1 /* $OpenBSD: tcp_input.c,v 1.335 2017/01/10 09:01:18 mpi Exp $ */ 2 /* $NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/timeout.h> 80 #include <sys/kernel.h> 81 #include <sys/pool.h> 82 83 #include <net/if.h> 84 #include <net/if_var.h> 85 #include <net/route.h> 86 87 #include <netinet/in.h> 88 #include <netinet/ip.h> 89 #include <netinet/in_pcb.h> 90 #include <netinet/ip_var.h> 91 #include <netinet/tcp.h> 92 #include <netinet/tcp_fsm.h> 93 #include <netinet/tcp_seq.h> 94 #include <netinet/tcp_timer.h> 95 #include <netinet/tcp_var.h> 96 #include <netinet/tcpip.h> 97 #include <netinet/tcp_debug.h> 98 99 #if NPF > 0 100 #include <net/pfvar.h> 101 #endif 102 103 struct tcpiphdr tcp_saveti; 104 105 int tcp_mss_adv(struct mbuf *, int); 106 int tcp_flush_queue(struct tcpcb *); 107 108 #ifdef INET6 109 #include <netinet6/in6_var.h> 110 #include <netinet6/nd6.h> 111 112 struct tcpipv6hdr tcp_saveti6; 113 114 /* for the packet header length in the mbuf */ 115 #define M_PH_LEN(m) (((struct mbuf *)(m))->m_pkthdr.len) 116 #define M_V6_LEN(m) (M_PH_LEN(m) - sizeof(struct ip6_hdr)) 117 #define M_V4_LEN(m) (M_PH_LEN(m) - sizeof(struct ip)) 118 #endif /* INET6 */ 119 120 int tcprexmtthresh = 3; 121 int tcptv_keep_init = TCPTV_KEEP_INIT; 122 123 int tcp_rst_ppslim = 100; /* 100pps */ 124 int tcp_rst_ppslim_count = 0; 125 struct timeval tcp_rst_ppslim_last; 126 127 int tcp_ackdrop_ppslim = 100; /* 100pps */ 128 int tcp_ackdrop_ppslim_count = 0; 129 struct timeval tcp_ackdrop_ppslim_last; 130 131 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 132 133 /* for modulo comparisons of timestamps */ 134 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 135 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 136 137 /* for TCP SACK comparisons */ 138 #define SEQ_MIN(a,b) (SEQ_LT(a,b) ? (a) : (b)) 139 #define SEQ_MAX(a,b) (SEQ_GT(a,b) ? (a) : (b)) 140 141 /* 142 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. 143 */ 144 #ifdef INET6 145 #define ND6_HINT(tp) \ 146 do { \ 147 if (tp && tp->t_inpcb && (tp->t_inpcb->inp_flags & INP_IPV6) && \ 148 rtisvalid(tp->t_inpcb->inp_route6.ro_rt)) { \ 149 nd6_nud_hint(tp->t_inpcb->inp_route6.ro_rt); \ 150 } \ 151 } while (0) 152 #else 153 #define ND6_HINT(tp) 154 #endif 155 156 #ifdef TCP_ECN 157 /* 158 * ECN (Explicit Congestion Notification) support based on RFC3168 159 * implementation note: 160 * snd_last is used to track a recovery phase. 161 * when cwnd is reduced, snd_last is set to snd_max. 162 * while snd_last > snd_una, the sender is in a recovery phase and 163 * its cwnd should not be reduced again. 164 * snd_last follows snd_una when not in a recovery phase. 165 */ 166 #endif 167 168 /* 169 * Macro to compute ACK transmission behavior. Delay the ACK unless 170 * we have already delayed an ACK (must send an ACK every two segments). 171 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 172 * option is enabled or when the packet is coming from a loopback 173 * interface. 174 */ 175 #define TCP_SETUP_ACK(tp, tiflags, m) \ 176 do { \ 177 struct ifnet *ifp = NULL; \ 178 if (m && (m->m_flags & M_PKTHDR)) \ 179 ifp = if_get(m->m_pkthdr.ph_ifidx); \ 180 if ((tp)->t_flags & TF_DELACK || \ 181 (tcp_ack_on_push && (tiflags) & TH_PUSH) || \ 182 (ifp && (ifp->if_flags & IFF_LOOPBACK))) \ 183 tp->t_flags |= TF_ACKNOW; \ 184 else \ 185 TCP_SET_DELACK(tp); \ 186 if_put(ifp); \ 187 } while (0) 188 189 void syn_cache_put(struct syn_cache *); 190 void syn_cache_rm(struct syn_cache *); 191 int syn_cache_respond(struct syn_cache *, struct mbuf *); 192 void syn_cache_timer(void *); 193 void syn_cache_reaper(void *); 194 void syn_cache_insert(struct syn_cache *, struct tcpcb *); 195 void syn_cache_reset(struct sockaddr *, struct sockaddr *, 196 struct tcphdr *, u_int); 197 int syn_cache_add(struct sockaddr *, struct sockaddr *, struct tcphdr *, 198 unsigned int, struct socket *, struct mbuf *, u_char *, int, 199 struct tcp_opt_info *, tcp_seq *); 200 struct socket *syn_cache_get(struct sockaddr *, struct sockaddr *, 201 struct tcphdr *, unsigned int, unsigned int, struct socket *, 202 struct mbuf *); 203 struct syn_cache *syn_cache_lookup(struct sockaddr *, struct sockaddr *, 204 struct syn_cache_head **, u_int); 205 206 /* 207 * Insert segment ti into reassembly queue of tcp with 208 * control block tp. Return TH_FIN if reassembly now includes 209 * a segment with FIN. The macro form does the common case inline 210 * (segment is the next to be received on an established connection, 211 * and the queue is empty), avoiding linkage into and removal 212 * from the queue and repetition of various conversions. 213 * Set DELACK for segments received in order, but ack immediately 214 * when segments are out of order (so fast retransmit can work). 215 */ 216 217 int 218 tcp_reass(struct tcpcb *tp, struct tcphdr *th, struct mbuf *m, int *tlen) 219 { 220 struct tcpqent *p, *q, *nq, *tiqe; 221 222 /* 223 * Allocate a new queue entry, before we throw away any data. 224 * If we can't, just drop the packet. XXX 225 */ 226 tiqe = pool_get(&tcpqe_pool, PR_NOWAIT); 227 if (tiqe == NULL) { 228 tiqe = TAILQ_LAST(&tp->t_segq, tcpqehead); 229 if (tiqe != NULL && th->th_seq == tp->rcv_nxt) { 230 /* Reuse last entry since new segment fills a hole */ 231 m_freem(tiqe->tcpqe_m); 232 TAILQ_REMOVE(&tp->t_segq, tiqe, tcpqe_q); 233 } 234 if (tiqe == NULL || th->th_seq != tp->rcv_nxt) { 235 /* Flush segment queue for this connection */ 236 tcp_freeq(tp); 237 tcpstat.tcps_rcvmemdrop++; 238 m_freem(m); 239 return (0); 240 } 241 } 242 243 /* 244 * Find a segment which begins after this one does. 245 */ 246 for (p = NULL, q = TAILQ_FIRST(&tp->t_segq); q != NULL; 247 p = q, q = TAILQ_NEXT(q, tcpqe_q)) 248 if (SEQ_GT(q->tcpqe_tcp->th_seq, th->th_seq)) 249 break; 250 251 /* 252 * If there is a preceding segment, it may provide some of 253 * our data already. If so, drop the data from the incoming 254 * segment. If it provides all of our data, drop us. 255 */ 256 if (p != NULL) { 257 struct tcphdr *phdr = p->tcpqe_tcp; 258 int i; 259 260 /* conversion to int (in i) handles seq wraparound */ 261 i = phdr->th_seq + phdr->th_reseqlen - th->th_seq; 262 if (i > 0) { 263 if (i >= *tlen) { 264 tcpstat.tcps_rcvduppack++; 265 tcpstat.tcps_rcvdupbyte += *tlen; 266 m_freem(m); 267 pool_put(&tcpqe_pool, tiqe); 268 return (0); 269 } 270 m_adj(m, i); 271 *tlen -= i; 272 th->th_seq += i; 273 } 274 } 275 tcpstat.tcps_rcvoopack++; 276 tcpstat.tcps_rcvoobyte += *tlen; 277 278 /* 279 * While we overlap succeeding segments trim them or, 280 * if they are completely covered, dequeue them. 281 */ 282 for (; q != NULL; q = nq) { 283 struct tcphdr *qhdr = q->tcpqe_tcp; 284 int i = (th->th_seq + *tlen) - qhdr->th_seq; 285 286 if (i <= 0) 287 break; 288 if (i < qhdr->th_reseqlen) { 289 qhdr->th_seq += i; 290 qhdr->th_reseqlen -= i; 291 m_adj(q->tcpqe_m, i); 292 break; 293 } 294 nq = TAILQ_NEXT(q, tcpqe_q); 295 m_freem(q->tcpqe_m); 296 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 297 pool_put(&tcpqe_pool, q); 298 } 299 300 /* Insert the new segment queue entry into place. */ 301 tiqe->tcpqe_m = m; 302 th->th_reseqlen = *tlen; 303 tiqe->tcpqe_tcp = th; 304 if (p == NULL) { 305 TAILQ_INSERT_HEAD(&tp->t_segq, tiqe, tcpqe_q); 306 } else { 307 TAILQ_INSERT_AFTER(&tp->t_segq, p, tiqe, tcpqe_q); 308 } 309 310 if (th->th_seq != tp->rcv_nxt) 311 return (0); 312 313 return (tcp_flush_queue(tp)); 314 } 315 316 int 317 tcp_flush_queue(struct tcpcb *tp) 318 { 319 struct socket *so = tp->t_inpcb->inp_socket; 320 struct tcpqent *q, *nq; 321 int flags; 322 323 /* 324 * Present data to user, advancing rcv_nxt through 325 * completed sequence space. 326 */ 327 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 328 return (0); 329 q = TAILQ_FIRST(&tp->t_segq); 330 if (q == NULL || q->tcpqe_tcp->th_seq != tp->rcv_nxt) 331 return (0); 332 if (tp->t_state == TCPS_SYN_RECEIVED && q->tcpqe_tcp->th_reseqlen) 333 return (0); 334 do { 335 tp->rcv_nxt += q->tcpqe_tcp->th_reseqlen; 336 flags = q->tcpqe_tcp->th_flags & TH_FIN; 337 338 nq = TAILQ_NEXT(q, tcpqe_q); 339 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 340 ND6_HINT(tp); 341 if (so->so_state & SS_CANTRCVMORE) 342 m_freem(q->tcpqe_m); 343 else 344 sbappendstream(&so->so_rcv, q->tcpqe_m); 345 pool_put(&tcpqe_pool, q); 346 q = nq; 347 } while (q != NULL && q->tcpqe_tcp->th_seq == tp->rcv_nxt); 348 tp->t_flags |= TF_BLOCKOUTPUT; 349 sorwakeup(so); 350 tp->t_flags &= ~TF_BLOCKOUTPUT; 351 return (flags); 352 } 353 354 #ifdef INET6 355 int 356 tcp6_input(struct mbuf **mp, int *offp, int proto) 357 { 358 struct mbuf *m = *mp; 359 360 tcp_input(m, *offp, proto); 361 return IPPROTO_DONE; 362 } 363 #endif 364 365 /* 366 * TCP input routine, follows pages 65-76 of the 367 * protocol specification dated September, 1981 very closely. 368 */ 369 void 370 tcp_input(struct mbuf *m, ...) 371 { 372 struct ip *ip; 373 struct inpcb *inp = NULL; 374 u_int8_t *optp = NULL; 375 int optlen = 0; 376 int tlen, off; 377 struct tcpcb *tp = NULL; 378 int tiflags; 379 struct socket *so = NULL; 380 int todrop, acked, ourfinisacked; 381 int hdroptlen = 0; 382 short ostate = 0; 383 tcp_seq iss, *reuse = NULL; 384 u_long tiwin; 385 struct tcp_opt_info opti; 386 int iphlen; 387 va_list ap; 388 struct tcphdr *th; 389 #ifdef INET6 390 struct ip6_hdr *ip6 = NULL; 391 #endif /* INET6 */ 392 #ifdef IPSEC 393 struct m_tag *mtag; 394 struct tdb_ident *tdbi; 395 struct tdb *tdb; 396 int error; 397 #endif /* IPSEC */ 398 int af; 399 #ifdef TCP_ECN 400 u_char iptos; 401 #endif 402 403 va_start(ap, m); 404 iphlen = va_arg(ap, int); 405 va_end(ap); 406 407 tcpstat.tcps_rcvtotal++; 408 409 opti.ts_present = 0; 410 opti.maxseg = 0; 411 412 /* 413 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 414 */ 415 if (m->m_flags & (M_BCAST|M_MCAST)) 416 goto drop; 417 418 /* 419 * Before we do ANYTHING, we have to figure out if it's TCP/IPv6 or 420 * TCP/IPv4. 421 */ 422 switch (mtod(m, struct ip *)->ip_v) { 423 #ifdef INET6 424 case 6: 425 af = AF_INET6; 426 break; 427 #endif 428 case 4: 429 af = AF_INET; 430 break; 431 default: 432 m_freem(m); 433 return; /*EAFNOSUPPORT*/ 434 } 435 436 /* 437 * Get IP and TCP header together in first mbuf. 438 * Note: IP leaves IP header in first mbuf. 439 */ 440 switch (af) { 441 case AF_INET: 442 #ifdef DIAGNOSTIC 443 if (iphlen < sizeof(struct ip)) { 444 m_freem(m); 445 return; 446 } 447 #endif /* DIAGNOSTIC */ 448 break; 449 #ifdef INET6 450 case AF_INET6: 451 #ifdef DIAGNOSTIC 452 if (iphlen < sizeof(struct ip6_hdr)) { 453 m_freem(m); 454 return; 455 } 456 #endif /* DIAGNOSTIC */ 457 break; 458 #endif 459 default: 460 m_freem(m); 461 return; 462 } 463 464 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, sizeof(*th)); 465 if (!th) { 466 tcpstat.tcps_rcvshort++; 467 return; 468 } 469 470 tlen = m->m_pkthdr.len - iphlen; 471 ip = NULL; 472 #ifdef INET6 473 ip6 = NULL; 474 #endif 475 switch (af) { 476 case AF_INET: 477 ip = mtod(m, struct ip *); 478 #ifdef TCP_ECN 479 /* save ip_tos before clearing it for checksum */ 480 iptos = ip->ip_tos; 481 #endif 482 break; 483 #ifdef INET6 484 case AF_INET6: 485 ip6 = mtod(m, struct ip6_hdr *); 486 #ifdef TCP_ECN 487 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 488 #endif 489 490 /* Be proactive about malicious use of IPv4 mapped address */ 491 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 492 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 493 /* XXX stat */ 494 goto drop; 495 } 496 497 /* 498 * Be proactive about unspecified IPv6 address in source. 499 * As we use all-zero to indicate unbounded/unconnected pcb, 500 * unspecified IPv6 address can be used to confuse us. 501 * 502 * Note that packets with unspecified IPv6 destination is 503 * already dropped in ip6_input. 504 */ 505 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 506 /* XXX stat */ 507 goto drop; 508 } 509 510 /* Discard packets to multicast */ 511 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 512 /* XXX stat */ 513 goto drop; 514 } 515 break; 516 #endif 517 } 518 519 /* 520 * Checksum extended TCP header and data. 521 */ 522 if ((m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_OK) == 0) { 523 int sum; 524 525 if (m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_BAD) { 526 tcpstat.tcps_rcvbadsum++; 527 goto drop; 528 } 529 tcpstat.tcps_inswcsum++; 530 switch (af) { 531 case AF_INET: 532 sum = in4_cksum(m, IPPROTO_TCP, iphlen, tlen); 533 break; 534 #ifdef INET6 535 case AF_INET6: 536 sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr), 537 tlen); 538 break; 539 #endif 540 } 541 if (sum != 0) { 542 tcpstat.tcps_rcvbadsum++; 543 goto drop; 544 } 545 } 546 547 /* 548 * Check that TCP offset makes sense, 549 * pull out TCP options and adjust length. XXX 550 */ 551 off = th->th_off << 2; 552 if (off < sizeof(struct tcphdr) || off > tlen) { 553 tcpstat.tcps_rcvbadoff++; 554 goto drop; 555 } 556 tlen -= off; 557 if (off > sizeof(struct tcphdr)) { 558 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, off); 559 if (!th) { 560 tcpstat.tcps_rcvshort++; 561 return; 562 } 563 optlen = off - sizeof(struct tcphdr); 564 optp = (u_int8_t *)(th + 1); 565 /* 566 * Do quick retrieval of timestamp options ("options 567 * prediction?"). If timestamp is the only option and it's 568 * formatted as recommended in RFC 1323 appendix A, we 569 * quickly get the values now and not bother calling 570 * tcp_dooptions(), etc. 571 */ 572 if ((optlen == TCPOLEN_TSTAMP_APPA || 573 (optlen > TCPOLEN_TSTAMP_APPA && 574 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 575 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 576 (th->th_flags & TH_SYN) == 0) { 577 opti.ts_present = 1; 578 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 579 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 580 optp = NULL; /* we've parsed the options */ 581 } 582 } 583 tiflags = th->th_flags; 584 585 /* 586 * Convert TCP protocol specific fields to host format. 587 */ 588 th->th_seq = ntohl(th->th_seq); 589 th->th_ack = ntohl(th->th_ack); 590 th->th_win = ntohs(th->th_win); 591 th->th_urp = ntohs(th->th_urp); 592 593 /* 594 * Locate pcb for segment. 595 */ 596 #if NPF > 0 597 inp = pf_inp_lookup(m); 598 #endif 599 findpcb: 600 if (inp == NULL) { 601 switch (af) { 602 #ifdef INET6 603 case AF_INET6: 604 inp = in6_pcbhashlookup(&tcbtable, &ip6->ip6_src, 605 th->th_sport, &ip6->ip6_dst, th->th_dport, 606 m->m_pkthdr.ph_rtableid); 607 break; 608 #endif 609 case AF_INET: 610 inp = in_pcbhashlookup(&tcbtable, ip->ip_src, 611 th->th_sport, ip->ip_dst, th->th_dport, 612 m->m_pkthdr.ph_rtableid); 613 break; 614 } 615 } 616 if (inp == NULL) { 617 int inpl_reverse = 0; 618 if (m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) 619 inpl_reverse = 1; 620 ++tcpstat.tcps_pcbhashmiss; 621 switch (af) { 622 #ifdef INET6 623 case AF_INET6: 624 inp = in6_pcblookup_listen(&tcbtable, 625 &ip6->ip6_dst, th->th_dport, inpl_reverse, m, 626 m->m_pkthdr.ph_rtableid); 627 break; 628 #endif /* INET6 */ 629 case AF_INET: 630 inp = in_pcblookup_listen(&tcbtable, 631 ip->ip_dst, th->th_dport, inpl_reverse, m, 632 m->m_pkthdr.ph_rtableid); 633 break; 634 } 635 /* 636 * If the state is CLOSED (i.e., TCB does not exist) then 637 * all data in the incoming segment is discarded. 