1 /* $OpenBSD: tcp_input.c,v 1.350 2017/10/25 12:38:21 job Exp $ */ 2 /* $NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/timeout.h> 80 #include <sys/kernel.h> 81 #include <sys/pool.h> 82 83 #include <net/if.h> 84 #include <net/if_var.h> 85 #include <net/route.h> 86 87 #include <netinet/in.h> 88 #include <netinet/ip.h> 89 #include <netinet/in_pcb.h> 90 #include <netinet/ip_var.h> 91 #include <netinet/tcp.h> 92 #include <netinet/tcp_fsm.h> 93 #include <netinet/tcp_seq.h> 94 #include <netinet/tcp_timer.h> 95 #include <netinet/tcp_var.h> 96 #include <netinet/tcp_debug.h> 97 98 #if NPF > 0 99 #include <net/pfvar.h> 100 #endif 101 102 struct tcpiphdr tcp_saveti; 103 104 int tcp_mss_adv(struct mbuf *, int); 105 int tcp_flush_queue(struct tcpcb *); 106 107 #ifdef INET6 108 #include <netinet6/in6_var.h> 109 #include <netinet6/nd6.h> 110 111 struct tcpipv6hdr tcp_saveti6; 112 113 /* for the packet header length in the mbuf */ 114 #define M_PH_LEN(m) (((struct mbuf *)(m))->m_pkthdr.len) 115 #define M_V6_LEN(m) (M_PH_LEN(m) - sizeof(struct ip6_hdr)) 116 #define M_V4_LEN(m) (M_PH_LEN(m) - sizeof(struct ip)) 117 #endif /* INET6 */ 118 119 int tcprexmtthresh = 3; 120 int tcptv_keep_init = TCPTV_KEEP_INIT; 121 122 int tcp_rst_ppslim = 100; /* 100pps */ 123 int tcp_rst_ppslim_count = 0; 124 struct timeval tcp_rst_ppslim_last; 125 126 int tcp_ackdrop_ppslim = 100; /* 100pps */ 127 int tcp_ackdrop_ppslim_count = 0; 128 struct timeval tcp_ackdrop_ppslim_last; 129 130 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 131 132 /* for modulo comparisons of timestamps */ 133 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 134 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 135 136 /* for TCP SACK comparisons */ 137 #define SEQ_MIN(a,b) (SEQ_LT(a,b) ? (a) : (b)) 138 #define SEQ_MAX(a,b) (SEQ_GT(a,b) ? (a) : (b)) 139 140 /* 141 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. 142 */ 143 #ifdef INET6 144 #define ND6_HINT(tp) \ 145 do { \ 146 if (tp && tp->t_inpcb && (tp->t_inpcb->inp_flags & INP_IPV6) && \ 147 rtisvalid(tp->t_inpcb->inp_route6.ro_rt)) { \ 148 nd6_nud_hint(tp->t_inpcb->inp_route6.ro_rt); \ 149 } \ 150 } while (0) 151 #else 152 #define ND6_HINT(tp) 153 #endif 154 155 #ifdef TCP_ECN 156 /* 157 * ECN (Explicit Congestion Notification) support based on RFC3168 158 * implementation note: 159 * snd_last is used to track a recovery phase. 160 * when cwnd is reduced, snd_last is set to snd_max. 161 * while snd_last > snd_una, the sender is in a recovery phase and 162 * its cwnd should not be reduced again. 163 * snd_last follows snd_una when not in a recovery phase. 164 */ 165 #endif 166 167 /* 168 * Macro to compute ACK transmission behavior. Delay the ACK unless 169 * we have already delayed an ACK (must send an ACK every two segments). 170 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 171 * option is enabled or when the packet is coming from a loopback 172 * interface. 173 */ 174 #define TCP_SETUP_ACK(tp, tiflags, m) \ 175 do { \ 176 struct ifnet *ifp = NULL; \ 177 if (m && (m->m_flags & M_PKTHDR)) \ 178 ifp = if_get(m->m_pkthdr.ph_ifidx); \ 179 if ((tp)->t_flags & TF_DELACK || \ 180 (tcp_ack_on_push && (tiflags) & TH_PUSH) || \ 181 (ifp && (ifp->if_flags & IFF_LOOPBACK))) \ 182 tp->t_flags |= TF_ACKNOW; \ 183 else \ 184 TCP_SET_DELACK(tp); \ 185 if_put(ifp); \ 186 } while (0) 187 188 void tcp_sack_partialack(struct tcpcb *, struct tcphdr *); 189 void tcp_newreno_partialack(struct tcpcb *, struct tcphdr *); 190 191 void syn_cache_put(struct syn_cache *); 192 void syn_cache_rm(struct syn_cache *); 193 int syn_cache_respond(struct syn_cache *, struct mbuf *); 194 void syn_cache_timer(void *); 195 void syn_cache_reaper(void *); 196 void syn_cache_insert(struct syn_cache *, struct tcpcb *); 197 void syn_cache_reset(struct sockaddr *, struct sockaddr *, 198 struct tcphdr *, u_int); 199 int syn_cache_add(struct sockaddr *, struct sockaddr *, struct tcphdr *, 200 unsigned int, struct socket *, struct mbuf *, u_char *, int, 201 struct tcp_opt_info *, tcp_seq *); 202 struct socket *syn_cache_get(struct sockaddr *, struct sockaddr *, 203 struct tcphdr *, unsigned int, unsigned int, struct socket *, 204 struct mbuf *); 205 struct syn_cache *syn_cache_lookup(struct sockaddr *, struct sockaddr *, 206 struct syn_cache_head **, u_int); 207 208 /* 209 * Insert segment ti into reassembly queue of tcp with 210 * control block tp. Return TH_FIN if reassembly now includes 211 * a segment with FIN. The macro form does the common case inline 212 * (segment is the next to be received on an established connection, 213 * and the queue is empty), avoiding linkage into and removal 214 * from the queue and repetition of various conversions. 215 * Set DELACK for segments received in order, but ack immediately 216 * when segments are out of order (so fast retransmit can work). 217 */ 218 219 int 220 tcp_reass(struct tcpcb *tp, struct tcphdr *th, struct mbuf *m, int *tlen) 221 { 222 struct tcpqent *p, *q, *nq, *tiqe; 223 224 /* 225 * Allocate a new queue entry, before we throw away any data. 226 * If we can't, just drop the packet. XXX 227 */ 228 tiqe = pool_get(&tcpqe_pool, PR_NOWAIT); 229 if (tiqe == NULL) { 230 tiqe = TAILQ_LAST(&tp->t_segq, tcpqehead); 231 if (tiqe != NULL && th->th_seq == tp->rcv_nxt) { 232 /* Reuse last entry since new segment fills a hole */ 233 m_freem(tiqe->tcpqe_m); 234 TAILQ_REMOVE(&tp->t_segq, tiqe, tcpqe_q); 235 } 236 if (tiqe == NULL || th->th_seq != tp->rcv_nxt) { 237 /* Flush segment queue for this connection */ 238 tcp_freeq(tp); 239 tcpstat_inc(tcps_rcvmemdrop); 240 m_freem(m); 241 return (0); 242 } 243 } 244 245 /* 246 * Find a segment which begins after this one does. 247 */ 248 for (p = NULL, q = TAILQ_FIRST(&tp->t_segq); q != NULL; 249 p = q, q = TAILQ_NEXT(q, tcpqe_q)) 250 if (SEQ_GT(q->tcpqe_tcp->th_seq, th->th_seq)) 251 break; 252 253 /* 254 * If there is a preceding segment, it may provide some of 255 * our data already. If so, drop the data from the incoming 256 * segment. If it provides all of our data, drop us. 257 */ 258 if (p != NULL) { 259 struct tcphdr *phdr = p->tcpqe_tcp; 260 int i; 261 262 /* conversion to int (in i) handles seq wraparound */ 263 i = phdr->th_seq + phdr->th_reseqlen - th->th_seq; 264 if (i > 0) { 265 if (i >= *tlen) { 266 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte, 267 *tlen); 268 m_freem(m); 269 pool_put(&tcpqe_pool, tiqe); 270 return (0); 271 } 272 m_adj(m, i); 273 *tlen -= i; 274 th->th_seq += i; 275 } 276 } 277 tcpstat_pkt(tcps_rcvoopack, tcps_rcvoobyte, *tlen); 278 279 /* 280 * While we overlap succeeding segments trim them or, 281 * if they are completely covered, dequeue them. 282 */ 283 for (; q != NULL; q = nq) { 284 struct tcphdr *qhdr = q->tcpqe_tcp; 285 int i = (th->th_seq + *tlen) - qhdr->th_seq; 286 287 if (i <= 0) 288 break; 289 if (i < qhdr->th_reseqlen) { 290 qhdr->th_seq += i; 291 qhdr->th_reseqlen -= i; 292 m_adj(q->tcpqe_m, i); 293 break; 294 } 295 nq = TAILQ_NEXT(q, tcpqe_q); 296 m_freem(q->tcpqe_m); 297 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 298 pool_put(&tcpqe_pool, q); 299 } 300 301 /* Insert the new segment queue entry into place. */ 302 tiqe->tcpqe_m = m; 303 th->th_reseqlen = *tlen; 304 tiqe->tcpqe_tcp = th; 305 if (p == NULL) { 306 TAILQ_INSERT_HEAD(&tp->t_segq, tiqe, tcpqe_q); 307 } else { 308 TAILQ_INSERT_AFTER(&tp->t_segq, p, tiqe, tcpqe_q); 309 } 310 311 if (th->th_seq != tp->rcv_nxt) 312 return (0); 313 314 return (tcp_flush_queue(tp)); 315 } 316 317 int 318 tcp_flush_queue(struct tcpcb *tp) 319 { 320 struct socket *so = tp->t_inpcb->inp_socket; 321 struct tcpqent *q, *nq; 322 int flags; 323 324 /* 325 * Present data to user, advancing rcv_nxt through 326 * completed sequence space. 327 */ 328 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 329 return (0); 330 q = TAILQ_FIRST(&tp->t_segq); 331 if (q == NULL || q->tcpqe_tcp->th_seq != tp->rcv_nxt) 332 return (0); 333 if (tp->t_state == TCPS_SYN_RECEIVED && q->tcpqe_tcp->th_reseqlen) 334 return (0); 335 do { 336 tp->rcv_nxt += q->tcpqe_tcp->th_reseqlen; 337 flags = q->tcpqe_tcp->th_flags & TH_FIN; 338 339 nq = TAILQ_NEXT(q, tcpqe_q); 340 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q); 341 ND6_HINT(tp); 342 if (so->so_state & SS_CANTRCVMORE) 343 m_freem(q->tcpqe_m); 344 else 345 sbappendstream(so, &so->so_rcv, q->tcpqe_m); 346 pool_put(&tcpqe_pool, q); 347 q = nq; 348 } while (q != NULL && q->tcpqe_tcp->th_seq == tp->rcv_nxt); 349 tp->t_flags |= TF_BLOCKOUTPUT; 350 sorwakeup(so); 351 tp->t_flags &= ~TF_BLOCKOUTPUT; 352 return (flags); 353 } 354 355 /* 356 * TCP input routine, follows pages 65-76 of the 357 * protocol specification dated September, 1981 very closely. 