xref: /dflybsd-src/sys/netinet/tcp_subr.c (revision bc76a771df54af7e361532b257cecc26227736b4)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
34  * $FreeBSD: src/sys/netinet/tcp_subr.c,v 1.73.2.31 2003/01/24 05:11:34 sam Exp $
35  * $DragonFly: src/sys/netinet/tcp_subr.c,v 1.24 2004/04/13 07:10:34 hsu Exp $
36  */
37 
38 #include "opt_compat.h"
39 #include "opt_inet6.h"
40 #include "opt_ipsec.h"
41 #include "opt_tcpdebug.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/callout.h>
46 #include <sys/kernel.h>
47 #include <sys/sysctl.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #ifdef INET6
51 #include <sys/domain.h>
52 #endif
53 #include <sys/proc.h>
54 #include <sys/socket.h>
55 #include <sys/socketvar.h>
56 #include <sys/protosw.h>
57 #include <sys/random.h>
58 #include <sys/in_cksum.h>
59 
60 #include <vm/vm_zone.h>
61 
62 #include <net/route.h>
63 #include <net/if.h>
64 #include <net/netisr.h>
65 
66 #define _IP_VHL
67 #include <netinet/in.h>
68 #include <netinet/in_systm.h>
69 #include <netinet/ip.h>
70 #ifdef INET6
71 #include <netinet/ip6.h>
72 #endif
73 #include <netinet/in_pcb.h>
74 #ifdef INET6
75 #include <netinet6/in6_pcb.h>
76 #endif
77 #include <netinet/in_var.h>
78 #include <netinet/ip_var.h>
79 #ifdef INET6
80 #include <netinet6/ip6_var.h>
81 #endif
82 #include <netinet/tcp.h>
83 #include <netinet/tcp_fsm.h>
84 #include <netinet/tcp_seq.h>
85 #include <netinet/tcp_timer.h>
86 #include <netinet/tcp_var.h>
87 #ifdef INET6
88 #include <netinet6/tcp6_var.h>
89 #endif
90 #include <netinet/tcpip.h>
91 #ifdef TCPDEBUG
92 #include <netinet/tcp_debug.h>
93 #endif
94 #include <netinet6/ip6protosw.h>
95 
96 #ifdef IPSEC
97 #include <netinet6/ipsec.h>
98 #ifdef INET6
99 #include <netinet6/ipsec6.h>
100 #endif
101 #endif /*IPSEC*/
102 
103 #ifdef FAST_IPSEC
104 #include <netipsec/ipsec.h>
105 #ifdef INET6
106 #include <netipsec/ipsec6.h>
107 #endif
108 #define	IPSEC
109 #endif /*FAST_IPSEC*/
110 
111 #include <sys/md5.h>
112 
113 #include <sys/msgport2.h>
114 
115 int 	tcp_mssdflt = TCP_MSS;
116 SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
117     &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");
118 
119 #ifdef INET6
120 int	tcp_v6mssdflt = TCP6_MSS;
121 SYSCTL_INT(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
122 	CTLFLAG_RW, &tcp_v6mssdflt , 0,
123 	"Default TCP Maximum Segment Size for IPv6");
124 #endif
125 
126 #if 0
127 static int 	tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
128 SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
129     &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
130 #endif
131 
132 int	tcp_do_rfc1323 = 1;
133 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW,
134     &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
135 
136 int	tcp_do_rfc1644 = 0;
137 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW,
138     &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
139 
140 static int	tcp_tcbhashsize = 0;
141 SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RD,
142      &tcp_tcbhashsize, 0, "Size of TCP control-block hashtable");
143 
144 static int	do_tcpdrain = 1;
145 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
146      "Enable tcp_drain routine for extra help when low on mbufs");
147 
148 /* XXX JH */
149 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_RD,
150     &tcbinfo[0].ipi_count, 0, "Number of active PCBs");
151 
152 static int	icmp_may_rst = 1;
153 SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_RW, &icmp_may_rst, 0,
154     "Certain ICMP unreachable messages may abort connections in SYN_SENT");
155 
156 static int	tcp_isn_reseed_interval = 0;
157 SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_RW,
158     &tcp_isn_reseed_interval, 0, "Seconds between reseeding of ISN secret");
159 
160 /*
161  * TCP bandwidth limiting sysctls.  Note that the default lower bound of
162  * 1024 exists only for debugging.  A good production default would be
163  * something like 6100.
164  */
165 static int     tcp_inflight_enable = 0;
166 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_enable, CTLFLAG_RW,
167     &tcp_inflight_enable, 0, "Enable automatic TCP inflight data limiting");
168 
169 static int     tcp_inflight_debug = 0;
170 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_debug, CTLFLAG_RW,
171     &tcp_inflight_debug, 0, "Debug TCP inflight calculations");
172 
173 static int     tcp_inflight_min = 6144;
174 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_min, CTLFLAG_RW,
175     &tcp_inflight_min, 0, "Lower-bound for TCP inflight window");
176 
177 static int     tcp_inflight_max = TCP_MAXWIN << TCP_MAX_WINSHIFT;
178 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_max, CTLFLAG_RW,
179     &tcp_inflight_max, 0, "Upper-bound for TCP inflight window");
180 
181 static int     tcp_inflight_stab = 20;
182 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_stab, CTLFLAG_RW,
183     &tcp_inflight_stab, 0, "Slop in maximal packets / 10 (20 = 2 packets)");
184 
185 static void	tcp_cleartaocache (void);
186 static void	tcp_notify (struct inpcb *, int);
187 
188 struct tcp_stats tcpstats_ary[MAXCPU];
189 #ifdef SMP
190 static int
191 sysctl_tcpstats(SYSCTL_HANDLER_ARGS)
192 {
193 	int cpu, error;
194 
195 	for (cpu = error = 0; cpu < ncpus; ++cpu) {
196 		if ((error = SYSCTL_OUT(req, (void *)&tcpstats_ary[cpu],
197 			sizeof(struct tcp_stats))))
198 			break;
199 		if ((error = SYSCTL_IN(req, (void *)&tcpstats_ary[cpu],
200 			sizeof(struct tcp_stats))))
201 			break;
202 	}
203 
204 	return (error);
205 }
206 SYSCTL_PROC(_net_inet_tcp, TCPCTL_STATS, stats, CTLTYPE_OPAQUE|CTLFLAG_RW,
207     0, 0, sysctl_tcpstats, "S,tcp_stats",
208 	"TCP statistics (struct tcp_stats, netinet/tcp_stats.h)");
209 #else /* !SMP */
210 SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW,
211     &tcpstat , tcp_stats,
212 	"TCP statistics (struct tcp_stats, netinet/tcp_stats.h)");
213 #endif
214 
215 /*
216  * Target size of TCP PCB hash tables. Must be a power of two.
217  *
218  * Note that this can be overridden by the kernel environment
219  * variable net.inet.tcp.tcbhashsize
220  */
221 #ifndef TCBHASHSIZE
222 #define TCBHASHSIZE	512
223 #endif
224 
225 /*
226  * This is the actual shape of what we allocate using the zone
227  * allocator.  Doing it this way allows us to protect both structures
228  * using the same generation count, and also eliminates the overhead
229  * of allocating tcpcbs separately.  By hiding the structure here,
230  * we avoid changing most of the rest of the code (although it needs
231  * to be changed, eventually, for greater efficiency).