638 * If the TCB exists but is in CLOSED state, it is embryonic, 639 * but should either do a listen or a connect soon. 640 */ 641 if (inp == NULL) { 642 ++tcpstat.tcps_noport; 643 goto dropwithreset_ratelim; 644 } 645 } 646 KASSERT(sotoinpcb(inp->inp_socket) == inp); 647 KASSERT(intotcpcb(inp) == NULL || intotcpcb(inp)->t_inpcb == inp); 648 649 /* Check the minimum TTL for socket. */ 650 switch (af) { 651 case AF_INET: 652 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) 653 goto drop; 654 break; 655 #ifdef INET6 656 case AF_INET6: 657 if (inp->inp_ip6_minhlim && 658 inp->inp_ip6_minhlim > ip6->ip6_hlim) 659 goto drop; 660 break; 661 #endif 662 } 663 664 tp = intotcpcb(inp); 665 if (tp == NULL) 666 goto dropwithreset_ratelim; 667 if (tp->t_state == TCPS_CLOSED) 668 goto drop; 669 670 /* Unscale the window into a 32-bit value. */ 671 if ((tiflags & TH_SYN) == 0) 672 tiwin = th->th_win << tp->snd_scale; 673 else 674 tiwin = th->th_win; 675 676 so = inp->inp_socket; 677 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 678 union syn_cache_sa src; 679 union syn_cache_sa dst; 680 681 bzero(&src, sizeof(src)); 682 bzero(&dst, sizeof(dst)); 683 switch (af) { 684 case AF_INET: 685 src.sin.sin_len = sizeof(struct sockaddr_in); 686 src.sin.sin_family = AF_INET; 687 src.sin.sin_addr = ip->ip_src; 688 src.sin.sin_port = th->th_sport; 689 690 dst.sin.sin_len = sizeof(struct sockaddr_in); 691 dst.sin.sin_family = AF_INET; 692 dst.sin.sin_addr = ip->ip_dst; 693 dst.sin.sin_port = th->th_dport; 694 break; 695 #ifdef INET6 696 case AF_INET6: 697 src.sin6.sin6_len = sizeof(struct sockaddr_in6); 698 src.sin6.sin6_family = AF_INET6; 699 src.sin6.sin6_addr = ip6->ip6_src; 700 src.sin6.sin6_port = th->th_sport; 701 702 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 703 dst.sin6.sin6_family = AF_INET6; 704 dst.sin6.sin6_addr = ip6->ip6_dst; 705 dst.sin6.sin6_port = th->th_dport; 706 break; 707 #endif /* INET6 */ 708 default: 709 goto badsyn; /*sanity*/ 710 } 711 712 if (so->so_options & SO_DEBUG) { 713 ostate = tp->t_state; 714 switch (af) { 715 #ifdef INET6 716 case AF_INET6: 717 memcpy(&tcp_saveti6.ti6_i, ip6, sizeof(*ip6)); 718 memcpy(&tcp_saveti6.ti6_t, th, sizeof(*th)); 719 break; 720 #endif 721 case AF_INET: 722 memcpy(&tcp_saveti.ti_i, ip, sizeof(*ip)); 723 memcpy(&tcp_saveti.ti_t, th, sizeof(*th)); 724 break; 725 } 726 } 727 if (so->so_options & SO_ACCEPTCONN) { 728 switch (tiflags & (TH_RST|TH_SYN|TH_ACK)) { 729 730 case TH_SYN|TH_ACK|TH_RST: 731 case TH_SYN|TH_RST: 732 case TH_ACK|TH_RST: 733 case TH_RST: 734 syn_cache_reset(&src.sa, &dst.sa, th, 735 inp->inp_rtableid); 736 goto drop; 737 738 case TH_SYN|TH_ACK: 739 /* 740 * Received a SYN,ACK. This should 741 * never happen while we are in 742 * LISTEN. Send an RST. 743 */ 744 goto badsyn; 745 746 case TH_ACK: 747 so = syn_cache_get(&src.sa, &dst.sa, 748 th, iphlen, tlen, so, m); 749 if (so == NULL) { 750 /* 751 * We don't have a SYN for 752 * this ACK; send an RST. 753 */ 754 goto badsyn; 755 } else if (so == (struct socket *)(-1)) { 756 /* 757 * We were unable to create 758 * the connection. If the 759 * 3-way handshake was 760 * completed, and RST has 761 * been sent to the peer. 762 * Since the mbuf might be 763 * in use for the reply, 764 * do not free it. 765 */ 766 m = NULL; 767 goto drop; 768 } else { 769 /* 770 * We have created a 771 * full-blown connection. 772 */ 773 tp = NULL; 774 inp = sotoinpcb(so); 775 tp = intotcpcb(inp); 776 if (tp == NULL) 777 goto badsyn; /*XXX*/ 778 779 } 780 break; 781 782 default: 783 /* 784 * None of RST, SYN or ACK was set. 785 * This is an invalid packet for a 786 * TCB in LISTEN state. Send a RST. 787 */ 788 goto badsyn; 789 790 case TH_SYN: 791 /* 792 * Received a SYN. 793 */ 794 #ifdef INET6 795 /* 796 * If deprecated address is forbidden, we do 797 * not accept SYN to deprecated interface 798 * address to prevent any new inbound 799 * connection from getting established. 800 * When we do not accept SYN, we send a TCP 801 * RST, with deprecated source address (instead 802 * of dropping it). We compromise it as it is 803 * much better for peer to send a RST, and 804 * RST will be the final packet for the 805 * exchange. 806 * 807 * If we do not forbid deprecated addresses, we 808 * accept the SYN packet. RFC2462 does not 809 * suggest dropping SYN in this case. 810 * If we decipher RFC2462 5.5.4, it says like 811 * this: 812 * 1. use of deprecated addr with existing 813 * communication is okay - "SHOULD continue 814 * to be used" 815 * 2. use of it with new communication: 816 * (2a) "SHOULD NOT be used if alternate 817 * address with sufficient scope is 818 * available" 819 * (2b) nothing mentioned otherwise. 820 * Here we fall into (2b) case as we have no 821 * choice in our source address selection - we 822 * must obey the peer. 823 * 824 * The wording in RFC2462 is confusing, and 825 * there are multiple description text for 826 * deprecated address handling - worse, they 827 * are not exactly the same. I believe 5.5.4 828 * is the best one, so we follow 5.5.4. 829 */ 830 if (ip6 && !ip6_use_deprecated) { 831 struct in6_ifaddr *ia6; 832 struct ifnet *ifp = 833 if_get(m->m_pkthdr.ph_ifidx); 834 835 if (ifp && 836 (ia6 = in6ifa_ifpwithaddr(ifp, 837 &ip6->ip6_dst)) && 838 (ia6->ia6_flags & 839 IN6_IFF_DEPRECATED)) { 840 tp = NULL; 841 if_put(ifp); 842 goto dropwithreset; 843 } 844 if_put(ifp); 845 } 846 #endif 847 848 /* 849 * LISTEN socket received a SYN 850 * from itself? This can't possibly 851 * be valid; drop the packet. 852 */ 853 if (th->th_dport == th->th_sport) { 854 switch (af) { 855 #ifdef INET6 856 case AF_INET6: 857 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, 858 &ip6->ip6_dst)) { 859 tcpstat.tcps_badsyn++; 860 goto drop; 861 } 862 break; 863 #endif /* INET6 */ 864 case AF_INET: 865 if (ip->ip_dst.s_addr == ip->ip_src.s_addr) { 866 tcpstat.tcps_badsyn++; 867 goto drop; 868 } 869 break; 870 } 871 } 872 873 /* 874 * SYN looks ok; create compressed TCP 875 * state for it. 876 */ 877 if (so->so_qlen > so->so_qlimit || 878 syn_cache_add(&src.sa, &dst.sa, th, iphlen, 879 so, m, optp, optlen, &opti, reuse) == -1) { 880 tcpstat.tcps_dropsyn++; 881 goto drop; 882 } 883 return; 884 } 885 } 886 } 887 888 #ifdef DIAGNOSTIC 889 /* 890 * Should not happen now that all embryonic connections 891 * are handled with compressed state. 892 */ 893 if (tp->t_state == TCPS_LISTEN) 894 panic("tcp_input: TCPS_LISTEN"); 895 #endif 896 897 #if NPF > 0 898 pf_inp_link(m, inp); 899 #endif 900 901 #ifdef IPSEC 902 /* Find most recent IPsec tag */ 903 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 904 if (mtag != NULL) { 905 tdbi = (struct tdb_ident *)(mtag + 1); 906 tdb = gettdb(tdbi->rdomain, tdbi->spi, 907 &tdbi->dst, tdbi->proto); 908 } else 909 tdb = NULL; 910 ipsp_spd_lookup(m, af, iphlen, &error, IPSP_DIRECTION_IN, 911 tdb, inp, 0); 912 if (error) { 913 tcpstat.tcps_rcvnosec++; 914 goto drop; 915 } 916 #endif /* IPSEC */ 917 918 /* 919 * Segment received on connection. 920 * Reset idle time and keep-alive timer. 921 */ 922 tp->t_rcvtime = tcp_now; 923 if (TCPS_HAVEESTABLISHED(tp->t_state)) 924 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 925 926 #ifdef TCP_SACK 927 if (tp->sack_enable) 928 tcp_del_sackholes(tp, th); /* Delete stale SACK holes */ 929 #endif /* TCP_SACK */ 930 931 /* 932 * Process options. 933 */ 934 #ifdef TCP_SIGNATURE 935 if (optp || (tp->t_flags & TF_SIGNATURE)) 936 #else 937 if (optp) 938 #endif 939 if (tcp_dooptions(tp, optp, optlen, th, m, iphlen, &opti, 940 m->m_pkthdr.ph_rtableid)) 941 goto drop; 942 943 if (opti.ts_present && opti.ts_ecr) { 944 int rtt_test; 945 946 /* subtract out the tcp timestamp modulator */ 947 opti.ts_ecr -= tp->ts_modulate; 948 949 /* make sure ts_ecr is sensible */ 950 rtt_test = tcp_now - opti.ts_ecr; 951 if (rtt_test < 0 || rtt_test > TCP_RTT_MAX) 952 opti.ts_ecr = 0; 953 } 954 955 #ifdef TCP_ECN 956 /* if congestion experienced, set ECE bit in subsequent packets. */ 957 if ((iptos & IPTOS_ECN_MASK) == IPTOS_ECN_CE) { 958 tp->t_flags |= TF_RCVD_CE; 959 tcpstat.tcps_ecn_rcvce++; 960 } 961 #endif 962 /* 963 * Header prediction: check for the two common cases 964 * of a uni-directional data xfer. If the packet has 965 * no control flags, is in-sequence, the window didn't 966 * change and we're not retransmitting, it's a 967 * candidate. If the length is zero and the ack moved 968 * forward, we're the sender side of the xfer. Just 969 * free the data acked & wake any higher level process 970 * that was blocked waiting for space. If the length 971 * is non-zero and the ack didn't move, we're the 972 * receiver side. If we're getting packets in-order 973 * (the reassembly queue is empty), add the data to 974 * the socket buffer and note that we need a delayed ack. 975 */ 976 if (tp->t_state == TCPS_ESTABLISHED && 977 #ifdef TCP_ECN 978 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK)) == TH_ACK && 979 #else 980 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 981 #endif 982 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 983 th->th_seq == tp->rcv_nxt && 984 tiwin && tiwin == tp->snd_wnd && 985 tp->snd_nxt == tp->snd_max) { 986 987 /* 988 * If last ACK falls within this segment's sequence numbers, 989 * record the timestamp. 990 * Fix from Braden, see Stevens p. 870 991 */ 992 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 993 tp->ts_recent_age = tcp_now; 994 tp->ts_recent = opti.ts_val; 995 } 996 997 if (tlen == 0) { 998 if (SEQ_GT(th->th_ack, tp->snd_una) && 999 SEQ_LEQ(th->th_ack, tp->snd_max) && 1000 tp->snd_cwnd >= tp->snd_wnd && 1001 tp->t_dupacks == 0) { 1002 /* 1003 * this is a pure ack for outstanding data. 1004 */ 1005 ++tcpstat.tcps_predack; 1006 if (opti.ts_present && opti.ts_ecr) 1007 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 1008 else if (tp->t_rtttime && 1009 SEQ_GT(th->th_ack, tp->t_rtseq)) 1010 tcp_xmit_timer(tp, 1011 tcp_now - tp->t_rtttime); 1012 acked = th->th_ack - tp->snd_una; 1013 tcpstat.tcps_rcvackpack++; 1014 tcpstat.tcps_rcvackbyte += acked; 1015 ND6_HINT(tp); 1016 sbdrop(&so->so_snd, acked); 1017 1018 /* 1019 * If we had a pending ICMP message that 1020 * refers to data that have just been 1021 * acknowledged, disregard the recorded ICMP 1022 * message. 1023 */ 1024 if ((tp->t_flags & TF_PMTUD_PEND) && 1025 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 1026 tp->t_flags &= ~TF_PMTUD_PEND; 1027 1028 /* 1029 * Keep track of the largest chunk of data 1030 * acknowledged since last PMTU update 1031 */ 1032 if (tp->t_pmtud_mss_acked < acked) 1033 tp->t_pmtud_mss_acked = acked; 1034 1035 tp->snd_una = th->th_ack; 1036 #if defined(TCP_SACK) || defined(TCP_ECN) 1037 /* 1038 * We want snd_last to track snd_una so 1039 * as to avoid sequence wraparound problems 1040 * for very large transfers. 1041 */ 1042 #ifdef TCP_ECN 1043 if (SEQ_GT(tp->snd_una, tp->snd_last)) 1044 #endif 1045 tp->snd_last = tp->snd_una; 1046 #endif /* TCP_SACK */ 1047 #if defined(TCP_SACK) && defined(TCP_FACK) 1048 tp->snd_fack = tp->snd_una; 1049 tp->retran_data = 0; 1050 #endif /* TCP_FACK */ 1051 m_freem(m); 1052 1053 /* 1054 * If all outstanding data are acked, stop 1055 * retransmit timer, otherwise restart timer 1056 * using current (possibly backed-off) value. 1057 * If process is waiting for space, 1058 * wakeup/selwakeup/signal. If data 1059 * are ready to send, let tcp_output 1060 * decide between more output or persist. 1061 */ 1062 if (tp->snd_una == tp->snd_max) 1063 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1064 else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1065 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1066 1067 tcp_update_sndspace(tp); 1068 if (sb_notify(&so->so_snd)) { 1069 tp->t_flags |= TF_BLOCKOUTPUT; 1070 sowwakeup(so); 1071 tp->t_flags &= ~TF_BLOCKOUTPUT; 1072 } 1073 if (so->so_snd.sb_cc || 1074 tp->t_flags & TF_NEEDOUTPUT) 1075 (void) tcp_output(tp); 1076 return; 1077 } 1078 } else if (th->th_ack == tp->snd_una && 1079 TAILQ_EMPTY(&tp->t_segq) && 1080 tlen <= sbspace(&so->so_rcv)) { 1081 /* 1082 * This is a pure, in-sequence data packet 1083 * with nothing on the reassembly queue and 1084 * we have enough buffer space to take it. 1085 */ 1086 #ifdef TCP_SACK 1087 /* Clean receiver SACK report if present */ 1088 if (tp->sack_enable && tp->rcv_numsacks) 1089 tcp_clean_sackreport(tp); 1090 #endif /* TCP_SACK */ 1091 ++tcpstat.tcps_preddat; 1092 tp->rcv_nxt += tlen; 1093 tcpstat.tcps_rcvpack++; 1094 tcpstat.tcps_rcvbyte += tlen; 1095 ND6_HINT(tp); 1096 1097 TCP_SETUP_ACK(tp, tiflags, m); 1098 /* 1099 * Drop TCP, IP headers and TCP options then add data 1100 * to socket buffer. 1101 */ 1102 if (so->so_state & SS_CANTRCVMORE) 1103 m_freem(m); 1104 else { 1105 if (opti.ts_present && opti.ts_ecr) { 1106 if (tp->rfbuf_ts < opti.ts_ecr && 1107 opti.ts_ecr - tp->rfbuf_ts < hz) { 1108 tcp_update_rcvspace(tp); 1109 /* Start over with next RTT. */ 1110 tp->rfbuf_cnt = 0; 1111 tp->rfbuf_ts = 0; 1112 } else 1113 tp->rfbuf_cnt += tlen; 1114 } 1115 m_adj(m, iphlen + off); 1116 sbappendstream(&so->so_rcv, m); 1117 } 1118 tp->t_flags |= TF_BLOCKOUTPUT; 1119 sorwakeup(so); 1120 tp->t_flags &= ~TF_BLOCKOUTPUT; 1121 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT)) 1122 (void) tcp_output(tp); 1123 return; 1124 } 1125 } 1126 1127 /* 1128 * Compute mbuf offset to TCP data segment. 1129 */ 1130 hdroptlen = iphlen + off; 1131 1132 /* 1133 * Calculate amount of space in receive window, 1134 * and then do TCP input processing. 1135 * Receive window is amount of space in rcv queue, 1136 * but not less than advertised window. 1137 */ 1138 { int win; 1139 1140 win = sbspace(&so->so_rcv); 1141 if (win < 0) 1142 win = 0; 1143 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1144 } 1145 1146 /* Reset receive buffer auto scaling when not in bulk receive mode. */ 1147 tp->rfbuf_cnt = 0; 1148 tp->rfbuf_ts = 0; 1149 1150 switch (tp->t_state) { 1151 1152 /* 1153 * If the state is SYN_RECEIVED: 1154 * if seg contains SYN/ACK, send an RST. 1155 * if seg contains an ACK, but not for our SYN/ACK, send an RST 1156 */ 1157 1158 case TCPS_SYN_RECEIVED: 1159 if (tiflags & TH_ACK) { 1160 if (tiflags & TH_SYN) { 1161 tcpstat.tcps_badsyn++; 1162 goto dropwithreset; 1163 } 1164 if (SEQ_LEQ(th->th_ack, tp->snd_una) || 1165 SEQ_GT(th->th_ack, tp->snd_max)) 1166 goto dropwithreset; 1167 } 1168 break; 1169 1170 /* 1171 * If the state is SYN_SENT: 1172 * if seg contains an ACK, but not for our SYN, drop the input. 1173 * if seg contains a RST, then drop the connection. 1174 * if seg does not contain SYN, then drop it. 1175 * Otherwise this is an acceptable SYN segment 1176 * initialize tp->rcv_nxt and tp->irs 1177 * if seg contains ack then advance tp->snd_una 1178 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1179 * arrange for segment to be acked (eventually) 1180 * continue processing rest of data/controls, beginning with URG 1181 */ 1182 case TCPS_SYN_SENT: 1183 if ((tiflags & TH_ACK) && 1184 (SEQ_LEQ(th->th_ack, tp->iss) || 1185 SEQ_GT(th->th_ack, tp->snd_max))) 1186 goto dropwithreset; 1187 if (tiflags & TH_RST) { 1188 #ifdef TCP_ECN 1189 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1190 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1191 goto drop; 1192 #endif 1193 if (tiflags & TH_ACK) 1194 tp = tcp_drop(tp, ECONNREFUSED); 1195 goto drop; 1196 } 1197 if ((tiflags & TH_SYN) == 0) 1198 goto drop; 1199 if (tiflags & TH_ACK) { 1200 tp->snd_una = th->th_ack; 1201 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1202 tp->snd_nxt = tp->snd_una; 1203 } 1204 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1205 tp->irs = th->th_seq; 1206 tcp_mss(tp, opti.maxseg); 1207 /* Reset initial window to 1 segment for retransmit */ 1208 if (tp->t_rxtshift > 0) 1209 tp->snd_cwnd = tp->t_maxseg; 1210 tcp_rcvseqinit(tp); 1211 tp->t_flags |= TF_ACKNOW; 1212 #ifdef TCP_SACK 1213 /* 1214 * If we've sent a SACK_PERMITTED option, and the peer 1215 * also replied with one, then TF_SACK_PERMIT should have 1216 * been set in tcp_dooptions(). If it was not, disable SACKs. 