xref: /dflybsd-src/sys/netinet/tcp_subr.c (revision dc77152fd0d00e1b1f8b8cb04d0706817b468ddd)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
34  * $FreeBSD: src/sys/netinet/tcp_subr.c,v 1.73.2.31 2003/01/24 05:11:34 sam Exp $
35  * $DragonFly: src/sys/netinet/tcp_subr.c,v 1.33 2004/06/07 02:36:22 dillon Exp $
36  */
37 
38 #include "opt_compat.h"
39 #include "opt_inet6.h"
40 #include "opt_ipsec.h"
41 #include "opt_tcpdebug.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/callout.h>
46 #include <sys/kernel.h>
47 #include <sys/sysctl.h>
48 #include <sys/malloc.h>
49 #include <sys/mpipe.h>
50 #include <sys/mbuf.h>
51 #ifdef INET6
52 #include <sys/domain.h>
53 #endif
54 #include <sys/proc.h>
55 #include <sys/socket.h>
56 #include <sys/socketvar.h>
57 #include <sys/protosw.h>
58 #include <sys/random.h>
59 #include <sys/in_cksum.h>
60 
61 #include <vm/vm_zone.h>
62 
63 #include <net/route.h>
64 #include <net/if.h>
65 #include <net/netisr.h>
66 
67 #define	_IP_VHL
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #include <netinet/ip6.h>
72 #include <netinet/in_pcb.h>
73 #include <netinet6/in6_pcb.h>
74 #include <netinet/in_var.h>
75 #include <netinet/ip_var.h>
76 #include <netinet6/ip6_var.h>
77 #include <netinet/tcp.h>
78 #include <netinet/tcp_fsm.h>
79 #include <netinet/tcp_seq.h>
80 #include <netinet/tcp_timer.h>
81 #include <netinet/tcp_var.h>
82 #include <netinet6/tcp6_var.h>
83 #include <netinet/tcpip.h>
84 #ifdef TCPDEBUG
85 #include <netinet/tcp_debug.h>
86 #endif
87 #include <netinet6/ip6protosw.h>
88 
89 #ifdef IPSEC
90 #include <netinet6/ipsec.h>
91 #ifdef INET6
92 #include <netinet6/ipsec6.h>
93 #endif
94 #endif
95 
96 #ifdef FAST_IPSEC
97 #include <netipsec/ipsec.h>
98 #ifdef INET6
99 #include <netipsec/ipsec6.h>
100 #endif
101 #define	IPSEC
102 #endif
103 
104 #include <sys/md5.h>
105 
106 #include <sys/msgport2.h>
107 
108 #include <machine/smp.h>
109 
110 int tcp_mssdflt = TCP_MSS;
111 SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
112     &tcp_mssdflt, 0, "Default TCP Maximum Segment Size");
113 
114 #ifdef INET6
115 int tcp_v6mssdflt = TCP6_MSS;
116 SYSCTL_INT(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt, CTLFLAG_RW,
117     &tcp_v6mssdflt, 0, "Default TCP Maximum Segment Size for IPv6");
118 #endif
119 
120 #if 0
121 static int tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
122 SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
123     &tcp_rttdflt, 0, "Default maximum TCP Round Trip Time");
124 #endif
125 
126 int tcp_do_rfc1323 = 1;
127 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW,
128     &tcp_do_rfc1323, 0, "Enable rfc1323 (high performance TCP) extensions");
129 
130 int tcp_do_rfc1644 = 0;
131 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW,
132     &tcp_do_rfc1644, 0, "Enable rfc1644 (TTCP) extensions");
133 
134 static int tcp_tcbhashsize = 0;
135 SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RD,
136      &tcp_tcbhashsize, 0, "Size of TCP control block hashtable");
137 
138 static int do_tcpdrain = 1;
139 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
140      "Enable tcp_drain routine for extra help when low on mbufs");
141 
142 /* XXX JH */
143 SYSCTL_INT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_RD,
144     &tcbinfo[0].ipi_count, 0, "Number of active PCBs");
145 
146 static int icmp_may_rst = 1;
147 SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_RW, &icmp_may_rst, 0,
148     "Certain ICMP unreachable messages may abort connections in SYN_SENT");
149 
150 static int tcp_isn_reseed_interval = 0;
151 SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_RW,
152     &tcp_isn_reseed_interval, 0, "Seconds between reseeding of ISN secret");
153 
154 /*
155  * TCP bandwidth limiting sysctls.  Note that the default lower bound of
156  * 1024 exists only for debugging.  A good production default would be
157  * something like 6100.
158  */
159 static int tcp_inflight_enable = 0;
160 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_enable, CTLFLAG_RW,
161     &tcp_inflight_enable, 0, "Enable automatic TCP inflight data limiting");
162 
163 static int tcp_inflight_debug = 0;
164 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_debug, CTLFLAG_RW,
165     &tcp_inflight_debug, 0, "Debug TCP inflight calculations");
166 
167 static int tcp_inflight_min = 6144;
168 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_min, CTLFLAG_RW,
169     &tcp_inflight_min, 0, "Lower bound for TCP inflight window");
170 
171 static int tcp_inflight_max = TCP_MAXWIN << TCP_MAX_WINSHIFT;
172 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_max, CTLFLAG_RW,
173     &tcp_inflight_max, 0, "Upper bound for TCP inflight window");
174 
175 static int tcp_inflight_stab = 20;
176 SYSCTL_INT(_net_inet_tcp, OID_AUTO, inflight_stab, CTLFLAG_RW,
177     &tcp_inflight_stab, 0, "Slop in maximal packets / 10 (20 = 2 packets)");
178 
179 static MALLOC_DEFINE(M_TCPTEMP, "tcptemp", "TCP Templates for Keepalives");
180 static struct malloc_pipe tcptemp_mpipe;
181 
182 static void tcp_cleartaocache (void);
183 static void tcp_notify (struct inpcb *, int);
184 
185 struct tcp_stats tcpstats_ary[MAXCPU];
186 #ifdef SMP
187 static int
188 sysctl_tcpstats(SYSCTL_HANDLER_ARGS)
189 {
190 	int cpu, error = 0;
191 
192 	for (cpu = 0; cpu < ncpus; ++cpu) {
193 		if ((error = SYSCTL_OUT(req, (void *)&tcpstats_ary[cpu],
194 					sizeof(struct tcp_stats))))
195 			break;
196 		if ((error = SYSCTL_IN(req, (void *)&tcpstats_ary[cpu],
197 				       sizeof(struct tcp_stats))))
198 			break;
199 	}
200 
201 	return (error);
202 }
203 SYSCTL_PROC(_net_inet_tcp, TCPCTL_STATS, stats, (CTLTYPE_OPAQUE | CTLFLAG_RW),
204     0, 0, sysctl_tcpstats, "S,tcp_stats", "TCP statistics");
205 #else
206 SYSCTL_STRUCT(_net_inet_tcp, TCPCTL_STATS, stats, CTLFLAG_RW,
207     &tcpstat, tcp_stats, "TCP statistics");
208 #endif
209 
210 /*
211  * Target size of TCP PCB hash tables. Must be a power of two.
212  *
213  * Note that this can be overridden by the kernel environment
214  * variable net.inet.tcp.tcbhashsize
215  */
216 #ifndef TCBHASHSIZE
217 #define	TCBHASHSIZE	512
218 #endif
219 
220 /*
221  * This is the actual shape of what we allocate using the zone
222  * allocator.  Doing it this way allows us to protect both structures
223  * using the same generation count, and also eliminates the overhead
224  * of allocating tcpcbs separately.  By hiding the structure here,
225  * we avoid changing most of the rest of the code (although it needs
226  * to be changed, eventually, for greater efficiency).
227  */
228 #define	ALIGNMENT	32
229 #define	ALIGNM1		(ALIGNMENT - 1)
230 struct	inp_tp {
231 	union {
232 		struct	inpcb inp;
233 		char	align[(sizeof(struct inpcb) + ALIGNM1) & ~ALIGNM1];
234 	} inp_tp_u;
235 	struct	tcpcb tcb;
236 	struct	callout inp_tp_rexmt, inp_tp_persist, inp_tp_keep, inp_tp_2msl;
237 	struct	callout inp_tp_delack;
238 };
239 #undef ALIGNMENT
240 #undef ALIGNM1
241 
242 /*
243  * Tcp initialization
244  */
245 void
246 tcp_init()
247 {
248 	struct inpcbporthead *porthashbase;
249 	u_long porthashmask;
250 	struct vm_zone *ipi_zone;
251 	int hashsize = TCBHASHSIZE;
252 	int cpu;
253 
254 	/*
255 	 * note: tcptemp is used for keepalives, and it is ok for an
256 	 * allocation to fail so do not specify MPF_INT.