358 */ 359 int 360 tcp_input(struct mbuf **mp, int *offp, int proto, int af) 361 { 362 struct mbuf *m = *mp; 363 int iphlen = *offp; 364 struct ip *ip = NULL; 365 struct inpcb *inp = NULL; 366 u_int8_t *optp = NULL; 367 int optlen = 0; 368 int tlen, off; 369 struct tcpcb *tp = NULL; 370 int tiflags; 371 struct socket *so = NULL; 372 int todrop, acked, ourfinisacked; 373 int hdroptlen = 0; 374 short ostate = 0; 375 tcp_seq iss, *reuse = NULL; 376 u_long tiwin; 377 struct tcp_opt_info opti; 378 struct tcphdr *th; 379 #ifdef INET6 380 struct ip6_hdr *ip6 = NULL; 381 #endif /* INET6 */ 382 #ifdef IPSEC 383 struct m_tag *mtag; 384 struct tdb_ident *tdbi; 385 struct tdb *tdb; 386 int error; 387 #endif /* IPSEC */ 388 #ifdef TCP_ECN 389 u_char iptos; 390 #endif 391 392 tcpstat_inc(tcps_rcvtotal); 393 394 opti.ts_present = 0; 395 opti.maxseg = 0; 396 397 /* 398 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 399 */ 400 if (m->m_flags & (M_BCAST|M_MCAST)) 401 goto drop; 402 403 /* 404 * Get IP and TCP header together in first mbuf. 405 * Note: IP leaves IP header in first mbuf. 406 */ 407 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, sizeof(*th)); 408 if (!th) { 409 tcpstat_inc(tcps_rcvshort); 410 return IPPROTO_DONE; 411 } 412 413 tlen = m->m_pkthdr.len - iphlen; 414 switch (af) { 415 case AF_INET: 416 ip = mtod(m, struct ip *); 417 #ifdef TCP_ECN 418 /* save ip_tos before clearing it for checksum */ 419 iptos = ip->ip_tos; 420 #endif 421 break; 422 #ifdef INET6 423 case AF_INET6: 424 ip6 = mtod(m, struct ip6_hdr *); 425 #ifdef TCP_ECN 426 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 427 #endif 428 429 /* 430 * Be proactive about unspecified IPv6 address in source. 431 * As we use all-zero to indicate unbounded/unconnected pcb, 432 * unspecified IPv6 address can be used to confuse us. 433 * 434 * Note that packets with unspecified IPv6 destination is 435 * already dropped in ip6_input. 436 */ 437 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 438 /* XXX stat */ 439 goto drop; 440 } 441 442 /* Discard packets to multicast */ 443 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 444 /* XXX stat */ 445 goto drop; 446 } 447 break; 448 #endif 449 default: 450 unhandled_af(af); 451 } 452 453 /* 454 * Checksum extended TCP header and data. 455 */ 456 if ((m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_OK) == 0) { 457 int sum; 458 459 if (m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_BAD) { 460 tcpstat_inc(tcps_rcvbadsum); 461 goto drop; 462 } 463 tcpstat_inc(tcps_inswcsum); 464 switch (af) { 465 case AF_INET: 466 sum = in4_cksum(m, IPPROTO_TCP, iphlen, tlen); 467 break; 468 #ifdef INET6 469 case AF_INET6: 470 sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr), 471 tlen); 472 break; 473 #endif 474 } 475 if (sum != 0) { 476 tcpstat_inc(tcps_rcvbadsum); 477 goto drop; 478 } 479 } 480 481 /* 482 * Check that TCP offset makes sense, 483 * pull out TCP options and adjust length. XXX 484 */ 485 off = th->th_off << 2; 486 if (off < sizeof(struct tcphdr) || off > tlen) { 487 tcpstat_inc(tcps_rcvbadoff); 488 goto drop; 489 } 490 tlen -= off; 491 if (off > sizeof(struct tcphdr)) { 492 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, off); 493 if (!th) { 494 tcpstat_inc(tcps_rcvshort); 495 return IPPROTO_DONE; 496 } 497 optlen = off - sizeof(struct tcphdr); 498 optp = (u_int8_t *)(th + 1); 499 /* 500 * Do quick retrieval of timestamp options ("options 501 * prediction?"). If timestamp is the only option and it's 502 * formatted as recommended in RFC 1323 appendix A, we 503 * quickly get the values now and not bother calling 504 * tcp_dooptions(), etc. 505 */ 506 if ((optlen == TCPOLEN_TSTAMP_APPA || 507 (optlen > TCPOLEN_TSTAMP_APPA && 508 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 509 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 510 (th->th_flags & TH_SYN) == 0) { 511 opti.ts_present = 1; 512 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 513 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 514 optp = NULL; /* we've parsed the options */ 515 } 516 } 517 tiflags = th->th_flags; 518 519 /* 520 * Convert TCP protocol specific fields to host format. 521 */ 522 th->th_seq = ntohl(th->th_seq); 523 th->th_ack = ntohl(th->th_ack); 524 th->th_win = ntohs(th->th_win); 525 th->th_urp = ntohs(th->th_urp); 526 527 /* 528 * Locate pcb for segment. 529 */ 530 #if NPF > 0 531 inp = pf_inp_lookup(m); 532 #endif 533 findpcb: 534 if (inp == NULL) { 535 switch (af) { 536 #ifdef INET6 537 case AF_INET6: 538 inp = in6_pcbhashlookup(&tcbtable, &ip6->ip6_src, 539 th->th_sport, &ip6->ip6_dst, th->th_dport, 540 m->m_pkthdr.ph_rtableid); 541 break; 542 #endif 543 case AF_INET: 544 inp = in_pcbhashlookup(&tcbtable, ip->ip_src, 545 th->th_sport, ip->ip_dst, th->th_dport, 546 m->m_pkthdr.ph_rtableid); 547 break; 548 } 549 } 550 if (inp == NULL) { 551 int inpl_reverse = 0; 552 if (m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) 553 inpl_reverse = 1; 554 tcpstat_inc(tcps_pcbhashmiss); 555 switch (af) { 556 #ifdef INET6 557 case AF_INET6: 558 inp = in6_pcblookup_listen(&tcbtable, 559 &ip6->ip6_dst, th->th_dport, inpl_reverse, m, 560 m->m_pkthdr.ph_rtableid); 561 break; 562 #endif /* INET6 */ 563 case AF_INET: 564 inp = in_pcblookup_listen(&tcbtable, 565 ip->ip_dst, th->th_dport, inpl_reverse, m, 566 m->m_pkthdr.ph_rtableid); 567 break; 568 } 569 /* 570 * If the state is CLOSED (i.e., TCB does not exist) then 571 * all data in the incoming segment is discarded. 572 * If the TCB exists but is in CLOSED state, it is embryonic, 573 * but should either do a listen or a connect soon. 574 */ 575 if (inp == NULL) { 576 tcpstat_inc(tcps_noport); 577 goto dropwithreset_ratelim; 578 } 579 } 580 KASSERT(sotoinpcb(inp->inp_socket) == inp); 581 KASSERT(intotcpcb(inp) == NULL || intotcpcb(inp)->t_inpcb == inp); 582 583 /* Check the minimum TTL for socket. */ 584 switch (af) { 585 case AF_INET: 586 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) 587 goto drop; 588 break; 589 #ifdef INET6 590 case AF_INET6: 591 if (inp->inp_ip6_minhlim && 592 inp->inp_ip6_minhlim > ip6->ip6_hlim) 593 goto drop; 594 break; 595 #endif 596 } 597 598 tp = intotcpcb(inp); 599 if (tp == NULL) 600 goto dropwithreset_ratelim; 601 if (tp->t_state == TCPS_CLOSED) 602 goto drop; 603 604 /* Unscale the window into a 32-bit value. */ 605 if ((tiflags & TH_SYN) == 0) 606 tiwin = th->th_win << tp->snd_scale; 607 else 608 tiwin = th->th_win; 609 610 so = inp->inp_socket; 611 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 612 union syn_cache_sa src; 613 union syn_cache_sa dst; 614 615 bzero(&src, sizeof(src)); 616 bzero(&dst, sizeof(dst)); 617 switch (af) { 618 case AF_INET: 619 src.sin.sin_len = sizeof(struct sockaddr_in); 620 src.sin.sin_family = AF_INET; 621 src.sin.sin_addr = ip->ip_src; 622 src.sin.sin_port = th->th_sport; 623 624 dst.sin.sin_len = sizeof(struct sockaddr_in); 625 dst.sin.sin_family = AF_INET; 626 dst.sin.sin_addr = ip->ip_dst; 627 dst.sin.sin_port = th->th_dport; 628 break; 629 #ifdef INET6 630 case AF_INET6: 631 src.sin6.sin6_len = sizeof(struct sockaddr_in6); 632 src.sin6.sin6_family = AF_INET6; 633 src.sin6.sin6_addr = ip6->ip6_src; 634 src.sin6.sin6_port = th->th_sport; 635 636 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 637 dst.sin6.sin6_family = AF_INET6; 638 dst.sin6.sin6_addr = ip6->ip6_dst; 639 dst.sin6.sin6_port = th->th_dport; 640 break; 641 #endif /* INET6 */ 642 default: 643 goto badsyn; /*sanity*/ 644 } 645 646 if (so->so_options & SO_DEBUG) { 647 ostate = tp->t_state; 648 switch (af) { 649 #ifdef INET6 650 case AF_INET6: 651 memcpy(&tcp_saveti6.ti6_i, ip6, sizeof(*ip6)); 652 memcpy(&tcp_saveti6.ti6_t, th, sizeof(*th)); 653 break; 654 #endif 655 case AF_INET: 656 memcpy(&tcp_saveti.ti_i, ip, sizeof(*ip)); 657 memcpy(&tcp_saveti.ti_t, th, sizeof(*th)); 658 break; 659 } 660 } 661 if (so->so_options & SO_ACCEPTCONN) { 662 switch (tiflags & (TH_RST|TH_SYN|TH_ACK)) { 663 664 case TH_SYN|TH_ACK|TH_RST: 665 case TH_SYN|TH_RST: 666 case TH_ACK|TH_RST: 667 case TH_RST: 668 syn_cache_reset(&src.sa, &dst.sa, th, 669 inp->inp_rtableid); 670 goto drop; 671 672 case TH_SYN|TH_ACK: 673 /* 674 * Received a SYN,ACK. This should 675 * never happen while we are in 676 * LISTEN. Send an RST. 677 */ 678 goto badsyn; 679 680 case TH_ACK: 681 so = syn_cache_get(&src.sa, &dst.sa, 682 th, iphlen, tlen, so, m); 683 if (so == NULL) { 684 /* 685 * We don't have a SYN for 686 * this ACK; send an RST. 687 */ 688 goto badsyn; 689 } else if (so == (struct socket *)(-1)) { 690 /* 691 * We were unable to create 692 * the connection. If the 693 * 3-way handshake was 694 * completed, and RST has 695 * been sent to the peer. 696 * Since the mbuf might be 697 * in use for the reply, 698 * do not free it. 699 */ 700 m = *mp = NULL; 701 goto drop; 702 } else { 703 /* 704 * We have created a 705 * full-blown connection. 706 */ 707 tp = NULL; 708 inp = sotoinpcb(so); 709 tp = intotcpcb(inp); 710 if (tp == NULL) 711 goto badsyn; /*XXX*/ 712 713 } 714 break; 715 716 default: 717 /* 718 * None of RST, SYN or ACK was set. 719 * This is an invalid packet for a 720 * TCB in LISTEN state. Send a RST. 721 */ 722 goto badsyn; 723 724 case TH_SYN: 725 /* 726 * Received a SYN. 727 */ 728 #ifdef INET6 729 /* 730 * If deprecated address is forbidden, we do 731 * not accept SYN to deprecated interface 732 * address to prevent any new inbound 733 * connection from getting established. 734 * When we do not accept SYN, we send a TCP 735 * RST, with deprecated source address (instead 736 * of dropping it). We compromise it as it is 737 * much better for peer to send a RST, and 738 * RST will be the final packet for the 739 * exchange. 740 * 741 * If we do not forbid deprecated addresses, we 742 * accept the SYN packet. RFC2462 does not 743 * suggest dropping SYN in this case. 744 * If we decipher RFC2462 5.5.4, it says like 745 * this: 746 * 1. use of deprecated addr with existing 747 * communication is okay - "SHOULD continue 748 * to be used" 749 * 2. use of it with new communication: 750 * (2a) "SHOULD NOT be used if alternate 751 * address with sufficient scope is 752 * available" 753 * (2b) nothing mentioned otherwise. 