1217 */ 1218 if (tp->sack_enable) 1219 tp->sack_enable = tp->t_flags & TF_SACK_PERMIT; 1220 #endif 1221 #ifdef TCP_ECN 1222 /* 1223 * if ECE is set but CWR is not set for SYN-ACK, or 1224 * both ECE and CWR are set for simultaneous open, 1225 * peer is ECN capable. 1226 */ 1227 if (tcp_do_ecn) { 1228 switch (tiflags & (TH_ACK|TH_ECE|TH_CWR)) { 1229 case TH_ACK|TH_ECE: 1230 case TH_ECE|TH_CWR: 1231 tp->t_flags |= TF_ECN_PERMIT; 1232 tiflags &= ~(TH_ECE|TH_CWR); 1233 tcpstat.tcps_ecn_accepts++; 1234 } 1235 } 1236 #endif 1237 1238 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 1239 tcpstat.tcps_connects++; 1240 soisconnected(so); 1241 tp->t_state = TCPS_ESTABLISHED; 1242 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1243 /* Do window scaling on this connection? */ 1244 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1245 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1246 tp->snd_scale = tp->requested_s_scale; 1247 tp->rcv_scale = tp->request_r_scale; 1248 } 1249 tcp_flush_queue(tp); 1250 1251 /* 1252 * if we didn't have to retransmit the SYN, 1253 * use its rtt as our initial srtt & rtt var. 1254 */ 1255 if (tp->t_rtttime) 1256 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1257 /* 1258 * Since new data was acked (the SYN), open the 1259 * congestion window by one MSS. We do this 1260 * here, because we won't go through the normal 1261 * ACK processing below. And since this is the 1262 * start of the connection, we know we are in 1263 * the exponential phase of slow-start. 1264 */ 1265 tp->snd_cwnd += tp->t_maxseg; 1266 } else 1267 tp->t_state = TCPS_SYN_RECEIVED; 1268 1269 #if 0 1270 trimthenstep6: 1271 #endif 1272 /* 1273 * Advance th->th_seq to correspond to first data byte. 1274 * If data, trim to stay within window, 1275 * dropping FIN if necessary. 1276 */ 1277 th->th_seq++; 1278 if (tlen > tp->rcv_wnd) { 1279 todrop = tlen - tp->rcv_wnd; 1280 m_adj(m, -todrop); 1281 tlen = tp->rcv_wnd; 1282 tiflags &= ~TH_FIN; 1283 tcpstat.tcps_rcvpackafterwin++; 1284 tcpstat.tcps_rcvbyteafterwin += todrop; 1285 } 1286 tp->snd_wl1 = th->th_seq - 1; 1287 tp->rcv_up = th->th_seq; 1288 goto step6; 1289 /* 1290 * If a new connection request is received while in TIME_WAIT, 1291 * drop the old connection and start over if the if the 1292 * timestamp or the sequence numbers are above the previous 1293 * ones. 1294 */ 1295 case TCPS_TIME_WAIT: 1296 if (((tiflags & (TH_SYN|TH_ACK)) == TH_SYN) && 1297 ((opti.ts_present && 1298 TSTMP_LT(tp->ts_recent, opti.ts_val)) || 1299 SEQ_GT(th->th_seq, tp->rcv_nxt))) { 1300 #if NPF > 0 1301 /* 1302 * The socket will be recreated but the new state 1303 * has already been linked to the socket. Remove the 1304 * link between old socket and new state. 1305 */ 1306 pf_inp_unlink(inp); 1307 #endif 1308 /* 1309 * Advance the iss by at least 32768, but 1310 * clear the msb in order to make sure 1311 * that SEG_LT(snd_nxt, iss). 1312 */ 1313 iss = tp->snd_nxt + 1314 ((arc4random() & 0x7fffffff) | 0x8000); 1315 reuse = &iss; 1316 tp = tcp_close(tp); 1317 inp = NULL; 1318 goto findpcb; 1319 } 1320 } 1321 1322 /* 1323 * States other than LISTEN or SYN_SENT. 1324 * First check timestamp, if present. 1325 * Then check that at least some bytes of segment are within 1326 * receive window. If segment begins before rcv_nxt, 1327 * drop leading data (and SYN); if nothing left, just ack. 1328 * 1329 * RFC 1323 PAWS: If we have a timestamp reply on this segment 1330 * and it's less than opti.ts_recent, drop it. 1331 */ 1332 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 1333 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 1334 1335 /* Check to see if ts_recent is over 24 days old. */ 1336 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1337 /* 1338 * Invalidate ts_recent. If this segment updates 1339 * ts_recent, the age will be reset later and ts_recent 1340 * will get a valid value. If it does not, setting 1341 * ts_recent to zero will at least satisfy the 1342 * requirement that zero be placed in the timestamp 1343 * echo reply when ts_recent isn't valid. The 1344 * age isn't reset until we get a valid ts_recent 1345 * because we don't want out-of-order segments to be 1346 * dropped when ts_recent is old. 1347 */ 1348 tp->ts_recent = 0; 1349 } else { 1350 tcpstat.tcps_rcvduppack++; 1351 tcpstat.tcps_rcvdupbyte += tlen; 1352 tcpstat.tcps_pawsdrop++; 1353 goto dropafterack; 1354 } 1355 } 1356 1357 todrop = tp->rcv_nxt - th->th_seq; 1358 if (todrop > 0) { 1359 if (tiflags & TH_SYN) { 1360 tiflags &= ~TH_SYN; 1361 th->th_seq++; 1362 if (th->th_urp > 1) 1363 th->th_urp--; 1364 else 1365 tiflags &= ~TH_URG; 1366 todrop--; 1367 } 1368 if (todrop > tlen || 1369 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 1370 /* 1371 * Any valid FIN must be to the left of the 1372 * window. At this point, FIN must be a 1373 * duplicate or out-of-sequence, so drop it. 1374 */ 1375 tiflags &= ~TH_FIN; 1376 /* 1377 * Send ACK to resynchronize, and drop any data, 1378 * but keep on processing for RST or ACK. 1379 */ 1380 tp->t_flags |= TF_ACKNOW; 1381 tcpstat.tcps_rcvdupbyte += todrop = tlen; 1382 tcpstat.tcps_rcvduppack++; 1383 } else { 1384 tcpstat.tcps_rcvpartduppack++; 1385 tcpstat.tcps_rcvpartdupbyte += todrop; 1386 } 1387 hdroptlen += todrop; /* drop from head afterwards */ 1388 th->th_seq += todrop; 1389 tlen -= todrop; 1390 if (th->th_urp > todrop) 1391 th->th_urp -= todrop; 1392 else { 1393 tiflags &= ~TH_URG; 1394 th->th_urp = 0; 1395 } 1396 } 1397 1398 /* 1399 * If new data are received on a connection after the 1400 * user processes are gone, then RST the other end. 1401 */ 1402 if ((so->so_state & SS_NOFDREF) && 1403 tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1404 tp = tcp_close(tp); 1405 tcpstat.tcps_rcvafterclose++; 1406 goto dropwithreset; 1407 } 1408 1409 /* 1410 * If segment ends after window, drop trailing data 1411 * (and PUSH and FIN); if nothing left, just ACK. 1412 */ 1413 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1414 if (todrop > 0) { 1415 tcpstat.tcps_rcvpackafterwin++; 1416 if (todrop >= tlen) { 1417 tcpstat.tcps_rcvbyteafterwin += tlen; 1418 /* 1419 * If window is closed can only take segments at 1420 * window edge, and have to drop data and PUSH from 1421 * incoming segments. Continue processing, but 1422 * remember to ack. Otherwise, drop segment 1423 * and ack. 1424 */ 1425 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1426 tp->t_flags |= TF_ACKNOW; 1427 tcpstat.tcps_rcvwinprobe++; 1428 } else 1429 goto dropafterack; 1430 } else 1431 tcpstat.tcps_rcvbyteafterwin += todrop; 1432 m_adj(m, -todrop); 1433 tlen -= todrop; 1434 tiflags &= ~(TH_PUSH|TH_FIN); 1435 } 1436 1437 /* 1438 * If last ACK falls within this segment's sequence numbers, 1439 * record its timestamp if it's more recent. 1440 * Cf fix from Braden, see Stevens p. 870 1441 */ 1442 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1443 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 1444 if (SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen + 1445 ((tiflags & (TH_SYN|TH_FIN)) != 0))) 1446 tp->ts_recent = opti.ts_val; 1447 else 1448 tp->ts_recent = 0; 1449 tp->ts_recent_age = tcp_now; 1450 } 1451 1452 /* 1453 * If the RST bit is set examine the state: 1454 * SYN_RECEIVED STATE: 1455 * If passive open, return to LISTEN state. 1456 * If active open, inform user that connection was refused. 1457 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1458 * Inform user that connection was reset, and close tcb. 1459 * CLOSING, LAST_ACK, TIME_WAIT STATES 1460 * Close the tcb. 1461 */ 1462 if (tiflags & TH_RST) { 1463 if (th->th_seq != tp->last_ack_sent && 1464 th->th_seq != tp->rcv_nxt && 1465 th->th_seq != (tp->rcv_nxt + 1)) 1466 goto drop; 1467 1468 switch (tp->t_state) { 1469 case TCPS_SYN_RECEIVED: 1470 #ifdef TCP_ECN 1471 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1472 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1473 goto drop; 1474 #endif 1475 so->so_error = ECONNREFUSED; 1476 goto close; 1477 1478 case TCPS_ESTABLISHED: 1479 case TCPS_FIN_WAIT_1: 1480 case TCPS_FIN_WAIT_2: 1481 case TCPS_CLOSE_WAIT: 1482 so->so_error = ECONNRESET; 1483 close: 1484 tp->t_state = TCPS_CLOSED; 1485 tcpstat.tcps_drops++; 1486 tp = tcp_close(tp); 1487 goto drop; 1488 case TCPS_CLOSING: 1489 case TCPS_LAST_ACK: 1490 case TCPS_TIME_WAIT: 1491 tp = tcp_close(tp); 1492 goto drop; 1493 } 1494 } 1495 1496 /* 1497 * If a SYN is in the window, then this is an 1498 * error and we ACK and drop the packet. 1499 */ 1500 if (tiflags & TH_SYN) 1501 goto dropafterack_ratelim; 1502 1503 /* 1504 * If the ACK bit is off we drop the segment and return. 1505 */ 1506 if ((tiflags & TH_ACK) == 0) { 1507 if (tp->t_flags & TF_ACKNOW) 1508 goto dropafterack; 1509 else 1510 goto drop; 1511 } 1512 1513 /* 1514 * Ack processing. 1515 */ 1516 switch (tp->t_state) { 1517 1518 /* 1519 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter 1520 * ESTABLISHED state and continue processing. 1521 * The ACK was checked above. 1522 */ 1523 case TCPS_SYN_RECEIVED: 1524 tcpstat.tcps_connects++; 1525 soisconnected(so); 1526 tp->t_state = TCPS_ESTABLISHED; 1527 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1528 /* Do window scaling? */ 1529 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1530 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1531 tp->snd_scale = tp->requested_s_scale; 1532 tp->rcv_scale = tp->request_r_scale; 1533 tiwin = th->th_win << tp->snd_scale; 1534 } 1535 tcp_flush_queue(tp); 1536 tp->snd_wl1 = th->th_seq - 1; 1537 /* fall into ... */ 1538 1539 /* 1540 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1541 * ACKs. If the ack is in the range 1542 * tp->snd_una < th->th_ack <= tp->snd_max 1543 * then advance tp->snd_una to th->th_ack and drop 1544 * data from the retransmission queue. If this ACK reflects 1545 * more up to date window information we update our window information. 1546 */ 1547 case TCPS_ESTABLISHED: 1548 case TCPS_FIN_WAIT_1: 1549 case TCPS_FIN_WAIT_2: 1550 case TCPS_CLOSE_WAIT: 1551 case TCPS_CLOSING: 1552 case TCPS_LAST_ACK: 1553 case TCPS_TIME_WAIT: 1554 #ifdef TCP_ECN 1555 /* 1556 * if we receive ECE and are not already in recovery phase, 1557 * reduce cwnd by half but don't slow-start. 1558 * advance snd_last to snd_max not to reduce cwnd again 1559 * until all outstanding packets are acked. 1560 */ 1561 if (tcp_do_ecn && (tiflags & TH_ECE)) { 1562 if ((tp->t_flags & TF_ECN_PERMIT) && 1563 SEQ_GEQ(tp->snd_una, tp->snd_last)) { 1564 u_int win; 1565 1566 win = min(tp->snd_wnd, tp->snd_cwnd) / tp->t_maxseg; 1567 if (win > 1) { 1568 tp->snd_ssthresh = win / 2 * tp->t_maxseg; 1569 tp->snd_cwnd = tp->snd_ssthresh; 1570 tp->snd_last = tp->snd_max; 1571 tp->t_flags |= TF_SEND_CWR; 1572 tcpstat.tcps_cwr_ecn++; 1573 } 1574 } 1575 tcpstat.tcps_ecn_rcvece++; 1576 } 1577 /* 1578 * if we receive CWR, we know that the peer has reduced 1579 * its congestion window. stop sending ecn-echo. 1580 */ 1581 if ((tiflags & TH_CWR)) { 1582 tp->t_flags &= ~TF_RCVD_CE; 1583 tcpstat.tcps_ecn_rcvcwr++; 1584 } 1585 #endif /* TCP_ECN */ 1586 1587 if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1588 /* 1589 * Duplicate/old ACK processing. 1590 * Increments t_dupacks: 1591 * Pure duplicate (same seq/ack/window, no data) 1592 * Doesn't affect t_dupacks: 1593 * Data packets. 1594 * Normal window updates (window opens) 1595 * Resets t_dupacks: 1596 * New data ACKed. 1597 * Window shrinks 1598 * Old ACK 1599 */ 1600 if (tlen) { 1601 /* Drop very old ACKs unless th_seq matches */ 1602 if (th->th_seq != tp->rcv_nxt && 1603 SEQ_LT(th->th_ack, 1604 tp->snd_una - tp->max_sndwnd)) { 1605 tcpstat.tcps_rcvacktooold++; 1606 goto drop; 1607 } 1608 break; 1609 } 1610 /* 1611 * If we get an old ACK, there is probably packet 1612 * reordering going on. Be conservative and reset 1613 * t_dupacks so that we are less aggressive in 1614 * doing a fast retransmit. 1615 */ 1616 if (th->th_ack != tp->snd_una) { 1617 tp->t_dupacks = 0; 1618 break; 1619 } 1620 if (tiwin == tp->snd_wnd) { 1621 tcpstat.tcps_rcvdupack++; 1622 /* 1623 * If we have outstanding data (other than 1624 * a window probe), this is a completely 1625 * duplicate ack (ie, window info didn't 1626 * change), the ack is the biggest we've 1627 * seen and we've seen exactly our rexmt 1628 * threshold of them, assume a packet 1629 * has been dropped and retransmit it. 1630 * Kludge snd_nxt & the congestion 1631 * window so we send only this one 1632 * packet. 1633 * 1634 * We know we're losing at the current 1635 * window size so do congestion avoidance 1636 * (set ssthresh to half the current window 1637 * and pull our congestion window back to 1638 * the new ssthresh). 1639 * 1640 * Dup acks mean that packets have left the 1641 * network (they're now cached at the receiver) 1642 * so bump cwnd by the amount in the receiver 1643 * to keep a constant cwnd packets in the 1644 * network. 1645 */ 1646 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0) 1647 tp->t_dupacks = 0; 1648 #if defined(TCP_SACK) && defined(TCP_FACK) 1649 /* 1650 * In FACK, can enter fast rec. if the receiver 1651 * reports a reass. queue longer than 3 segs. 1652 */ 1653 else if (++tp->t_dupacks == tcprexmtthresh || 1654 ((SEQ_GT(tp->snd_fack, tcprexmtthresh * 1655 tp->t_maxseg + tp->snd_una)) && 1656 SEQ_GT(tp->snd_una, tp->snd_last))) { 1657 #else 1658 else if (++tp->t_dupacks == tcprexmtthresh) { 1659 #endif /* TCP_FACK */ 1660 tcp_seq onxt = tp->snd_nxt; 1661 u_long win = 1662 ulmin(tp->snd_wnd, tp->snd_cwnd) / 1663 2 / tp->t_maxseg; 1664 1665 #if defined(TCP_SACK) || defined(TCP_ECN) 1666 if (SEQ_LT(th->th_ack, tp->snd_last)){ 1667 /* 1668 * False fast retx after 1669 * timeout. Do not cut window. 