257 	 */
258 	mpipe_init(&tcptemp_mpipe, M_TCPTEMP, sizeof(struct tcptemp),
259 		    25, -1, 0, NULL);
260 
261 	tcp_ccgen = 1;
262 	tcp_cleartaocache();
263 
264 	tcp_delacktime = TCPTV_DELACK;
265 	tcp_keepinit = TCPTV_KEEP_INIT;
266 	tcp_keepidle = TCPTV_KEEP_IDLE;
267 	tcp_keepintvl = TCPTV_KEEPINTVL;
268 	tcp_maxpersistidle = TCPTV_KEEP_IDLE;
269 	tcp_msl = TCPTV_MSL;
270 	tcp_rexmit_min = TCPTV_MIN;
271 	tcp_rexmit_slop = TCPTV_CPU_VAR;
272 
273 	TUNABLE_INT_FETCH("net.inet.tcp.tcbhashsize", &hashsize);
274 	if (!powerof2(hashsize)) {
275 		printf("WARNING: TCB hash size not a power of 2\n");
276 		hashsize = 512; /* safe default */
277 	}
278 	tcp_tcbhashsize = hashsize;
279 	porthashbase = hashinit(hashsize, M_PCB, &porthashmask);
280 	ipi_zone = zinit("tcpcb", sizeof(struct inp_tp), maxsockets,
281 			 ZONE_INTERRUPT, 0);
282 
283 	for (cpu = 0; cpu < ncpus2; cpu++) {
284 		in_pcbinfo_init(&tcbinfo[cpu]);
285 		tcbinfo[cpu].hashbase = hashinit(hashsize, M_PCB,
286 		    &tcbinfo[cpu].hashmask);
287 		tcbinfo[cpu].porthashbase = porthashbase;
288 		tcbinfo[cpu].porthashmask = porthashmask;
289 		tcbinfo[cpu].wildcardhashbase = hashinit(hashsize, M_PCB,
290 		    &tcbinfo[cpu].wildcardhashmask);
291 		tcbinfo[cpu].ipi_zone = ipi_zone;
292 	}
293 
294 	tcp_reass_maxseg = nmbclusters / 16;
295 	TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments", &tcp_reass_maxseg);
296 
297 #ifdef INET6
298 #define	TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
299 #else
300 #define	TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
301 #endif
302 	if (max_protohdr < TCP_MINPROTOHDR)
303 		max_protohdr = TCP_MINPROTOHDR;
304 	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
305 		panic("tcp_init");
306 #undef TCP_MINPROTOHDR
307 
308 	/*
309 	 * Initialize TCP statistics.
310 	 *
311 	 * It is layed out as an array which is has one element for UP,
312 	 * and SMP_MAXCPU elements for SMP.  This allows us to retain
313 	 * the access mechanism from userland for both UP and SMP.
314 	 */
315 #ifdef SMP
316 	for (cpu = 0; cpu < ncpus; ++cpu) {
317 		bzero(&tcpstats_ary[cpu], sizeof(struct tcp_stats));
318 	}
319 #else
320 	bzero(&tcpstat, sizeof(struct tcp_stats));
321 #endif
322 
323 	syncache_init();
324 	tcp_thread_init();
325 }
326 
327 /*
328  * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
329  * tcp_template used to store this data in mbufs, but we now recopy it out
330  * of the tcpcb each time to conserve mbufs.
331  */
332 void
333 tcp_fillheaders(struct tcpcb *tp, void *ip_ptr, void *tcp_ptr)
334 {
335 	struct inpcb *inp = tp->t_inpcb;
336 	struct tcphdr *tcp_hdr = (struct tcphdr *)tcp_ptr;
337 
338 #ifdef INET6
339 	if (inp->inp_vflag & INP_IPV6) {
340 		struct ip6_hdr *ip6;
341 
342 		ip6 = (struct ip6_hdr *)ip_ptr;
343 		ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
344 			(inp->in6p_flowinfo & IPV6_FLOWINFO_MASK);
345 		ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
346 			(IPV6_VERSION & IPV6_VERSION_MASK);
347 		ip6->ip6_nxt = IPPROTO_TCP;
348 		ip6->ip6_plen = sizeof(struct tcphdr);
349 		ip6->ip6_src = inp->in6p_laddr;
350 		ip6->ip6_dst = inp->in6p_faddr;
351 		tcp_hdr->th_sum = 0;
352 	} else
353 #endif
354 	{
355 		struct ip *ip = (struct ip *) ip_ptr;
356 
357 		ip->ip_vhl = IP_VHL_BORING;
358 		ip->ip_tos = 0;
359 		ip->ip_len = 0;
360 		ip->ip_id = 0;
361 		ip->ip_off = 0;
362 		ip->ip_ttl = 0;
363 		ip->ip_sum = 0;
364 		ip->ip_p = IPPROTO_TCP;
365 		ip->ip_src = inp->inp_laddr;
366 		ip->ip_dst = inp->inp_faddr;
367 		tcp_hdr->th_sum = in_pseudo(ip->ip_src.s_addr,
368 				    ip->ip_dst.s_addr,
369 				    htons(sizeof(struct tcphdr) + IPPROTO_TCP));
370 	}
371 
372 	tcp_hdr->th_sport = inp->inp_lport;
373 	tcp_hdr->th_dport = inp->inp_fport;
374 	tcp_hdr->th_seq = 0;
375 	tcp_hdr->th_ack = 0;
376 	tcp_hdr->th_x2 = 0;
377 	tcp_hdr->th_off = 5;
378 	tcp_hdr->th_flags = 0;
379 	tcp_hdr->th_win = 0;
380 	tcp_hdr->th_urp = 0;
381 }
382 
383 /*
384  * Create template to be used to send tcp packets on a connection.
385  * Allocates an mbuf and fills in a skeletal tcp/ip header.  The only
386  * use for this function is in keepalives, which use tcp_respond.
387  */
388 struct tcptemp *
389 tcp_maketemplate(struct tcpcb *tp)
390 {
391 	struct tcptemp *tmp;
392 
393 	if ((tmp = mpipe_alloc_nowait(&tcptemp_mpipe)) == NULL)
394 		return (NULL);
395 	tcp_fillheaders(tp, (void *)&tmp->tt_ipgen, (void *)&tmp->tt_t);
396 	return (tmp);
397 }
398 
399 void
400 tcp_freetemplate(struct tcptemp *tmp)
401 {
402 	mpipe_free(&tcptemp_mpipe, tmp);
403 }
404 
405 /*
406  * Send a single message to the TCP at address specified by
407  * the given TCP/IP header.  If m == NULL, then we make a copy
408  * of the tcpiphdr at ti and send directly to the addressed host.
409  * This is used to force keep alive messages out using the TCP
410  * template for a connection.  If flags are given then we send
411  * a message back to the TCP which originated the * segment ti,
412  * and discard the mbuf containing it and any other attached mbufs.
413  *
414  * In any case the ack and sequence number of the transmitted
415  * segment are as specified by the parameters.
416  *
417  * NOTE: If m != NULL, then ti must point to *inside* the mbuf.
418  */
419 void
420 tcp_respond(struct tcpcb *tp, void *ipgen, struct tcphdr *th, struct mbuf *m,
421 	    tcp_seq ack, tcp_seq seq, int flags)
422 {
423 	int tlen;
424 	int win = 0;
425 	struct route *ro = NULL;
426 	struct route sro;
427 	struct ip *ip = ipgen;
428 	struct tcphdr *nth;
429 	int ipflags = 0;
430 	struct route_in6 *ro6 = NULL;
431 	struct route_in6 sro6;
432 	struct ip6_hdr *ip6 = ipgen;
433 #ifdef INET6
434 	boolean_t isipv6 = (IP_VHL_V(ip->ip_vhl) == 6);
435 #else
436 	const boolean_t isipv6 = FALSE;
437 #endif
438 
439 	if (tp != NULL) {
440 		if (!(flags & TH_RST)) {
441 			win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
442 			if (win > (long)TCP_MAXWIN << tp->rcv_scale)
443 				win = (long)TCP_MAXWIN << tp->rcv_scale;
444 		}
445 		if (isipv6)
446 			ro6 = &tp->t_inpcb->in6p_route;
447 		else
448 			ro = &tp->t_inpcb->inp_route;
449 	} else {
450 		if (isipv6) {
451 			ro6 = &sro6;
452 			bzero(ro6, sizeof *ro6);
453 		} else {
454 			ro = &sro;
455 			bzero(ro, sizeof *ro);
456 		}
457 	}
458 	if (m == NULL) {
459 		m = m_gethdr(MB_DONTWAIT, MT_HEADER);
460 		if (m == NULL)
461 			return;
462 		tlen = 0;
463 		m->m_data += max_linkhdr;
464 		if (isipv6) {
465 			bcopy(ip6, mtod(m, caddr_t), sizeof(struct ip6_hdr));
466 			ip6 = mtod(m, struct ip6_hdr *);
467 			nth = (struct tcphdr *)(ip6 + 1);
468 		} else {
469 			bcopy(ip, mtod(m, caddr_t), sizeof(struct ip));
470 			ip = mtod(m, struct ip *);
471 			nth = (struct tcphdr *)(ip + 1);
472 		}
473 		bcopy(th, nth, sizeof(struct tcphdr));
474 		flags = TH_ACK;
475 	} else {
476 		m_freem(m->m_next);
477 		m->m_next = NULL;
478 		m->m_data = (caddr_t)ipgen;
479 		/* m_len is set later */
480 		tlen = 0;
481 #define	xchg(a, b, type) { type t; t = a; a = b; b = t; }
482 		if (isipv6) {
483 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
484 			nth = (struct tcphdr *)(ip6 + 1);
485 		} else {
486 			xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, n_long);
487 			nth = (struct tcphdr *)(ip + 1);
488 		}
489 		if (th != nth) {
490 			/*
491 			 * this is usually a case when an extension header
492 			 * exists between the IPv6 header and the
493 			 * TCP header.
