1 /* $NetBSD: tcp_input.c,v 1.72 1998/12/18 21:38:02 thorpej Exp $ */ 2 3 /*- 4 * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation 9 * Facility, NASA Ames Research Center. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 42 * The Regents of the University of California. All rights reserved. 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 3. All advertising materials mentioning features or use of this software 53 * must display the following acknowledgement: 54 * This product includes software developed by the University of 55 * California, Berkeley and its contributors. 56 * 4. Neither the name of the University nor the names of its contributors 57 * may be used to endorse or promote products derived from this software 58 * without specific prior written permission. 59 * 60 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 61 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 63 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 64 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 65 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 66 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 67 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 68 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 69 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 70 * SUCH DAMAGE. 71 * 72 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 73 */ 74 75 /* 76 * TODO list for SYN cache stuff: 77 * 78 * Find room for a "state" field, which is needed to keep a 79 * compressed state for TIME_WAIT TCBs. It's been noted already 80 * that this is fairly important for very high-volume web and 81 * mail servers, which use a large number of short-lived 82 * connections. 83 */ 84 85 #include <sys/param.h> 86 #include <sys/systm.h> 87 #include <sys/malloc.h> 88 #include <sys/mbuf.h> 89 #include <sys/protosw.h> 90 #include <sys/socket.h> 91 #include <sys/socketvar.h> 92 #include <sys/errno.h> 93 #include <sys/syslog.h> 94 #include <sys/pool.h> 95 96 #include <net/if.h> 97 #include <net/route.h> 98 99 #include <netinet/in.h> 100 #include <netinet/in_systm.h> 101 #include <netinet/ip.h> 102 #include <netinet/in_pcb.h> 103 #include <netinet/ip_var.h> 104 #include <netinet/tcp.h> 105 #include <netinet/tcp_fsm.h> 106 #include <netinet/tcp_seq.h> 107 #include <netinet/tcp_timer.h> 108 #include <netinet/tcp_var.h> 109 #include <netinet/tcpip.h> 110 #include <netinet/tcp_debug.h> 111 112 #include <machine/stdarg.h> 113 114 int tcprexmtthresh = 3; 115 struct tcpiphdr tcp_saveti; 116 117 extern u_long sb_max; 118 119 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 120 121 /* for modulo comparisons of timestamps */ 122 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 123 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 124 125 /* 126 * Macro to compute ACK transmission behavior. Delay the ACK unless 127 * we have already delayed an ACK (must send an ACK every two segments). 128 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 129 * option is enabled. 130 */ 131 #define TCP_SETUP_ACK(tp, ti) \ 132 do { \ 133 if ((tp)->t_flags & TF_DELACK || \ 134 (tcp_ack_on_push && (ti)->ti_flags & TH_PUSH)) \ 135 tp->t_flags |= TF_ACKNOW; \ 136 else \ 137 TCP_SET_DELACK(tp); \ 138 } while (0) 139 140 /* 141 * Insert segment ti into reassembly queue of tcp with 142 * control block tp. Return TH_FIN if reassembly now includes 143 * a segment with FIN. The macro form does the common case inline 144 * (segment is the next to be received on an established connection, 145 * and the queue is empty), avoiding linkage into and removal 146 * from the queue and repetition of various conversions. 147 * Set DELACK for segments received in order, but ack immediately 148 * when segments are out of order (so fast retransmit can work). 149 */ 150 #define TCP_REASS(tp, ti, m, so, flags) { \ 151 TCP_REASS_LOCK((tp)); \ 152 if ((ti)->ti_seq == (tp)->rcv_nxt && \ 153 (tp)->segq.lh_first == NULL && \ 154 (tp)->t_state == TCPS_ESTABLISHED) { \ 155 TCP_SETUP_ACK(tp, ti); \ 156 (tp)->rcv_nxt += (ti)->ti_len; \ 157 flags = (ti)->ti_flags & TH_FIN; \ 158 tcpstat.tcps_rcvpack++;\ 159 tcpstat.tcps_rcvbyte += (ti)->ti_len;\ 160 sbappend(&(so)->so_rcv, (m)); \ 161 sorwakeup(so); \ 162 } else { \ 163 (flags) = tcp_reass((tp), (ti), (m)); \ 164 tp->t_flags |= TF_ACKNOW; \ 165 } \ 166 TCP_REASS_UNLOCK((tp)); \ 167 } 168 169 int 170 tcp_reass(tp, ti, m) 171 register struct tcpcb *tp; 172 register struct tcpiphdr *ti; 173 struct mbuf *m; 174 { 175 register struct ipqent *p, *q, *nq, *tiqe = NULL; 176 struct socket *so = tp->t_inpcb->inp_socket; 177 int pkt_flags; 178 tcp_seq pkt_seq; 179 unsigned pkt_len; 180 u_long rcvpartdupbyte = 0; 181 u_long rcvoobyte; 182 183 TCP_REASS_LOCK_CHECK(tp); 184 185 /* 186 * Call with ti==0 after become established to 187 * force pre-ESTABLISHED data up to user socket. 188 */ 189 if (ti == 0) 190 goto present; 191 192 rcvoobyte = ti->ti_len; 193 /* 194 * Copy these to local variables because the tcpiphdr 195 * gets munged while we are collapsing mbufs. 196 */ 197 pkt_seq = ti->ti_seq; 198 pkt_len = ti->ti_len; 199 pkt_flags = ti->ti_flags; 200 /* 201 * Find a segment which begins after this one does. 202 */ 203 for (p = NULL, q = tp->segq.lh_first; q != NULL; q = nq) { 204 nq = q->ipqe_q.le_next; 205 /* 206 * If the received segment is just right after this 207 * fragment, merge the two together and then check 208 * for further overlaps. 209 */ 210 if (q->ipqe_seq + q->ipqe_len == pkt_seq) { 211 #ifdef TCPREASS_DEBUG 212 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n", 213 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 214 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len); 215 #endif 216 pkt_len += q->ipqe_len; 217 pkt_flags |= q->ipqe_flags; 218 pkt_seq = q->ipqe_seq; 219 m_cat(q->ipqe_m, m); 220 m = q->ipqe_m; 221 goto free_ipqe; 222 } 223 /* 224 * If the received segment is completely past this 225 * fragment, we need to go the next fragment. 226 */ 227 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 228 p = q; 229 continue; 230 } 231 /* 232 * If the fragment is past the received segment, 233 * it (or any following) can't be concatenated. 234 */ 235 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) 236 break; 237 /* 238 * We've received all the data in this segment before. 239 * mark it as a duplicate and return. 240 */ 241 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) && 242 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 243 tcpstat.tcps_rcvduppack++; 244 tcpstat.tcps_rcvdupbyte += pkt_len; 245 m_freem(m); 246 if (tiqe != NULL) 247 pool_put(&ipqent_pool, tiqe); 248 return (0); 249 } 250 /* 251 * Received segment completely overlaps this fragment 252 * so we drop the fragment (this keeps the temporal 253 * ordering of segments correct). 254 */ 255 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) && 256 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 257 rcvpartdupbyte += q->ipqe_len; 258 m_freem(q->ipqe_m); 259 goto free_ipqe; 260 } 261 /* 262 * RX'ed segment extends past the end of the 263 * fragment. Drop the overlapping bytes. Then 264 * merge the fragment and segment then treat as 265 * a longer received packet. 266 */ 267 if (SEQ_LT(q->ipqe_seq, pkt_seq) 268 && SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 269 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq; 270 #ifdef TCPREASS_DEBUG 271 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n", 272 tp, overlap, 273 pkt_seq, pkt_seq + pkt_len, pkt_len); 274 #endif 275 m_adj(m, overlap); 276 rcvpartdupbyte += overlap; 277 m_cat(q->ipqe_m, m); 278 m = q->ipqe_m; 279 pkt_seq = q->ipqe_seq; 280 pkt_len += q->ipqe_len - overlap; 281 rcvoobyte -= overlap; 282 goto free_ipqe; 283 } 284 /* 285 * RX'ed segment extends past the front of the 286 * fragment. Drop the overlapping bytes on the 287 * received packet. The packet will then be 288 * contatentated with this fragment a bit later. 289 */ 290 if (SEQ_GT(q->ipqe_seq, pkt_seq) 291 && SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) { 292 int overlap = pkt_seq + pkt_len - q->ipqe_seq; 293 #ifdef TCPREASS_DEBUG 294 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n", 295 tp, overlap, 296 pkt_seq, pkt_seq + pkt_len, pkt_len); 297 #endif 298 m_adj(m, -overlap); 299 pkt_len -= overlap; 300 rcvpartdupbyte += overlap; 301 rcvoobyte -= overlap; 302 } 303 /* 304 * If the received segment immediates precedes this 305 * fragment then tack the fragment onto this segment 306 * and reinsert the data. 307 */ 308 if (q->ipqe_seq == pkt_seq + pkt_len) { 309 #ifdef TCPREASS_DEBUG 310 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n", 311 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len, 312 pkt_seq, pkt_seq + pkt_len, pkt_len); 313 #endif 314 pkt_len += q->ipqe_len; 315 pkt_flags |= q->ipqe_flags; 316 m_cat(m, q->ipqe_m); 317 LIST_REMOVE(q, ipqe_q); 318 LIST_REMOVE(q, ipqe_timeq); 319 if (tiqe == NULL) { 320 tiqe = q; 321 } else { 322 pool_put(&ipqent_pool, q); 323 } 324 break; 325 } 326 /* 327 * If the fragment is before the segment, remember it. 328 * When this loop is terminated, p will contain the 329 * pointer to fragment that is right before the received 330 * segment. 