1670 */ 1671 tp->t_dupacks = 0; 1672 goto drop; 1673 } 1674 #endif 1675 if (win < 2) 1676 win = 2; 1677 tp->snd_ssthresh = win * tp->t_maxseg; 1678 #ifdef TCP_SACK 1679 tp->snd_last = tp->snd_max; 1680 if (tp->sack_enable) { 1681 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1682 tp->t_rtttime = 0; 1683 #ifdef TCP_ECN 1684 tp->t_flags |= TF_SEND_CWR; 1685 #endif 1686 tcpstat.tcps_cwr_frecovery++; 1687 tcpstat.tcps_sack_recovery_episode++; 1688 #if defined(TCP_SACK) && defined(TCP_FACK) 1689 tp->t_dupacks = tcprexmtthresh; 1690 (void) tcp_output(tp); 1691 /* 1692 * During FR, snd_cwnd is held 1693 * constant for FACK. 1694 */ 1695 tp->snd_cwnd = tp->snd_ssthresh; 1696 #else 1697 /* 1698 * tcp_output() will send 1699 * oldest SACK-eligible rtx. 1700 */ 1701 (void) tcp_output(tp); 1702 tp->snd_cwnd = tp->snd_ssthresh+ 1703 tp->t_maxseg * tp->t_dupacks; 1704 #endif /* TCP_FACK */ 1705 goto drop; 1706 } 1707 #endif /* TCP_SACK */ 1708 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1709 tp->t_rtttime = 0; 1710 tp->snd_nxt = th->th_ack; 1711 tp->snd_cwnd = tp->t_maxseg; 1712 #ifdef TCP_ECN 1713 tp->t_flags |= TF_SEND_CWR; 1714 #endif 1715 tcpstat.tcps_cwr_frecovery++; 1716 tcpstat.tcps_sndrexmitfast++; 1717 (void) tcp_output(tp); 1718 1719 tp->snd_cwnd = tp->snd_ssthresh + 1720 tp->t_maxseg * tp->t_dupacks; 1721 if (SEQ_GT(onxt, tp->snd_nxt)) 1722 tp->snd_nxt = onxt; 1723 goto drop; 1724 } else if (tp->t_dupacks > tcprexmtthresh) { 1725 #if defined(TCP_SACK) && defined(TCP_FACK) 1726 /* 1727 * while (awnd < cwnd) 1728 * sendsomething(); 1729 */ 1730 if (tp->sack_enable) { 1731 if (tp->snd_awnd < tp->snd_cwnd) 1732 tcp_output(tp); 1733 goto drop; 1734 } 1735 #endif /* TCP_FACK */ 1736 tp->snd_cwnd += tp->t_maxseg; 1737 (void) tcp_output(tp); 1738 goto drop; 1739 } 1740 } else if (tiwin < tp->snd_wnd) { 1741 /* 1742 * The window was retracted! Previous dup 1743 * ACKs may have been due to packets arriving 1744 * after the shrunken window, not a missing 1745 * packet, so play it safe and reset t_dupacks 1746 */ 1747 tp->t_dupacks = 0; 1748 } 1749 break; 1750 } 1751 /* 1752 * If the congestion window was inflated to account 1753 * for the other side's cached packets, retract it. 1754 */ 1755 #if defined(TCP_SACK) 1756 if (tp->sack_enable) { 1757 if (tp->t_dupacks >= tcprexmtthresh) { 1758 /* Check for a partial ACK */ 1759 if (tcp_sack_partialack(tp, th)) { 1760 #if defined(TCP_SACK) && defined(TCP_FACK) 1761 /* Force call to tcp_output */ 1762 if (tp->snd_awnd < tp->snd_cwnd) 1763 tp->t_flags |= TF_NEEDOUTPUT; 1764 #else 1765 tp->snd_cwnd += tp->t_maxseg; 1766 tp->t_flags |= TF_NEEDOUTPUT; 1767 #endif /* TCP_FACK */ 1768 } else { 1769 /* Out of fast recovery */ 1770 tp->snd_cwnd = tp->snd_ssthresh; 1771 if (tcp_seq_subtract(tp->snd_max, 1772 th->th_ack) < tp->snd_ssthresh) 1773 tp->snd_cwnd = 1774 tcp_seq_subtract(tp->snd_max, 1775 th->th_ack); 1776 tp->t_dupacks = 0; 1777 #if defined(TCP_SACK) && defined(TCP_FACK) 1778 if (SEQ_GT(th->th_ack, tp->snd_fack)) 1779 tp->snd_fack = th->th_ack; 1780 #endif /* TCP_FACK */ 1781 } 1782 } 1783 } else { 1784 if (tp->t_dupacks >= tcprexmtthresh && 1785 !tcp_newreno(tp, th)) { 1786 /* Out of fast recovery */ 1787 tp->snd_cwnd = tp->snd_ssthresh; 1788 if (tcp_seq_subtract(tp->snd_max, th->th_ack) < 1789 tp->snd_ssthresh) 1790 tp->snd_cwnd = 1791 tcp_seq_subtract(tp->snd_max, 1792 th->th_ack); 1793 tp->t_dupacks = 0; 1794 } 1795 } 1796 if (tp->t_dupacks < tcprexmtthresh) 1797 tp->t_dupacks = 0; 1798 #else /* else no TCP_SACK */ 1799 if (tp->t_dupacks >= tcprexmtthresh && 1800 tp->snd_cwnd > tp->snd_ssthresh) 1801 tp->snd_cwnd = tp->snd_ssthresh; 1802 tp->t_dupacks = 0; 1803 #endif 1804 if (SEQ_GT(th->th_ack, tp->snd_max)) { 1805 tcpstat.tcps_rcvacktoomuch++; 1806 goto dropafterack_ratelim; 1807 } 1808 acked = th->th_ack - tp->snd_una; 1809 tcpstat.tcps_rcvackpack++; 1810 tcpstat.tcps_rcvackbyte += acked; 1811 1812 /* 1813 * If we have a timestamp reply, update smoothed 1814 * round trip time. If no timestamp is present but 1815 * transmit timer is running and timed sequence 1816 * number was acked, update smoothed round trip time. 1817 * Since we now have an rtt measurement, cancel the 1818 * timer backoff (cf., Phil Karn's retransmit alg.). 1819 * Recompute the initial retransmit timer. 1820 */ 1821 if (opti.ts_present && opti.ts_ecr) 1822 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 1823 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) 1824 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1825 1826 /* 1827 * If all outstanding data is acked, stop retransmit 1828 * timer and remember to restart (more output or persist). 1829 * If there is more data to be acked, restart retransmit 1830 * timer, using current (possibly backed-off) value. 1831 */ 1832 if (th->th_ack == tp->snd_max) { 1833 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1834 tp->t_flags |= TF_NEEDOUTPUT; 1835 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1836 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1837 /* 1838 * When new data is acked, open the congestion window. 1839 * If the window gives us less than ssthresh packets 1840 * in flight, open exponentially (maxseg per packet). 1841 * Otherwise open linearly: maxseg per window 1842 * (maxseg^2 / cwnd per packet). 1843 */ 1844 { 1845 u_int cw = tp->snd_cwnd; 1846 u_int incr = tp->t_maxseg; 1847 1848 if (cw > tp->snd_ssthresh) 1849 incr = incr * incr / cw; 1850 #if defined (TCP_SACK) 1851 if (tp->t_dupacks < tcprexmtthresh) 1852 #endif 1853 tp->snd_cwnd = ulmin(cw + incr, TCP_MAXWIN<<tp->snd_scale); 1854 } 1855 ND6_HINT(tp); 1856 if (acked > so->so_snd.sb_cc) { 1857 tp->snd_wnd -= so->so_snd.sb_cc; 1858 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1859 ourfinisacked = 1; 1860 } else { 1861 sbdrop(&so->so_snd, acked); 1862 tp->snd_wnd -= acked; 1863 ourfinisacked = 0; 1864 } 1865 1866 tcp_update_sndspace(tp); 1867 if (sb_notify(&so->so_snd)) { 1868 tp->t_flags |= TF_BLOCKOUTPUT; 1869 sowwakeup(so); 1870 tp->t_flags &= ~TF_BLOCKOUTPUT; 1871 } 1872 1873 /* 1874 * If we had a pending ICMP message that referred to data 1875 * that have just been acknowledged, disregard the recorded 1876 * ICMP message. 1877 */ 1878 if ((tp->t_flags & TF_PMTUD_PEND) && 1879 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 1880 tp->t_flags &= ~TF_PMTUD_PEND; 1881 1882 /* 1883 * Keep track of the largest chunk of data acknowledged 1884 * since last PMTU update 1885 */ 1886 if (tp->t_pmtud_mss_acked < acked) 1887 tp->t_pmtud_mss_acked = acked; 1888 1889 tp->snd_una = th->th_ack; 1890 #ifdef TCP_ECN 1891 /* sync snd_last with snd_una */ 1892 if (SEQ_GT(tp->snd_una, tp->snd_last)) 1893 tp->snd_last = tp->snd_una; 1894 #endif 1895 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1896 tp->snd_nxt = tp->snd_una; 1897 #if defined (TCP_SACK) && defined (TCP_FACK) 1898 if (SEQ_GT(tp->snd_una, tp->snd_fack)) { 1899 tp->snd_fack = tp->snd_una; 1900 /* Update snd_awnd for partial ACK 1901 * without any SACK blocks. 1902 */ 1903 tp->snd_awnd = tcp_seq_subtract(tp->snd_nxt, 1904 tp->snd_fack) + tp->retran_data; 1905 } 1906 #endif 1907 1908 switch (tp->t_state) { 1909 1910 /* 1911 * In FIN_WAIT_1 STATE in addition to the processing 1912 * for the ESTABLISHED state if our FIN is now acknowledged 1913 * then enter FIN_WAIT_2. 1914 */ 1915 case TCPS_FIN_WAIT_1: 1916 if (ourfinisacked) { 1917 /* 1918 * If we can't receive any more 1919 * data, then closing user can proceed. 1920 * Starting the timer is contrary to the 1921 * specification, but if we don't get a FIN 1922 * we'll hang forever. 1923 */ 1924 if (so->so_state & SS_CANTRCVMORE) { 1925 soisdisconnected(so); 1926 TCP_TIMER_ARM(tp, TCPT_2MSL, tcp_maxidle); 1927 } 1928 tp->t_state = TCPS_FIN_WAIT_2; 1929 } 1930 break; 1931 1932 /* 1933 * In CLOSING STATE in addition to the processing for 1934 * the ESTABLISHED state if the ACK acknowledges our FIN 1935 * then enter the TIME-WAIT state, otherwise ignore 1936 * the segment. 1937 */ 1938 case TCPS_CLOSING: 1939 if (ourfinisacked) { 1940 tp->t_state = TCPS_TIME_WAIT; 1941 tcp_canceltimers(tp); 1942 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1943 soisdisconnected(so); 1944 } 1945 break; 1946 1947 /* 1948 * In LAST_ACK, we may still be waiting for data to drain 1949 * and/or to be acked, as well as for the ack of our FIN. 1950 * If our FIN is now acknowledged, delete the TCB, 1951 * enter the closed state and return. 1952 */ 1953 case TCPS_LAST_ACK: 1954 if (ourfinisacked) { 1955 tp = tcp_close(tp); 1956 goto drop; 1957 } 1958 break; 1959 1960 /* 1961 * In TIME_WAIT state the only thing that should arrive 1962 * is a retransmission of the remote FIN. Acknowledge 1963 * it and restart the finack timer. 1964 */ 1965 case TCPS_TIME_WAIT: 1966 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1967 goto dropafterack; 1968 } 1969 } 1970 1971 step6: 1972 /* 1973 * Update window information. 1974 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1975 */ 1976 if ((tiflags & TH_ACK) && 1977 (SEQ_LT(tp->snd_wl1, th->th_seq) || (tp->snd_wl1 == th->th_seq && 1978 (SEQ_LT(tp->snd_wl2, th->th_ack) || 1979 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 1980 /* keep track of pure window updates */ 1981 if (tlen == 0 && 1982 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 1983 tcpstat.tcps_rcvwinupd++; 1984 tp->snd_wnd = tiwin; 1985 tp->snd_wl1 = th->th_seq; 1986 tp->snd_wl2 = th->th_ack; 1987 if (tp->snd_wnd > tp->max_sndwnd) 1988 tp->max_sndwnd = tp->snd_wnd; 1989 tp->t_flags |= TF_NEEDOUTPUT; 1990 } 1991 1992 /* 1993 * Process segments with URG. 1994 */ 1995 if ((tiflags & TH_URG) && th->th_urp && 1996 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1997 /* 1998 * This is a kludge, but if we receive and accept 1999 * random urgent pointers, we'll crash in 2000 * soreceive. It's hard to imagine someone 2001 * actually wanting to send this much urgent data. 2002 */ 2003 if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 2004 th->th_urp = 0; /* XXX */ 2005 tiflags &= ~TH_URG; /* XXX */ 2006 goto dodata; /* XXX */ 2007 } 2008 /* 2009 * If this segment advances the known urgent pointer, 2010 * then mark the data stream. This should not happen 2011 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 2012 * a FIN has been received from the remote side. 2013 * In these states we ignore the URG. 2014 * 2015 * According to RFC961 (Assigned Protocols), 2016 * the urgent pointer points to the last octet 2017 * of urgent data. We continue, however, 2018 * to consider it to indicate the first octet 2019 * of data past the urgent section as the original 2020 * spec states (in one of two places). 2021 */ 2022 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 2023 tp->rcv_up = th->th_seq + th->th_urp; 2024 so->so_oobmark = so->so_rcv.sb_cc + 2025 (tp->rcv_up - tp->rcv_nxt) - 1; 2026 if (so->so_oobmark == 0) 2027 so->so_state |= SS_RCVATMARK; 2028 sohasoutofband(so); 2029 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 2030 } 2031 /* 2032 * Remove out of band data so doesn't get presented to user. 2033 * This can happen independent of advancing the URG pointer, 2034 * but if two URG's are pending at once, some out-of-band 2035 * data may creep in... ick. 2036 */ 2037 if (th->th_urp <= (u_int16_t) tlen && 2038 (so->so_options & SO_OOBINLINE) == 0) 2039 tcp_pulloutofband(so, th->th_urp, m, hdroptlen); 2040 } else 2041 /* 2042 * If no out of band data is expected, 2043 * pull receive urgent pointer along 2044 * with the receive window. 2045 */ 2046 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 2047 tp->rcv_up = tp->rcv_nxt; 2048 dodata: /* XXX */ 2049 2050 /* 2051 * Process the segment text, merging it into the TCP sequencing queue, 2052 * and arranging for acknowledgment of receipt if necessary. 2053 * This process logically involves adjusting tp->rcv_wnd as data 2054 * is presented to the user (this happens in tcp_usrreq.c, 2055 * case PRU_RCVD). If a FIN has already been received on this 2056 * connection then we just ignore the text. 2057 */ 2058 if ((tlen || (tiflags & TH_FIN)) && 2059 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2060 #ifdef TCP_SACK 2061 tcp_seq laststart = th->th_seq; 2062 tcp_seq lastend = th->th_seq + tlen; 2063 #endif 2064 if (th->th_seq == tp->rcv_nxt && TAILQ_EMPTY(&tp->t_segq) && 2065 tp->t_state == TCPS_ESTABLISHED) { 2066 TCP_SETUP_ACK(tp, tiflags, m); 2067 tp->rcv_nxt += tlen; 2068 tiflags = th->th_flags & TH_FIN; 2069 tcpstat.tcps_rcvpack++; 2070 tcpstat.tcps_rcvbyte += tlen; 2071 ND6_HINT(tp); 2072 if (so->so_state & SS_CANTRCVMORE) 2073 m_freem(m); 2074 else { 2075 m_adj(m, hdroptlen); 2076 sbappendstream(&so->so_rcv, m); 2077 } 2078 tp->t_flags |= TF_BLOCKOUTPUT; 2079 sorwakeup(so); 2080 tp->t_flags &= ~TF_BLOCKOUTPUT; 2081 } else { 2082 m_adj(m, hdroptlen); 2083 tiflags = tcp_reass(tp, th, m, &tlen); 2084 tp->t_flags |= TF_ACKNOW; 2085 } 2086 #ifdef TCP_SACK 2087 if (tp->sack_enable) 2088 tcp_update_sack_list(tp, laststart, lastend); 2089 #endif 2090 2091 /* 2092 * variable len never referenced again in modern BSD, 2093 * so why bother computing it ?? 2094 */ 2095 #if 0 2096 /* 2097 * Note the amount of data that peer has sent into 2098 * our window, in order to estimate the sender's 2099 * buffer size. 2100 */ 2101 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 2102 #endif /* 0 */ 2103 } else { 2104 m_freem(m); 2105 tiflags &= ~TH_FIN; 2106 } 2107 2108 /* 2109 * If FIN is received ACK the FIN and let the user know 2110 * that the connection is closing. Ignore a FIN received before 2111 * the connection is fully established. 2112 */ 2113 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 2114 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 2115 socantrcvmore(so); 2116 tp->t_flags |= TF_ACKNOW; 2117 tp->rcv_nxt++; 2118 } 2119 switch (tp->t_state) { 2120 2121 /* 2122 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 2123 */ 2124 case TCPS_ESTABLISHED: 2125 tp->t_state = TCPS_CLOSE_WAIT; 2126 break; 2127 2128 /* 2129 * If still in FIN_WAIT_1 STATE FIN has not been acked so 2130 * enter the CLOSING state. 2131 */ 2132 case TCPS_FIN_WAIT_1: 2133 tp->t_state = TCPS_CLOSING; 2134 break; 2135 2136 /* 2137 * In FIN_WAIT_2 state enter the TIME_WAIT state, 2138 * starting the time-wait timer, turning off the other 2139 * standard timers. 2140 */ 2141 case TCPS_FIN_WAIT_2: 2142 tp->t_state = TCPS_TIME_WAIT; 2143 tcp_canceltimers(tp); 2144 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2145 soisdisconnected(so); 2146 break; 2147 2148 /* 2149 * In TIME_WAIT state restart the 2 MSL time_wait timer. 2150 */ 2151 case TCPS_TIME_WAIT: 2152 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2153 break; 2154 } 2155 } 2156 if (so->so_options & SO_DEBUG) { 2157 switch (tp->pf) { 2158 #ifdef INET6 2159 case PF_INET6: 2160 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti6, 2161 0, tlen); 2162 break; 2163 #endif /* INET6 */ 2164 case PF_INET: 2165 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti, 2166 0, tlen); 2167 break; 2168 } 2169 } 2170 2171 /* 2172 * Return any desired output. 2173 */ 2174 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT)) 2175 (void) tcp_output(tp); 2176 return; 2177 2178 badsyn: 2179 /* 2180 * Received a bad SYN. Increment counters and dropwithreset. 2181 */ 2182 tcpstat.tcps_badsyn++; 2183 tp = NULL; 2184 goto dropwithreset; 2185 2186 dropafterack_ratelim: 2187 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count, 2188 tcp_ackdrop_ppslim) == 0) { 2189 /* XXX stat */ 2190 goto drop; 2191 } 2192 /* ...fall into dropafterack... */ 2193 2194 dropafterack: 2195 /* 2196 * Generate an ACK dropping incoming segment if it occupies 2197 * sequence space, where the ACK reflects our state. 2198 */ 2199 if (tiflags & TH_RST) 2200 goto drop; 2201 m_freem(m); 2202 tp->t_flags |= TF_ACKNOW; 2203 (void) tcp_output(tp); 2204 return; 2205 2206 dropwithreset_ratelim: 2207 /* 2208 * We may want to rate-limit RSTs in certain situations, 2209 * particularly if we are sending an RST in response to 2210 * an attempt to connect to or otherwise communicate with 2211 * a port for which we have no socket. 2212 */ 2213 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count, 2214 tcp_rst_ppslim) == 0) { 2215 /* XXX stat */ 2216 goto drop; 2217 } 2218 /* ...fall into dropwithreset... */ 2219 2220 dropwithreset: 2221 /* 2222 * Generate a RST, dropping incoming segment. 2223 * Make ACK acceptable to originator of segment. 2224 * Don't bother to respond to RST. 2225 */ 2226 if (tiflags & TH_RST) 2227 goto drop; 2228 if (tiflags & TH_ACK) { 2229 tcp_respond(tp, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, 2230 TH_RST, m->m_pkthdr.ph_rtableid); 2231 } else { 2232 if (tiflags & TH_SYN) 2233 tlen++; 2234 tcp_respond(tp, mtod(m, caddr_t), th, th->th_seq + tlen, 2235 (tcp_seq)0, TH_RST|TH_ACK, m->m_pkthdr.ph_rtableid); 2236 } 2237 m_freem(m); 2238 return; 2239 2240 drop: 2241 /* 2242 * Drop space held by incoming segment and return. 