494 			 */
495 			nth->th_sport = th->th_sport;
496 			nth->th_dport = th->th_dport;
497 		}
498 		xchg(nth->th_dport, nth->th_sport, n_short);
499 #undef xchg
500 	}
501 	if (isipv6) {
502 		ip6->ip6_flow = 0;
503 		ip6->ip6_vfc = IPV6_VERSION;
504 		ip6->ip6_nxt = IPPROTO_TCP;
505 		ip6->ip6_plen = htons((u_short)(sizeof(struct tcphdr) + tlen));
506 		tlen += sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
507 	} else {
508 		tlen += sizeof(struct tcpiphdr);
509 		ip->ip_len = tlen;
510 		ip->ip_ttl = ip_defttl;
511 	}
512 	m->m_len = tlen;
513 	m->m_pkthdr.len = tlen;
514 	m->m_pkthdr.rcvif = (struct ifnet *) NULL;
515 	nth->th_seq = htonl(seq);
516 	nth->th_ack = htonl(ack);
517 	nth->th_x2 = 0;
518 	nth->th_off = sizeof(struct tcphdr) >> 2;
519 	nth->th_flags = flags;
520 	if (tp != NULL)
521 		nth->th_win = htons((u_short) (win >> tp->rcv_scale));
522 	else
523 		nth->th_win = htons((u_short)win);
524 	nth->th_urp = 0;
525 	if (isipv6) {
526 		nth->th_sum = 0;
527 		nth->th_sum = in6_cksum(m, IPPROTO_TCP,
528 					sizeof(struct ip6_hdr),
529 					tlen - sizeof(struct ip6_hdr));
530 		ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL,
531 					       (ro6 && ro6->ro_rt) ?
532 					           ro6->ro_rt->rt_ifp : NULL);
533 	} else {
534 		nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
535 		    htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
536 		m->m_pkthdr.csum_flags = CSUM_TCP;
537 		m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
538 	}
539 #ifdef TCPDEBUG
540 	if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
541 		tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
542 #endif
543 	if (isipv6) {
544 		(void)ip6_output(m, NULL, ro6, ipflags, NULL, NULL,
545 				 tp ? tp->t_inpcb : NULL);
546 		if ((ro6 == &sro6) && (ro6->ro_rt != NULL)) {
547 			RTFREE(ro6->ro_rt);
548 			ro6->ro_rt = NULL;
549 		}
550 	} else {
551 		(void)ip_output(m, NULL, ro, ipflags, NULL,
552 				tp ? tp->t_inpcb : NULL);
553 		if ((ro == &sro) && (ro->ro_rt != NULL)) {
554 			RTFREE(ro->ro_rt);
555 			ro->ro_rt = NULL;
556 		}
557 	}
558 }
559 
560 /*
561  * Create a new TCP control block, making an
562  * empty reassembly queue and hooking it to the argument
563  * protocol control block.  The `inp' parameter must have
564  * come from the zone allocator set up in tcp_init().
565  */
566 struct tcpcb *
567 tcp_newtcpcb(struct inpcb *inp)
568 {
569 	struct inp_tp *it;
570 	struct tcpcb *tp;
571 #ifdef INET6
572 	boolean_t isipv6 = ((inp->inp_vflag & INP_IPV6) != 0);
573 #else
574 	const boolean_t isipv6 = FALSE;
575 #endif
576 
577 	it = (struct inp_tp *)inp;
578 	tp = &it->tcb;
579 	bzero(tp, sizeof(struct tcpcb));
580 	LIST_INIT(&tp->t_segq);
581 	tp->t_maxseg = tp->t_maxopd = isipv6 ? tcp_v6mssdflt : tcp_mssdflt;
582 
583 	/* Set up our timeouts. */
584 	callout_init(tp->tt_rexmt = &it->inp_tp_rexmt);
585 	callout_init(tp->tt_persist = &it->inp_tp_persist);
586 	callout_init(tp->tt_keep = &it->inp_tp_keep);
587 	callout_init(tp->tt_2msl = &it->inp_tp_2msl);
588 	callout_init(tp->tt_delack = &it->inp_tp_delack);
589 
590 	if (tcp_do_rfc1323)
591 		tp->t_flags = (TF_REQ_SCALE | TF_REQ_TSTMP);
592 	if (tcp_do_rfc1644)
593 		tp->t_flags |= TF_REQ_CC;
594 	tp->t_inpcb = inp;	/* XXX */
595 	/*
596 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
597 	 * rtt estimate.  Set rttvar so that srtt + 4 * rttvar gives
598 	 * reasonable initial retransmit time.
599 	 */
600 	tp->t_srtt = TCPTV_SRTTBASE;
601 	tp->t_rttvar =
602 	    ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
603 	tp->t_rttmin = tcp_rexmit_min;
604 	tp->t_rxtcur = TCPTV_RTOBASE;
605 	tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
606 	tp->snd_bwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
607 	tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
608 	tp->t_rcvtime = ticks;
609 	tp->t_bw_rtttime = ticks;
610 	/*
611 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
612 	 * because the socket may be bound to an IPv6 wildcard address,
613 	 * which may match an IPv4-mapped IPv6 address.
614 	 */
615 	inp->inp_ip_ttl = ip_defttl;
616 	inp->inp_ppcb = (caddr_t)tp;
617 	return (tp);		/* XXX */
618 }
619 
620 /*
621  * Drop a TCP connection, reporting the specified error.
622  * If connection is synchronized, then send a RST to peer.
623  */
624 struct tcpcb *
625 tcp_drop(struct tcpcb *tp, int errno)
626 {
627 	struct socket *so = tp->t_inpcb->inp_socket;
628 
629 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
630 		tp->t_state = TCPS_CLOSED;
631 		(void) tcp_output(tp);
632 		tcpstat.tcps_drops++;
633 	} else
634 		tcpstat.tcps_conndrops++;
635 	if (errno == ETIMEDOUT && tp->t_softerror)
636 		errno = tp->t_softerror;
637 	so->so_error = errno;
638 	return (tcp_close(tp));
639 }
640 
641 #ifdef SMP
642 struct netmsg_remwildcard {
643 	struct lwkt_msg		nm_lmsg;
644 	struct inpcb		*nm_inp;
645 	struct inpcbinfo	*nm_pcbinfo;
646 };
647 
648 static int
649 in_pcbremwildcardhash_handler(struct lwkt_msg *msg0)
650 {
651 	struct netmsg_remwildcard *msg = (struct netmsg_remwildcard *)msg0;
652 
653 	in_pcbremwildcardhash_oncpu(msg->nm_inp, msg->nm_pcbinfo);
654 	lwkt_replymsg(&msg->nm_lmsg, 0);
655 	return (EASYNC);
656 }
657 #endif
658 
659 /*
660  * Close a TCP control block:
661  *	discard all space held by the tcp
662  *	discard internet protocol block
663  *	wake up any sleepers
664  */
665 struct tcpcb *
666 tcp_close(struct tcpcb *tp)
667 {
668 	struct tseg_qent *q;
669 	struct inpcb *inp = tp->t_inpcb;
670 	struct socket *so = inp->inp_socket;
671 	struct rtentry *rt;
672 	boolean_t dosavessthresh;
673 #ifdef SMP
674 	int cpu;
675 #endif
676 #ifdef INET6
677 	boolean_t isipv6 = ((inp->inp_vflag & INP_IPV6) != 0);
678 #else
679 	const boolean_t isipv6 = FALSE;
680 #endif
681 
682 	/*
683 	 * Make sure that all of our timers are stopped before we
684 	 * delete the PCB.
685 	 */
686 	callout_stop(tp->tt_rexmt);
687 	callout_stop(tp->tt_persist);
688 	callout_stop(tp->tt_keep);
689 	callout_stop(tp->tt_2msl);
690 	callout_stop(tp->tt_delack);
691 
692 	/*
693 	 * If we got enough samples through the srtt filter,
694 	 * save the rtt and rttvar in the routing entry.