754 * Here we fall into (2b) case as we have no 755 * choice in our source address selection - we 756 * must obey the peer. 757 * 758 * The wording in RFC2462 is confusing, and 759 * there are multiple description text for 760 * deprecated address handling - worse, they 761 * are not exactly the same. I believe 5.5.4 762 * is the best one, so we follow 5.5.4. 763 */ 764 if (ip6 && !ip6_use_deprecated) { 765 struct in6_ifaddr *ia6; 766 struct ifnet *ifp = 767 if_get(m->m_pkthdr.ph_ifidx); 768 769 if (ifp && 770 (ia6 = in6ifa_ifpwithaddr(ifp, 771 &ip6->ip6_dst)) && 772 (ia6->ia6_flags & 773 IN6_IFF_DEPRECATED)) { 774 tp = NULL; 775 if_put(ifp); 776 goto dropwithreset; 777 } 778 if_put(ifp); 779 } 780 #endif 781 782 /* 783 * LISTEN socket received a SYN 784 * from itself? This can't possibly 785 * be valid; drop the packet. 786 */ 787 if (th->th_dport == th->th_sport) { 788 switch (af) { 789 #ifdef INET6 790 case AF_INET6: 791 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, 792 &ip6->ip6_dst)) { 793 tcpstat_inc(tcps_badsyn); 794 goto drop; 795 } 796 break; 797 #endif /* INET6 */ 798 case AF_INET: 799 if (ip->ip_dst.s_addr == ip->ip_src.s_addr) { 800 tcpstat_inc(tcps_badsyn); 801 goto drop; 802 } 803 break; 804 } 805 } 806 807 /* 808 * SYN looks ok; create compressed TCP 809 * state for it. 810 */ 811 if (so->so_qlen > so->so_qlimit || 812 syn_cache_add(&src.sa, &dst.sa, th, iphlen, 813 so, m, optp, optlen, &opti, reuse) == -1) { 814 tcpstat_inc(tcps_dropsyn); 815 goto drop; 816 } 817 return IPPROTO_DONE; 818 } 819 } 820 } 821 822 #ifdef DIAGNOSTIC 823 /* 824 * Should not happen now that all embryonic connections 825 * are handled with compressed state. 826 */ 827 if (tp->t_state == TCPS_LISTEN) 828 panic("tcp_input: TCPS_LISTEN"); 829 #endif 830 831 #if NPF > 0 832 pf_inp_link(m, inp); 833 #endif 834 835 #ifdef IPSEC 836 /* Find most recent IPsec tag */ 837 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 838 if (mtag != NULL) { 839 tdbi = (struct tdb_ident *)(mtag + 1); 840 tdb = gettdb(tdbi->rdomain, tdbi->spi, 841 &tdbi->dst, tdbi->proto); 842 } else 843 tdb = NULL; 844 ipsp_spd_lookup(m, af, iphlen, &error, IPSP_DIRECTION_IN, 845 tdb, inp, 0); 846 if (error) { 847 tcpstat_inc(tcps_rcvnosec); 848 goto drop; 849 } 850 #endif /* IPSEC */ 851 852 /* 853 * Segment received on connection. 854 * Reset idle time and keep-alive timer. 855 */ 856 tp->t_rcvtime = tcp_now; 857 if (TCPS_HAVEESTABLISHED(tp->t_state)) 858 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 859 860 if (tp->sack_enable) 861 tcp_del_sackholes(tp, th); /* Delete stale SACK holes */ 862 863 /* 864 * Process options. 865 */ 866 #ifdef TCP_SIGNATURE 867 if (optp || (tp->t_flags & TF_SIGNATURE)) 868 #else 869 if (optp) 870 #endif 871 if (tcp_dooptions(tp, optp, optlen, th, m, iphlen, &opti, 872 m->m_pkthdr.ph_rtableid)) 873 goto drop; 874 875 if (opti.ts_present && opti.ts_ecr) { 876 int rtt_test; 877 878 /* subtract out the tcp timestamp modulator */ 879 opti.ts_ecr -= tp->ts_modulate; 880 881 /* make sure ts_ecr is sensible */ 882 rtt_test = tcp_now - opti.ts_ecr; 883 if (rtt_test < 0 || rtt_test > TCP_RTT_MAX) 884 opti.ts_ecr = 0; 885 } 886 887 #ifdef TCP_ECN 888 /* if congestion experienced, set ECE bit in subsequent packets. */ 889 if ((iptos & IPTOS_ECN_MASK) == IPTOS_ECN_CE) { 890 tp->t_flags |= TF_RCVD_CE; 891 tcpstat_inc(tcps_ecn_rcvce); 892 } 893 #endif 894 /* 895 * Header prediction: check for the two common cases 896 * of a uni-directional data xfer. If the packet has 897 * no control flags, is in-sequence, the window didn't 898 * change and we're not retransmitting, it's a 899 * candidate. If the length is zero and the ack moved 900 * forward, we're the sender side of the xfer. Just 901 * free the data acked & wake any higher level process 902 * that was blocked waiting for space. If the length 903 * is non-zero and the ack didn't move, we're the 904 * receiver side. If we're getting packets in-order 905 * (the reassembly queue is empty), add the data to 906 * the socket buffer and note that we need a delayed ack. 907 */ 908 if (tp->t_state == TCPS_ESTABLISHED && 909 #ifdef TCP_ECN 910 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK)) == TH_ACK && 911 #else 912 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 913 #endif 914 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 915 th->th_seq == tp->rcv_nxt && 916 tiwin && tiwin == tp->snd_wnd && 917 tp->snd_nxt == tp->snd_max) { 918 919 /* 920 * If last ACK falls within this segment's sequence numbers, 921 * record the timestamp. 922 * Fix from Braden, see Stevens p. 870 923 */ 924 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 925 tp->ts_recent_age = tcp_now; 926 tp->ts_recent = opti.ts_val; 927 } 928 929 if (tlen == 0) { 930 if (SEQ_GT(th->th_ack, tp->snd_una) && 931 SEQ_LEQ(th->th_ack, tp->snd_max) && 932 tp->snd_cwnd >= tp->snd_wnd && 933 tp->t_dupacks == 0) { 934 /* 935 * this is a pure ack for outstanding data. 936 */ 937 tcpstat_inc(tcps_predack); 938 if (opti.ts_present && opti.ts_ecr) 939 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 940 else if (tp->t_rtttime && 941 SEQ_GT(th->th_ack, tp->t_rtseq)) 942 tcp_xmit_timer(tp, 943 tcp_now - tp->t_rtttime); 944 acked = th->th_ack - tp->snd_una; 945 tcpstat_pkt(tcps_rcvackpack, tcps_rcvackbyte, 946 acked); 947 ND6_HINT(tp); 948 sbdrop(so, &so->so_snd, acked); 949 950 /* 951 * If we had a pending ICMP message that 952 * refers to data that have just been 953 * acknowledged, disregard the recorded ICMP 954 * message. 955 */ 956 if ((tp->t_flags & TF_PMTUD_PEND) && 957 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 958 tp->t_flags &= ~TF_PMTUD_PEND; 959 960 /* 961 * Keep track of the largest chunk of data 962 * acknowledged since last PMTU update 963 */ 964 if (tp->t_pmtud_mss_acked < acked) 965 tp->t_pmtud_mss_acked = acked; 966 967 tp->snd_una = th->th_ack; 968 /* 969 * We want snd_last to track snd_una so 970 * as to avoid sequence wraparound problems 971 * for very large transfers. 972 */ 973 #ifdef TCP_ECN 974 if (SEQ_GT(tp->snd_una, tp->snd_last)) 975 #endif 976 tp->snd_last = tp->snd_una; 977 m_freem(m); 978 979 /* 980 * If all outstanding data are acked, stop 981 * retransmit timer, otherwise restart timer 982 * using current (possibly backed-off) value. 983 * If process is waiting for space, 984 * wakeup/selwakeup/signal. If data 985 * are ready to send, let tcp_output 986 * decide between more output or persist. 987 */ 988 if (tp->snd_una == tp->snd_max) 989 TCP_TIMER_DISARM(tp, TCPT_REXMT); 990 else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 991 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 992 993 tcp_update_sndspace(tp); 994 if (sb_notify(so, &so->so_snd)) { 995 tp->t_flags |= TF_BLOCKOUTPUT; 996 sowwakeup(so); 997 tp->t_flags &= ~TF_BLOCKOUTPUT; 998 } 999 if (so->so_snd.sb_cc || 1000 tp->t_flags & TF_NEEDOUTPUT) 1001 (void) tcp_output(tp); 1002 return IPPROTO_DONE; 1003 } 1004 } else if (th->th_ack == tp->snd_una && 1005 TAILQ_EMPTY(&tp->t_segq) && 1006 tlen <= sbspace(so, &so->so_rcv)) { 1007 /* 1008 * This is a pure, in-sequence data packet 1009 * with nothing on the reassembly queue and 1010 * we have enough buffer space to take it. 1011 */ 1012 /* Clean receiver SACK report if present */ 1013 if (tp->sack_enable && tp->rcv_numsacks) 1014 tcp_clean_sackreport(tp); 1015 tcpstat_inc(tcps_preddat); 1016 tp->rcv_nxt += tlen; 1017 tcpstat_pkt(tcps_rcvpack, tcps_rcvbyte, tlen); 1018 ND6_HINT(tp); 1019 1020 TCP_SETUP_ACK(tp, tiflags, m); 1021 /* 1022 * Drop TCP, IP headers and TCP options then add data 1023 * to socket buffer. 1024 */ 1025 if (so->so_state & SS_CANTRCVMORE) 1026 m_freem(m); 1027 else { 1028 if (opti.ts_present && opti.ts_ecr) { 1029 if (tp->rfbuf_ts < opti.ts_ecr && 1030 opti.ts_ecr - tp->rfbuf_ts < hz) { 1031 tcp_update_rcvspace(tp); 1032 /* Start over with next RTT. */ 1033 tp->rfbuf_cnt = 0; 1034 tp->rfbuf_ts = 0; 1035 } else 1036 tp->rfbuf_cnt += tlen; 1037 } 1038 m_adj(m, iphlen + off); 1039 sbappendstream(so, &so->so_rcv, m); 1040 } 1041 tp->t_flags |= TF_BLOCKOUTPUT; 1042 sorwakeup(so); 1043 tp->t_flags &= ~TF_BLOCKOUTPUT; 1044 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT)) 1045 (void) tcp_output(tp); 1046 return IPPROTO_DONE; 1047 } 1048 } 1049 1050 /* 1051 * Compute mbuf offset to TCP data segment. 1052 */ 1053 hdroptlen = iphlen + off; 1054 1055 /* 1056 * Calculate amount of space in receive window, 1057 * and then do TCP input processing. 1058 * Receive window is amount of space in rcv queue, 1059 * but not less than advertised window. 1060 */ 1061 { int win; 1062 1063 win = sbspace(so, &so->so_rcv); 1064 if (win < 0) 1065 win = 0; 1066 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1067 } 1068 1069 /* Reset receive buffer auto scaling when not in bulk receive mode. */ 1070 tp->rfbuf_cnt = 0; 1071 tp->rfbuf_ts = 0; 1072 1073 switch (tp->t_state) { 1074 1075 /* 1076 * If the state is SYN_RECEIVED: 1077 * if seg contains SYN/ACK, send an RST. 1078 * if seg contains an ACK, but not for our SYN/ACK, send an RST 1079 */ 1080 1081 case TCPS_SYN_RECEIVED: 1082 if (tiflags & TH_ACK) { 1083 if (tiflags & TH_SYN) { 1084 tcpstat_inc(tcps_badsyn); 1085 goto dropwithreset; 1086 } 1087 if (SEQ_LEQ(th->th_ack, tp->snd_una) || 1088 SEQ_GT(th->th_ack, tp->snd_max)) 1089 goto dropwithreset; 1090 } 1091 break; 1092 1093 /* 1094 * If the state is SYN_SENT: 1095 * if seg contains an ACK, but not for our SYN, drop the input. 1096 * if seg contains a RST, then drop the connection. 