2243 */ 2244 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) { 2245 switch (tp->pf) { 2246 #ifdef INET6 2247 case PF_INET6: 2248 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti6, 2249 0, tlen); 2250 break; 2251 #endif /* INET6 */ 2252 case PF_INET: 2253 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti, 2254 0, tlen); 2255 break; 2256 } 2257 } 2258 2259 m_freem(m); 2260 return; 2261 } 2262 2263 int 2264 tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th, 2265 struct mbuf *m, int iphlen, struct tcp_opt_info *oi, 2266 u_int rtableid) 2267 { 2268 u_int16_t mss = 0; 2269 int opt, optlen; 2270 #ifdef TCP_SIGNATURE 2271 caddr_t sigp = NULL; 2272 struct tdb *tdb = NULL; 2273 #endif /* TCP_SIGNATURE */ 2274 2275 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) { 2276 opt = cp[0]; 2277 if (opt == TCPOPT_EOL) 2278 break; 2279 if (opt == TCPOPT_NOP) 2280 optlen = 1; 2281 else { 2282 if (cnt < 2) 2283 break; 2284 optlen = cp[1]; 2285 if (optlen < 2 || optlen > cnt) 2286 break; 2287 } 2288 switch (opt) { 2289 2290 default: 2291 continue; 2292 2293 case TCPOPT_MAXSEG: 2294 if (optlen != TCPOLEN_MAXSEG) 2295 continue; 2296 if (!(th->th_flags & TH_SYN)) 2297 continue; 2298 if (TCPS_HAVERCVDSYN(tp->t_state)) 2299 continue; 2300 memcpy(&mss, cp + 2, sizeof(mss)); 2301 mss = ntohs(mss); 2302 oi->maxseg = mss; 2303 break; 2304 2305 case TCPOPT_WINDOW: 2306 if (optlen != TCPOLEN_WINDOW) 2307 continue; 2308 if (!(th->th_flags & TH_SYN)) 2309 continue; 2310 if (TCPS_HAVERCVDSYN(tp->t_state)) 2311 continue; 2312 tp->t_flags |= TF_RCVD_SCALE; 2313 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); 2314 break; 2315 2316 case TCPOPT_TIMESTAMP: 2317 if (optlen != TCPOLEN_TIMESTAMP) 2318 continue; 2319 oi->ts_present = 1; 2320 memcpy(&oi->ts_val, cp + 2, sizeof(oi->ts_val)); 2321 oi->ts_val = ntohl(oi->ts_val); 2322 memcpy(&oi->ts_ecr, cp + 6, sizeof(oi->ts_ecr)); 2323 oi->ts_ecr = ntohl(oi->ts_ecr); 2324 2325 if (!(th->th_flags & TH_SYN)) 2326 continue; 2327 if (TCPS_HAVERCVDSYN(tp->t_state)) 2328 continue; 2329 /* 2330 * A timestamp received in a SYN makes 2331 * it ok to send timestamp requests and replies. 2332 */ 2333 tp->t_flags |= TF_RCVD_TSTMP; 2334 tp->ts_recent = oi->ts_val; 2335 tp->ts_recent_age = tcp_now; 2336 break; 2337 2338 #ifdef TCP_SACK 2339 case TCPOPT_SACK_PERMITTED: 2340 if (!tp->sack_enable || optlen!=TCPOLEN_SACK_PERMITTED) 2341 continue; 2342 if (!(th->th_flags & TH_SYN)) 2343 continue; 2344 if (TCPS_HAVERCVDSYN(tp->t_state)) 2345 continue; 2346 /* MUST only be set on SYN */ 2347 tp->t_flags |= TF_SACK_PERMIT; 2348 break; 2349 case TCPOPT_SACK: 2350 tcp_sack_option(tp, th, cp, optlen); 2351 break; 2352 #endif 2353 #ifdef TCP_SIGNATURE 2354 case TCPOPT_SIGNATURE: 2355 if (optlen != TCPOLEN_SIGNATURE) 2356 continue; 2357 2358 if (sigp && timingsafe_bcmp(sigp, cp + 2, 16)) 2359 return (-1); 2360 2361 sigp = cp + 2; 2362 break; 2363 #endif /* TCP_SIGNATURE */ 2364 } 2365 } 2366 2367 #ifdef TCP_SIGNATURE 2368 if (tp->t_flags & TF_SIGNATURE) { 2369 union sockaddr_union src, dst; 2370 2371 memset(&src, 0, sizeof(union sockaddr_union)); 2372 memset(&dst, 0, sizeof(union sockaddr_union)); 2373 2374 switch (tp->pf) { 2375 case 0: 2376 case AF_INET: 2377 src.sa.sa_len = sizeof(struct sockaddr_in); 2378 src.sa.sa_family = AF_INET; 2379 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 2380 dst.sa.sa_len = sizeof(struct sockaddr_in); 2381 dst.sa.sa_family = AF_INET; 2382 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 2383 break; 2384 #ifdef INET6 2385 case AF_INET6: 2386 src.sa.sa_len = sizeof(struct sockaddr_in6); 2387 src.sa.sa_family = AF_INET6; 2388 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 2389 dst.sa.sa_len = sizeof(struct sockaddr_in6); 2390 dst.sa.sa_family = AF_INET6; 2391 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 2392 break; 2393 #endif /* INET6 */ 2394 } 2395 2396 tdb = gettdbbysrcdst(rtable_l2(rtableid), 2397 0, &src, &dst, IPPROTO_TCP); 2398 2399 /* 2400 * We don't have an SA for this peer, so we turn off 2401 * TF_SIGNATURE on the listen socket 2402 */ 2403 if (tdb == NULL && tp->t_state == TCPS_LISTEN) 2404 tp->t_flags &= ~TF_SIGNATURE; 2405 2406 } 2407 2408 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) { 2409 tcpstat.tcps_rcvbadsig++; 2410 return (-1); 2411 } 2412 2413 if (sigp) { 2414 char sig[16]; 2415 2416 if (tdb == NULL) { 2417 tcpstat.tcps_rcvbadsig++; 2418 return (-1); 2419 } 2420 2421 if (tcp_signature(tdb, tp->pf, m, th, iphlen, 1, sig) < 0) 2422 return (-1); 2423 2424 if (timingsafe_bcmp(sig, sigp, 16)) { 2425 tcpstat.tcps_rcvbadsig++; 2426 return (-1); 2427 } 2428 2429 tcpstat.tcps_rcvgoodsig++; 2430 } 2431 #endif /* TCP_SIGNATURE */ 2432 2433 return (0); 2434 } 2435 2436 #if defined(TCP_SACK) 2437 u_long 2438 tcp_seq_subtract(u_long a, u_long b) 2439 { 2440 return ((long)(a - b)); 2441 } 2442 #endif 2443 2444 2445 #ifdef TCP_SACK 2446 /* 2447 * This function is called upon receipt of new valid data (while not in header 2448 * prediction mode), and it updates the ordered list of sacks. 2449 */ 2450 void 2451 tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_laststart, 2452 tcp_seq rcv_lastend) 2453 { 2454 /* 2455 * First reported block MUST be the most recent one. Subsequent 2456 * blocks SHOULD be in the order in which they arrived at the 2457 * receiver. These two conditions make the implementation fully 2458 * compliant with RFC 2018. 2459 */ 2460 int i, j = 0, count = 0, lastpos = -1; 2461 struct sackblk sack, firstsack, temp[MAX_SACK_BLKS]; 2462 2463 /* First clean up current list of sacks */ 2464 for (i = 0; i < tp->rcv_numsacks; i++) { 2465 sack = tp->sackblks[i]; 2466 if (sack.start == 0 && sack.end == 0) { 2467 count++; /* count = number of blocks to be discarded */ 2468 continue; 2469 } 2470 if (SEQ_LEQ(sack.end, tp->rcv_nxt)) { 2471 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2472 count++; 2473 } else { 2474 temp[j].start = tp->sackblks[i].start; 2475 temp[j++].end = tp->sackblks[i].end; 2476 } 2477 } 2478 tp->rcv_numsacks -= count; 2479 if (tp->rcv_numsacks == 0) { /* no sack blocks currently (fast path) */ 2480 tcp_clean_sackreport(tp); 2481 if (SEQ_LT(tp->rcv_nxt, rcv_laststart)) { 2482 /* ==> need first sack block */ 2483 tp->sackblks[0].start = rcv_laststart; 2484 tp->sackblks[0].end = rcv_lastend; 2485 tp->rcv_numsacks = 1; 2486 } 2487 return; 2488 } 2489 /* Otherwise, sack blocks are already present. */ 2490 for (i = 0; i < tp->rcv_numsacks; i++) 2491 tp->sackblks[i] = temp[i]; /* first copy back sack list */ 2492 if (SEQ_GEQ(tp->rcv_nxt, rcv_lastend)) 2493 return; /* sack list remains unchanged */ 2494 /* 2495 * From here, segment just received should be (part of) the 1st sack. 2496 * Go through list, possibly coalescing sack block entries. 2497 */ 2498 firstsack.start = rcv_laststart; 2499 firstsack.end = rcv_lastend; 2500 for (i = 0; i < tp->rcv_numsacks; i++) { 2501 sack = tp->sackblks[i]; 2502 if (SEQ_LT(sack.end, firstsack.start) || 2503 SEQ_GT(sack.start, firstsack.end)) 2504 continue; /* no overlap */ 2505 if (sack.start == firstsack.start && sack.end == firstsack.end){ 2506 /* 2507 * identical block; delete it here since we will 2508 * move it to the front of the list. 2509 */ 2510 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2511 lastpos = i; /* last posn with a zero entry */ 2512 continue; 2513 } 2514 if (SEQ_LEQ(sack.start, firstsack.start)) 2515 firstsack.start = sack.start; /* merge blocks */ 2516 if (SEQ_GEQ(sack.end, firstsack.end)) 2517 firstsack.end = sack.end; /* merge blocks */ 2518 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2519 lastpos = i; /* last posn with a zero entry */ 2520 } 2521 if (lastpos != -1) { /* at least one merge */ 2522 for (i = 0, j = 1; i < tp->rcv_numsacks; i++) { 2523 sack = tp->sackblks[i]; 2524 if (sack.start == 0 && sack.end == 0) 2525 continue; 2526 temp[j++] = sack; 2527 } 2528 tp->rcv_numsacks = j; /* including first blk (added later) */ 2529 for (i = 1; i < tp->rcv_numsacks; i++) /* now copy back */ 2530 tp->sackblks[i] = temp[i]; 2531 } else { /* no merges -- shift sacks by 1 */ 2532 if (tp->rcv_numsacks < MAX_SACK_BLKS) 2533 tp->rcv_numsacks++; 2534 for (i = tp->rcv_numsacks-1; i > 0; i--) 2535 tp->sackblks[i] = tp->sackblks[i-1]; 2536 } 2537 tp->sackblks[0] = firstsack; 2538 return; 2539 } 2540 2541 /* 2542 * Process the TCP SACK option. tp->snd_holes is an ordered list 2543 * of holes (oldest to newest, in terms of the sequence space). 2544 */ 2545 void 2546 tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen) 2547 { 2548 int tmp_olen; 2549 u_char *tmp_cp; 2550 struct sackhole *cur, *p, *temp; 2551 2552 if (!tp->sack_enable) 2553 return; 2554 /* SACK without ACK doesn't make sense. */ 2555 if ((th->th_flags & TH_ACK) == 0) 2556 return; 2557 /* Make sure the ACK on this segment is in [snd_una, snd_max]. */ 2558 if (SEQ_LT(th->th_ack, tp->snd_una) || 2559 SEQ_GT(th->th_ack, tp->snd_max)) 2560 return; 2561 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2562 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0) 2563 return; 2564 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2565 tmp_cp = cp + 2; 2566 tmp_olen = optlen - 2; 2567 tcpstat.tcps_sack_rcv_opts++; 2568 if (tp->snd_numholes < 0) 2569 tp->snd_numholes = 0; 2570 if (tp->t_maxseg == 0) 2571 panic("tcp_sack_option"); /* Should never happen */ 2572 while (tmp_olen > 0) { 2573 struct sackblk sack; 2574 2575 memcpy(&sack.start, tmp_cp, sizeof(tcp_seq)); 2576 sack.start = ntohl(sack.start); 2577 memcpy(&sack.end, tmp_cp + sizeof(tcp_seq), sizeof(tcp_seq)); 2578 sack.end = ntohl(sack.end); 2579 tmp_olen -= TCPOLEN_SACK; 2580 tmp_cp += TCPOLEN_SACK; 2581 if (SEQ_LEQ(sack.end, sack.start)) 2582 continue; /* bad SACK fields */ 2583 if (SEQ_LEQ(sack.end, tp->snd_una)) 2584 continue; /* old block */ 2585 #if defined(TCP_SACK) && defined(TCP_FACK) 2586 /* Updates snd_fack. */ 2587 if (SEQ_GT(sack.end, tp->snd_fack)) 2588 tp->snd_fack = sack.end; 2589 #endif /* TCP_FACK */ 2590 if (SEQ_GT(th->th_ack, tp->snd_una)) { 2591 if (SEQ_LT(sack.start, th->th_ack)) 2592 continue; 2593 } 2594 if (SEQ_GT(sack.end, tp->snd_max)) 2595 continue; 2596 if (tp->snd_holes == NULL) { /* first hole */ 2597 tp->snd_holes = (struct sackhole *) 2598 pool_get(&sackhl_pool, PR_NOWAIT); 2599 if (tp->snd_holes == NULL) { 2600 /* ENOBUFS, so ignore SACKed block for now*/ 2601 goto done; 2602 } 2603 cur = tp->snd_holes; 2604 cur->start = th->th_ack; 2605 cur->end = sack.start; 2606 cur->rxmit = cur->start; 2607 cur->next = NULL; 2608 tp->snd_numholes = 1; 2609 tp->rcv_lastsack = sack.end; 2610 /* 2611 * dups is at least one. If more data has been 2612 * SACKed, it can be greater than one. 2613 */ 2614 cur->dups = min(tcprexmtthresh, 2615 ((sack.end - cur->end)/tp->t_maxseg)); 2616 if (cur->dups < 1) 2617 cur->dups = 1; 2618 continue; /* with next sack block */ 2619 } 2620 /* Go thru list of holes: p = previous, cur = current */ 2621 p = cur = tp->snd_holes; 2622 while (cur) { 2623 if (SEQ_LEQ(sack.end, cur->start)) 2624 /* SACKs data before the current hole */ 2625 break; /* no use going through more holes */ 2626 if (SEQ_GEQ(sack.start, cur->end)) { 2627 /* SACKs data beyond the current hole */ 2628 cur->dups++; 2629 if (((sack.end - cur->end)/tp->t_maxseg) >= 2630 tcprexmtthresh) 2631 cur->dups = tcprexmtthresh; 2632 p = cur; 2633 cur = cur->next; 2634 continue; 2635 } 2636 if (SEQ_LEQ(sack.start, cur->start)) { 2637 /* Data acks at least the beginning of hole */ 2638 #if defined(TCP_SACK) && defined(TCP_FACK) 2639 if (SEQ_GT(sack.end, cur->rxmit)) 2640 tp->retran_data -= 2641 tcp_seq_subtract(cur->rxmit, 2642 cur->start); 2643 else 2644 tp->retran_data -= 2645 tcp_seq_subtract(sack.end, 2646 cur->start); 2647 #endif /* TCP_FACK */ 2648 if (SEQ_GEQ(sack.end, cur->end)) { 2649 /* Acks entire hole, so delete hole */ 2650 if (p != cur) { 2651 p->next = cur->next; 2652 pool_put(&sackhl_pool, cur); 2653 cur = p->next; 2654 } else { 2655 cur = cur->next; 2656 pool_put(&sackhl_pool, p); 2657 p = cur; 2658 tp->snd_holes = p; 2659 } 2660 tp->snd_numholes--; 2661 continue; 2662 } 2663 /* otherwise, move start of hole forward */ 2664 cur->start = sack.end; 2665 cur->rxmit = SEQ_MAX(cur->rxmit, cur->start); 2666 p = cur; 2667 cur = cur->next; 2668 continue; 2669 } 2670 /* move end of hole backward */ 2671 if (SEQ_GEQ(sack.end, cur->end)) { 2672 #if defined(TCP_SACK) && defined(TCP_FACK) 2673 if (SEQ_GT(cur->rxmit, sack.start)) 2674 tp->retran_data -= 2675 tcp_seq_subtract(cur->rxmit, 2676 sack.start); 2677 #endif /* TCP_FACK */ 2678 cur->end = sack.start; 2679 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2680 cur->dups++; 2681 if (((sack.end - cur->end)/tp->t_maxseg) >= 2682 tcprexmtthresh) 2683 cur->dups = tcprexmtthresh; 2684 p = cur; 2685 cur = cur->next; 2686 continue; 2687 } 2688 if (SEQ_LT(cur->start, sack.start) && 2689 SEQ_GT(cur->end, sack.end)) { 2690 /* 2691 * ACKs some data in middle of a hole; need to 2692 * split current hole 2693 */ 2694 temp = (struct sackhole *) 2695 pool_get(&sackhl_pool, PR_NOWAIT); 2696 if (temp == NULL) 2697 goto done; /* ENOBUFS */ 2698 #if defined(TCP_SACK) && defined(TCP_FACK) 2699 if (SEQ_GT(cur->rxmit, sack.end)) 2700 tp->retran_data -= 2701 tcp_seq_subtract(sack.end, 2702 sack.start); 2703 else if (SEQ_GT(cur->rxmit, sack.start)) 2704 tp->retran_data -= 2705 tcp_seq_subtract(cur->rxmit, 2706 sack.start); 2707 #endif /* TCP_FACK */ 2708 temp->next = cur->next; 2709 temp->start = sack.end; 2710 temp->end = cur->end; 2711 temp->dups = cur->dups; 2712 temp->rxmit = SEQ_MAX(cur->rxmit, temp->start); 2713 cur->end = sack.start; 2714 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2715 cur->dups++; 2716 if (((sack.end - cur->end)/tp->t_maxseg) >= 2717 tcprexmtthresh) 2718 cur->dups = tcprexmtthresh; 2719 cur->next = temp; 2720 p = temp; 2721 cur = p->next; 2722 tp->snd_numholes++; 2723 } 2724 } 2725 /* At this point, p points to the last hole on the list */ 2726 if (SEQ_LT(tp->rcv_lastsack, sack.start)) { 2727 /* 2728 * Need to append new hole at end. 2729 * Last hole is p (and it's not NULL). 2730 */ 2731 temp = (struct sackhole *) 2732 pool_get(&sackhl_pool, PR_NOWAIT); 2733 if (temp == NULL) 2734 goto done; /* ENOBUFS */ 2735 temp->start = tp->rcv_lastsack; 2736 temp->end = sack.start; 2737 temp->dups = min(tcprexmtthresh, 2738 ((sack.end - sack.start)/tp->t_maxseg)); 2739 if (temp->dups < 1) 2740 temp->dups = 1; 2741 temp->rxmit = temp->start; 2742 temp->next = 0; 2743 p->next = temp; 2744 tp->rcv_lastsack = sack.end; 2745 tp->snd_numholes++; 2746 } 2747 } 2748 done: 2749 #if defined(TCP_SACK) && defined(TCP_FACK) 2750 /* 2751 * Update retran_data and snd_awnd. Go through the list of 2752 * holes. Increment retran_data by (hole->rxmit - hole->start). 2753 */ 2754 tp->retran_data = 0; 2755 cur = tp->snd_holes; 2756 while (cur) { 2757 tp->retran_data += cur->rxmit - cur->start; 2758 cur = cur->next; 2759 } 2760 tp->snd_awnd = tcp_seq_subtract(tp->snd_nxt, tp->snd_fack) + 2761 tp->retran_data; 2762 #endif /* TCP_FACK */ 2763 2764 return; 2765 } 2766 2767 /* 2768 * Delete stale (i.e, cumulatively ack'd) holes. Hole is deleted only if 2769 * it is completely acked; otherwise, tcp_sack_option(), called from 2770 * tcp_dooptions(), will fix up the hole. 2771 */ 2772 void 2773 tcp_del_sackholes(struct tcpcb *tp, struct tcphdr *th) 2774 { 2775 if (tp->sack_enable && tp->t_state != TCPS_LISTEN) { 2776 /* max because this could be an older ack just arrived */ 2777 tcp_seq lastack = SEQ_GT(th->th_ack, tp->snd_una) ? 2778 th->th_ack : tp->snd_una; 2779 struct sackhole *cur = tp->snd_holes; 2780 struct sackhole *prev; 2781 while (cur) 2782 if (SEQ_LEQ(cur->end, lastack)) { 2783 prev = cur; 2784 cur = cur->next; 2785 pool_put(&sackhl_pool, prev); 2786 tp->snd_numholes--; 2787 } else if (SEQ_LT(cur->start, lastack)) { 2788 cur->start = lastack; 2789 if (SEQ_LT(cur->rxmit, cur->start)) 2790 cur->rxmit = cur->start; 2791 break; 2792 } else 2793 break; 2794 tp->snd_holes = cur; 2795 } 2796 } 2797 2798 /* 2799 * Delete all receiver-side SACK information. 