232  */
233 #define	ALIGNMENT	32
234 #define	ALIGNM1		(ALIGNMENT - 1)
235 struct	inp_tp {
236 	union {
237 		struct	inpcb inp;
238 		char	align[(sizeof(struct inpcb) + ALIGNM1) & ~ALIGNM1];
239 	} inp_tp_u;
240 	struct	tcpcb tcb;
241 	struct	callout inp_tp_rexmt, inp_tp_persist, inp_tp_keep, inp_tp_2msl;
242 	struct	callout inp_tp_delack;
243 };
244 #undef ALIGNMENT
245 #undef ALIGNM1
246 
247 /*
248  * Tcp initialization
249  */
250 void
251 tcp_init()
252 {
253 	struct inpcbporthead *porthashbase;
254 	u_long porthashmask;
255 	struct inpcbhead *wildcardhashbase;
256 	u_long wildcardhashmask;
257 	struct vm_zone *ipi_zone;
258 	int hashsize = TCBHASHSIZE;
259 	int cpu;
260 
261 	tcp_ccgen = 1;
262 	tcp_cleartaocache();
263 
264 	tcp_delacktime = TCPTV_DELACK;
265 	tcp_keepinit = TCPTV_KEEP_INIT;
266 	tcp_keepidle = TCPTV_KEEP_IDLE;
267 	tcp_keepintvl = TCPTV_KEEPINTVL;
268 	tcp_maxpersistidle = TCPTV_KEEP_IDLE;
269 	tcp_msl = TCPTV_MSL;
270 	tcp_rexmit_min = TCPTV_MIN;
271 	tcp_rexmit_slop = TCPTV_CPU_VAR;
272 
273 	TUNABLE_INT_FETCH("net.inet.tcp.tcbhashsize", &hashsize);
274 	if (!powerof2(hashsize)) {
275 		printf("WARNING: TCB hash size not a power of 2\n");
276 		hashsize = 512; /* safe default */
277 	}
278 	tcp_tcbhashsize = hashsize;
279 	porthashbase = hashinit(hashsize, M_PCB, &porthashmask);
280 	wildcardhashbase = hashinit(hashsize, M_PCB, &wildcardhashmask);
281 	ipi_zone = zinit("tcpcb", sizeof(struct inp_tp), maxsockets,
282 			 ZONE_INTERRUPT, 0);
283 
284 	for (cpu = 0; cpu < ncpus2; cpu++) {
285 		LIST_INIT(&tcbinfo[cpu].listhead);
286 		tcbinfo[cpu].hashbase = hashinit(hashsize, M_PCB,
287 		    &tcbinfo[cpu].hashmask);
288 		tcbinfo[cpu].porthashbase = porthashbase;
289 		tcbinfo[cpu].porthashmask = porthashmask;
290 		tcbinfo[cpu].wildcardhashbase = wildcardhashbase;
291 		tcbinfo[cpu].wildcardhashmask = wildcardhashmask;
292 		tcbinfo[cpu].ipi_zone = ipi_zone;
293 	}
294 
295 	tcp_reass_maxseg = nmbclusters / 16;
296 	TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments",
297 	    &tcp_reass_maxseg);
298 
299 #ifdef INET6
300 #define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
301 #else /* INET6 */
302 #define TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
303 #endif /* INET6 */
304 	if (max_protohdr < TCP_MINPROTOHDR)
305 		max_protohdr = TCP_MINPROTOHDR;
306 	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
307 		panic("tcp_init");
308 #undef TCP_MINPROTOHDR
309 
310 	/*
311 	 * Initialize TCP statistics.
312 	 *
313 	 * It is layed out as an array which is has one element for UP,
314 	 * and SMP_MAXCPU elements for SMP.  This allows us to retain
315 	 * the access mechanism from userland for both UP and SMP.
316 	 */
317 #ifdef SMP
318 	for (cpu = 0; cpu < ncpus; ++cpu) {
319 		bzero(&tcpstats_ary[cpu], sizeof(struct tcp_stats));
320 	}
321 #else
322 	bzero(&tcpstat, sizeof(struct tcp_stats));
323 #endif
324 
325 	syncache_init();
326 	tcp_thread_init();
327 }
328 
329 /*
330  * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
331  * tcp_template used to store this data in mbufs, but we now recopy it out
332  * of the tcpcb each time to conserve mbufs.
333  */
334 void
335 tcp_fillheaders(tp, ip_ptr, tcp_ptr)
336 	struct tcpcb *tp;
337 	void *ip_ptr;
338 	void *tcp_ptr;
339 {
340 	struct inpcb *inp = tp->t_inpcb;
341 	struct tcphdr *tcp_hdr = (struct tcphdr *)tcp_ptr;
342 
343 #ifdef INET6
344 	if ((inp->inp_vflag & INP_IPV6) != 0) {
345 		struct ip6_hdr *ip6;
346 
347 		ip6 = (struct ip6_hdr *)ip_ptr;
348 		ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
349 			(inp->in6p_flowinfo & IPV6_FLOWINFO_MASK);
350 		ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
351 			(IPV6_VERSION & IPV6_VERSION_MASK);
352 		ip6->ip6_nxt = IPPROTO_TCP;
353 		ip6->ip6_plen = sizeof(struct tcphdr);
354 		ip6->ip6_src = inp->in6p_laddr;
355 		ip6->ip6_dst = inp->in6p_faddr;
356 		tcp_hdr->th_sum = 0;
357 	} else
358 #endif
359 	{
360 	struct ip *ip = (struct ip *) ip_ptr;
361 
362 	ip->ip_vhl = IP_VHL_BORING;
363 	ip->ip_tos = 0;
364 	ip->ip_len = 0;
365 	ip->ip_id = 0;
366 	ip->ip_off = 0;
367 	ip->ip_ttl = 0;
368 	ip->ip_sum = 0;
369 	ip->ip_p = IPPROTO_TCP;
370 	ip->ip_src = inp->inp_laddr;
371 	ip->ip_dst = inp->inp_faddr;
372 	tcp_hdr->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
373 		htons(sizeof(struct tcphdr) + IPPROTO_TCP));
374 	}
375 
376 	tcp_hdr->th_sport = inp->inp_lport;
377 	tcp_hdr->th_dport = inp->inp_fport;
378 	tcp_hdr->th_seq = 0;
379 	tcp_hdr->th_ack = 0;
380 	tcp_hdr->th_x2 = 0;
381 	tcp_hdr->th_off = 5;
382 	tcp_hdr->th_flags = 0;
383 	tcp_hdr->th_win = 0;
384 	tcp_hdr->th_urp = 0;
385 }
386 
387 /*
388  * Create template to be used to send tcp packets on a connection.
389  * Allocates an mbuf and fills in a skeletal tcp/ip header.  The only
390  * use for this function is in keepalives, which use tcp_respond.
391  */
392 struct tcptemp *
393 tcp_maketemplate(tp)
394 	struct tcpcb *tp;
395 {
396 	struct mbuf *m;
397 	struct tcptemp *n;
398 
399 	m = m_get(M_DONTWAIT, MT_HEADER);
400 	if (m == NULL)
401 		return (0);
402 	m->m_len = sizeof(struct tcptemp);
403 	n = mtod(m, struct tcptemp *);
404 
405 	tcp_fillheaders(tp, (void *)&n->tt_ipgen, (void *)&n->tt_t);
406 	return (n);
407 }
408 
409 /*
410  * Send a single message to the TCP at address specified by
411  * the given TCP/IP header.  If m == 0, then we make a copy
412  * of the tcpiphdr at ti and send directly to the addressed host.
413  * This is used to force keep alive messages out using the TCP
414  * template for a connection.  If flags are given then we send
415  * a message back to the TCP which originated the * segment ti,
416  * and discard the mbuf containing it and any other attached mbufs.
417  *
418  * In any case the ack and sequence number of the transmitted
419  * segment are as specified by the parameters.
420  *
421  * NOTE: If m != NULL, then ti must point to *inside* the mbuf.