1097 * if seg does not contain SYN, then drop it. 1098 * Otherwise this is an acceptable SYN segment 1099 * initialize tp->rcv_nxt and tp->irs 1100 * if seg contains ack then advance tp->snd_una 1101 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1102 * arrange for segment to be acked (eventually) 1103 * continue processing rest of data/controls, beginning with URG 1104 */ 1105 case TCPS_SYN_SENT: 1106 if ((tiflags & TH_ACK) && 1107 (SEQ_LEQ(th->th_ack, tp->iss) || 1108 SEQ_GT(th->th_ack, tp->snd_max))) 1109 goto dropwithreset; 1110 if (tiflags & TH_RST) { 1111 #ifdef TCP_ECN 1112 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1113 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1114 goto drop; 1115 #endif 1116 if (tiflags & TH_ACK) 1117 tp = tcp_drop(tp, ECONNREFUSED); 1118 goto drop; 1119 } 1120 if ((tiflags & TH_SYN) == 0) 1121 goto drop; 1122 if (tiflags & TH_ACK) { 1123 tp->snd_una = th->th_ack; 1124 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1125 tp->snd_nxt = tp->snd_una; 1126 } 1127 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1128 tp->irs = th->th_seq; 1129 tcp_mss(tp, opti.maxseg); 1130 /* Reset initial window to 1 segment for retransmit */ 1131 if (tp->t_rxtshift > 0) 1132 tp->snd_cwnd = tp->t_maxseg; 1133 tcp_rcvseqinit(tp); 1134 tp->t_flags |= TF_ACKNOW; 1135 /* 1136 * If we've sent a SACK_PERMITTED option, and the peer 1137 * also replied with one, then TF_SACK_PERMIT should have 1138 * been set in tcp_dooptions(). If it was not, disable SACKs. 1139 */ 1140 if (tp->sack_enable) 1141 tp->sack_enable = tp->t_flags & TF_SACK_PERMIT; 1142 #ifdef TCP_ECN 1143 /* 1144 * if ECE is set but CWR is not set for SYN-ACK, or 1145 * both ECE and CWR are set for simultaneous open, 1146 * peer is ECN capable. 1147 */ 1148 if (tcp_do_ecn) { 1149 switch (tiflags & (TH_ACK|TH_ECE|TH_CWR)) { 1150 case TH_ACK|TH_ECE: 1151 case TH_ECE|TH_CWR: 1152 tp->t_flags |= TF_ECN_PERMIT; 1153 tiflags &= ~(TH_ECE|TH_CWR); 1154 tcpstat_inc(tcps_ecn_accepts); 1155 } 1156 } 1157 #endif 1158 1159 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 1160 tcpstat_inc(tcps_connects); 1161 soisconnected(so); 1162 tp->t_state = TCPS_ESTABLISHED; 1163 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1164 /* Do window scaling on this connection? */ 1165 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1166 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1167 tp->snd_scale = tp->requested_s_scale; 1168 tp->rcv_scale = tp->request_r_scale; 1169 } 1170 tcp_flush_queue(tp); 1171 1172 /* 1173 * if we didn't have to retransmit the SYN, 1174 * use its rtt as our initial srtt & rtt var. 1175 */ 1176 if (tp->t_rtttime) 1177 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1178 /* 1179 * Since new data was acked (the SYN), open the 1180 * congestion window by one MSS. We do this 1181 * here, because we won't go through the normal 1182 * ACK processing below. And since this is the 1183 * start of the connection, we know we are in 1184 * the exponential phase of slow-start. 1185 */ 1186 tp->snd_cwnd += tp->t_maxseg; 1187 } else 1188 tp->t_state = TCPS_SYN_RECEIVED; 1189 1190 #if 0 1191 trimthenstep6: 1192 #endif 1193 /* 1194 * Advance th->th_seq to correspond to first data byte. 1195 * If data, trim to stay within window, 1196 * dropping FIN if necessary. 1197 */ 1198 th->th_seq++; 1199 if (tlen > tp->rcv_wnd) { 1200 todrop = tlen - tp->rcv_wnd; 1201 m_adj(m, -todrop); 1202 tlen = tp->rcv_wnd; 1203 tiflags &= ~TH_FIN; 1204 tcpstat_pkt(tcps_rcvpackafterwin, tcps_rcvbyteafterwin, 1205 todrop); 1206 } 1207 tp->snd_wl1 = th->th_seq - 1; 1208 tp->rcv_up = th->th_seq; 1209 goto step6; 1210 /* 1211 * If a new connection request is received while in TIME_WAIT, 1212 * drop the old connection and start over if the if the 1213 * timestamp or the sequence numbers are above the previous 1214 * ones. 1215 */ 1216 case TCPS_TIME_WAIT: 1217 if (((tiflags & (TH_SYN|TH_ACK)) == TH_SYN) && 1218 ((opti.ts_present && 1219 TSTMP_LT(tp->ts_recent, opti.ts_val)) || 1220 SEQ_GT(th->th_seq, tp->rcv_nxt))) { 1221 #if NPF > 0 1222 /* 1223 * The socket will be recreated but the new state 1224 * has already been linked to the socket. Remove the 1225 * link between old socket and new state. 1226 */ 1227 pf_inp_unlink(inp); 1228 #endif 1229 /* 1230 * Advance the iss by at least 32768, but 1231 * clear the msb in order to make sure 1232 * that SEG_LT(snd_nxt, iss). 1233 */ 1234 iss = tp->snd_nxt + 1235 ((arc4random() & 0x7fffffff) | 0x8000); 1236 reuse = &iss; 1237 tp = tcp_close(tp); 1238 inp = NULL; 1239 goto findpcb; 1240 } 1241 } 1242 1243 /* 1244 * States other than LISTEN or SYN_SENT. 1245 * First check timestamp, if present. 1246 * Then check that at least some bytes of segment are within 1247 * receive window. If segment begins before rcv_nxt, 1248 * drop leading data (and SYN); if nothing left, just ack. 1249 * 1250 * RFC 1323 PAWS: If we have a timestamp reply on this segment 1251 * and it's less than opti.ts_recent, drop it. 1252 */ 1253 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 1254 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 1255 1256 /* Check to see if ts_recent is over 24 days old. */ 1257 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1258 /* 1259 * Invalidate ts_recent. If this segment updates 1260 * ts_recent, the age will be reset later and ts_recent 1261 * will get a valid value. If it does not, setting 1262 * ts_recent to zero will at least satisfy the 1263 * requirement that zero be placed in the timestamp 1264 * echo reply when ts_recent isn't valid. The 1265 * age isn't reset until we get a valid ts_recent 1266 * because we don't want out-of-order segments to be 1267 * dropped when ts_recent is old. 1268 */ 1269 tp->ts_recent = 0; 1270 } else { 1271 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte, tlen); 1272 tcpstat_inc(tcps_pawsdrop); 1273 goto dropafterack; 1274 } 1275 } 1276 1277 todrop = tp->rcv_nxt - th->th_seq; 1278 if (todrop > 0) { 1279 if (tiflags & TH_SYN) { 1280 tiflags &= ~TH_SYN; 1281 th->th_seq++; 1282 if (th->th_urp > 1) 1283 th->th_urp--; 1284 else 1285 tiflags &= ~TH_URG; 1286 todrop--; 1287 } 1288 if (todrop > tlen || 1289 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 1290 /* 1291 * Any valid FIN must be to the left of the 1292 * window. At this point, FIN must be a 1293 * duplicate or out-of-sequence, so drop it. 1294 */ 1295 tiflags &= ~TH_FIN; 1296 /* 1297 * Send ACK to resynchronize, and drop any data, 1298 * but keep on processing for RST or ACK. 1299 */ 1300 tp->t_flags |= TF_ACKNOW; 1301 todrop = tlen; 1302 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte, todrop); 1303 } else { 1304 tcpstat_pkt(tcps_rcvpartduppack, tcps_rcvpartdupbyte, 1305 todrop); 1306 } 1307 hdroptlen += todrop; /* drop from head afterwards */ 1308 th->th_seq += todrop; 1309 tlen -= todrop; 1310 if (th->th_urp > todrop) 1311 th->th_urp -= todrop; 1312 else { 1313 tiflags &= ~TH_URG; 1314 th->th_urp = 0; 1315 } 1316 } 1317 1318 /* 1319 * If new data are received on a connection after the 1320 * user processes are gone, then RST the other end. 1321 */ 1322 if ((so->so_state & SS_NOFDREF) && 1323 tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1324 tp = tcp_close(tp); 1325 tcpstat_inc(tcps_rcvafterclose); 1326 goto dropwithreset; 1327 } 1328 1329 /* 1330 * If segment ends after window, drop trailing data 1331 * (and PUSH and FIN); if nothing left, just ACK. 1332 */ 1333 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1334 if (todrop > 0) { 1335 tcpstat_inc(tcps_rcvpackafterwin); 1336 if (todrop >= tlen) { 1337 tcpstat_add(tcps_rcvbyteafterwin, tlen); 1338 /* 1339 * If window is closed can only take segments at 1340 * window edge, and have to drop data and PUSH from 1341 * incoming segments. Continue processing, but 1342 * remember to ack. Otherwise, drop segment 1343 * and ack. 1344 */ 1345 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1346 tp->t_flags |= TF_ACKNOW; 1347 tcpstat_inc(tcps_rcvwinprobe); 1348 } else 1349 goto dropafterack; 1350 } else 1351 tcpstat_add(tcps_rcvbyteafterwin, todrop); 1352 m_adj(m, -todrop); 1353 tlen -= todrop; 1354 tiflags &= ~(TH_PUSH|TH_FIN); 1355 } 1356 1357 /* 1358 * If last ACK falls within this segment's sequence numbers, 1359 * record its timestamp if it's more recent. 1360 * NOTE that the test is modified according to the latest 1361 * proposal of the tcplw@cray.com list (Braden 1993/04/26). 1362 */ 1363 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1364 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { 1365 tp->ts_recent_age = tcp_now; 1366 tp->ts_recent = opti.ts_val; 1367 } 1368 1369 /* 1370 * If the RST bit is set examine the state: 1371 * SYN_RECEIVED STATE: 1372 * If passive open, return to LISTEN state. 1373 * If active open, inform user that connection was refused. 1374 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1375 * Inform user that connection was reset, and close tcb. 1376 * CLOSING, LAST_ACK, TIME_WAIT STATES 1377 * Close the tcb. 1378 */ 1379 if (tiflags & TH_RST) { 1380 if (th->th_seq != tp->last_ack_sent && 1381 th->th_seq != tp->rcv_nxt && 1382 th->th_seq != (tp->rcv_nxt + 1)) 1383 goto drop; 1384 1385 switch (tp->t_state) { 1386 case TCPS_SYN_RECEIVED: 1387 #ifdef TCP_ECN 1388 /* if ECN is enabled, fall back to non-ecn at rexmit */ 1389 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN)) 1390 goto drop; 1391 #endif 1392 so->so_error = ECONNREFUSED; 1393 goto close; 1394 1395 case TCPS_ESTABLISHED: 1396 case TCPS_FIN_WAIT_1: 1397 case TCPS_FIN_WAIT_2: 1398 case TCPS_CLOSE_WAIT: 1399 so->so_error = ECONNRESET; 1400 close: 1401 tp->t_state = TCPS_CLOSED; 1402 tcpstat_inc(tcps_drops); 1403 tp = tcp_close(tp); 1404 goto drop; 1405 case TCPS_CLOSING: 1406 case TCPS_LAST_ACK: 1407 case TCPS_TIME_WAIT: 1408 tp = tcp_close(tp); 1409 goto drop; 1410 } 1411 } 1412 1413 /* 1414 * If a SYN is in the window, then this is an 1415 * error and we ACK and drop the packet. 