xref: /netbsd-src/sys/netinet/tcp_input.c (revision eb7c1594f145c931049e1fd9eb056a5987e87e59)
1 /*	$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $	*/
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  *      @(#)COPYRIGHT   1.1 (NRL) 17 January 1995
34  *
35  * NRL grants permission for redistribution and use in source and binary
36  * forms, with or without modification, of the software and documentation
37  * created at NRL provided that the following conditions are met:
38  *
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgements:
46  *      This product includes software developed by the University of
47  *      California, Berkeley and its contributors.
48  *      This product includes software developed at the Information
49  *      Technology Division, US Naval Research Laboratory.
50  * 4. Neither the name of the NRL nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
58  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65  *
66  * The views and conclusions contained in the software and documentation
67  * are those of the authors and should not be interpreted as representing
68  * official policies, either expressed or implied, of the US Naval
69  * Research Laboratory (NRL).
70  */
71 
72 /*-
73  * Copyright (c) 1997, 1998, 1999, 2001 The NetBSD Foundation, Inc.
74  * All rights reserved.
75  *
76  * This code is derived from software contributed to The NetBSD Foundation
77  * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
78  * Facility, NASA Ames Research Center.
79  *
80  * Redistribution and use in source and binary forms, with or without
81  * modification, are permitted provided that the following conditions
82  * are met:
83  * 1. Redistributions of source code must retain the above copyright
84  *    notice, this list of conditions and the following disclaimer.
85  * 2. Redistributions in binary form must reproduce the above copyright
86  *    notice, this list of conditions and the following disclaimer in the
87  *    documentation and/or other materials provided with the distribution.
88  * 3. All advertising materials mentioning features or use of this software
89  *    must display the following acknowledgement:
90  *	This product includes software developed by the NetBSD
91  *	Foundation, Inc. and its contributors.
92  * 4. Neither the name of The NetBSD Foundation nor the names of its
93  *    contributors may be used to endorse or promote products derived
94  *    from this software without specific prior written permission.
95  *
96  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106  * POSSIBILITY OF SUCH DAMAGE.
107  */
108 
109 /*
110  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111  *	The Regents of the University of California.  All rights reserved.
112  *
113  * Redistribution and use in source and binary forms, with or without
114  * modification, are permitted provided that the following conditions
115  * are met:
116  * 1. Redistributions of source code must retain the above copyright
117  *    notice, this list of conditions and the following disclaimer.
118  * 2. Redistributions in binary form must reproduce the above copyright
119  *    notice, this list of conditions and the following disclaimer in the
120  *    documentation and/or other materials provided with the distribution.
121  * 3. Neither the name of the University nor the names of its contributors
122  *    may be used to endorse or promote products derived from this software
123  *    without specific prior written permission.
124  *
125  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135  * SUCH DAMAGE.
136  *
137  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
138  */
139 
140 /*
141  *	TODO list for SYN cache stuff:
142  *
143  *	Find room for a "state" field, which is needed to keep a
144  *	compressed state for TIME_WAIT TCBs.  It's been noted already
145  *	that this is fairly important for very high-volume web and
146  *	mail servers, which use a large number of short-lived
147  *	connections.
148  */
149 
150 #include <sys/cdefs.h>
151 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $");
152 
153 #include "opt_inet.h"
154 #include "opt_ipsec.h"
155 #include "opt_inet_csum.h"
156 #include "opt_tcp_debug.h"
157 
158 #include <sys/param.h>
159 #include <sys/systm.h>
160 #include <sys/malloc.h>
161 #include <sys/mbuf.h>
162 #include <sys/protosw.h>
163 #include <sys/socket.h>
164 #include <sys/socketvar.h>
165 #include <sys/errno.h>
166 #include <sys/syslog.h>
167 #include <sys/pool.h>
168 #include <sys/domain.h>
169 #include <sys/kernel.h>
170 
171 #include <net/if.h>
172 #include <net/route.h>
173 #include <net/if_types.h>
174 
175 #include <netinet/in.h>
176 #include <netinet/in_systm.h>
177 #include <netinet/ip.h>
178 #include <netinet/in_pcb.h>
179 #include <netinet/in_var.h>
180 #include <netinet/ip_var.h>
181 
182 #ifdef INET6
183 #ifndef INET
184 #include <netinet/in.h>
185 #endif
186 #include <netinet/ip6.h>
187 #include <netinet6/ip6_var.h>
188 #include <netinet6/in6_pcb.h>
189 #include <netinet6/ip6_var.h>
190 #include <netinet6/in6_var.h>
191 #include <netinet/icmp6.h>
192 #include <netinet6/nd6.h>
193 #endif
194 
195 #ifndef INET6
196 /* always need ip6.h for IP6_EXTHDR_GET */
197 #include <netinet/ip6.h>
198 #endif
199 
200 #include <netinet/tcp.h>
201 #include <netinet/tcp_fsm.h>
202 #include <netinet/tcp_seq.h>
203 #include <netinet/tcp_timer.h>
204 #include <netinet/tcp_var.h>
205 #include <netinet/tcpip.h>
206 #include <netinet/tcp_debug.h>
207 
208 #include <machine/stdarg.h>
209 
210 #ifdef IPSEC
211 #include <netinet6/ipsec.h>
212 #include <netkey/key.h>
213 #endif /*IPSEC*/
214 #ifdef INET6
215 #include "faith.h"
216 #if defined(NFAITH) && NFAITH > 0
217 #include <net/if_faith.h>
218 #endif
219 #endif
220 
221 int	tcprexmtthresh = 3;
222 int	tcp_log_refused;
223 
224 static int tcp_rst_ppslim_count = 0;
225 static struct timeval tcp_rst_ppslim_last;
226 
227 #define TCP_PAWS_IDLE	(24 * 24 * 60 * 60 * PR_SLOWHZ)
228 
229 /* for modulo comparisons of timestamps */
230 #define TSTMP_LT(a,b)	((int)((a)-(b)) < 0)
231 #define TSTMP_GEQ(a,b)	((int)((a)-(b)) >= 0)
232 
233 /*
234  * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
235  */
236 #ifdef INET6
237 #define ND6_HINT(tp) \
238 do { \
239 	if (tp && tp->t_in6pcb && tp->t_family == AF_INET6 \
240 	 && tp->t_in6pcb->in6p_route.ro_rt) { \
241 		nd6_nud_hint(tp->t_in6pcb->in6p_route.ro_rt, NULL, 0); \
242 	} \
243 } while (/*CONSTCOND*/ 0)
244 #else
245 #define ND6_HINT(tp)
246 #endif
247 
248 /*
249  * Macro to compute ACK transmission behavior.  Delay the ACK unless
250  * we have already delayed an ACK (must send an ACK every two segments).
251  * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
252  * option is enabled.
253  */
254 #define	TCP_SETUP_ACK(tp, th) \
255 do { \
256 	if ((tp)->t_flags & TF_DELACK || \
257 	    (tcp_ack_on_push && (th)->th_flags & TH_PUSH)) \
258 		tp->t_flags |= TF_ACKNOW; \
259 	else \
260 		TCP_SET_DELACK(tp); \
261 } while (/*CONSTCOND*/ 0)
262 
263 /*
264  * Convert TCP protocol fields to host order for easier processing.
265  */
266 #define	TCP_FIELDS_TO_HOST(th)						\
267 do {									\
268 	NTOHL((th)->th_seq);						\
269 	NTOHL((th)->th_ack);						\
270 	NTOHS((th)->th_win);						\
271 	NTOHS((th)->th_urp);						\
272 } while (/*CONSTCOND*/ 0)
273 
274 /*
275  * ... and reverse the above.
276  */
277 #define	TCP_FIELDS_TO_NET(th)						\
278 do {									\
279 	HTONL((th)->th_seq);						\
280 	HTONL((th)->th_ack);						\
281 	HTONS((th)->th_win);						\
282 	HTONS((th)->th_urp);						\
283 } while (/*CONSTCOND*/ 0)
284 
285 #ifdef TCP_CSUM_COUNTERS
286 #include <sys/device.h>
287 
288 extern struct evcnt tcp_hwcsum_ok;
289 extern struct evcnt tcp_hwcsum_bad;
290 extern struct evcnt tcp_hwcsum_data;
291 extern struct evcnt tcp_swcsum;
292 
293 #define	TCP_CSUM_COUNTER_INCR(ev)	(ev)->ev_count++
294 
295 #else
296 
297 #define	TCP_CSUM_COUNTER_INCR(ev)	/* nothing */
298 
299 #endif /* TCP_CSUM_COUNTERS */
300 
301 #ifdef TCP_REASS_COUNTERS
302 #include <sys/device.h>
303 
304 extern struct evcnt tcp_reass_;
305 extern struct evcnt tcp_reass_empty;
306 extern struct evcnt tcp_reass_iteration[8];
307 extern struct evcnt tcp_reass_prependfirst;
308 extern struct evcnt tcp_reass_prepend;
309 extern struct evcnt tcp_reass_insert;
310 extern struct evcnt tcp_reass_inserttail;
311 extern struct evcnt tcp_reass_append;
312 extern struct evcnt tcp_reass_appendtail;
313 extern struct evcnt tcp_reass_overlaptail;
314 extern struct evcnt tcp_reass_overlapfront;
315 extern struct evcnt tcp_reass_segdup;
316 extern struct evcnt tcp_reass_fragdup;
317 
318 #define	TCP_REASS_COUNTER_INCR(ev)	(ev)->ev_count++
319 
320 #else
321 
322 #define	TCP_REASS_COUNTER_INCR(ev)	/* nothing */
323 
324 #endif /* TCP_REASS_COUNTERS */
325 
326 #ifdef INET
327 static void tcp4_log_refused __P((const struct ip *, const struct tcphdr *));
328 #endif
329 #ifdef INET6
330 static void tcp6_log_refused
331     __P((const struct ip6_hdr *, const struct tcphdr *));
332 #endif
333 
334 int
335 tcp_reass(tp, th, m, tlen)
336 	struct tcpcb *tp;
337 	struct tcphdr *th;
338 	struct mbuf *m;
339 	int *tlen;
340 {
341 	struct ipqent *p, *q, *nq, *tiqe = NULL;
342 	struct socket *so = NULL;
343 	int pkt_flags;
344 	tcp_seq pkt_seq;
345 	unsigned pkt_len;
346 	u_long rcvpartdupbyte = 0;
347 	u_long rcvoobyte;
348 #ifdef TCP_REASS_COUNTERS
349 	u_int count = 0;
350 #endif
351 
352 	if (tp->t_inpcb)
353 		so = tp->t_inpcb->inp_socket;
354 #ifdef INET6
355 	else if (tp->t_in6pcb)
356 		so = tp->t_in6pcb->in6p_socket;
357 #endif
358 
359 	TCP_REASS_LOCK_CHECK(tp);
360 
361 	/*
362 	 * Call with th==0 after become established to
363 	 * force pre-ESTABLISHED data up to user socket.
364 	 */
365 	if (th == 0)
366 		goto present;
367 
368 	rcvoobyte = *tlen;
369 	/*
370 	 * Copy these to local variables because the tcpiphdr
371 	 * gets munged while we are collapsing mbufs.
372 	 */
373 	pkt_seq = th->th_seq;
374 	pkt_len = *tlen;
375 	pkt_flags = th->th_flags;
376 
377 	TCP_REASS_COUNTER_INCR(&tcp_reass_);
378 
379 	if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
380 		/*
381 		 * When we miss a packet, the vast majority of time we get
382 		 * packets that follow it in order.  So optimize for that.
383 		 */
384 		if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
385 			p->ipqe_len += pkt_len;
386 			p->ipqe_flags |= pkt_flags;
387 			m_cat(p->ipqe_m, m);
388 			tiqe = p;
389 			TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
390 			TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
391 			goto skip_replacement;
392 		}
393 		/*
394 		 * While we're here, if the pkt is completely beyond
395 		 * anything we have, just insert it at the tail.
396 		 */
397 		if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
398 			TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
399 			goto insert_it;
400 		}
401 	}
402 
403 	q = TAILQ_FIRST(&tp->segq);
404 
405 	if (q != NULL) {
406 		/*
407 		 * If this segment immediately precedes the first out-of-order
408 		 * block, simply slap the segment in front of it and (mostly)
409 		 * skip the complicated logic.
410 		 */
411 		if (pkt_seq + pkt_len == q->ipqe_seq) {
412 			q->ipqe_seq = pkt_seq;
413 			q->ipqe_len += pkt_len;
414 			q->ipqe_flags |= pkt_flags;
415 			m_cat(m, q->ipqe_m);
416 			q->ipqe_m = m;
417 			tiqe = q;
418 			TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
419 			TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
420 			goto skip_replacement;
421 		}
422 	} else {
423 		TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
424 	}
425 
426 	/*
427 	 * Find a segment which begins after this one does.
428 	 */
429 	for (p = NULL; q != NULL; q = nq) {
430 		nq = TAILQ_NEXT(q, ipqe_q);
431 #ifdef TCP_REASS_COUNTERS
432 		count++;
433 #endif
434 		/*
435 		 * If the received segment is just right after this
436 		 * fragment, merge the two together and then check
437 		 * for further overlaps.
438 		 */
439 		if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
440 #ifdef TCPREASS_DEBUG
441 			printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
442 			       tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
443 			       q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
444 #endif
445 			pkt_len += q->ipqe_len;
446 			pkt_flags |= q->ipqe_flags;
447 			pkt_seq = q->ipqe_seq;
448 			m_cat(q->ipqe_m, m);
449 			m = q->ipqe_m;
450 			TCP_REASS_COUNTER_INCR(&tcp_reass_append);
451 			goto free_ipqe;
452 		}
453 		/*
454 		 * If the received segment is completely past this
455 		 * fragment, we need to go the next fragment.
456 		 */
457 		if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
458 			p = q;
459 			continue;
460 		}
461 		/*
462 		 * If the fragment is past the received segment,
463 		 * it (or any following) can't be concatenated.
464 		 */
465 		if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
466 			TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
467 			break;
468 		}
469 
470 		/*
471 		 * We've received all the data in this segment before.
472 		 * mark it as a duplicate and return.
473 		 */
474 		if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
475 		    SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
476 			tcpstat.tcps_rcvduppack++;
477 			tcpstat.tcps_rcvdupbyte += pkt_len;
478 			m_freem(m);
479 			if (tiqe != NULL)
480 				pool_put(&ipqent_pool, tiqe);
481 			TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
482 			return (0);
483 		}
484 		/*
485 		 * Received segment completely overlaps this fragment
486 		 * so we drop the fragment (this keeps the temporal
487 		 * ordering of segments correct).
488 		 */
489 		if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
490 		    SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
491 			rcvpartdupbyte += q->ipqe_len;
492 			m_freem(q->ipqe_m);
493 			TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
494 			goto free_ipqe;
495 		}
496 		/*
497 		 * RX'ed segment extends past the end of the
498 		 * fragment.  Drop the overlapping bytes.  Then
499 		 * merge the fragment and segment then treat as
500 		 * a longer received packet.
501 		 */
502 		if (SEQ_LT(q->ipqe_seq, pkt_seq)
503 		    && SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq))  {
504 			int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
505 #ifdef TCPREASS_DEBUG
506 			printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
507 			       tp, overlap,
508 			       pkt_seq, pkt_seq + pkt_len, pkt_len);
509 #endif
510 			m_adj(m, overlap);
511 			rcvpartdupbyte += overlap;
512 			m_cat(q->ipqe_m, m);
513 			m = q->ipqe_m;
514 			pkt_seq = q->ipqe_seq;
515 			pkt_len += q->ipqe_len - overlap;
516 			rcvoobyte -= overlap;
517 			TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
518 			goto free_ipqe;
519 		}
520 		/*
521 		 * RX'ed segment extends past the front of the
522 		 * fragment.  Drop the overlapping bytes on the
523 		 * received packet.  The packet will then be
524 		 * contatentated with this fragment a bit later.
525 		 */
526 		if (SEQ_GT(q->ipqe_seq, pkt_seq)
527 		    && SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len))  {
528 			int overlap = pkt_seq + pkt_len - q->ipqe_seq;
529 #ifdef TCPREASS_DEBUG
530 			printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
531 			       tp, overlap,
532 			       pkt_seq, pkt_seq + pkt_len, pkt_len);
533 #endif
534 			m_adj(m, -overlap);
535 			pkt_len -= overlap;
536 			rcvpartdupbyte += overlap;
537 			TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
538 			rcvoobyte -= overlap;
539 		}
540 		/*
541 		 * If the received segment immediates precedes this
542 		 * fragment then tack the fragment onto this segment
543 		 * and reinsert the data.
544 		 */
545 		if (q->ipqe_seq == pkt_seq + pkt_len) {
546 #ifdef TCPREASS_DEBUG
547 			printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
548 			       tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
549 			       pkt_seq, pkt_seq + pkt_len, pkt_len);
550 #endif
551 			pkt_len += q->ipqe_len;
552 			pkt_flags |= q->ipqe_flags;
553 			m_cat(m, q->ipqe_m);
554 			TAILQ_REMOVE(&tp->segq, q, ipqe_q);
555 			TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
556 			if (tiqe == NULL) {
557 			    tiqe = q;
558 			} else {
559 			    pool_put(&ipqent_pool, q);
560 			}
561 			TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
562 			break;
563 		}
564 		/*
565 		 * If the fragment is before the segment, remember it.