422  */
423 void
424 tcp_respond(tp, ipgen, th, m, ack, seq, flags)
425 	struct tcpcb *tp;
426 	void *ipgen;
427 	struct tcphdr *th;
428 	struct mbuf *m;
429 	tcp_seq ack, seq;
430 	int flags;
431 {
432 	int tlen;
433 	int win = 0;
434 	struct route *ro = 0;
435 	struct route sro;
436 	struct ip *ip;
437 	struct tcphdr *nth;
438 #ifdef INET6
439 	struct route_in6 *ro6 = 0;
440 	struct route_in6 sro6;
441 	struct ip6_hdr *ip6;
442 	int isipv6;
443 #endif /* INET6 */
444 	int ipflags = 0;
445 
446 #ifdef INET6
447 	isipv6 = IP_VHL_V(((struct ip *)ipgen)->ip_vhl) == 6;
448 	ip6 = ipgen;
449 #endif /* INET6 */
450 	ip = ipgen;
451 
452 	if (tp) {
453 		if (!(flags & TH_RST)) {
454 			win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
455 			if (win > (long)TCP_MAXWIN << tp->rcv_scale)
456 				win = (long)TCP_MAXWIN << tp->rcv_scale;
457 		}
458 #ifdef INET6
459 		if (isipv6)
460 			ro6 = &tp->t_inpcb->in6p_route;
461 		else
462 #endif /* INET6 */
463 		ro = &tp->t_inpcb->inp_route;
464 	} else {
465 #ifdef INET6
466 		if (isipv6) {
467 			ro6 = &sro6;
468 			bzero(ro6, sizeof *ro6);
469 		} else
470 #endif /* INET6 */
471 	      {
472 		ro = &sro;
473 		bzero(ro, sizeof *ro);
474 	      }
475 	}
476 	if (m == 0) {
477 		m = m_gethdr(M_DONTWAIT, MT_HEADER);
478 		if (m == NULL)
479 			return;
480 		tlen = 0;
481 		m->m_data += max_linkhdr;
482 #ifdef INET6
483 		if (isipv6) {
484 			bcopy((caddr_t)ip6, mtod(m, caddr_t),
485 			      sizeof(struct ip6_hdr));
486 			ip6 = mtod(m, struct ip6_hdr *);
487 			nth = (struct tcphdr *)(ip6 + 1);
488 		} else
489 #endif /* INET6 */
490 	      {
491 		bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
492 		ip = mtod(m, struct ip *);
493 		nth = (struct tcphdr *)(ip + 1);
494 	      }
495 		bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
496 		flags = TH_ACK;
497 	} else {
498 		m_freem(m->m_next);
499 		m->m_next = 0;
500 		m->m_data = (caddr_t)ipgen;
501 		/* m_len is set later */
502 		tlen = 0;
503 #define xchg(a,b,type) { type t; t=a; a=b; b=t; }
504 #ifdef INET6
505 		if (isipv6) {
506 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
507 			nth = (struct tcphdr *)(ip6 + 1);
508 		} else
509 #endif /* INET6 */
510 	      {
511 		xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, n_long);
512 		nth = (struct tcphdr *)(ip + 1);
513 	      }
514 		if (th != nth) {
515 			/*
516 			 * this is usually a case when an extension header
517 			 * exists between the IPv6 header and the
518 			 * TCP header.
519 			 */
520 			nth->th_sport = th->th_sport;
521 			nth->th_dport = th->th_dport;
522 		}
523 		xchg(nth->th_dport, nth->th_sport, n_short);
524 #undef xchg
525 	}
526 #ifdef INET6
527 	if (isipv6) {
528 		ip6->ip6_flow = 0;
529 		ip6->ip6_vfc = IPV6_VERSION;
530 		ip6->ip6_nxt = IPPROTO_TCP;
531 		ip6->ip6_plen = htons((u_short)(sizeof (struct tcphdr) +
532 						tlen));
533 		tlen += sizeof (struct ip6_hdr) + sizeof (struct tcphdr);
534 	} else
535 #endif
536       {
537 	tlen += sizeof (struct tcpiphdr);
538 	ip->ip_len = tlen;
539 	ip->ip_ttl = ip_defttl;
540       }
541 	m->m_len = tlen;
542 	m->m_pkthdr.len = tlen;
543 	m->m_pkthdr.rcvif = (struct ifnet *) 0;
544 	nth->th_seq = htonl(seq);
545 	nth->th_ack = htonl(ack);
546 	nth->th_x2 = 0;
547 	nth->th_off = sizeof (struct tcphdr) >> 2;
548 	nth->th_flags = flags;
549 	if (tp)
550 		nth->th_win = htons((u_short) (win >> tp->rcv_scale));
551 	else
552 		nth->th_win = htons((u_short)win);
553 	nth->th_urp = 0;
554 #ifdef INET6
555 	if (isipv6) {
556 		nth->th_sum = 0;
557 		nth->th_sum = in6_cksum(m, IPPROTO_TCP,
558 					sizeof(struct ip6_hdr),
559 					tlen - sizeof(struct ip6_hdr));
560 		ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL,
561 					       ro6 && ro6->ro_rt ?
562 					       ro6->ro_rt->rt_ifp :
563 					       NULL);
564 	} else
565 #endif /* INET6 */
566       {
567         nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
568 	    htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
569         m->m_pkthdr.csum_flags = CSUM_TCP;
570         m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
571       }
572 #ifdef TCPDEBUG
573 	if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
574 		tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
575 #endif
576 #ifdef INET6
577 	if (isipv6) {
578 		(void)ip6_output(m, NULL, ro6, ipflags, NULL, NULL,
579 			tp ? tp->t_inpcb : NULL);
580 		if (ro6 == &sro6 && ro6->ro_rt) {
581 			RTFREE(ro6->ro_rt);
582 			ro6->ro_rt = NULL;
583 		}
584 	} else
585 #endif /* INET6 */
586       {
587 	(void) ip_output(m, NULL, ro, ipflags, NULL, tp ? tp->t_inpcb : NULL);
588 	if (ro == &sro && ro->ro_rt) {
589 		RTFREE(ro->ro_rt);
590 		ro->ro_rt = NULL;
591 	}
592       }
593 }
594 
595 /*
596  * Create a new TCP control block, making an
597  * empty reassembly queue and hooking it to the argument
598  * protocol control block.  The `inp' parameter must have
599  * come from the zone allocator set up in tcp_init().
600  */
601 struct tcpcb *
602 tcp_newtcpcb(inp)
603 	struct inpcb *inp;
604 {
605 	struct inp_tp *it;
606 	struct tcpcb *tp;
607 #ifdef INET6
608 	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
609 #endif /* INET6 */
610 
611 	it = (struct inp_tp *)inp;
612 	tp = &it->tcb;
613 	bzero((char *) tp, sizeof(struct tcpcb));
614 	LIST_INIT(&tp->t_segq);
615 	tp->t_maxseg = tp->t_maxopd =
616 #ifdef INET6
617 		isipv6 ? tcp_v6mssdflt :
618 #endif /* INET6 */
619 		tcp_mssdflt;
620 
621 	/* Set up our timeouts. */
622 	callout_init(tp->tt_rexmt = &it->inp_tp_rexmt);
623 	callout_init(tp->tt_persist = &it->inp_tp_persist);
624 	callout_init(tp->tt_keep = &it->inp_tp_keep);
625 	callout_init(tp->tt_2msl = &it->inp_tp_2msl);
626 	callout_init(tp->tt_delack = &it->inp_tp_delack);
627 
628 	if (tcp_do_rfc1323)
629 		tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
630 	if (tcp_do_rfc1644)
631 		tp->t_flags |= TF_REQ_CC;
632 	tp->t_inpcb = inp;	/* XXX */
633 	/*
634 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
635 	 * rtt estimate.  Set rttvar so that srtt + 4 * rttvar gives
636 	 * reasonable initial retransmit time.
637 	 */
638 	tp->t_srtt = TCPTV_SRTTBASE;
639 	tp->t_rttvar = ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
640 	tp->t_rttmin = tcp_rexmit_min;
641 	tp->t_rxtcur = TCPTV_RTOBASE;
642 	tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
643 	tp->snd_bwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
644 	tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
645 	tp->t_rcvtime = ticks;
646 	tp->t_bw_rtttime = ticks;
647         /*
648 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
649 	 * because the socket may be bound to an IPv6 wildcard address,
650 	 * which may match an IPv4-mapped IPv6 address.
651 	 */
652 	inp->inp_ip_ttl = ip_defttl;
653 	inp->inp_ppcb = (caddr_t)tp;
654 	return (tp);		/* XXX */
655 }
656 
657 /*
658  * Drop a TCP connection, reporting
659  * the specified error.  If connection is synchronized,
660  * then send a RST to peer.
661  */
662 struct tcpcb *
663 tcp_drop(tp, errno)
664 	struct tcpcb *tp;
665 	int errno;
666 {
667 	struct socket *so = tp->t_inpcb->inp_socket;
668 
669 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
670 		tp->t_state = TCPS_CLOSED;
671 		(void) tcp_output(tp);
672 		tcpstat.tcps_drops++;
673 	} else
674 		tcpstat.tcps_conndrops++;
675 	if (errno == ETIMEDOUT && tp->t_softerror)
676 		errno = tp->t_softerror;
677 	so->so_error = errno;
678 	return (tcp_close(tp));
679 }
680 
681 /*
682  * Close a TCP control block:
683  *	discard all space held by the tcp
684  *	discard internet protocol block
685  *	wake up any sleepers
686  */
687 struct tcpcb *
688 tcp_close(tp)
689 	struct tcpcb *tp;
690 {
691 	struct tseg_qent *q;
692 	struct inpcb *inp = tp->t_inpcb;
693 	struct socket *so = inp->inp_socket;
694 #ifdef INET6
695 	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
696 #endif /* INET6 */
697 	struct rtentry *rt;
698 	int dosavessthresh;
699 
700 	/*
701 	 * Make sure that all of our timers are stopped before we
702 	 * delete the PCB.