331 */ 332 if (SEQ_LEQ(q->ipqe_seq, pkt_seq)) 333 p = q; 334 335 continue; 336 337 /* 338 * This is a common operation. It also will allow 339 * to save doing a malloc/free in most instances. 340 */ 341 free_ipqe: 342 LIST_REMOVE(q, ipqe_q); 343 LIST_REMOVE(q, ipqe_timeq); 344 if (tiqe == NULL) { 345 tiqe = q; 346 } else { 347 pool_put(&ipqent_pool, q); 348 } 349 } 350 351 /* 352 * Allocate a new queue entry since the received segment did not 353 * collapse onto any other out-of-order block; thus we are allocating 354 * a new block. If it had collapsed, tiqe would not be NULL and 355 * we would be reusing it. 356 * XXX If we can't, just drop the packet. XXX 357 */ 358 if (tiqe == NULL) { 359 tiqe = pool_get(&ipqent_pool, PR_NOWAIT); 360 if (tiqe == NULL) { 361 tcpstat.tcps_rcvmemdrop++; 362 m_freem(m); 363 return (0); 364 } 365 } 366 367 /* 368 * Update the counters. 369 */ 370 tcpstat.tcps_rcvoopack++; 371 tcpstat.tcps_rcvoobyte += rcvoobyte; 372 if (rcvpartdupbyte) { 373 tcpstat.tcps_rcvpartduppack++; 374 tcpstat.tcps_rcvpartdupbyte += rcvpartdupbyte; 375 } 376 377 /* 378 * Insert the new fragment queue entry into both queues. 379 */ 380 tiqe->ipqe_m = m; 381 tiqe->ipqe_seq = pkt_seq; 382 tiqe->ipqe_len = pkt_len; 383 tiqe->ipqe_flags = pkt_flags; 384 if (p == NULL) { 385 LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q); 386 #ifdef TCPREASS_DEBUG 387 if (tiqe->ipqe_seq != tp->rcv_nxt) 388 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n", 389 tp, pkt_seq, pkt_seq + pkt_len, pkt_len); 390 #endif 391 } else { 392 LIST_INSERT_AFTER(p, tiqe, ipqe_q); 393 #ifdef TCPREASS_DEBUG 394 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n", 395 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 396 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len); 397 #endif 398 } 399 400 LIST_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq); 401 402 present: 403 /* 404 * Present data to user, advancing rcv_nxt through 405 * completed sequence space. 406 */ 407 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 408 return (0); 409 q = tp->segq.lh_first; 410 if (q == NULL || q->ipqe_seq != tp->rcv_nxt) 411 return (0); 412 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len) 413 return (0); 414 415 tp->rcv_nxt += q->ipqe_len; 416 pkt_flags = q->ipqe_flags & TH_FIN; 417 418 LIST_REMOVE(q, ipqe_q); 419 LIST_REMOVE(q, ipqe_timeq); 420 if (so->so_state & SS_CANTRCVMORE) 421 m_freem(q->ipqe_m); 422 else 423 sbappend(&so->so_rcv, q->ipqe_m); 424 pool_put(&ipqent_pool, q); 425 sorwakeup(so); 426 return (pkt_flags); 427 } 428 429 /* 430 * TCP input routine, follows pages 65-76 of the 431 * protocol specification dated September, 1981 very closely. 432 */ 433 void 434 #if __STDC__ 435 tcp_input(struct mbuf *m, ...) 436 #else 437 tcp_input(m, va_alist) 438 register struct mbuf *m; 439 #endif 440 { 441 register struct tcpiphdr *ti; 442 register struct inpcb *inp; 443 caddr_t optp = NULL; 444 int optlen = 0; 445 int len, tlen, off, hdroptlen; 446 register struct tcpcb *tp = 0; 447 register int tiflags; 448 struct socket *so = NULL; 449 int todrop, acked, ourfinisacked, needoutput = 0; 450 short ostate = 0; 451 int iss = 0; 452 u_long tiwin; 453 struct tcp_opt_info opti; 454 int iphlen; 455 va_list ap; 456 457 va_start(ap, m); 458 iphlen = va_arg(ap, int); 459 va_end(ap); 460 461 tcpstat.tcps_rcvtotal++; 462 463 opti.ts_present = 0; 464 opti.maxseg = 0; 465 466 /* 467 * Get IP and TCP header together in first mbuf. 468 * Note: IP leaves IP header in first mbuf. 469 */ 470 ti = mtod(m, struct tcpiphdr *); 471 if (iphlen > sizeof (struct ip)) 472 ip_stripoptions(m, (struct mbuf *)0); 473 if (m->m_len < sizeof (struct tcpiphdr)) { 474 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { 475 tcpstat.tcps_rcvshort++; 476 return; 477 } 478 ti = mtod(m, struct tcpiphdr *); 479 } 480 481 /* 482 * Checksum extended TCP header and data. 483 */ 484 tlen = ((struct ip *)ti)->ip_len; 485 len = sizeof (struct ip) + tlen; 486 bzero(ti->ti_x1, sizeof ti->ti_x1); 487 ti->ti_len = (u_int16_t)tlen; 488 HTONS(ti->ti_len); 489 if ((ti->ti_sum = in_cksum(m, len)) != 0) { 490 tcpstat.tcps_rcvbadsum++; 491 goto drop; 492 } 493 494 /* 495 * Check that TCP offset makes sense, 496 * pull out TCP options and adjust length. XXX 497 */ 498 off = ti->ti_off << 2; 499 if (off < sizeof (struct tcphdr) || off > tlen) { 500 tcpstat.tcps_rcvbadoff++; 501 goto drop; 502 } 503 tlen -= off; 504 ti->ti_len = tlen; 505 if (off > sizeof (struct tcphdr)) { 506 if (m->m_len < sizeof(struct ip) + off) { 507 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) { 508 tcpstat.tcps_rcvshort++; 509 return; 510 } 511 ti = mtod(m, struct tcpiphdr *); 512 } 513 optlen = off - sizeof (struct tcphdr); 514 optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr); 515 /* 516 * Do quick retrieval of timestamp options ("options 517 * prediction?"). If timestamp is the only option and it's 518 * formatted as recommended in RFC 1323 appendix A, we 519 * quickly get the values now and not bother calling 520 * tcp_dooptions(), etc. 521 */ 522 if ((optlen == TCPOLEN_TSTAMP_APPA || 523 (optlen > TCPOLEN_TSTAMP_APPA && 524 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 525 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 526 (ti->ti_flags & TH_SYN) == 0) { 527 opti.ts_present = 1; 528 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 529 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 530 optp = NULL; /* we've parsed the options */ 531 } 532 } 533 tiflags = ti->ti_flags; 534 535 /* 536 * Convert TCP protocol specific fields to host format. 537 */ 538 NTOHL(ti->ti_seq); 539 NTOHL(ti->ti_ack); 540 NTOHS(ti->ti_win); 541 NTOHS(ti->ti_urp); 542 543 /* 544 * Locate pcb for segment. 545 */ 546 findpcb: 547 inp = in_pcblookup_connect(&tcbtable, ti->ti_src, ti->ti_sport, 548 ti->ti_dst, ti->ti_dport); 549 if (inp == 0) { 550 ++tcpstat.tcps_pcbhashmiss; 551 inp = in_pcblookup_bind(&tcbtable, ti->ti_dst, ti->ti_dport); 552 if (inp == 0) { 553 ++tcpstat.tcps_noport; 554 goto dropwithreset; 555 } 556 } 557 558 /* 559 * If the state is CLOSED (i.e., TCB does not exist) then 560 * all data in the incoming segment is discarded. 561 * If the TCB exists but is in CLOSED state, it is embryonic, 562 * but should either do a listen or a connect soon. 563 */ 564 tp = intotcpcb(inp); 565 if (tp == 0) 566 goto dropwithreset; 567 if (tp->t_state == TCPS_CLOSED) 568 goto drop; 569 570 /* Unscale the window into a 32-bit value. */ 571 if ((tiflags & TH_SYN) == 0) 572 tiwin = ti->ti_win << tp->snd_scale; 573 else 574 tiwin = ti->ti_win; 575 576 so = inp->inp_socket; 577 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 578 if (so->so_options & SO_DEBUG) { 579 ostate = tp->t_state; 580 tcp_saveti = *ti; 581 } 582 if (so->so_options & SO_ACCEPTCONN) { 583 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 584 if (tiflags & TH_RST) { 585 syn_cache_reset(ti); 586 } else if ((tiflags & (TH_ACK|TH_SYN)) == 587 (TH_ACK|TH_SYN)) { 588 /* 589 * Received a SYN,ACK. This should 590 * never happen while we are in 591 * LISTEN. Send an RST. 592 */ 593 goto badsyn; 594 } else if (tiflags & TH_ACK) { 595 so = syn_cache_get(so, m); 596 if (so == NULL) { 597 /* 598 * We don't have a SYN for 599 * this ACK; send an RST. 600 */ 601 goto badsyn; 602 } else if (so == 603 (struct socket *)(-1)) { 604 /* 605 * We were unable to create 606 * the connection. If the 607 * 3-way handshake was 608 * completed, and RST has 609 * been sent to the peer. 610 * Since the mbuf might be 611 * in use for the reply, 612 * do not free it. 613 */ 614 m = NULL; 615 } else { 616 /* 617 * We have created a 618 * full-blown connection. 619 */ 620 inp = sotoinpcb(so); 621 tp = intotcpcb(inp); 622 tiwin <<= tp->snd_scale; 623 goto after_listen; 624 } 625 } else { 626 /* 627 * None of RST, SYN or ACK was set. 628 * This is an invalid packet for a 629 * TCB in LISTEN state. Send a RST. 630 */ 631 goto badsyn; 632 } 633 } else { 634 /* 635 * Received a SYN. 636 */ 637 if (in_hosteq(ti->ti_src, ti->ti_dst) && 638 ti->ti_sport == ti->ti_dport) { 639 /* 640 * LISTEN socket received a SYN 641 * from itself? This can't possibly 642 * be valid; drop the packet. 643 */ 644 tcpstat.tcps_badsyn++; 645 goto drop; 646 } 647 /* 648 * SYN looks ok; create compressed TCP 649 * state for it. 650 */ 651 if (so->so_qlen <= so->so_qlimit && 652 syn_cache_add(so, m, optp, optlen, &opti)) 653 m = NULL; 654 } 655 goto drop; 656 } 657 } 658 659 after_listen: 660 #ifdef DIAGNOSTIC 661 /* 662 * Should not happen now that all embryonic connections 663 * are handled with compressed state. 664 */ 665 if (tp->t_state == TCPS_LISTEN) 666 panic("tcp_input: TCPS_LISTEN"); 667 #endif 668 669 /* 670 * Segment received on connection. 671 * Reset idle time and keep-alive timer. 