695 	 * 'Enough' is arbitrarily defined as the 16 samples.
696 	 * 16 samples is enough for the srtt filter to converge
697 	 * to within 5% of the correct value; fewer samples and
698 	 * we could save a very bogus rtt.
699 	 *
700 	 * Don't update the default route's characteristics and don't
701 	 * update anything that the user "locked".
702 	 */
703 	if (tp->t_rttupdated >= 16) {
704 		u_long i = 0;
705 
706 		if (isipv6) {
707 			struct sockaddr_in6 *sin6;
708 
709 			if ((rt = inp->in6p_route.ro_rt) == NULL)
710 				goto no_valid_rt;
711 			sin6 = (struct sockaddr_in6 *)rt_key(rt);
712 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
713 				goto no_valid_rt;
714 		} else
715 			if ((rt = inp->inp_route.ro_rt) == NULL ||
716 			    ((struct sockaddr_in *)rt_key(rt))->
717 			     sin_addr.s_addr == INADDR_ANY)
718 				goto no_valid_rt;
719 
720 		if (!(rt->rt_rmx.rmx_locks & RTV_RTT)) {
721 			i = tp->t_srtt * (RTM_RTTUNIT / (hz * TCP_RTT_SCALE));
722 			if (rt->rt_rmx.rmx_rtt && i)
723 				/*
724 				 * filter this update to half the old & half
725 				 * the new values, converting scale.
726 				 * See route.h and tcp_var.h for a
727 				 * description of the scaling constants.
728 				 */
729 				rt->rt_rmx.rmx_rtt =
730 				    (rt->rt_rmx.rmx_rtt + i) / 2;
731 			else
732 				rt->rt_rmx.rmx_rtt = i;
733 			tcpstat.tcps_cachedrtt++;
734 		}
735 		if (!(rt->rt_rmx.rmx_locks & RTV_RTTVAR)) {
736 			i = tp->t_rttvar *
737 			    (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE));
738 			if (rt->rt_rmx.rmx_rttvar && i)
739 				rt->rt_rmx.rmx_rttvar =
740 				    (rt->rt_rmx.rmx_rttvar + i) / 2;
741 			else
742 				rt->rt_rmx.rmx_rttvar = i;
743 			tcpstat.tcps_cachedrttvar++;
744 		}
745 		/*
746 		 * The old comment here said:
747 		 * update the pipelimit (ssthresh) if it has been updated
748 		 * already or if a pipesize was specified & the threshhold
749 		 * got below half the pipesize.  I.e., wait for bad news
750 		 * before we start updating, then update on both good
751 		 * and bad news.
752 		 *
753 		 * But we want to save the ssthresh even if no pipesize is
754 		 * specified explicitly in the route, because such
755 		 * connections still have an implicit pipesize specified
756 		 * by the global tcp_sendspace.  In the absence of a reliable
757 		 * way to calculate the pipesize, it will have to do.
758 		 */
759 		i = tp->snd_ssthresh;
760 		if (rt->rt_rmx.rmx_sendpipe != 0)
761 			dosavessthresh = (i < rt->rt_rmx.rmx_sendpipe/2);
762 		else
763 			dosavessthresh = (i < so->so_snd.sb_hiwat/2);
764 		if (dosavessthresh ||
765 		    (!(rt->rt_rmx.rmx_locks & RTV_SSTHRESH) && (i != 0) &&
766 		     (rt->rt_rmx.rmx_ssthresh != 0))) {
767 			/*
768 			 * convert the limit from user data bytes to
769 			 * packets then to packet data bytes.
770 			 */
771 			i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
772 			if (i < 2)
773 				i = 2;
774 			i *= tp->t_maxseg +
775 			     (isipv6 ?
776 			      sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
777 			      sizeof(struct tcpiphdr));
778 			if (rt->rt_rmx.rmx_ssthresh)
779 				rt->rt_rmx.rmx_ssthresh =
780 				    (rt->rt_rmx.rmx_ssthresh + i) / 2;
781 			else
782 				rt->rt_rmx.rmx_ssthresh = i;
783 			tcpstat.tcps_cachedssthresh++;
784 		}
785 	}
786 
787 no_valid_rt:
788 	/* free the reassembly queue, if any */
789 	while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
790 		LIST_REMOVE(q, tqe_q);
791 		m_freem(q->tqe_m);
792 		FREE(q, M_TSEGQ);
793 		tcp_reass_qsize--;
794 	}
795 	inp->inp_ppcb = NULL;
796 	soisdisconnected(so);
797 
798 #ifdef SMP
799 	if (inp->inp_flags & INP_WILDCARD_MP) {
800 		for (cpu = 0; cpu < ncpus2; cpu ++) {
801 			struct netmsg_remwildcard *msg;
802 
803 			msg = malloc(sizeof(struct netmsg_remwildcard),
804 			    M_LWKTMSG, M_INTWAIT);
805 			lwkt_initmsg(&msg->nm_lmsg, &netisr_afree_rport, 0,
806 			    lwkt_cmd_func(in_pcbremwildcardhash_handler),
807 			    lwkt_cmd_op_none);
808 			msg->nm_inp = inp;
809 			msg->nm_pcbinfo = &tcbinfo[cpu];
810 			lwkt_sendmsg(tcp_cport(cpu), &msg->nm_lmsg);
811 		}
812 	}
813 #endif
814 
815 #ifdef INET6
816 	if (INP_CHECK_SOCKAF(so, AF_INET6))
817 		in6_pcbdetach(inp);
818 	else
819 #endif
820 		in_pcbdetach(inp);
821 	tcpstat.tcps_closed++;
822 	return (NULL);
823 }
824 
825 static __inline void
826 tcp_drain_oncpu(struct inpcbhead *head)
827 {
828 	struct inpcb *inpb;
829 	struct tcpcb *tcpb;
830 	struct tseg_qent *te;
831 
832 	LIST_FOREACH(inpb, head, inp_list) {
833 		if (inpb->inp_flags & INP_PLACEMARKER)
834 			continue;
835 		if ((tcpb = intotcpcb(inpb))) {
836 			while ((te = LIST_FIRST(&tcpb->t_segq)) != NULL) {
837 				LIST_REMOVE(te, tqe_q);
838 				m_freem(te->tqe_m);
839 				FREE(te, M_TSEGQ);
840 				tcp_reass_qsize--;
841 			}
842 		}
843 	}
844 }
845 
846 #ifdef SMP
847 struct netmsg_tcp_drain {
848 	struct lwkt_msg		nm_lmsg;
849 	struct inpcbhead	*nm_head;
850 };
851 
852 static int
853 tcp_drain_handler(lwkt_msg_t lmsg)
854 {
855 	struct netmsg_tcp_drain *nm = (void *)lmsg;
856 
857 	tcp_drain_oncpu(nm->nm_head);
858 	lwkt_replymsg(lmsg, 0);
859 	return(EASYNC);
860 }
861 #endif
862 
863 void
864 tcp_drain()
865 {
866 #ifdef SMP
867 	int cpu;
868 #endif
869 
870 	if (!do_tcpdrain)
871 		return;
872 
873 	/*
874 	 * Walk the tcpbs, if existing, and flush the reassembly queue,
875 	 * if there is one...
876 	 * XXX: The "Net/3" implementation doesn't imply that the TCP
877 	 *	reassembly queue should be flushed, but in a situation
878 	 *	where we're really low on mbufs, this is potentially
879 	 *	useful.
880 	 */
881 #ifdef SMP
882 	for (cpu = 0; cpu < ncpus2; cpu++) {
883 		struct netmsg_tcp_drain *msg;
884 
885 		if (cpu == mycpu->gd_cpuid) {
886 			tcp_drain_oncpu(&tcbinfo[cpu].pcblisthead);
887 		} else {
888 			msg = malloc(sizeof(struct netmsg_tcp_drain),
889 				    M_LWKTMSG, M_NOWAIT);
890 			if (msg == NULL)
891 				continue;
892 			lwkt_initmsg(&msg->nm_lmsg, &netisr_afree_rport, 0,
893 				lwkt_cmd_func(tcp_drain_handler),
894 				lwkt_cmd_op_none);
895 			msg->nm_head = &tcbinfo[cpu].pcblisthead;
896 			lwkt_sendmsg(tcp_cport(cpu), &msg->nm_lmsg);
897 		}
898 	}
899 #else
900 	tcp_drain_oncpu(&tcbinfo[0].pcblisthead);
901 #endif
902 }
903 
904 /*
905  * Notify a tcp user of an asynchronous error;
906  * store error as soft error, but wake up user
907  * (for now, won't do anything until can select for soft error).