566 		 * When this loop is terminated, p will contain the
567 		 * pointer to fragment that is right before the received
568 		 * segment.
569 		 */
570 		if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
571 			p = q;
572 
573 		continue;
574 
575 		/*
576 		 * This is a common operation.  It also will allow
577 		 * to save doing a malloc/free in most instances.
578 		 */
579 	  free_ipqe:
580 		TAILQ_REMOVE(&tp->segq, q, ipqe_q);
581 		TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
582 		if (tiqe == NULL) {
583 		    tiqe = q;
584 		} else {
585 		    pool_put(&ipqent_pool, q);
586 		}
587 	}
588 
589 #ifdef TCP_REASS_COUNTERS
590 	if (count > 7)
591 		TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
592 	else if (count > 0)
593 		TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
594 #endif
595 
596     insert_it:
597 
598 	/*
599 	 * Allocate a new queue entry since the received segment did not
600 	 * collapse onto any other out-of-order block; thus we are allocating
601 	 * a new block.  If it had collapsed, tiqe would not be NULL and
602 	 * we would be reusing it.
603 	 * XXX If we can't, just drop the packet.  XXX
604 	 */
605 	if (tiqe == NULL) {
606 		tiqe = pool_get(&ipqent_pool, PR_NOWAIT);
607 		if (tiqe == NULL) {
608 			tcpstat.tcps_rcvmemdrop++;
609 			m_freem(m);
610 			return (0);
611 		}
612 	}
613 
614 	/*
615 	 * Update the counters.
616 	 */
617 	tcpstat.tcps_rcvoopack++;
618 	tcpstat.tcps_rcvoobyte += rcvoobyte;
619 	if (rcvpartdupbyte) {
620 	    tcpstat.tcps_rcvpartduppack++;
621 	    tcpstat.tcps_rcvpartdupbyte += rcvpartdupbyte;
622 	}
623 
624 	/*
625 	 * Insert the new fragment queue entry into both queues.
626 	 */
627 	tiqe->ipqe_m = m;
628 	tiqe->ipqe_seq = pkt_seq;
629 	tiqe->ipqe_len = pkt_len;
630 	tiqe->ipqe_flags = pkt_flags;
631 	if (p == NULL) {
632 		TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
633 #ifdef TCPREASS_DEBUG
634 		if (tiqe->ipqe_seq != tp->rcv_nxt)
635 			printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
636 			       tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
637 #endif
638 	} else {
639 		TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
640 #ifdef TCPREASS_DEBUG
641 		printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
642 		       tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
643 		       p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
644 #endif
645 	}
646 
647 skip_replacement:
648 
649 	TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
650 
651 present:
652 	/*
653 	 * Present data to user, advancing rcv_nxt through
654 	 * completed sequence space.
655 	 */
656 	if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
657 		return (0);
658 	q = TAILQ_FIRST(&tp->segq);
659 	if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
660 		return (0);
661 	if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
662 		return (0);
663 
664 	tp->rcv_nxt += q->ipqe_len;
665 	pkt_flags = q->ipqe_flags & TH_FIN;
666 	ND6_HINT(tp);
667 
668 	TAILQ_REMOVE(&tp->segq, q, ipqe_q);
669 	TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
670 	if (so->so_state & SS_CANTRCVMORE)
671 		m_freem(q->ipqe_m);
672 	else
673 		sbappendstream(&so->so_rcv, q->ipqe_m);
674 	pool_put(&ipqent_pool, q);
675 	sorwakeup(so);
676 	return (pkt_flags);
677 }
678 
679 #ifdef INET6
680 int
681 tcp6_input(mp, offp, proto)
682 	struct mbuf **mp;
683 	int *offp, proto;
684 {
685 	struct mbuf *m = *mp;
686 
687 	/*
688 	 * draft-itojun-ipv6-tcp-to-anycast
689 	 * better place to put this in?
690 	 */
691 	if (m->m_flags & M_ANYCAST6) {
692 		struct ip6_hdr *ip6;
693 		if (m->m_len < sizeof(struct ip6_hdr)) {
694 			if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
695 				tcpstat.tcps_rcvshort++;
696 				return IPPROTO_DONE;
697 			}
698 		}
699 		ip6 = mtod(m, struct ip6_hdr *);
700 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
701 		    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
702 		return IPPROTO_DONE;
703 	}
704 
705 	tcp_input(m, *offp, proto);
706 	return IPPROTO_DONE;
707 }
708 #endif
709 
710 #ifdef INET
711 static void
712 tcp4_log_refused(ip, th)
713 	const struct ip *ip;
714 	const struct tcphdr *th;
715 {
716 	char src[4*sizeof "123"];
717 	char dst[4*sizeof "123"];
718 
719 	if (ip) {
720 		strlcpy(src, inet_ntoa(ip->ip_src), sizeof(src));
721 		strlcpy(dst, inet_ntoa(ip->ip_dst), sizeof(dst));
722 	}
723 	else {
724 		strlcpy(src, "(unknown)", sizeof(src));
725 		strlcpy(dst, "(unknown)", sizeof(dst));
726 	}
727 	log(LOG_INFO,
728 	    "Connection attempt to TCP %s:%d from %s:%d\n",
729 	    dst, ntohs(th->th_dport),
730 	    src, ntohs(th->th_sport));
731 }
732 #endif
733 
734 #ifdef INET6
735 static void
736 tcp6_log_refused(ip6, th)
737 	const struct ip6_hdr *ip6;
738 	const struct tcphdr *th;
739 {
740 	char src[INET6_ADDRSTRLEN];
741 	char dst[INET6_ADDRSTRLEN];
742 
743 	if (ip6) {
744 		strlcpy(src, ip6_sprintf(&ip6->ip6_src), sizeof(src));
745 		strlcpy(dst, ip6_sprintf(&ip6->ip6_dst), sizeof(dst));
746 	}
747 	else {
748 		strlcpy(src, "(unknown v6)", sizeof(src));
749 		strlcpy(dst, "(unknown v6)", sizeof(dst));
750 	}
751 	log(LOG_INFO,
752 	    "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
753 	    dst, ntohs(th->th_dport),
754 	    src, ntohs(th->th_sport));
755 }
756 #endif
757 
758 /*
759  * TCP input routine, follows pages 65-76 of the
760  * protocol specification dated September, 1981 very closely.
761  */
762 void
763 #if __STDC__
764 tcp_input(struct mbuf *m, ...)
765 #else
766 tcp_input(m, va_alist)
767 	struct mbuf *m;
768 #endif
769 {
770 	struct tcphdr *th;
771 	struct ip *ip;
772 	struct inpcb *inp;
773 #ifdef INET6
774 	struct ip6_hdr *ip6;
775 	struct in6pcb *in6p;
776 #endif
777 	u_int8_t *optp = NULL;
778 	int optlen = 0;
779 	int len, tlen, toff, hdroptlen = 0;
780 	struct tcpcb *tp = 0;
781 	int tiflags;
782 	struct socket *so = NULL;
783 	int todrop, acked, ourfinisacked, needoutput = 0;
784 #ifdef TCP_DEBUG
785 	short ostate = 0;
786 #endif
787 	int iss = 0;
788 	u_long tiwin;
789 	struct tcp_opt_info opti;
790 	int off, iphlen;
791 	va_list ap;
792 	int af;		/* af on the wire */
793 	struct mbuf *tcp_saveti = NULL;
794 
795 	MCLAIM(m, &tcp_rx_mowner);
796 	va_start(ap, m);
797 	toff = va_arg(ap, int);
798 	(void)va_arg(ap, int);		/* ignore value, advance ap */
799 	va_end(ap);
800 
801 	tcpstat.tcps_rcvtotal++;
802 
803 	bzero(&opti, sizeof(opti));
804 	opti.ts_present = 0;
805 	opti.maxseg = 0;
806 
807 	/*
808 	 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
809 	 *
810 	 * TCP is, by definition, unicast, so we reject all
811 	 * multicast outright.
812 	 *
813 	 * Note, there are additional src/dst address checks in
814 	 * the AF-specific code below.
815 	 */
816 	if (m->m_flags & (M_BCAST|M_MCAST)) {
817 		/* XXX stat */
818 		goto drop;
819 	}
820 #ifdef INET6
821 	if (m->m_flags & M_ANYCAST6) {
822 		/* XXX stat */
823 		goto drop;
824 	}
825 #endif
826 
827 	/*
828 	 * Get IP and TCP header together in first mbuf.
829 	 * Note: IP leaves IP header in first mbuf.
830 	 */
831 	ip = mtod(m, struct ip *);
832 #ifdef INET6
833 	ip6 = NULL;
834 #endif
835 	switch (ip->ip_v) {
836 #ifdef INET
837 	case 4:
838 		af = AF_INET;
839 		iphlen = sizeof(struct ip);
840 		ip = mtod(m, struct ip *);
841 		IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
842 			sizeof(struct tcphdr));
843 		if (th == NULL) {
844 			tcpstat.tcps_rcvshort++;
845 			return;
846 		}
847 		/* We do the checksum after PCB lookup... */
848 		len = ntohs(ip->ip_len);
849 		tlen = len - toff;
850 		break;
851 #endif
852 #ifdef INET6
853 	case 6:
854 		ip = NULL;
855 		iphlen = sizeof(struct ip6_hdr);
856 		af = AF_INET6;
857 		ip6 = mtod(m, struct ip6_hdr *);
858 		IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
859 			sizeof(struct tcphdr));
860 		if (th == NULL) {
861 			tcpstat.tcps_rcvshort++;
862 			return;
863 		}
864 
865 		/* Be proactive about malicious use of IPv4 mapped address */
866 		if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
867 		    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
868 			/* XXX stat */
869 			goto drop;
870 		}
871 
872 		/*
873 		 * Be proactive about unspecified IPv6 address in source.
874 		 * As we use all-zero to indicate unbounded/unconnected pcb,
875 		 * unspecified IPv6 address can be used to confuse us.
876 		 *
877 		 * Note that packets with unspecified IPv6 destination is
878 		 * already dropped in ip6_input.
879 		 */
880 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
881 			/* XXX stat */
882 			goto drop;
883 		}
884 
885 		/*
886 		 * Make sure destination address is not multicast.
887 		 * Source address checked in ip6_input().
888 		 */
889 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
890 			/* XXX stat */
891 			goto drop;
892 		}
893 
894 		/* We do the checksum after PCB lookup... */
895 		len = m->m_pkthdr.len;
896 		tlen = len - toff;
897 		break;
898 #endif
899 	default:
900 		m_freem(m);
901 		return;
902 	}
903 
904 	KASSERT(TCP_HDR_ALIGNED_P(th));
905 
906 	/*
907 	 * Check that TCP offset makes sense,
908 	 * pull out TCP options and adjust length.		XXX
909 	 */
910 	off = th->th_off << 2;
911 	if (off < sizeof (struct tcphdr) || off > tlen) {
912 		tcpstat.tcps_rcvbadoff++;
913 		goto drop;
914 	}
915 	tlen -= off;
916 
917 	/*
918 	 * tcp_input() has been modified to use tlen to mean the TCP data
919 	 * length throughout the function.  Other functions can use
920 	 * m->m_pkthdr.len as the basis for calculating the TCP data length.
921 	 * rja
922 	 */
923 
924 	if (off > sizeof (struct tcphdr)) {
925 		IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
926 		if (th == NULL) {
927 			tcpstat.tcps_rcvshort++;
928 			return;
929 		}
930 		/*
931 		 * NOTE: ip/ip6 will not be affected by m_pulldown()
932 		 * (as they're before toff) and we don't need to update those.
933 		 */
934 		KASSERT(TCP_HDR_ALIGNED_P(th));
935 		optlen = off - sizeof (struct tcphdr);
936 		optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
937 		/*
938 		 * Do quick retrieval of timestamp options ("options
939 		 * prediction?").  If timestamp is the only option and it's
940 		 * formatted as recommended in RFC 1323 appendix A, we
941 		 * quickly get the values now and not bother calling
942 		 * tcp_dooptions(), etc.
943 		 */
944 		if ((optlen == TCPOLEN_TSTAMP_APPA ||
945 		     (optlen > TCPOLEN_TSTAMP_APPA &&
946 			optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
947 		     *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
948 		     (th->th_flags & TH_SYN) == 0) {
949 			opti.ts_present = 1;
950 			opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
951 			opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
952 			optp = NULL;	/* we've parsed the options */
953 		}
954 	}
955 	tiflags = th->th_flags;
956 
957 	/*
958 	 * Locate pcb for segment.
959 	 */
960 findpcb:
961 	inp = NULL;
962 #ifdef INET6
963 	in6p = NULL;
964 #endif
965 	switch (af) {
966 #ifdef INET
967 	case AF_INET:
968 		inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
969 		    ip->ip_dst, th->th_dport);
970 		if (inp == 0) {
971 			++tcpstat.tcps_pcbhashmiss;
972 			inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
973 		}
974 #ifdef INET6
975 		if (inp == 0) {
976 			struct in6_addr s, d;
977 
978 			/* mapped addr case */
979 			bzero(&s, sizeof(s));
980 			s.s6_addr16[5] = htons(0xffff);
981 			bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
982 			bzero(&d, sizeof(d));
983 			d.s6_addr16[5] = htons(0xffff);
984 			bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
985 			in6p = in6_pcblookup_connect(&tcb6, &s, th->th_sport,
986 				&d, th->th_dport, 0);
987 			if (in6p == 0) {
988 				++tcpstat.tcps_pcbhashmiss;
989 				in6p = in6_pcblookup_bind(&tcb6, &d,
990 					th->th_dport, 0);
991 			}
992 		}
993 #endif
994 #ifndef INET6
995 		if (inp == 0)
996 #else
997 		if (inp == 0 && in6p == 0)
998 #endif
999 		{
1000 			++tcpstat.tcps_noport;
1001 			if (tcp_log_refused &&
1002 			    (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1003 				tcp4_log_refused(ip, th);
1004 			}
1005 			TCP_FIELDS_TO_HOST(th);
1006 			goto dropwithreset_ratelim;
1007 		}
1008 #ifdef IPSEC
1009 		if (inp && ipsec4_in_reject(m, inp)) {
1010 			ipsecstat.in_polvio++;
1011 			goto drop;
1012 		}
1013 #ifdef INET6
1014 		else if (in6p && ipsec4_in_reject_so(m, in6p->in6p_socket)) {
1015 			ipsecstat.in_polvio++;
1016 			goto drop;
1017 		}
1018 #endif
1019 #endif /*IPSEC*/
1020 		break;
1021 #endif /*INET*/
1022 #ifdef INET6
1023 	case AF_INET6:
1024 	    {
1025 		int faith;
1026 
1027 #if defined(NFAITH) && NFAITH > 0
1028 		faith = faithprefix(&ip6->ip6_dst);
1029 #else
1030 		faith = 0;
1031 #endif
1032 		in6p = in6_pcblookup_connect(&tcb6, &ip6->ip6_src, th->th_sport,
1033 			&ip6->ip6_dst, th->th_dport, faith);
1034 		if (in6p == NULL) {
1035 			++tcpstat.tcps_pcbhashmiss;
1036 			in6p = in6_pcblookup_bind(&tcb6, &ip6->ip6_dst,
1037 				th->th_dport, faith);
1038 		}
1039 		if (in6p == NULL) {
1040 			++tcpstat.tcps_noport;
1041 			if (tcp_log_refused &&
1042 			    (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1043 				tcp6_log_refused(ip6, th);
1044 			}
1045 			TCP_FIELDS_TO_HOST(th);
1046 			goto dropwithreset_ratelim;
1047 		}
1048 #ifdef IPSEC
1049 		if (ipsec6_in_reject(m, in6p)) {
1050 			ipsec6stat.in_polvio++;
1051 			goto drop;
1052 		}
1053 #endif /*IPSEC*/
1054 		break;
1055 	    }
1056 #endif
1057 	}
1058 
1059 	/*
1060 	 * If the state is CLOSED (i.e., TCB does not exist) then
1061 	 * all data in the incoming segment is discarded.
1062 	 * If the TCB exists but is in CLOSED state, it is embryonic,
1063 	 * but should either do a listen or a connect soon.
1064 	 */
1065 	tp = NULL;
1066 	so = NULL;
1067 	if (inp) {
1068 		tp = intotcpcb(inp);
1069 		so = inp->inp_socket;
1070 	}
1071 #ifdef INET6
1072 	else if (in6p) {
1073 		tp = in6totcpcb(in6p);
1074 		so = in6p->in6p_socket;
1075 	}
1076 #endif
1077 	if (tp == 0) {
1078 		TCP_FIELDS_TO_HOST(th);
1079 		goto dropwithreset_ratelim;
1080 	}
1081 	if (tp->t_state == TCPS_CLOSED)
1082 		goto drop;
1083 
1084 	/*
1085 	 * Checksum extended TCP header and data.