703 	 */
704 	callout_stop(tp->tt_rexmt);
705 	callout_stop(tp->tt_persist);
706 	callout_stop(tp->tt_keep);
707 	callout_stop(tp->tt_2msl);
708 	callout_stop(tp->tt_delack);
709 
710 	/*
711 	 * If we got enough samples through the srtt filter,
712 	 * save the rtt and rttvar in the routing entry.
713 	 * 'Enough' is arbitrarily defined as the 16 samples.
714 	 * 16 samples is enough for the srtt filter to converge
715 	 * to within 5% of the correct value; fewer samples and
716 	 * we could save a very bogus rtt.
717 	 *
718 	 * Don't update the default route's characteristics and don't
719 	 * update anything that the user "locked".
720 	 */
721 	if (tp->t_rttupdated >= 16) {
722 		u_long i = 0;
723 #ifdef INET6
724 		if (isipv6) {
725 			struct sockaddr_in6 *sin6;
726 
727 			if ((rt = inp->in6p_route.ro_rt) == NULL)
728 				goto no_valid_rt;
729 			sin6 = (struct sockaddr_in6 *)rt_key(rt);
730 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
731 				goto no_valid_rt;
732 		}
733 		else
734 #endif /* INET6 */
735 		if ((rt = inp->inp_route.ro_rt) == NULL ||
736 		    ((struct sockaddr_in *)rt_key(rt))->sin_addr.s_addr
737 		    == INADDR_ANY)
738 			goto no_valid_rt;
739 
740 		if ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0) {
741 			i = tp->t_srtt *
742 			    (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
743 			if (rt->rt_rmx.rmx_rtt && i)
744 				/*
745 				 * filter this update to half the old & half
746 				 * the new values, converting scale.
747 				 * See route.h and tcp_var.h for a
748 				 * description of the scaling constants.
749 				 */
750 				rt->rt_rmx.rmx_rtt =
751 				    (rt->rt_rmx.rmx_rtt + i) / 2;
752 			else
753 				rt->rt_rmx.rmx_rtt = i;
754 			tcpstat.tcps_cachedrtt++;
755 		}
756 		if ((rt->rt_rmx.rmx_locks & RTV_RTTVAR) == 0) {
757 			i = tp->t_rttvar *
758 			    (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
759 			if (rt->rt_rmx.rmx_rttvar && i)
760 				rt->rt_rmx.rmx_rttvar =
761 				    (rt->rt_rmx.rmx_rttvar + i) / 2;
762 			else
763 				rt->rt_rmx.rmx_rttvar = i;
764 			tcpstat.tcps_cachedrttvar++;
765 		}
766 		/*
767 		 * The old comment here said:
768 		 * update the pipelimit (ssthresh) if it has been updated
769 		 * already or if a pipesize was specified & the threshhold
770 		 * got below half the pipesize.  I.e., wait for bad news
771 		 * before we start updating, then update on both good
772 		 * and bad news.
773 		 *
774 		 * But we want to save the ssthresh even if no pipesize is
775 		 * specified explicitly in the route, because such
776 		 * connections still have an implicit pipesize specified
777 		 * by the global tcp_sendspace.  In the absence of a reliable
778 		 * way to calculate the pipesize, it will have to do.
779 		 */
780 		i = tp->snd_ssthresh;
781 		if (rt->rt_rmx.rmx_sendpipe != 0)
782 			dosavessthresh = (i < rt->rt_rmx.rmx_sendpipe / 2);
783 		else
784 			dosavessthresh = (i < so->so_snd.sb_hiwat / 2);
785 		if (((rt->rt_rmx.rmx_locks & RTV_SSTHRESH) == 0 &&
786 		     i != 0 && rt->rt_rmx.rmx_ssthresh != 0)
787 		    || dosavessthresh) {
788 			/*
789 			 * convert the limit from user data bytes to
790 			 * packets then to packet data bytes.
791 			 */
792 			i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
793 			if (i < 2)
794 				i = 2;
795 			i *= (u_long)(tp->t_maxseg +
796 #ifdef INET6
797 				      (isipv6 ? sizeof (struct ip6_hdr) +
798 					       sizeof (struct tcphdr) :
799 #endif
800 				       sizeof (struct tcpiphdr)
801 #ifdef INET6
802 				       )
803 #endif
804 				      );
805 			if (rt->rt_rmx.rmx_ssthresh)
806 				rt->rt_rmx.rmx_ssthresh =
807 				    (rt->rt_rmx.rmx_ssthresh + i) / 2;
808 			else
809 				rt->rt_rmx.rmx_ssthresh = i;
810 			tcpstat.tcps_cachedssthresh++;
811 		}
812 	}
813     no_valid_rt:
814 	/* free the reassembly queue, if any */
815 	while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
816 		LIST_REMOVE(q, tqe_q);
817 		m_freem(q->tqe_m);
818 		FREE(q, M_TSEGQ);
819 		tcp_reass_qsize--;
820 	}
821 	inp->inp_ppcb = NULL;
822 	soisdisconnected(so);
823 #ifdef INET6
824 	if (INP_CHECK_SOCKAF(so, AF_INET6))
825 		in6_pcbdetach(inp);
826 	else
827 #endif /* INET6 */
828 	in_pcbdetach(inp);
829 	tcpstat.tcps_closed++;
830 	return ((struct tcpcb *)0);
831 }
832 
833 static __inline void
834 tcp_drain_oncpu(struct inpcbhead *head)
835 {
836 	struct inpcb *inpb;
837 	struct tcpcb *tcpb;
838 	struct tseg_qent *te;
839 
840 	LIST_FOREACH(inpb, head, inp_list) {
841 		if ((tcpb = intotcpcb(inpb))) {
842 			while ((te = LIST_FIRST(&tcpb->t_segq)) != NULL) {
843 				LIST_REMOVE(te, tqe_q);
844 				m_freem(te->tqe_m);
845 				FREE(te, M_TSEGQ);
846 				tcp_reass_qsize--;
847 			}
848 		}
849 	}
850 }
851 
852 #ifdef SMP
853 struct netmsg_tcp_drain {
854 	struct lwkt_msg		nm_lmsg;
855 	netisr_fn_t		nm_handler;
856 	struct inpcbhead	*nm_head;
857 };
858 
859 static void
860 tcp_drain_handler(struct netmsg *msg0)
861 {
862 	struct netmsg_tcp_drain *nm = (struct netmsg_tcp_drain *)msg0;
863 
864 	tcp_drain_oncpu(nm->nm_head);
865 	lwkt_replymsg(&msg0->nm_lmsg, 0);
866 }
867 #endif
868 
869 void
870 tcp_drain()
871 {
872 #ifdef SMP
873 	int cpu;
874 #endif
875 
876 	if (!do_tcpdrain)
877 		return;
878 
879 	/*
880 	 * Walk the tcpbs, if existing, and flush the reassembly queue,
881 	 * if there is one...
882 	 * XXX: The "Net/3" implementation doesn't imply that the TCP
883 	 *      reassembly queue should be flushed, but in a situation
884 	 * 	where we're really low on mbufs, this is potentially
885 	 *  	usefull.
886 	 */
887 #ifdef SMP
888 	for (cpu = 0; cpu < ncpus2; cpu++) {
889 		struct netmsg_tcp_drain *msg;
890 
891 		if (cpu == mycpu->gd_cpuid) {
892 			tcp_drain_oncpu(&tcbinfo[cpu].listhead);
893 		} else {
894 			msg = malloc(sizeof(struct netmsg_tcp_drain),
895 			    M_LWKTMSG, M_NOWAIT);
896 			if (!msg)
897 				continue;
898 			lwkt_initmsg_rp(&msg->nm_lmsg, &netisr_afree_rport,
899 			    CMD_NETMSG_ONCPU);
900 			msg->nm_handler = tcp_drain_handler;
901 			msg->nm_head = &tcbinfo[cpu].listhead;
902 			lwkt_sendmsg(tcp_cport(cpu), &msg->nm_lmsg);
903 		}
904 	}
905 #else
906 	tcp_drain_oncpu(&tcbinfo[0].listhead);
907 #endif
908 }
909 
910 /*
911  * Notify a tcp user of an asynchronous error;
912  * store error as soft error, but wake up user
913  * (for now, won't do anything until can select for soft error).