672 */ 673 tp->t_idle = 0; 674 if (TCPS_HAVEESTABLISHED(tp->t_state)) 675 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 676 677 /* 678 * Process options. 679 */ 680 if (optp) 681 tcp_dooptions(tp, optp, optlen, ti, &opti); 682 683 /* 684 * Header prediction: check for the two common cases 685 * of a uni-directional data xfer. If the packet has 686 * no control flags, is in-sequence, the window didn't 687 * change and we're not retransmitting, it's a 688 * candidate. If the length is zero and the ack moved 689 * forward, we're the sender side of the xfer. Just 690 * free the data acked & wake any higher level process 691 * that was blocked waiting for space. If the length 692 * is non-zero and the ack didn't move, we're the 693 * receiver side. If we're getting packets in-order 694 * (the reassembly queue is empty), add the data to 695 * the socket buffer and note that we need a delayed ack. 696 */ 697 if (tp->t_state == TCPS_ESTABLISHED && 698 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 699 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 700 ti->ti_seq == tp->rcv_nxt && 701 tiwin && tiwin == tp->snd_wnd && 702 tp->snd_nxt == tp->snd_max) { 703 704 /* 705 * If last ACK falls within this segment's sequence numbers, 706 * record the timestamp. 707 */ 708 if (opti.ts_present && 709 SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) && 710 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len)) { 711 tp->ts_recent_age = tcp_now; 712 tp->ts_recent = opti.ts_val; 713 } 714 715 if (ti->ti_len == 0) { 716 if (SEQ_GT(ti->ti_ack, tp->snd_una) && 717 SEQ_LEQ(ti->ti_ack, tp->snd_max) && 718 tp->snd_cwnd >= tp->snd_wnd && 719 tp->t_dupacks < tcprexmtthresh) { 720 /* 721 * this is a pure ack for outstanding data. 722 */ 723 ++tcpstat.tcps_predack; 724 if (opti.ts_present) 725 tcp_xmit_timer(tp, 726 tcp_now-opti.ts_ecr+1); 727 else if (tp->t_rtt && 728 SEQ_GT(ti->ti_ack, tp->t_rtseq)) 729 tcp_xmit_timer(tp, tp->t_rtt); 730 acked = ti->ti_ack - tp->snd_una; 731 tcpstat.tcps_rcvackpack++; 732 tcpstat.tcps_rcvackbyte += acked; 733 sbdrop(&so->so_snd, acked); 734 tp->snd_una = ti->ti_ack; 735 m_freem(m); 736 737 /* 738 * If all outstanding data are acked, stop 739 * retransmit timer, otherwise restart timer 740 * using current (possibly backed-off) value. 741 * If process is waiting for space, 742 * wakeup/selwakeup/signal. If data 743 * are ready to send, let tcp_output 744 * decide between more output or persist. 745 */ 746 if (tp->snd_una == tp->snd_max) 747 TCP_TIMER_DISARM(tp, TCPT_REXMT); 748 else if (TCP_TIMER_ISARMED(tp, 749 TCPT_PERSIST) == 0) 750 TCP_TIMER_ARM(tp, TCPT_REXMT, 751 tp->t_rxtcur); 752 753 sowwakeup(so); 754 if (so->so_snd.sb_cc) 755 (void) tcp_output(tp); 756 return; 757 } 758 } else if (ti->ti_ack == tp->snd_una && 759 tp->segq.lh_first == NULL && 760 ti->ti_len <= sbspace(&so->so_rcv)) { 761 /* 762 * this is a pure, in-sequence data packet 763 * with nothing on the reassembly queue and 764 * we have enough buffer space to take it. 765 */ 766 ++tcpstat.tcps_preddat; 767 tp->rcv_nxt += ti->ti_len; 768 tcpstat.tcps_rcvpack++; 769 tcpstat.tcps_rcvbyte += ti->ti_len; 770 /* 771 * Drop TCP, IP headers and TCP options then add data 772 * to socket buffer. 773 */ 774 m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); 775 m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); 776 sbappend(&so->so_rcv, m); 777 sorwakeup(so); 778 TCP_SETUP_ACK(tp, ti); 779 if (tp->t_flags & TF_ACKNOW) 780 (void) tcp_output(tp); 781 return; 782 } 783 } 784 785 /* 786 * Drop TCP, IP headers and TCP options. 787 */ 788 hdroptlen = sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr); 789 m->m_data += hdroptlen; 790 m->m_len -= hdroptlen; 791 792 /* 793 * Calculate amount of space in receive window, 794 * and then do TCP input processing. 795 * Receive window is amount of space in rcv queue, 796 * but not less than advertised window. 797 */ 798 { int win; 799 800 win = sbspace(&so->so_rcv); 801 if (win < 0) 802 win = 0; 803 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 804 } 805 806 switch (tp->t_state) { 807 808 /* 809 * If the state is SYN_SENT: 810 * if seg contains an ACK, but not for our SYN, drop the input. 811 * if seg contains a RST, then drop the connection. 812 * if seg does not contain SYN, then drop it. 813 * Otherwise this is an acceptable SYN segment 814 * initialize tp->rcv_nxt and tp->irs 815 * if seg contains ack then advance tp->snd_una 816 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 817 * arrange for segment to be acked (eventually) 818 * continue processing rest of data/controls, beginning with URG 819 */ 820 case TCPS_SYN_SENT: 821 if ((tiflags & TH_ACK) && 822 (SEQ_LEQ(ti->ti_ack, tp->iss) || 823 SEQ_GT(ti->ti_ack, tp->snd_max))) 824 goto dropwithreset; 825 if (tiflags & TH_RST) { 826 if (tiflags & TH_ACK) 827 tp = tcp_drop(tp, ECONNREFUSED); 828 goto drop; 829 } 830 if ((tiflags & TH_SYN) == 0) 831 goto drop; 832 if (tiflags & TH_ACK) { 833 tp->snd_una = ti->ti_ack; 834 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 835 tp->snd_nxt = tp->snd_una; 836 } 837 TCP_TIMER_DISARM(tp, TCPT_REXMT); 838 tp->irs = ti->ti_seq; 839 tcp_rcvseqinit(tp); 840 tp->t_flags |= TF_ACKNOW; 841 tcp_mss_from_peer(tp, opti.maxseg); 842 843 /* 844 * Initialize the initial congestion window. If we 845 * had to retransmit the SYN, we must initialize cwnd 846 * to 1 segment (i.e. the Loss Window). 847 */ 848 if (tp->t_flags & TF_SYN_REXMT) 849 tp->snd_cwnd = tp->t_peermss; 850 else 851 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, 852 tp->t_peermss); 853 854 tcp_rmx_rtt(tp); 855 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 856 tcpstat.tcps_connects++; 857 soisconnected(so); 858 tcp_established(tp); 859 /* Do window scaling on this connection? */ 860 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 861 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 862 tp->snd_scale = tp->requested_s_scale; 863 tp->rcv_scale = tp->request_r_scale; 864 } 865 TCP_REASS_LOCK(tp); 866 (void) tcp_reass(tp, (struct tcpiphdr *)0, 867 (struct mbuf *)0); 868 TCP_REASS_UNLOCK(tp); 869 /* 870 * if we didn't have to retransmit the SYN, 871 * use its rtt as our initial srtt & rtt var. 872 */ 873 if (tp->t_rtt) 874 tcp_xmit_timer(tp, tp->t_rtt); 875 } else 876 tp->t_state = TCPS_SYN_RECEIVED; 877 878 /* 879 * Advance ti->ti_seq to correspond to first data byte. 880 * If data, trim to stay within window, 881 * dropping FIN if necessary. 882 */ 883 ti->ti_seq++; 884 if (ti->ti_len > tp->rcv_wnd) { 885 todrop = ti->ti_len - tp->rcv_wnd; 886 m_adj(m, -todrop); 887 ti->ti_len = tp->rcv_wnd; 888 tiflags &= ~TH_FIN; 889 tcpstat.tcps_rcvpackafterwin++; 890 tcpstat.tcps_rcvbyteafterwin += todrop; 891 } 892 tp->snd_wl1 = ti->ti_seq - 1; 893 tp->rcv_up = ti->ti_seq; 894 goto step6; 895 896 /* 897 * If the state is SYN_RECEIVED: 898 * If seg contains an ACK, but not for our SYN, drop the input 899 * and generate an RST. See page 36, rfc793 900 */ 901 case TCPS_SYN_RECEIVED: 902 if ((tiflags & TH_ACK) && 903 (SEQ_LEQ(ti->ti_ack, tp->iss) || 904 SEQ_GT(ti->ti_ack, tp->snd_max))) 905 goto dropwithreset; 906 break; 907 } 908 909 /* 910 * States other than LISTEN or SYN_SENT. 911 * First check timestamp, if present. 912 * Then check that at least some bytes of segment are within 913 * receive window. If segment begins before rcv_nxt, 914 * drop leading data (and SYN); if nothing left, just ack. 915 * 916 * RFC 1323 PAWS: If we have a timestamp reply on this segment 917 * and it's less than ts_recent, drop it. 918 */ 919 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 920 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 921 922 /* Check to see if ts_recent is over 24 days old. */ 923 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 924 /* 925 * Invalidate ts_recent. If this segment updates 926 * ts_recent, the age will be reset later and ts_recent 927 * will get a valid value. If it does not, setting 928 * ts_recent to zero will at least satisfy the 929 * requirement that zero be placed in the timestamp 930 * echo reply when ts_recent isn't valid. The 931 * age isn't reset until we get a valid ts_recent 932 * because we don't want out-of-order segments to be 933 * dropped when ts_recent is old. 934 */ 935 tp->ts_recent = 0; 936 } else { 937 tcpstat.tcps_rcvduppack++; 938 tcpstat.tcps_rcvdupbyte += ti->ti_len; 939 tcpstat.tcps_pawsdrop++; 940 goto dropafterack; 941 } 942 } 943 944 todrop = tp->rcv_nxt - ti->ti_seq; 945 if (todrop > 0) { 946 if (tiflags & TH_SYN) { 947 tiflags &= ~TH_SYN; 948 ti->ti_seq++; 949 if (ti->ti_urp > 1) 950 ti->ti_urp--; 951 else { 952 tiflags &= ~TH_URG; 953 ti->ti_urp = 0; 954 } 955 todrop--; 956 } 957 if (todrop > ti->ti_len || 958 (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) { 959 /* 960 * Any valid FIN must be to the left of the window. 