908  *
909  * Do not wake up user since there currently is no mechanism for
910  * reporting soft errors (yet - a kqueue filter may be added).
911  */
912 static void
913 tcp_notify(struct inpcb *inp, int error)
914 {
915 	struct tcpcb *tp = intotcpcb(inp);
916 
917 	/*
918 	 * Ignore some errors if we are hooked up.
919 	 * If connection hasn't completed, has retransmitted several times,
920 	 * and receives a second error, give up now.  This is better
921 	 * than waiting a long time to establish a connection that
922 	 * can never complete.
923 	 */
924 	if (tp->t_state == TCPS_ESTABLISHED &&
925 	     (error == EHOSTUNREACH || error == ENETUNREACH ||
926 	      error == EHOSTDOWN)) {
927 		return;
928 	} else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
929 	    tp->t_softerror)
930 		tcp_drop(tp, error);
931 	else
932 		tp->t_softerror = error;
933 #if 0
934 	wakeup((caddr_t) &so->so_timeo);
935 	sorwakeup(so);
936 	sowwakeup(so);
937 #endif
938 }
939 
940 static int
941 tcp_pcblist(SYSCTL_HANDLER_ARGS)
942 {
943 	int error, i, n;
944 	struct inpcb *marker;
945 	struct inpcb *inp;
946 	inp_gen_t gencnt;
947 	struct xinpgen xig;
948 	globaldata_t gd;
949 	int origcpu, ccpu;
950 
951 	error = 0;
952 	n = 0;
953 
954 	/*
955 	 * The process of preparing the TCB list is too time-consuming and
956 	 * resource-intensive to repeat twice on every request.
957 	 */
958 	if (req->oldptr == NULL) {
959 		for (ccpu = 0; ccpu < ncpus; ++ccpu) {
960 			gd = globaldata_find(ccpu);
961 			n += tcbinfo[gd->gd_cpuid].ipi_count;
962 		}
963 		req->oldidx = 2 * ncpus * (sizeof xig) +
964 		  (n + n/8) * sizeof(struct xtcpcb);
965 		return (0);
966 	}
967 
968 	if (req->newptr != NULL)
969 		return (EPERM);
970 
971 	marker = malloc(sizeof(struct inpcb), M_TEMP, M_WAITOK|M_ZERO);
972 	marker->inp_flags |= INP_PLACEMARKER;
973 
974 	/*
975 	 * OK, now we're committed to doing something.  Run the inpcb list
976 	 * for each cpu in the system and construct the output.  Use a
977 	 * list placemarker to deal with list changes occuring during
978 	 * copyout blockages (but otherwise depend on being on the correct
979 	 * cpu to avoid races).
980 	 */
981 	origcpu = mycpu->gd_cpuid;
982 	for (ccpu = 1; ccpu <= ncpus && error == 0; ++ccpu) {
983 		globaldata_t rgd;
984 		caddr_t inp_ppcb;
985 		struct xtcpcb xt;
986 		int cpu_id;
987 
988 		cpu_id = (origcpu + ccpu) % ncpus;
989 		if ((smp_active_mask & (1 << cpu_id)) == 0)
990 			continue;
991 		rgd = globaldata_find(cpu_id);
992 		lwkt_setcpu_self(rgd);
993 
994 		/* indicate change of CPU */
995 		cpu_mb1();
996 
997 		gencnt = tcbinfo[cpu_id].ipi_gencnt;
998 		n = tcbinfo[cpu_id].ipi_count;
999 
1000 		xig.xig_len = sizeof xig;
1001 		xig.xig_count = n;
1002 		xig.xig_gen = gencnt;
1003 		xig.xig_sogen = so_gencnt;
1004 		xig.xig_cpu = cpu_id;
1005 		error = SYSCTL_OUT(req, &xig, sizeof xig);
1006 		if (error != 0)
1007 			break;
1008 
1009 		LIST_INSERT_HEAD(&tcbinfo[cpu_id].pcblisthead, marker, inp_list);
1010 		i = 0;
1011 		while ((inp = LIST_NEXT(marker, inp_list)) != NULL && i < n) {
1012 			/*
1013 			 * process a snapshot of pcbs, ignoring placemarkers
1014 			 * and using our own to allow SYSCTL_OUT to block.
1015 			 */
1016 			LIST_REMOVE(marker, inp_list);
1017 			LIST_INSERT_AFTER(inp, marker, inp_list);
1018 
1019 			if (inp->inp_flags & INP_PLACEMARKER)
1020 				continue;
1021 			if (inp->inp_gencnt > gencnt)
1022 				continue;
1023 			if (prison_xinpcb(req->td, inp))
1024 				continue;
1025 
1026 			xt.xt_len = sizeof xt;
1027 			bcopy(inp, &xt.xt_inp, sizeof *inp);
1028 			inp_ppcb = inp->inp_ppcb;
1029 			if (inp_ppcb != NULL)
1030 				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
1031 			else
1032 				bzero(&xt.xt_tp, sizeof xt.xt_tp);
1033 			if (inp->inp_socket)
1034 				sotoxsocket(inp->inp_socket, &xt.xt_socket);
1035 			if ((error = SYSCTL_OUT(req, &xt, sizeof xt)) != 0)
1036 				break;
1037 			++i;
1038 		}
1039 		LIST_REMOVE(marker, inp_list);
1040 		if (error == 0 && i < n) {
1041 			bzero(&xt, sizeof(xt));
1042 			xt.xt_len = sizeof(xt);
1043 			while (i < n) {
1044 				error = SYSCTL_OUT(req, &xt, sizeof (xt));
1045 				if (error)
1046 					break;
1047 				++i;
1048 			}
1049 		}
1050 		if (error == 0) {
1051 			/*
1052 			 * Give the user an updated idea of our state.
1053 			 * If the generation differs from what we told
1054 			 * her before, she knows that something happened
1055 			 * while we were processing this request, and it
1056 			 * might be necessary to retry.
1057 			 */
1058 			xig.xig_gen = tcbinfo[cpu_id].ipi_gencnt;
1059 			xig.xig_sogen = so_gencnt;
1060 			xig.xig_count = tcbinfo[cpu_id].ipi_count;
1061 			error = SYSCTL_OUT(req, &xig, sizeof xig);
1062 		}
1063 	}
1064 
1065 	/*
1066 	 * Make sure we are on the same cpu we were on originally, since
1067 	 * higher level callers expect this.  Also don't pollute caches with
1068 	 * migrated userland data by (eventually) returning to userland
1069 	 * on a different cpu.