1086 	 */
1087 	switch (af) {
1088 #ifdef INET
1089 	case AF_INET:
1090 		switch (m->m_pkthdr.csum_flags &
1091 			((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
1092 			 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
1093 		case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
1094 			TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
1095 			goto badcsum;
1096 
1097 		case M_CSUM_TCPv4|M_CSUM_DATA:
1098 			TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
1099 			if ((m->m_pkthdr.csum_data ^ 0xffff) != 0)
1100 				goto badcsum;
1101 			break;
1102 
1103 		case M_CSUM_TCPv4:
1104 			/* Checksum was okay. */
1105 			TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
1106 			break;
1107 
1108 		default:
1109 			/* Must compute it ourselves. */
1110 			TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
1111 			if (in4_cksum(m, IPPROTO_TCP, toff, tlen + off) != 0)
1112 				goto badcsum;
1113 			break;
1114 		}
1115 		break;
1116 #endif /* INET4 */
1117 
1118 #ifdef INET6
1119 	case AF_INET6:
1120 		if (in6_cksum(m, IPPROTO_TCP, toff, tlen + off) != 0)
1121 			goto badcsum;
1122 		break;
1123 #endif /* INET6 */
1124 	}
1125 
1126 	TCP_FIELDS_TO_HOST(th);
1127 
1128 	/* Unscale the window into a 32-bit value. */
1129 	if ((tiflags & TH_SYN) == 0)
1130 		tiwin = th->th_win << tp->snd_scale;
1131 	else
1132 		tiwin = th->th_win;
1133 
1134 #ifdef INET6
1135 	/* save packet options if user wanted */
1136 	if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1137 		if (in6p->in6p_options) {
1138 			m_freem(in6p->in6p_options);
1139 			in6p->in6p_options = 0;
1140 		}
1141 		ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1142 	}
1143 #endif
1144 
1145 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1146 		union syn_cache_sa src;
1147 		union syn_cache_sa dst;
1148 
1149 		bzero(&src, sizeof(src));
1150 		bzero(&dst, sizeof(dst));
1151 		switch (af) {
1152 #ifdef INET
1153 		case AF_INET:
1154 			src.sin.sin_len = sizeof(struct sockaddr_in);
1155 			src.sin.sin_family = AF_INET;
1156 			src.sin.sin_addr = ip->ip_src;
1157 			src.sin.sin_port = th->th_sport;
1158 
1159 			dst.sin.sin_len = sizeof(struct sockaddr_in);
1160 			dst.sin.sin_family = AF_INET;
1161 			dst.sin.sin_addr = ip->ip_dst;
1162 			dst.sin.sin_port = th->th_dport;
1163 			break;
1164 #endif
1165 #ifdef INET6
1166 		case AF_INET6:
1167 			src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1168 			src.sin6.sin6_family = AF_INET6;
1169 			src.sin6.sin6_addr = ip6->ip6_src;
1170 			src.sin6.sin6_port = th->th_sport;
1171 
1172 			dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1173 			dst.sin6.sin6_family = AF_INET6;
1174 			dst.sin6.sin6_addr = ip6->ip6_dst;
1175 			dst.sin6.sin6_port = th->th_dport;
1176 			break;
1177 #endif /* INET6 */
1178 		default:
1179 			goto badsyn;	/*sanity*/
1180 		}
1181 
1182 		if (so->so_options & SO_DEBUG) {
1183 #ifdef TCP_DEBUG
1184 			ostate = tp->t_state;
1185 #endif
1186 
1187 			tcp_saveti = NULL;
1188 			if (iphlen + sizeof(struct tcphdr) > MHLEN)
1189 				goto nosave;
1190 
1191 			if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1192 				tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1193 				if (!tcp_saveti)
1194 					goto nosave;
1195 			} else {
1196 				MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1197 				if (!tcp_saveti)
1198 					goto nosave;
1199 				MCLAIM(m, &tcp_mowner);
1200 				tcp_saveti->m_len = iphlen;
1201 				m_copydata(m, 0, iphlen,
1202 				    mtod(tcp_saveti, caddr_t));
1203 			}
1204 
1205 			if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1206 				m_freem(tcp_saveti);
1207 				tcp_saveti = NULL;
1208 			} else {
1209 				tcp_saveti->m_len += sizeof(struct tcphdr);
1210 				bcopy(th, mtod(tcp_saveti, caddr_t) + iphlen,
1211 				    sizeof(struct tcphdr));
1212 			}
1213 	nosave:;
1214 		}
1215 		if (so->so_options & SO_ACCEPTCONN) {
1216 			if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1217 				if (tiflags & TH_RST) {
1218 					syn_cache_reset(&src.sa, &dst.sa, th);
1219 				} else if ((tiflags & (TH_ACK|TH_SYN)) ==
1220 				    (TH_ACK|TH_SYN)) {
1221 					/*
1222 					 * Received a SYN,ACK.  This should
1223 					 * never happen while we are in
1224 					 * LISTEN.  Send an RST.
1225 					 */
1226 					goto badsyn;
1227 				} else if (tiflags & TH_ACK) {
1228 					so = syn_cache_get(&src.sa, &dst.sa,
1229 						th, toff, tlen, so, m);
1230 					if (so == NULL) {
1231 						/*
1232 						 * We don't have a SYN for
1233 						 * this ACK; send an RST.
1234 						 */
1235 						goto badsyn;
1236 					} else if (so ==
1237 					    (struct socket *)(-1)) {
1238 						/*
1239 						 * We were unable to create
1240 						 * the connection.  If the
1241 						 * 3-way handshake was
1242 						 * completed, and RST has
1243 						 * been sent to the peer.
1244 						 * Since the mbuf might be
1245 						 * in use for the reply,
1246 						 * do not free it.
1247 						 */
1248 						m = NULL;
1249 					} else {
1250 						/*
1251 						 * We have created a
1252 						 * full-blown connection.
1253 						 */
1254 						tp = NULL;
1255 						inp = NULL;
1256 #ifdef INET6
1257 						in6p = NULL;
1258 #endif
1259 						switch (so->so_proto->pr_domain->dom_family) {
1260 #ifdef INET
1261 						case AF_INET:
1262 							inp = sotoinpcb(so);
1263 							tp = intotcpcb(inp);
1264 							break;
1265 #endif
1266 #ifdef INET6
1267 						case AF_INET6:
1268 							in6p = sotoin6pcb(so);
1269 							tp = in6totcpcb(in6p);
1270 							break;
1271 #endif
1272 						}
1273 						if (tp == NULL)
1274 							goto badsyn;	/*XXX*/
1275 						tiwin <<= tp->snd_scale;
1276 						goto after_listen;
1277 					}
1278 				} else {
1279 					/*
1280 					 * None of RST, SYN or ACK was set.
1281 					 * This is an invalid packet for a
1282 					 * TCB in LISTEN state.  Send a RST.
1283 					 */
1284 					goto badsyn;
1285 				}
1286 			} else {
1287 				/*
1288 				 * Received a SYN.
1289 				 */
1290 
1291 #ifdef INET6
1292 				/*
1293 				 * If deprecated address is forbidden, we do
1294 				 * not accept SYN to deprecated interface
1295 				 * address to prevent any new inbound
1296 				 * connection from getting established.
1297 				 * When we do not accept SYN, we send a TCP
1298 				 * RST, with deprecated source address (instead
1299 				 * of dropping it).  We compromise it as it is
1300 				 * much better for peer to send a RST, and
1301 				 * RST will be the final packet for the
1302 				 * exchange.
1303 				 *
1304 				 * If we do not forbid deprecated addresses, we
1305 				 * accept the SYN packet.  RFC2462 does not
1306 				 * suggest dropping SYN in this case.
1307 				 * If we decipher RFC2462 5.5.4, it says like
1308 				 * this:
1309 				 * 1. use of deprecated addr with existing
1310 				 *    communication is okay - "SHOULD continue
1311 				 *    to be used"
1312 				 * 2. use of it with new communication:
1313 				 *   (2a) "SHOULD NOT be used if alternate
1314 				 *        address with sufficient scope is
1315 				 *        available"
1316 				 *   (2b) nothing mentioned otherwise.
1317 				 * Here we fall into (2b) case as we have no
1318 				 * choice in our source address selection - we
1319 				 * must obey the peer.
1320 				 *
1321 				 * The wording in RFC2462 is confusing, and
1322 				 * there are multiple description text for
1323 				 * deprecated address handling - worse, they
1324 				 * are not exactly the same.  I believe 5.5.4
1325 				 * is the best one, so we follow 5.5.4.
1326 				 */
1327 				if (af == AF_INET6 && !ip6_use_deprecated) {
1328 					struct in6_ifaddr *ia6;
1329 					if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
1330 					    &ip6->ip6_dst)) &&
1331 					    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1332 						tp = NULL;
1333 						goto dropwithreset;
1334 					}
1335 				}
1336 #endif
1337 
1338 				/*
1339 				 * LISTEN socket received a SYN
1340 				 * from itself?  This can't possibly
1341 				 * be valid; drop the packet.
1342 				 */
1343 				if (th->th_sport == th->th_dport) {
1344 					int i;
1345 
1346 					switch (af) {
1347 #ifdef INET
1348 					case AF_INET:
1349 						i = in_hosteq(ip->ip_src, ip->ip_dst);
1350 						break;
1351 #endif
1352 #ifdef INET6
1353 					case AF_INET6:
1354 						i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1355 						break;
1356 #endif
1357 					default:
1358 						i = 1;
1359 					}
1360 					if (i) {
1361 						tcpstat.tcps_badsyn++;
1362 						goto drop;
1363 					}
1364 				}
1365 
1366 				/*
1367 				 * SYN looks ok; create compressed TCP
1368 				 * state for it.
1369 				 */
1370 				if (so->so_qlen <= so->so_qlimit &&
1371 				    syn_cache_add(&src.sa, &dst.sa, th, tlen,
1372 						so, m, optp, optlen, &opti))
1373 					m = NULL;
1374 			}
1375 			goto drop;
1376 		}
1377 	}
1378 
1379 after_listen:
1380 #ifdef DIAGNOSTIC
1381 	/*
1382 	 * Should not happen now that all embryonic connections
1383 	 * are handled with compressed state.
1384 	 */
1385 	if (tp->t_state == TCPS_LISTEN)
1386 		panic("tcp_input: TCPS_LISTEN");
1387 #endif
1388 
1389 	/*
1390 	 * Segment received on connection.
1391 	 * Reset idle time and keep-alive timer.
1392 	 */
1393 	tp->t_rcvtime = tcp_now;
1394 	if (TCPS_HAVEESTABLISHED(tp->t_state))
1395 		TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle);
1396 
1397 	/*
1398 	 * Process options.
1399 	 */
1400 	if (optp)
1401 		tcp_dooptions(tp, optp, optlen, th, &opti);
1402 
1403 	/*
1404 	 * Header prediction: check for the two common cases
1405 	 * of a uni-directional data xfer.  If the packet has
1406 	 * no control flags, is in-sequence, the window didn't
1407 	 * change and we're not retransmitting, it's a
1408 	 * candidate.  If the length is zero and the ack moved
1409 	 * forward, we're the sender side of the xfer.  Just
1410 	 * free the data acked & wake any higher level process
1411 	 * that was blocked waiting for space.  If the length
1412 	 * is non-zero and the ack didn't move, we're the
1413 	 * receiver side.  If we're getting packets in-order
1414 	 * (the reassembly queue is empty), add the data to
1415 	 * the socket buffer and note that we need a delayed ack.
1416 	 */
1417 	if (tp->t_state == TCPS_ESTABLISHED &&
1418 	    (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1419 	    (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1420 	    th->th_seq == tp->rcv_nxt &&
1421 	    tiwin && tiwin == tp->snd_wnd &&
1422 	    tp->snd_nxt == tp->snd_max) {
1423 
1424 		/*
1425 		 * If last ACK falls within this segment's sequence numbers,
1426 		 *  record the timestamp.
1427 		 */
1428 		if (opti.ts_present &&
1429 		    SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1430 		    SEQ_LT(tp->last_ack_sent, th->th_seq + tlen)) {
1431 			tp->ts_recent_age = TCP_TIMESTAMP(tp);
1432 			tp->ts_recent = opti.ts_val;
1433 		}
1434 
1435 		if (tlen == 0) {
1436 			if (SEQ_GT(th->th_ack, tp->snd_una) &&
1437 			    SEQ_LEQ(th->th_ack, tp->snd_max) &&
1438 			    tp->snd_cwnd >= tp->snd_wnd &&
1439 			    tp->t_dupacks < tcprexmtthresh) {
1440 				int slen;
1441 
1442 				/*
1443 				 * this is a pure ack for outstanding data.
1444 				 */
1445 				++tcpstat.tcps_predack;
1446 				if (opti.ts_present && opti.ts_ecr)
1447 					tcp_xmit_timer(tp,
1448 					  TCP_TIMESTAMP(tp) - opti.ts_ecr + 1);
1449 				else if (tp->t_rtttime &&
1450 				    SEQ_GT(th->th_ack, tp->t_rtseq))
1451 					tcp_xmit_timer(tp,
1452 					tcp_now - tp->t_rtttime);
1453 				acked = th->th_ack - tp->snd_una;
1454 				tcpstat.tcps_rcvackpack++;
1455 				tcpstat.tcps_rcvackbyte += acked;
1456 				ND6_HINT(tp);
1457 
1458 				slen = tp->t_lastm->m_len;
1459 				sbdrop(&so->so_snd, acked);
1460 				if (so->so_snd.sb_cc != 0) {
1461 					tp->t_lastoff -= acked;
1462 					if (tp->t_lastm->m_len < slen)
1463 						tp->t_inoff -=
1464 						    (slen - tp->t_lastm->m_len);
1465 				}
1466 
1467 				/*
1468 				 * We want snd_recover to track snd_una to
1469 				 * avoid sequence wraparound problems for
1470 				 * very large transfers.
1471 				 */
1472 				tp->snd_una = tp->snd_recover = th->th_ack;
1473 				m_freem(m);
1474 
1475 				/*
1476 				 * If all outstanding data are acked, stop
1477 				 * retransmit timer, otherwise restart timer
1478 				 * using current (possibly backed-off) value.
1479 				 * If process is waiting for space,
1480 				 * wakeup/selwakeup/signal.  If data
1481 				 * are ready to send, let tcp_output
1482 				 * decide between more output or persist.
1483 				 */
1484 				if (tp->snd_una == tp->snd_max)
1485 					TCP_TIMER_DISARM(tp, TCPT_REXMT);
1486 				else if (TCP_TIMER_ISARMED(tp,
1487 				    TCPT_PERSIST) == 0)
1488 					TCP_TIMER_ARM(tp, TCPT_REXMT,
1489 					    tp->t_rxtcur);
1490 
1491 				sowwakeup(so);
1492 				if (so->so_snd.sb_cc)
1493 					(void) tcp_output(tp);
1494 				if (tcp_saveti)
1495 					m_freem(tcp_saveti);
1496 				return;
1497 			}
1498 		} else if (th->th_ack == tp->snd_una &&
1499 		    TAILQ_FIRST(&tp->segq) == NULL &&
1500 		    tlen <= sbspace(&so->so_rcv)) {
1501 			/*
1502 			 * this is a pure, in-sequence data packet
1503 			 * with nothing on the reassembly queue and
1504 			 * we have enough buffer space to take it.
1505 			 */
1506 			++tcpstat.tcps_preddat;
1507 			tp->rcv_nxt += tlen;
1508 			tcpstat.tcps_rcvpack++;
1509 			tcpstat.tcps_rcvbyte += tlen;
1510 			ND6_HINT(tp);
1511 			/*
1512 			 * Drop TCP, IP headers and TCP options then add data
1513 			 * to socket buffer.
1514 			 */
1515 			if (so->so_state & SS_CANTRCVMORE)
1516 				m_freem(m);
1517 			else {
1518 				m_adj(m, toff + off);
1519 				sbappendstream(&so->so_rcv, m);
1520 			}
1521 			sorwakeup(so);
1522 			TCP_SETUP_ACK(tp, th);
1523 			if (tp->t_flags & TF_ACKNOW)
1524 				(void) tcp_output(tp);
1525 			if (tcp_saveti)
1526 				m_freem(tcp_saveti);
1527 			return;
1528 		}
1529 	}
1530 
1531 	/*
1532 	 * Compute mbuf offset to TCP data segment.
1533 	 */
1534 	hdroptlen = toff + off;
1535 
1536 	/*
1537 	 * Calculate amount of space in receive window,
1538 	 * and then do TCP input processing.
1539 	 * Receive window is amount of space in rcv queue,
1540 	 * but not less than advertised window.