961 * At this point the FIN must be a duplicate or 962 * out of sequence; drop it. 963 */ 964 tiflags &= ~TH_FIN; 965 /* 966 * Send an ACK to resynchronize and drop any data. 967 * But keep on processing for RST or ACK. 968 */ 969 tp->t_flags |= TF_ACKNOW; 970 todrop = ti->ti_len; 971 tcpstat.tcps_rcvdupbyte += todrop; 972 tcpstat.tcps_rcvduppack++; 973 } else { 974 tcpstat.tcps_rcvpartduppack++; 975 tcpstat.tcps_rcvpartdupbyte += todrop; 976 } 977 m_adj(m, todrop); 978 ti->ti_seq += todrop; 979 ti->ti_len -= todrop; 980 if (ti->ti_urp > todrop) 981 ti->ti_urp -= todrop; 982 else { 983 tiflags &= ~TH_URG; 984 ti->ti_urp = 0; 985 } 986 } 987 988 /* 989 * If new data are received on a connection after the 990 * user processes are gone, then RST the other end. 991 */ 992 if ((so->so_state & SS_NOFDREF) && 993 tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) { 994 tp = tcp_close(tp); 995 tcpstat.tcps_rcvafterclose++; 996 goto dropwithreset; 997 } 998 999 /* 1000 * If segment ends after window, drop trailing data 1001 * (and PUSH and FIN); if nothing left, just ACK. 1002 */ 1003 todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd); 1004 if (todrop > 0) { 1005 tcpstat.tcps_rcvpackafterwin++; 1006 if (todrop >= ti->ti_len) { 1007 tcpstat.tcps_rcvbyteafterwin += ti->ti_len; 1008 /* 1009 * If a new connection request is received 1010 * while in TIME_WAIT, drop the old connection 1011 * and start over if the sequence numbers 1012 * are above the previous ones. 1013 */ 1014 if (tiflags & TH_SYN && 1015 tp->t_state == TCPS_TIME_WAIT && 1016 SEQ_GT(ti->ti_seq, tp->rcv_nxt)) { 1017 iss = tcp_new_iss(tp, sizeof(struct tcpcb), 1018 tp->rcv_nxt); 1019 tp = tcp_close(tp); 1020 /* 1021 * We have already advanced the mbuf 1022 * pointers past the IP+TCP headers and 1023 * options. Restore those pointers before 1024 * attempting to use the TCP header again. 1025 */ 1026 m->m_data -= hdroptlen; 1027 m->m_len += hdroptlen; 1028 goto findpcb; 1029 } 1030 /* 1031 * If window is closed can only take segments at 1032 * window edge, and have to drop data and PUSH from 1033 * incoming segments. Continue processing, but 1034 * remember to ack. Otherwise, drop segment 1035 * and ack. 1036 */ 1037 if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) { 1038 tp->t_flags |= TF_ACKNOW; 1039 tcpstat.tcps_rcvwinprobe++; 1040 } else 1041 goto dropafterack; 1042 } else 1043 tcpstat.tcps_rcvbyteafterwin += todrop; 1044 m_adj(m, -todrop); 1045 ti->ti_len -= todrop; 1046 tiflags &= ~(TH_PUSH|TH_FIN); 1047 } 1048 1049 /* 1050 * If last ACK falls within this segment's sequence numbers, 1051 * and the timestamp is newer, record it. 1052 */ 1053 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1054 SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) && 1055 SEQ_LT(tp->last_ack_sent, ti->ti_seq + ti->ti_len + 1056 ((tiflags & (TH_SYN|TH_FIN)) != 0))) { 1057 tp->ts_recent_age = tcp_now; 1058 tp->ts_recent = opti.ts_val; 1059 } 1060 1061 /* 1062 * If the RST bit is set examine the state: 1063 * SYN_RECEIVED STATE: 1064 * If passive open, return to LISTEN state. 1065 * If active open, inform user that connection was refused. 1066 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1067 * Inform user that connection was reset, and close tcb. 1068 * CLOSING, LAST_ACK, TIME_WAIT STATES 1069 * Close the tcb. 1070 */ 1071 if (tiflags&TH_RST) switch (tp->t_state) { 1072 1073 case TCPS_SYN_RECEIVED: 1074 so->so_error = ECONNREFUSED; 1075 goto close; 1076 1077 case TCPS_ESTABLISHED: 1078 case TCPS_FIN_WAIT_1: 1079 case TCPS_FIN_WAIT_2: 1080 case TCPS_CLOSE_WAIT: 1081 so->so_error = ECONNRESET; 1082 close: 1083 tp->t_state = TCPS_CLOSED; 1084 tcpstat.tcps_drops++; 1085 tp = tcp_close(tp); 1086 goto drop; 1087 1088 case TCPS_CLOSING: 1089 case TCPS_LAST_ACK: 1090 case TCPS_TIME_WAIT: 1091 tp = tcp_close(tp); 1092 goto drop; 1093 } 1094 1095 /* 1096 * If a SYN is in the window, then this is an 1097 * error and we send an RST and drop the connection. 1098 */ 1099 if (tiflags & TH_SYN) { 1100 tp = tcp_drop(tp, ECONNRESET); 1101 goto dropwithreset; 1102 } 1103 1104 /* 1105 * If the ACK bit is off we drop the segment and return. 1106 */ 1107 if ((tiflags & TH_ACK) == 0) 1108 goto drop; 1109 1110 /* 1111 * Ack processing. 1112 */ 1113 switch (tp->t_state) { 1114 1115 /* 1116 * In SYN_RECEIVED state if the ack ACKs our SYN then enter 1117 * ESTABLISHED state and continue processing, otherwise 1118 * send an RST. 1119 */ 1120 case TCPS_SYN_RECEIVED: 1121 if (SEQ_GT(tp->snd_una, ti->ti_ack) || 1122 SEQ_GT(ti->ti_ack, tp->snd_max)) 1123 goto dropwithreset; 1124 tcpstat.tcps_connects++; 1125 soisconnected(so); 1126 tcp_established(tp); 1127 /* Do window scaling? */ 1128 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1129 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1130 tp->snd_scale = tp->requested_s_scale; 1131 tp->rcv_scale = tp->request_r_scale; 1132 } 1133 TCP_REASS_LOCK(tp); 1134 (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0); 1135 TCP_REASS_UNLOCK(tp); 1136 tp->snd_wl1 = ti->ti_seq - 1; 1137 /* fall into ... */ 1138 1139 /* 1140 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1141 * ACKs. If the ack is in the range 1142 * tp->snd_una < ti->ti_ack <= tp->snd_max 1143 * then advance tp->snd_una to ti->ti_ack and drop 1144 * data from the retransmission queue. If this ACK reflects 1145 * more up to date window information we update our window information. 1146 */ 1147 case TCPS_ESTABLISHED: 1148 case TCPS_FIN_WAIT_1: 1149 case TCPS_FIN_WAIT_2: 1150 case TCPS_CLOSE_WAIT: 1151 case TCPS_CLOSING: 1152 case TCPS_LAST_ACK: 1153 case TCPS_TIME_WAIT: 1154 1155 if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) { 1156 if (ti->ti_len == 0 && tiwin == tp->snd_wnd) { 1157 tcpstat.tcps_rcvdupack++; 1158 /* 1159 * If we have outstanding data (other than 1160 * a window probe), this is a completely 1161 * duplicate ack (ie, window info didn't 1162 * change), the ack is the biggest we've 1163 * seen and we've seen exactly our rexmt 1164 * threshhold of them, assume a packet 1165 * has been dropped and retransmit it. 1166 * Kludge snd_nxt & the congestion 1167 * window so we send only this one 1168 * packet. 1169 * 1170 * We know we're losing at the current 1171 * window size so do congestion avoidance 1172 * (set ssthresh to half the current window 1173 * and pull our congestion window back to 1174 * the new ssthresh). 1175 * 1176 * Dup acks mean that packets have left the 1177 * network (they're now cached at the receiver) 1178 * so bump cwnd by the amount in the receiver 1179 * to keep a constant cwnd packets in the 1180 * network. 1181 */ 1182 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 || 1183 ti->ti_ack != tp->snd_una) 1184 tp->t_dupacks = 0; 1185 else if (++tp->t_dupacks == tcprexmtthresh) { 1186 tcp_seq onxt = tp->snd_nxt; 1187 u_int win = 1188 min(tp->snd_wnd, tp->snd_cwnd) / 1189 2 / tp->t_segsz; 1190 if (SEQ_LT(ti->ti_ack, tp->snd_recover)) { 1191 /* 1192 * False fast retransmit after 1193 * timeout. Do not cut window. 1194 */ 1195 tp->snd_cwnd += tp->t_segsz; 1196 tp->t_dupacks = 0; 1197 (void) tcp_output(tp); 1198 goto drop; 1199 } 1200 1201 if (win < 2) 1202 win = 2; 1203 tp->snd_ssthresh = win * tp->t_segsz; 1204 tp->snd_recover = tp->snd_max; 1205 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1206 tp->t_rtt = 0; 1207 tp->snd_nxt = ti->ti_ack; 1208 tp->snd_cwnd = tp->t_segsz; 1209 (void) tcp_output(tp); 1210 tp->snd_cwnd = tp->snd_ssthresh + 1211 tp->t_segsz * tp->t_dupacks; 1212 if (SEQ_GT(onxt, tp->snd_nxt)) 1213 tp->snd_nxt = onxt; 1214 goto drop; 1215 } else if (tp->t_dupacks > tcprexmtthresh) { 1216 tp->snd_cwnd += tp->t_segsz; 1217 (void) tcp_output(tp); 1218 goto drop; 1219 } 1220 } else 1221 tp->t_dupacks = 0; 1222 break; 1223 } 1224 /* 1225 * If the congestion window was inflated to account 1226 * for the other side's cached packets, retract it. 1227 */ 1228 if (!tcp_do_newreno) { 1229 if (tp->t_dupacks >= tcprexmtthresh && 1230 tp->snd_cwnd > tp->snd_ssthresh) 1231 tp->snd_cwnd = tp->snd_ssthresh; 1232 tp->t_dupacks = 0; 1233 } else if (tp->t_dupacks >= tcprexmtthresh 1234 && !tcp_newreno(tp, ti)) { 1235 tp->snd_cwnd = tp->snd_ssthresh; 1236 /* 1237 * Window inflation should have left us with approx. 1238 * snd_ssthresh outstanding data. But in case we 1239 * would be inclined to send a burst, better to do 1240 * it via the slow start mechanism. 1241 */ 1242 if (SEQ_SUB(tp->snd_max, ti->ti_ack) < tp->snd_ssthresh) 1243 tp->snd_cwnd = SEQ_SUB(tp->snd_max, ti->ti_ack) 1244 + tp->t_segsz; 1245 tp->t_dupacks = 0; 1246 } 1247 if (SEQ_GT(ti->ti_ack, tp->snd_max)) { 1248 tcpstat.tcps_rcvacktoomuch++; 1249 goto dropafterack; 1250 } 1251 acked = ti->ti_ack - tp->snd_una; 1252 tcpstat.tcps_rcvackpack++; 1253 tcpstat.tcps_rcvackbyte += acked; 1254 1255 /* 1256 * If we have a timestamp reply, update smoothed 1257 * round trip time. If no timestamp is present but 1258 * transmit timer is running and timed sequence 1259 * number was acked, update smoothed round trip time. 1260 * Since we now have an rtt measurement, cancel the 1261 * timer backoff (cf., Phil Karn's retransmit alg.). 