1070 	 */
1071 	lwkt_setcpu_self(globaldata_find(origcpu));
1072 	free(marker, M_TEMP);
1073 	return (error);
1074 }
1075 
1076 SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
1077 	    tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
1078 
1079 static int
1080 tcp_getcred(SYSCTL_HANDLER_ARGS)
1081 {
1082 	struct sockaddr_in addrs[2];
1083 	struct inpcb *inp;
1084 	int cpu;
1085 	int error, s;
1086 
1087 	error = suser(req->td);
1088 	if (error != 0)
1089 		return (error);
1090 	error = SYSCTL_IN(req, addrs, sizeof addrs);
1091 	if (error != 0)
1092 		return (error);
1093 	s = splnet();
1094 
1095 	cpu = tcp_addrcpu(addrs[1].sin_addr.s_addr, addrs[1].sin_port,
1096 	    addrs[0].sin_addr.s_addr, addrs[0].sin_port);
1097 	inp = in_pcblookup_hash(&tcbinfo[cpu], addrs[1].sin_addr,
1098 	    addrs[1].sin_port, addrs[0].sin_addr, addrs[0].sin_port, 0, NULL);
1099 	if (inp == NULL || inp->inp_socket == NULL) {
1100 		error = ENOENT;
1101 		goto out;
1102 	}
1103 	error = SYSCTL_OUT(req, inp->inp_socket->so_cred, sizeof(struct ucred));
1104 out:
1105 	splx(s);
1106 	return (error);
1107 }
1108 
1109 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, getcred, (CTLTYPE_OPAQUE | CTLFLAG_RW),
1110     0, 0, tcp_getcred, "S,ucred", "Get the ucred of a TCP connection");
1111 
1112 #ifdef INET6
1113 static int
1114 tcp6_getcred(SYSCTL_HANDLER_ARGS)
1115 {
1116 	struct sockaddr_in6 addrs[2];
1117 	struct inpcb *inp;
1118 	int error, s;
1119 	boolean_t mapped = FALSE;
1120 
1121 	error = suser(req->td);
1122 	if (error != 0)
1123 		return (error);
1124 	error = SYSCTL_IN(req, addrs, sizeof addrs);
1125 	if (error != 0)
1126 		return (error);
1127 	if (IN6_IS_ADDR_V4MAPPED(&addrs[0].sin6_addr)) {
1128 		if (IN6_IS_ADDR_V4MAPPED(&addrs[1].sin6_addr))
1129 			mapped = TRUE;
1130 		else
1131 			return (EINVAL);
1132 	}
1133 	s = splnet();
1134 	if (mapped) {
1135 		inp = in_pcblookup_hash(&tcbinfo[0],
1136 		    *(struct in_addr *)&addrs[1].sin6_addr.s6_addr[12],
1137 		    addrs[1].sin6_port,
1138 		    *(struct in_addr *)&addrs[0].sin6_addr.s6_addr[12],
1139 		    addrs[0].sin6_port,
1140 		    0, NULL);
1141 	} else {
1142 		inp = in6_pcblookup_hash(&tcbinfo[0],
1143 		    &addrs[1].sin6_addr, addrs[1].sin6_port,
1144 		    &addrs[0].sin6_addr, addrs[0].sin6_port,
1145 		    0, NULL);
1146 	}
1147 	if (inp == NULL || inp->inp_socket == NULL) {
1148 		error = ENOENT;
1149 		goto out;
1150 	}
1151 	error = SYSCTL_OUT(req, inp->inp_socket->so_cred, sizeof(struct ucred));
1152 out:
1153 	splx(s);
1154 	return (error);
1155 }
1156 
1157 SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred, (CTLTYPE_OPAQUE | CTLFLAG_RW),
1158 	    0, 0,
1159 	    tcp6_getcred, "S,ucred", "Get the ucred of a TCP6 connection");
1160 #endif
1161 
1162 void
1163 tcp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
1164 {
1165 	struct ip *ip = vip;
1166 	struct tcphdr *th;
1167 	struct in_addr faddr;
1168 	struct inpcb *inp;
1169 	struct tcpcb *tp;
1170 	void (*notify)(struct inpcb *, int) = tcp_notify;
1171 	tcp_seq icmp_seq;
1172 	int cpu;
1173 	int s;
1174 
1175 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
1176 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1177 		return;
1178 
1179 	if (cmd == PRC_QUENCH)
1180 		notify = tcp_quench;
1181 	else if (icmp_may_rst &&
1182 		 (cmd == PRC_UNREACH_ADMIN_PROHIB || cmd == PRC_UNREACH_PORT ||
1183 		  cmd == PRC_TIMXCEED_INTRANS) &&
1184 		 ip != NULL)
1185 		notify = tcp_drop_syn_sent;
1186 	else if (cmd == PRC_MSGSIZE)
1187 		notify = tcp_mtudisc;
1188 	else if (PRC_IS_REDIRECT(cmd)) {
1189 		ip = NULL;
1190 		notify = in_rtchange;
1191 	} else if (cmd == PRC_HOSTDEAD)
1192 		ip = NULL;
1193 	else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
1194 		return;
1195 	if (ip != NULL) {
1196 		s = splnet();
1197 		th = (struct tcphdr *)((caddr_t)ip +
1198 				       (IP_VHL_HL(ip->ip_vhl) << 2));
1199 		cpu = tcp_addrcpu(faddr.s_addr, th->th_dport,
1200 				  ip->ip_src.s_addr, th->th_sport);
1201 		inp = in_pcblookup_hash(&tcbinfo[cpu], faddr, th->th_dport,
1202 					ip->ip_src, th->th_sport, 0, NULL);
1203 		if ((inp != NULL) && (inp->inp_socket != NULL)) {
1204 			icmp_seq = htonl(th->th_seq);
1205 			tp = intotcpcb(inp);
1206 			if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
1207 			    SEQ_LT(icmp_seq, tp->snd_max))
1208 				(*notify)(inp, inetctlerrmap[cmd]);
1209 		} else {
1210 			struct in_conninfo inc;
1211 
1212 			inc.inc_fport = th->th_dport;
1213 			inc.inc_lport = th->th_sport;
1214 			inc.inc_faddr = faddr;
1215 			inc.inc_laddr = ip->ip_src;
1216 #ifdef INET6
1217 			inc.inc_isipv6 = 0;
1218 #endif
1219 			syncache_unreach(&inc, th);
1220 		}
1221 		splx(s);
1222 	} else {
1223 		for (cpu = 0; cpu < ncpus2; cpu++) {
1224 			in_pcbnotifyall(&tcbinfo[cpu].pcblisthead, faddr,
1225 					inetctlerrmap[cmd], notify);
1226 		}
1227 	}
1228 }
1229 
1230 #ifdef INET6
1231 void
1232 tcp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
1233 {
1234 	struct tcphdr th;
1235 	void (*notify) (struct inpcb *, int) = tcp_notify;
1236 	struct ip6_hdr *ip6;
1237 	struct mbuf *m;
1238 	struct ip6ctlparam *ip6cp = NULL;
1239 	const struct sockaddr_in6 *sa6_src = NULL;
1240 	int off;
1241 	struct tcp_portonly {
1242 		u_int16_t th_sport;
1243 		u_int16_t th_dport;
1244 	} *thp;
1245 
1246 	if (sa->sa_family != AF_INET6 ||
1247 	    sa->sa_len != sizeof(struct sockaddr_in6))
1248 		return;
1249 
1250 	if (cmd == PRC_QUENCH)
1251 		notify = tcp_quench;
1252 	else if (cmd == PRC_MSGSIZE)
1253 		notify = tcp_mtudisc;
1254 	else if (!PRC_IS_REDIRECT(cmd) &&
1255 		 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1256 		return;
1257 
1258 	/* if the parameter is from icmp6, decode it. */
1259 	if (d != NULL) {
1260 		ip6cp = (struct ip6ctlparam *)d;
1261 		m = ip6cp->ip6c_m;
1262 		ip6 = ip6cp->ip6c_ip6;
1263 		off = ip6cp->ip6c_off;
1264 		sa6_src = ip6cp->ip6c_src;
1265 	} else {
1266 		m = NULL;
1267 		ip6 = NULL;
1268 		off = 0;	/* fool gcc */
1269 		sa6_src = &sa6_any;
1270 	}
1271 
1272 	if (ip6 != NULL) {
1273 		struct in_conninfo inc;
1274 		/*
1275 		 * XXX: We assume that when IPV6 is non NULL,
1276 		 * M and OFF are valid.
1277 		 */
1278 
1279 		/* check if we can safely examine src and dst ports */
1280 		if (m->m_pkthdr.len < off + sizeof *thp)
1281 			return;
1282 
1283 		bzero(&th, sizeof th);
1284 		m_copydata(m, off, sizeof *thp, (caddr_t)&th);
1285 
1286 		in6_pcbnotify(&tcbinfo[0].pcblisthead, sa, th.th_dport,
1287 		    (struct sockaddr *)ip6cp->ip6c_src,
1288 		    th.th_sport, cmd, notify);
1289 
1290 		inc.inc_fport = th.th_dport;
1291 		inc.inc_lport = th.th_sport;
1292 		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
1293 		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
1294 		inc.inc_isipv6 = 1;
1295 		syncache_unreach(&inc, &th);
1296 	} else
1297 		in6_pcbnotify(&tcbinfo[0].pcblisthead, sa, 0,
1298 		    (const struct sockaddr *)sa6_src, 0, cmd, notify);
1299 }
1300 #endif
1301 
1302 /*
1303  * Following is where TCP initial sequence number generation occurs.
1304  *
1305  * There are two places where we must use initial sequence numbers:
1306  * 1.  In SYN-ACK packets.
1307  * 2.  In SYN packets.
1308  *
1309  * All ISNs for SYN-ACK packets are generated by the syncache.  See
1310  * tcp_syncache.c for details.
1311  *
1312  * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
1313  * depends on this property.  In addition, these ISNs should be
1314  * unguessable so as to prevent connection hijacking.  To satisfy
1315  * the requirements of this situation, the algorithm outlined in
1316  * RFC 1948 is used to generate sequence numbers.
1317  *
1318  * Implementation details:
1319  *
1320  * Time is based off the system timer, and is corrected so that it
1321  * increases by one megabyte per second.  This allows for proper
1322  * recycling on high speed LANs while still leaving over an hour
1323  * before rollover.
1324  *
1325  * net.inet.tcp.isn_reseed_interval controls the number of seconds
1326  * between seeding of isn_secret.  This is normally set to zero,
1327  * as reseeding should not be necessary.