1541 	 */
1542 	{ int win;
1543 
1544 	win = sbspace(&so->so_rcv);
1545 	if (win < 0)
1546 		win = 0;
1547 	tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1548 	}
1549 
1550 	switch (tp->t_state) {
1551 	case TCPS_LISTEN:
1552 		/*
1553 		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1554 		 */
1555 		if (m->m_flags & (M_BCAST|M_MCAST))
1556 			goto drop;
1557 		switch (af) {
1558 #ifdef INET6
1559 		case AF_INET6:
1560 			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1561 				goto drop;
1562 			break;
1563 #endif /* INET6 */
1564 		case AF_INET:
1565 			if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1566 			    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1567 				goto drop;
1568 			break;
1569 		}
1570 		break;
1571 
1572 	/*
1573 	 * If the state is SYN_SENT:
1574 	 *	if seg contains an ACK, but not for our SYN, drop the input.
1575 	 *	if seg contains a RST, then drop the connection.
1576 	 *	if seg does not contain SYN, then drop it.
1577 	 * Otherwise this is an acceptable SYN segment
1578 	 *	initialize tp->rcv_nxt and tp->irs
1579 	 *	if seg contains ack then advance tp->snd_una
1580 	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1581 	 *	arrange for segment to be acked (eventually)
1582 	 *	continue processing rest of data/controls, beginning with URG
1583 	 */
1584 	case TCPS_SYN_SENT:
1585 		if ((tiflags & TH_ACK) &&
1586 		    (SEQ_LEQ(th->th_ack, tp->iss) ||
1587 		     SEQ_GT(th->th_ack, tp->snd_max)))
1588 			goto dropwithreset;
1589 		if (tiflags & TH_RST) {
1590 			if (tiflags & TH_ACK)
1591 				tp = tcp_drop(tp, ECONNREFUSED);
1592 			goto drop;
1593 		}
1594 		if ((tiflags & TH_SYN) == 0)
1595 			goto drop;
1596 		if (tiflags & TH_ACK) {
1597 			tp->snd_una = tp->snd_recover = th->th_ack;
1598 			if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1599 				tp->snd_nxt = tp->snd_una;
1600 			TCP_TIMER_DISARM(tp, TCPT_REXMT);
1601 		}
1602 		tp->irs = th->th_seq;
1603 		tcp_rcvseqinit(tp);
1604 		tp->t_flags |= TF_ACKNOW;
1605 		tcp_mss_from_peer(tp, opti.maxseg);
1606 
1607 		/*
1608 		 * Initialize the initial congestion window.  If we
1609 		 * had to retransmit the SYN, we must initialize cwnd
1610 		 * to 1 segment (i.e. the Loss Window).
1611 		 */
1612 		if (tp->t_flags & TF_SYN_REXMT)
1613 			tp->snd_cwnd = tp->t_peermss;
1614 		else {
1615 			int ss = tcp_init_win;
1616 #ifdef INET
1617 			if (inp != NULL && in_localaddr(inp->inp_faddr))
1618 				ss = tcp_init_win_local;
1619 #endif
1620 #ifdef INET6
1621 			if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
1622 				ss = tcp_init_win_local;
1623 #endif
1624 			tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
1625 		}
1626 
1627 		tcp_rmx_rtt(tp);
1628 		if (tiflags & TH_ACK) {
1629 			tcpstat.tcps_connects++;
1630 			soisconnected(so);
1631 			tcp_established(tp);
1632 			/* Do window scaling on this connection? */
1633 			if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1634 			    (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1635 				tp->snd_scale = tp->requested_s_scale;
1636 				tp->rcv_scale = tp->request_r_scale;
1637 			}
1638 			TCP_REASS_LOCK(tp);
1639 			(void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
1640 			TCP_REASS_UNLOCK(tp);
1641 			/*
1642 			 * if we didn't have to retransmit the SYN,
1643 			 * use its rtt as our initial srtt & rtt var.
1644 			 */
1645 			if (tp->t_rtttime)
1646 				tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
1647 		} else
1648 			tp->t_state = TCPS_SYN_RECEIVED;
1649 
1650 		/*
1651 		 * Advance th->th_seq to correspond to first data byte.
1652 		 * If data, trim to stay within window,
1653 		 * dropping FIN if necessary.
1654 		 */
1655 		th->th_seq++;
1656 		if (tlen > tp->rcv_wnd) {
1657 			todrop = tlen - tp->rcv_wnd;
1658 			m_adj(m, -todrop);
1659 			tlen = tp->rcv_wnd;
1660 			tiflags &= ~TH_FIN;
1661 			tcpstat.tcps_rcvpackafterwin++;
1662 			tcpstat.tcps_rcvbyteafterwin += todrop;
1663 		}
1664 		tp->snd_wl1 = th->th_seq - 1;
1665 		tp->rcv_up = th->th_seq;
1666 		goto step6;
1667 
1668 	/*
1669 	 * If the state is SYN_RECEIVED:
1670 	 *	If seg contains an ACK, but not for our SYN, drop the input
1671 	 *	and generate an RST.  See page 36, rfc793
1672 	 */
1673 	case TCPS_SYN_RECEIVED:
1674 		if ((tiflags & TH_ACK) &&
1675 		    (SEQ_LEQ(th->th_ack, tp->iss) ||
1676 		     SEQ_GT(th->th_ack, tp->snd_max)))
1677 			goto dropwithreset;
1678 		break;
1679 	}
1680 
1681 	/*
1682 	 * States other than LISTEN or SYN_SENT.
1683 	 * First check timestamp, if present.
1684 	 * Then check that at least some bytes of segment are within
1685 	 * receive window.  If segment begins before rcv_nxt,
1686 	 * drop leading data (and SYN); if nothing left, just ack.
1687 	 *
1688 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1689 	 * and it's less than ts_recent, drop it.
1690 	 */
1691 	if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
1692 	    TSTMP_LT(opti.ts_val, tp->ts_recent)) {
1693 
1694 		/* Check to see if ts_recent is over 24 days old.  */
1695 		if ((int)(TCP_TIMESTAMP(tp) - tp->ts_recent_age) >
1696 		    TCP_PAWS_IDLE) {
1697 			/*
1698 			 * Invalidate ts_recent.  If this segment updates
1699 			 * ts_recent, the age will be reset later and ts_recent
1700 			 * will get a valid value.  If it does not, setting
1701 			 * ts_recent to zero will at least satisfy the
1702 			 * requirement that zero be placed in the timestamp
1703 			 * echo reply when ts_recent isn't valid.  The
1704 			 * age isn't reset until we get a valid ts_recent
1705 			 * because we don't want out-of-order segments to be
1706 			 * dropped when ts_recent is old.
1707 			 */
1708 			tp->ts_recent = 0;
1709 		} else {
1710 			tcpstat.tcps_rcvduppack++;
1711 			tcpstat.tcps_rcvdupbyte += tlen;
1712 			tcpstat.tcps_pawsdrop++;
1713 			goto dropafterack;
1714 		}
1715 	}
1716 
1717 	todrop = tp->rcv_nxt - th->th_seq;
1718 	if (todrop > 0) {
1719 		if (tiflags & TH_SYN) {
1720 			tiflags &= ~TH_SYN;
1721 			th->th_seq++;
1722 			if (th->th_urp > 1)
1723 				th->th_urp--;
1724 			else {
1725 				tiflags &= ~TH_URG;
1726 				th->th_urp = 0;
1727 			}
1728 			todrop--;
1729 		}
1730 		if (todrop > tlen ||
1731 		    (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1732 			/*
1733 			 * Any valid FIN must be to the left of the window.
1734 			 * At this point the FIN must be a duplicate or
1735 			 * out of sequence; drop it.
1736 			 */
1737 			tiflags &= ~TH_FIN;
1738 			/*
1739 			 * Send an ACK to resynchronize and drop any data.
1740 			 * But keep on processing for RST or ACK.
1741 			 */
1742 			tp->t_flags |= TF_ACKNOW;
1743 			todrop = tlen;
1744 			tcpstat.tcps_rcvdupbyte += todrop;
1745 			tcpstat.tcps_rcvduppack++;
1746 		} else {
1747 			tcpstat.tcps_rcvpartduppack++;
1748 			tcpstat.tcps_rcvpartdupbyte += todrop;
1749 		}
1750 		hdroptlen += todrop;	/*drop from head afterwards*/
1751 		th->th_seq += todrop;
1752 		tlen -= todrop;
1753 		if (th->th_urp > todrop)
1754 			th->th_urp -= todrop;
1755 		else {
1756 			tiflags &= ~TH_URG;
1757 			th->th_urp = 0;
1758 		}
1759 	}
1760 
1761 	/*
1762 	 * If new data are received on a connection after the
1763 	 * user processes are gone, then RST the other end.
1764 	 */
1765 	if ((so->so_state & SS_NOFDREF) &&
1766 	    tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1767 		tp = tcp_close(tp);
1768 		tcpstat.tcps_rcvafterclose++;
1769 		goto dropwithreset;
1770 	}
1771 
1772 	/*
1773 	 * If segment ends after window, drop trailing data
1774 	 * (and PUSH and FIN); if nothing left, just ACK.
1775 	 */
1776 	todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1777 	if (todrop > 0) {
1778 		tcpstat.tcps_rcvpackafterwin++;
1779 		if (todrop >= tlen) {
1780 			tcpstat.tcps_rcvbyteafterwin += tlen;
1781 			/*
1782 			 * If a new connection request is received
1783 			 * while in TIME_WAIT, drop the old connection
1784 			 * and start over if the sequence numbers
1785 			 * are above the previous ones.
1786 			 *
1787 			 * NOTE: We will checksum the packet again, and
1788 			 * so we need to put the header fields back into
1789 			 * network order!
1790 			 * XXX This kind of sucks, but we don't expect
1791 			 * XXX this to happen very often, so maybe it
1792 			 * XXX doesn't matter so much.
1793 			 */
1794 			if (tiflags & TH_SYN &&
1795 			    tp->t_state == TCPS_TIME_WAIT &&
1796 			    SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1797 				iss = tcp_new_iss(tp, tp->snd_nxt);
1798 				tp = tcp_close(tp);
1799 				TCP_FIELDS_TO_NET(th);
1800 				goto findpcb;
1801 			}
1802 			/*
1803 			 * If window is closed can only take segments at
1804 			 * window edge, and have to drop data and PUSH from
1805 			 * incoming segments.  Continue processing, but
1806 			 * remember to ack.  Otherwise, drop segment
1807 			 * and ack.
1808 			 */
1809 			if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1810 				tp->t_flags |= TF_ACKNOW;
1811 				tcpstat.tcps_rcvwinprobe++;
1812 			} else
1813 				goto dropafterack;
1814 		} else
1815 			tcpstat.tcps_rcvbyteafterwin += todrop;
1816 		m_adj(m, -todrop);
1817 		tlen -= todrop;
1818 		tiflags &= ~(TH_PUSH|TH_FIN);
1819 	}
1820 
1821 	/*
1822 	 * If last ACK falls within this segment's sequence numbers,
1823 	 * and the timestamp is newer, record it.
1824 	 */
1825 	if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) &&
1826 	    SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
1827 	    SEQ_LT(tp->last_ack_sent, th->th_seq + tlen +
1828 		   ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
1829 		tp->ts_recent_age = TCP_TIMESTAMP(tp);
1830 		tp->ts_recent = opti.ts_val;
1831 	}
1832 
1833 	/*
1834 	 * If the RST bit is set examine the state:
1835 	 *    SYN_RECEIVED STATE:
1836 	 *	If passive open, return to LISTEN state.
1837 	 *	If active open, inform user that connection was refused.
1838 	 *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
1839 	 *	Inform user that connection was reset, and close tcb.
1840 	 *    CLOSING, LAST_ACK, TIME_WAIT STATES
1841 	 *	Close the tcb.
1842 	 */
1843 	if (tiflags&TH_RST) switch (tp->t_state) {
1844 
1845 	case TCPS_SYN_RECEIVED:
1846 		so->so_error = ECONNREFUSED;
1847 		goto close;
1848 
1849 	case TCPS_ESTABLISHED:
1850 	case TCPS_FIN_WAIT_1:
1851 	case TCPS_FIN_WAIT_2:
1852 	case TCPS_CLOSE_WAIT:
1853 		so->so_error = ECONNRESET;
1854 	close:
1855 		tp->t_state = TCPS_CLOSED;
1856 		tcpstat.tcps_drops++;
1857 		tp = tcp_close(tp);
1858 		goto drop;
1859 
1860 	case TCPS_CLOSING:
1861 	case TCPS_LAST_ACK:
1862 	case TCPS_TIME_WAIT:
1863 		tp = tcp_close(tp);
1864 		goto drop;
1865 	}
1866 
1867 	/*
1868 	 * If a SYN is in the window, then this is an
1869 	 * error and we send an RST and drop the connection.
1870 	 */
1871 	if (tiflags & TH_SYN) {
1872 		tp = tcp_drop(tp, ECONNRESET);
1873 		goto dropwithreset;
1874 	}
1875 
1876 	/*
1877 	 * If the ACK bit is off we drop the segment and return.
1878 	 */
1879 	if ((tiflags & TH_ACK) == 0) {
1880 		if (tp->t_flags & TF_ACKNOW)
1881 			goto dropafterack;
1882 		else
1883 			goto drop;
1884 	}
1885 
1886 	/*
1887 	 * Ack processing.
1888 	 */
1889 	switch (tp->t_state) {
1890 
1891 	/*
1892 	 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
1893 	 * ESTABLISHED state and continue processing, otherwise
1894 	 * send an RST.
1895 	 */
1896 	case TCPS_SYN_RECEIVED:
1897 		if (SEQ_GT(tp->snd_una, th->th_ack) ||
1898 		    SEQ_GT(th->th_ack, tp->snd_max))
1899 			goto dropwithreset;
1900 		tcpstat.tcps_connects++;
1901 		soisconnected(so);
1902 		tcp_established(tp);
1903 		/* Do window scaling? */
1904 		if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1905 		    (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1906 			tp->snd_scale = tp->requested_s_scale;
1907 			tp->rcv_scale = tp->request_r_scale;
1908 		}
1909 		TCP_REASS_LOCK(tp);
1910 		(void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
1911 		TCP_REASS_UNLOCK(tp);
1912 		tp->snd_wl1 = th->th_seq - 1;
1913 		/* fall into ... */
1914 
1915 	/*
1916 	 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1917 	 * ACKs.  If the ack is in the range
1918 	 *	tp->snd_una < th->th_ack <= tp->snd_max
1919 	 * then advance tp->snd_una to th->th_ack and drop
1920 	 * data from the retransmission queue.  If this ACK reflects
1921 	 * more up to date window information we update our window information.
1922 	 */
1923 	case TCPS_ESTABLISHED:
1924 	case TCPS_FIN_WAIT_1:
1925 	case TCPS_FIN_WAIT_2:
1926 	case TCPS_CLOSE_WAIT:
1927 	case TCPS_CLOSING:
1928 	case TCPS_LAST_ACK:
1929 	case TCPS_TIME_WAIT:
1930 
1931 		if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1932 			if (tlen == 0 && tiwin == tp->snd_wnd) {
1933 				tcpstat.tcps_rcvdupack++;
1934 				/*
1935 				 * If we have outstanding data (other than
1936 				 * a window probe), this is a completely
1937 				 * duplicate ack (ie, window info didn't
1938 				 * change), the ack is the biggest we've
1939 				 * seen and we've seen exactly our rexmt
1940 				 * threshhold of them, assume a packet
1941 				 * has been dropped and retransmit it.
1942 				 * Kludge snd_nxt & the congestion
1943 				 * window so we send only this one
1944 				 * packet.
1945 				 *
1946 				 * We know we're losing at the current
1947 				 * window size so do congestion avoidance
1948 				 * (set ssthresh to half the current window
1949 				 * and pull our congestion window back to
1950 				 * the new ssthresh).
1951 				 *
1952 				 * Dup acks mean that packets have left the
1953 				 * network (they're now cached at the receiver)
1954 				 * so bump cwnd by the amount in the receiver
1955 				 * to keep a constant cwnd packets in the
1956 				 * network.
1957 				 */
1958 				if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
1959 				    th->th_ack != tp->snd_una)
1960 					tp->t_dupacks = 0;
1961 				else if (++tp->t_dupacks == tcprexmtthresh) {
1962 					tcp_seq onxt = tp->snd_nxt;
1963 					u_int win =
1964 					    min(tp->snd_wnd, tp->snd_cwnd) /
1965 					    2 /	tp->t_segsz;
1966 					if (tcp_do_newreno && SEQ_LT(th->th_ack,
1967 					    tp->snd_recover)) {
1968 						/*
1969 						 * False fast retransmit after
1970 						 * timeout.  Do not cut window.