1262 * Recompute the initial retransmit timer. 1263 */ 1264 if (opti.ts_present) 1265 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1); 1266 else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) 1267 tcp_xmit_timer(tp,tp->t_rtt); 1268 1269 /* 1270 * If all outstanding data is acked, stop retransmit 1271 * timer and remember to restart (more output or persist). 1272 * If there is more data to be acked, restart retransmit 1273 * timer, using current (possibly backed-off) value. 1274 */ 1275 if (ti->ti_ack == tp->snd_max) { 1276 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1277 needoutput = 1; 1278 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1279 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1280 /* 1281 * When new data is acked, open the congestion window. 1282 * If the window gives us less than ssthresh packets 1283 * in flight, open exponentially (segsz per packet). 1284 * Otherwise open linearly: segsz per window 1285 * (segsz^2 / cwnd per packet), plus a constant 1286 * fraction of a packet (segsz/8) to help larger windows 1287 * open quickly enough. 1288 */ 1289 { 1290 register u_int cw = tp->snd_cwnd; 1291 register u_int incr = tp->t_segsz; 1292 1293 if (cw > tp->snd_ssthresh) 1294 incr = incr * incr / cw; 1295 if (!tcp_do_newreno || SEQ_GEQ(ti->ti_ack, tp->snd_recover)) 1296 tp->snd_cwnd = min(cw + incr,TCP_MAXWIN<<tp->snd_scale); 1297 } 1298 if (acked > so->so_snd.sb_cc) { 1299 tp->snd_wnd -= so->so_snd.sb_cc; 1300 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1301 ourfinisacked = 1; 1302 } else { 1303 sbdrop(&so->so_snd, acked); 1304 tp->snd_wnd -= acked; 1305 ourfinisacked = 0; 1306 } 1307 sowwakeup(so); 1308 tp->snd_una = ti->ti_ack; 1309 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1310 tp->snd_nxt = tp->snd_una; 1311 1312 switch (tp->t_state) { 1313 1314 /* 1315 * In FIN_WAIT_1 STATE in addition to the processing 1316 * for the ESTABLISHED state if our FIN is now acknowledged 1317 * then enter FIN_WAIT_2. 1318 */ 1319 case TCPS_FIN_WAIT_1: 1320 if (ourfinisacked) { 1321 /* 1322 * If we can't receive any more 1323 * data, then closing user can proceed. 1324 * Starting the timer is contrary to the 1325 * specification, but if we don't get a FIN 1326 * we'll hang forever. 1327 */ 1328 if (so->so_state & SS_CANTRCVMORE) { 1329 soisdisconnected(so); 1330 if (tcp_maxidle > 0) 1331 TCP_TIMER_ARM(tp, TCPT_2MSL, 1332 tcp_maxidle); 1333 } 1334 tp->t_state = TCPS_FIN_WAIT_2; 1335 } 1336 break; 1337 1338 /* 1339 * In CLOSING STATE in addition to the processing for 1340 * the ESTABLISHED state if the ACK acknowledges our FIN 1341 * then enter the TIME-WAIT state, otherwise ignore 1342 * the segment. 1343 */ 1344 case TCPS_CLOSING: 1345 if (ourfinisacked) { 1346 tp->t_state = TCPS_TIME_WAIT; 1347 tcp_canceltimers(tp); 1348 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1349 soisdisconnected(so); 1350 } 1351 break; 1352 1353 /* 1354 * In LAST_ACK, we may still be waiting for data to drain 1355 * and/or to be acked, as well as for the ack of our FIN. 1356 * If our FIN is now acknowledged, delete the TCB, 1357 * enter the closed state and return. 1358 */ 1359 case TCPS_LAST_ACK: 1360 if (ourfinisacked) { 1361 tp = tcp_close(tp); 1362 goto drop; 1363 } 1364 break; 1365 1366 /* 1367 * In TIME_WAIT state the only thing that should arrive 1368 * is a retransmission of the remote FIN. Acknowledge 1369 * it and restart the finack timer. 1370 */ 1371 case TCPS_TIME_WAIT: 1372 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1373 goto dropafterack; 1374 } 1375 } 1376 1377 step6: 1378 /* 1379 * Update window information. 1380 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1381 */ 1382 if (((tiflags & TH_ACK) && SEQ_LT(tp->snd_wl1, ti->ti_seq)) || 1383 (tp->snd_wl1 == ti->ti_seq && SEQ_LT(tp->snd_wl2, ti->ti_ack)) || 1384 (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd)) { 1385 /* keep track of pure window updates */ 1386 if (ti->ti_len == 0 && 1387 tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd) 1388 tcpstat.tcps_rcvwinupd++; 1389 tp->snd_wnd = tiwin; 1390 tp->snd_wl1 = ti->ti_seq; 1391 tp->snd_wl2 = ti->ti_ack; 1392 if (tp->snd_wnd > tp->max_sndwnd) 1393 tp->max_sndwnd = tp->snd_wnd; 1394 needoutput = 1; 1395 } 1396 1397 /* 1398 * Process segments with URG. 1399 */ 1400 if ((tiflags & TH_URG) && ti->ti_urp && 1401 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1402 /* 1403 * This is a kludge, but if we receive and accept 1404 * random urgent pointers, we'll crash in 1405 * soreceive. It's hard to imagine someone 1406 * actually wanting to send this much urgent data. 1407 */ 1408 if (ti->ti_urp + so->so_rcv.sb_cc > sb_max) { 1409 ti->ti_urp = 0; /* XXX */ 1410 tiflags &= ~TH_URG; /* XXX */ 1411 goto dodata; /* XXX */ 1412 } 1413 /* 1414 * If this segment advances the known urgent pointer, 1415 * then mark the data stream. This should not happen 1416 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 1417 * a FIN has been received from the remote side. 1418 * In these states we ignore the URG. 1419 * 1420 * According to RFC961 (Assigned Protocols), 1421 * the urgent pointer points to the last octet 1422 * of urgent data. We continue, however, 1423 * to consider it to indicate the first octet 1424 * of data past the urgent section as the original 1425 * spec states (in one of two places). 1426 */ 1427 if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) { 1428 tp->rcv_up = ti->ti_seq + ti->ti_urp; 1429 so->so_oobmark = so->so_rcv.sb_cc + 1430 (tp->rcv_up - tp->rcv_nxt) - 1; 1431 if (so->so_oobmark == 0) 1432 so->so_state |= SS_RCVATMARK; 1433 sohasoutofband(so); 1434 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 1435 } 1436 /* 1437 * Remove out of band data so doesn't get presented to user. 1438 * This can happen independent of advancing the URG pointer, 1439 * but if two URG's are pending at once, some out-of-band 1440 * data may creep in... ick. 1441 */ 1442 if (ti->ti_urp <= (u_int16_t) ti->ti_len 1443 #ifdef SO_OOBINLINE 1444 && (so->so_options & SO_OOBINLINE) == 0 1445 #endif 1446 ) 1447 tcp_pulloutofband(so, ti, m); 1448 } else 1449 /* 1450 * If no out of band data is expected, 1451 * pull receive urgent pointer along 1452 * with the receive window. 1453 */ 1454 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 1455 tp->rcv_up = tp->rcv_nxt; 1456 dodata: /* XXX */ 1457 1458 /* 1459 * Process the segment text, merging it into the TCP sequencing queue, 1460 * and arranging for acknowledgment of receipt if necessary. 1461 * This process logically involves adjusting tp->rcv_wnd as data 1462 * is presented to the user (this happens in tcp_usrreq.c, 1463 * case PRU_RCVD). If a FIN has already been received on this 1464 * connection then we just ignore the text. 1465 */ 1466 if ((ti->ti_len || (tiflags & TH_FIN)) && 1467 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1468 TCP_REASS(tp, ti, m, so, tiflags); 1469 /* 1470 * Note the amount of data that peer has sent into 1471 * our window, in order to estimate the sender's 1472 * buffer size. 1473 */ 1474 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 1475 } else { 1476 m_freem(m); 1477 tiflags &= ~TH_FIN; 1478 } 1479 1480 /* 1481 * If FIN is received ACK the FIN and let the user know 1482 * that the connection is closing. Ignore a FIN received before 1483 * the connection is fully established. 1484 */ 1485 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 1486 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1487 socantrcvmore(so); 1488 tp->t_flags |= TF_ACKNOW; 1489 tp->rcv_nxt++; 1490 } 1491 switch (tp->t_state) { 1492 1493 /* 1494 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 1495 */ 1496 case TCPS_ESTABLISHED: 1497 tp->t_state = TCPS_CLOSE_WAIT; 1498 break; 1499 1500 /* 1501 * If still in FIN_WAIT_1 STATE FIN has not been acked so 1502 * enter the CLOSING state. 1503 */ 1504 case TCPS_FIN_WAIT_1: 1505 tp->t_state = TCPS_CLOSING; 1506 break; 1507 1508 /* 1509 * In FIN_WAIT_2 state enter the TIME_WAIT state, 1510 * starting the time-wait timer, turning off the other 1511 * standard timers. 1512 */ 1513 case TCPS_FIN_WAIT_2: 1514 tp->t_state = TCPS_TIME_WAIT; 1515 tcp_canceltimers(tp); 1516 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1517 soisdisconnected(so); 1518 break; 1519 1520 /* 1521 * In TIME_WAIT state restart the 2 MSL time_wait timer. 1522 */ 1523 case TCPS_TIME_WAIT: 1524 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1525 break; 1526 } 1527 } 1528 if (so->so_options & SO_DEBUG) 1529 tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0); 1530 1531 /* 1532 * Return any desired output. 1533 */ 1534 if (needoutput || (tp->t_flags & TF_ACKNOW)) 1535 (void) tcp_output(tp); 1536 return; 1537 1538 badsyn: 1539 /* 1540 * Received a bad SYN. Increment counters and dropwithreset. 1541 */ 1542 tcpstat.tcps_badsyn++; 1543 tp = NULL; 1544 goto dropwithreset; 1545 1546 dropafterack: 1547 /* 1548 * Generate an ACK dropping incoming segment if it occupies 1549 * sequence space, where the ACK reflects our state. 