914  *
915  * Do not wake up user since there currently is no mechanism for
916  * reporting soft errors (yet - a kqueue filter may be added).
917  */
918 static void
919 tcp_notify(inp, error)
920 	struct inpcb *inp;
921 	int error;
922 {
923 	struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
924 
925 	/*
926 	 * Ignore some errors if we are hooked up.
927 	 * If connection hasn't completed, has retransmitted several times,
928 	 * and receives a second error, give up now.  This is better
929 	 * than waiting a long time to establish a connection that
930 	 * can never complete.
931 	 */
932 	if (tp->t_state == TCPS_ESTABLISHED &&
933 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
934 	      error == EHOSTDOWN)) {
935 		return;
936 	} else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
937 	    tp->t_softerror)
938 		tcp_drop(tp, error);
939 	else
940 		tp->t_softerror = error;
941 #if 0
942 	wakeup((caddr_t) &so->so_timeo);
943 	sorwakeup(so);
944 	sowwakeup(so);
945 #endif
946 }
947 
948 static int
949 tcp_pcblist(SYSCTL_HANDLER_ARGS)
950 {
951 	int error, i, n, s;
952 	struct inpcb *inp, **inp_list;
953 	inp_gen_t gencnt;
954 	struct xinpgen xig;
955 
956 	/*
957 	 * The process of preparing the TCB list is too time-consuming and
958 	 * resource-intensive to repeat twice on every request.
959 	 */
960 	if (req->oldptr == 0) {
961 		n = tcbinfo[mycpu->gd_cpuid].ipi_count;
962 		req->oldidx = 2 * (sizeof xig)
963 			+ (n + n/8) * sizeof(struct xtcpcb);
964 		return 0;
965 	}
966 
967 	if (req->newptr != 0)
968 		return EPERM;
969 
970 	/*
971 	 * OK, now we're committed to doing something.
972 	 */
973 	s = splnet();
974 	gencnt = tcbinfo[mycpu->gd_cpuid].ipi_gencnt;
975 	n = tcbinfo[mycpu->gd_cpuid].ipi_count;
976 	splx(s);
977 
978 	xig.xig_len = sizeof xig;
979 	xig.xig_count = n;
980 	xig.xig_gen = gencnt;
981 	xig.xig_sogen = so_gencnt;
982 	error = SYSCTL_OUT(req, &xig, sizeof xig);
983 	if (error)
984 		return error;
985 
986 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
987 	if (inp_list == 0)
988 		return ENOMEM;
989 
990 	s = splnet();
991 	for (inp = LIST_FIRST(&tcbinfo[mycpu->gd_cpuid].listhead), i = 0;
992 	    inp && i < n; inp = LIST_NEXT(inp, inp_list)) {
993 		if (inp->inp_gencnt <= gencnt && !prison_xinpcb(req->td, inp))
994 			inp_list[i++] = inp;
995 	}
996 	splx(s);
997 	n = i;
998 
999 	error = 0;
1000 	for (i = 0; i < n; i++) {
1001 		inp = inp_list[i];
1002 		if (inp->inp_gencnt <= gencnt) {
1003 			struct xtcpcb xt;
1004 			caddr_t inp_ppcb;
1005 			xt.xt_len = sizeof xt;
1006 			/* XXX should avoid extra copy */
1007 			bcopy(inp, &xt.xt_inp, sizeof *inp);
1008 			inp_ppcb = inp->inp_ppcb;
1009 			if (inp_ppcb != NULL)
1010 				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
1011 			else
1012 				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
1013 			if (inp->inp_socket)
1014 				sotoxsocket(inp->inp_socket, &xt.xt_socket);
1015 			error = SYSCTL_OUT(req, &xt, sizeof xt);
1016 		}
1017 	}
1018 	if (!error) {
1019 		/*
1020 		 * Give the user an updated idea of our state.
1021 		 * If the generation differs from what we told
1022 		 * her before, she knows that something happened
1023 		 * while we were processing this request, and it
1024 		 * might be necessary to retry.
1025 		 */
1026 		s = splnet();
1027 		xig.xig_gen = tcbinfo[mycpu->gd_cpuid].ipi_gencnt;
1028 		xig.xig_sogen = so_gencnt;
1029 		xig.xig_count = tcbinfo[mycpu->gd_cpuid].ipi_count;
1030 		splx(s);
1031 		error = SYSCTL_OUT(req, &xig, sizeof xig);
1032 	}
1033 	free(inp_list, M_TEMP);
1034 	return error;
1035 }
1036 
1037 SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
1038 	    tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
1039 
1040 static int
1041 tcp_getcred(SYSCTL_HANDLER_ARGS)
1042 {
1043 	struct sockaddr_in addrs[2];
1044 	struct inpcb *inp;
1045 	int cpu;
1046 	int error, s;
1047 
1048 	error = suser(req->td);
1049 	if (error)
1050 		return (error);
1051 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
1052 	if (error)
1053 		return (error);
1054 	s = splnet();
1055 
1056 	cpu = tcp_addrcpu(addrs[1].sin_addr.s_addr, addrs[1].sin_port,
1057 	    addrs[0].sin_addr.s_addr, addrs[0].sin_port);
1058 	inp = in_pcblookup_hash(&tcbinfo[cpu], addrs[1].sin_addr,
1059 	    addrs[1].sin_port, addrs[0].sin_addr, addrs[0].sin_port, 0, NULL);
1060 	if (inp == NULL || inp->inp_socket == NULL) {
1061 		error = ENOENT;
1062 		goto out;
1063 	}
1064 	error = SYSCTL_OUT(req, inp->inp_socket->so_cred, sizeof(struct ucred));
1065 out:
1066 	splx(s);
1067 	return (error);
1068 }
1069 
1070 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, getcred, CTLTYPE_OPAQUE|CTLFLAG_RW,
1071     0, 0, tcp_getcred, "S,ucred", "Get the ucred of a TCP connection");
1072 
1073 #ifdef INET6
1074 static int
1075 tcp6_getcred(SYSCTL_HANDLER_ARGS)
1076 {
1077 	struct sockaddr_in6 addrs[2];
1078 	struct inpcb *inp;
1079 	int error, s, mapped = 0;
1080 
1081 	error = suser(req->td);
1082 	if (error)
1083 		return (error);
1084 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
1085 	if (error)
1086 		return (error);
1087 	if (IN6_IS_ADDR_V4MAPPED(&addrs[0].sin6_addr)) {
1088 		if (IN6_IS_ADDR_V4MAPPED(&addrs[1].sin6_addr))
1089 			mapped = 1;
1090 		else
1091 			return (EINVAL);
1092 	}
1093 	s = splnet();
1094 	if (mapped == 1) {
1095 		inp = in_pcblookup_hash(&tcbinfo[0],
1096 		    *(struct in_addr *)&addrs[1].sin6_addr.s6_addr[12],
1097 		    addrs[1].sin6_port,
1098 		    *(struct in_addr *)&addrs[0].sin6_addr.s6_addr[12],
1099 		    addrs[0].sin6_port,
1100 		    0, NULL);
1101 	} else {
1102 		inp = in6_pcblookup_hash(&tcbinfo[0],
1103 		    &addrs[1].sin6_addr, addrs[1].sin6_port,
1104 		    &addrs[0].sin6_addr, addrs[0].sin6_port,
1105 		    0, NULL);
1106 	}
1107 	if (inp == NULL || inp->inp_socket == NULL) {
1108 		error = ENOENT;
1109 		goto out;
1110 	}
1111 	error = SYSCTL_OUT(req, inp->inp_socket->so_cred,
1112 			   sizeof(struct ucred));
1113 out:
1114 	splx(s);
1115 	return (error);
1116 }
1117 
1118 SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred, CTLTYPE_OPAQUE|CTLFLAG_RW,
1119 	    0, 0,
1120 	    tcp6_getcred, "S,ucred", "Get the ucred of a TCP6 connection");
1121 #endif
1122 
1123 
1124 void
1125 tcp_ctlinput(cmd, sa, vip)
1126 	int cmd;
1127 	struct sockaddr *sa;
1128 	void *vip;
1129 {
1130 	struct ip *ip = vip;
1131 	struct tcphdr *th;
1132 	struct in_addr faddr;
1133 	struct inpcb *inp;
1134 	struct tcpcb *tp;
1135 	void (*notify) (struct inpcb *, int) = tcp_notify;
1136 	tcp_seq icmp_seq;
1137 	int cpu;
1138 	int s;
1139 
1140 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
1141 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1142 		return;