1416 */ 1417 if (tiflags & TH_SYN) 1418 goto dropafterack_ratelim; 1419 1420 /* 1421 * If the ACK bit is off we drop the segment and return. 1422 */ 1423 if ((tiflags & TH_ACK) == 0) { 1424 if (tp->t_flags & TF_ACKNOW) 1425 goto dropafterack; 1426 else 1427 goto drop; 1428 } 1429 1430 /* 1431 * Ack processing. 1432 */ 1433 switch (tp->t_state) { 1434 1435 /* 1436 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter 1437 * ESTABLISHED state and continue processing. 1438 * The ACK was checked above. 1439 */ 1440 case TCPS_SYN_RECEIVED: 1441 tcpstat_inc(tcps_connects); 1442 soisconnected(so); 1443 tp->t_state = TCPS_ESTABLISHED; 1444 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1445 /* Do window scaling? */ 1446 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1447 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1448 tp->snd_scale = tp->requested_s_scale; 1449 tp->rcv_scale = tp->request_r_scale; 1450 tiwin = th->th_win << tp->snd_scale; 1451 } 1452 tcp_flush_queue(tp); 1453 tp->snd_wl1 = th->th_seq - 1; 1454 /* fall into ... */ 1455 1456 /* 1457 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1458 * ACKs. If the ack is in the range 1459 * tp->snd_una < th->th_ack <= tp->snd_max 1460 * then advance tp->snd_una to th->th_ack and drop 1461 * data from the retransmission queue. If this ACK reflects 1462 * more up to date window information we update our window information. 1463 */ 1464 case TCPS_ESTABLISHED: 1465 case TCPS_FIN_WAIT_1: 1466 case TCPS_FIN_WAIT_2: 1467 case TCPS_CLOSE_WAIT: 1468 case TCPS_CLOSING: 1469 case TCPS_LAST_ACK: 1470 case TCPS_TIME_WAIT: 1471 #ifdef TCP_ECN 1472 /* 1473 * if we receive ECE and are not already in recovery phase, 1474 * reduce cwnd by half but don't slow-start. 1475 * advance snd_last to snd_max not to reduce cwnd again 1476 * until all outstanding packets are acked. 1477 */ 1478 if (tcp_do_ecn && (tiflags & TH_ECE)) { 1479 if ((tp->t_flags & TF_ECN_PERMIT) && 1480 SEQ_GEQ(tp->snd_una, tp->snd_last)) { 1481 u_int win; 1482 1483 win = min(tp->snd_wnd, tp->snd_cwnd) / tp->t_maxseg; 1484 if (win > 1) { 1485 tp->snd_ssthresh = win / 2 * tp->t_maxseg; 1486 tp->snd_cwnd = tp->snd_ssthresh; 1487 tp->snd_last = tp->snd_max; 1488 tp->t_flags |= TF_SEND_CWR; 1489 tcpstat_inc(tcps_cwr_ecn); 1490 } 1491 } 1492 tcpstat_inc(tcps_ecn_rcvece); 1493 } 1494 /* 1495 * if we receive CWR, we know that the peer has reduced 1496 * its congestion window. stop sending ecn-echo. 1497 */ 1498 if ((tiflags & TH_CWR)) { 1499 tp->t_flags &= ~TF_RCVD_CE; 1500 tcpstat_inc(tcps_ecn_rcvcwr); 1501 } 1502 #endif /* TCP_ECN */ 1503 1504 if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1505 /* 1506 * Duplicate/old ACK processing. 1507 * Increments t_dupacks: 1508 * Pure duplicate (same seq/ack/window, no data) 1509 * Doesn't affect t_dupacks: 1510 * Data packets. 1511 * Normal window updates (window opens) 1512 * Resets t_dupacks: 1513 * New data ACKed. 1514 * Window shrinks 1515 * Old ACK 1516 */ 1517 if (tlen) { 1518 /* Drop very old ACKs unless th_seq matches */ 1519 if (th->th_seq != tp->rcv_nxt && 1520 SEQ_LT(th->th_ack, 1521 tp->snd_una - tp->max_sndwnd)) { 1522 tcpstat_inc(tcps_rcvacktooold); 1523 goto drop; 1524 } 1525 break; 1526 } 1527 /* 1528 * If we get an old ACK, there is probably packet 1529 * reordering going on. Be conservative and reset 1530 * t_dupacks so that we are less aggressive in 1531 * doing a fast retransmit. 1532 */ 1533 if (th->th_ack != tp->snd_una) { 1534 tp->t_dupacks = 0; 1535 break; 1536 } 1537 if (tiwin == tp->snd_wnd) { 1538 tcpstat_inc(tcps_rcvdupack); 1539 /* 1540 * If we have outstanding data (other than 1541 * a window probe), this is a completely 1542 * duplicate ack (ie, window info didn't 1543 * change), the ack is the biggest we've 1544 * seen and we've seen exactly our rexmt 1545 * threshold of them, assume a packet 1546 * has been dropped and retransmit it. 1547 * Kludge snd_nxt & the congestion 1548 * window so we send only this one 1549 * packet. 1550 * 1551 * We know we're losing at the current 1552 * window size so do congestion avoidance 1553 * (set ssthresh to half the current window 1554 * and pull our congestion window back to 1555 * the new ssthresh). 1556 * 1557 * Dup acks mean that packets have left the 1558 * network (they're now cached at the receiver) 1559 * so bump cwnd by the amount in the receiver 1560 * to keep a constant cwnd packets in the 1561 * network. 1562 */ 1563 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0) 1564 tp->t_dupacks = 0; 1565 else if (++tp->t_dupacks == tcprexmtthresh) { 1566 tcp_seq onxt = tp->snd_nxt; 1567 u_long win = 1568 ulmin(tp->snd_wnd, tp->snd_cwnd) / 1569 2 / tp->t_maxseg; 1570 1571 if (SEQ_LT(th->th_ack, tp->snd_last)){ 1572 /* 1573 * False fast retx after 1574 * timeout. Do not cut window. 1575 */ 1576 tp->t_dupacks = 0; 1577 goto drop; 1578 } 1579 if (win < 2) 1580 win = 2; 1581 tp->snd_ssthresh = win * tp->t_maxseg; 1582 tp->snd_last = tp->snd_max; 1583 if (tp->sack_enable) { 1584 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1585 tp->t_rtttime = 0; 1586 #ifdef TCP_ECN 1587 tp->t_flags |= TF_SEND_CWR; 1588 #endif 1589 tcpstat_inc(tcps_cwr_frecovery); 1590 tcpstat_inc(tcps_sack_recovery_episode); 1591 /* 1592 * tcp_output() will send 1593 * oldest SACK-eligible rtx. 1594 */ 1595 (void) tcp_output(tp); 1596 tp->snd_cwnd = tp->snd_ssthresh+ 1597 tp->t_maxseg * tp->t_dupacks; 1598 goto drop; 1599 } 1600 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1601 tp->t_rtttime = 0; 1602 tp->snd_nxt = th->th_ack; 1603 tp->snd_cwnd = tp->t_maxseg; 1604 #ifdef TCP_ECN 1605 tp->t_flags |= TF_SEND_CWR; 1606 #endif 1607 tcpstat_inc(tcps_cwr_frecovery); 1608 tcpstat_inc(tcps_sndrexmitfast); 1609 (void) tcp_output(tp); 1610 1611 tp->snd_cwnd = tp->snd_ssthresh + 1612 tp->t_maxseg * tp->t_dupacks; 1613 if (SEQ_GT(onxt, tp->snd_nxt)) 1614 tp->snd_nxt = onxt; 1615 goto drop; 1616 } else if (tp->t_dupacks > tcprexmtthresh) { 1617 tp->snd_cwnd += tp->t_maxseg; 1618 (void) tcp_output(tp); 1619 goto drop; 1620 } 1621 } else if (tiwin < tp->snd_wnd) { 1622 /* 1623 * The window was retracted! Previous dup 1624 * ACKs may have been due to packets arriving 1625 * after the shrunken window, not a missing 1626 * packet, so play it safe and reset t_dupacks 1627 */ 1628 tp->t_dupacks = 0; 1629 } 1630 break; 1631 } 1632 /* 1633 * If the congestion window was inflated to account 1634 * for the other side's cached packets, retract it. 1635 */ 1636 if (tp->t_dupacks >= tcprexmtthresh) { 1637 /* Check for a partial ACK */ 1638 if (SEQ_LT(th->th_ack, tp->snd_last)) { 1639 if (tp->sack_enable) 1640 tcp_sack_partialack(tp, th); 1641 else 1642 tcp_newreno_partialack(tp, th); 1643 } else { 1644 /* Out of fast recovery */ 1645 tp->snd_cwnd = tp->snd_ssthresh; 1646 if (tcp_seq_subtract(tp->snd_max, th->th_ack) < 1647 tp->snd_ssthresh) 1648 tp->snd_cwnd = 1649 tcp_seq_subtract(tp->snd_max, 1650 th->th_ack); 1651 tp->t_dupacks = 0; 1652 } 1653 } else { 1654 /* 1655 * Reset the duplicate ACK counter if we 1656 * were not in fast recovery. 1657 */ 1658 tp->t_dupacks = 0; 1659 } 1660 if (SEQ_GT(th->th_ack, tp->snd_max)) { 1661 tcpstat_inc(tcps_rcvacktoomuch); 1662 goto dropafterack_ratelim; 1663 } 1664 acked = th->th_ack - tp->snd_una; 1665 tcpstat_pkt(tcps_rcvackpack, tcps_rcvackbyte, acked); 1666 1667 /* 1668 * If we have a timestamp reply, update smoothed 1669 * round trip time. If no timestamp is present but 1670 * transmit timer is running and timed sequence 1671 * number was acked, update smoothed round trip time. 1672 * Since we now have an rtt measurement, cancel the 1673 * timer backoff (cf., Phil Karn's retransmit alg.). 1674 * Recompute the initial retransmit timer. 1675 */ 1676 if (opti.ts_present && opti.ts_ecr) 1677 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr); 1678 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) 1679 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime); 1680 1681 /* 1682 * If all outstanding data is acked, stop retransmit 1683 * timer and remember to restart (more output or persist). 1684 * If there is more data to be acked, restart retransmit 1685 * timer, using current (possibly backed-off) value. 1686 */ 1687 if (th->th_ack == tp->snd_max) { 1688 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1689 tp->t_flags |= TF_NEEDOUTPUT; 1690 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1691 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1692 /* 1693 * When new data is acked, open the congestion window. 1694 * If the window gives us less than ssthresh packets 1695 * in flight, open exponentially (maxseg per packet). 1696 * Otherwise open linearly: maxseg per window 1697 * (maxseg^2 / cwnd per packet). 