1 /* $OpenBSD: tcp_input.c,v 1.228 2009/08/20 13:25:42 bluhm Exp $ */ 2 /* $NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include <sys/param.h> 72 #include <sys/systm.h> 73 #include <sys/mbuf.h> 74 #include <sys/protosw.h> 75 #include <sys/socket.h> 76 #include <sys/socketvar.h> 77 #include <sys/kernel.h> 78 #include <sys/pool.h> 79 80 #include <dev/rndvar.h> 81 82 #include <net/if.h> 83 #include <net/route.h> 84 85 #include <netinet/in.h> 86 #include <netinet/in_systm.h> 87 #include <netinet/ip.h> 88 #include <netinet/in_pcb.h> 89 #include <netinet/ip_var.h> 90 #include <netinet/tcp.h> 91 #include <netinet/tcp_fsm.h> 92 #include <netinet/tcp_seq.h> 93 #include <netinet/tcp_timer.h> 94 #include <netinet/tcp_var.h> 95 #include <netinet/tcpip.h> 96 #include <netinet/tcp_debug.h> 97 98 #include "faith.h" 99 100 #include "pf.h" 101 #if NPF > 0 102 #include <net/pfvar.h> 103 #endif 104 105 struct tcpiphdr tcp_saveti; 106 107 int tcp_mss_adv(struct ifnet *, int); 108 109 #ifdef INET6 110 #include <netinet6/in6_var.h> 111 #include <netinet6/nd6.h> 112 113 struct tcpipv6hdr tcp_saveti6; 114 115 /* for the packet header length in the mbuf */ 116 #define M_PH_LEN(m) (((struct mbuf *)(m))->m_pkthdr.len) 117 #define M_V6_LEN(m) (M_PH_LEN(m) - sizeof(struct ip6_hdr)) 118 #define M_V4_LEN(m) (M_PH_LEN(m) - sizeof(struct ip)) 119 #endif /* INET6 */ 120 121 int tcprexmtthresh = 3; 122 int tcptv_keep_init = TCPTV_KEEP_INIT; 123 124 extern u_long sb_max; 125 126 int tcp_rst_ppslim = 100; /* 100pps */ 127 int tcp_rst_ppslim_count = 0; 128 struct timeval tcp_rst_ppslim_last; 129 130 int tcp_ackdrop_ppslim = 100; /* 100pps */ 131 int tcp_ackdrop_ppslim_count = 0; 132 struct timeval tcp_ackdrop_ppslim_last; 133 134 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 135 136 /* for modulo comparisons of timestamps */ 137 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 138 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 139 140 /* for TCP SACK comparisons */ 141 #define SEQ_MIN(a,b) (SEQ_LT(a,b) ? (a) : (b)) 142 #define SEQ_MAX(a,b) (SEQ_GT(a,b) ? (a) : (b)) 143 144 /* 145 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. 146 */ 147 #ifdef INET6 148 #define ND6_HINT(tp) \ 149 do { \ 150 if (tp && tp->t_inpcb && (tp->t_inpcb->inp_flags & INP_IPV6) && \ 151 tp->t_inpcb->inp_route6.ro_rt) { \ 152 nd6_nud_hint(tp->t_inpcb->inp_route6.ro_rt, NULL, 0); \ 153 } \ 154 } while (0) 155 #else 156 #define ND6_HINT(tp) 157 #endif 158 159 #ifdef TCP_ECN 160 /* 161 * ECN (Explicit Congestion Notification) support based on RFC3168 162 * implementation note: 163 * snd_last is used to track a recovery phase. 164 * when cwnd is reduced, snd_last is set to snd_max. 165 * while snd_last > snd_una, the sender is in a recovery phase and 166 * its cwnd should not be reduced again. 167 * snd_last follows snd_una when not in a recovery phase. 168 */ 169 #endif 170 171 /* 172 * Macro to compute ACK transmission behavior. Delay the ACK unless 173 * we have already delayed an ACK (must send an ACK every two segments). 174 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 175 * option is enabled. 176 */ 177 #define TCP_SETUP_ACK(tp, tiflags) \ 178 do { \ 179 if ((tp)->t_flags & TF_DELACK || \ 180 (tcp_ack_on_push && (tiflags) & TH_PUSH)) \ 181 tp->t_flags |= TF_ACKNOW; \ 182 else \ 183 TCP_SET_DELACK(tp); \ 184 } while (0) 185 186 /* 187 * Insert segment ti into reassembly queue of tcp with 188 * control block tp. Return TH_FIN if reassembly now includes 189 * a segment with FIN. The macro form does the common case inline 190 * (segment is the next to be received on an established connection, 191 * and the queue is empty), avoiding linkage into and removal 192 * from the queue and repetition of various conversions. 193 * Set DELACK for segments received in order, but ack immediately 194 * when segments are out of order (so fast retransmit can work). 195 */ 196 197 int 198 tcp_reass(struct tcpcb *tp, struct tcphdr *th, struct mbuf *m, int *tlen) 199 { 200 struct tcpqent *p, *q, *nq, *tiqe; 201 struct socket *so = tp->t_inpcb->inp_socket; 202 int flags; 203 204 /* 205 * Call with th==0 after become established to 206 * force pre-ESTABLISHED data up to user socket. 207 */ 208 if (th == 0) 209 goto present; 210 211 /* 212 * Allocate a new queue entry, before we throw away any data. 213 * If we can't, just drop the packet. XXX 214 */ 215 tiqe = pool_get(&tcpqe_pool, PR_NOWAIT); 216 if (tiqe == NULL) { 217 tiqe = TAILQ_LAST(&tp->t_segq, tcpqehead); 218 if (tiqe != NULL && th->th_seq == tp->rcv_nxt) { 219 /* Reuse last entry since new segment fills a hole */ 220 m_freem(tiqe->tcpqe_m); 221 TAILQ_REMOVE(&tp->t_segq, tiqe, tcpqe_q); 222 } 223 if (tiqe == NULL || th->th_seq != tp->rcv_nxt) { 224 /* Flush segment queue for this connection */ 225 tcp_freeq(tp); 226 tcpstat.tcps_rcvmemdrop++; 227 m_freem(m); 228 return (0); 229 } 230 } 231 232 /* 233 * Find a segment which begins after this one does. 234 */ 235 for (p = NULL, q = TAILQ_FIRST(&tp->t_segq); q != NULL; 236 p = q, q = TAILQ_NEXT(q, tcpqe_q)) 237 if (SEQ_GT(q->tcpqe_tcp->th_seq, th->th_seq)) 238 break; 239 240 /* 241 * If there is a preceding segment, it may provide some of 242 * our data already. If so, drop the data from the incoming 243 * segment. If it provides all of our data, drop us. 244 */ 245 if (p != NULL) { 246 struct tcphdr *phdr = p->tcpqe_tcp; 247 int i; 248 249 /* conversion to int (in i) handles seq wraparound */ 250 i = phdr->th_seq + phdr->th_reseqlen - th->th_seq; 251 if (i > 0) { 252 if (i >= *tlen) { 253 tcpstat.tcps_rcvduppack++; 254 tcpstat.tcps_rcvdupbyte += *tlen; 255 m_freem(m); 256 pool_put(&tcpqe_pool, tiqe); 257 return (0); 258 } 259 m_adj(m, i); 260 *tlen -= i; 261 th->th_seq += i; 262 } 263 } 264 tcpstat.tcps_rcvoopack++; 265 tcpstat.tcps_rcvoobyte += *tlen; 266 267 /* 268 * While we overlap succeeding segments trim them or, 269 * if they are completely covered, dequeue them. 270 */ 271 for (; q != NULL; q = nq) { 272 struct tcphdr *qhdr = q->tcpqe_tcp; 273 int i = (th->th_seq + *tlen) - qhdr->th_seq; 274 275 if (i <= 0) 276 break; 277 if (i < qhdr->th_reseqlen) { 278 qhdr->th_seq += i; 279 qhdr->th_reseqlen -= i; 280 m_adj(q->tcpqe_m, i); 281 break; 282 } 283 nq = TAILQ_NEXT(q, tcpqe_q); 284 m_freem(q->tcpqe_m); 285 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 286 pool_put(&tcpqe_pool, q); 287 } 288 289 /* Insert the new segment queue entry into place. */ 290 tiqe->tcpqe_m = m; 291 th->th_reseqlen = *tlen; 292 tiqe->tcpqe_tcp = th; 293 if (p == NULL) { 294 TAILQ_INSERT_HEAD(&tp->t_segq, tiqe, tcpqe_q); 295 } else { 296 TAILQ_INSERT_AFTER(&tp->t_segq, p, tiqe, tcpqe_q); 297 } 298 299 present: 300 /* 301 * Present data to user, advancing rcv_nxt through 302 * completed sequence space. 303 */ 304 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 305 return (0); 306 q = TAILQ_FIRST(&tp->t_segq); 307 if (q == NULL || q->tcpqe_tcp->th_seq != tp->rcv_nxt) 308 return (0); 309 if (tp->t_state == TCPS_SYN_RECEIVED && q->tcpqe_tcp->th_reseqlen) 310 return (0); 311 do { 312 tp->rcv_nxt += q->tcpqe_tcp->th_reseqlen; 313 flags = q->tcpqe_tcp->th_flags & TH_FIN; 314 315 nq = TAILQ_NEXT(q, tcpqe_q); 316 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 317 ND6_HINT(tp); 318 if (so->so_state & SS_CANTRCVMORE) 319 m_freem(q->tcpqe_m); 320 else 321 sbappendstream(&so->so_rcv, q->tcpqe_m); 322 pool_put(&tcpqe_pool, q); 323 q = nq; 324 } while (q != NULL && q->tcpqe_tcp->th_seq == tp->rcv_nxt); 325 sorwakeup(so); 326 return (flags); 327 } 328 329 #ifdef INET6 330 int 331 tcp6_input(struct mbuf **mp, int *offp, int proto) 332 { 333 struct mbuf *m = *mp; 334 335 #if NFAITH > 0 336 if (m->m_pkthdr.rcvif) { 337 if (m->m_pkthdr.rcvif->if_type == IFT_FAITH) { 338 /* XXX send icmp6 host/port unreach? */ 339 m_freem(m); 340 return IPPROTO_DONE; 341 } 342 } 343 #endif 344 345 tcp_input(m, *offp, proto); 346 return IPPROTO_DONE; 347 } 348 #endif 349 350 /* 351 * TCP input routine, follows pages 65-76 of the 352 * protocol specification dated September, 1981 very closely. 353 */ 354 void 355 tcp_input(struct mbuf *m, ...) 356 { 357 struct ip *ip; 358 struct inpcb *inp = NULL; 359 u_int8_t *optp = NULL; 360 int optlen = 0; 361 int tlen, off; 362 struct tcpcb *tp = 0; 363 int tiflags; 364 struct socket *so = NULL; 365 int todrop, acked, ourfinisacked, needoutput = 0; 366 int hdroptlen = 0; 367 short ostate = 0; 368 tcp_seq iss, *reuse = NULL; 369 u_long tiwin; 370 struct tcp_opt_info opti; 371 int iphlen; 372 va_list ap; 373 struct tcphdr *th; 374 #ifdef INET6 375 struct ip6_hdr *ip6 = NULL; 376 #endif /* INET6 */ 377 #ifdef IPSEC 378 struct m_tag *mtag; 379 struct tdb_ident *tdbi; 380 struct tdb *tdb; 381 int error, s; 382 #endif /* IPSEC */ 383 int af; 384 #ifdef TCP_ECN 385 u_char iptos; 386 #endif 387 388 va_start(ap, m); 389 iphlen = va_arg(ap, int); 390 va_end(ap); 391 392 tcpstat.tcps_rcvtotal++; 393 394 opti.ts_present = 0; 395 opti.maxseg = 0; 396 397 /* 398 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 399 * See below for AF specific multicast. 400 */ 401 if (m->m_flags & (M_BCAST|M_MCAST)) 402 goto drop; 403 404 /* 405 * Before we do ANYTHING, we have to figure out if it's TCP/IPv6 or 406 * TCP/IPv4. 407 */ 408 switch (mtod(m, struct ip *)->ip_v) { 409 #ifdef INET6 410 case 6: 411 af = AF_INET6; 412 break; 413 #endif 414 case 4: 415 af = AF_INET; 416 break; 417 default: 418 m_freem(m); 419 return; /*EAFNOSUPPORT*/ 420 } 421 422 /* 423 * Get IP and TCP header together in first mbuf. 424 * Note: IP leaves IP header in first mbuf. 425 */ 426 switch (af) { 427 case AF_INET: 428 #ifdef DIAGNOSTIC 429 if (iphlen < sizeof(struct ip)) { 430 m_freem(m); 431 return; 432 } 433 #endif /* DIAGNOSTIC */ 434 break; 435 #ifdef INET6 436 case AF_INET6: 437 #ifdef DIAGNOSTIC 438 if (iphlen < sizeof(struct ip6_hdr)) { 439 m_freem(m); 440 return; 441 } 442 #endif /* DIAGNOSTIC */ 443 break; 444 #endif 445 default: 446 m_freem(m); 447 return; 448 } 449 450 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, sizeof(*th)); 451 if (!th) { 452 tcpstat.tcps_rcvshort++; 453 return; 454 } 455 456 tlen = m->m_pkthdr.len - iphlen; 457 ip = NULL; 458 #ifdef INET6 459 ip6 = NULL; 460 #endif 461 switch (af) { 462 case AF_INET: 463 ip = mtod(m, struct ip *); 464 if (IN_MULTICAST(ip->ip_dst.s_addr) || 465 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) 466 goto drop; 467 #ifdef TCP_ECN 468 /* save ip_tos before clearing it for checksum */ 469 iptos = ip->ip_tos; 470 #endif 471 /* 472 * Checksum extended TCP header and data. 473 */ 474 if ((m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_OK) == 0) { 475 if (m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_BAD) { 476 tcpstat.tcps_inhwcsum++; 477 tcpstat.tcps_rcvbadsum++; 478 goto drop; 479 } 480 if (in4_cksum(m, IPPROTO_TCP, iphlen, tlen) != 0) { 481 tcpstat.tcps_rcvbadsum++; 482 goto drop; 483 } 484 } else { 485 m->m_pkthdr.csum_flags &= ~M_TCP_CSUM_IN_OK; 486 tcpstat.tcps_inhwcsum++; 487 } 488 break; 489 #ifdef INET6 490 case AF_INET6: 491 ip6 = mtod(m, struct ip6_hdr *); 492 #ifdef TCP_ECN 493 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 494 #endif 495 496 /* Be proactive about malicious use of IPv4 mapped address */ 497 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 498 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 499 /* XXX stat */ 500 goto drop; 501 } 502 503 /* 504 * Be proactive about unspecified IPv6 address in source. 505 * As we use all-zero to indicate unbounded/unconnected pcb, 506 * unspecified IPv6 address can be used to confuse us. 507 * 508 * Note that packets with unspecified IPv6 destination is 509 * already dropped in ip6_input. 510 */ 511 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 512 /* XXX stat */ 513 goto drop; 514 } 515 516 /* Discard packets to multicast */ 517 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 518 /* XXX stat */ 519 goto drop; 520 } 521 522 /* 523 * Checksum extended TCP header and data. 524 */ 525 if ((m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_OK) == 0) { 526 if (m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_BAD) { 527 tcpstat.tcps_inhwcsum++; 528 tcpstat.tcps_rcvbadsum++; 529 goto drop; 530 } 531 if (in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr), 532 tlen)) { 533 tcpstat.tcps_rcvbadsum++; 534 goto drop; 535 } 536 } else { 537 m->m_pkthdr.csum_flags &= ~M_TCP_CSUM_IN_OK; 538 tcpstat.tcps_inhwcsum++; 539 } 540 break; 541 #endif 542 } 543 544 /* 545 * Check that TCP offset makes sense, 546 * pull out TCP options and adjust length. XXX 547 */ 548 off = th->th_off << 2; 549 if (off < sizeof(struct tcphdr) || off > tlen) { 550 tcpstat.tcps_rcvbadoff++; 551 goto drop; 552 } 553 tlen -= off; 554 if (off > sizeof(struct tcphdr)) { 555 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, off); 556 if (!th) { 557 tcpstat.tcps_rcvshort++; 558 return; 559 } 560 optlen = off - sizeof(struct tcphdr); 561 optp = (u_int8_t *)(th + 1); 562 /* 563 * Do quick retrieval of timestamp options ("options 564 * prediction?"). If timestamp is the only option and it's 565 * formatted as recommended in RFC 1323 appendix A, we 566 * quickly get the values now and not bother calling 567 * tcp_dooptions(), etc. 568 */ 569 if ((optlen == TCPOLEN_TSTAMP_APPA || 570 (optlen > TCPOLEN_TSTAMP_APPA && 571 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 572 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 573 (th->th_flags & TH_SYN) == 0) { 574 opti.ts_present = 1; 575 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 576 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 577 optp = NULL; /* we've parsed the options */ 578 } 579 } 580 tiflags = th->th_flags; 581 582 /* 583 * Convert TCP protocol specific fields to host format. 584 */ 585 NTOHL(th->th_seq); 586 NTOHL(th->th_ack); 587 NTOHS(th->th_win); 588 NTOHS(th->th_urp); 589 590 /* 591 * Locate pcb for segment. 592 */ 593 #if NPF > 0 594 if (m->m_pkthdr.pf.statekey) 595 inp = ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->inp; 596 #endif 597 findpcb: 598 if (inp == NULL) { 599 switch (af) { 600 #ifdef INET6 601 case AF_INET6: 602 inp = in6_pcbhashlookup(&tcbtable, &ip6->ip6_src, 603 th->th_sport, &ip6->ip6_dst, th->th_dport); 604 break; 605 #endif 606 case AF_INET: 607 inp = in_pcbhashlookup(&tcbtable, ip->ip_src, 608 th->th_sport, ip->ip_dst, th->th_dport, 609 m->m_pkthdr.rdomain); 610 break; 611 } 612 #if NPF > 0 613 if (m->m_pkthdr.pf.statekey && inp) { 614 ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->inp = 615 inp; 616 inp->inp_pf_sk = m->m_pkthdr.pf.statekey; 617 } 618 #endif 619 } 620 if (inp == NULL) { 621 int inpl_flags = 0; 622 if (m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) 623 inpl_flags = INPLOOKUP_WILDCARD; 624 ++tcpstat.tcps_pcbhashmiss; 625 switch (af) { 626 #ifdef INET6 627 case AF_INET6: 628 inp = in6_pcblookup_listen(&tcbtable, 629 &ip6->ip6_dst, th->th_dport, inpl_flags, m); 630 break; 631 #endif /* INET6 */ 632 case AF_INET: 633 inp = in_pcblookup_listen(&tcbtable, 634 ip->ip_dst, th->th_dport, inpl_flags, m, 635 m->m_pkthdr.rdomain); 636 break; 637 } 638 /* 639 * If the state is CLOSED (i.e., TCB does not exist) then 640 * all data in the incoming segment is discarded. 