1550 */ 1551 if (tiflags & TH_RST) 1552 goto drop; 1553 m_freem(m); 1554 tp->t_flags |= TF_ACKNOW; 1555 (void) tcp_output(tp); 1556 return; 1557 1558 dropwithreset: 1559 /* 1560 * Generate a RST, dropping incoming segment. 1561 * Make ACK acceptable to originator of segment. 1562 * Don't bother to respond if destination was broadcast/multicast. 1563 */ 1564 if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) || 1565 IN_MULTICAST(ti->ti_dst.s_addr)) 1566 goto drop; 1567 if (tiflags & TH_ACK) 1568 (void)tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST); 1569 else { 1570 if (tiflags & TH_SYN) 1571 ti->ti_len++; 1572 (void)tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0, 1573 TH_RST|TH_ACK); 1574 } 1575 return; 1576 1577 drop: 1578 /* 1579 * Drop space held by incoming segment and return. 1580 */ 1581 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) 1582 tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0); 1583 m_freem(m); 1584 return; 1585 } 1586 1587 void 1588 tcp_dooptions(tp, cp, cnt, ti, oi) 1589 struct tcpcb *tp; 1590 u_char *cp; 1591 int cnt; 1592 struct tcpiphdr *ti; 1593 struct tcp_opt_info *oi; 1594 { 1595 u_int16_t mss; 1596 int opt, optlen; 1597 1598 for (; cnt > 0; cnt -= optlen, cp += optlen) { 1599 opt = cp[0]; 1600 if (opt == TCPOPT_EOL) 1601 break; 1602 if (opt == TCPOPT_NOP) 1603 optlen = 1; 1604 else { 1605 optlen = cp[1]; 1606 if (optlen <= 0) 1607 break; 1608 } 1609 switch (opt) { 1610 1611 default: 1612 continue; 1613 1614 case TCPOPT_MAXSEG: 1615 if (optlen != TCPOLEN_MAXSEG) 1616 continue; 1617 if (!(ti->ti_flags & TH_SYN)) 1618 continue; 1619 bcopy(cp + 2, &mss, sizeof(mss)); 1620 oi->maxseg = ntohs(mss); 1621 break; 1622 1623 case TCPOPT_WINDOW: 1624 if (optlen != TCPOLEN_WINDOW) 1625 continue; 1626 if (!(ti->ti_flags & TH_SYN)) 1627 continue; 1628 tp->t_flags |= TF_RCVD_SCALE; 1629 tp->requested_s_scale = cp[2]; 1630 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) { 1631 log(LOG_ERR, "TCP: invalid wscale %d from " 1632 "0x%08x, assuming %d\n", 1633 tp->requested_s_scale, 1634 ntohl(ti->ti_src.s_addr), 1635 TCP_MAX_WINSHIFT); 1636 tp->requested_s_scale = TCP_MAX_WINSHIFT; 1637 } 1638 break; 1639 1640 case TCPOPT_TIMESTAMP: 1641 if (optlen != TCPOLEN_TIMESTAMP) 1642 continue; 1643 oi->ts_present = 1; 1644 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val)); 1645 NTOHL(oi->ts_val); 1646 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr)); 1647 NTOHL(oi->ts_ecr); 1648 1649 /* 1650 * A timestamp received in a SYN makes 1651 * it ok to send timestamp requests and replies. 1652 */ 1653 if (ti->ti_flags & TH_SYN) { 1654 tp->t_flags |= TF_RCVD_TSTMP; 1655 tp->ts_recent = oi->ts_val; 1656 tp->ts_recent_age = tcp_now; 1657 } 1658 break; 1659 case TCPOPT_SACK_PERMITTED: 1660 if (optlen != TCPOLEN_SACK_PERMITTED) 1661 continue; 1662 if (!(ti->ti_flags & TH_SYN)) 1663 continue; 1664 tp->t_flags &= ~TF_CANT_TXSACK; 1665 break; 1666 1667 case TCPOPT_SACK: 1668 if (tp->t_flags & TF_IGNR_RXSACK) 1669 continue; 1670 if (optlen % 8 != 2 || optlen < 10) 1671 continue; 1672 cp += 2; 1673 optlen -= 2; 1674 for (; optlen > 0; cp -= 8, optlen -= 8) { 1675 tcp_seq lwe, rwe; 1676 bcopy((char *)cp, (char *) &lwe, sizeof(lwe)); 1677 NTOHL(lwe); 1678 bcopy((char *)cp, (char *) &rwe, sizeof(rwe)); 1679 NTOHL(rwe); 1680 /* tcp_mark_sacked(tp, lwe, rwe); */ 1681 } 1682 break; 1683 } 1684 } 1685 } 1686 1687 /* 1688 * Pull out of band byte out of a segment so 1689 * it doesn't appear in the user's data queue. 1690 * It is still reflected in the segment length for 1691 * sequencing purposes. 1692 */ 1693 void 1694 tcp_pulloutofband(so, ti, m) 1695 struct socket *so; 1696 struct tcpiphdr *ti; 1697 register struct mbuf *m; 1698 { 1699 int cnt = ti->ti_urp - 1; 1700 1701 while (cnt >= 0) { 1702 if (m->m_len > cnt) { 1703 char *cp = mtod(m, caddr_t) + cnt; 1704 struct tcpcb *tp = sototcpcb(so); 1705 1706 tp->t_iobc = *cp; 1707 tp->t_oobflags |= TCPOOB_HAVEDATA; 1708 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 1709 m->m_len--; 1710 return; 1711 } 1712 cnt -= m->m_len; 1713 m = m->m_next; 1714 if (m == 0) 1715 break; 1716 } 1717 panic("tcp_pulloutofband"); 1718 } 1719 1720 /* 1721 * Collect new round-trip time estimate 1722 * and update averages and current timeout. 1723 */ 1724 void 1725 tcp_xmit_timer(tp, rtt) 1726 register struct tcpcb *tp; 1727 short rtt; 1728 { 1729 register short delta; 1730 short rttmin; 1731 1732 tcpstat.tcps_rttupdated++; 1733 --rtt; 1734 if (tp->t_srtt != 0) { 1735 /* 1736 * srtt is stored as fixed point with 3 bits after the 1737 * binary point (i.e., scaled by 8). The following magic 1738 * is equivalent to the smoothing algorithm in rfc793 with 1739 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 1740 * point). Adjust rtt to origin 0. 1741 */ 1742 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT); 1743 if ((tp->t_srtt += delta) <= 0) 1744 tp->t_srtt = 1 << 2; 1745 /* 1746 * We accumulate a smoothed rtt variance (actually, a 1747 * smoothed mean difference), then set the retransmit 1748 * timer to smoothed rtt + 4 times the smoothed variance. 1749 * rttvar is stored as fixed point with 2 bits after the 1750 * binary point (scaled by 4). The following is 1751 * equivalent to rfc793 smoothing with an alpha of .75 1752 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 1753 * rfc793's wired-in beta. 1754 */ 1755 if (delta < 0) 1756 delta = -delta; 1757 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 1758 if ((tp->t_rttvar += delta) <= 0) 1759 tp->t_rttvar = 1 << 2; 1760 } else { 1761 /* 1762 * No rtt measurement yet - use the unsmoothed rtt. 1763 * Set the variance to half the rtt (so our first 1764 * retransmit happens at 3*rtt). 1765 */ 1766 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2); 1767 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1); 1768 } 1769 tp->t_rtt = 0; 1770 tp->t_rxtshift = 0; 1771 1772 /* 1773 * the retransmit should happen at rtt + 4 * rttvar. 1774 * Because of the way we do the smoothing, srtt and rttvar 1775 * will each average +1/2 tick of bias. When we compute 1776 * the retransmit timer, we want 1/2 tick of rounding and 1777 * 1 extra tick because of +-1/2 tick uncertainty in the 1778 * firing of the timer. The bias will give us exactly the 1779 * 1.5 tick we need. But, because the bias is 1780 * statistical, we have to test that we don't drop below 1781 * the minimum feasible timer (which is 2 ticks). 1782 */ 1783 if (tp->t_rttmin > rtt + 2) 1784 rttmin = tp->t_rttmin; 1785 else 1786 rttmin = rtt + 2; 1787 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 1788 1789 /* 1790 * We received an ack for a packet that wasn't retransmitted; 1791 * it is probably safe to discard any error indications we've 1792 * received recently. This isn't quite right, but close enough 1793 * for now (a route might have failed after we sent a segment, 1794 * and the return path might not be symmetrical). 1795 */ 1796 tp->t_softerror = 0; 1797 } 1798 1799 /* 1800 * Checks for partial ack. If partial ack arrives, force the retransmission 1801 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return 1802 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to 1803 * be started again. If the ack advances at least to tp->snd_recover, return 0. 1804 */ 1805 int 1806 tcp_newreno(tp, ti) 1807 struct tcpcb *tp; 1808 struct tcpiphdr *ti; 1809 { 1810 if (SEQ_LT(ti->ti_ack, tp->snd_recover)) { 1811 tcp_seq onxt = tp->snd_nxt; 1812 tcp_seq ouna = tp->snd_una; /* Haven't updated snd_una yet*/ 1813 u_long ocwnd = tp->snd_cwnd; 1814 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1815 tp->t_rtt = 0; 1816 tp->snd_nxt = ti->ti_ack; 1817 tp->snd_cwnd = tp->t_segsz; 1818 tp->snd_una = ti->ti_ack; 1819 (void) tcp_output(tp); 1820 tp->snd_cwnd = ocwnd; 1821 tp->snd_una = ouna; 1822 if (SEQ_GT(onxt, tp->snd_nxt)) 1823 tp->snd_nxt = onxt; 1824 /* 1825 * Partial window deflation. Relies on fact that tp->snd_una 1826 * not updated yet. 1827 */ 1828 tp->snd_cwnd -= (ti->ti_ack - tp->snd_una - tp->t_segsz); 1829 return 1; 1830 } 1831 return 0; 1832 } 1833 1834 1835 /* 1836 * TCP compressed state engine. Currently used to hold compressed 1837 * state for SYN_RECEIVED. 1838 */ 1839 1840 u_long syn_cache_count; 1841 u_int32_t syn_hash1, syn_hash2; 1842 1843 #define SYN_HASH(sa, sp, dp) \ 1844 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 1845 ((u_int32_t)(sp)))^syn_hash2))) 1846 1847 LIST_HEAD(, syn_cache_head) tcp_syn_cache_queue; 1848 1849 #define SYN_CACHE_RM(sc, scp) \ 1850 do { \ 1851 TAILQ_REMOVE(&(scp)->sch_queue, (sc), sc_queue); \ 1852 if (--(scp)->sch_length == 0) \ 1853 LIST_REMOVE((scp), sch_headq); \ 1854 syn_cache_count--; \ 1855 } while (0) 1856 1857 struct pool syn_cache_pool; 1858 1859 void 1860 syn_cache_init() 1861 { 1862 int i; 1863 1864 /* Initialize the hash bucket queues. */ 1865 for (i = 0; i < tcp_syn_cache_size; i++) 1866 TAILQ_INIT(&tcp_syn_cache[i].sch_queue); 1867 1868 /* Initialize the active hash bucket cache. */ 1869 LIST_INIT(&tcp_syn_cache_queue); 1870 1871 /* Initialize the syn cache pool. */ 1872 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, 1873 "synpl", 0, NULL, NULL, M_PCB); 1874 } 1875 1876 void 1877 syn_cache_insert(sc) 1878 struct syn_cache *sc; 1879 { 1880 struct syn_cache_head *scp, *scp2, *sce; 1881 struct syn_cache *sc2; 1882 int s; 1883 1884 /* 1885 * If there are no entries in the hash table, reinitialize 1886 * the hash secrets. 