1698 */ 1699 { 1700 u_int cw = tp->snd_cwnd; 1701 u_int incr = tp->t_maxseg; 1702 1703 if (cw > tp->snd_ssthresh) 1704 incr = incr * incr / cw; 1705 if (tp->t_dupacks < tcprexmtthresh) 1706 tp->snd_cwnd = ulmin(cw + incr, 1707 TCP_MAXWIN << tp->snd_scale); 1708 } 1709 ND6_HINT(tp); 1710 if (acked > so->so_snd.sb_cc) { 1711 tp->snd_wnd -= so->so_snd.sb_cc; 1712 sbdrop(so, &so->so_snd, (int)so->so_snd.sb_cc); 1713 ourfinisacked = 1; 1714 } else { 1715 sbdrop(so, &so->so_snd, acked); 1716 tp->snd_wnd -= acked; 1717 ourfinisacked = 0; 1718 } 1719 1720 tcp_update_sndspace(tp); 1721 if (sb_notify(so, &so->so_snd)) { 1722 tp->t_flags |= TF_BLOCKOUTPUT; 1723 sowwakeup(so); 1724 tp->t_flags &= ~TF_BLOCKOUTPUT; 1725 } 1726 1727 /* 1728 * If we had a pending ICMP message that referred to data 1729 * that have just been acknowledged, disregard the recorded 1730 * ICMP message. 1731 */ 1732 if ((tp->t_flags & TF_PMTUD_PEND) && 1733 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq)) 1734 tp->t_flags &= ~TF_PMTUD_PEND; 1735 1736 /* 1737 * Keep track of the largest chunk of data acknowledged 1738 * since last PMTU update 1739 */ 1740 if (tp->t_pmtud_mss_acked < acked) 1741 tp->t_pmtud_mss_acked = acked; 1742 1743 tp->snd_una = th->th_ack; 1744 #ifdef TCP_ECN 1745 /* sync snd_last with snd_una */ 1746 if (SEQ_GT(tp->snd_una, tp->snd_last)) 1747 tp->snd_last = tp->snd_una; 1748 #endif 1749 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1750 tp->snd_nxt = tp->snd_una; 1751 1752 switch (tp->t_state) { 1753 1754 /* 1755 * In FIN_WAIT_1 STATE in addition to the processing 1756 * for the ESTABLISHED state if our FIN is now acknowledged 1757 * then enter FIN_WAIT_2. 1758 */ 1759 case TCPS_FIN_WAIT_1: 1760 if (ourfinisacked) { 1761 /* 1762 * If we can't receive any more 1763 * data, then closing user can proceed. 1764 * Starting the timer is contrary to the 1765 * specification, but if we don't get a FIN 1766 * we'll hang forever. 1767 */ 1768 if (so->so_state & SS_CANTRCVMORE) { 1769 soisdisconnected(so); 1770 TCP_TIMER_ARM(tp, TCPT_2MSL, tcp_maxidle); 1771 } 1772 tp->t_state = TCPS_FIN_WAIT_2; 1773 } 1774 break; 1775 1776 /* 1777 * In CLOSING STATE in addition to the processing for 1778 * the ESTABLISHED state if the ACK acknowledges our FIN 1779 * then enter the TIME-WAIT state, otherwise ignore 1780 * the segment. 1781 */ 1782 case TCPS_CLOSING: 1783 if (ourfinisacked) { 1784 tp->t_state = TCPS_TIME_WAIT; 1785 tcp_canceltimers(tp); 1786 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1787 soisdisconnected(so); 1788 } 1789 break; 1790 1791 /* 1792 * In LAST_ACK, we may still be waiting for data to drain 1793 * and/or to be acked, as well as for the ack of our FIN. 1794 * If our FIN is now acknowledged, delete the TCB, 1795 * enter the closed state and return. 1796 */ 1797 case TCPS_LAST_ACK: 1798 if (ourfinisacked) { 1799 tp = tcp_close(tp); 1800 goto drop; 1801 } 1802 break; 1803 1804 /* 1805 * In TIME_WAIT state the only thing that should arrive 1806 * is a retransmission of the remote FIN. Acknowledge 1807 * it and restart the finack timer. 1808 */ 1809 case TCPS_TIME_WAIT: 1810 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1811 goto dropafterack; 1812 } 1813 } 1814 1815 step6: 1816 /* 1817 * Update window information. 1818 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1819 */ 1820 if ((tiflags & TH_ACK) && 1821 (SEQ_LT(tp->snd_wl1, th->th_seq) || (tp->snd_wl1 == th->th_seq && 1822 (SEQ_LT(tp->snd_wl2, th->th_ack) || 1823 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { 1824 /* keep track of pure window updates */ 1825 if (tlen == 0 && 1826 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 1827 tcpstat_inc(tcps_rcvwinupd); 1828 tp->snd_wnd = tiwin; 1829 tp->snd_wl1 = th->th_seq; 1830 tp->snd_wl2 = th->th_ack; 1831 if (tp->snd_wnd > tp->max_sndwnd) 1832 tp->max_sndwnd = tp->snd_wnd; 1833 tp->t_flags |= TF_NEEDOUTPUT; 1834 } 1835 1836 /* 1837 * Process segments with URG. 1838 */ 1839 if ((tiflags & TH_URG) && th->th_urp && 1840 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1841 /* 1842 * This is a kludge, but if we receive and accept 1843 * random urgent pointers, we'll crash in 1844 * soreceive. It's hard to imagine someone 1845 * actually wanting to send this much urgent data. 1846 */ 1847 if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 1848 th->th_urp = 0; /* XXX */ 1849 tiflags &= ~TH_URG; /* XXX */ 1850 goto dodata; /* XXX */ 1851 } 1852 /* 1853 * If this segment advances the known urgent pointer, 1854 * then mark the data stream. This should not happen 1855 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 1856 * a FIN has been received from the remote side. 1857 * In these states we ignore the URG. 1858 * 1859 * According to RFC961 (Assigned Protocols), 1860 * the urgent pointer points to the last octet 1861 * of urgent data. We continue, however, 1862 * to consider it to indicate the first octet 1863 * of data past the urgent section as the original 1864 * spec states (in one of two places). 1865 */ 1866 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 1867 tp->rcv_up = th->th_seq + th->th_urp; 1868 so->so_oobmark = so->so_rcv.sb_cc + 1869 (tp->rcv_up - tp->rcv_nxt) - 1; 1870 if (so->so_oobmark == 0) 1871 so->so_state |= SS_RCVATMARK; 1872 sohasoutofband(so); 1873 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 1874 } 1875 /* 1876 * Remove out of band data so doesn't get presented to user. 1877 * This can happen independent of advancing the URG pointer, 1878 * but if two URG's are pending at once, some out-of-band 1879 * data may creep in... ick. 1880 */ 1881 if (th->th_urp <= (u_int16_t) tlen && 1882 (so->so_options & SO_OOBINLINE) == 0) 1883 tcp_pulloutofband(so, th->th_urp, m, hdroptlen); 1884 } else 1885 /* 1886 * If no out of band data is expected, 1887 * pull receive urgent pointer along 1888 * with the receive window. 1889 */ 1890 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 1891 tp->rcv_up = tp->rcv_nxt; 1892 dodata: /* XXX */ 1893 1894 /* 1895 * Process the segment text, merging it into the TCP sequencing queue, 1896 * and arranging for acknowledgment of receipt if necessary. 1897 * This process logically involves adjusting tp->rcv_wnd as data 1898 * is presented to the user (this happens in tcp_usrreq.c, 1899 * case PRU_RCVD). If a FIN has already been received on this 1900 * connection then we just ignore the text. 1901 */ 1902 if ((tlen || (tiflags & TH_FIN)) && 1903 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1904 tcp_seq laststart = th->th_seq; 1905 tcp_seq lastend = th->th_seq + tlen; 1906 1907 if (th->th_seq == tp->rcv_nxt && TAILQ_EMPTY(&tp->t_segq) && 1908 tp->t_state == TCPS_ESTABLISHED) { 1909 TCP_SETUP_ACK(tp, tiflags, m); 1910 tp->rcv_nxt += tlen; 1911 tiflags = th->th_flags & TH_FIN; 1912 tcpstat_pkt(tcps_rcvpack, tcps_rcvbyte, tlen); 1913 ND6_HINT(tp); 1914 if (so->so_state & SS_CANTRCVMORE) 1915 m_freem(m); 1916 else { 1917 m_adj(m, hdroptlen); 1918 sbappendstream(so, &so->so_rcv, m); 1919 } 1920 tp->t_flags |= TF_BLOCKOUTPUT; 1921 sorwakeup(so); 1922 tp->t_flags &= ~TF_BLOCKOUTPUT; 1923 } else { 1924 m_adj(m, hdroptlen); 1925 tiflags = tcp_reass(tp, th, m, &tlen); 1926 tp->t_flags |= TF_ACKNOW; 1927 } 1928 if (tp->sack_enable) 1929 tcp_update_sack_list(tp, laststart, lastend); 1930 1931 /* 1932 * variable len never referenced again in modern BSD, 1933 * so why bother computing it ?? 1934 */ 1935 #if 0 1936 /* 1937 * Note the amount of data that peer has sent into 1938 * our window, in order to estimate the sender's 1939 * buffer size. 1940 */ 1941 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 1942 #endif /* 0 */ 1943 } else { 1944 m_freem(m); 1945 tiflags &= ~TH_FIN; 1946 } 1947 1948 /* 1949 * If FIN is received ACK the FIN and let the user know 1950 * that the connection is closing. Ignore a FIN received before 1951 * the connection is fully established. 1952 */ 1953 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 1954 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1955 socantrcvmore(so); 1956 tp->t_flags |= TF_ACKNOW; 1957 tp->rcv_nxt++; 1958 } 1959 switch (tp->t_state) { 1960 1961 /* 1962 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 1963 */ 1964 case TCPS_ESTABLISHED: 1965 tp->t_state = TCPS_CLOSE_WAIT; 1966 break; 1967 1968 /* 1969 * If still in FIN_WAIT_1 STATE FIN has not been acked so 1970 * enter the CLOSING state. 1971 */ 1972 case TCPS_FIN_WAIT_1: 1973 tp->t_state = TCPS_CLOSING; 1974 break; 1975 1976 /* 1977 * In FIN_WAIT_2 state enter the TIME_WAIT state, 1978 * starting the time-wait timer, turning off the other 1979 * standard timers. 1980 */ 1981 case TCPS_FIN_WAIT_2: 1982 tp->t_state = TCPS_TIME_WAIT; 1983 tcp_canceltimers(tp); 1984 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1985 soisdisconnected(so); 1986 break; 1987 1988 /* 1989 * In TIME_WAIT state restart the 2 MSL time_wait timer. 1990 */ 1991 case TCPS_TIME_WAIT: 1992 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1993 break; 1994 } 1995 } 1996 if (so->so_options & SO_DEBUG) { 1997 switch (tp->pf) { 1998 #ifdef INET6 1999 case PF_INET6: 2000 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti6, 2001 0, tlen); 2002 break; 2003 #endif /* INET6 */ 2004 case PF_INET: 2005 tcp_trace(TA_INPUT, ostate, tp, (caddr_t) &tcp_saveti, 2006 0, tlen); 2007 break; 2008 } 2009 } 2010 2011 /* 2012 * Return any desired output. 2013 */ 2014 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT)) 2015 (void) tcp_output(tp); 2016 return IPPROTO_DONE; 2017 2018 badsyn: 2019 /* 2020 * Received a bad SYN. Increment counters and dropwithreset. 