1971 						 */
1972 						tp->snd_cwnd += tp->t_segsz;
1973 						tp->t_dupacks = 0;
1974 						(void) tcp_output(tp);
1975 						goto drop;
1976 					}
1977 
1978 					if (win < 2)
1979 						win = 2;
1980 					tp->snd_ssthresh = win * tp->t_segsz;
1981 					tp->snd_recover = tp->snd_max;
1982 					TCP_TIMER_DISARM(tp, TCPT_REXMT);
1983 					tp->t_rtttime = 0;
1984 					tp->snd_nxt = th->th_ack;
1985 					tp->snd_cwnd = tp->t_segsz;
1986 					(void) tcp_output(tp);
1987 					tp->snd_cwnd = tp->snd_ssthresh +
1988 					       tp->t_segsz * tp->t_dupacks;
1989 					if (SEQ_GT(onxt, tp->snd_nxt))
1990 						tp->snd_nxt = onxt;
1991 					goto drop;
1992 				} else if (tp->t_dupacks > tcprexmtthresh) {
1993 					tp->snd_cwnd += tp->t_segsz;
1994 					(void) tcp_output(tp);
1995 					goto drop;
1996 				}
1997 			} else
1998 				tp->t_dupacks = 0;
1999 			break;
2000 		}
2001 		/*
2002 		 * If the congestion window was inflated to account
2003 		 * for the other side's cached packets, retract it.
2004 		 */
2005 		if (tcp_do_newreno == 0) {
2006 			if (tp->t_dupacks >= tcprexmtthresh &&
2007 			    tp->snd_cwnd > tp->snd_ssthresh)
2008 				tp->snd_cwnd = tp->snd_ssthresh;
2009 			tp->t_dupacks = 0;
2010 		} else if (tp->t_dupacks >= tcprexmtthresh &&
2011 			   tcp_newreno(tp, th) == 0) {
2012 			tp->snd_cwnd = tp->snd_ssthresh;
2013 			/*
2014 			 * Window inflation should have left us with approx.
2015 			 * snd_ssthresh outstanding data.  But in case we
2016 			 * would be inclined to send a burst, better to do
2017 			 * it via the slow start mechanism.
2018 			 */
2019 			if (SEQ_SUB(tp->snd_max, th->th_ack) < tp->snd_ssthresh)
2020 				tp->snd_cwnd = SEQ_SUB(tp->snd_max, th->th_ack)
2021 				    + tp->t_segsz;
2022 			tp->t_dupacks = 0;
2023 		}
2024 		if (SEQ_GT(th->th_ack, tp->snd_max)) {
2025 			tcpstat.tcps_rcvacktoomuch++;
2026 			goto dropafterack;
2027 		}
2028 		acked = th->th_ack - tp->snd_una;
2029 		tcpstat.tcps_rcvackpack++;
2030 		tcpstat.tcps_rcvackbyte += acked;
2031 
2032 		/*
2033 		 * If we have a timestamp reply, update smoothed
2034 		 * round trip time.  If no timestamp is present but
2035 		 * transmit timer is running and timed sequence
2036 		 * number was acked, update smoothed round trip time.
2037 		 * Since we now have an rtt measurement, cancel the
2038 		 * timer backoff (cf., Phil Karn's retransmit alg.).
2039 		 * Recompute the initial retransmit timer.
2040 		 */
2041 		if (opti.ts_present && opti.ts_ecr)
2042 			tcp_xmit_timer(tp, TCP_TIMESTAMP(tp) - opti.ts_ecr + 1);
2043 		else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2044 			tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2045 
2046 		/*
2047 		 * If all outstanding data is acked, stop retransmit
2048 		 * timer and remember to restart (more output or persist).
2049 		 * If there is more data to be acked, restart retransmit
2050 		 * timer, using current (possibly backed-off) value.
2051 		 */
2052 		if (th->th_ack == tp->snd_max) {
2053 			TCP_TIMER_DISARM(tp, TCPT_REXMT);
2054 			needoutput = 1;
2055 		} else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2056 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2057 		/*
2058 		 * When new data is acked, open the congestion window.
2059 		 * If the window gives us less than ssthresh packets
2060 		 * in flight, open exponentially (segsz per packet).
2061 		 * Otherwise open linearly: segsz per window
2062 		 * (segsz^2 / cwnd per packet), plus a constant
2063 		 * fraction of a packet (segsz/8) to help larger windows
2064 		 * open quickly enough.
2065 		 */
2066 		{
2067 		u_int cw = tp->snd_cwnd;
2068 		u_int incr = tp->t_segsz;
2069 
2070 		if (cw > tp->snd_ssthresh)
2071 			incr = incr * incr / cw;
2072 		if (tcp_do_newreno == 0 || SEQ_GEQ(th->th_ack, tp->snd_recover))
2073 			tp->snd_cwnd = min(cw + incr,
2074 			    TCP_MAXWIN << tp->snd_scale);
2075 		}
2076 		ND6_HINT(tp);
2077 		if (acked > so->so_snd.sb_cc) {
2078 			tp->snd_wnd -= so->so_snd.sb_cc;
2079 			sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2080 			ourfinisacked = 1;
2081 		} else {
2082 			int slen;
2083 
2084 			slen = tp->t_lastm->m_len;
2085 			sbdrop(&so->so_snd, acked);
2086 			tp->snd_wnd -= acked;
2087 			if (so->so_snd.sb_cc != 0) {
2088 				tp->t_lastoff -= acked;
2089 				if (tp->t_lastm->m_len != slen)
2090 					tp->t_inoff -=
2091 					    (slen - tp->t_lastm->m_len);
2092 			}
2093 			ourfinisacked = 0;
2094 		}
2095 		sowwakeup(so);
2096 		/*
2097 		 * We want snd_recover to track snd_una to
2098 		 * avoid sequence wraparound problems for
2099 		 * very large transfers.
2100 		 */
2101 		tp->snd_una = tp->snd_recover = th->th_ack;
2102 		if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2103 			tp->snd_nxt = tp->snd_una;
2104 
2105 		switch (tp->t_state) {
2106 
2107 		/*
2108 		 * In FIN_WAIT_1 STATE in addition to the processing
2109 		 * for the ESTABLISHED state if our FIN is now acknowledged
2110 		 * then enter FIN_WAIT_2.
2111 		 */
2112 		case TCPS_FIN_WAIT_1:
2113 			if (ourfinisacked) {
2114 				/*
2115 				 * If we can't receive any more
2116 				 * data, then closing user can proceed.
2117 				 * Starting the timer is contrary to the
2118 				 * specification, but if we don't get a FIN
2119 				 * we'll hang forever.
2120 				 */
2121 				if (so->so_state & SS_CANTRCVMORE) {
2122 					soisdisconnected(so);
2123 					if (tcp_maxidle > 0)
2124 						TCP_TIMER_ARM(tp, TCPT_2MSL,
2125 						    tcp_maxidle);
2126 				}
2127 				tp->t_state = TCPS_FIN_WAIT_2;
2128 			}
2129 			break;
2130 
2131 	 	/*
2132 		 * In CLOSING STATE in addition to the processing for
2133 		 * the ESTABLISHED state if the ACK acknowledges our FIN
2134 		 * then enter the TIME-WAIT state, otherwise ignore
2135 		 * the segment.
2136 		 */
2137 		case TCPS_CLOSING:
2138 			if (ourfinisacked) {
2139 				tp->t_state = TCPS_TIME_WAIT;
2140 				tcp_canceltimers(tp);
2141 				TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2142 				soisdisconnected(so);
2143 			}
2144 			break;
2145 
2146 		/*
2147 		 * In LAST_ACK, we may still be waiting for data to drain
2148 		 * and/or to be acked, as well as for the ack of our FIN.
2149 		 * If our FIN is now acknowledged, delete the TCB,
2150 		 * enter the closed state and return.
2151 		 */
2152 		case TCPS_LAST_ACK:
2153 			if (ourfinisacked) {
2154 				tp = tcp_close(tp);
2155 				goto drop;
2156 			}
2157 			break;
2158 
2159 		/*
2160 		 * In TIME_WAIT state the only thing that should arrive
2161 		 * is a retransmission of the remote FIN.  Acknowledge
2162 		 * it and restart the finack timer.
2163 		 */
2164 		case TCPS_TIME_WAIT:
2165 			TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2166 			goto dropafterack;
2167 		}
2168 	}
2169 
2170 step6:
2171 	/*
2172 	 * Update window information.
2173 	 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2174 	 */
2175 	if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2176 	    (tp->snd_wl1 == th->th_seq && SEQ_LT(tp->snd_wl2, th->th_ack)) ||
2177 	    (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))) {
2178 		/* keep track of pure window updates */
2179 		if (tlen == 0 &&
2180 		    tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2181 			tcpstat.tcps_rcvwinupd++;
2182 		tp->snd_wnd = tiwin;
2183 		tp->snd_wl1 = th->th_seq;
2184 		tp->snd_wl2 = th->th_ack;
2185 		if (tp->snd_wnd > tp->max_sndwnd)
2186 			tp->max_sndwnd = tp->snd_wnd;
2187 		needoutput = 1;
2188 	}
2189 
2190 	/*
2191 	 * Process segments with URG.
2192 	 */
2193 	if ((tiflags & TH_URG) && th->th_urp &&
2194 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2195 		/*
2196 		 * This is a kludge, but if we receive and accept
2197 		 * random urgent pointers, we'll crash in
2198 		 * soreceive.  It's hard to imagine someone
2199 		 * actually wanting to send this much urgent data.
2200 		 */
2201 		if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2202 			th->th_urp = 0;			/* XXX */
2203 			tiflags &= ~TH_URG;		/* XXX */
2204 			goto dodata;			/* XXX */
2205 		}
2206 		/*
2207 		 * If this segment advances the known urgent pointer,
2208 		 * then mark the data stream.  This should not happen
2209 		 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2210 		 * a FIN has been received from the remote side.
2211 		 * In these states we ignore the URG.
2212 		 *
2213 		 * According to RFC961 (Assigned Protocols),
2214 		 * the urgent pointer points to the last octet
2215 		 * of urgent data.  We continue, however,
2216 		 * to consider it to indicate the first octet
2217 		 * of data past the urgent section as the original
2218 		 * spec states (in one of two places).
2219 		 */
2220 		if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2221 			tp->rcv_up = th->th_seq + th->th_urp;
2222 			so->so_oobmark = so->so_rcv.sb_cc +
2223 			    (tp->rcv_up - tp->rcv_nxt) - 1;
2224 			if (so->so_oobmark == 0)
2225 				so->so_state |= SS_RCVATMARK;
2226 			sohasoutofband(so);
2227 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2228 		}
2229 		/*
2230 		 * Remove out of band data so doesn't get presented to user.
2231 		 * This can happen independent of advancing the URG pointer,
2232 		 * but if two URG's are pending at once, some out-of-band
2233 		 * data may creep in... ick.
2234 		 */
2235 		if (th->th_urp <= (u_int16_t) tlen
2236 #ifdef SO_OOBINLINE
2237 		     && (so->so_options & SO_OOBINLINE) == 0
2238 #endif
2239 		     )
2240 			tcp_pulloutofband(so, th, m, hdroptlen);
2241 	} else
2242 		/*
2243 		 * If no out of band data is expected,
2244 		 * pull receive urgent pointer along
2245 		 * with the receive window.
2246 		 */
2247 		if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2248 			tp->rcv_up = tp->rcv_nxt;
2249 dodata:							/* XXX */
2250 
2251 	/*
2252 	 * Process the segment text, merging it into the TCP sequencing queue,
2253 	 * and arranging for acknowledgement of receipt if necessary.
2254 	 * This process logically involves adjusting tp->rcv_wnd as data
2255 	 * is presented to the user (this happens in tcp_usrreq.c,
2256 	 * case PRU_RCVD).  If a FIN has already been received on this
2257 	 * connection then we just ignore the text.
2258 	 */
2259 	if ((tlen || (tiflags & TH_FIN)) &&
2260 	    TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2261 		/*
2262 		 * Insert segment ti into reassembly queue of tcp with
2263 		 * control block tp.  Return TH_FIN if reassembly now includes
2264 		 * a segment with FIN.  The macro form does the common case
2265 		 * inline (segment is the next to be received on an
2266 		 * established connection, and the queue is empty),
2267 		 * avoiding linkage into and removal from the queue and
2268 		 * repetition of various conversions.
2269 		 * Set DELACK for segments received in order, but ack
2270 		 * immediately when segments are out of order
2271 		 * (so fast retransmit can work).
2272 		 */
2273 		/* NOTE: this was TCP_REASS() macro, but used only once */
2274 		TCP_REASS_LOCK(tp);
2275 		if (th->th_seq == tp->rcv_nxt &&
2276 		    TAILQ_FIRST(&tp->segq) == NULL &&
2277 		    tp->t_state == TCPS_ESTABLISHED) {
2278 			TCP_SETUP_ACK(tp, th);
2279 			tp->rcv_nxt += tlen;
2280 			tiflags = th->th_flags & TH_FIN;
2281 			tcpstat.tcps_rcvpack++;
2282 			tcpstat.tcps_rcvbyte += tlen;
2283 			ND6_HINT(tp);
2284 			if (so->so_state & SS_CANTRCVMORE)
2285 				m_freem(m);
2286 			else {
2287 				m_adj(m, hdroptlen);
2288 				sbappendstream(&(so)->so_rcv, m);
2289 			}
2290 			sorwakeup(so);
2291 		} else {
2292 			m_adj(m, hdroptlen);
2293 			tiflags = tcp_reass(tp, th, m, &tlen);
2294 			tp->t_flags |= TF_ACKNOW;
2295 		}
2296 		TCP_REASS_UNLOCK(tp);
2297 
2298 		/*
2299 		 * Note the amount of data that peer has sent into
2300 		 * our window, in order to estimate the sender's
2301 		 * buffer size.
2302 		 */
2303 		len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2304 	} else {
2305 		m_freem(m);
2306 		m = NULL;
2307 		tiflags &= ~TH_FIN;
2308 	}
2309 
2310 	/*
2311 	 * If FIN is received ACK the FIN and let the user know
2312 	 * that the connection is closing.  Ignore a FIN received before
2313 	 * the connection is fully established.
2314 	 */
2315 	if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2316 		if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2317 			socantrcvmore(so);
2318 			tp->t_flags |= TF_ACKNOW;
2319 			tp->rcv_nxt++;
2320 		}
2321 		switch (tp->t_state) {
2322 
2323 	 	/*
2324 		 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2325 		 */
2326 		case TCPS_ESTABLISHED:
2327 			tp->t_state = TCPS_CLOSE_WAIT;
2328 			break;
2329 
2330 	 	/*
2331 		 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2332 		 * enter the CLOSING state.
2333 		 */
2334 		case TCPS_FIN_WAIT_1:
2335 			tp->t_state = TCPS_CLOSING;
2336 			break;
2337 
2338 	 	/*
2339 		 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2340 		 * starting the time-wait timer, turning off the other
2341 		 * standard timers.
2342 		 */
2343 		case TCPS_FIN_WAIT_2:
2344 			tp->t_state = TCPS_TIME_WAIT;
2345 			tcp_canceltimers(tp);
2346 			TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2347 			soisdisconnected(so);
2348 			break;
2349 
2350 		/*
2351 		 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2352 		 */
2353 		case TCPS_TIME_WAIT:
2354 			TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2355 			break;
2356 		}
2357 	}
2358 #ifdef TCP_DEBUG
2359 	if (so->so_options & SO_DEBUG)
2360 		tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2361 #endif
2362 
2363 	/*
2364 	 * Return any desired output.
2365 	 */
2366 	if (needoutput || (tp->t_flags & TF_ACKNOW))
2367 		(void) tcp_output(tp);
2368 	if (tcp_saveti)
2369 		m_freem(tcp_saveti);
2370 	return;
2371 
2372 badsyn:
2373 	/*
2374 	 * Received a bad SYN.  Increment counters and dropwithreset.
2375 	 */
2376 	tcpstat.tcps_badsyn++;
2377 	tp = NULL;
2378 	goto dropwithreset;
2379 
2380 dropafterack:
2381 	/*
2382 	 * Generate an ACK dropping incoming segment if it occupies
2383 	 * sequence space, where the ACK reflects our state.
2384 	 */
2385 	if (tiflags & TH_RST)
2386 		goto drop;
2387 	m_freem(m);
2388 	tp->t_flags |= TF_ACKNOW;
2389 	(void) tcp_output(tp);
2390 	if (tcp_saveti)
2391 		m_freem(tcp_saveti);
2392 	return;
2393 
2394 dropwithreset_ratelim:
2395 	/*
2396 	 * We may want to rate-limit RSTs in certain situations,
2397 	 * particularly if we are sending an RST in response to
2398 	 * an attempt to connect to or otherwise communicate with
2399 	 * a port for which we have no socket.
2400 	 */
2401 	if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2402 	    tcp_rst_ppslim) == 0) {
2403 		/* XXX stat */
2404 		goto drop;
2405 	}
2406 	/* ...fall into dropwithreset... */
2407 
2408 dropwithreset:
2409 	/*
2410 	 * Generate a RST, dropping incoming segment.
2411 	 * Make ACK acceptable to originator of segment.