641 * If the TCB exists but is in CLOSED state, it is embryonic, 642 * but should either do a listen or a connect soon. 643 */ 644 if (inp == 0) { 645 ++tcpstat.tcps_noport; 646 goto dropwithreset_ratelim; 647 } 648 } 649 650 /* Check the minimum TTL for socket. */ 651 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) 652 goto drop; 653 654 tp = intotcpcb(inp); 655 if (tp == 0) 656 goto dropwithreset_ratelim; 657 if (tp->t_state == TCPS_CLOSED) 658 goto drop; 659 660 /* Unscale the window into a 32-bit value. */ 661 if ((tiflags & TH_SYN) == 0) 662 tiwin = th->th_win << tp->snd_scale; 663 else 664 tiwin = th->th_win; 665 666 so = inp->inp_socket; 667 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 668 union syn_cache_sa src; 669 union syn_cache_sa dst; 670 671 bzero(&src, sizeof(src)); 672 bzero(&dst, sizeof(dst)); 673 switch (af) { 674 #ifdef INET 675 case AF_INET: 676 src.sin.sin_len = sizeof(struct sockaddr_in); 677 src.sin.sin_family = AF_INET; 678 src.sin.sin_addr = ip->ip_src; 679 src.sin.sin_port = th->th_sport; 680 681 dst.sin.sin_len = sizeof(struct sockaddr_in); 682 dst.sin.sin_family = AF_INET; 683 dst.sin.sin_addr = ip->ip_dst; 684 dst.sin.sin_port = th->th_dport; 685 break; 686 #endif 687 #ifdef INET6 688 case AF_INET6: 689 src.sin6.sin6_len = sizeof(struct sockaddr_in6); 690 src.sin6.sin6_family = AF_INET6; 691 src.sin6.sin6_addr = ip6->ip6_src; 692 src.sin6.sin6_port = th->th_sport; 693 694 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 695 dst.sin6.sin6_family = AF_INET6; 696 dst.sin6.sin6_addr = ip6->ip6_dst; 697 dst.sin6.sin6_port = th->th_dport; 698 break; 699 #endif /* INET6 */ 700 default: 701 goto badsyn; /*sanity*/ 702 } 703 704 if (so->so_options & SO_DEBUG) { 705 ostate = tp->t_state; 706 switch (af) { 707 #ifdef INET6 708 case AF_INET6: 709 bcopy(ip6, &tcp_saveti6.ti6_i, sizeof(*ip6)); 710 bcopy(th, &tcp_saveti6.ti6_t, sizeof(*th)); 711 break; 712 #endif 713 case AF_INET: 714 bcopy(ip, &tcp_saveti.ti_i, sizeof(*ip)); 715 bcopy(th, &tcp_saveti.ti_t, sizeof(*th)); 716 break; 717 } 718 } 719 if (so->so_options & SO_ACCEPTCONN) { 720 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 721 if (tiflags & TH_RST) { 722 syn_cache_reset(&src.sa, &dst.sa, th, 723 inp->inp_rdomain); 724 } else if ((tiflags & (TH_ACK|TH_SYN)) == 725 (TH_ACK|TH_SYN)) { 726 /* 727 * Received a SYN,ACK. This should 728 * never happen while we are in 729 * LISTEN. Send an RST. 730 */ 731 goto badsyn; 732 } else if (tiflags & TH_ACK) { 733 so = syn_cache_get(&src.sa, &dst.sa, 734 th, iphlen, tlen, so, m); 735 if (so == NULL) { 736 /* 737 * We don't have a SYN for 738 * this ACK; send an RST. 739 */ 740 goto badsyn; 741 } else if (so == 742 (struct socket *)(-1)) { 743 /* 744 * We were unable to create 745 * the connection. If the 746 * 3-way handshake was 747 * completed, and RST has 748 * been sent to the peer. 749 * Since the mbuf might be 750 * in use for the reply, 751 * do not free it. 752 */ 753 m = NULL; 754 } else { 755 /* 756 * We have created a 757 * full-blown connection. 758 */ 759 tp = NULL; 760 inp = (struct inpcb *)so->so_pcb; 761 tp = intotcpcb(inp); 762 if (tp == NULL) 763 goto badsyn; /*XXX*/ 764 765 /* 766 * Compute proper scaling 767 * value from buffer space 768 */ 769 tcp_rscale(tp, so->so_rcv.sb_hiwat); 770 goto after_listen; 771 } 772 } else { 773 /* 774 * None of RST, SYN or ACK was set. 775 * This is an invalid packet for a 776 * TCB in LISTEN state. Send a RST. 777 */ 778 goto badsyn; 779 } 780 } else { 781 /* 782 * Received a SYN. 783 */ 784 #ifdef INET6 785 /* 786 * If deprecated address is forbidden, we do 787 * not accept SYN to deprecated interface 788 * address to prevent any new inbound 789 * connection from getting established. 790 * When we do not accept SYN, we send a TCP 791 * RST, with deprecated source address (instead 792 * of dropping it). We compromise it as it is 793 * much better for peer to send a RST, and 794 * RST will be the final packet for the 795 * exchange. 796 * 797 * If we do not forbid deprecated addresses, we 798 * accept the SYN packet. RFC2462 does not 799 * suggest dropping SYN in this case. 800 * If we decipher RFC2462 5.5.4, it says like 801 * this: 802 * 1. use of deprecated addr with existing 803 * communication is okay - "SHOULD continue 804 * to be used" 805 * 2. use of it with new communication: 806 * (2a) "SHOULD NOT be used if alternate 807 * address with sufficient scope is 808 * available" 809 * (2b) nothing mentioned otherwise. 810 * Here we fall into (2b) case as we have no 811 * choice in our source address selection - we 812 * must obey the peer. 813 * 814 * The wording in RFC2462 is confusing, and 815 * there are multiple description text for 816 * deprecated address handling - worse, they 817 * are not exactly the same. I believe 5.5.4 818 * is the best one, so we follow 5.5.4. 819 */ 820 if (ip6 && !ip6_use_deprecated) { 821 struct in6_ifaddr *ia6; 822 823 if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, 824 &ip6->ip6_dst)) && 825 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) { 826 tp = NULL; 827 goto dropwithreset; 828 } 829 } 830 #endif 831 832 /* 833 * LISTEN socket received a SYN 834 * from itself? This can't possibly 835 * be valid; drop the packet. 836 */ 837 if (th->th_dport == th->th_sport) { 838 switch (af) { 839 #ifdef INET6 840 case AF_INET6: 841 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, 842 &ip6->ip6_dst)) { 843 tcpstat.tcps_badsyn++; 844 goto drop; 845 } 846 break; 847 #endif /* INET6 */ 848 case AF_INET: 849 if (ip->ip_dst.s_addr == ip->ip_src.s_addr) { 850 tcpstat.tcps_badsyn++; 851 goto drop; 852 } 853 break; 854 } 855 } 856 857 /* 858 * SYN looks ok; create compressed TCP 859 * state for it. 860 */ 861 if (so->so_qlen <= so->so_qlimit && 862 syn_cache_add(&src.sa, &dst.sa, th, iphlen, 863 so, m, optp, optlen, &opti, reuse)) 864 m = NULL; 865 } 866 goto drop; 867 } 868 } 869 870 after_listen: 871 #ifdef DIAGNOSTIC 872 /* 873 * Should not happen now that all embryonic connections 874 * are handled with compressed state. 875 */ 876 if (tp->t_state == TCPS_LISTEN) 877 panic("tcp_input: TCPS_LISTEN"); 878 #endif 879 880 #if NPF > 0 881 if (m->m_pkthdr.pf.statekey) { 882 ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->inp = inp; 883 inp->inp_pf_sk = m->m_pkthdr.pf.statekey; 884 } 885 #endif 886 887 #ifdef IPSEC 888 /* Find most recent IPsec tag */ 889 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 890 s = splnet(); 891 if (mtag != NULL) { 892 tdbi = (struct tdb_ident *)(mtag + 1); 893 tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto); 894 } else 895 tdb = NULL; 896 ipsp_spd_lookup(m, af, iphlen, &error, IPSP_DIRECTION_IN, 897 tdb, inp); 898 if (error) { 899 splx(s); 900 goto drop; 901 } 902 903 /* Latch SA */ 904 if (inp->inp_tdb_in != tdb) { 905 if (tdb) { 906 tdb_add_inp(tdb, inp, 1); 907 if (inp->inp_ipo == NULL) { 908 inp->inp_ipo = ipsec_add_policy(inp, af, 909 IPSP_DIRECTION_OUT); 910 if (inp->inp_ipo == NULL) { 911 splx(s); 912 goto drop; 913 } 914 } 915 if (inp->inp_ipo->ipo_dstid == NULL && 916 tdb->tdb_srcid != NULL) { 917 inp->inp_ipo->ipo_dstid = tdb->tdb_srcid; 918 tdb->tdb_srcid->ref_count++; 919 } 920 if (inp->inp_ipsec_remotecred == NULL && 921 tdb->tdb_remote_cred != NULL) { 922 inp->inp_ipsec_remotecred = 923 tdb->tdb_remote_cred; 924 tdb->tdb_remote_cred->ref_count++; 925 } 926 if (inp->inp_ipsec_remoteauth == NULL && 927 tdb->tdb_remote_auth != NULL) { 928 inp->inp_ipsec_remoteauth = 929 tdb->tdb_remote_auth; 930 tdb->tdb_remote_auth->ref_count++; 931 } 932 } else { /* Just reset */ 933 TAILQ_REMOVE(&inp->inp_tdb_in->tdb_inp_in, inp, 934 inp_tdb_in_next); 935 inp->inp_tdb_in = NULL; 936 } 937 } 938 splx(s); 939 #endif /* IPSEC */ 940 941 /* 942 * Segment received on connection. 943 * Reset idle time and keep-alive timer. 944 */ 945 tp->t_rcvtime = tcp_now; 946 if (TCPS_HAVEESTABLISHED(tp->t_state)) 947 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 948 949 #ifdef TCP_SACK 950 if (tp->sack_enable) 951 tcp_del_sackholes(tp, th); /* Delete stale SACK holes */ 952 #endif /* TCP_SACK */ 953 954 /* 955 * Process options. 956 */ 957 #ifdef TCP_SIGNATURE 958 if (optp || (tp->t_flags & TF_SIGNATURE)) 959 #else 960 if (optp) 961 #endif 962 if (tcp_dooptions(tp, optp, optlen, th, m, iphlen, &opti)) 963 goto drop; 964 965 if (opti.ts_present && opti.ts_ecr) { 966 int rtt_test; 967 968 /* subtract out the tcp timestamp modulator */ 969 opti.ts_ecr -= tp->ts_modulate; 970 971 /* make sure ts_ecr is sensible */ 972 rtt_test = tcp_now - opti.ts_ecr; 973 if (rtt_test < 0 || rtt_test > TCP_RTT_MAX) 974 opti.ts_ecr = 0; 975 } 976 977 #ifdef TCP_ECN 978 /* if congestion experienced, set ECE bit in subsequent packets. */ 979 if ((iptos & IPTOS_ECN_MASK) == IPTOS_ECN_CE) { 980 tp->t_flags |= TF_RCVD_CE; 981 tcpstat.tcps_ecn_rcvce++; 982 } 983 #endif 984 /* 985 * Header prediction: check for the two common cases 986 * of a uni-directional data xfer. If the packet has 987 * no control flags, is in-sequence, the window didn't 988 * change and we're not retransmitting, it's a 989 * candidate. If the length is zero and the ack moved 990 * forward, we're the sender side of the xfer. Just 991 * free the data acked & wake any higher level process 992 * that was blocked waiting for space. If the length 993 * is non-zero and the ack didn't move, we're the 994 * receiver side. If we're getting packets in-order 995 * (the reassembly queue is empty), add the data to 996 * the socket buffer and note that we need a delayed ack. 997 */ 998 if (tp->t_state == TCPS_ESTABLISHED && 999 #ifdef TCP_ECN 1000 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK)) == TH_ACK && 1001 #else 1002 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 1003 #endif 1004 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 1005 th->th_seq == tp->rcv_nxt && 1006 tiwin && tiwin == tp->snd_wnd && 1007 tp->snd_nxt == tp->snd_max) { 1008 1009 /* 1010 * If last ACK falls within this segment's sequence numbers, 1011 * record the timestamp. 1012 * Fix from Braden, see Stevens p. 870 1013 */ 1014 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 1015 tp->ts_recent_age = tcp_now; 1016 tp->ts_recent = opti.ts_val; 1017 } 1018 1019 if (tlen == 0) { 1020 if (SEQ_GT(th->th_ack, tp->snd_una) && 1021 SEQ_LEQ(th->th_ack, tp->snd_max) && 1022 tp->snd_cwnd >= tp->snd_wnd && 1023 tp->t_dupacks == 0) { 1024 /* 1025 * this is a pure ack for outstanding data. 1026 */ 1027 ++tcpstat.tcps_predack; 1028 if (opti.ts_present && opti.ts_ecr) 1029 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 1030 else if (tp->t_rtttime && 1031 SEQ_GT(th->th_ack, tp->t_rtseq)) 1032 tcp_xmit_timer(tp, 1033 tcp_now - tp->t_rtttime); 1034 acked = th->th_ack - tp->snd_una; 1035 tcpstat.tcps_rcvackpack++; 1036 tcpstat.tcps_rcvackbyte += acked; 1037 ND6_HINT(tp); 1038 sbdrop(&so->so_snd, acked); 1039 1040 /* 1041 * If we had a pending ICMP message that 1042 * referres to data that have just been 1043 * acknowledged, disregard the recorded ICMP 1044 * message. 1045 */ 1046 if ((tp->t_flags & TF_PMTUD_PEND) && 1047 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 1048 tp->t_flags &= ~TF_PMTUD_PEND; 1049 1050 /* 1051 * Keep track of the largest chunk of data 1052 * acknowledged since last PMTU update 1053 */ 1054 if (tp->t_pmtud_mss_acked < acked) 1055 tp->t_pmtud_mss_acked = acked; 1056 1057 tp->snd_una = th->th_ack; 1058 #if defined(TCP_SACK) || defined(TCP_ECN) 1059 /* 1060 * We want snd_last to track snd_una so 1061 * as to avoid sequence wraparound problems 1062 * for very large transfers. 1063 */ 1064 #ifdef TCP_ECN 1065 if (SEQ_GT(tp->snd_una, tp->snd_last)) 1066 #endif 1067 tp->snd_last = tp->snd_una; 1068 #endif /* TCP_SACK */ 1069 #if defined(TCP_SACK) && defined(TCP_FACK) 1070 tp->snd_fack = tp->snd_una; 1071 tp->retran_data = 0; 1072 #endif /* TCP_FACK */ 1073 m_freem(m); 1074 1075 /* 1076 * If all outstanding data are acked, stop 1077 * retransmit timer, otherwise restart timer 1078 * using current (possibly backed-off) value. 1079 * If process is waiting for space, 1080 * wakeup/selwakeup/signal. If data 1081 * are ready to send, let tcp_output 1082 * decide between more output or persist. 1083 */ 1084 if (tp->snd_una == tp->snd_max) 1085 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1086 else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1087 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1088 1089 if (sb_notify(&so->so_snd)) 1090 sowwakeup(so); 1091 if (so->so_snd.sb_cc) 1092 (void) tcp_output(tp); 1093 return; 1094 } 1095 } else if (th->th_ack == tp->snd_una && 1096 TAILQ_EMPTY(&tp->t_segq) && 1097 tlen <= sbspace(&so->so_rcv)) { 1098 /* 1099 * This is a pure, in-sequence data packet 1100 * with nothing on the reassembly queue and 1101 * we have enough buffer space to take it. 1102 */ 1103 #ifdef TCP_SACK 1104 /* Clean receiver SACK report if present */ 1105 if (tp->sack_enable && tp->rcv_numsacks) 1106 tcp_clean_sackreport(tp); 1107 #endif /* TCP_SACK */ 1108 ++tcpstat.tcps_preddat; 1109 tp->rcv_nxt += tlen; 1110 tcpstat.tcps_rcvpack++; 1111 tcpstat.tcps_rcvbyte += tlen; 1112 ND6_HINT(tp); 1113 /* 1114 * Drop TCP, IP headers and TCP options then add data 1115 * to socket buffer. 1116 */ 1117 if (so->so_state & SS_CANTRCVMORE) 1118 m_freem(m); 1119 else { 1120 m_adj(m, iphlen + off); 1121 sbappendstream(&so->so_rcv, m); 1122 } 1123 sorwakeup(so); 1124 TCP_SETUP_ACK(tp, tiflags); 1125 if (tp->t_flags & TF_ACKNOW) 1126 (void) tcp_output(tp); 1127 return; 1128 } 1129 } 1130 1131 /* 1132 * Compute mbuf offset to TCP data segment. 1133 */ 1134 hdroptlen = iphlen + off; 1135 1136 /* 1137 * Calculate amount of space in receive window, 1138 * and then do TCP input processing. 1139 * Receive window is amount of space in rcv queue, 1140 * but not less than advertised window. 1141 */ 1142 { int win; 1143 1144 win = sbspace(&so->so_rcv); 1145 if (win < 0) 1146 win = 0; 1147 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1148 } 1149 1150 switch (tp->t_state) { 1151 1152 /* 1153 * If the state is SYN_RECEIVED: 1154 * if seg contains SYN/ACK, send an RST. 1155 * if seg contains an ACK, but not for our SYN/ACK, send an RST 1156 */ 1157 1158 case TCPS_SYN_RECEIVED: 1159 if (tiflags & TH_ACK) { 1160 if (tiflags & TH_SYN) { 1161 tcpstat.tcps_badsyn++; 1162 goto dropwithreset; 1163 } 1164 if (SEQ_LEQ(th->th_ack, tp->snd_una) || 1165 SEQ_GT(th->th_ack, tp->snd_max)) 1166 goto dropwithreset; 1167 } 1168 break; 1169 1170 /* 1171 * If the state is SYN_SENT: 1172 * if seg contains an ACK, but not for our SYN, drop the input. 1173 * if seg contains a RST, then drop the connection. 1174 * if seg does not contain SYN, then drop it. 1175 * Otherwise this is an acceptable SYN segment 1176 * initialize tp->rcv_nxt and tp->irs 1177 * if seg contains ack then advance tp->snd_una 1178 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1179 * arrange for segment to be acked (eventually) 1180 * continue processing rest of data/controls, beginning with URG 1181 */ 1182 case TCPS_SYN_SENT: 1183 if ((tiflags & TH_ACK) && 1184 (SEQ_LEQ(th->th_ack, tp->iss) || 1185 SEQ_GT(th->th_ack, tp->snd_max))) 1186 goto dropwithreset; 1187 if (tiflags & TH_RST) { 1188 #ifdef TCP_ECN 1189 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1190 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1191 goto drop; 1192 #endif 1193 if (tiflags & TH_ACK) 1194 tp = tcp_drop(tp, ECONNREFUSED); 1195 goto drop; 1196 } 1197 if ((tiflags & TH_SYN) == 0) 1198 goto drop; 1199 if (tiflags & TH_ACK) { 1200 tp->snd_una = th->th_ack; 1201 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1202 tp->snd_nxt = tp->snd_una; 1203 } 1204 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1205 tp->irs = th->th_seq; 1206 tcp_mss(tp, opti.maxseg); 1207 /* Reset initial window to 1 segment for retransmit */ 1208 if (tp->t_rxtshift > 0) 1209 tp->snd_cwnd = tp->t_maxseg; 1210 tcp_rcvseqinit(tp); 1211 tp->t_flags |= TF_ACKNOW; 1212 #ifdef TCP_SACK 1213 /* 1214 * If we've sent a SACK_PERMITTED option, and the peer 1215 * also replied with one, then TF_SACK_PERMIT should have 1216 * been set in tcp_dooptions(). If it was not, disable SACKs. 