2800 */ 2801 void 2802 tcp_clean_sackreport(struct tcpcb *tp) 2803 { 2804 int i; 2805 2806 tp->rcv_numsacks = 0; 2807 for (i = 0; i < MAX_SACK_BLKS; i++) 2808 tp->sackblks[i].start = tp->sackblks[i].end=0; 2809 2810 } 2811 2812 /* 2813 * Checks for partial ack. If partial ack arrives, turn off retransmission 2814 * timer, deflate the window, do not clear tp->t_dupacks, and return 1. 2815 * If the ack advances at least to tp->snd_last, return 0. 2816 */ 2817 int 2818 tcp_sack_partialack(struct tcpcb *tp, struct tcphdr *th) 2819 { 2820 if (SEQ_LT(th->th_ack, tp->snd_last)) { 2821 /* Turn off retx. timer (will start again next segment) */ 2822 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2823 tp->t_rtttime = 0; 2824 #ifndef TCP_FACK 2825 /* 2826 * Partial window deflation. This statement relies on the 2827 * fact that tp->snd_una has not been updated yet. In FACK 2828 * hold snd_cwnd constant during fast recovery. 2829 */ 2830 if (tp->snd_cwnd > (th->th_ack - tp->snd_una)) { 2831 tp->snd_cwnd -= th->th_ack - tp->snd_una; 2832 tp->snd_cwnd += tp->t_maxseg; 2833 } else 2834 tp->snd_cwnd = tp->t_maxseg; 2835 #endif 2836 return (1); 2837 } 2838 return (0); 2839 } 2840 #endif /* TCP_SACK */ 2841 2842 /* 2843 * Pull out of band byte out of a segment so 2844 * it doesn't appear in the user's data queue. 2845 * It is still reflected in the segment length for 2846 * sequencing purposes. 2847 */ 2848 void 2849 tcp_pulloutofband(struct socket *so, u_int urgent, struct mbuf *m, int off) 2850 { 2851 int cnt = off + urgent - 1; 2852 2853 while (cnt >= 0) { 2854 if (m->m_len > cnt) { 2855 char *cp = mtod(m, caddr_t) + cnt; 2856 struct tcpcb *tp = sototcpcb(so); 2857 2858 tp->t_iobc = *cp; 2859 tp->t_oobflags |= TCPOOB_HAVEDATA; 2860 memmove(cp, cp + 1, m->m_len - cnt - 1); 2861 m->m_len--; 2862 return; 2863 } 2864 cnt -= m->m_len; 2865 m = m->m_next; 2866 if (m == NULL) 2867 break; 2868 } 2869 panic("tcp_pulloutofband"); 2870 } 2871 2872 /* 2873 * Collect new round-trip time estimate 2874 * and update averages and current timeout. 2875 */ 2876 void 2877 tcp_xmit_timer(struct tcpcb *tp, int rtt) 2878 { 2879 short delta; 2880 short rttmin; 2881 2882 if (rtt < 0) 2883 rtt = 0; 2884 else if (rtt > TCP_RTT_MAX) 2885 rtt = TCP_RTT_MAX; 2886 2887 tcpstat.tcps_rttupdated++; 2888 if (tp->t_srtt != 0) { 2889 /* 2890 * delta is fixed point with 2 (TCP_RTT_BASE_SHIFT) bits 2891 * after the binary point (scaled by 4), whereas 2892 * srtt is stored as fixed point with 5 bits after the 2893 * binary point (i.e., scaled by 32). The following magic 2894 * is equivalent to the smoothing algorithm in rfc793 with 2895 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2896 * point). 2897 */ 2898 delta = (rtt << TCP_RTT_BASE_SHIFT) - 2899 (tp->t_srtt >> TCP_RTT_SHIFT); 2900 if ((tp->t_srtt += delta) <= 0) 2901 tp->t_srtt = 1 << TCP_RTT_BASE_SHIFT; 2902 /* 2903 * We accumulate a smoothed rtt variance (actually, a 2904 * smoothed mean difference), then set the retransmit 2905 * timer to smoothed rtt + 4 times the smoothed variance. 2906 * rttvar is stored as fixed point with 4 bits after the 2907 * binary point (scaled by 16). The following is 2908 * equivalent to rfc793 smoothing with an alpha of .75 2909 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2910 * rfc793's wired-in beta. 2911 */ 2912 if (delta < 0) 2913 delta = -delta; 2914 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 2915 if ((tp->t_rttvar += delta) <= 0) 2916 tp->t_rttvar = 1 << TCP_RTT_BASE_SHIFT; 2917 } else { 2918 /* 2919 * No rtt measurement yet - use the unsmoothed rtt. 2920 * Set the variance to half the rtt (so our first 2921 * retransmit happens at 3*rtt). 2922 */ 2923 tp->t_srtt = (rtt + 1) << (TCP_RTT_SHIFT + TCP_RTT_BASE_SHIFT); 2924 tp->t_rttvar = (rtt + 1) << 2925 (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1); 2926 } 2927 tp->t_rtttime = 0; 2928 tp->t_rxtshift = 0; 2929 2930 /* 2931 * the retransmit should happen at rtt + 4 * rttvar. 2932 * Because of the way we do the smoothing, srtt and rttvar 2933 * will each average +1/2 tick of bias. When we compute 2934 * the retransmit timer, we want 1/2 tick of rounding and 2935 * 1 extra tick because of +-1/2 tick uncertainty in the 2936 * firing of the timer. The bias will give us exactly the 2937 * 1.5 tick we need. But, because the bias is 2938 * statistical, we have to test that we don't drop below 2939 * the minimum feasible timer (which is 2 ticks). 2940 */ 2941 rttmin = min(max(rtt + 2, tp->t_rttmin), TCPTV_REXMTMAX); 2942 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 2943 2944 /* 2945 * We received an ack for a packet that wasn't retransmitted; 2946 * it is probably safe to discard any error indications we've 2947 * received recently. This isn't quite right, but close enough 2948 * for now (a route might have failed after we sent a segment, 2949 * and the return path might not be symmetrical). 2950 */ 2951 tp->t_softerror = 0; 2952 } 2953 2954 /* 2955 * Determine a reasonable value for maxseg size. 2956 * If the route is known, check route for mtu. 2957 * If none, use an mss that can be handled on the outgoing 2958 * interface without forcing IP to fragment; if bigger than 2959 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES 2960 * to utilize large mbufs. If no route is found, route has no mtu, 2961 * or the destination isn't local, use a default, hopefully conservative 2962 * size (usually 512 or the default IP max size, but no more than the mtu 2963 * of the interface), as we can't discover anything about intervening 2964 * gateways or networks. We also initialize the congestion/slow start 2965 * window to be a single segment if the destination isn't local. 2966 * While looking at the routing entry, we also initialize other path-dependent 2967 * parameters from pre-set or cached values in the routing entry. 2968 * 2969 * Also take into account the space needed for options that we 2970 * send regularly. Make maxseg shorter by that amount to assure 2971 * that we can send maxseg amount of data even when the options 2972 * are present. Store the upper limit of the length of options plus 2973 * data in maxopd. 2974 * 2975 * NOTE: offer == -1 indicates that the maxseg size changed due to 2976 * Path MTU discovery. 2977 */ 2978 int 2979 tcp_mss(struct tcpcb *tp, int offer) 2980 { 2981 struct rtentry *rt; 2982 struct ifnet *ifp = NULL; 2983 int mss, mssopt; 2984 int iphlen; 2985 struct inpcb *inp; 2986 2987 inp = tp->t_inpcb; 2988 2989 mssopt = mss = tcp_mssdflt; 2990 2991 rt = in_pcbrtentry(inp); 2992 2993 if (rt == NULL) 2994 goto out; 2995 2996 ifp = if_get(rt->rt_ifidx); 2997 if (ifp == NULL) 2998 goto out; 2999 3000 switch (tp->pf) { 3001 #ifdef INET6 3002 case AF_INET6: 3003 iphlen = sizeof(struct ip6_hdr); 3004 break; 3005 #endif 3006 case AF_INET: 3007 iphlen = sizeof(struct ip); 3008 break; 3009 default: 3010 /* the family does not support path MTU discovery */ 3011 goto out; 3012 } 3013 3014 /* 3015 * if there's an mtu associated with the route and we support 3016 * path MTU discovery for the underlying protocol family, use it. 3017 */ 3018 if (rt->rt_rmx.rmx_mtu) { 3019 /* 3020 * One may wish to lower MSS to take into account options, 3021 * especially security-related options. 3022 */ 3023 if (tp->pf == AF_INET6 && rt->rt_rmx.rmx_mtu < IPV6_MMTU) { 3024 /* 3025 * RFC2460 section 5, last paragraph: if path MTU is 3026 * smaller than 1280, use 1280 as packet size and 3027 * attach fragment header. 3028 */ 3029 mss = IPV6_MMTU - iphlen - sizeof(struct ip6_frag) - 3030 sizeof(struct tcphdr); 3031 } else { 3032 mss = rt->rt_rmx.rmx_mtu - iphlen - 3033 sizeof(struct tcphdr); 3034 } 3035 } else if (ifp->if_flags & IFF_LOOPBACK) { 3036 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3037 } else if (tp->pf == AF_INET) { 3038 if (ip_mtudisc) 3039 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3040 } 3041 #ifdef INET6 3042 else if (tp->pf == AF_INET6) { 3043 /* 3044 * for IPv6, path MTU discovery is always turned on, 3045 * or the node must use packet size <= 1280. 3046 */ 3047 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3048 } 3049 #endif /* INET6 */ 3050 3051 /* Calculate the value that we offer in TCPOPT_MAXSEG */ 3052 if (offer != -1) { 3053 mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 3054 mssopt = max(tcp_mssdflt, mssopt); 3055 } 3056 out: 3057 if_put(ifp); 3058 /* 3059 * The current mss, t_maxseg, is initialized to the default value. 3060 * If we compute a smaller value, reduce the current mss. 3061 * If we compute a larger value, return it for use in sending 3062 * a max seg size option, but don't store it for use 3063 * unless we received an offer at least that large from peer. 3064 * 3065 * However, do not accept offers lower than the minimum of 3066 * the interface MTU and 216. 3067 */ 3068 if (offer > 0) 3069 tp->t_peermss = offer; 3070 if (tp->t_peermss) 3071 mss = min(mss, max(tp->t_peermss, 216)); 3072 3073 /* sanity - at least max opt. space */ 3074 mss = max(mss, 64); 3075 3076 /* 3077 * maxopd stores the maximum length of data AND options 3078 * in a segment; maxseg is the amount of data in a normal 3079 * segment. We need to store this value (maxopd) apart 3080 * from maxseg, because now every segment carries options 3081 * and thus we normally have somewhat less data in segments. 3082 */ 3083 tp->t_maxopd = mss; 3084 3085 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 3086 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 3087 mss -= TCPOLEN_TSTAMP_APPA; 3088 #ifdef TCP_SIGNATURE 3089 if (tp->t_flags & TF_SIGNATURE) 3090 mss -= TCPOLEN_SIGLEN; 3091 #endif 3092 3093 if (offer == -1) { 3094 /* mss changed due to Path MTU discovery */ 3095 tp->t_flags &= ~TF_PMTUD_PEND; 3096 tp->t_pmtud_mtu_sent = 0; 3097 tp->t_pmtud_mss_acked = 0; 3098 if (mss < tp->t_maxseg) { 3099 /* 3100 * Follow suggestion in RFC 2414 to reduce the 3101 * congestion window by the ratio of the old 3102 * segment size to the new segment size. 3103 */ 3104 tp->snd_cwnd = ulmax((tp->snd_cwnd / tp->t_maxseg) * 3105 mss, mss); 3106 } 3107 } else if (tcp_do_rfc3390 == 2) { 3108 /* increase initial window */ 3109 tp->snd_cwnd = ulmin(10 * mss, ulmax(2 * mss, 14600)); 3110 } else if (tcp_do_rfc3390) { 3111 /* increase initial window */ 3112 tp->snd_cwnd = ulmin(4 * mss, ulmax(2 * mss, 4380)); 3113 } else 3114 tp->snd_cwnd = mss; 3115 3116 tp->t_maxseg = mss; 3117 3118 return (offer != -1 ? mssopt : mss); 3119 } 3120 3121 u_int 3122 tcp_hdrsz(struct tcpcb *tp) 3123 { 3124 u_int hlen; 3125 3126 switch (tp->pf) { 3127 #ifdef INET6 3128 case AF_INET6: 3129 hlen = sizeof(struct ip6_hdr); 3130 break; 3131 #endif 3132 case AF_INET: 3133 hlen = sizeof(struct ip); 3134 break; 3135 default: 3136 hlen = 0; 3137 break; 3138 } 3139 hlen += sizeof(struct tcphdr); 3140 3141 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 3142 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 3143 hlen += TCPOLEN_TSTAMP_APPA; 3144 #ifdef TCP_SIGNATURE 3145 if (tp->t_flags & TF_SIGNATURE) 3146 hlen += TCPOLEN_SIGLEN; 3147 #endif 3148 return (hlen); 3149 } 3150 3151 /* 3152 * Set connection variables based on the effective MSS. 3153 * We are passed the TCPCB for the actual connection. If we 3154 * are the server, we are called by the compressed state engine 3155 * when the 3-way handshake is complete. If we are the client, 3156 * we are called when we receive the SYN,ACK from the server. 3157 * 3158 * NOTE: The t_maxseg value must be initialized in the TCPCB 3159 * before this routine is called! 3160 */ 3161 void 3162 tcp_mss_update(struct tcpcb *tp) 3163 { 3164 int mss; 3165 u_long bufsize; 3166 struct rtentry *rt; 3167 struct socket *so; 3168 3169 so = tp->t_inpcb->inp_socket; 3170 mss = tp->t_maxseg; 3171 3172 rt = in_pcbrtentry(tp->t_inpcb); 3173 3174 if (rt == NULL) 3175 return; 3176 3177 bufsize = so->so_snd.sb_hiwat; 3178 if (bufsize < mss) { 3179 mss = bufsize; 3180 /* Update t_maxseg and t_maxopd */ 3181 tcp_mss(tp, mss); 3182 } else { 3183 bufsize = roundup(bufsize, mss); 3184 if (bufsize > sb_max) 3185 bufsize = sb_max; 3186 (void)sbreserve(&so->so_snd, bufsize); 3187 } 3188 3189 bufsize = so->so_rcv.sb_hiwat; 3190 if (bufsize > mss) { 3191 bufsize = roundup(bufsize, mss); 3192 if (bufsize > sb_max) 3193 bufsize = sb_max; 3194 (void)sbreserve(&so->so_rcv, bufsize); 3195 } 3196 3197 } 3198 3199 #if defined (TCP_SACK) 3200 /* 3201 * Checks for partial ack. If partial ack arrives, force the retransmission 3202 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return 3203 * 1. By setting snd_nxt to ti_ack, this forces retransmission timer to 3204 * be started again. If the ack advances at least to tp->snd_last, return 0. 3205 */ 3206 int 3207 tcp_newreno(struct tcpcb *tp, struct tcphdr *th) 3208 { 3209 if (SEQ_LT(th->th_ack, tp->snd_last)) { 3210 /* 3211 * snd_una has not been updated and the socket send buffer 3212 * not yet drained of the acked data, so we have to leave 3213 * snd_una as it was to get the correct data offset in 3214 * tcp_output(). 3215 */ 3216 tcp_seq onxt = tp->snd_nxt; 3217 u_long ocwnd = tp->snd_cwnd; 3218 TCP_TIMER_DISARM(tp, TCPT_REXMT); 3219 tp->t_rtttime = 0; 3220 tp->snd_nxt = th->th_ack; 3221 /* 3222 * Set snd_cwnd to one segment beyond acknowledged offset 3223 * (tp->snd_una not yet updated when this function is called) 3224 */ 3225 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una); 3226 (void) tcp_output(tp); 3227 tp->snd_cwnd = ocwnd; 3228 if (SEQ_GT(onxt, tp->snd_nxt)) 3229 tp->snd_nxt = onxt; 3230 /* 3231 * Partial window deflation. Relies on fact that tp->snd_una 3232 * not updated yet. 3233 */ 3234 if (tp->snd_cwnd > th->th_ack - tp->snd_una) 3235 tp->snd_cwnd -= th->th_ack - tp->snd_una; 3236 else 3237 tp->snd_cwnd = 0; 3238 tp->snd_cwnd += tp->t_maxseg; 3239 3240 return 1; 3241 } 3242 return 0; 3243 } 3244 #endif /* TCP_SACK */ 3245 3246 int 3247 tcp_mss_adv(struct mbuf *m, int af) 3248 { 3249 int mss = 0; 3250 int iphlen; 3251 struct ifnet *ifp = NULL; 3252 3253 if (m && (m->m_flags & M_PKTHDR)) 3254 ifp = if_get(m->m_pkthdr.ph_ifidx); 3255 3256 switch (af) { 3257 case AF_INET: 3258 if (ifp != NULL) 3259 mss = ifp->if_mtu; 3260 iphlen = sizeof(struct ip); 3261 break; 3262 #ifdef INET6 3263 case AF_INET6: 3264 if (ifp != NULL) 3265 mss = ifp->if_mtu; 3266 iphlen = sizeof(struct ip6_hdr); 3267 break; 3268 #endif 3269 default: 3270 unhandled_af(af); 3271 } 3272 if_put(ifp); 3273 mss = mss - iphlen - sizeof(struct tcphdr); 3274 return (max(mss, tcp_mssdflt)); 3275 } 3276 3277 /* 3278 * TCP compressed state engine. Currently used to hold compressed 3279 * state for SYN_RECEIVED. 