1887 */ 1888 if (syn_cache_count == 0) { 1889 struct timeval tv; 1890 microtime(&tv); 1891 syn_hash1 = random() ^ (u_long)≻ 1892 syn_hash2 = random() ^ tv.tv_usec; 1893 } 1894 1895 sc->sc_hash = SYN_HASH(&sc->sc_src, sc->sc_sport, sc->sc_dport); 1896 scp = &tcp_syn_cache[sc->sc_hash % tcp_syn_cache_size]; 1897 1898 /* 1899 * Make sure that we don't overflow the per-bucket 1900 * limit or the total cache size limit. 1901 */ 1902 s = splsoftnet(); 1903 if (scp->sch_length >= tcp_syn_bucket_limit) { 1904 tcpstat.tcps_sc_bucketoverflow++; 1905 /* 1906 * The bucket is full. Toss the first (i.e. oldest) 1907 * element in this bucket. 1908 */ 1909 sc2 = TAILQ_FIRST(&scp->sch_queue); 1910 SYN_CACHE_RM(sc2, scp); 1911 if (sc2->sc_ipopts) 1912 (void) m_free(sc2->sc_ipopts); 1913 pool_put(&syn_cache_pool, sc2); 1914 } else if (syn_cache_count >= tcp_syn_cache_limit) { 1915 tcpstat.tcps_sc_overflowed++; 1916 /* 1917 * The cache is full. Toss the first (i.e. oldest) 1918 * element in the first non-empty bucket we can find. 1919 */ 1920 scp2 = scp; 1921 if (TAILQ_FIRST(&scp2->sch_queue) == NULL) { 1922 sce = &tcp_syn_cache[tcp_syn_cache_size]; 1923 for (++scp2; scp2 != scp; scp2++) { 1924 if (scp2 >= sce) 1925 scp2 = &tcp_syn_cache[0]; 1926 if (TAILQ_FIRST(&scp2->sch_queue) != NULL) 1927 break; 1928 } 1929 } 1930 sc2 = TAILQ_FIRST(&scp2->sch_queue); 1931 if (sc2 == NULL) { 1932 if (sc->sc_ipopts) 1933 (void) m_free(sc->sc_ipopts); 1934 pool_put(&syn_cache_pool, sc); 1935 return; 1936 } 1937 SYN_CACHE_RM(sc2, scp2); 1938 if (sc2->sc_ipopts) 1939 (void) m_free(sc2->sc_ipopts); 1940 pool_put(&syn_cache_pool, sc2); 1941 } 1942 1943 /* Set entry's timer. */ 1944 PRT_SLOW_ARM(sc->sc_timer, tcp_syn_cache_timeo); 1945 1946 /* Put it into the bucket. */ 1947 TAILQ_INSERT_TAIL(&scp->sch_queue, sc, sc_queue); 1948 if (++scp->sch_length == 1) 1949 LIST_INSERT_HEAD(&tcp_syn_cache_queue, scp, sch_headq); 1950 syn_cache_count++; 1951 1952 tcpstat.tcps_sc_added++; 1953 splx(s); 1954 } 1955 1956 /* 1957 * Walk down the cache list, looking for expired entries in each bucket. 1958 */ 1959 void 1960 syn_cache_timer() 1961 { 1962 struct syn_cache_head *scp, *nscp; 1963 struct syn_cache *sc, *nsc; 1964 int s; 1965 1966 s = splsoftnet(); 1967 for (scp = LIST_FIRST(&tcp_syn_cache_queue); scp != NULL; scp = nscp) { 1968 #ifdef DIAGNOSTIC 1969 if (TAILQ_FIRST(&scp->sch_queue) == NULL) 1970 panic("syn_cache_timer: queue inconsistency"); 1971 #endif 1972 nscp = LIST_NEXT(scp, sch_headq); 1973 for (sc = TAILQ_FIRST(&scp->sch_queue); 1974 sc != NULL && PRT_SLOW_ISEXPIRED(sc->sc_timer); 1975 sc = nsc) { 1976 nsc = TAILQ_NEXT(sc, sc_queue); 1977 tcpstat.tcps_sc_timed_out++; 1978 SYN_CACHE_RM(sc, scp); 1979 if (sc->sc_ipopts) 1980 (void) m_free(sc->sc_ipopts); 1981 pool_put(&syn_cache_pool, sc); 1982 } 1983 } 1984 splx(s); 1985 } 1986 1987 /* 1988 * Find an entry in the syn cache. 1989 */ 1990 struct syn_cache * 1991 syn_cache_lookup(ti, headp) 1992 struct tcpiphdr *ti; 1993 struct syn_cache_head **headp; 1994 { 1995 struct syn_cache *sc; 1996 struct syn_cache_head *scp; 1997 u_int32_t hash; 1998 int s; 1999 2000 hash = SYN_HASH(&ti->ti_src, ti->ti_sport, ti->ti_dport); 2001 2002 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 2003 *headp = scp; 2004 s = splsoftnet(); 2005 for (sc = TAILQ_FIRST(&scp->sch_queue); sc != NULL; 2006 sc = TAILQ_NEXT(sc, sc_queue)) { 2007 if (sc->sc_hash != hash) 2008 continue; 2009 if (sc->sc_src.s_addr == ti->ti_src.s_addr && 2010 sc->sc_sport == ti->ti_sport && 2011 sc->sc_dport == ti->ti_dport && 2012 sc->sc_dst.s_addr == ti->ti_dst.s_addr) { 2013 splx(s); 2014 return (sc); 2015 } 2016 } 2017 splx(s); 2018 return (NULL); 2019 } 2020 2021 /* 2022 * This function gets called when we receive an ACK for a 2023 * socket in the LISTEN state. We look up the connection 2024 * in the syn cache, and if its there, we pull it out of 2025 * the cache and turn it into a full-blown connection in 2026 * the SYN-RECEIVED state. 2027 * 2028 * The return values may not be immediately obvious, and their effects 2029 * can be subtle, so here they are: 2030 * 2031 * NULL SYN was not found in cache; caller should drop the 2032 * packet and send an RST. 2033 * 2034 * -1 We were unable to create the new connection, and are 2035 * aborting it. An ACK,RST is being sent to the peer 2036 * (unless we got screwey sequence numbners; see below), 2037 * because the 3-way handshake has been completed. Caller 2038 * should not free the mbuf, since we may be using it. If 2039 * we are not, we will free it. 2040 * 2041 * Otherwise, the return value is a pointer to the new socket 2042 * associated with the connection. 2043 */ 2044 struct socket * 2045 syn_cache_get(so, m) 2046 struct socket *so; 2047 struct mbuf *m; 2048 { 2049 struct syn_cache *sc; 2050 struct syn_cache_head *scp; 2051 register struct inpcb *inp; 2052 register struct tcpcb *tp = 0; 2053 register struct tcpiphdr *ti; 2054 struct sockaddr_in *sin; 2055 struct mbuf *am; 2056 long win; 2057 int s; 2058 2059 ti = mtod(m, struct tcpiphdr *); 2060 s = splsoftnet(); 2061 if ((sc = syn_cache_lookup(ti, &scp)) == NULL) { 2062 splx(s); 2063 return (NULL); 2064 } 2065 2066 win = sbspace(&so->so_rcv); 2067 if (win > TCP_MAXWIN) 2068 win = TCP_MAXWIN; 2069 2070 /* 2071 * Verify the sequence and ack numbers. 2072 */ 2073 if ((ti->ti_ack != sc->sc_iss + 1) || 2074 SEQ_LEQ(ti->ti_seq, sc->sc_irs) || 2075 SEQ_GT(ti->ti_seq, sc->sc_irs + 1 + win)) { 2076 (void) syn_cache_respond(sc, m, ti, win, 0); 2077 splx(s); 2078 return ((struct socket *)(-1)); 2079 } 2080 2081 /* Remove this cache entry */ 2082 SYN_CACHE_RM(sc, scp); 2083 splx(s); 2084 2085 /* 2086 * Ok, create the full blown connection, and set things up 2087 * as they would have been set up if we had created the 2088 * connection when the SYN arrived. If we can't create 2089 * the connection, abort it. 2090 */ 2091 so = sonewconn(so, SS_ISCONNECTED); 2092 if (so == NULL) 2093 goto resetandabort; 2094 2095 inp = sotoinpcb(so); 2096 inp->inp_laddr = sc->sc_dst; 2097 inp->inp_lport = sc->sc_dport; 2098 in_pcbstate(inp, INP_BOUND); 2099 inp->inp_options = ip_srcroute(); 2100 if (inp->inp_options == NULL) { 2101 inp->inp_options = sc->sc_ipopts; 2102 sc->sc_ipopts = NULL; 2103 } 2104 2105 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 2106 if (am == NULL) 2107 goto resetandabort; 2108 am->m_len = sizeof(struct sockaddr_in); 2109 sin = mtod(am, struct sockaddr_in *); 2110 sin->sin_family = AF_INET; 2111 sin->sin_len = sizeof(*sin); 2112 sin->sin_addr = sc->sc_src; 2113 sin->sin_port = sc->sc_sport; 2114 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero)); 2115 if (in_pcbconnect(inp, am)) { 2116 (void) m_free(am); 2117 goto resetandabort; 2118 } 2119 (void) m_free(am); 2120 2121 tp = intotcpcb(inp); 2122 if (sc->sc_request_r_scale != 15) { 2123 tp->requested_s_scale = sc->sc_requested_s_scale; 2124 tp->request_r_scale = sc->sc_request_r_scale; 2125 tp->snd_scale = sc->sc_requested_s_scale; 2126 tp->rcv_scale = sc->sc_request_r_scale; 2127 tp->t_flags |= TF_RCVD_SCALE; 2128 } 2129 if (sc->sc_flags & SCF_TIMESTAMP) 2130 tp->t_flags |= TF_RCVD_TSTMP; 2131 2132 tp->t_template = tcp_template(tp); 2133 if (tp->t_template == 0) { 2134 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 2135 so = NULL; 2136 m_freem(m); 2137 goto abort; 2138 } 2139 2140 tp->iss = sc->sc_iss; 2141 tp->irs = sc->sc_irs; 2142 tcp_sendseqinit(tp); 2143 tcp_rcvseqinit(tp); 2144 tp->t_state = TCPS_SYN_RECEIVED; 2145 TCP_TIMER_ARM(tp, TCPT_KEEP, TCPTV_KEEP_INIT); 2146 tcpstat.tcps_accepts++; 2147 2148 /* Initialize tp->t_ourmss before we deal with the peer's! */ 2149 tp->t_ourmss = sc->sc_ourmaxseg; 2150 tcp_mss_from_peer(tp, sc->sc_peermaxseg); 2151 2152 /* 2153 * Initialize the initial congestion window. If we 2154 * had to retransmit the SYN,ACK, we must initialize cwnd 2155 * to 1 segment (i.e. the Loss Window). 