1217 */ 1218 if (tp->sack_enable) 1219 tp->sack_enable = tp->t_flags & TF_SACK_PERMIT; 1220 #endif 1221 #ifdef TCP_ECN 1222 /* 1223 * if ECE is set but CWR is not set for SYN-ACK, or 1224 * both ECE and CWR are set for simultaneous open, 1225 * peer is ECN capable. 1226 */ 1227 if (tcp_do_ecn) { 1228 if ((tiflags & (TH_ACK|TH_ECE|TH_CWR)) 1229 == (TH_ACK|TH_ECE) || 1230 (tiflags & (TH_ACK|TH_ECE|TH_CWR)) 1231 == (TH_ECE|TH_CWR)) { 1232 tp->t_flags |= TF_ECN_PERMIT; 1233 tiflags &= ~(TH_ECE|TH_CWR); 1234 tcpstat.tcps_ecn_accepts++; 1235 } 1236 } 1237 #endif 1238 1239 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 1240 tcpstat.tcps_connects++; 1241 soisconnected(so); 1242 tp->t_state = TCPS_ESTABLISHED; 1243 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1244 /* Do window scaling on this connection? */ 1245 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1246 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1247 tp->snd_scale = tp->requested_s_scale; 1248 tp->rcv_scale = tp->request_r_scale; 1249 } 1250 (void) tcp_reass(tp, (struct tcphdr *)0, 1251 (struct mbuf *)0, &tlen); 1252 /* 1253 * if we didn't have to retransmit the SYN, 1254 * use its rtt as our initial srtt & rtt var. 1255 */ 1256 if (tp->t_rtttime) 1257 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1258 /* 1259 * Since new data was acked (the SYN), open the 1260 * congestion window by one MSS. We do this 1261 * here, because we won't go through the normal 1262 * ACK processing below. And since this is the 1263 * start of the connection, we know we are in 1264 * the exponential phase of slow-start. 1265 */ 1266 tp->snd_cwnd += tp->t_maxseg; 1267 } else 1268 tp->t_state = TCPS_SYN_RECEIVED; 1269 1270 #if 0 1271 trimthenstep6: 1272 #endif 1273 /* 1274 * Advance th->th_seq to correspond to first data byte. 1275 * If data, trim to stay within window, 1276 * dropping FIN if necessary. 1277 */ 1278 th->th_seq++; 1279 if (tlen > tp->rcv_wnd) { 1280 todrop = tlen - tp->rcv_wnd; 1281 m_adj(m, -todrop); 1282 tlen = tp->rcv_wnd; 1283 tiflags &= ~TH_FIN; 1284 tcpstat.tcps_rcvpackafterwin++; 1285 tcpstat.tcps_rcvbyteafterwin += todrop; 1286 } 1287 tp->snd_wl1 = th->th_seq - 1; 1288 tp->rcv_up = th->th_seq; 1289 goto step6; 1290 /* 1291 * If a new connection request is received while in TIME_WAIT, 1292 * drop the old connection and start over if the if the 1293 * timestamp or the sequence numbers are above the previous 1294 * ones. 1295 */ 1296 case TCPS_TIME_WAIT: 1297 if (((tiflags & (TH_SYN|TH_ACK)) == TH_SYN) && 1298 ((opti.ts_present && 1299 TSTMP_LT(tp->ts_recent, opti.ts_val)) || 1300 SEQ_GT(th->th_seq, tp->rcv_nxt))) { 1301 /* 1302 * Advance the iss by at least 32768, but 1303 * clear the msb in order to make sure 1304 * that SEG_LT(snd_nxt, iss). 1305 */ 1306 iss = tp->snd_nxt + 1307 ((arc4random() & 0x7fffffff) | 0x8000); 1308 reuse = &iss; 1309 tp = tcp_close(tp); 1310 inp = NULL; 1311 goto findpcb; 1312 } 1313 } 1314 1315 /* 1316 * States other than LISTEN or SYN_SENT. 1317 * First check timestamp, if present. 1318 * Then check that at least some bytes of segment are within 1319 * receive window. If segment begins before rcv_nxt, 1320 * drop leading data (and SYN); if nothing left, just ack. 1321 * 1322 * RFC 1323 PAWS: If we have a timestamp reply on this segment 1323 * and it's less than opti.ts_recent, drop it. 1324 */ 1325 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 1326 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 1327 1328 /* Check to see if ts_recent is over 24 days old. */ 1329 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1330 /* 1331 * Invalidate ts_recent. If this segment updates 1332 * ts_recent, the age will be reset later and ts_recent 1333 * will get a valid value. If it does not, setting 1334 * ts_recent to zero will at least satisfy the 1335 * requirement that zero be placed in the timestamp 1336 * echo reply when ts_recent isn't valid. The 1337 * age isn't reset until we get a valid ts_recent 1338 * because we don't want out-of-order segments to be 1339 * dropped when ts_recent is old. 1340 */ 1341 tp->ts_recent = 0; 1342 } else { 1343 tcpstat.tcps_rcvduppack++; 1344 tcpstat.tcps_rcvdupbyte += tlen; 1345 tcpstat.tcps_pawsdrop++; 1346 goto dropafterack; 1347 } 1348 } 1349 1350 todrop = tp->rcv_nxt - th->th_seq; 1351 if (todrop > 0) { 1352 if (tiflags & TH_SYN) { 1353 tiflags &= ~TH_SYN; 1354 th->th_seq++; 1355 if (th->th_urp > 1) 1356 th->th_urp--; 1357 else 1358 tiflags &= ~TH_URG; 1359 todrop--; 1360 } 1361 if (todrop > tlen || 1362 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 1363 /* 1364 * Any valid FIN must be to the left of the 1365 * window. At this point, FIN must be a 1366 * duplicate or out-of-sequence, so drop it. 1367 */ 1368 tiflags &= ~TH_FIN; 1369 /* 1370 * Send ACK to resynchronize, and drop any data, 1371 * but keep on processing for RST or ACK. 1372 */ 1373 tp->t_flags |= TF_ACKNOW; 1374 tcpstat.tcps_rcvdupbyte += todrop = tlen; 1375 tcpstat.tcps_rcvduppack++; 1376 } else { 1377 tcpstat.tcps_rcvpartduppack++; 1378 tcpstat.tcps_rcvpartdupbyte += todrop; 1379 } 1380 hdroptlen += todrop; /* drop from head afterwards */ 1381 th->th_seq += todrop; 1382 tlen -= todrop; 1383 if (th->th_urp > todrop) 1384 th->th_urp -= todrop; 1385 else { 1386 tiflags &= ~TH_URG; 1387 th->th_urp = 0; 1388 } 1389 } 1390 1391 /* 1392 * If new data are received on a connection after the 1393 * user processes are gone, then RST the other end. 1394 */ 1395 if ((so->so_state & SS_NOFDREF) && 1396 tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1397 tp = tcp_close(tp); 1398 tcpstat.tcps_rcvafterclose++; 1399 goto dropwithreset; 1400 } 1401 1402 /* 1403 * If segment ends after window, drop trailing data 1404 * (and PUSH and FIN); if nothing left, just ACK. 1405 */ 1406 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1407 if (todrop > 0) { 1408 tcpstat.tcps_rcvpackafterwin++; 1409 if (todrop >= tlen) { 1410 tcpstat.tcps_rcvbyteafterwin += tlen; 1411 /* 1412 * If window is closed can only take segments at 1413 * window edge, and have to drop data and PUSH from 1414 * incoming segments. Continue processing, but 1415 * remember to ack. Otherwise, drop segment 1416 * and ack. 1417 */ 1418 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1419 tp->t_flags |= TF_ACKNOW; 1420 tcpstat.tcps_rcvwinprobe++; 1421 } else 1422 goto dropafterack; 1423 } else 1424 tcpstat.tcps_rcvbyteafterwin += todrop; 1425 m_adj(m, -todrop); 1426 tlen -= todrop; 1427 tiflags &= ~(TH_PUSH|TH_FIN); 1428 } 1429 1430 /* 1431 * If last ACK falls within this segment's sequence numbers, 1432 * record its timestamp if it's more recent. 1433 * Cf fix from Braden, see Stevens p. 870 1434 */ 1435 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1436 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 1437 if (SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen + 1438 ((tiflags & (TH_SYN|TH_FIN)) != 0))) 1439 tp->ts_recent = opti.ts_val; 1440 else 1441 tp->ts_recent = 0; 1442 tp->ts_recent_age = tcp_now; 1443 } 1444 1445 /* 1446 * If the RST bit is set examine the state: 1447 * SYN_RECEIVED STATE: 1448 * If passive open, return to LISTEN state. 1449 * If active open, inform user that connection was refused. 1450 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1451 * Inform user that connection was reset, and close tcb. 1452 * CLOSING, LAST_ACK, TIME_WAIT STATES 1453 * Close the tcb. 1454 */ 1455 if (tiflags & TH_RST) { 1456 if (th->th_seq != tp->last_ack_sent && 1457 th->th_seq != tp->rcv_nxt && 1458 th->th_seq != (tp->rcv_nxt + 1)) 1459 goto drop; 1460 1461 switch (tp->t_state) { 1462 case TCPS_SYN_RECEIVED: 1463 #ifdef TCP_ECN 1464 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1465 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1466 goto drop; 1467 #endif 1468 so->so_error = ECONNREFUSED; 1469 goto close; 1470 1471 case TCPS_ESTABLISHED: 1472 case TCPS_FIN_WAIT_1: 1473 case TCPS_FIN_WAIT_2: 1474 case TCPS_CLOSE_WAIT: 1475 so->so_error = ECONNRESET; 1476 close: 1477 tp->t_state = TCPS_CLOSED; 1478 tcpstat.tcps_drops++; 1479 tp = tcp_close(tp); 1480 goto drop; 1481 case TCPS_CLOSING: 1482 case TCPS_LAST_ACK: 1483 case TCPS_TIME_WAIT: 1484 tp = tcp_close(tp); 1485 goto drop; 1486 } 1487 } 1488 1489 /* 1490 * If a SYN is in the window, then this is an 1491 * error and we ACK and drop the packet. 1492 */ 1493 if (tiflags & TH_SYN) 1494 goto dropafterack_ratelim; 1495 1496 /* 1497 * If the ACK bit is off we drop the segment and return. 1498 */ 1499 if ((tiflags & TH_ACK) == 0) { 1500 if (tp->t_flags & TF_ACKNOW) 1501 goto dropafterack; 1502 else 1503 goto drop; 1504 } 1505 1506 /* 1507 * Ack processing. 1508 */ 1509 switch (tp->t_state) { 1510 1511 /* 1512 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter 1513 * ESTABLISHED state and continue processing. 1514 * The ACK was checked above. 1515 */ 1516 case TCPS_SYN_RECEIVED: 1517 tcpstat.tcps_connects++; 1518 soisconnected(so); 1519 tp->t_state = TCPS_ESTABLISHED; 1520 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1521 /* Do window scaling? */ 1522 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1523 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1524 tp->snd_scale = tp->requested_s_scale; 1525 tp->rcv_scale = tp->request_r_scale; 1526 tiwin = th->th_win << tp->snd_scale; 1527 } 1528 (void) tcp_reass(tp, (struct tcphdr *)0, (struct mbuf *)0, 1529 &tlen); 1530 tp->snd_wl1 = th->th_seq - 1; 1531 /* fall into ... */ 1532 1533 /* 1534 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1535 * ACKs. If the ack is in the range 1536 * tp->snd_una < th->th_ack <= tp->snd_max 1537 * then advance tp->snd_una to th->th_ack and drop 1538 * data from the retransmission queue. If this ACK reflects 1539 * more up to date window information we update our window information. 1540 */ 1541 case TCPS_ESTABLISHED: 1542 case TCPS_FIN_WAIT_1: 1543 case TCPS_FIN_WAIT_2: 1544 case TCPS_CLOSE_WAIT: 1545 case TCPS_CLOSING: 1546 case TCPS_LAST_ACK: 1547 case TCPS_TIME_WAIT: 1548 #ifdef TCP_ECN 1549 /* 1550 * if we receive ECE and are not already in recovery phase, 1551 * reduce cwnd by half but don't slow-start. 1552 * advance snd_last to snd_max not to reduce cwnd again 1553 * until all outstanding packets are acked. 1554 */ 1555 if (tcp_do_ecn && (tiflags & TH_ECE)) { 1556 if ((tp->t_flags & TF_ECN_PERMIT) && 1557 SEQ_GEQ(tp->snd_una, tp->snd_last)) { 1558 u_int win; 1559 1560 win = min(tp->snd_wnd, tp->snd_cwnd) / tp->t_maxseg; 1561 if (win > 1) { 1562 tp->snd_ssthresh = win / 2 * tp->t_maxseg; 1563 tp->snd_cwnd = tp->snd_ssthresh; 1564 tp->snd_last = tp->snd_max; 1565 tp->t_flags |= TF_SEND_CWR; 1566 tcpstat.tcps_cwr_ecn++; 1567 } 1568 } 1569 tcpstat.tcps_ecn_rcvece++; 1570 } 1571 /* 1572 * if we receive CWR, we know that the peer has reduced 1573 * its congestion window. stop sending ecn-echo. 1574 */ 1575 if ((tiflags & TH_CWR)) { 1576 tp->t_flags &= ~TF_RCVD_CE; 1577 tcpstat.tcps_ecn_rcvcwr++; 1578 } 1579 #endif /* TCP_ECN */ 1580 1581 if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1582 /* 1583 * Duplicate/old ACK processing. 1584 * Increments t_dupacks: 1585 * Pure duplicate (same seq/ack/window, no data) 1586 * Doesn't affect t_dupacks: 1587 * Data packets. 1588 * Normal window updates (window opens) 1589 * Resets t_dupacks: 1590 * New data ACKed. 1591 * Window shrinks 1592 * Old ACK 1593 */ 1594 if (tlen) { 1595 /* Drop very old ACKs unless th_seq matches */ 1596 if (th->th_seq != tp->rcv_nxt && 1597 SEQ_LT(th->th_ack, 1598 tp->snd_una - tp->max_sndwnd)) { 1599 tcpstat.tcps_rcvacktooold++; 1600 goto drop; 1601 } 1602 break; 1603 } 1604 /* 1605 * If we get an old ACK, there is probably packet 1606 * reordering going on. Be conservative and reset 1607 * t_dupacks so that we are less aggressive in 1608 * doing a fast retransmit. 1609 */ 1610 if (th->th_ack != tp->snd_una) { 1611 tp->t_dupacks = 0; 1612 break; 1613 } 1614 if (tiwin == tp->snd_wnd) { 1615 tcpstat.tcps_rcvdupack++; 1616 /* 1617 * If we have outstanding data (other than 1618 * a window probe), this is a completely 1619 * duplicate ack (ie, window info didn't 1620 * change), the ack is the biggest we've 1621 * seen and we've seen exactly our rexmt 1622 * threshold of them, assume a packet 1623 * has been dropped and retransmit it. 1624 * Kludge snd_nxt & the congestion 1625 * window so we send only this one 1626 * packet. 1627 * 1628 * We know we're losing at the current 1629 * window size so do congestion avoidance 1630 * (set ssthresh to half the current window 1631 * and pull our congestion window back to 1632 * the new ssthresh). 1633 * 1634 * Dup acks mean that packets have left the 1635 * network (they're now cached at the receiver) 1636 * so bump cwnd by the amount in the receiver 1637 * to keep a constant cwnd packets in the 1638 * network. 1639 */ 1640 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0) 1641 tp->t_dupacks = 0; 1642 #if defined(TCP_SACK) && defined(TCP_FACK) 1643 /* 1644 * In FACK, can enter fast rec. if the receiver 1645 * reports a reass. queue longer than 3 segs. 1646 */ 1647 else if (++tp->t_dupacks == tcprexmtthresh || 1648 ((SEQ_GT(tp->snd_fack, tcprexmtthresh * 1649 tp->t_maxseg + tp->snd_una)) && 1650 SEQ_GT(tp->snd_una, tp->snd_last))) { 1651 #else 1652 else if (++tp->t_dupacks == tcprexmtthresh) { 1653 #endif /* TCP_FACK */ 1654 tcp_seq onxt = tp->snd_nxt; 1655 u_long win = 1656 ulmin(tp->snd_wnd, tp->snd_cwnd) / 1657 2 / tp->t_maxseg; 1658 1659 #if defined(TCP_SACK) || defined(TCP_ECN) 1660 if (SEQ_LT(th->th_ack, tp->snd_last)){ 1661 /* 1662 * False fast retx after 1663 * timeout. Do not cut window. 