3280 */ 3281 3282 /* syn hash parameters */ 3283 int tcp_syn_hash_size = TCP_SYN_HASH_SIZE; 3284 int tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE; 3285 int tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE; 3286 int tcp_syn_use_limit = 100000; 3287 3288 struct syn_cache_set tcp_syn_cache[2]; 3289 int tcp_syn_cache_active; 3290 3291 #define SYN_HASH(sa, sp, dp, rand) \ 3292 (((sa)->s_addr ^ (rand)[0]) * \ 3293 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4])) 3294 #ifndef INET6 3295 #define SYN_HASHALL(hash, src, dst, rand) \ 3296 do { \ 3297 hash = SYN_HASH(&satosin(src)->sin_addr, \ 3298 satosin(src)->sin_port, \ 3299 satosin(dst)->sin_port, (rand)); \ 3300 } while (/*CONSTCOND*/ 0) 3301 #else 3302 #define SYN_HASH6(sa, sp, dp, rand) \ 3303 (((sa)->s6_addr32[0] ^ (rand)[0]) * \ 3304 ((sa)->s6_addr32[1] ^ (rand)[1]) * \ 3305 ((sa)->s6_addr32[2] ^ (rand)[2]) * \ 3306 ((sa)->s6_addr32[3] ^ (rand)[3]) * \ 3307 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4])) 3308 3309 #define SYN_HASHALL(hash, src, dst, rand) \ 3310 do { \ 3311 switch ((src)->sa_family) { \ 3312 case AF_INET: \ 3313 hash = SYN_HASH(&satosin(src)->sin_addr, \ 3314 satosin(src)->sin_port, \ 3315 satosin(dst)->sin_port, (rand)); \ 3316 break; \ 3317 case AF_INET6: \ 3318 hash = SYN_HASH6(&satosin6(src)->sin6_addr, \ 3319 satosin6(src)->sin6_port, \ 3320 satosin6(dst)->sin6_port, (rand)); \ 3321 break; \ 3322 default: \ 3323 hash = 0; \ 3324 } \ 3325 } while (/*CONSTCOND*/0) 3326 #endif /* INET6 */ 3327 3328 void 3329 syn_cache_rm(struct syn_cache *sc) 3330 { 3331 sc->sc_flags |= SCF_DEAD; 3332 TAILQ_REMOVE(&sc->sc_buckethead->sch_bucket, sc, sc_bucketq); 3333 sc->sc_tp = NULL; 3334 LIST_REMOVE(sc, sc_tpq); 3335 sc->sc_buckethead->sch_length--; 3336 timeout_del(&sc->sc_timer); 3337 sc->sc_set->scs_count--; 3338 } 3339 3340 void 3341 syn_cache_put(struct syn_cache *sc) 3342 { 3343 m_free(sc->sc_ipopts); 3344 if (sc->sc_route4.ro_rt != NULL) { 3345 rtfree(sc->sc_route4.ro_rt); 3346 sc->sc_route4.ro_rt = NULL; 3347 } 3348 timeout_set(&sc->sc_timer, syn_cache_reaper, sc); 3349 timeout_add(&sc->sc_timer, 0); 3350 } 3351 3352 struct pool syn_cache_pool; 3353 3354 /* 3355 * We don't estimate RTT with SYNs, so each packet starts with the default 3356 * RTT and each timer step has a fixed timeout value. 3357 */ 3358 #define SYN_CACHE_TIMER_ARM(sc) \ 3359 do { \ 3360 TCPT_RANGESET((sc)->sc_rxtcur, \ 3361 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \ 3362 TCPTV_REXMTMAX); \ 3363 if (!timeout_initialized(&(sc)->sc_timer)) \ 3364 timeout_set_proc(&(sc)->sc_timer, syn_cache_timer, (sc)); \ 3365 timeout_add(&(sc)->sc_timer, (sc)->sc_rxtcur * (hz / PR_SLOWHZ)); \ 3366 } while (/*CONSTCOND*/0) 3367 3368 #define SYN_CACHE_TIMESTAMP(sc) tcp_now + (sc)->sc_modulate 3369 3370 void 3371 syn_cache_init(void) 3372 { 3373 int i; 3374 3375 /* Initialize the hash buckets. */ 3376 tcp_syn_cache[0].scs_buckethead = mallocarray(tcp_syn_hash_size, 3377 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO); 3378 tcp_syn_cache[1].scs_buckethead = mallocarray(tcp_syn_hash_size, 3379 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO); 3380 tcp_syn_cache[0].scs_size = tcp_syn_hash_size; 3381 tcp_syn_cache[1].scs_size = tcp_syn_hash_size; 3382 for (i = 0; i < tcp_syn_hash_size; i++) { 3383 TAILQ_INIT(&tcp_syn_cache[0].scs_buckethead[i].sch_bucket); 3384 TAILQ_INIT(&tcp_syn_cache[1].scs_buckethead[i].sch_bucket); 3385 } 3386 3387 /* Initialize the syn cache pool. */ 3388 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, IPL_SOFTNET, 3389 0, "syncache", NULL); 3390 } 3391 3392 void 3393 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp) 3394 { 3395 struct syn_cache_set *set = &tcp_syn_cache[tcp_syn_cache_active]; 3396 struct syn_cache_head *scp; 3397 struct syn_cache *sc2; 3398 int i; 3399 3400 NET_ASSERT_LOCKED(); 3401 3402 /* 3403 * If there are no entries in the hash table, reinitialize 3404 * the hash secrets. To avoid useless cache swaps and 3405 * reinitialization, use it until the limit is reached. 3406 * An emtpy cache is also the oportunity to resize the hash. 3407 */ 3408 if (set->scs_count == 0 && set->scs_use <= 0) { 3409 set->scs_use = tcp_syn_use_limit; 3410 if (set->scs_size != tcp_syn_hash_size) { 3411 scp = mallocarray(tcp_syn_hash_size, sizeof(struct 3412 syn_cache_head), M_SYNCACHE, M_NOWAIT|M_ZERO); 3413 if (scp == NULL) { 3414 /* Try again next time. */ 3415 set->scs_use = 0; 3416 } else { 3417 free(set->scs_buckethead, M_SYNCACHE, 3418 set->scs_size * 3419 sizeof(struct syn_cache_head)); 3420 set->scs_buckethead = scp; 3421 set->scs_size = tcp_syn_hash_size; 3422 for (i = 0; i < tcp_syn_hash_size; i++) 3423 TAILQ_INIT(&scp[i].sch_bucket); 3424 } 3425 } 3426 arc4random_buf(set->scs_random, sizeof(set->scs_random)); 3427 tcpstat.tcps_sc_seedrandom++; 3428 } 3429 3430 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa, 3431 set->scs_random); 3432 scp = &set->scs_buckethead[sc->sc_hash % set->scs_size]; 3433 sc->sc_buckethead = scp; 3434 3435 /* 3436 * Make sure that we don't overflow the per-bucket 3437 * limit or the total cache size limit. 3438 */ 3439 if (scp->sch_length >= tcp_syn_bucket_limit) { 3440 tcpstat.tcps_sc_bucketoverflow++; 3441 /* 3442 * Someone might attack our bucket hash function. Reseed 3443 * with random as soon as the passive syn cache gets empty. 3444 */ 3445 set->scs_use = 0; 3446 /* 3447 * The bucket is full. Toss the oldest element in the 3448 * bucket. This will be the first entry in the bucket. 3449 */ 3450 sc2 = TAILQ_FIRST(&scp->sch_bucket); 3451 #ifdef DIAGNOSTIC 3452 /* 3453 * This should never happen; we should always find an 3454 * entry in our bucket. 3455 */ 3456 if (sc2 == NULL) 3457 panic("%s: bucketoverflow: impossible", __func__); 3458 #endif 3459 syn_cache_rm(sc2); 3460 syn_cache_put(sc2); 3461 } else if (set->scs_count >= tcp_syn_cache_limit) { 3462 struct syn_cache_head *scp2, *sce; 3463 3464 tcpstat.tcps_sc_overflowed++; 3465 /* 3466 * The cache is full. Toss the oldest entry in the 3467 * first non-empty bucket we can find. 3468 * 3469 * XXX We would really like to toss the oldest 3470 * entry in the cache, but we hope that this 3471 * condition doesn't happen very often. 3472 */ 3473 scp2 = scp; 3474 if (TAILQ_EMPTY(&scp2->sch_bucket)) { 3475 sce = &set->scs_buckethead[set->scs_size]; 3476 for (++scp2; scp2 != scp; scp2++) { 3477 if (scp2 >= sce) 3478 scp2 = &set->scs_buckethead[0]; 3479 if (! TAILQ_EMPTY(&scp2->sch_bucket)) 3480 break; 3481 } 3482 #ifdef DIAGNOSTIC 3483 /* 3484 * This should never happen; we should always find a 3485 * non-empty bucket. 3486 */ 3487 if (scp2 == scp) 3488 panic("%s: cacheoverflow: impossible", 3489 __func__); 3490 #endif 3491 } 3492 sc2 = TAILQ_FIRST(&scp2->sch_bucket); 3493 syn_cache_rm(sc2); 3494 syn_cache_put(sc2); 3495 } 3496 3497 /* 3498 * Initialize the entry's timer. 3499 */ 3500 sc->sc_rxttot = 0; 3501 sc->sc_rxtshift = 0; 3502 SYN_CACHE_TIMER_ARM(sc); 3503 3504 /* Link it from tcpcb entry */ 3505 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 3506 3507 /* Put it into the bucket. */ 3508 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq); 3509 scp->sch_length++; 3510 sc->sc_set = set; 3511 set->scs_count++; 3512 set->scs_use--; 3513 3514 tcpstat.tcps_sc_added++; 3515 3516 /* 3517 * If the active cache has exceeded its use limit and 3518 * the passive syn cache is empty, exchange their roles. 3519 */ 3520 if (set->scs_use <= 0 && 3521 tcp_syn_cache[!tcp_syn_cache_active].scs_count == 0) 3522 tcp_syn_cache_active = !tcp_syn_cache_active; 3523 } 3524 3525 /* 3526 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 3527 * If we have retransmitted an entry the maximum number of times, expire 3528 * that entry. 3529 */ 3530 void 3531 syn_cache_timer(void *arg) 3532 { 3533 struct syn_cache *sc = arg; 3534 int s; 3535 3536 NET_LOCK(s); 3537 if (sc->sc_flags & SCF_DEAD) 3538 goto out; 3539 3540 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) { 3541 /* Drop it -- too many retransmissions. */ 3542 goto dropit; 3543 } 3544 3545 /* 3546 * Compute the total amount of time this entry has 3547 * been on a queue. If this entry has been on longer 3548 * than the keep alive timer would allow, expire it. 3549 */ 3550 sc->sc_rxttot += sc->sc_rxtcur; 3551 if (sc->sc_rxttot >= tcptv_keep_init) 3552 goto dropit; 3553 3554 tcpstat.tcps_sc_retransmitted++; 3555 (void) syn_cache_respond(sc, NULL); 3556 3557 /* Advance the timer back-off. */ 3558 sc->sc_rxtshift++; 3559 SYN_CACHE_TIMER_ARM(sc); 3560 3561 out: 3562 NET_UNLOCK(s); 3563 return; 3564 3565 dropit: 3566 tcpstat.tcps_sc_timed_out++; 3567 syn_cache_rm(sc); 3568 syn_cache_put(sc); 3569 NET_UNLOCK(s); 3570 } 3571 3572 void 3573 syn_cache_reaper(void *arg) 3574 { 3575 struct syn_cache *sc = arg; 3576 3577 pool_put(&syn_cache_pool, (sc)); 3578 return; 3579 } 3580 3581 /* 3582 * Remove syn cache created by the specified tcb entry, 3583 * because this does not make sense to keep them 3584 * (if there's no tcb entry, syn cache entry will never be used) 3585 */ 3586 void 3587 syn_cache_cleanup(struct tcpcb *tp) 3588 { 3589 struct syn_cache *sc, *nsc; 3590 3591 NET_ASSERT_LOCKED(); 3592 3593 LIST_FOREACH_SAFE(sc, &tp->t_sc, sc_tpq, nsc) { 3594 #ifdef DIAGNOSTIC 3595 if (sc->sc_tp != tp) 3596 panic("invalid sc_tp in syn_cache_cleanup"); 3597 #endif 3598 syn_cache_rm(sc); 3599 syn_cache_put(sc); 3600 } 3601 /* just for safety */ 3602 LIST_INIT(&tp->t_sc); 3603 } 3604 3605 /* 3606 * Find an entry in the syn cache. 3607 */ 3608 struct syn_cache * 3609 syn_cache_lookup(struct sockaddr *src, struct sockaddr *dst, 3610 struct syn_cache_head **headp, u_int rtableid) 3611 { 3612 struct syn_cache_set *sets[2]; 3613 struct syn_cache *sc; 3614 struct syn_cache_head *scp; 3615 u_int32_t hash; 3616 int i; 3617 3618 NET_ASSERT_LOCKED(); 3619 3620 /* Check the active cache first, the passive cache is likely emtpy. */ 3621 sets[0] = &tcp_syn_cache[tcp_syn_cache_active]; 3622 sets[1] = &tcp_syn_cache[!tcp_syn_cache_active]; 3623 for (i = 0; i < 2; i++) { 3624 if (sets[i]->scs_count == 0) 3625 continue; 3626 SYN_HASHALL(hash, src, dst, sets[i]->scs_random); 3627 scp = &sets[i]->scs_buckethead[hash % sets[i]->scs_size]; 3628 *headp = scp; 3629 TAILQ_FOREACH(sc, &scp->sch_bucket, sc_bucketq) { 3630 if (sc->sc_hash != hash) 3631 continue; 3632 if (!bcmp(&sc->sc_src, src, src->sa_len) && 3633 !bcmp(&sc->sc_dst, dst, dst->sa_len) && 3634 rtable_l2(rtableid) == rtable_l2(sc->sc_rtableid)) 3635 return (sc); 3636 } 3637 } 3638 return (NULL); 3639 } 3640 3641 /* 3642 * This function gets called when we receive an ACK for a 3643 * socket in the LISTEN state. We look up the connection 3644 * in the syn cache, and if its there, we pull it out of 3645 * the cache and turn it into a full-blown connection in 3646 * the SYN-RECEIVED state. 3647 * 3648 * The return values may not be immediately obvious, and their effects 3649 * can be subtle, so here they are: 3650 * 3651 * NULL SYN was not found in cache; caller should drop the 3652 * packet and send an RST. 3653 * 3654 * -1 We were unable to create the new connection, and are 3655 * aborting it. An ACK,RST is being sent to the peer 3656 * (unless we got screwey sequence numbners; see below), 3657 * because the 3-way handshake has been completed. Caller 3658 * should not free the mbuf, since we may be using it. If 3659 * we are not, we will free it. 3660 * 3661 * Otherwise, the return value is a pointer to the new socket 3662 * associated with the connection. 3663 */ 3664 struct socket * 3665 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3666 u_int hlen, u_int tlen, struct socket *so, struct mbuf *m) 3667 { 3668 struct syn_cache *sc; 3669 struct syn_cache_head *scp; 3670 struct inpcb *inp, *oldinp; 3671 struct tcpcb *tp = NULL; 3672 struct mbuf *am; 3673 struct socket *oso; 3674 #if NPF > 0 3675 struct pf_divert *divert = NULL; 3676 #endif 3677 3678 NET_ASSERT_LOCKED(); 3679 3680 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid); 3681 if (sc == NULL) 3682 return (NULL); 3683 3684 /* 3685 * Verify the sequence and ack numbers. Try getting the correct 3686 * response again. 3687 */ 3688 if ((th->th_ack != sc->sc_iss + 1) || 3689 SEQ_LEQ(th->th_seq, sc->sc_irs) || 3690 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 3691 (void) syn_cache_respond(sc, m); 3692 return ((struct socket *)(-1)); 3693 } 3694 3695 /* Remove this cache entry */ 3696 syn_cache_rm(sc); 3697 3698 /* 3699 * Ok, create the full blown connection, and set things up 3700 * as they would have been set up if we had created the 3701 * connection when the SYN arrived. If we can't create 3702 * the connection, abort it. 3703 */ 3704 oso = so; 3705 so = sonewconn(so, SS_ISCONNECTED); 3706 if (so == NULL) 3707 goto resetandabort; 3708 3709 oldinp = sotoinpcb(oso); 3710 inp = sotoinpcb(so); 3711 3712 #ifdef IPSEC 3713 /* 3714 * We need to copy the required security levels 3715 * from the old pcb. Ditto for any other 3716 * IPsec-related information. 3717 */ 3718 memcpy(inp->inp_seclevel, oldinp->inp_seclevel, 3719 sizeof(oldinp->inp_seclevel)); 3720 #endif /* IPSEC */ 3721 #ifdef INET6 3722 /* 3723 * inp still has the OLD in_pcb stuff, set the 3724 * v6-related flags on the new guy, too. 3725 */ 3726 inp->inp_flags |= (oldinp->inp_flags & INP_IPV6); 3727 if (inp->inp_flags & INP_IPV6) { 3728 inp->inp_ipv6.ip6_hlim = oldinp->inp_ipv6.ip6_hlim; 3729 inp->inp_hops = oldinp->inp_hops; 3730 } else 3731 #endif /* INET6 */ 3732 { 3733 inp->inp_ip.ip_ttl = oldinp->inp_ip.ip_ttl; 3734 } 3735 3736 #if NPF > 0 3737 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED && 3738 (divert = pf_find_divert(m)) != NULL) 3739 inp->inp_rtableid = divert->rdomain; 3740 else 3741 #endif 3742 /* inherit rtable from listening socket */ 3743 inp->inp_rtableid = sc->sc_rtableid; 3744 3745 inp->inp_lport = th->th_dport; 3746 switch (src->sa_family) { 3747 #ifdef INET6 3748 case AF_INET6: 3749 inp->inp_laddr6 = satosin6(dst)->sin6_addr; 3750 break; 3751 #endif /* INET6 */ 3752 case AF_INET: 3753 inp->inp_laddr = satosin(dst)->sin_addr; 3754 inp->inp_options = ip_srcroute(m); 3755 if (inp->inp_options == NULL) { 3756 inp->inp_options = sc->sc_ipopts; 3757 sc->sc_ipopts = NULL; 3758 } 3759 break; 3760 } 3761 in_pcbrehash(inp); 3762 3763 /* 3764 * Give the new socket our cached route reference. 3765 */ 3766 if (src->sa_family == AF_INET) 3767 inp->inp_route = sc->sc_route4; /* struct assignment */ 3768 #ifdef INET6 3769 else 3770 inp->inp_route6 = sc->sc_route6; 3771 #endif 3772 sc->sc_route4.ro_rt = NULL; 3773 3774 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 3775 if (am == NULL) 3776 goto resetandabort; 3777 am->m_len = src->sa_len; 3778 memcpy(mtod(am, caddr_t), src, src->sa_len); 3779 3780 switch (src->sa_family) { 3781 case AF_INET: 3782 /* drop IPv4 packet to AF_INET6 socket */ 3783 if (inp->inp_flags & INP_IPV6) { 3784 (void) m_free(am); 3785 goto resetandabort; 3786 } 3787 if (in_pcbconnect(inp, am)) { 3788 (void) m_free(am); 3789 goto resetandabort; 3790 } 3791 break; 3792 #ifdef INET6 3793 case AF_INET6: 3794 if (in6_pcbconnect(inp, am)) { 3795 (void) m_free(am); 3796 goto resetandabort; 3797 } 3798 break; 3799 #endif 3800 } 3801 (void) m_free(am); 3802 3803 tp = intotcpcb(inp); 3804 tp->t_flags = sototcpcb(oso)->t_flags & (TF_NOPUSH|TF_NODELAY); 3805 if (sc->sc_request_r_scale != 15) { 3806 tp->requested_s_scale = sc->sc_requested_s_scale; 3807 tp->request_r_scale = sc->sc_request_r_scale; 3808 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE; 3809 } 3810 if (sc->sc_flags & SCF_TIMESTAMP) 3811 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP; 3812 3813 tp->t_template = tcp_template(tp); 3814 if (tp->t_template == 0) { 3815 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 3816 so = NULL; 3817 m_freem(m); 3818 goto abort; 3819 } 3820 #ifdef TCP_SACK 3821 tp->sack_enable = sc->sc_flags & SCF_SACK_PERMIT; 3822 #endif 3823 3824 tp->ts_modulate = sc->sc_modulate; 3825 tp->ts_recent = sc->sc_timestamp; 3826 tp->iss = sc->sc_iss; 3827 tp->irs = sc->sc_irs; 3828 tcp_sendseqinit(tp); 3829 #if defined (TCP_SACK) || defined(TCP_ECN) 3830 tp->snd_last = tp->snd_una; 3831 #endif /* TCP_SACK */ 3832 #if defined(TCP_SACK) && defined(TCP_FACK) 3833 tp->snd_fack = tp->snd_una; 3834 tp->retran_data = 0; 3835 tp->snd_awnd = 0; 3836 #endif /* TCP_FACK */ 3837 #ifdef TCP_ECN 3838 if (sc->sc_flags & SCF_ECN_PERMIT) { 3839 tp->t_flags |= TF_ECN_PERMIT; 3840 tcpstat.tcps_ecn_accepts++; 3841 } 3842 #endif 3843 #ifdef TCP_SACK 3844 if (sc->sc_flags & SCF_SACK_PERMIT) 3845 tp->t_flags |= TF_SACK_PERMIT; 3846 #endif 3847 #ifdef TCP_SIGNATURE 3848 if (sc->sc_flags & SCF_SIGNATURE) 3849 tp->t_flags |= TF_SIGNATURE; 3850 #endif 3851 