2156 */ 2157 if (sc->sc_rexmt_count) 2158 tp->snd_cwnd = tp->t_peermss; 2159 else 2160 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, tp->t_peermss); 2161 2162 tcp_rmx_rtt(tp); 2163 tp->snd_wl1 = sc->sc_irs; 2164 tp->rcv_up = sc->sc_irs + 1; 2165 2166 /* 2167 * This is what whould have happened in tcp_ouput() when 2168 * the SYN,ACK was sent. 2169 */ 2170 tp->snd_up = tp->snd_una; 2171 tp->snd_max = tp->snd_nxt = tp->iss+1; 2172 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 2173 if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv)) 2174 tp->rcv_adv = tp->rcv_nxt + win; 2175 tp->last_ack_sent = tp->rcv_nxt; 2176 2177 tcpstat.tcps_sc_completed++; 2178 if (sc->sc_ipopts) 2179 (void) m_free(sc->sc_ipopts); 2180 pool_put(&syn_cache_pool, sc); 2181 return (so); 2182 2183 resetandabort: 2184 (void) tcp_respond(NULL, ti, m, ti->ti_seq+ti->ti_len, 2185 (tcp_seq)0, TH_RST|TH_ACK); 2186 abort: 2187 if (so != NULL) 2188 (void) soabort(so); 2189 if (sc->sc_ipopts) 2190 (void) m_free(sc->sc_ipopts); 2191 pool_put(&syn_cache_pool, sc); 2192 tcpstat.tcps_sc_aborted++; 2193 return ((struct socket *)(-1)); 2194 } 2195 2196 /* 2197 * This function is called when we get a RST for a 2198 * non-existant connection, so that we can see if the 2199 * connection is in the syn cache. If it is, zap it. 2200 */ 2201 2202 void 2203 syn_cache_reset(ti) 2204 register struct tcpiphdr *ti; 2205 { 2206 struct syn_cache *sc; 2207 struct syn_cache_head *scp; 2208 int s = splsoftnet(); 2209 2210 if ((sc = syn_cache_lookup(ti, &scp)) == NULL) { 2211 splx(s); 2212 return; 2213 } 2214 if (SEQ_LT(ti->ti_seq,sc->sc_irs) || 2215 SEQ_GT(ti->ti_seq, sc->sc_irs+1)) { 2216 splx(s); 2217 return; 2218 } 2219 SYN_CACHE_RM(sc, scp); 2220 splx(s); 2221 tcpstat.tcps_sc_reset++; 2222 if (sc->sc_ipopts) 2223 (void) m_free(sc->sc_ipopts); 2224 pool_put(&syn_cache_pool, sc); 2225 } 2226 2227 void 2228 syn_cache_unreach(ip, th) 2229 struct ip *ip; 2230 struct tcphdr *th; 2231 { 2232 struct syn_cache *sc; 2233 struct syn_cache_head *scp; 2234 struct tcpiphdr ti2; 2235 int s; 2236 2237 ti2.ti_src.s_addr = ip->ip_dst.s_addr; 2238 ti2.ti_dst.s_addr = ip->ip_src.s_addr; 2239 ti2.ti_sport = th->th_dport; 2240 ti2.ti_dport = th->th_sport; 2241 2242 s = splsoftnet(); 2243 if ((sc = syn_cache_lookup(&ti2, &scp)) == NULL) { 2244 splx(s); 2245 return; 2246 } 2247 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 2248 if (ntohl (th->th_seq) != sc->sc_iss) { 2249 splx(s); 2250 return; 2251 } 2252 2253 /* 2254 * If we've rertransmitted 3 times and this is our second error, 2255 * we remove the entry. Otherwise, we allow it to continue on. 2256 * This prevents us from incorrectly nuking an entry during a 2257 * spurious network outage. 2258 * 2259 * See tcp_notify(). 2260 */ 2261 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rexmt_count < 3) { 2262 sc->sc_flags |= SCF_UNREACH; 2263 splx(s); 2264 return; 2265 } 2266 2267 SYN_CACHE_RM(sc, scp); 2268 splx(s); 2269 tcpstat.tcps_sc_unreach++; 2270 if (sc->sc_ipopts) 2271 (void) m_free(sc->sc_ipopts); 2272 pool_put(&syn_cache_pool, sc); 2273 } 2274 2275 /* 2276 * Given a LISTEN socket and an inbound SYN request, add 2277 * this to the syn cache, and send back a segment: 2278 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 2279 * to the source. 2280 * 2281 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 2282 * Doing so would require that we hold onto the data and deliver it 2283 * to the application. However, if we are the target of a SYN-flood 2284 * DoS attack, an attacker could send data which would eventually 2285 * consume all available buffer space if it were ACKed. By not ACKing 2286 * the data, we avoid this DoS scenario. 2287 */ 2288 2289 int 2290 syn_cache_add(so, m, optp, optlen, oi) 2291 struct socket *so; 2292 struct mbuf *m; 2293 u_char *optp; 2294 int optlen; 2295 struct tcp_opt_info *oi; 2296 { 2297 register struct tcpiphdr *ti; 2298 struct tcpcb tb, *tp; 2299 long win; 2300 struct syn_cache *sc; 2301 struct syn_cache_head *scp; 2302 struct mbuf *ipopts; 2303 2304 tp = sototcpcb(so); 2305 ti = mtod(m, struct tcpiphdr *); 2306 2307 /* 2308 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 2309 * in_broadcast() should never return true on a received 2310 * packet with M_BCAST not set. 2311 */ 2312 if (m->m_flags & (M_BCAST|M_MCAST) || 2313 IN_MULTICAST(ti->ti_src.s_addr) || 2314 IN_MULTICAST(ti->ti_dst.s_addr)) 2315 return (0); 2316 2317 /* 2318 * Initialize some local state. 2319 */ 2320 win = sbspace(&so->so_rcv); 2321 if (win > TCP_MAXWIN) 2322 win = TCP_MAXWIN; 2323 2324 /* 2325 * Remember the IP options, if any. 2326 */ 2327 ipopts = ip_srcroute(); 2328 2329 if (optp) { 2330 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 2331 tcp_dooptions(&tb, optp, optlen, ti, oi); 2332 } else 2333 tb.t_flags = 0; 2334 2335 /* 2336 * See if we already have an entry for this connection. 2337 * If we do, resend the SYN,ACK, and remember since the 2338 * initial congestion window must be initialized to 1 2339 * segment when the connection completes. 2340 */ 2341 if ((sc = syn_cache_lookup(ti, &scp)) != NULL) { 2342 tcpstat.tcps_sc_dupesyn++; 2343 sc->sc_rexmt_count++; 2344 if (sc->sc_rexmt_count == 0) { 2345 /* 2346 * Eeek! We rolled the counter. Just set it 2347 * to the max value. This shouldn't ever happen, 2348 * but there's no real reason to panic here, since 2349 * the count doesn't have to be very precise. 2350 */ 2351 sc->sc_rexmt_count = USHRT_MAX; 2352 } 2353 2354 if (ipopts) { 2355 /* 2356 * If we were remembering a previous source route, 2357 * forget it and use the new one we've been given. 2358 */ 2359 if (sc->sc_ipopts) 2360 (void) m_free(sc->sc_ipopts); 2361 sc->sc_ipopts = ipopts; 2362 } 2363 2364 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) { 2365 tcpstat.tcps_sndacks++; 2366 tcpstat.tcps_sndtotal++; 2367 } 2368 return (1); 2369 } 2370 2371 sc = pool_get(&syn_cache_pool, PR_NOWAIT); 2372 if (sc == NULL) { 2373 if (ipopts) 2374 (void) m_free(ipopts); 2375 return (0); 2376 } 2377 2378 /* 2379 * Fill in the cache, and put the necessary IP and TCP 2380 * options into the reply. 2381 */ 2382 sc->sc_src.s_addr = ti->ti_src.s_addr; 2383 sc->sc_dst.s_addr = ti->ti_dst.s_addr; 2384 sc->sc_sport = ti->ti_sport; 2385 sc->sc_dport = ti->ti_dport; 2386 sc->sc_flags = 0; 2387 sc->sc_ipopts = ipopts; 2388 sc->sc_irs = ti->ti_seq; 2389 sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0); 2390 sc->sc_peermaxseg = oi->maxseg; 2391 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ? 2392 m->m_pkthdr.rcvif : NULL); 2393 if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP)) 2394 sc->sc_flags |= SCF_TIMESTAMP; 2395 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 2396 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 2397 sc->sc_requested_s_scale = tb.requested_s_scale; 2398 sc->sc_request_r_scale = 0; 2399 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 2400 TCP_MAXWIN << sc->sc_request_r_scale < 2401 so->so_rcv.sb_hiwat) 2402 sc->sc_request_r_scale++; 2403 } else { 2404 sc->sc_requested_s_scale = 15; 2405 sc->sc_request_r_scale = 15; 2406 } 2407 if (syn_cache_respond(sc, m, ti, win, tb.ts_recent) == 0) { 2408 syn_cache_insert(sc); 2409 tcpstat.tcps_sndacks++; 2410 tcpstat.tcps_sndtotal++; 2411 } else { 2412 if (sc->sc_ipopts) 2413 (void) m_free(sc->sc_ipopts); 2414 pool_put(&syn_cache_pool, sc); 2415 tcpstat.tcps_sc_dropped++; 2416 } 2417 return (1); 2418 } 2419 2420 int 2421 syn_cache_respond(sc, m, ti, win, ts) 2422 struct syn_cache *sc; 2423 struct mbuf *m; 2424 register struct tcpiphdr *ti; 2425 long win; 2426 u_long ts; 2427 { 2428 u_int8_t *optp; 2429 int optlen; 2430 2431 /* 2432 * Tack on the TCP options. If there isn't enough trailing 2433 * space for them, move up the fixed header to make space. 2434 */ 2435 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 2436 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 2437 if (optlen > M_TRAILINGSPACE(m)) { 2438 if (M_LEADINGSPACE(m) >= optlen) { 2439 m->m_data -= optlen; 2440 m->m_len += optlen; 2441 } else { 2442 struct mbuf *m0 = m; 2443 if ((m = m_gethdr(M_DONTWAIT, MT_HEADER)) == NULL) { 2444 m_freem(m0); 2445 return (ENOBUFS); 2446 } 2447 MH_ALIGN(m, sizeof(*ti) + optlen); 2448 m->m_next = m0; /* this gets freed below */ 2449 } 2450 bcopy((caddr_t)ti, mtod(m, caddr_t), sizeof(*ti)); 2451 ti = mtod(m, struct tcpiphdr *); 2452 } 2453 2454 optp = (u_int8_t *)(ti + 1); 2455 optp[0] = TCPOPT_MAXSEG; 2456 optp[1] = 4; 2457 optp[2] = (sc->sc_ourmaxseg >> 8) & 0xff; 2458 optp[3] = sc->sc_ourmaxseg & 0xff; 2459 optlen = 4; 2460 2461 if (sc->sc_request_r_scale != 15) { 2462 *((u_int32_t *)(optp + optlen)) = htonl(TCPOPT_NOP << 24 | 2463 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 2464 sc->sc_request_r_scale); 2465 optlen += 4; 2466 } 2467 2468 if (sc->sc_flags & SCF_TIMESTAMP) { 2469 u_int32_t *lp = (u_int32_t *)(optp + optlen); 2470 /* Form timestamp option as shown in appendix A of RFC 1323. */ 2471 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 2472 *lp++ = htonl(tcp_now); 2473 *lp = htonl(ts); 2474 optlen += TCPOLEN_TSTAMP_APPA; 2475 } 2476 2477 /* 2478 * Toss any trailing mbufs. No need to worry about 2479 * m_len and m_pkthdr.len, since tcp_respond() will 2480 * unconditionally set them. 2481 */ 2482 if (m->m_next) { 2483 m_freem(m->m_next); 2484 m->m_next = NULL; 2485 } 2486 2487 /* 2488 * Fill in the fields that tcp_respond() will not touch, and 2489 * then send the response. 2490 */ 2491 ti->ti_off = (sizeof(struct tcphdr) + optlen) >> 2; 2492 ti->ti_win = htons(win); 2493 return (tcp_respond(NULL, ti, m, sc->sc_irs + 1, sc->sc_iss, 2494 TH_SYN|TH_ACK)); 2495 } 2496