2412 	 */
2413 	if (tiflags & TH_RST)
2414 		goto drop;
2415 
2416 	switch (af) {
2417 #ifdef INET6
2418 	case AF_INET6:
2419 		/* For following calls to tcp_respond */
2420 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
2421 			goto drop;
2422 		break;
2423 #endif /* INET6 */
2424 	case AF_INET:
2425 		if (IN_MULTICAST(ip->ip_dst.s_addr) ||
2426 		    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2427 			goto drop;
2428 	}
2429 
2430 	if (tiflags & TH_ACK)
2431 		(void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
2432 	else {
2433 		if (tiflags & TH_SYN)
2434 			tlen++;
2435 		(void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
2436 		    TH_RST|TH_ACK);
2437 	}
2438 	if (tcp_saveti)
2439 		m_freem(tcp_saveti);
2440 	return;
2441 
2442 badcsum:
2443 	tcpstat.tcps_rcvbadsum++;
2444 drop:
2445 	/*
2446 	 * Drop space held by incoming segment and return.
2447 	 */
2448 	if (tp) {
2449 		if (tp->t_inpcb)
2450 			so = tp->t_inpcb->inp_socket;
2451 #ifdef INET6
2452 		else if (tp->t_in6pcb)
2453 			so = tp->t_in6pcb->in6p_socket;
2454 #endif
2455 		else
2456 			so = NULL;
2457 #ifdef TCP_DEBUG
2458 		if (so && (so->so_options & SO_DEBUG) != 0)
2459 			tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
2460 #endif
2461 	}
2462 	if (tcp_saveti)
2463 		m_freem(tcp_saveti);
2464 	m_freem(m);
2465 	return;
2466 }
2467 
2468 void
2469 tcp_dooptions(tp, cp, cnt, th, oi)
2470 	struct tcpcb *tp;
2471 	u_char *cp;
2472 	int cnt;
2473 	struct tcphdr *th;
2474 	struct tcp_opt_info *oi;
2475 {
2476 	u_int16_t mss;
2477 	int opt, optlen;
2478 
2479 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
2480 		opt = cp[0];
2481 		if (opt == TCPOPT_EOL)
2482 			break;
2483 		if (opt == TCPOPT_NOP)
2484 			optlen = 1;
2485 		else {
2486 			if (cnt < 2)
2487 				break;
2488 			optlen = cp[1];
2489 			if (optlen < 2 || optlen > cnt)
2490 				break;
2491 		}
2492 		switch (opt) {
2493 
2494 		default:
2495 			continue;
2496 
2497 		case TCPOPT_MAXSEG:
2498 			if (optlen != TCPOLEN_MAXSEG)
2499 				continue;
2500 			if (!(th->th_flags & TH_SYN))
2501 				continue;
2502 			bcopy(cp + 2, &mss, sizeof(mss));
2503 			oi->maxseg = ntohs(mss);
2504 			break;
2505 
2506 		case TCPOPT_WINDOW:
2507 			if (optlen != TCPOLEN_WINDOW)
2508 				continue;
2509 			if (!(th->th_flags & TH_SYN))
2510 				continue;
2511 			tp->t_flags |= TF_RCVD_SCALE;
2512 			tp->requested_s_scale = cp[2];
2513 			if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
2514 #if 0	/*XXX*/
2515 				char *p;
2516 
2517 				if (ip)
2518 					p = ntohl(ip->ip_src);
2519 #ifdef INET6
2520 				else if (ip6)
2521 					p = ip6_sprintf(&ip6->ip6_src);
2522 #endif
2523 				else
2524 					p = "(unknown)";
2525 				log(LOG_ERR, "TCP: invalid wscale %d from %s, "
2526 				    "assuming %d\n",
2527 				    tp->requested_s_scale, p,
2528 				    TCP_MAX_WINSHIFT);
2529 #else
2530 				log(LOG_ERR, "TCP: invalid wscale %d, "
2531 				    "assuming %d\n",
2532 				    tp->requested_s_scale,
2533 				    TCP_MAX_WINSHIFT);
2534 #endif
2535 				tp->requested_s_scale = TCP_MAX_WINSHIFT;
2536 			}
2537 			break;
2538 
2539 		case TCPOPT_TIMESTAMP:
2540 			if (optlen != TCPOLEN_TIMESTAMP)
2541 				continue;
2542 			oi->ts_present = 1;
2543 			bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
2544 			NTOHL(oi->ts_val);
2545 			bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
2546 			NTOHL(oi->ts_ecr);
2547 
2548 			/*
2549 			 * A timestamp received in a SYN makes
2550 			 * it ok to send timestamp requests and replies.
2551 			 */
2552 			if (th->th_flags & TH_SYN) {
2553 				tp->t_flags |= TF_RCVD_TSTMP;
2554 				tp->ts_recent = oi->ts_val;
2555 				tp->ts_recent_age = TCP_TIMESTAMP(tp);
2556 			}
2557 			break;
2558 		case TCPOPT_SACK_PERMITTED:
2559 			if (optlen != TCPOLEN_SACK_PERMITTED)
2560 				continue;
2561 			if (!(th->th_flags & TH_SYN))
2562 				continue;
2563 			tp->t_flags &= ~TF_CANT_TXSACK;
2564 			break;
2565 
2566 		case TCPOPT_SACK:
2567 			if (tp->t_flags & TF_IGNR_RXSACK)
2568 				continue;
2569 			if (optlen % 8 != 2 || optlen < 10)
2570 				continue;
2571 			cp += 2;
2572 			optlen -= 2;
2573 			for (; optlen > 0; cp -= 8, optlen -= 8) {
2574 				tcp_seq lwe, rwe;
2575 				bcopy((char *)cp, (char *) &lwe, sizeof(lwe));
2576 				NTOHL(lwe);
2577 				bcopy((char *)cp, (char *) &rwe, sizeof(rwe));
2578 				NTOHL(rwe);
2579 				/* tcp_mark_sacked(tp, lwe, rwe); */
2580 			}
2581 			break;
2582 		}
2583 	}
2584 }
2585 
2586 /*
2587  * Pull out of band byte out of a segment so
2588  * it doesn't appear in the user's data queue.
2589  * It is still reflected in the segment length for
2590  * sequencing purposes.
2591  */
2592 void
2593 tcp_pulloutofband(so, th, m, off)
2594 	struct socket *so;
2595 	struct tcphdr *th;
2596 	struct mbuf *m;
2597 	int off;
2598 {
2599 	int cnt = off + th->th_urp - 1;
2600 
2601 	while (cnt >= 0) {
2602 		if (m->m_len > cnt) {
2603 			char *cp = mtod(m, caddr_t) + cnt;
2604 			struct tcpcb *tp = sototcpcb(so);
2605 
2606 			tp->t_iobc = *cp;
2607 			tp->t_oobflags |= TCPOOB_HAVEDATA;
2608 			bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
2609 			m->m_len--;
2610 			return;
2611 		}
2612 		cnt -= m->m_len;
2613 		m = m->m_next;
2614 		if (m == 0)
2615 			break;
2616 	}
2617 	panic("tcp_pulloutofband");
2618 }
2619 
2620 /*
2621  * Collect new round-trip time estimate
2622  * and update averages and current timeout.
2623  */
2624 void
2625 tcp_xmit_timer(tp, rtt)
2626 	struct tcpcb *tp;
2627 	uint32_t rtt;
2628 {
2629 	int32_t delta;
2630 
2631 	tcpstat.tcps_rttupdated++;
2632 	if (tp->t_srtt != 0) {
2633 		/*
2634 		 * srtt is stored as fixed point with 3 bits after the
2635 		 * binary point (i.e., scaled by 8).  The following magic
2636 		 * is equivalent to the smoothing algorithm in rfc793 with
2637 		 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2638 		 * point).  Adjust rtt to origin 0.
2639 		 */
2640 		delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
2641 		if ((tp->t_srtt += delta) <= 0)
2642 			tp->t_srtt = 1 << 2;
2643 		/*
2644 		 * We accumulate a smoothed rtt variance (actually, a
2645 		 * smoothed mean difference), then set the retransmit
2646 		 * timer to smoothed rtt + 4 times the smoothed variance.
2647 		 * rttvar is stored as fixed point with 2 bits after the
2648 		 * binary point (scaled by 4).  The following is
2649 		 * equivalent to rfc793 smoothing with an alpha of .75
2650 		 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
2651 		 * rfc793's wired-in beta.
2652 		 */
2653 		if (delta < 0)
2654 			delta = -delta;
2655 		delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
2656 		if ((tp->t_rttvar += delta) <= 0)
2657 			tp->t_rttvar = 1 << 2;
2658 	} else {
2659 		/*
2660 		 * No rtt measurement yet - use the unsmoothed rtt.
2661 		 * Set the variance to half the rtt (so our first
2662 		 * retransmit happens at 3*rtt).
2663 		 */
2664 		tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
2665 		tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
2666 	}
2667 	tp->t_rtttime = 0;
2668 	tp->t_rxtshift = 0;
2669 
2670 	/*
2671 	 * the retransmit should happen at rtt + 4 * rttvar.
2672 	 * Because of the way we do the smoothing, srtt and rttvar
2673 	 * will each average +1/2 tick of bias.  When we compute
2674 	 * the retransmit timer, we want 1/2 tick of rounding and
2675 	 * 1 extra tick because of +-1/2 tick uncertainty in the
2676 	 * firing of the timer.  The bias will give us exactly the
2677 	 * 1.5 tick we need.  But, because the bias is
2678 	 * statistical, we have to test that we don't drop below
2679 	 * the minimum feasible timer (which is 2 ticks).
2680 	 */
2681 	TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
2682 	    max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
2683 
2684 	/*
2685 	 * We received an ack for a packet that wasn't retransmitted;
2686 	 * it is probably safe to discard any error indications we've
2687 	 * received recently.  This isn't quite right, but close enough
2688 	 * for now (a route might have failed after we sent a segment,
2689 	 * and the return path might not be symmetrical).
2690 	 */
2691 	tp->t_softerror = 0;
2692 }
2693 
2694 /*
2695  * Checks for partial ack.  If partial ack arrives, force the retransmission
2696  * of the next unacknowledged segment, do not clear tp->t_dupacks, and return
2697  * 1.  By setting snd_nxt to th_ack, this forces retransmission timer to
2698  * be started again.  If the ack advances at least to tp->snd_recover, return 0.
2699  */
2700 int
2701 tcp_newreno(tp, th)
2702 	struct tcpcb *tp;
2703 	struct tcphdr *th;
2704 {
2705 	tcp_seq onxt = tp->snd_nxt;
2706 	u_long ocwnd = tp->snd_cwnd;
2707 
2708 	if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2709 		/*
2710 		 * snd_una has not yet been updated and the socket's send
2711 		 * buffer has not yet drained off the ACK'd data, so we
2712 		 * have to leave snd_una as it was to get the correct data
2713 		 * offset in tcp_output().
2714 		 */
2715 		TCP_TIMER_DISARM(tp, TCPT_REXMT);
2716 		tp->t_rtttime = 0;
2717 		tp->snd_nxt = th->th_ack;
2718 		/*
2719 		 * Set snd_cwnd to one segment beyond ACK'd offset.  snd_una
2720 		 * is not yet updated when we're called.
2721 		 */
2722 		tp->snd_cwnd = tp->t_segsz + (th->th_ack - tp->snd_una);
2723 		(void) tcp_output(tp);
2724 		tp->snd_cwnd = ocwnd;
2725 		if (SEQ_GT(onxt, tp->snd_nxt))
2726 			tp->snd_nxt = onxt;
2727 		/*
2728 		 * Partial window deflation.  Relies on fact that tp->snd_una
2729 		 * not updated yet.
2730 		 */
2731 		tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_segsz);
2732 		return 1;
2733 	}
2734 	return 0;
2735 }
2736 
2737 
2738 /*
2739  * TCP compressed state engine.  Currently used to hold compressed
2740  * state for SYN_RECEIVED.
2741  */
2742 
2743 u_long	syn_cache_count;
2744 u_int32_t syn_hash1, syn_hash2;
2745 
2746 #define SYN_HASH(sa, sp, dp) \
2747 	((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
2748 				     ((u_int32_t)(sp)))^syn_hash2)))
2749 #ifndef INET6
2750 #define	SYN_HASHALL(hash, src, dst) \
2751 do {									\
2752 	hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr,	\
2753 		((struct sockaddr_in *)(src))->sin_port,		\
2754 		((struct sockaddr_in *)(dst))->sin_port);		\
2755 } while (/*CONSTCOND*/ 0)
2756 #else
2757 #define SYN_HASH6(sa, sp, dp) \
2758 	((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
2759 	  (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
2760 	 & 0x7fffffff)
2761 
2762 #define SYN_HASHALL(hash, src, dst) \
2763 do {									\
2764 	switch ((src)->sa_family) {					\
2765 	case AF_INET:							\
2766 		hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \
2767 			((struct sockaddr_in *)(src))->sin_port,	\
2768 			((struct sockaddr_in *)(dst))->sin_port);	\
2769 		break;							\
2770 	case AF_INET6:							\
2771 		hash = SYN_HASH6(&((struct sockaddr_in6 *)(src))->sin6_addr, \
2772 			((struct sockaddr_in6 *)(src))->sin6_port,	\
2773 			((struct sockaddr_in6 *)(dst))->sin6_port);	\
2774 		break;							\
2775 	default:							\
2776 		hash = 0;						\
2777 	}								\
2778 } while (/*CONSTCOND*/0)
2779 #endif /* INET6 */
2780 
2781 #define	SYN_CACHE_RM(sc)						\
2782 do {									\
2783 	TAILQ_REMOVE(&tcp_syn_cache[(sc)->sc_bucketidx].sch_bucket,	\
2784 	    (sc), sc_bucketq);						\
2785 	(sc)->sc_tp = NULL;						\
2786 	LIST_REMOVE((sc), sc_tpq);					\
2787 	tcp_syn_cache[(sc)->sc_bucketidx].sch_length--;			\
2788 	callout_stop(&(sc)->sc_timer);					\
2789 	syn_cache_count--;						\
2790 } while (/*CONSTCOND*/0)
2791 
2792 #define	SYN_CACHE_PUT(sc)						\
2793 do {									\
2794 	if ((sc)->sc_ipopts)						\
2795 		(void) m_free((sc)->sc_ipopts);				\
2796 	if ((sc)->sc_route4.ro_rt != NULL)				\
2797 		RTFREE((sc)->sc_route4.ro_rt);				\
2798 	if (callout_invoking(&(sc)->sc_timer))				\
2799 		(sc)->sc_flags |= SCF_DEAD;				\
2800 	else								\
2801 		pool_put(&syn_cache_pool, (sc));			\
2802 } while (/*CONSTCOND*/0)
2803 
2804 struct pool syn_cache_pool;
2805 
2806 /*
2807  * We don't estimate RTT with SYNs, so each packet starts with the default
2808  * RTT and each timer step has a fixed timeout value.
2809  */
2810 #define	SYN_CACHE_TIMER_ARM(sc)						\
2811 do {									\
2812 	TCPT_RANGESET((sc)->sc_rxtcur,					\
2813 	    TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN,	\
2814 	    TCPTV_REXMTMAX);						\
2815 	callout_reset(&(sc)->sc_timer,					\
2816 	    (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc));	\
2817 } while (/*CONSTCOND*/0)
2818 
2819 #define	SYN_CACHE_TIMESTAMP(sc)	(tcp_now - (sc)->sc_timebase)
2820 
2821 void
2822 syn_cache_init()
2823 {
2824 	int i;
2825 
2826 	/* Initialize the hash buckets. */
2827 	for (i = 0; i < tcp_syn_cache_size; i++)
2828 		TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
2829 
2830 	/* Initialize the syn cache pool. */
2831 	pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0,
2832 	    "synpl", NULL);
2833 }
2834 
2835 void
2836 syn_cache_insert(sc, tp)
2837 	struct syn_cache *sc;
2838 	struct tcpcb *tp;
2839 {
2840 	struct syn_cache_head *scp;
2841 	struct syn_cache *sc2;
2842 	int s;
2843 
2844 	/*
2845 	 * If there are no entries in the hash table, reinitialize
2846 	 * the hash secrets.
2847 	 */
2848 	if (syn_cache_count == 0) {
2849 		struct timeval tv;
2850 		microtime(&tv);
2851 		syn_hash1 = arc4random() ^ (u_long)&sc;
2852 		syn_hash2 = arc4random() ^ tv.tv_usec;
2853 	}
2854 
2855 	SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
2856 	sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
2857 	scp = &tcp_syn_cache[sc->sc_bucketidx];
2858 
2859 	/*
2860 	 * Make sure that we don't overflow the per-bucket
2861 	 * limit or the total cache size limit.
2862 	 */
2863 	s = splsoftnet();
2864 	if (scp->sch_length >= tcp_syn_bucket_limit) {
2865 		tcpstat.tcps_sc_bucketoverflow++;
2866 		/*
2867 		 * The bucket is full.  Toss the oldest element in the
2868 		 * bucket.  This will be the first entry in the bucket.
2869 		 */
2870 		sc2 = TAILQ_FIRST(&scp->sch_bucket);
2871 #ifdef DIAGNOSTIC
2872 		/*
2873 		 * This should never happen; we should always find an
2874 		 * entry in our bucket.