1328  *
1329  */
1330 
1331 #define	ISN_BYTES_PER_SECOND 1048576
1332 
1333 u_char isn_secret[32];
1334 int isn_last_reseed;
1335 MD5_CTX isn_ctx;
1336 
1337 tcp_seq
1338 tcp_new_isn(struct tcpcb *tp)
1339 {
1340 	u_int32_t md5_buffer[4];
1341 	tcp_seq new_isn;
1342 
1343 	/* Seed if this is the first use, reseed if requested. */
1344 	if ((isn_last_reseed == 0) || ((tcp_isn_reseed_interval > 0) &&
1345 	     (((u_int)isn_last_reseed + (u_int)tcp_isn_reseed_interval*hz)
1346 		< (u_int)ticks))) {
1347 		read_random_unlimited(&isn_secret, sizeof isn_secret);
1348 		isn_last_reseed = ticks;
1349 	}
1350 
1351 	/* Compute the md5 hash and return the ISN. */
1352 	MD5Init(&isn_ctx);
1353 	MD5Update(&isn_ctx, (u_char *)&tp->t_inpcb->inp_fport, sizeof(u_short));
1354 	MD5Update(&isn_ctx, (u_char *)&tp->t_inpcb->inp_lport, sizeof(u_short));
1355 #ifdef INET6
1356 	if (tp->t_inpcb->inp_vflag & INP_IPV6) {
1357 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
1358 			  sizeof(struct in6_addr));
1359 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
1360 			  sizeof(struct in6_addr));
1361 	} else
1362 #endif
1363 	{
1364 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
1365 			  sizeof(struct in_addr));
1366 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
1367 			  sizeof(struct in_addr));
1368 	}
1369 	MD5Update(&isn_ctx, (u_char *) &isn_secret, sizeof(isn_secret));
1370 	MD5Final((u_char *) &md5_buffer, &isn_ctx);
1371 	new_isn = (tcp_seq) md5_buffer[0];
1372 	new_isn += ticks * (ISN_BYTES_PER_SECOND / hz);
1373 	return (new_isn);
1374 }
1375 
1376 /*
1377  * When a source quench is received, close congestion window
1378  * to one segment.  We will gradually open it again as we proceed.
1379  */
1380 void
1381 tcp_quench(struct inpcb *inp, int errno)
1382 {
1383 	struct tcpcb *tp = intotcpcb(inp);
1384 
1385 	if (tp != NULL)
1386 		tp->snd_cwnd = tp->t_maxseg;
1387 }
1388 
1389 /*
1390  * When a specific ICMP unreachable message is received and the
1391  * connection state is SYN-SENT, drop the connection.  This behavior
1392  * is controlled by the icmp_may_rst sysctl.
1393  */
1394 void
1395 tcp_drop_syn_sent(struct inpcb *inp, int errno)
1396 {
1397 	struct tcpcb *tp = intotcpcb(inp);
1398 
1399 	if ((tp != NULL) && (tp->t_state == TCPS_SYN_SENT))
1400 		tcp_drop(tp, errno);
1401 }
1402 
1403 /*
1404  * When `need fragmentation' ICMP is received, update our idea of the MSS
1405  * based on the new value in the route.  Also nudge TCP to send something,
1406  * since we know the packet we just sent was dropped.
1407  * This duplicates some code in the tcp_mss() function in tcp_input.c.
1408  */
1409 void
1410 tcp_mtudisc(struct inpcb *inp, int errno)
1411 {
1412 	struct tcpcb *tp = intotcpcb(inp);
1413 	struct rtentry *rt;
1414 	struct rmxp_tao *taop;
1415 	struct socket *so = inp->inp_socket;
1416 	int offered;
1417 	int mss;
1418 #ifdef INET6
1419 	boolean_t isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0);
1420 #else
1421 	const boolean_t isipv6 = FALSE;
1422 #endif
1423 
1424 	if (tp != NULL) {
1425 		if (isipv6)
1426 			rt = tcp_rtlookup6(&inp->inp_inc);
1427 		else
1428 			rt = tcp_rtlookup(&inp->inp_inc);
1429 		if (rt == NULL || rt->rt_rmx.rmx_mtu == 0) {
1430 			tp->t_maxopd = tp->t_maxseg =
1431 			    isipv6 ? tcp_v6mssdflt : tcp_mssdflt;
1432 			return;
1433 		}
1434 		taop = rmx_taop(rt->rt_rmx);
1435 		offered = taop->tao_mssopt;
1436 		mss = rt->rt_rmx.rmx_mtu -
1437 			(isipv6 ?
1438 			 sizeof(struct ip6_hdr) + sizeof(struct tcphdr) :
1439 			 sizeof(struct tcpiphdr));
1440 
1441 		if (offered != 0)
1442 			mss = min(mss, offered);
1443 		/*
1444 		 * XXX - The above conditional probably violates the TCP
1445 		 * spec.  The problem is that, since we don't know the
1446 		 * other end's MSS, we are supposed to use a conservative
1447 		 * default.  But, if we do that, then MTU discovery will
1448 		 * never actually take place, because the conservative
1449 		 * default is much less than the MTUs typically seen
1450 		 * on the Internet today.  For the moment, we'll sweep
1451 		 * this under the carpet.
1452 		 *
1453 		 * The conservative default might not actually be a problem
1454 		 * if the only case this occurs is when sending an initial
1455 		 * SYN with options and data to a host we've never talked
1456 		 * to before.  Then, they will reply with an MSS value which
1457 		 * will get recorded and the new parameters should get
1458 		 * recomputed.  For Further Study.
1459 		 */
1460 		if (tp->t_maxopd <= mss)
1461 			return;
1462 		tp->t_maxopd = mss;
1463 
1464 		if ((tp->t_flags & (TF_REQ_TSTMP | TF_NOOPT)) == TF_REQ_TSTMP &&
1465 		    (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
1466 			mss -= TCPOLEN_TSTAMP_APPA;
1467 		if ((tp->t_flags & (TF_REQ_CC | TF_NOOPT)) == TF_REQ_CC &&
1468 		    (tp->t_flags & TF_RCVD_CC) == TF_RCVD_CC)
1469 			mss -= TCPOLEN_CC_APPA;
1470 #if	(MCLBYTES & (MCLBYTES - 1)) == 0
1471 		if (mss > MCLBYTES)
1472 			mss &= ~(MCLBYTES - 1);
1473 #else
1474 		if (mss > MCLBYTES)
1475 			mss = mss / MCLBYTES * MCLBYTES;
1476 #endif
1477 		if (so->so_snd.sb_hiwat < mss)
1478 			mss = so->so_snd.sb_hiwat;
1479 
1480 		tp->t_maxseg = mss;
1481 
1482 		tcpstat.tcps_mturesent++;
1483 		tp->t_rtttime = 0;
1484 		tp->snd_nxt = tp->snd_una;
1485 		tcp_output(tp);
1486 	}
1487 }
1488 
1489 /*
1490  * Look-up the routing entry to the peer of this inpcb.  If no route
1491  * is found and it cannot be allocated the return NULL.  This routine
1492  * is called by TCP routines that access the rmx structure and by tcp_mss
1493  * to get the interface MTU.
1494  */
1495 struct rtentry *
1496 tcp_rtlookup(struct in_conninfo *inc)
1497 {
1498 	struct route *ro;
1499 	struct rtentry *rt;
1500 
1501 	ro = &inc->inc_route;
1502 	rt = ro->ro_rt;
1503 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1504 		/* No route yet, so try to acquire one */
1505 		if (inc->inc_faddr.s_addr != INADDR_ANY) {
1506 			ro->ro_dst.sa_family = AF_INET;
1507 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
1508 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
1509 			    inc->inc_faddr;
1510 			rtalloc(ro);
1511 			rt = ro->ro_rt;
1512 		}
1513 	}
1514 	return (rt);
1515 }
1516 
1517 #ifdef INET6
1518 struct rtentry *
1519 tcp_rtlookup6(struct in_conninfo *inc)
1520 {
1521 	struct route_in6 *ro6;
1522 	struct rtentry *rt;
1523 
1524 	ro6 = &inc->inc6_route;
1525 	rt = ro6->ro_rt;
1526 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
1527 		/* No route yet, so try to acquire one */
1528 		if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
1529 			ro6->ro_dst.sin6_family = AF_INET6;
1530 			ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
1531 			ro6->ro_dst.sin6_addr = inc->inc6_faddr;
1532 			rtalloc((struct route *)ro6);
1533 			rt = ro6->ro_rt;
1534 		}
1535 	}
1536 	return (rt);
1537 }
1538 #endif
1539 
1540 #ifdef IPSEC
1541 /* compute ESP/AH header size for TCP, including outer IP header. */
1542 size_t
1543 ipsec_hdrsiz_tcp(struct tcpcb *tp)
1544 {
1545 	struct inpcb *inp;
1546 	struct mbuf *m;
1547 	size_t hdrsiz;
1548 	struct ip *ip;
1549 	struct tcphdr *th;
1550 
1551 	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
1552 		return (0);
1553 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1554 	if (!m)
1555 		return (0);
1556 
1557 #ifdef INET6
1558 	if (inp->inp_vflag & INP_IPV6) {
1559 		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1560 
1561 		th = (struct tcphdr *)(ip6 + 1);
1562 		m->m_pkthdr.len = m->m_len =
1563 		    sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
1564 		tcp_fillheaders(tp, ip6, th);
1565 		hdrsiz = ipsec6_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1566 	} else
1567 #endif
1568 	{
1569 		ip = mtod(m, struct ip *);
1570 		th = (struct tcphdr *)(ip + 1);
1571 		m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
1572 		tcp_fillheaders(tp, ip, th);
1573 		hdrsiz = ipsec4_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
1574 	}
1575 
1576 	m_free(m);
1577 	return (hdrsiz);
1578 }
1579 #endif
1580 
1581 /*
1582  * Return a pointer to the cached information about the remote host.