2021 */ 2022 tcpstat_inc(tcps_badsyn); 2023 tp = NULL; 2024 goto dropwithreset; 2025 2026 dropafterack_ratelim: 2027 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count, 2028 tcp_ackdrop_ppslim) == 0) { 2029 /* XXX stat */ 2030 goto drop; 2031 } 2032 /* ...fall into dropafterack... */ 2033 2034 dropafterack: 2035 /* 2036 * Generate an ACK dropping incoming segment if it occupies 2037 * sequence space, where the ACK reflects our state. 2038 */ 2039 if (tiflags & TH_RST) 2040 goto drop; 2041 m_freem(m); 2042 tp->t_flags |= TF_ACKNOW; 2043 (void) tcp_output(tp); 2044 return IPPROTO_DONE; 2045 2046 dropwithreset_ratelim: 2047 /* 2048 * We may want to rate-limit RSTs in certain situations, 2049 * particularly if we are sending an RST in response to 2050 * an attempt to connect to or otherwise communicate with 2051 * a port for which we have no socket. 2052 */ 2053 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count, 2054 tcp_rst_ppslim) == 0) { 2055 /* XXX stat */ 2056 goto drop; 2057 } 2058 /* ...fall into dropwithreset... */ 2059 2060 dropwithreset: 2061 /* 2062 * Generate a RST, dropping incoming segment. 2063 * Make ACK acceptable to originator of segment. 2064 * Don't bother to respond to RST. 2065 */ 2066 if (tiflags & TH_RST) 2067 goto drop; 2068 if (tiflags & TH_ACK) { 2069 tcp_respond(tp, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, 2070 TH_RST, m->m_pkthdr.ph_rtableid); 2071 } else { 2072 if (tiflags & TH_SYN) 2073 tlen++; 2074 tcp_respond(tp, mtod(m, caddr_t), th, th->th_seq + tlen, 2075 (tcp_seq)0, TH_RST|TH_ACK, m->m_pkthdr.ph_rtableid); 2076 } 2077 m_freem(m); 2078 return IPPROTO_DONE; 2079 2080 drop: 2081 /* 2082 * Drop space held by incoming segment and return. 2083 */ 2084 if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) { 2085 switch (tp->pf) { 2086 #ifdef INET6 2087 case PF_INET6: 2088 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti6, 2089 0, tlen); 2090 break; 2091 #endif /* INET6 */ 2092 case PF_INET: 2093 tcp_trace(TA_DROP, ostate, tp, (caddr_t) &tcp_saveti, 2094 0, tlen); 2095 break; 2096 } 2097 } 2098 2099 m_freem(m); 2100 return IPPROTO_DONE; 2101 } 2102 2103 int 2104 tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th, 2105 struct mbuf *m, int iphlen, struct tcp_opt_info *oi, 2106 u_int rtableid) 2107 { 2108 u_int16_t mss = 0; 2109 int opt, optlen; 2110 #ifdef TCP_SIGNATURE 2111 caddr_t sigp = NULL; 2112 struct tdb *tdb = NULL; 2113 #endif /* TCP_SIGNATURE */ 2114 2115 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) { 2116 opt = cp[0]; 2117 if (opt == TCPOPT_EOL) 2118 break; 2119 if (opt == TCPOPT_NOP) 2120 optlen = 1; 2121 else { 2122 if (cnt < 2) 2123 break; 2124 optlen = cp[1]; 2125 if (optlen < 2 || optlen > cnt) 2126 break; 2127 } 2128 switch (opt) { 2129 2130 default: 2131 continue; 2132 2133 case TCPOPT_MAXSEG: 2134 if (optlen != TCPOLEN_MAXSEG) 2135 continue; 2136 if (!(th->th_flags & TH_SYN)) 2137 continue; 2138 if (TCPS_HAVERCVDSYN(tp->t_state)) 2139 continue; 2140 memcpy(&mss, cp + 2, sizeof(mss)); 2141 mss = ntohs(mss); 2142 oi->maxseg = mss; 2143 break; 2144 2145 case TCPOPT_WINDOW: 2146 if (optlen != TCPOLEN_WINDOW) 2147 continue; 2148 if (!(th->th_flags & TH_SYN)) 2149 continue; 2150 if (TCPS_HAVERCVDSYN(tp->t_state)) 2151 continue; 2152 tp->t_flags |= TF_RCVD_SCALE; 2153 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); 2154 break; 2155 2156 case TCPOPT_TIMESTAMP: 2157 if (optlen != TCPOLEN_TIMESTAMP) 2158 continue; 2159 oi->ts_present = 1; 2160 memcpy(&oi->ts_val, cp + 2, sizeof(oi->ts_val)); 2161 oi->ts_val = ntohl(oi->ts_val); 2162 memcpy(&oi->ts_ecr, cp + 6, sizeof(oi->ts_ecr)); 2163 oi->ts_ecr = ntohl(oi->ts_ecr); 2164 2165 if (!(th->th_flags & TH_SYN)) 2166 continue; 2167 if (TCPS_HAVERCVDSYN(tp->t_state)) 2168 continue; 2169 /* 2170 * A timestamp received in a SYN makes 2171 * it ok to send timestamp requests and replies. 2172 */ 2173 tp->t_flags |= TF_RCVD_TSTMP; 2174 tp->ts_recent = oi->ts_val; 2175 tp->ts_recent_age = tcp_now; 2176 break; 2177 2178 case TCPOPT_SACK_PERMITTED: 2179 if (!tp->sack_enable || optlen!=TCPOLEN_SACK_PERMITTED) 2180 continue; 2181 if (!(th->th_flags & TH_SYN)) 2182 continue; 2183 if (TCPS_HAVERCVDSYN(tp->t_state)) 2184 continue; 2185 /* MUST only be set on SYN */ 2186 tp->t_flags |= TF_SACK_PERMIT; 2187 break; 2188 case TCPOPT_SACK: 2189 tcp_sack_option(tp, th, cp, optlen); 2190 break; 2191 #ifdef TCP_SIGNATURE 2192 case TCPOPT_SIGNATURE: 2193 if (optlen != TCPOLEN_SIGNATURE) 2194 continue; 2195 2196 if (sigp && timingsafe_bcmp(sigp, cp + 2, 16)) 2197 return (-1); 2198 2199 sigp = cp + 2; 2200 break; 2201 #endif /* TCP_SIGNATURE */ 2202 } 2203 } 2204 2205 #ifdef TCP_SIGNATURE 2206 if (tp->t_flags & TF_SIGNATURE) { 2207 union sockaddr_union src, dst; 2208 2209 memset(&src, 0, sizeof(union sockaddr_union)); 2210 memset(&dst, 0, sizeof(union sockaddr_union)); 2211 2212 switch (tp->pf) { 2213 case 0: 2214 case AF_INET: 2215 src.sa.sa_len = sizeof(struct sockaddr_in); 2216 src.sa.sa_family = AF_INET; 2217 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 2218 dst.sa.sa_len = sizeof(struct sockaddr_in); 2219 dst.sa.sa_family = AF_INET; 2220 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 2221 break; 2222 #ifdef INET6 2223 case AF_INET6: 2224 src.sa.sa_len = sizeof(struct sockaddr_in6); 2225 src.sa.sa_family = AF_INET6; 2226 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 2227 dst.sa.sa_len = sizeof(struct sockaddr_in6); 2228 dst.sa.sa_family = AF_INET6; 2229 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 2230 break; 2231 #endif /* INET6 */ 2232 } 2233 2234 tdb = gettdbbysrcdst(rtable_l2(rtableid), 2235 0, &src, &dst, IPPROTO_TCP); 2236 2237 /* 2238 * We don't have an SA for this peer, so we turn off 2239 * TF_SIGNATURE on the listen socket 2240 */ 2241 if (tdb == NULL && tp->t_state == TCPS_LISTEN) 2242 tp->t_flags &= ~TF_SIGNATURE; 2243 2244 } 2245 2246 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) { 2247 tcpstat_inc(tcps_rcvbadsig); 2248 return (-1); 2249 } 2250 2251 if (sigp) { 2252 char sig[16]; 2253 2254 if (tdb == NULL) { 2255 tcpstat_inc(tcps_rcvbadsig); 2256 return (-1); 2257 } 2258 2259 if (tcp_signature(tdb, tp->pf, m, th, iphlen, 1, sig) < 0) 2260 return (-1); 2261 2262 if (timingsafe_bcmp(sig, sigp, 16)) { 2263 tcpstat_inc(tcps_rcvbadsig); 2264 return (-1); 2265 } 2266 2267 tcpstat_inc(tcps_rcvgoodsig); 2268 } 2269 #endif /* TCP_SIGNATURE */ 2270 2271 return (0); 2272 } 2273 2274 u_long 2275 tcp_seq_subtract(u_long a, u_long b) 2276 { 2277 return ((long)(a - b)); 2278 } 2279 2280 /* 2281 * This function is called upon receipt of new valid data (while not in header 2282 * prediction mode), and it updates the ordered list of sacks. 2283 */ 2284 void 2285 tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_laststart, 2286 tcp_seq rcv_lastend) 2287 { 2288 /* 2289 * First reported block MUST be the most recent one. Subsequent 2290 * blocks SHOULD be in the order in which they arrived at the 2291 * receiver. These two conditions make the implementation fully 2292 * compliant with RFC 2018. 2293 */ 2294 int i, j = 0, count = 0, lastpos = -1; 2295 struct sackblk sack, firstsack, temp[MAX_SACK_BLKS]; 2296 2297 /* First clean up current list of sacks */ 2298 for (i = 0; i < tp->rcv_numsacks; i++) { 2299 sack = tp->sackblks[i]; 2300 if (sack.start == 0 && sack.end == 0) { 2301 count++; /* count = number of blocks to be discarded */ 2302 continue; 2303 } 2304 if (SEQ_LEQ(sack.end, tp->rcv_nxt)) { 2305 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2306 count++; 2307 } else { 2308 temp[j].start = tp->sackblks[i].start; 2309 temp[j++].end = tp->sackblks[i].end; 2310 } 2311 } 2312 tp->rcv_numsacks -= count; 2313 if (tp->rcv_numsacks == 0) { /* no sack blocks currently (fast path) */ 2314 tcp_clean_sackreport(tp); 2315 if (SEQ_LT(tp->rcv_nxt, rcv_laststart)) { 2316 /* ==> need first sack block */ 2317 tp->sackblks[0].start = rcv_laststart; 2318 tp->sackblks[0].end = rcv_lastend; 2319 tp->rcv_numsacks = 1; 2320 } 2321 return; 2322 } 2323 /* Otherwise, sack blocks are already present. */ 2324 for (i = 0; i < tp->rcv_numsacks; i++) 2325 tp->sackblks[i] = temp[i]; /* first copy back sack list */ 2326 if (SEQ_GEQ(tp->rcv_nxt, rcv_lastend)) 2327 return; /* sack list remains unchanged */ 2328 /* 2329 * From here, segment just received should be (part of) the 1st sack. 2330 * Go through list, possibly coalescing sack block entries. 2331 */ 2332 firstsack.start = rcv_laststart; 2333 firstsack.end = rcv_lastend; 2334 for (i = 0; i < tp->rcv_numsacks; i++) { 2335 sack = tp->sackblks[i]; 2336 if (SEQ_LT(sack.end, firstsack.start) || 2337 SEQ_GT(sack.start, firstsack.end)) 2338 continue; /* no overlap */ 2339 if (sack.start == firstsack.start && sack.end == firstsack.end){ 2340 /* 2341 * identical block; delete it here since we will 2342 * move it to the front of the list. 2343 */ 2344 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2345 lastpos = i; /* last posn with a zero entry */ 2346 continue; 2347 } 2348 if (SEQ_LEQ(sack.start, firstsack.start)) 2349 firstsack.start = sack.start; /* merge blocks */ 2350 if (SEQ_GEQ(sack.end, firstsack.end)) 2351 firstsack.end = sack.end; /* merge blocks */ 2352 tp->sackblks[i].start = tp->sackblks[i].end = 0; 2353 lastpos = i; /* last posn with a zero entry */ 2354 } 2355 if (lastpos != -1) { /* at least one merge */ 2356 for (i = 0, j = 1; i < tp->rcv_numsacks; i++) { 2357 sack = tp->sackblks[i]; 2358 if (sack.start == 0 && sack.end == 0) 2359 continue; 2360 temp[j++] = sack; 2361 } 2362 tp->rcv_numsacks = j; /* including first blk (added later) */ 2363 for (i = 1; i < tp->rcv_numsacks; i++) /* now copy back */ 2364 tp->sackblks[i] = temp[i]; 2365 } else { /* no merges -- shift sacks by 1 */ 2366 if (tp->rcv_numsacks < MAX_SACK_BLKS) 2367 tp->rcv_numsacks++; 2368 for (i = tp->rcv_numsacks-1; i > 0; i--) 2369 tp->sackblks[i] = tp->sackblks[i-1]; 2370 } 2371 tp->sackblks[0] = firstsack; 2372 return; 2373 } 2374 2375 /* 2376 * Process the TCP SACK option. tp->snd_holes is an ordered list 2377 * of holes (oldest to newest, in terms of the sequence space). 