2875 		 */
2876 		if (sc2 == NULL)
2877 			panic("syn_cache_insert: bucketoverflow: impossible");
2878 #endif
2879 		SYN_CACHE_RM(sc2);
2880 		SYN_CACHE_PUT(sc2);
2881 	} else if (syn_cache_count >= tcp_syn_cache_limit) {
2882 		struct syn_cache_head *scp2, *sce;
2883 
2884 		tcpstat.tcps_sc_overflowed++;
2885 		/*
2886 		 * The cache is full.  Toss the oldest entry in the
2887 		 * first non-empty bucket we can find.
2888 		 *
2889 		 * XXX We would really like to toss the oldest
2890 		 * entry in the cache, but we hope that this
2891 		 * condition doesn't happen very often.
2892 		 */
2893 		scp2 = scp;
2894 		if (TAILQ_EMPTY(&scp2->sch_bucket)) {
2895 			sce = &tcp_syn_cache[tcp_syn_cache_size];
2896 			for (++scp2; scp2 != scp; scp2++) {
2897 				if (scp2 >= sce)
2898 					scp2 = &tcp_syn_cache[0];
2899 				if (! TAILQ_EMPTY(&scp2->sch_bucket))
2900 					break;
2901 			}
2902 #ifdef DIAGNOSTIC
2903 			/*
2904 			 * This should never happen; we should always find a
2905 			 * non-empty bucket.
2906 			 */
2907 			if (scp2 == scp)
2908 				panic("syn_cache_insert: cacheoverflow: "
2909 				    "impossible");
2910 #endif
2911 		}
2912 		sc2 = TAILQ_FIRST(&scp2->sch_bucket);
2913 		SYN_CACHE_RM(sc2);
2914 		SYN_CACHE_PUT(sc2);
2915 	}
2916 
2917 	/*
2918 	 * Initialize the entry's timer.
2919 	 */
2920 	sc->sc_rxttot = 0;
2921 	sc->sc_rxtshift = 0;
2922 	SYN_CACHE_TIMER_ARM(sc);
2923 
2924 	/* Link it from tcpcb entry */
2925 	LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
2926 
2927 	/* Put it into the bucket. */
2928 	TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
2929 	scp->sch_length++;
2930 	syn_cache_count++;
2931 
2932 	tcpstat.tcps_sc_added++;
2933 	splx(s);
2934 }
2935 
2936 /*
2937  * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
2938  * If we have retransmitted an entry the maximum number of times, expire
2939  * that entry.
2940  */
2941 void
2942 syn_cache_timer(void *arg)
2943 {
2944 	struct syn_cache *sc = arg;
2945 	int s;
2946 
2947 	s = splsoftnet();
2948 	callout_ack(&sc->sc_timer);
2949 
2950 	if (__predict_false(sc->sc_flags & SCF_DEAD)) {
2951 		tcpstat.tcps_sc_delayed_free++;
2952 		pool_put(&syn_cache_pool, sc);
2953 		splx(s);
2954 		return;
2955 	}
2956 
2957 	if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
2958 		/* Drop it -- too many retransmissions. */
2959 		goto dropit;
2960 	}
2961 
2962 	/*
2963 	 * Compute the total amount of time this entry has
2964 	 * been on a queue.  If this entry has been on longer
2965 	 * than the keep alive timer would allow, expire it.
2966 	 */
2967 	sc->sc_rxttot += sc->sc_rxtcur;
2968 	if (sc->sc_rxttot >= TCPTV_KEEP_INIT)
2969 		goto dropit;
2970 
2971 	tcpstat.tcps_sc_retransmitted++;
2972 	(void) syn_cache_respond(sc, NULL);
2973 
2974 	/* Advance the timer back-off. */
2975 	sc->sc_rxtshift++;
2976 	SYN_CACHE_TIMER_ARM(sc);
2977 
2978 	splx(s);
2979 	return;
2980 
2981  dropit:
2982 	tcpstat.tcps_sc_timed_out++;
2983 	SYN_CACHE_RM(sc);
2984 	SYN_CACHE_PUT(sc);
2985 	splx(s);
2986 }
2987 
2988 /*
2989  * Remove syn cache created by the specified tcb entry,
2990  * because this does not make sense to keep them
2991  * (if there's no tcb entry, syn cache entry will never be used)
2992  */
2993 void
2994 syn_cache_cleanup(tp)
2995 	struct tcpcb *tp;
2996 {
2997 	struct syn_cache *sc, *nsc;
2998 	int s;
2999 
3000 	s = splsoftnet();
3001 
3002 	for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3003 		nsc = LIST_NEXT(sc, sc_tpq);
3004 
3005 #ifdef DIAGNOSTIC
3006 		if (sc->sc_tp != tp)
3007 			panic("invalid sc_tp in syn_cache_cleanup");
3008 #endif
3009 		SYN_CACHE_RM(sc);
3010 		SYN_CACHE_PUT(sc);
3011 	}
3012 	/* just for safety */
3013 	LIST_INIT(&tp->t_sc);
3014 
3015 	splx(s);
3016 }
3017 
3018 /*
3019  * Find an entry in the syn cache.
3020  */
3021 struct syn_cache *
3022 syn_cache_lookup(src, dst, headp)
3023 	struct sockaddr *src;
3024 	struct sockaddr *dst;
3025 	struct syn_cache_head **headp;
3026 {
3027 	struct syn_cache *sc;
3028 	struct syn_cache_head *scp;
3029 	u_int32_t hash;
3030 	int s;
3031 
3032 	SYN_HASHALL(hash, src, dst);
3033 
3034 	scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3035 	*headp = scp;
3036 	s = splsoftnet();
3037 	for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3038 	     sc = TAILQ_NEXT(sc, sc_bucketq)) {
3039 		if (sc->sc_hash != hash)
3040 			continue;
3041 		if (!bcmp(&sc->sc_src, src, src->sa_len) &&
3042 		    !bcmp(&sc->sc_dst, dst, dst->sa_len)) {
3043 			splx(s);
3044 			return (sc);
3045 		}
3046 	}
3047 	splx(s);
3048 	return (NULL);
3049 }
3050 
3051 /*
3052  * This function gets called when we receive an ACK for a
3053  * socket in the LISTEN state.  We look up the connection
3054  * in the syn cache, and if its there, we pull it out of
3055  * the cache and turn it into a full-blown connection in
3056  * the SYN-RECEIVED state.
3057  *
3058  * The return values may not be immediately obvious, and their effects
3059  * can be subtle, so here they are:
3060  *
3061  *	NULL	SYN was not found in cache; caller should drop the
3062  *		packet and send an RST.
3063  *
3064  *	-1	We were unable to create the new connection, and are
3065  *		aborting it.  An ACK,RST is being sent to the peer
3066  *		(unless we got screwey sequence numbners; see below),
3067  *		because the 3-way handshake has been completed.  Caller
3068  *		should not free the mbuf, since we may be using it.  If
3069  *		we are not, we will free it.
3070  *
3071  *	Otherwise, the return value is a pointer to the new socket
3072  *	associated with the connection.
3073  */
3074 struct socket *
3075 syn_cache_get(src, dst, th, hlen, tlen, so, m)
3076 	struct sockaddr *src;
3077 	struct sockaddr *dst;
3078 	struct tcphdr *th;
3079 	unsigned int hlen, tlen;
3080 	struct socket *so;
3081 	struct mbuf *m;
3082 {
3083 	struct syn_cache *sc;
3084 	struct syn_cache_head *scp;
3085 	struct inpcb *inp = NULL;
3086 #ifdef INET6
3087 	struct in6pcb *in6p = NULL;
3088 #endif
3089 	struct tcpcb *tp = 0;
3090 	struct mbuf *am;
3091 	int s;
3092 	struct socket *oso;
3093 
3094 	s = splsoftnet();
3095 	if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3096 		splx(s);
3097 		return (NULL);
3098 	}
3099 
3100 	/*
3101 	 * Verify the sequence and ack numbers.  Try getting the correct
3102 	 * response again.
3103 	 */
3104 	if ((th->th_ack != sc->sc_iss + 1) ||
3105 	    SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3106 	    SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3107 		(void) syn_cache_respond(sc, m);
3108 		splx(s);
3109 		return ((struct socket *)(-1));
3110 	}
3111 
3112 	/* Remove this cache entry */
3113 	SYN_CACHE_RM(sc);
3114 	splx(s);
3115 
3116 	/*
3117 	 * Ok, create the full blown connection, and set things up
3118 	 * as they would have been set up if we had created the
3119 	 * connection when the SYN arrived.  If we can't create
3120 	 * the connection, abort it.
3121 	 */
3122 	/*
3123 	 * inp still has the OLD in_pcb stuff, set the
3124 	 * v6-related flags on the new guy, too.   This is
3125 	 * done particularly for the case where an AF_INET6
3126 	 * socket is bound only to a port, and a v4 connection
3127 	 * comes in on that port.
3128 	 * we also copy the flowinfo from the original pcb
3129 	 * to the new one.
3130 	 */
3131 	oso = so;
3132 	so = sonewconn(so, SS_ISCONNECTED);
3133 	if (so == NULL)
3134 		goto resetandabort;
3135 
3136 	switch (so->so_proto->pr_domain->dom_family) {
3137 #ifdef INET
3138 	case AF_INET:
3139 		inp = sotoinpcb(so);
3140 		break;
3141 #endif
3142 #ifdef INET6
3143 	case AF_INET6:
3144 		in6p = sotoin6pcb(so);
3145 		break;
3146 #endif
3147 	}
3148 	switch (src->sa_family) {
3149 #ifdef INET
3150 	case AF_INET:
3151 		if (inp) {
3152 			struct in_ifaddr *ia;
3153 			inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
3154 			inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
3155 			inp->inp_options = ip_srcroute();
3156 			INADDR_TO_IA(inp->inp_laddr, ia);
3157 			KASSERT(ia != NULL);
3158 			KASSERT(inp->inp_ia == NULL);
3159 			inp->inp_ia = ia;
3160 			LIST_INSERT_HEAD(&ia->ia_inpcbs, inp, inp_ialink);
3161 			IFAREF(&ia->ia_ifa);
3162 			in_pcbstate(inp, INP_BOUND);
3163 			if (inp->inp_options == NULL) {
3164 				inp->inp_options = sc->sc_ipopts;
3165 				sc->sc_ipopts = NULL;
3166 			}
3167 		}
3168 #ifdef INET6
3169 		else if (in6p) {
3170 			/* IPv4 packet to AF_INET6 socket */
3171 			bzero(&in6p->in6p_laddr, sizeof(in6p->in6p_laddr));
3172 			in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
3173 			bcopy(&((struct sockaddr_in *)dst)->sin_addr,
3174 				&in6p->in6p_laddr.s6_addr32[3],
3175 				sizeof(((struct sockaddr_in *)dst)->sin_addr));
3176 			in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
3177 			in6totcpcb(in6p)->t_family = AF_INET;
3178 			if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
3179 				in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
3180 			else
3181 				in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
3182 		}
3183 #endif
3184 		break;
3185 #endif
3186 #ifdef INET6
3187 	case AF_INET6:
3188 		if (in6p) {
3189 			in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
3190 			in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
3191 #if 0
3192 			in6p->in6p_flowinfo = ip6->ip6_flow & IPV6_FLOWINFO_MASK;
3193 			/*inp->inp_options = ip6_srcroute();*/ /* soon. */
3194 #endif
3195 		}
3196 		break;
3197 #endif
3198 	}
3199 #ifdef INET6
3200 	if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
3201 		struct in6pcb *oin6p = sotoin6pcb(oso);
3202 		/* inherit socket options from the listening socket */
3203 		in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
3204 		if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
3205 			m_freem(in6p->in6p_options);
3206 			in6p->in6p_options = 0;
3207 		}
3208 		ip6_savecontrol(in6p, &in6p->in6p_options,
3209 			mtod(m, struct ip6_hdr *), m);
3210 	}
3211 #endif
3212 
3213 #ifdef IPSEC
3214 	/*
3215 	 * we make a copy of policy, instead of sharing the policy,
3216 	 * for better behavior in terms of SA lookup and dead SA removal.
3217 	 */
3218 	if (inp) {
3219 		/* copy old policy into new socket's */
3220 		if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
3221 			printf("tcp_input: could not copy policy\n");
3222 	}
3223 #ifdef INET6
3224 	else if (in6p) {
3225 		/* copy old policy into new socket's */
3226 		if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
3227 		    in6p->in6p_sp))
3228 			printf("tcp_input: could not copy policy\n");
3229 	}
3230 #endif
3231 #endif
3232 
3233 	/*
3234 	 * Give the new socket our cached route reference.
3235 	 */
3236 	if (inp)
3237 		inp->inp_route = sc->sc_route4;		/* struct assignment */
3238 #ifdef INET6
3239 	else
3240 		in6p->in6p_route = sc->sc_route6;
3241 #endif
3242 	sc->sc_route4.ro_rt = NULL;
3243 
3244 	am = m_get(M_DONTWAIT, MT_SONAME);	/* XXX */
3245 	if (am == NULL)
3246 		goto resetandabort;
3247 	MCLAIM(am, &tcp_mowner);
3248 	am->m_len = src->sa_len;
3249 	bcopy(src, mtod(am, caddr_t), src->sa_len);
3250 	if (inp) {
3251 		if (in_pcbconnect(inp, am)) {
3252 			(void) m_free(am);
3253 			goto resetandabort;
3254 		}
3255 	}
3256 #ifdef INET6
3257 	else if (in6p) {
3258 		if (src->sa_family == AF_INET) {
3259 			/* IPv4 packet to AF_INET6 socket */
3260 			struct sockaddr_in6 *sin6;
3261 			sin6 = mtod(am, struct sockaddr_in6 *);
3262 			am->m_len = sizeof(*sin6);
3263 			bzero(sin6, sizeof(*sin6));
3264 			sin6->sin6_family = AF_INET6;
3265 			sin6->sin6_len = sizeof(*sin6);
3266 			sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
3267 			sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
3268 			bcopy(&((struct sockaddr_in *)src)->sin_addr,
3269 				&sin6->sin6_addr.s6_addr32[3],
3270 				sizeof(sin6->sin6_addr.s6_addr32[3]));
3271 		}
3272 		if (in6_pcbconnect(in6p, am)) {
3273 			(void) m_free(am);
3274 			goto resetandabort;
3275 		}
3276 	}
3277 #endif
3278 	else {
3279 		(void) m_free(am);
3280 		goto resetandabort;
3281 	}
3282 	(void) m_free(am);
3283 
3284 	if (inp)
3285 		tp = intotcpcb(inp);
3286 #ifdef INET6
3287 	else if (in6p)
3288 		tp = in6totcpcb(in6p);
3289 #endif
3290 	else
3291 		tp = NULL;
3292 	tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
3293 	if (sc->sc_request_r_scale != 15) {
3294 		tp->requested_s_scale = sc->sc_requested_s_scale;
3295 		tp->request_r_scale = sc->sc_request_r_scale;
3296 		tp->snd_scale = sc->sc_requested_s_scale;
3297 		tp->rcv_scale = sc->sc_request_r_scale;
3298 		tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
3299 	}
3300 	if (sc->sc_flags & SCF_TIMESTAMP)
3301 		tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
3302 	tp->ts_timebase = sc->sc_timebase;
3303 
3304 	tp->t_template = tcp_template(tp);
3305 	if (tp->t_template == 0) {
3306 		tp = tcp_drop(tp, ENOBUFS);	/* destroys socket */
3307 		so = NULL;
3308 		m_freem(m);
3309 		goto abort;
3310 	}
3311 
3312 	tp->iss = sc->sc_iss;
3313 	tp->irs = sc->sc_irs;
3314 	tcp_sendseqinit(tp);
3315 	tcp_rcvseqinit(tp);
3316 	tp->t_state = TCPS_SYN_RECEIVED;
3317 	TCP_TIMER_ARM(tp, TCPT_KEEP, TCPTV_KEEP_INIT);
3318 	tcpstat.tcps_accepts++;
3319 
3320 	/* Initialize tp->t_ourmss before we deal with the peer's! */
3321 	tp->t_ourmss = sc->sc_ourmaxseg;
3322 	tcp_mss_from_peer(tp, sc->sc_peermaxseg);
3323 
3324 	/*
3325 	 * Initialize the initial congestion window.  If we
3326 	 * had to retransmit the SYN,ACK, we must initialize cwnd
3327 	 * to 1 segment (i.e. the Loss Window).
3328 	 */
3329 	if (sc->sc_rxtshift)
3330 		tp->snd_cwnd = tp->t_peermss;
3331 	else {
3332 		int ss = tcp_init_win;
3333 #ifdef INET
3334 		if (inp != NULL && in_localaddr(inp->inp_faddr))
3335 			ss = tcp_init_win_local;
3336 #endif
3337 #ifdef INET6
3338 		if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
3339 			ss = tcp_init_win_local;
3340 #endif
3341 		tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
3342 	}
3343 
3344 	tcp_rmx_rtt(tp);
3345 	tp->snd_wl1 = sc->sc_irs;
3346 	tp->rcv_up = sc->sc_irs + 1;
3347 
3348 	/*
3349 	 * This is what whould have happened in tcp_output() when
3350 	 * the SYN,ACK was sent.