1143 
1144 	if (cmd == PRC_QUENCH)
1145 		notify = tcp_quench;
1146 	else if (icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||
1147 		cmd == PRC_UNREACH_PORT || cmd == PRC_TIMXCEED_INTRANS) && ip)
1148 		notify = tcp_drop_syn_sent;
1149 	else if (cmd == PRC_MSGSIZE)
1150 		notify = tcp_mtudisc;
1151 	else if (PRC_IS_REDIRECT(cmd)) {
1152 		ip = 0;
1153 		notify = in_rtchange;
1154 	} else if (cmd == PRC_HOSTDEAD)
1155 		ip = 0;
1156 	else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
1157 		return;
1158 	if (ip) {
1159 		s = splnet();
1160 		th = (struct tcphdr *)((caddr_t)ip
1161 				       + (IP_VHL_HL(ip->ip_vhl) << 2));
1162 		cpu = tcp_addrcpu(faddr.s_addr, th->th_dport,
1163 		    ip->ip_src.s_addr, th->th_sport);
1164 		inp = in_pcblookup_hash(&tcbinfo[cpu], faddr, th->th_dport,
1165 		    ip->ip_src, th->th_sport, 0, NULL);
1166 		if (inp != NULL && inp->inp_socket != NULL) {
1167 			icmp_seq = htonl(th->th_seq);
1168 			tp = intotcpcb(inp);
1169 			if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
1170 			    SEQ_LT(icmp_seq, tp->snd_max))
1171 				(*notify)(inp, inetctlerrmap[cmd]);
1172 		} else {
1173 			struct in_conninfo inc;
1174 
1175 			inc.inc_fport = th->th_dport;
1176 			inc.inc_lport = th->th_sport;
1177 			inc.inc_faddr = faddr;
1178 			inc.inc_laddr = ip->ip_src;
1179 #ifdef INET6
1180 			inc.inc_isipv6 = 0;
1181 #endif
1182 			syncache_unreach(&inc, th);
1183 		}
1184 		splx(s);
1185 	} else {
1186 		for (cpu = 0; cpu < ncpus2; cpu++) {
1187 			in_pcbnotifyall(&tcbinfo[cpu].listhead, faddr,
1188 					inetctlerrmap[cmd], notify);
1189 		}
1190 	}
1191 }
1192 
1193 #ifdef INET6
1194 void
1195 tcp6_ctlinput(cmd, sa, d)
1196 	int cmd;
1197 	struct sockaddr *sa;
1198 	void *d;
1199 {
1200 	struct tcphdr th;
1201 	void (*notify) (struct inpcb *, int) = tcp_notify;
1202 	struct ip6_hdr *ip6;
1203 	struct mbuf *m;
1204 	struct ip6ctlparam *ip6cp = NULL;
1205 	const struct sockaddr_in6 *sa6_src = NULL;
1206 	int off;
1207 	struct tcp_portonly {
1208 		u_int16_t th_sport;
1209 		u_int16_t th_dport;
1210 	} *thp;
1211 
1212 	if (sa->sa_family != AF_INET6 ||
1213 	    sa->sa_len != sizeof(struct sockaddr_in6))
1214 		return;
1215 
1216 	if (cmd == PRC_QUENCH)
1217 		notify = tcp_quench;
1218 	else if (cmd == PRC_MSGSIZE)
1219 		notify = tcp_mtudisc;
1220 	else if (!PRC_IS_REDIRECT(cmd) &&
1221 		 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1222 		return;
1223 
1224 	/* if the parameter is from icmp6, decode it. */
1225 	if (d != NULL) {
1226 		ip6cp = (struct ip6ctlparam *)d;
1227 		m = ip6cp->ip6c_m;
1228 		ip6 = ip6cp->ip6c_ip6;
1229 		off = ip6cp->ip6c_off;
1230 		sa6_src = ip6cp->ip6c_src;
1231 	} else {
1232 		m = NULL;
1233 		ip6 = NULL;
1234 		off = 0;	/* fool gcc */
1235 		sa6_src = &sa6_any;
1236 	}
1237 
1238 	if (ip6) {
1239 		struct in_conninfo inc;
1240 		/*
1241 		 * XXX: We assume that when IPV6 is non NULL,
1242 		 * M and OFF are valid.
1243 		 */
1244 
1245 		/* check if we can safely examine src and dst ports */
1246 		if (m->m_pkthdr.len < off + sizeof(*thp))
1247 			return;
1248 
1249 		bzero(&th, sizeof(th));
1250 		m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
1251 
1252 		in6_pcbnotify(&tcbinfo[0].listhead, sa, th.th_dport,
1253 		    (struct sockaddr *)ip6cp->ip6c_src,
1254 		    th.th_sport, cmd, notify);
1255 
1256 		inc.inc_fport = th.th_dport;
1257 		inc.inc_lport = th.th_sport;
1258 		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
1259 		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
1260 		inc.inc_isipv6 = 1;
1261 		syncache_unreach(&inc, &th);
1262 	} else
1263 		in6_pcbnotify(&tcbinfo[0].listhead, sa, 0,
1264 		    (const struct sockaddr *)sa6_src, 0, cmd, notify);
1265 }
1266 #endif /* INET6 */
1267 
1268 
1269 /*
1270  * Following is where TCP initial sequence number generation occurs.
1271  *
1272  * There are two places where we must use initial sequence numbers:
1273  * 1.  In SYN-ACK packets.
1274  * 2.  In SYN packets.
1275  *
1276  * All ISNs for SYN-ACK packets are generated by the syncache.  See
1277  * tcp_syncache.c for details.
1278  *
1279  * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
1280  * depends on this property.  In addition, these ISNs should be
1281  * unguessable so as to prevent connection hijacking.  To satisfy
1282  * the requirements of this situation, the algorithm outlined in
1283  * RFC 1948 is used to generate sequence numbers.
1284  *
1285  * Implementation details:
1286  *
1287  * Time is based off the system timer, and is corrected so that it
1288  * increases by one megabyte per second.  This allows for proper
1289  * recycling on high speed LANs while still leaving over an hour
1290  * before rollover.
1291  *
1292  * net.inet.tcp.isn_reseed_interval controls the number of seconds
1293  * between seeding of isn_secret.  This is normally set to zero,
1294  * as reseeding should not be necessary.
1295  *
1296  */
1297 
1298 #define ISN_BYTES_PER_SECOND 1048576
1299 
1300 u_char isn_secret[32];
1301 int isn_last_reseed;
1302 MD5_CTX isn_ctx;
1303 
1304 tcp_seq
1305 tcp_new_isn(tp)
1306 	struct tcpcb *tp;
1307 {
1308 	u_int32_t md5_buffer[4];
1309 	tcp_seq new_isn;
1310 
1311 	/* Seed if this is the first use, reseed if requested. */
1312 	if ((isn_last_reseed == 0) || ((tcp_isn_reseed_interval > 0) &&
1313 	     (((u_int)isn_last_reseed + (u_int)tcp_isn_reseed_interval*hz)
1314 		< (u_int)ticks))) {
1315 		read_random_unlimited(&isn_secret, sizeof(isn_secret));
1316 		isn_last_reseed = ticks;
1317 	}
1318 
1319 	/* Compute the md5 hash and return the ISN. */
1320 	MD5Init(&isn_ctx);
1321 	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_fport, sizeof(u_short));
1322 	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_lport, sizeof(u_short));
1323 #ifdef INET6
1324 	if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
1325 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
1326 			  sizeof(struct in6_addr));
1327 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
1328 			  sizeof(struct in6_addr));
1329 	} else
1330 #endif
1331 	{
1332 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
1333 			  sizeof(struct in_addr));
1334 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
1335 			  sizeof(struct in_addr));
1336 	}
1337 	MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret));
1338 	MD5Final((u_char *) &md5_buffer, &isn_ctx);
1339 	new_isn = (tcp_seq) md5_buffer[0];
1340 	new_isn += ticks * (ISN_BYTES_PER_SECOND / hz);
1341 	return new_isn;
1342 }
1343 
1344 /*
1345  * When a source quench is received, close congestion window
1346  * to one segment.  We will gradually open it again as we proceed.