1664 */ 1665 tp->t_dupacks = 0; 1666 goto drop; 1667 } 1668 #endif 1669 if (win < 2) 1670 win = 2; 1671 tp->snd_ssthresh = win * tp->t_maxseg; 1672 #ifdef TCP_SACK 1673 tp->snd_last = tp->snd_max; 1674 if (tp->sack_enable) { 1675 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1676 tp->t_rtttime = 0; 1677 #ifdef TCP_ECN 1678 tp->t_flags |= TF_SEND_CWR; 1679 #endif 1680 tcpstat.tcps_cwr_frecovery++; 1681 tcpstat.tcps_sack_recovery_episode++; 1682 #if defined(TCP_SACK) && defined(TCP_FACK) 1683 tp->t_dupacks = tcprexmtthresh; 1684 (void) tcp_output(tp); 1685 /* 1686 * During FR, snd_cwnd is held 1687 * constant for FACK. 1688 */ 1689 tp->snd_cwnd = tp->snd_ssthresh; 1690 #else 1691 /* 1692 * tcp_output() will send 1693 * oldest SACK-eligible rtx. 1694 */ 1695 (void) tcp_output(tp); 1696 tp->snd_cwnd = tp->snd_ssthresh+ 1697 tp->t_maxseg * tp->t_dupacks; 1698 #endif /* TCP_FACK */ 1699 goto drop; 1700 } 1701 #endif /* TCP_SACK */ 1702 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1703 tp->t_rtttime = 0; 1704 tp->snd_nxt = th->th_ack; 1705 tp->snd_cwnd = tp->t_maxseg; 1706 #ifdef TCP_ECN 1707 tp->t_flags |= TF_SEND_CWR; 1708 #endif 1709 tcpstat.tcps_cwr_frecovery++; 1710 tcpstat.tcps_sndrexmitfast++; 1711 (void) tcp_output(tp); 1712 1713 tp->snd_cwnd = tp->snd_ssthresh + 1714 tp->t_maxseg * tp->t_dupacks; 1715 if (SEQ_GT(onxt, tp->snd_nxt)) 1716 tp->snd_nxt = onxt; 1717 goto drop; 1718 } else if (tp->t_dupacks > tcprexmtthresh) { 1719 #if defined(TCP_SACK) && defined(TCP_FACK) 1720 /* 1721 * while (awnd < cwnd) 1722 * sendsomething(); 1723 */ 1724 if (tp->sack_enable) { 1725 if (tp->snd_awnd < tp->snd_cwnd) 1726 tcp_output(tp); 1727 goto drop; 1728 } 1729 #endif /* TCP_FACK */ 1730 tp->snd_cwnd += tp->t_maxseg; 1731 (void) tcp_output(tp); 1732 goto drop; 1733 } 1734 } else if (tiwin < tp->snd_wnd) { 1735 /* 1736 * The window was retracted! Previous dup 1737 * ACKs may have been due to packets arriving 1738 * after the shrunken window, not a missing 1739 * packet, so play it safe and reset t_dupacks 1740 */ 1741 tp->t_dupacks = 0; 1742 } 1743 break; 1744 } 1745 /* 1746 * If the congestion window was inflated to account 1747 * for the other side's cached packets, retract it. 1748 */ 1749 #if defined(TCP_SACK) 1750 if (tp->sack_enable) { 1751 if (tp->t_dupacks >= tcprexmtthresh) { 1752 /* Check for a partial ACK */ 1753 if (tcp_sack_partialack(tp, th)) { 1754 #if defined(TCP_SACK) && defined(TCP_FACK) 1755 /* Force call to tcp_output */ 1756 if (tp->snd_awnd < tp->snd_cwnd) 1757 needoutput = 1; 1758 #else 1759 tp->snd_cwnd += tp->t_maxseg; 1760 needoutput = 1; 1761 #endif /* TCP_FACK */ 1762 } else { 1763 /* Out of fast recovery */ 1764 tp->snd_cwnd = tp->snd_ssthresh; 1765 if (tcp_seq_subtract(tp->snd_max, 1766 th->th_ack) < tp->snd_ssthresh) 1767 tp->snd_cwnd = 1768 tcp_seq_subtract(tp->snd_max, 1769 th->th_ack); 1770 tp->t_dupacks = 0; 1771 #if defined(TCP_SACK) && defined(TCP_FACK) 1772 if (SEQ_GT(th->th_ack, tp->snd_fack)) 1773 tp->snd_fack = th->th_ack; 1774 #endif /* TCP_FACK */ 1775 } 1776 } 1777 } else { 1778 if (tp->t_dupacks >= tcprexmtthresh && 1779 !tcp_newreno(tp, th)) { 1780 /* Out of fast recovery */ 1781 tp->snd_cwnd = tp->snd_ssthresh; 1782 if (tcp_seq_subtract(tp->snd_max, th->th_ack) < 1783 tp->snd_ssthresh) 1784 tp->snd_cwnd = 1785 tcp_seq_subtract(tp->snd_max, 1786 th->th_ack); 1787 tp->t_dupacks = 0; 1788 } 1789 } 1790 if (tp->t_dupacks < tcprexmtthresh) 1791 tp->t_dupacks = 0; 1792 #else /* else no TCP_SACK */ 1793 if (tp->t_dupacks >= tcprexmtthresh && 1794 tp->snd_cwnd > tp->snd_ssthresh) 1795 tp->snd_cwnd = tp->snd_ssthresh; 1796 tp->t_dupacks = 0; 1797 #endif 1798 if (SEQ_GT(th->th_ack, tp->snd_max)) { 1799 tcpstat.tcps_rcvacktoomuch++; 1800 goto dropafterack_ratelim; 1801 } 1802 acked = th->th_ack - tp->snd_una; 1803 tcpstat.tcps_rcvackpack++; 1804 tcpstat.tcps_rcvackbyte += acked; 1805 1806 /* 1807 * If we have a timestamp reply, update smoothed 1808 * round trip time. If no timestamp is present but 1809 * transmit timer is running and timed sequence 1810 * number was acked, update smoothed round trip time. 1811 * Since we now have an rtt measurement, cancel the 1812 * timer backoff (cf., Phil Karn's retransmit alg.). 1813 * Recompute the initial retransmit timer. 1814 */ 1815 if (opti.ts_present && opti.ts_ecr) 1816 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 1817 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) 1818 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1819 1820 /* 1821 * If all outstanding data is acked, stop retransmit 1822 * timer and remember to restart (more output or persist). 1823 * If there is more data to be acked, restart retransmit 1824 * timer, using current (possibly backed-off) value. 1825 */ 1826 if (th->th_ack == tp->snd_max) { 1827 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1828 needoutput = 1; 1829 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1830 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1831 /* 1832 * When new data is acked, open the congestion window. 1833 * If the window gives us less than ssthresh packets 1834 * in flight, open exponentially (maxseg per packet). 1835 * Otherwise open linearly: maxseg per window 1836 * (maxseg^2 / cwnd per packet). 1837 */ 1838 { 1839 u_int cw = tp->snd_cwnd; 1840 u_int incr = tp->t_maxseg; 1841 1842 if (cw > tp->snd_ssthresh) 1843 incr = incr * incr / cw; 1844 #if defined (TCP_SACK) 1845 if (tp->t_dupacks < tcprexmtthresh) 1846 #endif 1847 tp->snd_cwnd = ulmin(cw + incr, TCP_MAXWIN<<tp->snd_scale); 1848 } 1849 ND6_HINT(tp); 1850 if (acked > so->so_snd.sb_cc) { 1851 tp->snd_wnd -= so->so_snd.sb_cc; 1852 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1853 ourfinisacked = 1; 1854 } else { 1855 sbdrop(&so->so_snd, acked); 1856 tp->snd_wnd -= acked; 1857 ourfinisacked = 0; 1858 } 1859 if (sb_notify(&so->so_snd)) 1860 sowwakeup(so); 1861 1862 /* 1863 * If we had a pending ICMP message that referred to data 1864 * that have just been acknowledged, disregard the recorded 1865 * ICMP message. 1866 */ 1867 if ((tp->t_flags & TF_PMTUD_PEND) && 1868 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 1869 tp->t_flags &= ~TF_PMTUD_PEND; 1870 1871 /* 1872 * Keep track of the largest chunk of data acknowledged 1873 * since last PMTU update 1874 */ 1875 if (tp->t_pmtud_mss_acked < acked) 1876 tp->t_pmtud_mss_acked = acked; 1877 1878 tp->snd_una = th->th_ack; 1879 #ifdef TCP_ECN 1880 /* sync snd_last with snd_una */ 1881 if (SEQ_GT(tp->snd_una, tp->snd_last)) 1882 tp->snd_last = tp->snd_una; 1883 #endif 1884 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1885 tp->snd_nxt = tp->snd_una; 1886 #if defined (TCP_SACK) && defined (TCP_FACK) 1887 if (SEQ_GT(tp->snd_una, tp->snd_fack)) { 1888 tp->snd_fack = tp->snd_una; 1889 /* Update snd_awnd for partial ACK 1890 * without any SACK blocks. 1891 */ 1892 tp->snd_awnd = tcp_seq_subtract(tp->snd_nxt, 1893 tp->snd_fack) + tp->retran_data; 1894 } 1895 #endif 1896 1897 switch (tp->t_state) { 1898 1899 /* 1900 * In FIN_WAIT_1 STATE in addition to the processing 1901 * for the ESTABLISHED state if our FIN is now acknowledged 1902 * then enter FIN_WAIT_2. 1903 */ 1904 case TCPS_FIN_WAIT_1: 1905 if (ourfinisacked) { 1906 /* 1907 * If we can't receive any more 1908 * data, then closing user can proceed. 1909 * Starting the timer is contrary to the 1910 * specification, but if we don't get a FIN 1911 * we'll hang forever. 1912 */ 1913 if (so->so_state & SS_CANTRCVMORE) { 1914 soisdisconnected(so); 1915 TCP_TIMER_ARM(tp, TCPT_2MSL, tcp_maxidle); 1916 } 1917 tp->t_state = TCPS_FIN_WAIT_2; 1918 } 1919 break; 1920 1921 /* 1922 * In CLOSING STATE in addition to the processing for 1923 * the ESTABLISHED state if the ACK acknowledges our FIN 1924 * then enter the TIME-WAIT state, otherwise ignore 1925 * the segment. 1926 */ 1927 case TCPS_CLOSING: 1928 if (ourfinisacked) { 1929 tp->t_state = TCPS_TIME_WAIT; 1930 tcp_canceltimers(tp); 1931 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1932 soisdisconnected(so); 1933 } 1934 break; 1935 1936 /* 1937 * In LAST_ACK, we may still be waiting for data to drain 1938 * and/or to be acked, as well as for the ack of our FIN. 1939 * If our FIN is now acknowledged, delete the TCB, 1940 * enter the closed state and return. 1941 */ 1942 case TCPS_LAST_ACK: 1943 if (ourfinisacked) { 1944 tp = tcp_close(tp); 1945 goto drop; 1946 } 1947 break; 1948 1949 /* 1950 * In TIME_WAIT state the only thing that should arrive 1951 * is a retransmission of the remote FIN. Acknowledge 1952 * it and restart the finack timer. 1953 */ 1954 case TCPS_TIME_WAIT: 1955 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1956 goto dropafterack; 1957 } 1958 } 1959 1960 step6: 1961 /* 1962 * Update window information. 1963 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1964 */ 1965 if ((tiflags & TH_ACK) && 1966 (SEQ_LT(tp->snd_wl1, th->th_seq) || (tp->snd_wl1 == th->th_seq && 1967 (SEQ_LT(tp->snd_wl2, th->th_ack) || 1968 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 1969 /* keep track of pure window updates */ 1970 if (tlen == 0 && 1971 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 1972 tcpstat.tcps_rcvwinupd++; 1973 tp->snd_wnd = tiwin; 1974 tp->snd_wl1 = th->th_seq; 1975 tp->snd_wl2 = th->th_ack; 1976 if (tp->snd_wnd > tp->max_sndwnd) 1977 tp->max_sndwnd = tp->snd_wnd; 1978 needoutput = 1; 1979 } 1980 1981 /* 1982 * Process segments with URG. 1983 */ 1984 if ((tiflags & TH_URG) && th->th_urp && 1985 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1986 /* 1987 * This is a kludge, but if we receive and accept 1988 * random urgent pointers, we'll crash in 1989 * soreceive. It's hard to imagine someone 1990 * actually wanting to send this much urgent data. 1991 */ 1992 if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 1993 th->th_urp = 0; /* XXX */ 1994 tiflags &= ~TH_URG; /* XXX */ 1995 goto dodata; /* XXX */ 1996 } 1997 /* 1998 * If this segment advances the known urgent pointer, 1999 * then mark the data stream. This should not happen 2000 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 2001 * a FIN has been received from the remote side. 2002 * In these states we ignore the URG. 2003 * 2004 * According to RFC961 (Assigned Protocols), 2005 * the urgent pointer points to the last octet 2006 * of urgent data. We continue, however, 2007 * to consider it to indicate the first octet 2008 * of data past the urgent section as the original 2009 * spec states (in one of two places). 2010 */ 2011 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 2012 tp->rcv_up = th->th_seq + th->th_urp; 2013 so->so_oobmark = so->so_rcv.sb_cc + 2014 (tp->rcv_up - tp->rcv_nxt) - 1; 2015 if (so->so_oobmark == 0) 2016 so->so_state |= SS_RCVATMARK; 2017 sohasoutofband(so); 2018 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 2019 } 2020 /* 2021 * Remove out of band data so doesn't get presented to user. 2022 * This can happen independent of advancing the URG pointer, 2023 * but if two URG's are pending at once, some out-of-band 2024 * data may creep in... ick. 2025 */ 2026 if (th->th_urp <= (u_int16_t) tlen 2027 #ifdef SO_OOBINLINE 2028 && (so->so_options & SO_OOBINLINE) == 0 2029 #endif 2030 ) 2031 tcp_pulloutofband(so, th->th_urp, m, hdroptlen); 2032 } else 2033 /* 2034 * If no out of band data is expected, 2035 * pull receive urgent pointer along 2036 * with the receive window. 2037 */ 2038 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 2039 tp->rcv_up = tp->rcv_nxt; 2040 dodata: /* XXX */ 2041 2042 /* 2043 * Process the segment text, merging it into the TCP sequencing queue, 2044 * and arranging for acknowledgment of receipt if necessary. 2045 * This process logically involves adjusting tp->rcv_wnd as data 2046 * is presented to the user (this happens in tcp_usrreq.c, 2047 * case PRU_RCVD). If a FIN has already been received on this 2048 * connection then we just ignore the text. 2049 */ 2050 if ((tlen || (tiflags & TH_FIN)) && 2051 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2052 #ifdef TCP_SACK 2053 tcp_seq laststart = th->th_seq; 2054 tcp_seq lastend = th->th_seq + tlen; 2055 #endif 2056 if (th->th_seq == tp->rcv_nxt && TAILQ_EMPTY(&tp->t_segq) && 2057 tp->t_state == TCPS_ESTABLISHED) { 2058 TCP_SETUP_ACK(tp, tiflags); 2059 tp->rcv_nxt += tlen; 2060 tiflags = th->th_flags & TH_FIN; 2061 tcpstat.tcps_rcvpack++; 2062 tcpstat.tcps_rcvbyte += tlen; 2063 ND6_HINT(tp); 2064 if (so->so_state & SS_CANTRCVMORE) 2065 m_freem(m); 2066 else { 2067 m_adj(m, hdroptlen); 2068 sbappendstream(&so->so_rcv, m); 2069 } 2070 sorwakeup(so); 2071 } else { 2072 m_adj(m, hdroptlen); 2073 tiflags = tcp_reass(tp, th, m, &tlen); 2074 tp->t_flags |= TF_ACKNOW; 2075 } 2076 #ifdef TCP_SACK 2077 if (tp->sack_enable) 2078 tcp_update_sack_list(tp, laststart, lastend); 2079 #endif 2080 2081 /* 2082 * variable len never referenced again in modern BSD, 2083 * so why bother computing it ?? 2084 */ 2085 #if 0 2086 /* 2087 * Note the amount of data that peer has sent into 2088 * our window, in order to estimate the sender's 2089 * buffer size. 2090 */ 2091 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 2092 #endif /* 0 */ 2093 } else { 2094 m_freem(m); 2095 tiflags &= ~TH_FIN; 2096 } 2097 2098 /* 2099 * If FIN is received ACK the FIN and let the user know 2100 * that the connection is closing. Ignore a FIN received before 2101 * the connection is fully established. 2102 */ 2103 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 2104 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2105 socantrcvmore(so); 2106 tp->t_flags |= TF_ACKNOW; 2107 tp->rcv_nxt++; 2108 } 2109 switch (tp->t_state) { 2110 2111 /* 2112 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 2113 */ 2114 case TCPS_ESTABLISHED: 2115 tp->t_state = TCPS_CLOSE_WAIT; 2116 break; 2117 2118 /* 2119 * If still in FIN_WAIT_1 STATE FIN has not been acked so 2120 * enter the CLOSING state. 2121 */ 2122 case TCPS_FIN_WAIT_1: 2123 tp->t_state = TCPS_CLOSING; 2124 break; 2125 2126 /* 2127 * In FIN_WAIT_2 state enter the TIME_WAIT state, 2128 * starting the time-wait timer, turning off the other 2129 * standard timers. 2130 */ 2131 case TCPS_FIN_WAIT_2: 2132 tp->t_state = TCPS_TIME_WAIT; 2133 tcp_canceltimers(tp); 2134 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2135 soisdisconnected(so); 2136 break; 2137 2138 /* 2139 * In TIME_WAIT state restart the 2 MSL time_wait timer. 2140 */ 2141 case TCPS_TIME_WAIT: 2142 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2143 break; 2144 } 2145 } 2146 if (so->so_options & SO_DEBUG) { 2147 switch (tp->pf) { 2148 #ifdef INET6 2149 case PF_INET6: 2150 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti6, 2151 0, tlen); 2152 break; 2153 #endif /* INET6 */ 2154 case PF_INET: 2155 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti, 2156 0, tlen); 2157 break; 2158 } 2159 } 2160 2161 /* 2162 * Return any desired output. 2163 */ 2164 if (needoutput || (tp->t_flags & TF_ACKNOW)) { 2165 (void) tcp_output(tp); 2166 } 2167 return; 2168 2169 badsyn: 2170 /* 2171 * Received a bad SYN. Increment counters and dropwithreset. 2172 */ 2173 tcpstat.tcps_badsyn++; 2174 tp = NULL; 2175 goto dropwithreset; 2176 2177 dropafterack_ratelim: 2178 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count, 2179 tcp_ackdrop_ppslim) == 0) { 2180 /* XXX stat */ 2181 goto drop; 2182 } 2183 /* ...fall into dropafterack... */ 2184 2185 dropafterack: 2186 /* 2187 * Generate an ACK dropping incoming segment if it occupies 2188 * sequence space, where the ACK reflects our state. 2189 */ 2190 if (tiflags & TH_RST) 2191 goto drop; 2192 m_freem(m); 2193 tp->t_flags |= TF_ACKNOW; 2194 (void) tcp_output(tp); 2195 return; 2196 2197 dropwithreset_ratelim: 2198 /* 2199 * We may want to rate-limit RSTs in certain situations, 2200 * particularly if we are sending an RST in response to 2201 * an attempt to connect to or otherwise communicate with 2202 * a port for which we have no socket. 2203 */ 2204 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count, 2205 tcp_rst_ppslim) == 0) { 2206 /* XXX stat */ 2207 goto drop; 2208 } 2209 /* ...fall into dropwithreset... */ 2210 2211 dropwithreset: 2212 /* 2213 * Generate a RST, dropping incoming segment. 2214 * Make ACK acceptable to originator of segment. 