3351 	 */
3352 	tp->snd_up = tp->snd_una;
3353 	tp->snd_max = tp->snd_nxt = tp->iss+1;
3354 	TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
3355 	if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
3356 		tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
3357 	tp->last_ack_sent = tp->rcv_nxt;
3358 
3359 	tcpstat.tcps_sc_completed++;
3360 	SYN_CACHE_PUT(sc);
3361 	return (so);
3362 
3363 resetandabort:
3364 	(void) tcp_respond(NULL, m, m, th,
3365 			   th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
3366 abort:
3367 	if (so != NULL)
3368 		(void) soabort(so);
3369 	SYN_CACHE_PUT(sc);
3370 	tcpstat.tcps_sc_aborted++;
3371 	return ((struct socket *)(-1));
3372 }
3373 
3374 /*
3375  * This function is called when we get a RST for a
3376  * non-existent connection, so that we can see if the
3377  * connection is in the syn cache.  If it is, zap it.
3378  */
3379 
3380 void
3381 syn_cache_reset(src, dst, th)
3382 	struct sockaddr *src;
3383 	struct sockaddr *dst;
3384 	struct tcphdr *th;
3385 {
3386 	struct syn_cache *sc;
3387 	struct syn_cache_head *scp;
3388 	int s = splsoftnet();
3389 
3390 	if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3391 		splx(s);
3392 		return;
3393 	}
3394 	if (SEQ_LT(th->th_seq, sc->sc_irs) ||
3395 	    SEQ_GT(th->th_seq, sc->sc_irs+1)) {
3396 		splx(s);
3397 		return;
3398 	}
3399 	SYN_CACHE_RM(sc);
3400 	splx(s);
3401 	tcpstat.tcps_sc_reset++;
3402 	SYN_CACHE_PUT(sc);
3403 }
3404 
3405 void
3406 syn_cache_unreach(src, dst, th)
3407 	struct sockaddr *src;
3408 	struct sockaddr *dst;
3409 	struct tcphdr *th;
3410 {
3411 	struct syn_cache *sc;
3412 	struct syn_cache_head *scp;
3413 	int s;
3414 
3415 	s = splsoftnet();
3416 	if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3417 		splx(s);
3418 		return;
3419 	}
3420 	/* If the sequence number != sc_iss, then it's a bogus ICMP msg */
3421 	if (ntohl (th->th_seq) != sc->sc_iss) {
3422 		splx(s);
3423 		return;
3424 	}
3425 
3426 	/*
3427 	 * If we've rertransmitted 3 times and this is our second error,
3428 	 * we remove the entry.  Otherwise, we allow it to continue on.
3429 	 * This prevents us from incorrectly nuking an entry during a
3430 	 * spurious network outage.
3431 	 *
3432 	 * See tcp_notify().
3433 	 */
3434 	if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
3435 		sc->sc_flags |= SCF_UNREACH;
3436 		splx(s);
3437 		return;
3438 	}
3439 
3440 	SYN_CACHE_RM(sc);
3441 	splx(s);
3442 	tcpstat.tcps_sc_unreach++;
3443 	SYN_CACHE_PUT(sc);
3444 }
3445 
3446 /*
3447  * Given a LISTEN socket and an inbound SYN request, add
3448  * this to the syn cache, and send back a segment:
3449  *	<SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
3450  * to the source.
3451  *
3452  * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
3453  * Doing so would require that we hold onto the data and deliver it
3454  * to the application.  However, if we are the target of a SYN-flood
3455  * DoS attack, an attacker could send data which would eventually
3456  * consume all available buffer space if it were ACKed.  By not ACKing
3457  * the data, we avoid this DoS scenario.
3458  */
3459 
3460 int
3461 syn_cache_add(src, dst, th, hlen, so, m, optp, optlen, oi)
3462 	struct sockaddr *src;
3463 	struct sockaddr *dst;
3464 	struct tcphdr *th;
3465 	unsigned int hlen;
3466 	struct socket *so;
3467 	struct mbuf *m;
3468 	u_char *optp;
3469 	int optlen;
3470 	struct tcp_opt_info *oi;
3471 {
3472 	struct tcpcb tb, *tp;
3473 	long win;
3474 	struct syn_cache *sc;
3475 	struct syn_cache_head *scp;
3476 	struct mbuf *ipopts;
3477 
3478 	tp = sototcpcb(so);
3479 
3480 	/*
3481 	 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
3482 	 *
3483 	 * Note this check is performed in tcp_input() very early on.
3484 	 */
3485 
3486 	/*
3487 	 * Initialize some local state.
3488 	 */
3489 	win = sbspace(&so->so_rcv);
3490 	if (win > TCP_MAXWIN)
3491 		win = TCP_MAXWIN;
3492 
3493 	switch (src->sa_family) {
3494 #ifdef INET
3495 	case AF_INET:
3496 		/*
3497 		 * Remember the IP options, if any.
3498 		 */
3499 		ipopts = ip_srcroute();
3500 		break;
3501 #endif
3502 	default:
3503 		ipopts = NULL;
3504 	}
3505 
3506 	if (optp) {
3507 		tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
3508 		tcp_dooptions(&tb, optp, optlen, th, oi);
3509 	} else
3510 		tb.t_flags = 0;
3511 
3512 	/*
3513 	 * See if we already have an entry for this connection.
3514 	 * If we do, resend the SYN,ACK.  We do not count this
3515 	 * as a retransmission (XXX though maybe we should).
3516 	 */
3517 	if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
3518 		tcpstat.tcps_sc_dupesyn++;
3519 		if (ipopts) {
3520 			/*
3521 			 * If we were remembering a previous source route,
3522 			 * forget it and use the new one we've been given.
3523 			 */
3524 			if (sc->sc_ipopts)
3525 				(void) m_free(sc->sc_ipopts);
3526 			sc->sc_ipopts = ipopts;
3527 		}
3528 		sc->sc_timestamp = tb.ts_recent;
3529 		if (syn_cache_respond(sc, m) == 0) {
3530 			tcpstat.tcps_sndacks++;
3531 			tcpstat.tcps_sndtotal++;
3532 		}
3533 		return (1);
3534 	}
3535 
3536 	sc = pool_get(&syn_cache_pool, PR_NOWAIT);
3537 	if (sc == NULL) {
3538 		if (ipopts)
3539 			(void) m_free(ipopts);
3540 		return (0);
3541 	}
3542 
3543 	/*
3544 	 * Fill in the cache, and put the necessary IP and TCP
3545 	 * options into the reply.
3546 	 */
3547 	bzero(sc, sizeof(struct syn_cache));
3548 	callout_init(&sc->sc_timer);
3549 	bcopy(src, &sc->sc_src, src->sa_len);
3550 	bcopy(dst, &sc->sc_dst, dst->sa_len);
3551 	sc->sc_flags = 0;
3552 	sc->sc_ipopts = ipopts;
3553 	sc->sc_irs = th->th_seq;
3554 	switch (src->sa_family) {
3555 #ifdef INET
3556 	case AF_INET:
3557 	    {
3558 		struct sockaddr_in *srcin = (void *) src;
3559 		struct sockaddr_in *dstin = (void *) dst;
3560 
3561 		sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
3562 		    &srcin->sin_addr, dstin->sin_port,
3563 		    srcin->sin_port, sizeof(dstin->sin_addr), 0);
3564 		break;
3565 	    }
3566 #endif /* INET */
3567 #ifdef INET6
3568 	case AF_INET6:
3569 	    {
3570 		struct sockaddr_in6 *srcin6 = (void *) src;
3571 		struct sockaddr_in6 *dstin6 = (void *) dst;
3572 
3573 		sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
3574 		    &srcin6->sin6_addr, dstin6->sin6_port,
3575 		    srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
3576 		break;
3577 	    }
3578 #endif /* INET6 */
3579 	}
3580 	sc->sc_peermaxseg = oi->maxseg;
3581 	sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
3582 						m->m_pkthdr.rcvif : NULL,
3583 						sc->sc_src.sa.sa_family);
3584 	sc->sc_win = win;
3585 	sc->sc_timebase = tcp_now;	/* see tcp_newtcpcb() */
3586 	sc->sc_timestamp = tb.ts_recent;
3587 	if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
3588 	    (TF_REQ_TSTMP|TF_RCVD_TSTMP))
3589 		sc->sc_flags |= SCF_TIMESTAMP;
3590 	if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
3591 	    (TF_RCVD_SCALE|TF_REQ_SCALE)) {
3592 		sc->sc_requested_s_scale = tb.requested_s_scale;
3593 		sc->sc_request_r_scale = 0;
3594 		while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
3595 		    TCP_MAXWIN << sc->sc_request_r_scale <
3596 		    so->so_rcv.sb_hiwat)
3597 			sc->sc_request_r_scale++;
3598 	} else {
3599 		sc->sc_requested_s_scale = 15;
3600 		sc->sc_request_r_scale = 15;
3601 	}
3602 	sc->sc_tp = tp;
3603 	if (syn_cache_respond(sc, m) == 0) {
3604 		syn_cache_insert(sc, tp);
3605 		tcpstat.tcps_sndacks++;
3606 		tcpstat.tcps_sndtotal++;
3607 	} else {
3608 		SYN_CACHE_PUT(sc);
3609 		tcpstat.tcps_sc_dropped++;
3610 	}
3611 	return (1);
3612 }
3613 
3614 int
3615 syn_cache_respond(sc, m)
3616 	struct syn_cache *sc;
3617 	struct mbuf *m;
3618 {
3619 	struct route *ro;
3620 	u_int8_t *optp;
3621 	int optlen, error;
3622 	u_int16_t tlen;
3623 	struct ip *ip = NULL;
3624 #ifdef INET6
3625 	struct ip6_hdr *ip6 = NULL;
3626 #endif
3627 	struct tcphdr *th;
3628 	u_int hlen;
3629 
3630 	switch (sc->sc_src.sa.sa_family) {
3631 	case AF_INET:
3632 		hlen = sizeof(struct ip);
3633 		ro = &sc->sc_route4;
3634 		break;
3635 #ifdef INET6
3636 	case AF_INET6:
3637 		hlen = sizeof(struct ip6_hdr);
3638 		ro = (struct route *)&sc->sc_route6;
3639 		break;
3640 #endif
3641 	default:
3642 		if (m)
3643 			m_freem(m);
3644 		return EAFNOSUPPORT;
3645 	}
3646 
3647 	/* Compute the size of the TCP options. */
3648 	optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
3649 	    ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
3650 
3651 	tlen = hlen + sizeof(struct tcphdr) + optlen;
3652 
3653 	/*
3654 	 * Create the IP+TCP header from scratch.
3655 	 */
3656 	if (m)
3657 		m_freem(m);
3658 #ifdef DIAGNOSTIC
3659 	if (max_linkhdr + tlen > MCLBYTES)
3660 		return (ENOBUFS);
3661 #endif
3662 	MGETHDR(m, M_DONTWAIT, MT_DATA);
3663 	if (m && tlen > MHLEN) {
3664 		MCLGET(m, M_DONTWAIT);
3665 		if ((m->m_flags & M_EXT) == 0) {
3666 			m_freem(m);
3667 			m = NULL;
3668 		}
3669 	}
3670 	if (m == NULL)
3671 		return (ENOBUFS);
3672 	MCLAIM(m, &tcp_tx_mowner);
3673 
3674 	/* Fixup the mbuf. */
3675 	m->m_data += max_linkhdr;
3676 	m->m_len = m->m_pkthdr.len = tlen;
3677 #ifdef IPSEC
3678 	if (sc->sc_tp) {
3679 		struct tcpcb *tp;
3680 		struct socket *so;
3681 
3682 		tp = sc->sc_tp;
3683 		if (tp->t_inpcb)
3684 			so = tp->t_inpcb->inp_socket;
3685 #ifdef INET6
3686 		else if (tp->t_in6pcb)
3687 			so = tp->t_in6pcb->in6p_socket;
3688 #endif
3689 		else
3690 			so = NULL;
3691 		/* use IPsec policy on listening socket, on SYN ACK */
3692 		if (ipsec_setsocket(m, so) != 0) {
3693 			m_freem(m);
3694 			return ENOBUFS;
3695 		}
3696 	}
3697 #endif
3698 	m->m_pkthdr.rcvif = NULL;
3699 	memset(mtod(m, u_char *), 0, tlen);
3700 
3701 	switch (sc->sc_src.sa.sa_family) {
3702 	case AF_INET:
3703 		ip = mtod(m, struct ip *);
3704 		ip->ip_dst = sc->sc_src.sin.sin_addr;
3705 		ip->ip_src = sc->sc_dst.sin.sin_addr;
3706 		ip->ip_p = IPPROTO_TCP;
3707 		th = (struct tcphdr *)(ip + 1);
3708 		th->th_dport = sc->sc_src.sin.sin_port;
3709 		th->th_sport = sc->sc_dst.sin.sin_port;
3710 		break;
3711 #ifdef INET6
3712 	case AF_INET6:
3713 		ip6 = mtod(m, struct ip6_hdr *);
3714 		ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
3715 		ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
3716 		ip6->ip6_nxt = IPPROTO_TCP;
3717 		/* ip6_plen will be updated in ip6_output() */
3718 		th = (struct tcphdr *)(ip6 + 1);
3719 		th->th_dport = sc->sc_src.sin6.sin6_port;
3720 		th->th_sport = sc->sc_dst.sin6.sin6_port;
3721 		break;
3722 #endif
3723 	default:
3724 		th = NULL;
3725 	}
3726 
3727 	th->th_seq = htonl(sc->sc_iss);
3728 	th->th_ack = htonl(sc->sc_irs + 1);
3729 	th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
3730 	th->th_flags = TH_SYN|TH_ACK;
3731 	th->th_win = htons(sc->sc_win);
3732 	/* th_sum already 0 */
3733 	/* th_urp already 0 */
3734 
3735 	/* Tack on the TCP options. */
3736 	optp = (u_int8_t *)(th + 1);
3737 	*optp++ = TCPOPT_MAXSEG;
3738 	*optp++ = 4;
3739 	*optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
3740 	*optp++ = sc->sc_ourmaxseg & 0xff;
3741 
3742 	if (sc->sc_request_r_scale != 15) {
3743 		*((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
3744 		    TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
3745 		    sc->sc_request_r_scale);
3746 		optp += 4;
3747 	}
3748 
3749 	if (sc->sc_flags & SCF_TIMESTAMP) {
3750 		u_int32_t *lp = (u_int32_t *)(optp);
3751 		/* Form timestamp option as shown in appendix A of RFC 1323. */
3752 		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
3753 		*lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
3754 		*lp   = htonl(sc->sc_timestamp);
3755 		optp += TCPOLEN_TSTAMP_APPA;
3756 	}
3757 
3758 	/* Compute the packet's checksum. */
3759 	switch (sc->sc_src.sa.sa_family) {
3760 	case AF_INET:
3761 		ip->ip_len = htons(tlen - hlen);
3762 		th->th_sum = 0;
3763 		th->th_sum = in_cksum(m, tlen);
3764 		break;
3765 #ifdef INET6
3766 	case AF_INET6:
3767 		ip6->ip6_plen = htons(tlen - hlen);
3768 		th->th_sum = 0;
3769 		th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
3770 		break;
3771 #endif
3772 	}
3773 
3774 	/*
3775 	 * Fill in some straggling IP bits.  Note the stack expects
3776 	 * ip_len to be in host order, for convenience.
3777 	 */
3778 	switch (sc->sc_src.sa.sa_family) {
3779 #ifdef INET
3780 	case AF_INET:
3781 		ip->ip_len = htons(tlen);
3782 		ip->ip_ttl = ip_defttl;
3783 		/* XXX tos? */
3784 		break;
3785 #endif
3786 #ifdef INET6
3787 	case AF_INET6:
3788 		ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3789 		ip6->ip6_vfc |= IPV6_VERSION;
3790 		ip6->ip6_plen = htons(tlen - hlen);
3791 		/* ip6_hlim will be initialized afterwards */
3792 		/* XXX flowlabel? */
3793 		break;
3794 #endif
3795 	}
3796 
3797 	switch (sc->sc_src.sa.sa_family) {
3798 #ifdef INET
3799 	case AF_INET:
3800 		error = ip_output(m, sc->sc_ipopts, ro,
3801 		    (ip_mtudisc ? IP_MTUDISC : 0),
3802 		    NULL);
3803 		break;
3804 #endif
3805 #ifdef INET6
3806 	case AF_INET6:
3807 		ip6->ip6_hlim = in6_selecthlim(NULL,
3808 				ro->ro_rt ? ro->ro_rt->rt_ifp : NULL);
3809 
3810 		error = ip6_output(m, NULL /*XXX*/, (struct route_in6 *)ro,
3811 			0, NULL, NULL);
3812 		break;
3813 #endif
3814 	default:
3815 		error = EAFNOSUPPORT;
3816 		break;
3817 	}
3818 	return (error);
3819 }
3820