1347  */
1348 void
1349 tcp_quench(inp, errno)
1350 	struct inpcb *inp;
1351 	int errno;
1352 {
1353 	struct tcpcb *tp = intotcpcb(inp);
1354 
1355 	if (tp)
1356 		tp->snd_cwnd = tp->t_maxseg;
1357 }
1358 
1359 /*
1360  * When a specific ICMP unreachable message is received and the
1361  * connection state is SYN-SENT, drop the connection.  This behavior
1362  * is controlled by the icmp_may_rst sysctl.
1363  */
1364 void
1365 tcp_drop_syn_sent(inp, errno)
1366 	struct inpcb *inp;
1367 	int errno;
1368 {
1369 	struct tcpcb *tp = intotcpcb(inp);
1370 
1371 	if (tp && tp->t_state == TCPS_SYN_SENT)
1372 		tcp_drop(tp, errno);
1373 }
1374 
1375 /*
1376  * When `need fragmentation' ICMP is received, update our idea of the MSS
1377  * based on the new value in the route.  Also nudge TCP to send something,
1378  * since we know the packet we just sent was dropped.
1379  * This duplicates some code in the tcp_mss() function in tcp_input.c.
1380  */
1381 void
1382 tcp_mtudisc(inp, errno)
1383 	struct inpcb *inp;
1384 	int errno;
1385 {
1386 	struct tcpcb *tp = intotcpcb(inp);
1387 	struct rtentry *rt;
1388 	struct rmxp_tao *taop;
1389 	struct socket *so = inp->inp_socket;
1390 	int offered;
1391 	int mss;
1392 #ifdef INET6
1393 	int isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0;
1394 #endif /* INET6 */
1395 
1396 	if (tp) {
1397 #ifdef INET6
1398 		if (isipv6)
1399 			rt = tcp_rtlookup6(&inp->inp_inc);
1400 		else
1401 #endif /* INET6 */
1402 		rt = tcp_rtlookup(&inp->inp_inc);
1403 		if (!rt || !rt->rt_rmx.rmx_mtu) {
1404 			tp->t_maxopd = tp->t_maxseg =
1405 #ifdef INET6
1406 				isipv6 ? tcp_v6mssdflt :
1407 #endif /* INET6 */
1408 				tcp_mssdflt;
1409 			return;
1410 		}
1411 		taop = rmx_taop(rt->rt_rmx);
1412 		offered = taop->tao_mssopt;
1413 		mss = rt->rt_rmx.rmx_mtu -
1414 #ifdef INET6
1415 			(isipv6 ?
1416 			 sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
1417 #endif /* INET6 */
1418 			 sizeof(struct tcpiphdr)
1419 #ifdef INET6
1420 			 )
1421 #endif /* INET6 */
1422 			;
1423 
1424 		if (offered)
1425 			mss = min(mss, offered);
1426 		/*
1427 		 * XXX - The above conditional probably violates the TCP
1428 		 * spec.  The problem is that, since we don't know the
1429 		 * other end's MSS, we are supposed to use a conservative
1430 		 * default.  But, if we do that, then MTU discovery will
1431 		 * never actually take place, because the conservative
1432 		 * default is much less than the MTUs typically seen
1433 		 * on the Internet today.  For the moment, we'll sweep
1434 		 * this under the carpet.
1435 		 *
1436 		 * The conservative default might not actually be a problem
1437 		 * if the only case this occurs is when sending an initial
1438 		 * SYN with options and data to a host we've never talked
1439 		 * to before.  Then, they will reply with an MSS value which
1440 		 * will get recorded and the new parameters should get
1441 		 * recomputed.  For Further Study.
1442 		 */
1443 		if (tp->t_maxopd <= mss)
1444 			return;
1445 		tp->t_maxopd = mss;
1446 
1447 		if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
1448 		    (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
1449 			mss -= TCPOLEN_TSTAMP_APPA;
1450 		if ((tp->t_flags & (TF_REQ_CC|TF_NOOPT)) == TF_REQ_CC &&
1451 		    (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)
1452 			mss -= TCPOLEN_CC_APPA;
1453 #if	(MCLBYTES & (MCLBYTES - 1)) == 0
1454 		if (mss > MCLBYTES)
1455 			mss &= ~(MCLBYTES-1);
1456 #else
1457 		if (mss > MCLBYTES)
1458 			mss = mss / MCLBYTES * MCLBYTES;
1459 #endif
1460 		if (so->so_snd.sb_hiwat < mss)
1461 			mss = so->so_snd.sb_hiwat;
1462 
1463 		tp->t_maxseg = mss;
1464 
1465 		tcpstat.tcps_mturesent++;
1466 		tp->t_rtttime = 0;
1467 		tp->snd_nxt = tp->snd_una;
1468 		tcp_output(tp);
1469 	}
1470 }
1471 
1472 /*
1473  * Look-up the routing entry to the peer of this inpcb.  If no route
1474  * is found and it cannot be allocated the return NULL.  This routine
1475  * is called by TCP routines that access the rmx structure and by tcp_mss
1476  * to get the interface MTU.
1477  */
1478 struct rtentry *
1479 tcp_rtlookup(inc)
1480 	struct in_conninfo *inc;
1481 {
1482 	struct route *ro;
1483 	struct rtentry *rt;
1484 
1485 	ro = &inc->inc_route;
1486 	rt = ro->ro_rt;
1487 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1488 		/* No route yet, so try to acquire one */
1489 		if (inc->inc_faddr.s_addr != INADDR_ANY) {
1490 			ro->ro_dst.sa_family = AF_INET;
1491 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
1492 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1493 			    inc->inc_faddr;
1494 			rtalloc(ro);
1495 			rt = ro->ro_rt;
1496 		}
1497 	}
1498 	return rt;
1499 }
1500 
1501 #ifdef INET6
1502 struct rtentry *
1503 tcp_rtlookup6(inc)
1504 	struct in_conninfo *inc;
1505 {
1506 	struct route_in6 *ro6;
1507 	struct rtentry *rt;
1508 
1509 	ro6 = &inc->inc6_route;
1510 	rt = ro6->ro_rt;
1511 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1512 		/* No route yet, so try to acquire one */
1513 		if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
1514 			ro6->ro_dst.sin6_family = AF_INET6;
1515 			ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
1516 			ro6->ro_dst.sin6_addr = inc->inc6_faddr;
1517 			rtalloc((struct route *)ro6);
1518 			rt = ro6->ro_rt;
1519 		}
1520 	}
1521 	return rt;
1522 }
1523 #endif /* INET6 */
1524 
1525 #ifdef IPSEC
1526 /* compute ESP/AH header size for TCP, including outer IP header. */
1527 size_t
1528 ipsec_hdrsiz_tcp(tp)
1529 	struct tcpcb *tp;
1530 {
1531 	struct inpcb *inp;
1532 	struct mbuf *m;
1533 	size_t hdrsiz;
1534 	struct ip *ip;
1535 #ifdef INET6
1536 	struct ip6_hdr *ip6;
1537 #endif /* INET6 */
1538 	struct tcphdr *th;
1539 
1540 	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
1541 		return 0;
1542 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1543 	if (!m)
1544 		return 0;
1545 
1546 #ifdef INET6
1547 	if ((inp->inp_vflag & INP_IPV6) != 0) {
1548 		ip6 = mtod(m, struct ip6_hdr *);
1549 		th = (struct tcphdr *)(ip6 + 1);
1550 		m->m_pkthdr.len = m->m_len =
1551 			sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
1552 		tcp_fillheaders(tp, ip6, th);
1553 		hdrsiz = ipsec6_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1554 	} else
1555 #endif /* INET6 */
1556       {
1557 	ip = mtod(m, struct ip *);
1558 	th = (struct tcphdr *)(ip + 1);
1559 	m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
1560 	tcp_fillheaders(tp, ip, th);
1561 	hdrsiz = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1562       }
1563 
1564 	m_free(m);
1565 	return hdrsiz;
1566 }
1567 #endif /*IPSEC*/
1568 
1569 /*
1570  * Return a pointer to the cached information about the remote host.
1571  * The cached information is stored in the protocol specific part of
1572  * the route metrics.