2215 * Don't bother to respond to RST. 2216 */ 2217 if (tiflags & TH_RST) 2218 goto drop; 2219 if (tiflags & TH_ACK) { 2220 tcp_respond(tp, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, 2221 TH_RST); 2222 } else { 2223 if (tiflags & TH_SYN) 2224 tlen++; 2225 tcp_respond(tp, mtod(m, caddr_t), th, th->th_seq + tlen, 2226 (tcp_seq)0, TH_RST|TH_ACK); 2227 } 2228 m_freem(m); 2229 return; 2230 2231 drop: 2232 /* 2233 * Drop space held by incoming segment and return. 2234 */ 2235 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) { 2236 switch (tp->pf) { 2237 #ifdef INET6 2238 case PF_INET6: 2239 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti6, 2240 0, tlen); 2241 break; 2242 #endif /* INET6 */ 2243 case PF_INET: 2244 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti, 2245 0, tlen); 2246 break; 2247 } 2248 } 2249 2250 m_freem(m); 2251 return; 2252 } 2253 2254 int 2255 tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th, 2256 struct mbuf *m, int iphlen, struct tcp_opt_info *oi) 2257 { 2258 u_int16_t mss = 0; 2259 int opt, optlen; 2260 #ifdef TCP_SIGNATURE 2261 caddr_t sigp = NULL; 2262 struct tdb *tdb = NULL; 2263 #endif /* TCP_SIGNATURE */ 2264 2265 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) { 2266 opt = cp[0]; 2267 if (opt == TCPOPT_EOL) 2268 break; 2269 if (opt == TCPOPT_NOP) 2270 optlen = 1; 2271 else { 2272 if (cnt < 2) 2273 break; 2274 optlen = cp[1]; 2275 if (optlen < 2 || optlen > cnt) 2276 break; 2277 } 2278 switch (opt) { 2279 2280 default: 2281 continue; 2282 2283 case TCPOPT_MAXSEG: 2284 if (optlen != TCPOLEN_MAXSEG) 2285 continue; 2286 if (!(th->th_flags & TH_SYN)) 2287 continue; 2288 if (TCPS_HAVERCVDSYN(tp->t_state)) 2289 continue; 2290 bcopy((char *) cp + 2, (char *) &mss, sizeof(mss)); 2291 NTOHS(mss); 2292 oi->maxseg = mss; 2293 break; 2294 2295 case TCPOPT_WINDOW: 2296 if (optlen != TCPOLEN_WINDOW) 2297 continue; 2298 if (!(th->th_flags & TH_SYN)) 2299 continue; 2300 if (TCPS_HAVERCVDSYN(tp->t_state)) 2301 continue; 2302 tp->t_flags |= TF_RCVD_SCALE; 2303 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); 2304 break; 2305 2306 case TCPOPT_TIMESTAMP: 2307 if (optlen != TCPOLEN_TIMESTAMP) 2308 continue; 2309 oi->ts_present = 1; 2310 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val)); 2311 NTOHL(oi->ts_val); 2312 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr)); 2313 NTOHL(oi->ts_ecr); 2314 2315 if (!(th->th_flags & TH_SYN)) 2316 continue; 2317 if (TCPS_HAVERCVDSYN(tp->t_state)) 2318 continue; 2319 /* 2320 * A timestamp received in a SYN makes 2321 * it ok to send timestamp requests and replies. 2322 */ 2323 tp->t_flags |= TF_RCVD_TSTMP; 2324 tp->ts_recent = oi->ts_val; 2325 tp->ts_recent_age = tcp_now; 2326 break; 2327 2328 #ifdef TCP_SACK 2329 case TCPOPT_SACK_PERMITTED: 2330 if (!tp->sack_enable || optlen!=TCPOLEN_SACK_PERMITTED) 2331 continue; 2332 if (!(th->th_flags & TH_SYN)) 2333 continue; 2334 if (TCPS_HAVERCVDSYN(tp->t_state)) 2335 continue; 2336 /* MUST only be set on SYN */ 2337 tp->t_flags |= TF_SACK_PERMIT; 2338 break; 2339 case TCPOPT_SACK: 2340 tcp_sack_option(tp, th, cp, optlen); 2341 break; 2342 #endif 2343 #ifdef TCP_SIGNATURE 2344 case TCPOPT_SIGNATURE: 2345 if (optlen != TCPOLEN_SIGNATURE) 2346 continue; 2347 2348 if (sigp && bcmp(sigp, cp + 2, 16)) 2349 return (-1); 2350 2351 sigp = cp + 2; 2352 break; 2353 #endif /* TCP_SIGNATURE */ 2354 } 2355 } 2356 2357 #ifdef TCP_SIGNATURE 2358 if (tp->t_flags & TF_SIGNATURE) { 2359 union sockaddr_union src, dst; 2360 2361 memset(&src, 0, sizeof(union sockaddr_union)); 2362 memset(&dst, 0, sizeof(union sockaddr_union)); 2363 2364 switch (tp->pf) { 2365 case 0: 2366 #ifdef INET 2367 case AF_INET: 2368 src.sa.sa_len = sizeof(struct sockaddr_in); 2369 src.sa.sa_family = AF_INET; 2370 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 2371 dst.sa.sa_len = sizeof(struct sockaddr_in); 2372 dst.sa.sa_family = AF_INET; 2373 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 2374 break; 2375 #endif 2376 #ifdef INET6 2377 case AF_INET6: 2378 src.sa.sa_len = sizeof(struct sockaddr_in6); 2379 src.sa.sa_family = AF_INET6; 2380 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 2381 dst.sa.sa_len = sizeof(struct sockaddr_in6); 2382 dst.sa.sa_family = AF_INET6; 2383 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 2384 break; 2385 #endif /* INET6 */ 2386 } 2387 2388 tdb = gettdbbysrcdst(0, &src, &dst, IPPROTO_TCP); 2389 2390 /* 2391 * We don't have an SA for this peer, so we turn off 2392 * TF_SIGNATURE on the listen socket 2393 */ 2394 if (tdb == NULL && tp->t_state == TCPS_LISTEN) 2395 tp->t_flags &= ~TF_SIGNATURE; 2396 2397 } 2398 2399 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) { 2400 tcpstat.tcps_rcvbadsig++; 2401 return (-1); 2402 } 2403 2404 if (sigp) { 2405 char sig[16]; 2406 2407 if (tdb == NULL) { 2408 tcpstat.tcps_rcvbadsig++; 2409 return (-1); 2410 } 2411 2412 if (tcp_signature(tdb, tp->pf, m, th, iphlen, 1, sig) < 0) 2413 return (-1); 2414 2415 if (bcmp(sig, sigp, 16)) { 2416 tcpstat.tcps_rcvbadsig++; 2417 return (-1); 2418 } 2419 2420 tcpstat.tcps_rcvgoodsig++; 2421 } 2422 #endif /* TCP_SIGNATURE */ 2423 2424 return (0); 2425 } 2426 2427 #if defined(TCP_SACK) 2428 u_long 2429 tcp_seq_subtract(u_long a, u_long b) 2430 { 2431 return ((long)(a - b)); 2432 } 2433 #endif 2434 2435 2436 #ifdef TCP_SACK 2437 /* 2438 * This function is called upon receipt of new valid data (while not in header 2439 * prediction mode), and it updates the ordered list of sacks. 2440 */ 2441 void 2442 tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_laststart, 2443 tcp_seq rcv_lastend) 2444 { 2445 /* 2446 * First reported block MUST be the most recent one. Subsequent 2447 * blocks SHOULD be in the order in which they arrived at the 2448 * receiver. These two conditions make the implementation fully 2449 * compliant with RFC 2018. 2450 */ 2451 int i, j = 0, count = 0, lastpos = -1; 2452 struct sackblk sack, firstsack, temp[MAX_SACK_BLKS]; 2453 2454 /* First clean up current list of sacks */ 2455 for (i = 0; i < tp->rcv_numsacks; i++) { 2456 sack = tp->sackblks[i]; 2457 if (sack.start == 0 && sack.end == 0) { 2458 count++; /* count = number of blocks to be discarded */ 2459 continue; 2460 } 2461 if (SEQ_LEQ(sack.end, tp->rcv_nxt)) { 2462 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2463 count++; 2464 } else { 2465 temp[j].start = tp->sackblks[i].start; 2466 temp[j++].end = tp->sackblks[i].end; 2467 } 2468 } 2469 tp->rcv_numsacks -= count; 2470 if (tp->rcv_numsacks == 0) { /* no sack blocks currently (fast path) */ 2471 tcp_clean_sackreport(tp); 2472 if (SEQ_LT(tp->rcv_nxt, rcv_laststart)) { 2473 /* ==> need first sack block */ 2474 tp->sackblks[0].start = rcv_laststart; 2475 tp->sackblks[0].end = rcv_lastend; 2476 tp->rcv_numsacks = 1; 2477 } 2478 return; 2479 } 2480 /* Otherwise, sack blocks are already present. */ 2481 for (i = 0; i < tp->rcv_numsacks; i++) 2482 tp->sackblks[i] = temp[i]; /* first copy back sack list */ 2483 if (SEQ_GEQ(tp->rcv_nxt, rcv_lastend)) 2484 return; /* sack list remains unchanged */ 2485 /* 2486 * From here, segment just received should be (part of) the 1st sack. 2487 * Go through list, possibly coalescing sack block entries. 2488 */ 2489 firstsack.start = rcv_laststart; 2490 firstsack.end = rcv_lastend; 2491 for (i = 0; i < tp->rcv_numsacks; i++) { 2492 sack = tp->sackblks[i]; 2493 if (SEQ_LT(sack.end, firstsack.start) || 2494 SEQ_GT(sack.start, firstsack.end)) 2495 continue; /* no overlap */ 2496 if (sack.start == firstsack.start && sack.end == firstsack.end){ 2497 /* 2498 * identical block; delete it here since we will 2499 * move it to the front of the list. 2500 */ 2501 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2502 lastpos = i; /* last posn with a zero entry */ 2503 continue; 2504 } 2505 if (SEQ_LEQ(sack.start, firstsack.start)) 2506 firstsack.start = sack.start; /* merge blocks */ 2507 if (SEQ_GEQ(sack.end, firstsack.end)) 2508 firstsack.end = sack.end; /* merge blocks */ 2509 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2510 lastpos = i; /* last posn with a zero entry */ 2511 } 2512 if (lastpos != -1) { /* at least one merge */ 2513 for (i = 0, j = 1; i < tp->rcv_numsacks; i++) { 2514 sack = tp->sackblks[i]; 2515 if (sack.start == 0 && sack.end == 0) 2516 continue; 2517 temp[j++] = sack; 2518 } 2519 tp->rcv_numsacks = j; /* including first blk (added later) */ 2520 for (i = 1; i < tp->rcv_numsacks; i++) /* now copy back */ 2521 tp->sackblks[i] = temp[i]; 2522 } else { /* no merges -- shift sacks by 1 */ 2523 if (tp->rcv_numsacks < MAX_SACK_BLKS) 2524 tp->rcv_numsacks++; 2525 for (i = tp->rcv_numsacks-1; i > 0; i--) 2526 tp->sackblks[i] = tp->sackblks[i-1]; 2527 } 2528 tp->sackblks[0] = firstsack; 2529 return; 2530 } 2531 2532 /* 2533 * Process the TCP SACK option. tp->snd_holes is an ordered list 2534 * of holes (oldest to newest, in terms of the sequence space). 2535 */ 2536 void 2537 tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen) 2538 { 2539 int tmp_olen; 2540 u_char *tmp_cp; 2541 struct sackhole *cur, *p, *temp; 2542 2543 if (!tp->sack_enable) 2544 return; 2545 /* SACK without ACK doesn't make sense. */ 2546 if ((th->th_flags & TH_ACK) == 0) 2547 return; 2548 /* Make sure the ACK on this segment is in [snd_una, snd_max]. */ 2549 if (SEQ_LT(th->th_ack, tp->snd_una) || 2550 SEQ_GT(th->th_ack, tp->snd_max)) 2551 return; 2552 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2553 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0) 2554 return; 2555 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2556 tmp_cp = cp + 2; 2557 tmp_olen = optlen - 2; 2558 tcpstat.tcps_sack_rcv_opts++; 2559 if (tp->snd_numholes < 0) 2560 tp->snd_numholes = 0; 2561 if (tp->t_maxseg == 0) 2562 panic("tcp_sack_option"); /* Should never happen */ 2563 while (tmp_olen > 0) { 2564 struct sackblk sack; 2565 2566 bcopy(tmp_cp, (char *) &(sack.start), sizeof(tcp_seq)); 2567 NTOHL(sack.start); 2568 bcopy(tmp_cp + sizeof(tcp_seq), 2569 (char *) &(sack.end), sizeof(tcp_seq)); 2570 NTOHL(sack.end); 2571 tmp_olen -= TCPOLEN_SACK; 2572 tmp_cp += TCPOLEN_SACK; 2573 if (SEQ_LEQ(sack.end, sack.start)) 2574 continue; /* bad SACK fields */ 2575 if (SEQ_LEQ(sack.end, tp->snd_una)) 2576 continue; /* old block */ 2577 #if defined(TCP_SACK) && defined(TCP_FACK) 2578 /* Updates snd_fack. */ 2579 if (SEQ_GT(sack.end, tp->snd_fack)) 2580 tp->snd_fack = sack.end; 2581 #endif /* TCP_FACK */ 2582 if (SEQ_GT(th->th_ack, tp->snd_una)) { 2583 if (SEQ_LT(sack.start, th->th_ack)) 2584 continue; 2585 } 2586 if (SEQ_GT(sack.end, tp->snd_max)) 2587 continue; 2588 if (tp->snd_holes == NULL) { /* first hole */ 2589 tp->snd_holes = (struct sackhole *) 2590 pool_get(&sackhl_pool, PR_NOWAIT); 2591 if (tp->snd_holes == NULL) { 2592 /* ENOBUFS, so ignore SACKed block for now*/ 2593 goto done; 2594 } 2595 cur = tp->snd_holes; 2596 cur->start = th->th_ack; 2597 cur->end = sack.start; 2598 cur->rxmit = cur->start; 2599 cur->next = NULL; 2600 tp->snd_numholes = 1; 2601 tp->rcv_lastsack = sack.end; 2602 /* 2603 * dups is at least one. If more data has been 2604 * SACKed, it can be greater than one. 2605 */ 2606 cur->dups = min(tcprexmtthresh, 2607 ((sack.end - cur->end)/tp->t_maxseg)); 2608 if (cur->dups < 1) 2609 cur->dups = 1; 2610 continue; /* with next sack block */ 2611 } 2612 /* Go thru list of holes: p = previous, cur = current */ 2613 p = cur = tp->snd_holes; 2614 while (cur) { 2615 if (SEQ_LEQ(sack.end, cur->start)) 2616 /* SACKs data before the current hole */ 2617 break; /* no use going through more holes */ 2618 if (SEQ_GEQ(sack.start, cur->end)) { 2619 /* SACKs data beyond the current hole */ 2620 cur->dups++; 2621 if (((sack.end - cur->end)/tp->t_maxseg) >= 2622 tcprexmtthresh) 2623 cur->dups = tcprexmtthresh; 2624 p = cur; 2625 cur = cur->next; 2626 continue; 2627 } 2628 if (SEQ_LEQ(sack.start, cur->start)) { 2629 /* Data acks at least the beginning of hole */ 2630 #if defined(TCP_SACK) && defined(TCP_FACK) 2631 if (SEQ_GT(sack.end, cur->rxmit)) 2632 tp->retran_data -= 2633 tcp_seq_subtract(cur->rxmit, 2634 cur->start); 2635 else 2636 tp->retran_data -= 2637 tcp_seq_subtract(sack.end, 2638 cur->start); 2639 #endif /* TCP_FACK */ 2640 if (SEQ_GEQ(sack.end, cur->end)) { 2641 /* Acks entire hole, so delete hole */ 2642 if (p != cur) { 2643 p->next = cur->next; 2644 pool_put(&sackhl_pool, cur); 2645 cur = p->next; 2646 } else { 2647 cur = cur->next; 2648 pool_put(&sackhl_pool, p); 2649 p = cur; 2650 tp->snd_holes = p; 2651 } 2652 tp->snd_numholes--; 2653 continue; 2654 } 2655 /* otherwise, move start of hole forward */ 2656 cur->start = sack.end; 2657 cur->rxmit = SEQ_MAX(cur->rxmit, cur->start); 2658 p = cur; 2659 cur = cur->next; 2660 continue; 2661 } 2662 /* move end of hole backward */ 2663 if (SEQ_GEQ(sack.end, cur->end)) { 2664 #if defined(TCP_SACK) && defined(TCP_FACK) 2665 if (SEQ_GT(cur->rxmit, sack.start)) 2666 tp->retran_data -= 2667 tcp_seq_subtract(cur->rxmit, 2668 sack.start); 2669 #endif /* TCP_FACK */ 2670 cur->end = sack.start; 2671 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2672 cur->dups++; 2673 if (((sack.end - cur->end)/tp->t_maxseg) >= 2674 tcprexmtthresh) 2675 cur->dups = tcprexmtthresh; 2676 p = cur; 2677 cur = cur->next; 2678 continue; 2679 } 2680 if (SEQ_LT(cur->start, sack.start) && 2681 SEQ_GT(cur->end, sack.end)) { 2682 /* 2683 * ACKs some data in middle of a hole; need to 2684 * split current hole 2685 */ 2686 temp = (struct sackhole *) 2687 pool_get(&sackhl_pool, PR_NOWAIT); 2688 if (temp == NULL) 2689 goto done; /* ENOBUFS */ 2690 #if defined(TCP_SACK) && defined(TCP_FACK) 2691 if (SEQ_GT(cur->rxmit, sack.end)) 2692 tp->retran_data -= 2693 tcp_seq_subtract(sack.end, 2694 sack.start); 2695 else if (SEQ_GT(cur->rxmit, sack.start)) 2696 tp->retran_data -= 2697 tcp_seq_subtract(cur->rxmit, 2698 sack.start); 2699 #endif /* TCP_FACK */ 2700 temp->next = cur->next; 2701 temp->start = sack.end; 2702 temp->end = cur->end; 2703 temp->dups = cur->dups; 2704 temp->rxmit = SEQ_MAX(cur->rxmit, temp->start); 2705 cur->end = sack.start; 2706 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2707 cur->dups++; 2708 if (((sack.end - cur->end)/tp->t_maxseg) >= 2709 tcprexmtthresh) 2710 cur->dups = tcprexmtthresh; 2711 cur->next = temp; 2712 p = temp; 2713 cur = p->next; 2714 tp->snd_numholes++; 2715 } 2716 } 2717 /* At this point, p points to the last hole on the list */ 2718 if (SEQ_LT(tp->rcv_lastsack, sack.start)) { 2719 /* 2720 * Need to append new hole at end. 2721 * Last hole is p (and it's not NULL). 2722 */ 2723 temp = (struct sackhole *) 2724 pool_get(&sackhl_pool, PR_NOWAIT); 2725 if (temp == NULL) 2726 goto done; /* ENOBUFS */ 2727 temp->start = tp->rcv_lastsack; 2728 temp->end = sack.start; 2729 temp->dups = min(tcprexmtthresh, 2730 ((sack.end - sack.start)/tp->t_maxseg)); 2731 if (temp->dups < 1) 2732 temp->dups = 1; 2733 temp->rxmit = temp->start; 2734 temp->next = 0; 2735 p->next = temp; 2736 tp->rcv_lastsack = sack.end; 2737 tp->snd_numholes++; 2738 } 2739 } 2740 done: 2741 #if defined(TCP_SACK) && defined(TCP_FACK) 2742 /* 2743 * Update retran_data and snd_awnd. Go through the list of 2744 * holes. Increment retran_data by (hole->rxmit - hole->start). 