tcp_rcvseqinit(tp); 3852 tp->t_state = TCPS_SYN_RECEIVED; 3853 tp->t_rcvtime = tcp_now; 3854 TCP_TIMER_ARM(tp, TCPT_KEEP, tcptv_keep_init); 3855 tcpstat.tcps_accepts++; 3856 3857 tcp_mss(tp, sc->sc_peermaxseg); /* sets t_maxseg */ 3858 if (sc->sc_peermaxseg) 3859 tcp_mss_update(tp); 3860 /* Reset initial window to 1 segment for retransmit */ 3861 if (sc->sc_rxtshift > 0) 3862 tp->snd_cwnd = tp->t_maxseg; 3863 tp->snd_wl1 = sc->sc_irs; 3864 tp->rcv_up = sc->sc_irs + 1; 3865 3866 /* 3867 * This is what whould have happened in tcp_output() when 3868 * the SYN,ACK was sent. 3869 */ 3870 tp->snd_up = tp->snd_una; 3871 tp->snd_max = tp->snd_nxt = tp->iss+1; 3872 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 3873 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 3874 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 3875 tp->last_ack_sent = tp->rcv_nxt; 3876 3877 tcpstat.tcps_sc_completed++; 3878 syn_cache_put(sc); 3879 return (so); 3880 3881 resetandabort: 3882 tcp_respond(NULL, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, TH_RST, 3883 m->m_pkthdr.ph_rtableid); 3884 m_freem(m); 3885 abort: 3886 if (so != NULL) 3887 (void) soabort(so); 3888 syn_cache_put(sc); 3889 tcpstat.tcps_sc_aborted++; 3890 return ((struct socket *)(-1)); 3891 } 3892 3893 /* 3894 * This function is called when we get a RST for a 3895 * non-existent connection, so that we can see if the 3896 * connection is in the syn cache. If it is, zap it. 3897 */ 3898 3899 void 3900 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3901 u_int rtableid) 3902 { 3903 struct syn_cache *sc; 3904 struct syn_cache_head *scp; 3905 3906 NET_ASSERT_LOCKED(); 3907 3908 if ((sc = syn_cache_lookup(src, dst, &scp, rtableid)) == NULL) 3909 return; 3910 if (SEQ_LT(th->th_seq, sc->sc_irs) || 3911 SEQ_GT(th->th_seq, sc->sc_irs + 1)) 3912 return; 3913 syn_cache_rm(sc); 3914 tcpstat.tcps_sc_reset++; 3915 syn_cache_put(sc); 3916 } 3917 3918 void 3919 syn_cache_unreach(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3920 u_int rtableid) 3921 { 3922 struct syn_cache *sc; 3923 struct syn_cache_head *scp; 3924 3925 NET_ASSERT_LOCKED(); 3926 3927 if ((sc = syn_cache_lookup(src, dst, &scp, rtableid)) == NULL) 3928 return; 3929 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 3930 if (ntohl (th->th_seq) != sc->sc_iss) { 3931 return; 3932 } 3933 3934 /* 3935 * If we've retransmitted 3 times and this is our second error, 3936 * we remove the entry. Otherwise, we allow it to continue on. 3937 * This prevents us from incorrectly nuking an entry during a 3938 * spurious network outage. 3939 * 3940 * See tcp_notify(). 3941 */ 3942 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 3943 sc->sc_flags |= SCF_UNREACH; 3944 return; 3945 } 3946 3947 syn_cache_rm(sc); 3948 tcpstat.tcps_sc_unreach++; 3949 syn_cache_put(sc); 3950 } 3951 3952 /* 3953 * Given a LISTEN socket and an inbound SYN request, add 3954 * this to the syn cache, and send back a segment: 3955 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 3956 * to the source. 3957 * 3958 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 3959 * Doing so would require that we hold onto the data and deliver it 3960 * to the application. However, if we are the target of a SYN-flood 3961 * DoS attack, an attacker could send data which would eventually 3962 * consume all available buffer space if it were ACKed. By not ACKing 3963 * the data, we avoid this DoS scenario. 3964 */ 3965 3966 int 3967 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3968 u_int iphlen, struct socket *so, struct mbuf *m, u_char *optp, int optlen, 3969 struct tcp_opt_info *oi, tcp_seq *issp) 3970 { 3971 struct tcpcb tb, *tp; 3972 long win; 3973 struct syn_cache *sc; 3974 struct syn_cache_head *scp; 3975 struct mbuf *ipopts; 3976 3977 tp = sototcpcb(so); 3978 3979 /* 3980 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 3981 * 3982 * Note this check is performed in tcp_input() very early on. 3983 */ 3984 3985 /* 3986 * Initialize some local state. 3987 */ 3988 win = sbspace(&so->so_rcv); 3989 if (win > TCP_MAXWIN) 3990 win = TCP_MAXWIN; 3991 3992 bzero(&tb, sizeof(tb)); 3993 #ifdef TCP_SIGNATURE 3994 if (optp || (tp->t_flags & TF_SIGNATURE)) { 3995 #else 3996 if (optp) { 3997 #endif 3998 tb.pf = tp->pf; 3999 #ifdef TCP_SACK 4000 tb.sack_enable = tp->sack_enable; 4001 #endif 4002 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 4003 #ifdef TCP_SIGNATURE 4004 if (tp->t_flags & TF_SIGNATURE) 4005 tb.t_flags |= TF_SIGNATURE; 4006 #endif 4007 tb.t_state = TCPS_LISTEN; 4008 if (tcp_dooptions(&tb, optp, optlen, th, m, iphlen, oi, 4009 sotoinpcb(so)->inp_rtableid)) 4010 return (-1); 4011 } 4012 4013 switch (src->sa_family) { 4014 case AF_INET: 4015 /* 4016 * Remember the IP options, if any. 4017 */ 4018 ipopts = ip_srcroute(m); 4019 break; 4020 default: 4021 ipopts = NULL; 4022 } 4023 4024 /* 4025 * See if we already have an entry for this connection. 4026 * If we do, resend the SYN,ACK. We do not count this 4027 * as a retransmission (XXX though maybe we should). 4028 */ 4029 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid); 4030 if (sc != NULL) { 4031 tcpstat.tcps_sc_dupesyn++; 4032 if (ipopts) { 4033 /* 4034 * If we were remembering a previous source route, 4035 * forget it and use the new one we've been given. 4036 */ 4037 m_free(sc->sc_ipopts); 4038 sc->sc_ipopts = ipopts; 4039 } 4040 sc->sc_timestamp = tb.ts_recent; 4041 if (syn_cache_respond(sc, m) == 0) { 4042 tcpstat.tcps_sndacks++; 4043 tcpstat.tcps_sndtotal++; 4044 } 4045 return (0); 4046 } 4047 4048 sc = pool_get(&syn_cache_pool, PR_NOWAIT|PR_ZERO); 4049 if (sc == NULL) { 4050 m_free(ipopts); 4051 return (-1); 4052 } 4053 4054 /* 4055 * Fill in the cache, and put the necessary IP and TCP 4056 * options into the reply. 4057 */ 4058 memcpy(&sc->sc_src, src, src->sa_len); 4059 memcpy(&sc->sc_dst, dst, dst->sa_len); 4060 sc->sc_rtableid = sotoinpcb(so)->inp_rtableid; 4061 sc->sc_flags = 0; 4062 sc->sc_ipopts = ipopts; 4063 sc->sc_irs = th->th_seq; 4064 4065 sc->sc_iss = issp ? *issp : arc4random(); 4066 sc->sc_peermaxseg = oi->maxseg; 4067 sc->sc_ourmaxseg = tcp_mss_adv(m, sc->sc_src.sa.sa_family); 4068 sc->sc_win = win; 4069 sc->sc_timestamp = tb.ts_recent; 4070 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) == 4071 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) { 4072 sc->sc_flags |= SCF_TIMESTAMP; 4073 sc->sc_modulate = arc4random(); 4074 } 4075 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 4076 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 4077 sc->sc_requested_s_scale = tb.requested_s_scale; 4078 sc->sc_request_r_scale = 0; 4079 /* 4080 * Pick the smallest possible scaling factor that 4081 * will still allow us to scale up to sb_max. 4082 * 4083 * We do this because there are broken firewalls that 4084 * will corrupt the window scale option, leading to 4085 * the other endpoint believing that our advertised 4086 * window is unscaled. At scale factors larger than 4087 * 5 the unscaled window will drop below 1500 bytes, 4088 * leading to serious problems when traversing these 4089 * broken firewalls. 4090 * 4091 * With the default sbmax of 256K, a scale factor 4092 * of 3 will be chosen by this algorithm. Those who 4093 * choose a larger sbmax should watch out 4094 * for the compatiblity problems mentioned above. 4095 * 4096 * RFC1323: The Window field in a SYN (i.e., a <SYN> 4097 * or <SYN,ACK>) segment itself is never scaled. 4098 */ 4099 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 4100 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max) 4101 sc->sc_request_r_scale++; 4102 } else { 4103 sc->sc_requested_s_scale = 15; 4104 sc->sc_request_r_scale = 15; 4105 } 4106 #ifdef TCP_ECN 4107 /* 4108 * if both ECE and CWR flag bits are set, peer is ECN capable. 4109 */ 4110 if (tcp_do_ecn && 4111 (th->th_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) 4112 sc->sc_flags |= SCF_ECN_PERMIT; 4113 #endif 4114 #ifdef TCP_SACK 4115 /* 4116 * Set SCF_SACK_PERMIT if peer did send a SACK_PERMITTED option 4117 * (i.e., if tcp_dooptions() did set TF_SACK_PERMIT). 4118 */ 4119 if (tb.sack_enable && (tb.t_flags & TF_SACK_PERMIT)) 4120 sc->sc_flags |= SCF_SACK_PERMIT; 4121 #endif 4122 #ifdef TCP_SIGNATURE 4123 if (tb.t_flags & TF_SIGNATURE) 4124 sc->sc_flags |= SCF_SIGNATURE; 4125 #endif 4126 sc->sc_tp = tp; 4127 if (syn_cache_respond(sc, m) == 0) { 4128 syn_cache_insert(sc, tp); 4129 tcpstat.tcps_sndacks++; 4130 tcpstat.tcps_sndtotal++; 4131 } else { 4132 syn_cache_put(sc); 4133 tcpstat.tcps_sc_dropped++; 4134 } 4135 4136 return (0); 4137 } 4138 4139 int 4140 syn_cache_respond(struct syn_cache *sc, struct mbuf *m) 4141 { 4142 u_int8_t *optp; 4143 int optlen, error; 4144 u_int16_t tlen; 4145 struct ip *ip = NULL; 4146 #ifdef INET6 4147 struct ip6_hdr *ip6 = NULL; 4148 #endif 4149 struct tcphdr *th; 4150 u_int hlen; 4151 struct inpcb *inp; 4152 4153 switch (sc->sc_src.sa.sa_family) { 4154 case AF_INET: 4155 hlen = sizeof(struct ip); 4156 break; 4157 #ifdef INET6 4158 case AF_INET6: 4159 hlen = sizeof(struct ip6_hdr); 4160 break; 4161 #endif 4162 default: 4163 m_freem(m); 4164 return (EAFNOSUPPORT); 4165 } 4166 4167 /* Compute the size of the TCP options. */ 4168 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 4169 #ifdef TCP_SACK 4170 ((sc->sc_flags & SCF_SACK_PERMIT) ? 4 : 0) + 4171 #endif 4172 #ifdef TCP_SIGNATURE 4173 ((sc->sc_flags & SCF_SIGNATURE) ? TCPOLEN_SIGLEN : 0) + 4174 #endif 4175 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 4176 4177 tlen = hlen + sizeof(struct tcphdr) + optlen; 4178 4179 /* 4180 * Create the IP+TCP header from scratch. 4181 */ 4182 m_freem(m); 4183 #ifdef DIAGNOSTIC 4184 if (max_linkhdr + tlen > MCLBYTES) 4185 return (ENOBUFS); 4186 #endif 4187 MGETHDR(m, M_DONTWAIT, MT_DATA); 4188 if (m && max_linkhdr + tlen > MHLEN) { 4189 MCLGET(m, M_DONTWAIT); 4190 if ((m->m_flags & M_EXT) == 0) { 4191 m_freem(m); 4192 m = NULL; 4193 } 4194 } 4195 if (m == NULL) 4196 return (ENOBUFS); 4197 4198 /* Fixup the mbuf. */ 4199 m->m_data += max_linkhdr; 4200 m->m_len = m->m_pkthdr.len = tlen; 4201 m->m_pkthdr.ph_ifidx = 0; 4202 m->m_pkthdr.ph_rtableid = sc->sc_rtableid; 4203 memset(mtod(m, u_char *), 0, tlen); 4204 4205 switch (sc->sc_src.sa.sa_family) { 4206 case AF_INET: 4207 ip = mtod(m, struct ip *); 4208 ip->ip_dst = sc->sc_src.sin.sin_addr; 4209 ip->ip_src = sc->sc_dst.sin.sin_addr; 4210 ip->ip_p = IPPROTO_TCP; 4211 th = (struct tcphdr *)(ip + 1); 4212 th->th_dport = sc->sc_src.sin.sin_port; 4213 th->th_sport = sc->sc_dst.sin.sin_port; 4214 break; 4215 #ifdef INET6 4216 case AF_INET6: 4217 ip6 = mtod(m, struct ip6_hdr *); 4218 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 4219 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 4220 ip6->ip6_nxt = IPPROTO_TCP; 4221 /* ip6_plen will be updated in ip6_output() */ 4222 th = (struct tcphdr *)(ip6 + 1); 4223 th->th_dport = sc->sc_src.sin6.sin6_port; 4224 th->th_sport = sc->sc_dst.sin6.sin6_port; 4225 break; 4226 #endif 4227 default: 4228 unhandled_af(sc->sc_src.sa.sa_family); 4229 } 4230 4231 th->th_seq = htonl(sc->sc_iss); 4232 th->th_ack = htonl(sc->sc_irs + 1); 4233 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 4234 th->th_flags = TH_SYN|TH_ACK; 4235 #ifdef TCP_ECN 4236 /* Set ECE for SYN-ACK if peer supports ECN. */ 4237 if (tcp_do_ecn && (sc->sc_flags & SCF_ECN_PERMIT)) 4238 th->th_flags |= TH_ECE; 4239 #endif 4240 th->th_win = htons(sc->sc_win); 4241 /* th_sum already 0 */ 4242 /* th_urp already 0 */ 4243 4244 /* Tack on the TCP options. */ 4245 optp = (u_int8_t *)(th + 1); 4246 *optp++ = TCPOPT_MAXSEG; 4247 *optp++ = 4; 4248 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 4249 *optp++ = sc->sc_ourmaxseg & 0xff; 4250 4251 #ifdef TCP_SACK 4252 /* Include SACK_PERMIT_HDR option if peer has already done so. */ 4253 if (sc->sc_flags & SCF_SACK_PERMIT) { 4254 *((u_int32_t *)optp) = htonl(TCPOPT_SACK_PERMIT_HDR); 4255 optp += 4; 4256 } 4257 #endif 4258 4259 if (sc->sc_request_r_scale != 15) { 4260 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 4261 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 4262 sc->sc_request_r_scale); 4263 optp += 4; 4264 } 4265 4266 if (sc->sc_flags & SCF_TIMESTAMP) { 4267 u_int32_t *lp = (u_int32_t *)(optp); 4268 /* Form timestamp option as shown in appendix A of RFC 1323. */ 4269 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 4270 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc)); 4271 *lp = htonl(sc->sc_timestamp); 4272 optp += TCPOLEN_TSTAMP_APPA; 4273 } 4274 4275 #ifdef TCP_SIGNATURE 4276 if (sc->sc_flags & SCF_SIGNATURE) { 4277 union sockaddr_union src, dst; 4278 struct tdb *tdb; 4279 4280 bzero(&src, sizeof(union sockaddr_union)); 4281 bzero(&dst, sizeof(union sockaddr_union)); 4282 src.sa.sa_len = sc->sc_src.sa.sa_len; 4283 src.sa.sa_family = sc->sc_src.sa.sa_family; 4284 dst.sa.sa_len = sc->sc_dst.sa.sa_len; 4285 dst.sa.sa_family = sc->sc_dst.sa.sa_family; 4286 4287 switch (sc->sc_src.sa.sa_family) { 4288 case 0: /*default to PF_INET*/ 4289 case AF_INET: 4290 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 4291 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 4292 break; 4293 #ifdef INET6 4294 case AF_INET6: 4295 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 4296 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 4297 break; 4298 #endif /* INET6 */ 4299 } 4300 4301 tdb = gettdbbysrcdst(rtable_l2(sc->sc_rtableid), 4302 0, &src, &dst, IPPROTO_TCP); 4303 if (tdb == NULL) { 4304 m_freem(m); 4305 return (EPERM); 4306 } 4307 4308 /* Send signature option */ 4309 *(optp++) = TCPOPT_SIGNATURE; 4310 *(optp++) = TCPOLEN_SIGNATURE; 4311 4312 if (tcp_signature(tdb, sc->sc_src.sa.sa_family, m, th, 4313 hlen, 0, optp) < 0) { 4314 m_freem(m); 4315 return (EINVAL); 4316 } 4317 optp += 16; 4318 4319 /* Pad options list to the next 32 bit boundary and 4320 * terminate it. 4321 */ 4322 *optp++ = TCPOPT_NOP; 4323 *optp++ = TCPOPT_EOL; 4324 } 4325 #endif /* TCP_SIGNATURE */ 4326 4327 /* Compute the packet's checksum. */ 4328 switch (sc->sc_src.sa.sa_family) { 4329 case AF_INET: 4330 ip->ip_len = htons(tlen - hlen); 4331 th->th_sum = 0; 4332 th->th_sum = in_cksum(m, tlen); 4333 break; 4334 #ifdef INET6 4335 case AF_INET6: 4336 ip6->ip6_plen = htons(tlen - hlen); 4337 th->th_sum = 0; 4338 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 4339 break; 4340 #endif 4341 } 4342 4343 /* use IPsec policy and ttl from listening socket, on SYN ACK */ 4344 inp = sc->sc_tp ? sc->sc_tp->t_inpcb : NULL; 4345 4346 /* 4347 * Fill in some straggling IP bits. Note the stack expects 4348 * ip_len to be in host order, for convenience. 4349 */ 4350 switch (sc->sc_src.sa.sa_family) { 4351 case AF_INET: 4352 ip->ip_len = htons(tlen); 4353 ip->ip_ttl = inp ? inp->inp_ip.ip_ttl : ip_defttl; 4354 if (inp != NULL) 4355 ip->ip_tos = inp->inp_ip.ip_tos; 4356 break; 4357 #ifdef INET6 4358 case AF_INET6: 4359 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 4360 ip6->ip6_vfc |= IPV6_VERSION; 4361 ip6->ip6_plen = htons(tlen - hlen); 4362 /* ip6_hlim will be initialized afterwards */ 4363 /* leave flowlabel = 0, it is legal and require no state mgmt */ 4364 break; 4365 #endif 4366 } 4367 4368 switch (sc->sc_src.sa.sa_family) { 4369 case AF_INET: 4370 error = ip_output(m, sc->sc_ipopts, &sc->sc_route4, 4371 (ip_mtudisc ? IP_MTUDISC : 0), NULL, inp, 0); 4372 break; 4373 #ifdef INET6 4374 case AF_INET6: 4375 ip6->ip6_hlim = in6_selecthlim(inp); 4376 4377 error = ip6_output(m, NULL /*XXX*/, &sc->sc_route6, 0, 4378 NULL, NULL); 4379 break; 4380 #endif 4381 default: 4382 error = EAFNOSUPPORT; 4383 break; 4384 } 4385 return (error); 4386 } 4387