1573  */
1574 struct rmxp_tao *
1575 tcp_gettaocache(inc)
1576 	struct in_conninfo *inc;
1577 {
1578 	struct rtentry *rt;
1579 
1580 #ifdef INET6
1581 	if (inc->inc_isipv6)
1582 		rt = tcp_rtlookup6(inc);
1583 	else
1584 #endif /* INET6 */
1585 	rt = tcp_rtlookup(inc);
1586 
1587 	/* Make sure this is a host route and is up. */
1588 	if (rt == NULL ||
1589 	    (rt->rt_flags & (RTF_UP|RTF_HOST)) != (RTF_UP|RTF_HOST))
1590 		return NULL;
1591 
1592 	return rmx_taop(rt->rt_rmx);
1593 }
1594 
1595 /*
1596  * Clear all the TAO cache entries, called from tcp_init.
1597  *
1598  * XXX
1599  * This routine is just an empty one, because we assume that the routing
1600  * routing tables are initialized at the same time when TCP, so there is
1601  * nothing in the cache left over.
1602  */
1603 static void
1604 tcp_cleartaocache()
1605 {
1606 }
1607 
1608 /*
1609  * TCP BANDWIDTH DELAY PRODUCT WINDOW LIMITING
1610  *
1611  * This code attempts to calculate the bandwidth-delay product as a
1612  * means of determining the optimal window size to maximize bandwidth,
1613  * minimize RTT, and avoid the over-allocation of buffers on interfaces and
1614  * routers.  This code also does a fairly good job keeping RTTs in check
1615  * across slow links like modems.  We implement an algorithm which is very
1616  * similar (but not meant to be) TCP/Vegas.  The code operates on the
1617  * transmitter side of a TCP connection and so only effects the transmit
1618  * side of the connection.
1619  *
1620  * BACKGROUND:  TCP makes no provision for the management of buffer space
1621  * at the end points or at the intermediate routers and switches.  A TCP
1622  * stream, whether using NewReno or not, will eventually buffer as
1623  * many packets as it is able and the only reason this typically works is
1624  * due to the fairly small default buffers made available for a connection
1625  * (typicaly 16K or 32K).  As machines use larger windows and/or window
1626  * scaling it is now fairly easy for even a single TCP connection to blow-out
1627  * all available buffer space not only on the local interface, but on
1628  * intermediate routers and switches as well.  NewReno makes a misguided
1629  * attempt to 'solve' this problem by waiting for an actual failure to occur,
1630  * then backing off, then steadily increasing the window again until another
1631  * failure occurs, ad-infinitum.  This results in terrible oscillation that
1632  * is only made worse as network loads increase and the idea of intentionally
1633  * blowing out network buffers is, frankly, a terrible way to manage network
1634  * resources.
1635  *
1636  * It is far better to limit the transmit window prior to the failure
1637  * condition being achieved.  There are two general ways to do this:  First
1638  * you can 'scan' through different transmit window sizes and locate the
1639  * point where the RTT stops increasing, indicating that you have filled the
1640  * pipe, then scan backwards until you note that RTT stops decreasing, then
1641  * repeat ad-infinitum.  This method works in principle but has severe
1642  * implementation issues due to RTT variances, timer granularity, and
1643  * instability in the algorithm which can lead to many false positives and
1644  * create oscillations as well as interact badly with other TCP streams
1645  * implementing the same algorithm.
1646  *
1647  * The second method is to limit the window to the bandwidth delay product
1648  * of the link.  This is the method we implement.  RTT variances and our
1649  * own manipulation of the congestion window, bwnd, can potentially
1650  * destabilize the algorithm.  For this reason we have to stabilize the
1651  * elements used to calculate the window.  We do this by using the minimum
1652  * observed RTT, the long term average of the observed bandwidth, and
1653  * by adding two segments worth of slop.  It isn't perfect but it is able
1654  * to react to changing conditions and gives us a very stable basis on
1655  * which to extend the algorithm.
1656  */
1657 void
1658 tcp_xmit_bandwidth_limit(struct tcpcb *tp, tcp_seq ack_seq)
1659 {
1660 	u_long bw;
1661 	u_long bwnd;
1662 	int save_ticks;
1663 
1664 	/*
1665 	 * If inflight_enable is disabled in the middle of a tcp connection,
1666 	 * make sure snd_bwnd is effectively disabled.
1667 	 */
1668 	if (tcp_inflight_enable == 0) {
1669 		tp->snd_bwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
1670 		tp->snd_bandwidth = 0;
1671 		return;
1672 	}
1673 
1674 	/*
1675 	 * Figure out the bandwidth.  Due to the tick granularity this
1676 	 * is a very rough number and it MUST be averaged over a fairly
1677 	 * long period of time.  XXX we need to take into account a link
1678 	 * that is not using all available bandwidth, but for now our
1679 	 * slop will ramp us up if this case occurs and the bandwidth later
1680 	 * increases.
1681 	 *
1682 	 * Note: if ticks rollover 'bw' may wind up negative.  We must
1683 	 * effectively reset t_bw_rtttime for this case.
1684 	 */
1685 	save_ticks = ticks;
1686 	if ((u_int)(save_ticks - tp->t_bw_rtttime) < 1)
1687 		return;
1688 
1689 	bw = (int64_t)(ack_seq - tp->t_bw_rtseq) * hz /
1690 	    (save_ticks - tp->t_bw_rtttime);
1691 	tp->t_bw_rtttime = save_ticks;
1692 	tp->t_bw_rtseq = ack_seq;
1693 	if (tp->t_bw_rtttime == 0 || (int)bw < 0)
1694 		return;
1695 	bw = ((int64_t)tp->snd_bandwidth * 15 + bw) >> 4;
1696 
1697 	tp->snd_bandwidth = bw;
1698 
1699 	/*
1700 	 * Calculate the semi-static bandwidth delay product, plus two maximal
1701 	 * segments.  The additional slop puts us squarely in the sweet
1702 	 * spot and also handles the bandwidth run-up case.  Without the
1703 	 * slop we could be locking ourselves into a lower bandwidth.
1704 	 *
1705 	 * Situations Handled:
1706 	 *	(1) Prevents over-queueing of packets on LANs, especially on
1707 	 *	    high speed LANs, allowing larger TCP buffers to be
1708 	 *	    specified, and also does a good job preventing
1709 	 *	    over-queueing of packets over choke points like modems
1710 	 *	    (at least for the transmit side).
1711 	 *
1712 	 *	(2) Is able to handle changing network loads (bandwidth
1713 	 *	    drops so bwnd drops, bandwidth increases so bwnd
1714 	 *	    increases).
1715 	 *
1716 	 *	(3) Theoretically should stabilize in the face of multiple
1717 	 *	    connections implementing the same algorithm (this may need
1718 	 *	    a little work).
1719 	 *
1720 	 *	(4) Stability value (defaults to 20 = 2 maximal packets) can
1721 	 *	    be adjusted with a sysctl but typically only needs to be on
1722 	 *	    very slow connections.  A value no smaller then 5 should
1723 	 *	    be used, but only reduce this default if you have no other
1724 	 *	    choice.
1725 	 */
1726 #define USERTT	((tp->t_srtt + tp->t_rttbest) / 2)
1727 	bwnd = (int64_t)bw * USERTT / (hz << TCP_RTT_SHIFT) + tcp_inflight_stab * (int)tp->t_maxseg / 10;
1728 #undef USERTT
1729 
1730 	if (tcp_inflight_debug > 0) {
1731 		static int ltime;
1732 		if ((u_int)(ticks - ltime) >= hz / tcp_inflight_debug) {
1733 			ltime = ticks;
1734 			printf("%p bw %ld rttbest %d srtt %d bwnd %ld\n",
1735 			    tp,
1736 			    bw,
1737 			    tp->t_rttbest,
1738 			    tp->t_srtt,
1739 			    bwnd
1740 			);
1741 		}
1742 	}
1743 	if ((long)bwnd < tcp_inflight_min)
1744 		bwnd = tcp_inflight_min;
1745 	if (bwnd > tcp_inflight_max)
1746 		bwnd = tcp_inflight_max;
1747 	if ((long)bwnd < tp->t_maxseg * 2)
1748 		bwnd = tp->t_maxseg * 2;
1749 	tp->snd_bwnd = bwnd;
1750 }
1751