2745 */ 2746 tp->retran_data = 0; 2747 cur = tp->snd_holes; 2748 while (cur) { 2749 tp->retran_data += cur->rxmit - cur->start; 2750 cur = cur->next; 2751 } 2752 tp->snd_awnd = tcp_seq_subtract(tp->snd_nxt, tp->snd_fack) + 2753 tp->retran_data; 2754 #endif /* TCP_FACK */ 2755 2756 return; 2757 } 2758 2759 /* 2760 * Delete stale (i.e, cumulatively ack'd) holes. Hole is deleted only if 2761 * it is completely acked; otherwise, tcp_sack_option(), called from 2762 * tcp_dooptions(), will fix up the hole. 2763 */ 2764 void 2765 tcp_del_sackholes(struct tcpcb *tp, struct tcphdr *th) 2766 { 2767 if (tp->sack_enable && tp->t_state != TCPS_LISTEN) { 2768 /* max because this could be an older ack just arrived */ 2769 tcp_seq lastack = SEQ_GT(th->th_ack, tp->snd_una) ? 2770 th->th_ack : tp->snd_una; 2771 struct sackhole *cur = tp->snd_holes; 2772 struct sackhole *prev; 2773 while (cur) 2774 if (SEQ_LEQ(cur->end, lastack)) { 2775 prev = cur; 2776 cur = cur->next; 2777 pool_put(&sackhl_pool, prev); 2778 tp->snd_numholes--; 2779 } else if (SEQ_LT(cur->start, lastack)) { 2780 cur->start = lastack; 2781 if (SEQ_LT(cur->rxmit, cur->start)) 2782 cur->rxmit = cur->start; 2783 break; 2784 } else 2785 break; 2786 tp->snd_holes = cur; 2787 } 2788 } 2789 2790 /* 2791 * Delete all receiver-side SACK information. 2792 */ 2793 void 2794 tcp_clean_sackreport(struct tcpcb *tp) 2795 { 2796 int i; 2797 2798 tp->rcv_numsacks = 0; 2799 for (i = 0; i < MAX_SACK_BLKS; i++) 2800 tp->sackblks[i].start = tp->sackblks[i].end=0; 2801 2802 } 2803 2804 /* 2805 * Checks for partial ack. If partial ack arrives, turn off retransmission 2806 * timer, deflate the window, do not clear tp->t_dupacks, and return 1. 2807 * If the ack advances at least to tp->snd_last, return 0. 2808 */ 2809 int 2810 tcp_sack_partialack(struct tcpcb *tp, struct tcphdr *th) 2811 { 2812 if (SEQ_LT(th->th_ack, tp->snd_last)) { 2813 /* Turn off retx. timer (will start again next segment) */ 2814 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2815 tp->t_rtttime = 0; 2816 #ifndef TCP_FACK 2817 /* 2818 * Partial window deflation. This statement relies on the 2819 * fact that tp->snd_una has not been updated yet. In FACK 2820 * hold snd_cwnd constant during fast recovery. 2821 */ 2822 if (tp->snd_cwnd > (th->th_ack - tp->snd_una)) { 2823 tp->snd_cwnd -= th->th_ack - tp->snd_una; 2824 tp->snd_cwnd += tp->t_maxseg; 2825 } else 2826 tp->snd_cwnd = tp->t_maxseg; 2827 #endif 2828 return (1); 2829 } 2830 return (0); 2831 } 2832 #endif /* TCP_SACK */ 2833 2834 /* 2835 * Pull out of band byte out of a segment so 2836 * it doesn't appear in the user's data queue. 2837 * It is still reflected in the segment length for 2838 * sequencing purposes. 2839 */ 2840 void 2841 tcp_pulloutofband(struct socket *so, u_int urgent, struct mbuf *m, int off) 2842 { 2843 int cnt = off + urgent - 1; 2844 2845 while (cnt >= 0) { 2846 if (m->m_len > cnt) { 2847 char *cp = mtod(m, caddr_t) + cnt; 2848 struct tcpcb *tp = sototcpcb(so); 2849 2850 tp->t_iobc = *cp; 2851 tp->t_oobflags |= TCPOOB_HAVEDATA; 2852 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 2853 m->m_len--; 2854 return; 2855 } 2856 cnt -= m->m_len; 2857 m = m->m_next; 2858 if (m == 0) 2859 break; 2860 } 2861 panic("tcp_pulloutofband"); 2862 } 2863 2864 /* 2865 * Collect new round-trip time estimate 2866 * and update averages and current timeout. 2867 */ 2868 void 2869 tcp_xmit_timer(struct tcpcb *tp, int rtt) 2870 { 2871 short delta; 2872 short rttmin; 2873 2874 if (rtt < 0) 2875 rtt = 0; 2876 else if (rtt > TCP_RTT_MAX) 2877 rtt = TCP_RTT_MAX; 2878 2879 tcpstat.tcps_rttupdated++; 2880 if (tp->t_srtt != 0) { 2881 /* 2882 * delta is fixed point with 2 (TCP_RTT_BASE_SHIFT) bits 2883 * after the binary point (scaled by 4), whereas 2884 * srtt is stored as fixed point with 5 bits after the 2885 * binary point (i.e., scaled by 32). The following magic 2886 * is equivalent to the smoothing algorithm in rfc793 with 2887 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2888 * point). 2889 */ 2890 delta = (rtt << TCP_RTT_BASE_SHIFT) - 2891 (tp->t_srtt >> TCP_RTT_SHIFT); 2892 if ((tp->t_srtt += delta) <= 0) 2893 tp->t_srtt = 1 << TCP_RTT_BASE_SHIFT; 2894 /* 2895 * We accumulate a smoothed rtt variance (actually, a 2896 * smoothed mean difference), then set the retransmit 2897 * timer to smoothed rtt + 4 times the smoothed variance. 2898 * rttvar is stored as fixed point with 4 bits after the 2899 * binary point (scaled by 16). The following is 2900 * equivalent to rfc793 smoothing with an alpha of .75 2901 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2902 * rfc793's wired-in beta. 2903 */ 2904 if (delta < 0) 2905 delta = -delta; 2906 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 2907 if ((tp->t_rttvar += delta) <= 0) 2908 tp->t_rttvar = 1 << TCP_RTT_BASE_SHIFT; 2909 } else { 2910 /* 2911 * No rtt measurement yet - use the unsmoothed rtt. 2912 * Set the variance to half the rtt (so our first 2913 * retransmit happens at 3*rtt). 2914 */ 2915 tp->t_srtt = (rtt + 1) << (TCP_RTT_SHIFT + TCP_RTT_BASE_SHIFT); 2916 tp->t_rttvar = (rtt + 1) << 2917 (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1); 2918 } 2919 tp->t_rtttime = 0; 2920 tp->t_rxtshift = 0; 2921 2922 /* 2923 * the retransmit should happen at rtt + 4 * rttvar. 2924 * Because of the way we do the smoothing, srtt and rttvar 2925 * will each average +1/2 tick of bias. When we compute 2926 * the retransmit timer, we want 1/2 tick of rounding and 2927 * 1 extra tick because of +-1/2 tick uncertainty in the 2928 * firing of the timer. The bias will give us exactly the 2929 * 1.5 tick we need. But, because the bias is 2930 * statistical, we have to test that we don't drop below 2931 * the minimum feasible timer (which is 2 ticks). 2932 */ 2933 rttmin = min(max(rtt + 2, tp->t_rttmin), TCPTV_REXMTMAX); 2934 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 2935 2936 /* 2937 * We received an ack for a packet that wasn't retransmitted; 2938 * it is probably safe to discard any error indications we've 2939 * received recently. This isn't quite right, but close enough 2940 * for now (a route might have failed after we sent a segment, 2941 * and the return path might not be symmetrical). 2942 */ 2943 tp->t_softerror = 0; 2944 } 2945 2946 /* 2947 * Determine a reasonable value for maxseg size. 2948 * If the route is known, check route for mtu. 2949 * If none, use an mss that can be handled on the outgoing 2950 * interface without forcing IP to fragment; if bigger than 2951 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES 2952 * to utilize large mbufs. If no route is found, route has no mtu, 2953 * or the destination isn't local, use a default, hopefully conservative 2954 * size (usually 512 or the default IP max size, but no more than the mtu 2955 * of the interface), as we can't discover anything about intervening 2956 * gateways or networks. We also initialize the congestion/slow start 2957 * window to be a single segment if the destination isn't local. 2958 * While looking at the routing entry, we also initialize other path-dependent 2959 * parameters from pre-set or cached values in the routing entry. 2960 * 2961 * Also take into account the space needed for options that we 2962 * send regularly. Make maxseg shorter by that amount to assure 2963 * that we can send maxseg amount of data even when the options 2964 * are present. Store the upper limit of the length of options plus 2965 * data in maxopd. 2966 * 2967 * NOTE: offer == -1 indicates that the maxseg size changed due to 2968 * Path MTU discovery. 2969 */ 2970 int 2971 tcp_mss(struct tcpcb *tp, int offer) 2972 { 2973 struct rtentry *rt; 2974 struct ifnet *ifp; 2975 int mss, mssopt; 2976 int iphlen; 2977 struct inpcb *inp; 2978 2979 inp = tp->t_inpcb; 2980 2981 mssopt = mss = tcp_mssdflt; 2982 2983 rt = in_pcbrtentry(inp); 2984 2985 if (rt == NULL) 2986 goto out; 2987 2988 ifp = rt->rt_ifp; 2989 2990 switch (tp->pf) { 2991 #ifdef INET6 2992 case AF_INET6: 2993 iphlen = sizeof(struct ip6_hdr); 2994 break; 2995 #endif 2996 case AF_INET: 2997 iphlen = sizeof(struct ip); 2998 break; 2999 default: 3000 /* the family does not support path MTU discovery */ 3001 goto out; 3002 } 3003 3004 #ifdef RTV_MTU 3005 /* 3006 * if there's an mtu associated with the route and we support 3007 * path MTU discovery for the underlying protocol family, use it. 3008 */ 3009 if (rt->rt_rmx.rmx_mtu) { 3010 /* 3011 * One may wish to lower MSS to take into account options, 3012 * especially security-related options. 3013 */ 3014 if (tp->pf == AF_INET6 && rt->rt_rmx.rmx_mtu < IPV6_MMTU) { 3015 /* 3016 * RFC2460 section 5, last paragraph: if path MTU is 3017 * smaller than 1280, use 1280 as packet size and 3018 * attach fragment header. 3019 */ 3020 mss = IPV6_MMTU - iphlen - sizeof(struct ip6_frag) - 3021 sizeof(struct tcphdr); 3022 } else 3023 mss = rt->rt_rmx.rmx_mtu - iphlen - sizeof(struct tcphdr); 3024 } else 3025 #endif /* RTV_MTU */ 3026 if (!ifp) 3027 /* 3028 * ifp may be null and rmx_mtu may be zero in certain 3029 * v6 cases (e.g., if ND wasn't able to resolve the 3030 * destination host. 3031 */ 3032 goto out; 3033 else if (ifp->if_flags & IFF_LOOPBACK) 3034 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3035 else if (tp->pf == AF_INET) { 3036 if (ip_mtudisc) 3037 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3038 else if (inp && in_localaddr(inp->inp_faddr, inp->inp_rdomain)) 3039 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3040 } 3041 #ifdef INET6 3042 else if (tp->pf == AF_INET6) { 3043 /* 3044 * for IPv6, path MTU discovery is always turned on, 3045 * or the node must use packet size <= 1280. 3046 */ 3047 mss = IN6_LINKMTU(ifp) - iphlen - sizeof(struct tcphdr); 3048 } 3049 #endif /* INET6 */ 3050 3051 /* Calculate the value that we offer in TCPOPT_MAXSEG */ 3052 if (offer != -1) { 3053 #ifndef INET6 3054 mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3055 #else 3056 if (tp->pf == AF_INET6) 3057 mssopt = IN6_LINKMTU(ifp) - iphlen - 3058 sizeof(struct tcphdr); 3059 else 3060 mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3061 #endif 3062 3063 mssopt = max(tcp_mssdflt, mssopt); 3064 } 3065 3066 out: 3067 /* 3068 * The current mss, t_maxseg, is initialized to the default value. 3069 * If we compute a smaller value, reduce the current mss. 3070 * If we compute a larger value, return it for use in sending 3071 * a max seg size option, but don't store it for use 3072 * unless we received an offer at least that large from peer. 3073 * 3074 * However, do not accept offers lower than the minimum of 3075 * the interface MTU and 216. 3076 */ 3077 if (offer > 0) 3078 tp->t_peermss = offer; 3079 if (tp->t_peermss) 3080 mss = min(mss, max(tp->t_peermss, 216)); 3081 3082 /* sanity - at least max opt. space */ 3083 mss = max(mss, 64); 3084 3085 /* 3086 * maxopd stores the maximum length of data AND options 3087 * in a segment; maxseg is the amount of data in a normal 3088 * segment. We need to store this value (maxopd) apart 3089 * from maxseg, because now every segment carries options 3090 * and thus we normally have somewhat less data in segments. 3091 */ 3092 tp->t_maxopd = mss; 3093 3094 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 3095 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 3096 mss -= TCPOLEN_TSTAMP_APPA; 3097 #ifdef TCP_SIGNATURE 3098 if (tp->t_flags & TF_SIGNATURE) 3099 mss -= TCPOLEN_SIGLEN; 3100 #endif 3101 3102 if (offer == -1) { 3103 /* mss changed due to Path MTU discovery */ 3104 tp->t_flags &= ~TF_PMTUD_PEND; 3105 tp->t_pmtud_mtu_sent = 0; 3106 tp->t_pmtud_mss_acked = 0; 3107 if (mss < tp->t_maxseg) { 3108 /* 3109 * Follow suggestion in RFC 2414 to reduce the 3110 * congestion window by the ratio of the old 3111 * segment size to the new segment size. 3112 */ 3113 tp->snd_cwnd = ulmax((tp->snd_cwnd / tp->t_maxseg) * 3114 mss, mss); 3115 } 3116 } else if (tcp_do_rfc3390) { 3117 /* increase initial window */ 3118 tp->snd_cwnd = ulmin(4 * mss, ulmax(2 * mss, 4380)); 3119 } else 3120 tp->snd_cwnd = mss; 3121 3122 tp->t_maxseg = mss; 3123 3124 return (offer != -1 ? mssopt : mss); 3125 } 3126 3127 u_int 3128 tcp_hdrsz(struct tcpcb *tp) 3129 { 3130 u_int hlen; 3131 3132 switch (tp->pf) { 3133 #ifdef INET6 3134 case AF_INET6: 3135 hlen = sizeof(struct ip6_hdr); 3136 break; 3137 #endif 3138 case AF_INET: 3139 hlen = sizeof(struct ip); 3140 break; 3141 default: 3142 hlen = 0; 3143 break; 3144 } 3145 hlen += sizeof(struct tcphdr); 3146 3147 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 3148 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 3149 hlen += TCPOLEN_TSTAMP_APPA; 3150 #ifdef TCP_SIGNATURE 3151 if (tp->t_flags & TF_SIGNATURE) 3152 hlen += TCPOLEN_SIGLEN; 3153 #endif 3154 return (hlen); 3155 } 3156 3157 /* 3158 * Set connection variables based on the effective MSS. 3159 * We are passed the TCPCB for the actual connection. If we 3160 * are the server, we are called by the compressed state engine 3161 * when the 3-way handshake is complete. If we are the client, 3162 * we are called when we receive the SYN,ACK from the server. 3163 * 3164 * NOTE: The t_maxseg value must be initialized in the TCPCB 3165 * before this routine is called! 3166 */ 3167 void 3168 tcp_mss_update(struct tcpcb *tp) 3169 { 3170 int mss; 3171 u_long bufsize; 3172 struct rtentry *rt; 3173 struct socket *so; 3174 3175 so = tp->t_inpcb->inp_socket; 3176 mss = tp->t_maxseg; 3177 3178 rt = in_pcbrtentry(tp->t_inpcb); 3179 3180 if (rt == NULL) 3181 return; 3182 3183 bufsize = so->so_snd.sb_hiwat; 3184 if (bufsize < mss) { 3185 mss = bufsize; 3186 /* Update t_maxseg and t_maxopd */ 3187 tcp_mss(tp, mss); 3188 } else { 3189 bufsize = roundup(bufsize, mss); 3190 if (bufsize > sb_max) 3191 bufsize = sb_max; 3192 (void)sbreserve(&so->so_snd, bufsize); 3193 } 3194 3195 bufsize = so->so_rcv.sb_hiwat; 3196 if (bufsize > mss) { 3197 bufsize = roundup(bufsize, mss); 3198 if (bufsize > sb_max) 3199 bufsize = sb_max; 3200 (void)sbreserve(&so->so_rcv, bufsize); 3201 } 3202 3203 } 3204 3205 #if defined (TCP_SACK) 3206 /* 3207 * Checks for partial ack. If partial ack arrives, force the retransmission 3208 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return 3209 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to 3210 * be started again. If the ack advances at least to tp->snd_last, return 0. 3211 */ 3212 int 3213 tcp_newreno(struct tcpcb *tp, struct tcphdr *th) 3214 { 3215 if (SEQ_LT(th->th_ack, tp->snd_last)) { 3216 /* 3217 * snd_una has not been updated and the socket send buffer 3218 * not yet drained of the acked data, so we have to leave 3219 * snd_una as it was to get the correct data offset in 3220 * tcp_output(). 3221 */ 3222 tcp_seq onxt = tp->snd_nxt; 3223 u_long ocwnd = tp->snd_cwnd; 3224 TCP_TIMER_DISARM(tp, TCPT_REXMT); 3225 tp->t_rtttime = 0; 3226 tp->snd_nxt = th->th_ack; 3227 /* 3228 * Set snd_cwnd to one segment beyond acknowledged offset 3229 * (tp->snd_una not yet updated when this function is called) 3230 */ 3231 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una); 3232 (void) tcp_output(tp); 3233 tp->snd_cwnd = ocwnd; 3234 if (SEQ_GT(onxt, tp->snd_nxt)) 3235 tp->snd_nxt = onxt; 3236 /* 3237 * Partial window deflation. Relies on fact that tp->snd_una 3238 * not updated yet. 3239 */ 3240 if (tp->snd_cwnd > th->th_ack - tp->snd_una) 3241 tp->snd_cwnd -= th->th_ack - tp->snd_una; 3242 else 3243 tp->snd_cwnd = 0; 3244 tp->snd_cwnd += tp->t_maxseg; 3245 3246 return 1; 3247 } 3248 return 0; 3249 } 3250 #endif /* TCP_SACK */ 3251 3252 int 3253 tcp_mss_adv(struct ifnet *ifp, int af) 3254 { 3255 int mss = 0; 3256 int iphlen; 3257 3258 switch (af) { 3259 case AF_INET: 3260 if (ifp != NULL) 3261 mss = ifp->if_mtu; 3262 iphlen = sizeof(struct ip); 3263 break; 3264 #ifdef INET6 3265 case AF_INET6: 3266 if (ifp != NULL) 3267 mss = IN6_LINKMTU(ifp); 3268 iphlen = sizeof(struct ip6_hdr); 3269 break; 3270 #endif 3271 } 3272 mss = mss - iphlen - sizeof(struct tcphdr); 3273 return (max(mss, tcp_mssdflt)); 3274 } 3275 3276 /* 3277 * TCP compressed state engine. Currently used to hold compressed 3278 * state for SYN_RECEIVED. 