1583  * The cached information is stored in the protocol specific part of
1584  * the route metrics.
1585  */
1586 struct rmxp_tao *
1587 tcp_gettaocache(struct in_conninfo *inc)
1588 {
1589 	struct rtentry *rt;
1590 
1591 #ifdef INET6
1592 	if (inc->inc_isipv6)
1593 		rt = tcp_rtlookup6(inc);
1594 	else
1595 #endif
1596 		rt = tcp_rtlookup(inc);
1597 
1598 	/* Make sure this is a host route and is up. */
1599 	if (rt == NULL ||
1600 	    (rt->rt_flags & (RTF_UP | RTF_HOST)) != (RTF_UP | RTF_HOST))
1601 		return (NULL);
1602 
1603 	return (rmx_taop(rt->rt_rmx));
1604 }
1605 
1606 /*
1607  * Clear all the TAO cache entries, called from tcp_init.
1608  *
1609  * XXX
1610  * This routine is just an empty one, because we assume that the routing
1611  * routing tables are initialized at the same time when TCP, so there is
1612  * nothing in the cache left over.
1613  */
1614 static void
1615 tcp_cleartaocache()
1616 {
1617 }
1618 
1619 /*
1620  * TCP BANDWIDTH DELAY PRODUCT WINDOW LIMITING
1621  *
1622  * This code attempts to calculate the bandwidth-delay product as a
1623  * means of determining the optimal window size to maximize bandwidth,
1624  * minimize RTT, and avoid the over-allocation of buffers on interfaces and
1625  * routers.  This code also does a fairly good job keeping RTTs in check
1626  * across slow links like modems.  We implement an algorithm which is very
1627  * similar (but not meant to be) TCP/Vegas.  The code operates on the
1628  * transmitter side of a TCP connection and so only effects the transmit
1629  * side of the connection.
1630  *
1631  * BACKGROUND:  TCP makes no provision for the management of buffer space
1632  * at the end points or at the intermediate routers and switches.  A TCP
1633  * stream, whether using NewReno or not, will eventually buffer as
1634  * many packets as it is able and the only reason this typically works is
1635  * due to the fairly small default buffers made available for a connection
1636  * (typicaly 16K or 32K).  As machines use larger windows and/or window
1637  * scaling it is now fairly easy for even a single TCP connection to blow-out
1638  * all available buffer space not only on the local interface, but on
1639  * intermediate routers and switches as well.  NewReno makes a misguided
1640  * attempt to 'solve' this problem by waiting for an actual failure to occur,
1641  * then backing off, then steadily increasing the window again until another
1642  * failure occurs, ad-infinitum.  This results in terrible oscillation that
1643  * is only made worse as network loads increase and the idea of intentionally
1644  * blowing out network buffers is, frankly, a terrible way to manage network
1645  * resources.
1646  *
1647  * It is far better to limit the transmit window prior to the failure
1648  * condition being achieved.  There are two general ways to do this:  First
1649  * you can 'scan' through different transmit window sizes and locate the
1650  * point where the RTT stops increasing, indicating that you have filled the
1651  * pipe, then scan backwards until you note that RTT stops decreasing, then
1652  * repeat ad-infinitum.  This method works in principle but has severe
1653  * implementation issues due to RTT variances, timer granularity, and
1654  * instability in the algorithm which can lead to many false positives and
1655  * create oscillations as well as interact badly with other TCP streams
1656  * implementing the same algorithm.
1657  *
1658  * The second method is to limit the window to the bandwidth delay product
1659  * of the link.  This is the method we implement.  RTT variances and our
1660  * own manipulation of the congestion window, bwnd, can potentially
1661  * destabilize the algorithm.  For this reason we have to stabilize the
1662  * elements used to calculate the window.  We do this by using the minimum
1663  * observed RTT, the long term average of the observed bandwidth, and
1664  * by adding two segments worth of slop.  It isn't perfect but it is able
1665  * to react to changing conditions and gives us a very stable basis on
1666  * which to extend the algorithm.
1667  */
1668 void
1669 tcp_xmit_bandwidth_limit(struct tcpcb *tp, tcp_seq ack_seq)
1670 {
1671 	u_long bw;
1672 	u_long bwnd;
1673 	int save_ticks;
1674 
1675 	/*
1676 	 * If inflight_enable is disabled in the middle of a tcp connection,
1677 	 * make sure snd_bwnd is effectively disabled.
1678 	 */
1679 	if (!tcp_inflight_enable) {
1680 		tp->snd_bwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
1681 		tp->snd_bandwidth = 0;
1682 		return;
1683 	}
1684 
1685 	/*
1686 	 * Figure out the bandwidth.  Due to the tick granularity this
1687 	 * is a very rough number and it MUST be averaged over a fairly
1688 	 * long period of time.  XXX we need to take into account a link
1689 	 * that is not using all available bandwidth, but for now our
1690 	 * slop will ramp us up if this case occurs and the bandwidth later
1691 	 * increases.
1692 	 *
1693 	 * Note: if ticks rollover 'bw' may wind up negative.  We must
1694 	 * effectively reset t_bw_rtttime for this case.
1695 	 */
1696 	save_ticks = ticks;
1697 	if ((u_int)(save_ticks - tp->t_bw_rtttime) < 1)
1698 		return;
1699 
1700 	bw = (int64_t)(ack_seq - tp->t_bw_rtseq) * hz /
1701 	    (save_ticks - tp->t_bw_rtttime);
1702 	tp->t_bw_rtttime = save_ticks;
1703 	tp->t_bw_rtseq = ack_seq;
1704 	if (tp->t_bw_rtttime == 0 || (int)bw < 0)
1705 		return;
1706 	bw = ((int64_t)tp->snd_bandwidth * 15 + bw) >> 4;
1707 
1708 	tp->snd_bandwidth = bw;
1709 
1710 	/*
1711 	 * Calculate the semi-static bandwidth delay product, plus two maximal
1712 	 * segments.  The additional slop puts us squarely in the sweet
1713 	 * spot and also handles the bandwidth run-up case.  Without the
1714 	 * slop we could be locking ourselves into a lower bandwidth.
1715 	 *
1716 	 * Situations Handled:
1717 	 *	(1) Prevents over-queueing of packets on LANs, especially on
1718 	 *	    high speed LANs, allowing larger TCP buffers to be
1719 	 *	    specified, and also does a good job preventing
1720 	 *	    over-queueing of packets over choke points like modems
1721 	 *	    (at least for the transmit side).
1722 	 *
1723 	 *	(2) Is able to handle changing network loads (bandwidth
1724 	 *	    drops so bwnd drops, bandwidth increases so bwnd
1725 	 *	    increases).
1726 	 *
1727 	 *	(3) Theoretically should stabilize in the face of multiple
1728 	 *	    connections implementing the same algorithm (this may need
1729 	 *	    a little work).
1730 	 *
1731 	 *	(4) Stability value (defaults to 20 = 2 maximal packets) can
1732 	 *	    be adjusted with a sysctl but typically only needs to be on
1733 	 *	    very slow connections.  A value no smaller then 5 should
1734 	 *	    be used, but only reduce this default if you have no other
1735 	 *	    choice.
1736 	 */
1737 
1738 #define	USERTT	((tp->t_srtt + tp->t_rttbest) / 2)
1739 	bwnd = (int64_t)bw * USERTT / (hz << TCP_RTT_SHIFT) +
1740 	       tcp_inflight_stab * (int)tp->t_maxseg / 10;
1741 #undef USERTT
1742 
1743 	if (tcp_inflight_debug > 0) {
1744 		static int ltime;
1745 		if ((u_int)(ticks - ltime) >= hz / tcp_inflight_debug) {
1746 			ltime = ticks;
1747 			printf("%p bw %ld rttbest %d srtt %d bwnd %ld\n",
1748 				tp, bw, tp->t_rttbest, tp->t_srtt, bwnd);
1749 		}
1750 	}
1751 	if ((long)bwnd < tcp_inflight_min)
1752 		bwnd = tcp_inflight_min;
1753 	if (bwnd > tcp_inflight_max)
1754 		bwnd = tcp_inflight_max;
1755 	if ((long)bwnd < tp->t_maxseg * 2)
1756 		bwnd = tp->t_maxseg * 2;
1757 	tp->snd_bwnd = bwnd;
1758 }
1759