TF_ACKNOW))
1021 		(void) tcp_output(tp);
1022 	return;
1023 
1024 dropafterack:
1025 	/*
1026 	 * Generate an ACK dropping incoming segment if it occupies
1027 	 * sequence space, where the ACK reflects our state.
1028 	 */
1029 	if (tiflags & TH_RST)
1030 		goto drop;
1031 	m_freem(m);
1032 	tp->t_flags |= TF_ACKNOW;
1033 	(void) tcp_output(tp);
1034 	return;
1035 
1036 dropwithreset:
1037 	if (om) {
1038 		(void) m_free(om);
1039 		om = 0;
1040 	}
1041 	/*
1042 	 * Generate a RST, dropping incoming segment.
1043 	 * Make ACK acceptable to originator of segment.
1044 	 * Don't bother to respond if destination was broadcast.
1045 	 */
1046 	if ((tiflags & TH_RST) || in_broadcast(ti->ti_dst))
1047 		goto drop;
1048 	if (tiflags & TH_ACK)
1049 		tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
1050 	else {
1051 		if (tiflags & TH_SYN)
1052 			ti->ti_len++;
1053 		tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
1054 		    TH_RST|TH_ACK);
1055 	}
1056 	/* destroy temporarily created socket */
1057 	if (dropsocket)
1058 		(void) soabort(so);
1059 	return;
1060 
1061 drop:
1062 	if (om)
1063 		(void) m_free(om);
1064 	/*
1065 	 * Drop space held by incoming segment and return.
1066 	 */
1067 	if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
1068 		tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
1069 	m_freem(m);
1070 	/* destroy temporarily created socket */
1071 	if (dropsocket)
1072 		(void) soabort(so);
1073 	return;
1074 }
1075 
1076 tcp_dooptions(tp, om, ti)
1077 	struct tcpcb *tp;
1078 	struct mbuf *om;
1079 	struct tcpiphdr *ti;
1080 {
1081 	register u_char *cp;
1082 	int opt, optlen, cnt;
1083 
1084 	cp = mtod(om, u_char *);
1085 	cnt = om->m_len;
1086 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1087 		opt = cp[0];
1088 		if (opt == TCPOPT_EOL)
1089 			break;
1090 		if (opt == TCPOPT_NOP)
1091 			optlen = 1;
1092 		else {
1093 			optlen = cp[1];
1094 			if (optlen <= 0)
1095 				break;
1096 		}
1097 		switch (opt) {
1098 
1099 		default:
1100 			break;
1101 
1102 		case TCPOPT_MAXSEG:
1103 			if (optlen != 4)
1104 				continue;
1105 			if (!(ti->ti_flags & TH_SYN))
1106 				continue;
1107 			tp->t_maxseg = *(u_short *)(cp + 2);
1108 			tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
1109 			tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
1110 			break;
1111 		}
1112 	}
1113 	(void) m_free(om);
1114 }
1115 
1116 /*
1117  * Pull out of band byte out of a segment so
1118  * it doesn't appear in the user's data queue.
1119  * It is still reflected in the segment length for
1120  * sequencing purposes.
1121  */
1122 tcp_pulloutofband(so, ti)
1123 	struct socket *so;
1124 	struct tcpiphdr *ti;
1125 {
1126 	register struct mbuf *m;
1127 	int cnt = ti->ti_urp - 1;
1128 
1129 	m = dtom(ti);
1130 	while (cnt >= 0) {
1131 		if (m->m_len > cnt) {
1132 			char *cp = mtod(m, caddr_t) + cnt;
1133 			struct tcpcb *tp = sototcpcb(so);
1134 
1135 			tp->t_iobc = *cp;
1136 			tp->t_oobflags |= TCPOOB_HAVEDATA;
1137 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
1138 			m->m_len--;
1139 			return;
1140 		}
1141 		cnt -= m->m_len;
1142 		m = m->m_next;
1143 		if (m == 0)
1144 			break;
1145 	}
1146 	panic("tcp_pulloutofband");
1147 }
1148 
1149 /*
1150  *  Determine a reasonable value for maxseg size.
1151  *  If the route is known, use one that can be handled
1152  *  on the given interface without forcing IP to fragment.
1153  *  If bigger than an mbuf cluster (MCLBYTES), round down to nearest size
1154  *  to utilize large mbufs.
1155  *  If interface pointer is unavailable, or the destination isn't local,
1156  *  use a conservative size (512 or the default IP max size, but no more
1157  *  than the mtu of the interface through which we route),
1158  *  as we can't discover anything about intervening gateways or networks.
1159  *  We also initialize the congestion/slow start window to be a single
1160  *  segment if the destination isn't local; this information should
1161  *  probably all be saved with the routing entry at the transport level.
1162  *
1163  *  This is ugly, and doesn't belong at this level, but has to happen somehow.
1164  */
1165 tcp_mss(tp)
1166 	register struct tcpcb *tp;
1167 {
1168 	struct route *ro;
1169 	struct ifnet *ifp;
1170 	int mss;
1171 	struct inpcb *inp;
1172 
1173 	inp = tp->t_inpcb;
1174 	ro = &inp->inp_route;
1175 	if ((ro->ro_rt == (struct rtentry *)0) ||
1176 	    (ifp = ro->ro_rt->rt_ifp) == (struct ifnet *)0) {
1177 		/* No route yet, so try to acquire one */
1178 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
1179 			ro->ro_dst.sa_family = AF_INET;
1180 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1181 				inp->inp_faddr;
1182 			rtalloc(ro);
1183 		}
1184 		if ((ro->ro_rt == 0) || (ifp = ro->ro_rt->rt_ifp) == 0)
1185 			return (TCP_MSS);
1186 	}
1187 
1188 	mss = ifp->if_mtu - sizeof(struct tcpiphdr);
1189 #if	(MCLBYTES & (MCLBYTES - 1)) == 0
1190 	if (mss > MCLBYTES)
1191 		mss &= ~(MCLBYTES-1);
1192 #else
1193 	if (mss > MCLBYTES)
1194 		mss = mss / MCLBYTES * MCLBYTES;
1195 #endif
1196 	if (in_localaddr(inp->inp_faddr))
1197 		return (mss);
1198 	mss = MIN(mss, TCP_MSS);
1199 	tp->snd_cwnd = mss;
1200 	return (mss);
1201 }
1202