3279 */ 3280 3281 u_long syn_cache_count; 3282 u_int32_t syn_hash1, syn_hash2; 3283 3284 #define SYN_HASH(sa, sp, dp) \ 3285 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 3286 ((u_int32_t)(sp)))^syn_hash2))) 3287 #ifndef INET6 3288 #define SYN_HASHALL(hash, src, dst) \ 3289 do { \ 3290 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \ 3291 ((struct sockaddr_in *)(src))->sin_port, \ 3292 ((struct sockaddr_in *)(dst))->sin_port); \ 3293 } while (/*CONSTCOND*/ 0) 3294 #else 3295 #define SYN_HASH6(sa, sp, dp) \ 3296 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \ 3297 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \ 3298 & 0x7fffffff) 3299 3300 #define SYN_HASHALL(hash, src, dst) \ 3301 do { \ 3302 switch ((src)->sa_family) { \ 3303 case AF_INET: \ 3304 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \ 3305 ((struct sockaddr_in *)(src))->sin_port, \ 3306 ((struct sockaddr_in *)(dst))->sin_port); \ 3307 break; \ 3308 case AF_INET6: \ 3309 hash = SYN_HASH6(&((struct sockaddr_in6 *)(src))->sin6_addr, \ 3310 ((struct sockaddr_in6 *)(src))->sin6_port, \ 3311 ((struct sockaddr_in6 *)(dst))->sin6_port); \ 3312 break; \ 3313 default: \ 3314 hash = 0; \ 3315 } \ 3316 } while (/*CONSTCOND*/0) 3317 #endif /* INET6 */ 3318 3319 #define SYN_CACHE_RM(sc) \ 3320 do { \ 3321 (sc)->sc_flags |= SCF_DEAD; \ 3322 TAILQ_REMOVE(&tcp_syn_cache[(sc)->sc_bucketidx].sch_bucket, \ 3323 (sc), sc_bucketq); \ 3324 (sc)->sc_tp = NULL; \ 3325 LIST_REMOVE((sc), sc_tpq); \ 3326 tcp_syn_cache[(sc)->sc_bucketidx].sch_length--; \ 3327 timeout_del(&(sc)->sc_timer); \ 3328 syn_cache_count--; \ 3329 } while (/*CONSTCOND*/0) 3330 3331 #define SYN_CACHE_PUT(sc) \ 3332 do { \ 3333 if ((sc)->sc_ipopts) \ 3334 (void) m_free((sc)->sc_ipopts); \ 3335 if ((sc)->sc_route4.ro_rt != NULL) \ 3336 RTFREE((sc)->sc_route4.ro_rt); \ 3337 timeout_set(&(sc)->sc_timer, syn_cache_reaper, (sc)); \ 3338 timeout_add(&(sc)->sc_timer, 0); \ 3339 } while (/*CONSTCOND*/0) 3340 3341 struct pool syn_cache_pool; 3342 3343 /* 3344 * We don't estimate RTT with SYNs, so each packet starts with the default 3345 * RTT and each timer step has a fixed timeout value. 3346 */ 3347 #define SYN_CACHE_TIMER_ARM(sc) \ 3348 do { \ 3349 TCPT_RANGESET((sc)->sc_rxtcur, \ 3350 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \ 3351 TCPTV_REXMTMAX); \ 3352 if (!timeout_initialized(&(sc)->sc_timer)) \ 3353 timeout_set(&(sc)->sc_timer, syn_cache_timer, (sc)); \ 3354 timeout_add(&(sc)->sc_timer, (sc)->sc_rxtcur * (hz / PR_SLOWHZ)); \ 3355 } while (/*CONSTCOND*/0) 3356 3357 #define SYN_CACHE_TIMESTAMP(sc) tcp_now + (sc)->sc_modulate 3358 3359 void 3360 syn_cache_init() 3361 { 3362 int i; 3363 3364 /* Initialize the hash buckets. */ 3365 for (i = 0; i < tcp_syn_cache_size; i++) 3366 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket); 3367 3368 /* Initialize the syn cache pool. */ 3369 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, 3370 "synpl", NULL); 3371 } 3372 3373 void 3374 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp) 3375 { 3376 struct syn_cache_head *scp; 3377 struct syn_cache *sc2; 3378 int s; 3379 3380 /* 3381 * If there are no entries in the hash table, reinitialize 3382 * the hash secrets. 3383 */ 3384 if (syn_cache_count == 0) { 3385 syn_hash1 = arc4random(); 3386 syn_hash2 = arc4random(); 3387 } 3388 3389 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa); 3390 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size; 3391 scp = &tcp_syn_cache[sc->sc_bucketidx]; 3392 3393 /* 3394 * Make sure that we don't overflow the per-bucket 3395 * limit or the total cache size limit. 3396 */ 3397 s = splsoftnet(); 3398 if (scp->sch_length >= tcp_syn_bucket_limit) { 3399 tcpstat.tcps_sc_bucketoverflow++; 3400 /* 3401 * The bucket is full. Toss the oldest element in the 3402 * bucket. This will be the first entry in the bucket. 3403 */ 3404 sc2 = TAILQ_FIRST(&scp->sch_bucket); 3405 #ifdef DIAGNOSTIC 3406 /* 3407 * This should never happen; we should always find an 3408 * entry in our bucket. 3409 */ 3410 if (sc2 == NULL) 3411 panic("syn_cache_insert: bucketoverflow: impossible"); 3412 #endif 3413 SYN_CACHE_RM(sc2); 3414 SYN_CACHE_PUT(sc2); 3415 } else if (syn_cache_count >= tcp_syn_cache_limit) { 3416 struct syn_cache_head *scp2, *sce; 3417 3418 tcpstat.tcps_sc_overflowed++; 3419 /* 3420 * The cache is full. Toss the oldest entry in the 3421 * first non-empty bucket we can find. 3422 * 3423 * XXX We would really like to toss the oldest 3424 * entry in the cache, but we hope that this 3425 * condition doesn't happen very often. 3426 */ 3427 scp2 = scp; 3428 if (TAILQ_EMPTY(&scp2->sch_bucket)) { 3429 sce = &tcp_syn_cache[tcp_syn_cache_size]; 3430 for (++scp2; scp2 != scp; scp2++) { 3431 if (scp2 >= sce) 3432 scp2 = &tcp_syn_cache[0]; 3433 if (! TAILQ_EMPTY(&scp2->sch_bucket)) 3434 break; 3435 } 3436 #ifdef DIAGNOSTIC 3437 /* 3438 * This should never happen; we should always find a 3439 * non-empty bucket. 3440 */ 3441 if (scp2 == scp) 3442 panic("syn_cache_insert: cacheoverflow: " 3443 "impossible"); 3444 #endif 3445 } 3446 sc2 = TAILQ_FIRST(&scp2->sch_bucket); 3447 SYN_CACHE_RM(sc2); 3448 SYN_CACHE_PUT(sc2); 3449 } 3450 3451 /* 3452 * Initialize the entry's timer. 3453 */ 3454 sc->sc_rxttot = 0; 3455 sc->sc_rxtshift = 0; 3456 SYN_CACHE_TIMER_ARM(sc); 3457 3458 /* Link it from tcpcb entry */ 3459 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 3460 3461 /* Put it into the bucket. */ 3462 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq); 3463 scp->sch_length++; 3464 syn_cache_count++; 3465 3466 tcpstat.tcps_sc_added++; 3467 splx(s); 3468 } 3469 3470 /* 3471 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 3472 * If we have retransmitted an entry the maximum number of times, expire 3473 * that entry. 3474 */ 3475 void 3476 syn_cache_timer(void *arg) 3477 { 3478 struct syn_cache *sc = arg; 3479 int s; 3480 3481 s = splsoftnet(); 3482 if (sc->sc_flags & SCF_DEAD) { 3483 splx(s); 3484 return; 3485 } 3486 3487 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) { 3488 /* Drop it -- too many retransmissions. */ 3489 goto dropit; 3490 } 3491 3492 /* 3493 * Compute the total amount of time this entry has 3494 * been on a queue. If this entry has been on longer 3495 * than the keep alive timer would allow, expire it. 3496 */ 3497 sc->sc_rxttot += sc->sc_rxtcur; 3498 if (sc->sc_rxttot >= tcptv_keep_init) 3499 goto dropit; 3500 3501 tcpstat.tcps_sc_retransmitted++; 3502 (void) syn_cache_respond(sc, NULL); 3503 3504 /* Advance the timer back-off. */ 3505 sc->sc_rxtshift++; 3506 SYN_CACHE_TIMER_ARM(sc); 3507 3508 splx(s); 3509 return; 3510 3511 dropit: 3512 tcpstat.tcps_sc_timed_out++; 3513 SYN_CACHE_RM(sc); 3514 SYN_CACHE_PUT(sc); 3515 splx(s); 3516 } 3517 3518 void 3519 syn_cache_reaper(void *arg) 3520 { 3521 struct syn_cache *sc = arg; 3522 int s; 3523 3524 s = splsoftnet(); 3525 pool_put(&syn_cache_pool, (sc)); 3526 splx(s); 3527 return; 3528 } 3529 3530 /* 3531 * Remove syn cache created by the specified tcb entry, 3532 * because this does not make sense to keep them 3533 * (if there's no tcb entry, syn cache entry will never be used) 3534 */ 3535 void 3536 syn_cache_cleanup(struct tcpcb *tp) 3537 { 3538 struct syn_cache *sc, *nsc; 3539 int s; 3540 3541 s = splsoftnet(); 3542 3543 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) { 3544 nsc = LIST_NEXT(sc, sc_tpq); 3545 3546 #ifdef DIAGNOSTIC 3547 if (sc->sc_tp != tp) 3548 panic("invalid sc_tp in syn_cache_cleanup"); 3549 #endif 3550 SYN_CACHE_RM(sc); 3551 SYN_CACHE_PUT(sc); 3552 } 3553 /* just for safety */ 3554 LIST_INIT(&tp->t_sc); 3555 3556 splx(s); 3557 } 3558 3559 /* 3560 * Find an entry in the syn cache. 3561 */ 3562 struct syn_cache * 3563 syn_cache_lookup(struct sockaddr *src, struct sockaddr *dst, 3564 struct syn_cache_head **headp, u_int rdomain) 3565 { 3566 struct syn_cache *sc; 3567 struct syn_cache_head *scp; 3568 u_int32_t hash; 3569 int s; 3570 3571 SYN_HASHALL(hash, src, dst); 3572 3573 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 3574 *headp = scp; 3575 s = splsoftnet(); 3576 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL; 3577 sc = TAILQ_NEXT(sc, sc_bucketq)) { 3578 if (sc->sc_hash != hash) 3579 continue; 3580 if (!bcmp(&sc->sc_src, src, src->sa_len) && 3581 !bcmp(&sc->sc_dst, dst, dst->sa_len) && 3582 rdomain == sc->sc_rdomain) { 3583 splx(s); 3584 return (sc); 3585 } 3586 } 3587 splx(s); 3588 return (NULL); 3589 } 3590 3591 /* 3592 * This function gets called when we receive an ACK for a 3593 * socket in the LISTEN state. We look up the connection 3594 * in the syn cache, and if its there, we pull it out of 3595 * the cache and turn it into a full-blown connection in 3596 * the SYN-RECEIVED state. 3597 * 3598 * The return values may not be immediately obvious, and their effects 3599 * can be subtle, so here they are: 3600 * 3601 * NULL SYN was not found in cache; caller should drop the 3602 * packet and send an RST. 3603 * 3604 * -1 We were unable to create the new connection, and are 3605 * aborting it. An ACK,RST is being sent to the peer 3606 * (unless we got screwey sequence numbners; see below), 3607 * because the 3-way handshake has been completed. Caller 3608 * should not free the mbuf, since we may be using it. If 3609 * we are not, we will free it. 3610 * 3611 * Otherwise, the return value is a pointer to the new socket 3612 * associated with the connection. 3613 */ 3614 struct socket * 3615 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3616 u_int hlen, u_int tlen, struct socket *so, struct mbuf *m) 3617 { 3618 struct syn_cache *sc; 3619 struct syn_cache_head *scp; 3620 struct inpcb *inp = NULL; 3621 struct tcpcb *tp = 0; 3622 struct mbuf *am; 3623 int s; 3624 struct socket *oso; 3625 3626 s = splsoftnet(); 3627 if ((sc = syn_cache_lookup(src, dst, &scp, 3628 m->m_pkthdr.rdomain)) == NULL) { 3629 splx(s); 3630 return (NULL); 3631 } 3632 3633 /* 3634 * Verify the sequence and ack numbers. Try getting the correct 3635 * response again. 3636 */ 3637 if ((th->th_ack != sc->sc_iss + 1) || 3638 SEQ_LEQ(th->th_seq, sc->sc_irs) || 3639 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 3640 (void) syn_cache_respond(sc, m); 3641 splx(s); 3642 return ((struct socket *)(-1)); 3643 } 3644 3645 /* Remove this cache entry */ 3646 SYN_CACHE_RM(sc); 3647 splx(s); 3648 3649 /* 3650 * Ok, create the full blown connection, and set things up 3651 * as they would have been set up if we had created the 3652 * connection when the SYN arrived. If we can't create 3653 * the connection, abort it. 3654 */ 3655 oso = so; 3656 so = sonewconn(so, SS_ISCONNECTED); 3657 if (so == NULL) 3658 goto resetandabort; 3659 3660 inp = sotoinpcb(oso); 3661 3662 #ifdef IPSEC 3663 /* 3664 * We need to copy the required security levels 3665 * from the old pcb. Ditto for any other 3666 * IPsec-related information. 3667 */ 3668 { 3669 struct inpcb *newinp = (struct inpcb *)so->so_pcb; 3670 bcopy(inp->inp_seclevel, newinp->inp_seclevel, 3671 sizeof(inp->inp_seclevel)); 3672 newinp->inp_secrequire = inp->inp_secrequire; 3673 if (inp->inp_ipo != NULL) { 3674 newinp->inp_ipo = inp->inp_ipo; 3675 inp->inp_ipo->ipo_ref_count++; 3676 } 3677 if (inp->inp_ipsec_remotecred != NULL) { 3678 newinp->inp_ipsec_remotecred = inp->inp_ipsec_remotecred; 3679 inp->inp_ipsec_remotecred->ref_count++; 3680 } 3681 if (inp->inp_ipsec_remoteauth != NULL) { 3682 newinp->inp_ipsec_remoteauth 3683 = inp->inp_ipsec_remoteauth; 3684 inp->inp_ipsec_remoteauth->ref_count++; 3685 } 3686 } 3687 #endif /* IPSEC */ 3688 #ifdef INET6 3689 /* 3690 * inp still has the OLD in_pcb stuff, set the 3691 * v6-related flags on the new guy, too. 3692 */ 3693 { 3694 int flags = inp->inp_flags; 3695 struct inpcb *oldinpcb = inp; 3696 3697 inp = (struct inpcb *)so->so_pcb; 3698 inp->inp_flags |= (flags & INP_IPV6); 3699 if ((inp->inp_flags & INP_IPV6) != 0) { 3700 inp->inp_ipv6.ip6_hlim = 3701 oldinpcb->inp_ipv6.ip6_hlim; 3702 } 3703 } 3704 #else /* INET6 */ 3705 inp = (struct inpcb *)so->so_pcb; 3706 #endif /* INET6 */ 3707 3708 /* inherit rdomain from listening socket */ 3709 inp->inp_rdomain = sc->sc_rdomain; 3710 3711 inp->inp_lport = th->th_dport; 3712 switch (src->sa_family) { 3713 #ifdef INET6 3714 case AF_INET6: 3715 inp->inp_laddr6 = ((struct sockaddr_in6 *)dst)->sin6_addr; 3716 break; 3717 #endif /* INET6 */ 3718 case AF_INET: 3719 3720 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr; 3721 inp->inp_options = ip_srcroute(); 3722 if (inp->inp_options == NULL) { 3723 inp->inp_options = sc->sc_ipopts; 3724 sc->sc_ipopts = NULL; 3725 } 3726 break; 3727 } 3728 in_pcbrehash(inp); 3729 3730 /* 3731 * Give the new socket our cached route reference. 3732 */ 3733 if (src->sa_family == AF_INET) 3734 inp->inp_route = sc->sc_route4; /* struct assignment */ 3735 #ifdef INET6 3736 else 3737 inp->inp_route6 = sc->sc_route6; 3738 #endif 3739 sc->sc_route4.ro_rt = NULL; 3740 3741 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 3742 if (am == NULL) 3743 goto resetandabort; 3744 am->m_len = src->sa_len; 3745 bcopy(src, mtod(am, caddr_t), src->sa_len); 3746 3747 switch (src->sa_family) { 3748 case AF_INET: 3749 /* drop IPv4 packet to AF_INET6 socket */ 3750 if (inp->inp_flags & INP_IPV6) { 3751 (void) m_free(am); 3752 goto resetandabort; 3753 } 3754 if (in_pcbconnect(inp, am)) { 3755 (void) m_free(am); 3756 goto resetandabort; 3757 } 3758 break; 3759 #ifdef INET6 3760 case AF_INET6: 3761 if (in6_pcbconnect(inp, am)) { 3762 (void) m_free(am); 3763 goto resetandabort; 3764 } 3765 break; 3766 #endif 3767 } 3768 (void) m_free(am); 3769 3770 tp = intotcpcb(inp); 3771 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY; 3772 if (sc->sc_request_r_scale != 15) { 3773 tp->requested_s_scale = sc->sc_requested_s_scale; 3774 tp->request_r_scale = sc->sc_request_r_scale; 3775 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE; 3776 } 3777 if (sc->sc_flags & SCF_TIMESTAMP) 3778 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP; 3779 3780 tp->t_template = tcp_template(tp); 3781 if (tp->t_template == 0) { 3782 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 3783 so = NULL; 3784 m_freem(m); 3785 goto abort; 3786 } 3787 #ifdef TCP_SACK 3788 tp->sack_enable = sc->sc_flags & SCF_SACK_PERMIT; 3789 #endif 3790 3791 tp->ts_modulate = sc->sc_modulate; 3792 tp->iss = sc->sc_iss; 3793 tp->irs = sc->sc_irs; 3794 tcp_sendseqinit(tp); 3795 #if defined (TCP_SACK) || defined(TCP_ECN) 3796 tp->snd_last = tp->snd_una; 3797 #endif /* TCP_SACK */ 3798 #if defined(TCP_SACK) && defined(TCP_FACK) 3799 tp->snd_fack = tp->snd_una; 3800 tp->retran_data = 0; 3801 tp->snd_awnd = 0; 3802 #endif /* TCP_FACK */ 3803 #ifdef TCP_ECN 3804 if (sc->sc_flags & SCF_ECN_PERMIT) { 3805 tp->t_flags |= TF_ECN_PERMIT; 3806 tcpstat.tcps_ecn_accepts++; 3807 } 3808 #endif 3809 #ifdef TCP_SACK 3810 if (sc->sc_flags & SCF_SACK_PERMIT) 3811 tp->t_flags |= TF_SACK_PERMIT; 3812 #endif 3813 #ifdef TCP_SIGNATURE 3814 if (sc->sc_flags & SCF_SIGNATURE) 3815 tp->t_flags |= TF_SIGNATURE; 3816 #endif 3817 tcp_rcvseqinit(tp); 3818 tp->t_state = TCPS_SYN_RECEIVED; 3819 tp->t_rcvtime = tcp_now; 3820 TCP_TIMER_ARM(tp, TCPT_KEEP, tcptv_keep_init); 3821 tcpstat.tcps_accepts++; 3822 3823 tcp_mss(tp, sc->sc_peermaxseg); /* sets t_maxseg */ 3824 if (sc->sc_peermaxseg) 3825 tcp_mss_update(tp); 3826 /* Reset initial window to 1 segment for retransmit */ 3827 if (sc->sc_rxtshift > 0) 3828 tp->snd_cwnd = tp->t_maxseg; 3829 tp->snd_wl1 = sc->sc_irs; 3830 tp->rcv_up = sc->sc_irs + 1; 3831 3832 /* 3833 * This is what whould have happened in tcp_output() when 3834 * the SYN,ACK was sent. 3835 */ 3836 tp->snd_up = tp->snd_una; 3837 tp->snd_max = tp->snd_nxt = tp->iss+1; 3838 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 3839 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 3840 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 3841 tp->last_ack_sent = tp->rcv_nxt; 3842 3843 tcpstat.tcps_sc_completed++; 3844 SYN_CACHE_PUT(sc); 3845 return (so); 3846 3847 resetandabort: 3848 tcp_respond(NULL, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, TH_RST); 3849 m_freem(m); 3850 abort: 3851 if (so != NULL) 3852 (void) soabort(so); 3853 SYN_CACHE_PUT(sc); 3854 tcpstat.tcps_sc_aborted++; 3855 return ((struct socket *)(-1)); 3856 } 3857 3858 /* 3859 * This function is called when we get a RST for a 3860 * non-existent connection, so that we can see if the 3861 * connection is in the syn cache. If it is, zap it. 3862 */ 3863 3864 void 3865 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3866 u_int rdomain) 3867 { 3868 struct syn_cache *sc; 3869 struct syn_cache_head *scp; 3870 int s = splsoftnet(); 3871 3872 if ((sc = syn_cache_lookup(src, dst, &scp, rdomain)) == NULL) { 3873 splx(s); 3874 return; 3875 } 3876 if (SEQ_LT(th->th_seq, sc->sc_irs) || 3877 SEQ_GT(th->th_seq, sc->sc_irs+1)) { 3878 splx(s); 3879 return; 3880 } 3881 SYN_CACHE_RM(sc); 3882 splx(s); 3883 tcpstat.tcps_sc_reset++; 3884 SYN_CACHE_PUT(sc); 3885 } 3886 3887 void 3888 syn_cache_unreach(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3889 u_int rdomain) 3890 { 3891 struct syn_cache *sc; 3892 struct syn_cache_head *scp; 3893 int s; 3894 3895 s = splsoftnet(); 3896 if ((sc = syn_cache_lookup(src, dst, &scp, rdomain)) == NULL) { 3897 splx(s); 3898 return; 3899 } 3900 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 3901 if (ntohl (th->th_seq) != sc->sc_iss) { 3902 splx(s); 3903 return; 3904 } 3905 3906 /* 3907 * If we've retransmitted 3 times and this is our second error, 3908 * we remove the entry. Otherwise, we allow it to continue on. 3909 * This prevents us from incorrectly nuking an entry during a 3910 * spurious network outage. 3911 * 3912 * See tcp_notify(). 3913 */ 3914 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 3915 sc->sc_flags |= SCF_UNREACH; 3916 splx(s); 3917 return; 3918 } 3919 3920 SYN_CACHE_RM(sc); 3921 splx(s); 3922 tcpstat.tcps_sc_unreach++; 3923 SYN_CACHE_PUT(sc); 3924 } 3925 3926 /* 3927 * Given a LISTEN socket and an inbound SYN request, add 3928 * this to the syn cache, and send back a segment: 3929 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 3930 * to the source. 3931 * 3932 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 3933 * Doing so would require that we hold onto the data and deliver it 3934 * to the application. However, if we are the target of a SYN-flood 3935 * DoS attack, an attacker could send data which would eventually 3936 * consume all available buffer space if it were ACKed. By not ACKing 3937 * the data, we avoid this DoS scenario. 3938 */ 3939 3940 int 3941 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3942 u_int iphlen, struct socket *so, struct mbuf *m, u_char *optp, int optlen, 3943 struct tcp_opt_info *oi, tcp_seq *issp) 3944 { 3945 struct tcpcb tb, *tp; 3946 long win; 3947 struct syn_cache *sc; 3948 struct syn_cache_head *scp; 3949 struct mbuf *ipopts; 3950 3951 tp = sototcpcb(so); 3952 3953 /* 3954 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 3955 * 3956 * Note this check is performed in tcp_input() very early on. 3957 */ 3958 3959 /* 3960 * Initialize some local state. 3961 */ 3962 win = sbspace(&so->so_rcv); 3963 if (win > TCP_MAXWIN) 3964 win = TCP_MAXWIN; 3965 3966 #ifdef TCP_SIGNATURE 3967 if (optp || (tp->t_flags & TF_SIGNATURE)) { 3968 #else 3969 if (optp) { 3970 #endif 3971 tb.pf = tp->pf; 3972 #ifdef TCP_SACK 3973 tb.sack_enable = tp->sack_enable; 3974 #endif 3975 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 3976 #ifdef TCP_SIGNATURE 3977 if (tp->t_flags & TF_SIGNATURE) 3978 tb.t_flags |= TF_SIGNATURE; 3979 #endif 3980 tb.t_state = TCPS_LISTEN; 3981 if (tcp_dooptions(&tb, optp, optlen, th, m, iphlen, oi)) 3982 return (0); 3983 } else 3984 tb.t_flags = 0; 3985 3986 switch (src->sa_family) { 3987 #ifdef INET 3988 case AF_INET: 3989 /* 3990 * Remember the IP options, if any. 3991 */ 3992 ipopts = ip_srcroute(); 3993 break; 3994 #endif 3995 default: 3996 ipopts = NULL; 3997 } 3998 3999 /* 4000 * See if we already have an entry for this connection. 4001 * If we do, resend the SYN,ACK. We do not count this 4002 * as a retransmission (XXX though maybe we should). 4003 */ 4004 if ((sc = syn_cache_lookup(src, dst, &scp, m->m_pkthdr.rdomain)) != 4005 NULL) { 4006 tcpstat.tcps_sc_dupesyn++; 4007 if (ipopts) { 4008 /* 4009 * If we were remembering a previous source route, 4010 * forget it and use the new one we've been given. 4011 */ 4012 if (sc->sc_ipopts) 4013 (void) m_free(sc->sc_ipopts); 4014 sc->sc_ipopts = ipopts; 4015 } 4016 sc->sc_timestamp = tb.ts_recent; 4017 if (syn_cache_respond(sc, m) == 0) { 4018 tcpstat.tcps_sndacks++; 4019 tcpstat.tcps_sndtotal++; 4020 } 4021 return (1); 4022 } 4023 4024 sc = pool_get(&syn_cache_pool, PR_NOWAIT); 4025 if (sc == NULL) { 4026 if (ipopts) 4027 (void) m_free(ipopts); 4028 return (0); 4029 } 4030 4031 /* 4032 * Fill in the cache, and put the necessary IP and TCP 4033 * options into the reply. 4034 */ 4035 bzero(sc, sizeof(struct syn_cache)); 4036 bzero(&sc->sc_timer, sizeof(sc->sc_timer)); 4037 bcopy(src, &sc->sc_src, src->sa_len); 4038 bcopy(dst, &sc->sc_dst, dst->sa_len); 4039 sc->sc_rdomain = m->m_pkthdr.rdomain; 4040 sc->sc_flags = 0; 4041 sc->sc_ipopts = ipopts; 4042 sc->sc_irs = th->th_seq; 4043 4044 sc->sc_iss = issp ? *issp : arc4random(); 4045 sc->sc_peermaxseg = oi->maxseg; 4046 sc->sc_ourmaxseg = tcp_mss_adv(m->m_flags & M_PKTHDR ? 4047 m->m_pkthdr.rcvif : NULL, sc->sc_src.sa.sa_family); 4048 sc->sc_win = win; 4049 sc->sc_timestamp = tb.ts_recent; 4050 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) == 4051 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) { 4052 sc->sc_flags |= SCF_TIMESTAMP; 4053 sc->sc_modulate = arc4random(); 4054 } 4055 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 4056 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 4057 sc->sc_requested_s_scale = tb.requested_s_scale; 4058 sc->sc_request_r_scale = 0; 4059 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 4060 TCP_MAXWIN << sc->sc_request_r_scale < 4061 so->so_rcv.sb_hiwat) 4062 sc->sc_request_r_scale++; 4063 } else { 4064 sc->sc_requested_s_scale = 15; 4065 sc->sc_request_r_scale = 15; 4066 } 4067 #ifdef TCP_ECN 4068 /* 4069 * if both ECE and CWR flag bits are set, peer is ECN capable. 4070 */ 4071 if (tcp_do_ecn && 4072 (th->th_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) 4073 sc->sc_flags |= SCF_ECN_PERMIT; 4074 #endif 4075 #ifdef TCP_SACK 4076 /* 4077 * Set SCF_SACK_PERMIT if peer did send a SACK_PERMITTED option 4078 * (i.e., if tcp_dooptions() did set TF_SACK_PERMIT). 4079 */ 4080 if (tb.sack_enable && (tb.t_flags & TF_SACK_PERMIT)) 4081 sc->sc_flags |= SCF_SACK_PERMIT; 4082 #endif 4083 #ifdef TCP_SIGNATURE 4084 if (tb.t_flags & TF_SIGNATURE) 4085 sc->sc_flags |= SCF_SIGNATURE; 4086 #endif 4087 sc->sc_tp = tp; 4088 if (syn_cache_respond(sc, m) == 0) { 4089 syn_cache_insert(sc, tp); 4090 tcpstat.tcps_sndacks++; 4091 tcpstat.tcps_sndtotal++; 4092 } else { 4093 SYN_CACHE_PUT(sc); 4094 tcpstat.tcps_sc_dropped++; 4095 } 4096 return (1); 4097 } 4098 4099 int 4100 syn_cache_respond(struct syn_cache *sc, struct mbuf *m) 4101 { 4102 struct route *ro; 4103 u_int8_t *optp; 4104 int optlen, error; 4105 u_int16_t tlen; 4106 struct ip *ip = NULL; 4107 #ifdef INET6 4108 struct ip6_hdr *ip6 = NULL; 4109 #endif 4110 struct tcphdr *th; 4111 u_int hlen; 4112 struct inpcb *inp; 4113 4114 switch (sc->sc_src.sa.sa_family) { 4115 case AF_INET: 4116 hlen = sizeof(struct ip); 4117 ro = &sc->sc_route4; 4118 break; 4119 #ifdef INET6 4120 case AF_INET6: 4121 hlen = sizeof(struct ip6_hdr); 4122 ro = (struct route *)&sc->sc_route6; 4123 break; 4124 #endif 4125 default: 4126 if (m) 4127 m_freem(m); 4128 return (EAFNOSUPPORT); 4129 } 4130 4131 /* Compute the size of the TCP options. */ 4132 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 4133 #ifdef TCP_SACK 4134 ((sc->sc_flags & SCF_SACK_PERMIT) ? 4 : 0) + 4135 #endif 4136 #ifdef TCP_SIGNATURE 4137 ((sc->sc_flags & SCF_SIGNATURE) ? TCPOLEN_SIGLEN : 0) + 4138 #endif 4139 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 4140 4141 tlen = hlen + sizeof(struct tcphdr) + optlen; 4142 4143 /* 4144 * Create the IP+TCP header from scratch. 4145 */ 4146 if (m) 4147 m_freem(m); 4148 #ifdef DIAGNOSTIC 4149 if (max_linkhdr + tlen > MCLBYTES) 4150 return (ENOBUFS); 4151 #endif 4152 MGETHDR(m, M_DONTWAIT, MT_DATA); 4153 if (m && max_linkhdr + tlen > MHLEN) { 4154 MCLGET(m, M_DONTWAIT); 4155 if ((m->m_flags & M_EXT) == 0) { 4156 m_freem(m); 4157 m = NULL; 4158 } 4159 } 4160 if (m == NULL) 4161 return (ENOBUFS); 4162 4163 /* Fixup the mbuf. */ 4164 m->m_data += max_linkhdr; 4165 m->m_len = m->m_pkthdr.len = tlen; 4166 m->m_pkthdr.rcvif = NULL; 4167 m->m_pkthdr.rdomain = sc->sc_rdomain; 4168 memset(mtod(m, u_char *), 0, tlen); 4169 4170 switch (sc->sc_src.sa.sa_family) { 4171 case AF_INET: 4172 ip = mtod(m, struct ip *); 4173 ip->ip_dst = sc->sc_src.sin.sin_addr; 4174 ip->ip_src = sc->sc_dst.sin.sin_addr; 4175 ip->ip_p = IPPROTO_TCP; 4176 th = (struct tcphdr *)(ip + 1); 4177 th->th_dport = sc->sc_src.sin.sin_port; 4178 th->th_sport = sc->sc_dst.sin.sin_port; 4179 break; 4180 #ifdef INET6 4181 case AF_INET6: 4182 ip6 = mtod(m, struct ip6_hdr *); 4183 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 4184 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 4185 ip6->ip6_nxt = IPPROTO_TCP; 4186 /* ip6_plen will be updated in ip6_output() */ 4187 th = (struct tcphdr *)(ip6 + 1); 4188 th->th_dport = sc->sc_src.sin6.sin6_port; 4189 th->th_sport = sc->sc_dst.sin6.sin6_port; 4190 break; 4191 #endif 4192 default: 4193 th = NULL; 4194 } 4195 4196 th->th_seq = htonl(sc->sc_iss); 4197 th->th_ack = htonl(sc->sc_irs + 1); 4198 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 4199 th->th_flags = TH_SYN|TH_ACK; 4200 #ifdef TCP_ECN 4201 /* Set ECE for SYN-ACK if peer supports ECN. */ 4202 if (tcp_do_ecn && (sc->sc_flags & SCF_ECN_PERMIT)) 4203 th->th_flags |= TH_ECE; 4204 #endif 4205 th->th_win = htons(sc->sc_win); 4206 /* th_sum already 0 */ 4207 /* th_urp already 0 */ 4208 4209 /* Tack on the TCP options. */ 4210 optp = (u_int8_t *)(th + 1); 4211 *optp++ = TCPOPT_MAXSEG; 4212 *optp++ = 4; 4213 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 4214 *optp++ = sc->sc_ourmaxseg & 0xff; 4215 4216 #ifdef TCP_SACK 4217 /* Include SACK_PERMIT_HDR option if peer has already done so. */ 4218 if (sc->sc_flags & SCF_SACK_PERMIT) { 4219 *((u_int32_t *)optp) = htonl(TCPOPT_SACK_PERMIT_HDR); 4220 optp += 4; 4221 } 4222 #endif 4223 4224 if (sc->sc_request_r_scale != 15) { 4225 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 4226 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 4227 sc->sc_request_r_scale); 4228 optp += 4; 4229 } 4230 4231 if (sc->sc_flags & SCF_TIMESTAMP) { 4232 u_int32_t *lp = (u_int32_t *)(optp); 4233 /* Form timestamp option as shown in appendix A of RFC 1323. */ 4234 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 4235 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc)); 4236 *lp = htonl(sc->sc_timestamp); 4237 optp += TCPOLEN_TSTAMP_APPA; 4238 } 4239 4240 #ifdef TCP_SIGNATURE 4241 if (sc->sc_flags & SCF_SIGNATURE) { 4242 union sockaddr_union src, dst; 4243 struct tdb *tdb; 4244 4245 bzero(&src, sizeof(union sockaddr_union)); 4246 bzero(&dst, sizeof(union sockaddr_union)); 4247 src.sa.sa_len = sc->sc_src.sa.sa_len; 4248 src.sa.sa_family = sc->sc_src.sa.sa_family; 4249 dst.sa.sa_len = sc->sc_dst.sa.sa_len; 4250 dst.sa.sa_family = sc->sc_dst.sa.sa_family; 4251 4252 switch (sc->sc_src.sa.sa_family) { 4253 case 0: /*default to PF_INET*/ 4254 #ifdef INET 4255 case AF_INET: 4256 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 4257 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 4258 break; 4259 #endif /* INET */ 4260 #ifdef INET6 4261 case AF_INET6: 4262 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 4263 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 4264 break; 4265 #endif /* INET6 */ 4266 } 4267 4268 tdb = gettdbbysrcdst(0, &src, &dst, IPPROTO_TCP); 4269 if (tdb == NULL) { 4270 if (m) 4271 m_freem(m); 4272 return (EPERM); 4273 } 4274 4275 /* Send signature option */ 4276 *(optp++) = TCPOPT_SIGNATURE; 4277 *(optp++) = TCPOLEN_SIGNATURE; 4278 4279 if (tcp_signature(tdb, sc->sc_src.sa.sa_family, m, th, 4280 hlen, 0, optp) < 0) { 4281 if (m) 4282 m_freem(m); 4283 return (EINVAL); 4284 } 4285 optp += 16; 4286 4287 /* Pad options list to the next 32 bit boundary and 4288 * terminate it. 4289 */ 4290 *optp++ = TCPOPT_NOP; 4291 *optp++ = TCPOPT_EOL; 4292 } 4293 #endif /* TCP_SIGNATURE */ 4294 4295 /* Compute the packet's checksum. */ 4296 switch (sc->sc_src.sa.sa_family) { 4297 case AF_INET: 4298 ip->ip_len = htons(tlen - hlen); 4299 th->th_sum = 0; 4300 th->th_sum = in_cksum(m, tlen); 4301 break; 4302 #ifdef INET6 4303 case AF_INET6: 4304 ip6->ip6_plen = htons(tlen - hlen); 4305 th->th_sum = 0; 4306 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 4307 break; 4308 #endif 4309 } 4310 4311 /* use IPsec policy and ttl from listening socket, on SYN ACK */ 4312 inp = sc->sc_tp ? sc->sc_tp->t_inpcb : NULL; 4313 4314 /* 4315 * Fill in some straggling IP bits. Note the stack expects 4316 * ip_len to be in host order, for convenience. 4317 */ 4318 switch (sc->sc_src.sa.sa_family) { 4319 #ifdef INET 4320 case AF_INET: 4321 ip->ip_len = htons(tlen); 4322 ip->ip_ttl = inp ? inp->inp_ip.ip_ttl : ip_defttl; 4323 /* XXX tos? */ 4324 break; 4325 #endif 4326 #ifdef INET6 4327 case AF_INET6: 4328 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 4329 ip6->ip6_vfc |= IPV6_VERSION; 4330 ip6->ip6_plen = htons(tlen - hlen); 4331 /* ip6_hlim will be initialized afterwards */ 4332 /* leave flowlabel = 0, it is legal and require no state mgmt */ 4333 break; 4334 #endif 4335 } 4336 4337 switch (sc->sc_src.sa.sa_family) { 4338 #ifdef INET 4339 case AF_INET: 4340 error = ip_output(m, sc->sc_ipopts, ro, 4341 (ip_mtudisc ? IP_MTUDISC : 0), 4342 (struct ip_moptions *)NULL, inp); 4343 break; 4344 #endif 4345 #ifdef INET6 4346 case AF_INET6: 4347 ip6->ip6_hlim = in6_selecthlim(NULL, 4348 ro->ro_rt ? ro->ro_rt->rt_ifp : NULL); 4349 4350 error = ip6_output(m, NULL /*XXX*/, (struct route_in6 *)ro, 0, 4351 (struct ip6_moptions *)0, NULL, NULL); 4352 break; 4353 #endif 4354 default: 4355 error = EAFNOSUPPORT; 4356 break; 4357 } 4358 return (error); 4359 } 4360