2378 */ 2379 void 2380 tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen) 2381 { 2382 int tmp_olen; 2383 u_char *tmp_cp; 2384 struct sackhole *cur, *p, *temp; 2385 2386 if (!tp->sack_enable) 2387 return; 2388 /* SACK without ACK doesn't make sense. */ 2389 if ((th->th_flags & TH_ACK) == 0) 2390 return; 2391 /* Make sure the ACK on this segment is in [snd_una, snd_max]. */ 2392 if (SEQ_LT(th->th_ack, tp->snd_una) || 2393 SEQ_GT(th->th_ack, tp->snd_max)) 2394 return; 2395 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2396 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0) 2397 return; 2398 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */ 2399 tmp_cp = cp + 2; 2400 tmp_olen = optlen - 2; 2401 tcpstat_inc(tcps_sack_rcv_opts); 2402 if (tp->snd_numholes < 0) 2403 tp->snd_numholes = 0; 2404 if (tp->t_maxseg == 0) 2405 panic("tcp_sack_option"); /* Should never happen */ 2406 while (tmp_olen > 0) { 2407 struct sackblk sack; 2408 2409 memcpy(&sack.start, tmp_cp, sizeof(tcp_seq)); 2410 sack.start = ntohl(sack.start); 2411 memcpy(&sack.end, tmp_cp + sizeof(tcp_seq), sizeof(tcp_seq)); 2412 sack.end = ntohl(sack.end); 2413 tmp_olen -= TCPOLEN_SACK; 2414 tmp_cp += TCPOLEN_SACK; 2415 if (SEQ_LEQ(sack.end, sack.start)) 2416 continue; /* bad SACK fields */ 2417 if (SEQ_LEQ(sack.end, tp->snd_una)) 2418 continue; /* old block */ 2419 if (SEQ_GT(th->th_ack, tp->snd_una)) { 2420 if (SEQ_LT(sack.start, th->th_ack)) 2421 continue; 2422 } 2423 if (SEQ_GT(sack.end, tp->snd_max)) 2424 continue; 2425 if (tp->snd_holes == NULL) { /* first hole */ 2426 tp->snd_holes = (struct sackhole *) 2427 pool_get(&sackhl_pool, PR_NOWAIT); 2428 if (tp->snd_holes == NULL) { 2429 /* ENOBUFS, so ignore SACKed block for now*/ 2430 goto done; 2431 } 2432 cur = tp->snd_holes; 2433 cur->start = th->th_ack; 2434 cur->end = sack.start; 2435 cur->rxmit = cur->start; 2436 cur->next = NULL; 2437 tp->snd_numholes = 1; 2438 tp->rcv_lastsack = sack.end; 2439 /* 2440 * dups is at least one. If more data has been 2441 * SACKed, it can be greater than one. 2442 */ 2443 cur->dups = min(tcprexmtthresh, 2444 ((sack.end - cur->end)/tp->t_maxseg)); 2445 if (cur->dups < 1) 2446 cur->dups = 1; 2447 continue; /* with next sack block */ 2448 } 2449 /* Go thru list of holes: p = previous, cur = current */ 2450 p = cur = tp->snd_holes; 2451 while (cur) { 2452 if (SEQ_LEQ(sack.end, cur->start)) 2453 /* SACKs data before the current hole */ 2454 break; /* no use going through more holes */ 2455 if (SEQ_GEQ(sack.start, cur->end)) { 2456 /* SACKs data beyond the current hole */ 2457 cur->dups++; 2458 if (((sack.end - cur->end)/tp->t_maxseg) >= 2459 tcprexmtthresh) 2460 cur->dups = tcprexmtthresh; 2461 p = cur; 2462 cur = cur->next; 2463 continue; 2464 } 2465 if (SEQ_LEQ(sack.start, cur->start)) { 2466 /* Data acks at least the beginning of hole */ 2467 if (SEQ_GEQ(sack.end, cur->end)) { 2468 /* Acks entire hole, so delete hole */ 2469 if (p != cur) { 2470 p->next = cur->next; 2471 pool_put(&sackhl_pool, cur); 2472 cur = p->next; 2473 } else { 2474 cur = cur->next; 2475 pool_put(&sackhl_pool, p); 2476 p = cur; 2477 tp->snd_holes = p; 2478 } 2479 tp->snd_numholes--; 2480 continue; 2481 } 2482 /* otherwise, move start of hole forward */ 2483 cur->start = sack.end; 2484 cur->rxmit = SEQ_MAX(cur->rxmit, cur->start); 2485 p = cur; 2486 cur = cur->next; 2487 continue; 2488 } 2489 /* move end of hole backward */ 2490 if (SEQ_GEQ(sack.end, cur->end)) { 2491 cur->end = sack.start; 2492 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2493 cur->dups++; 2494 if (((sack.end - cur->end)/tp->t_maxseg) >= 2495 tcprexmtthresh) 2496 cur->dups = tcprexmtthresh; 2497 p = cur; 2498 cur = cur->next; 2499 continue; 2500 } 2501 if (SEQ_LT(cur->start, sack.start) && 2502 SEQ_GT(cur->end, sack.end)) { 2503 /* 2504 * ACKs some data in middle of a hole; need to 2505 * split current hole 2506 */ 2507 temp = (struct sackhole *) 2508 pool_get(&sackhl_pool, PR_NOWAIT); 2509 if (temp == NULL) 2510 goto done; /* ENOBUFS */ 2511 temp->next = cur->next; 2512 temp->start = sack.end; 2513 temp->end = cur->end; 2514 temp->dups = cur->dups; 2515 temp->rxmit = SEQ_MAX(cur->rxmit, temp->start); 2516 cur->end = sack.start; 2517 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); 2518 cur->dups++; 2519 if (((sack.end - cur->end)/tp->t_maxseg) >= 2520 tcprexmtthresh) 2521 cur->dups = tcprexmtthresh; 2522 cur->next = temp; 2523 p = temp; 2524 cur = p->next; 2525 tp->snd_numholes++; 2526 } 2527 } 2528 /* At this point, p points to the last hole on the list */ 2529 if (SEQ_LT(tp->rcv_lastsack, sack.start)) { 2530 /* 2531 * Need to append new hole at end. 2532 * Last hole is p (and it's not NULL). 2533 */ 2534 temp = (struct sackhole *) 2535 pool_get(&sackhl_pool, PR_NOWAIT); 2536 if (temp == NULL) 2537 goto done; /* ENOBUFS */ 2538 temp->start = tp->rcv_lastsack; 2539 temp->end = sack.start; 2540 temp->dups = min(tcprexmtthresh, 2541 ((sack.end - sack.start)/tp->t_maxseg)); 2542 if (temp->dups < 1) 2543 temp->dups = 1; 2544 temp->rxmit = temp->start; 2545 temp->next = 0; 2546 p->next = temp; 2547 tp->rcv_lastsack = sack.end; 2548 tp->snd_numholes++; 2549 } 2550 } 2551 done: 2552 return; 2553 } 2554 2555 /* 2556 * Delete stale (i.e, cumulatively ack'd) holes. Hole is deleted only if 2557 * it is completely acked; otherwise, tcp_sack_option(), called from 2558 * tcp_dooptions(), will fix up the hole. 2559 */ 2560 void 2561 tcp_del_sackholes(struct tcpcb *tp, struct tcphdr *th) 2562 { 2563 if (tp->sack_enable && tp->t_state != TCPS_LISTEN) { 2564 /* max because this could be an older ack just arrived */ 2565 tcp_seq lastack = SEQ_GT(th->th_ack, tp->snd_una) ? 2566 th->th_ack : tp->snd_una; 2567 struct sackhole *cur = tp->snd_holes; 2568 struct sackhole *prev; 2569 while (cur) 2570 if (SEQ_LEQ(cur->end, lastack)) { 2571 prev = cur; 2572 cur = cur->next; 2573 pool_put(&sackhl_pool, prev); 2574 tp->snd_numholes--; 2575 } else if (SEQ_LT(cur->start, lastack)) { 2576 cur->start = lastack; 2577 if (SEQ_LT(cur->rxmit, cur->start)) 2578 cur->rxmit = cur->start; 2579 break; 2580 } else 2581 break; 2582 tp->snd_holes = cur; 2583 } 2584 } 2585 2586 /* 2587 * Delete all receiver-side SACK information. 2588 */ 2589 void 2590 tcp_clean_sackreport(struct tcpcb *tp) 2591 { 2592 int i; 2593 2594 tp->rcv_numsacks = 0; 2595 for (i = 0; i < MAX_SACK_BLKS; i++) 2596 tp->sackblks[i].start = tp->sackblks[i].end=0; 2597 2598 } 2599 2600 /* 2601 * Partial ack handling within a sack recovery episode. When a partial ack 2602 * arrives, turn off retransmission timer, deflate the window, do not clear 2603 * tp->t_dupacks. 2604 */ 2605 void 2606 tcp_sack_partialack(struct tcpcb *tp, struct tcphdr *th) 2607 { 2608 /* Turn off retx. timer (will start again next segment) */ 2609 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2610 tp->t_rtttime = 0; 2611 /* 2612 * Partial window deflation. This statement relies on the 2613 * fact that tp->snd_una has not been updated yet. 2614 */ 2615 if (tp->snd_cwnd > (th->th_ack - tp->snd_una)) { 2616 tp->snd_cwnd -= th->th_ack - tp->snd_una; 2617 tp->snd_cwnd += tp->t_maxseg; 2618 } else 2619 tp->snd_cwnd = tp->t_maxseg; 2620 tp->snd_cwnd += tp->t_maxseg; 2621 tp->t_flags |= TF_NEEDOUTPUT; 2622 } 2623 2624 /* 2625 * Pull out of band byte out of a segment so 2626 * it doesn't appear in the user's data queue. 2627 * It is still reflected in the segment length for 2628 * sequencing purposes. 2629 */ 2630 void 2631 tcp_pulloutofband(struct socket *so, u_int urgent, struct mbuf *m, int off) 2632 { 2633 int cnt = off + urgent - 1; 2634 2635 while (cnt >= 0) { 2636 if (m->m_len > cnt) { 2637 char *cp = mtod(m, caddr_t) + cnt; 2638 struct tcpcb *tp = sototcpcb(so); 2639 2640 tp->t_iobc = *cp; 2641 tp->t_oobflags |= TCPOOB_HAVEDATA; 2642 memmove(cp, cp + 1, m->m_len - cnt - 1); 2643 m->m_len--; 2644 return; 2645 } 2646 cnt -= m->m_len; 2647 m = m->m_next; 2648 if (m == NULL) 2649 break; 2650 } 2651 panic("tcp_pulloutofband"); 2652 } 2653 2654 /* 2655 * Collect new round-trip time estimate 2656 * and update averages and current timeout. 2657 */ 2658 void 2659 tcp_xmit_timer(struct tcpcb *tp, int rtt) 2660 { 2661 short delta; 2662 short rttmin; 2663 2664 if (rtt < 0) 2665 rtt = 0; 2666 else if (rtt > TCP_RTT_MAX) 2667 rtt = TCP_RTT_MAX; 2668 2669 tcpstat_inc(tcps_rttupdated); 2670 if (tp->t_srtt != 0) { 2671 /* 2672 * delta is fixed point with 2 (TCP_RTT_BASE_SHIFT) bits 2673 * after the binary point (scaled by 4), whereas 2674 * srtt is stored as fixed point with 5 bits after the 2675 * binary point (i.e., scaled by 32). The following magic 2676 * is equivalent to the smoothing algorithm in rfc793 with 2677 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2678 * point). 2679 */ 2680 delta = (rtt << TCP_RTT_BASE_SHIFT) - 2681 (tp->t_srtt >> TCP_RTT_SHIFT); 2682 if ((tp->t_srtt += delta) <= 0) 2683 tp->t_srtt = 1 << TCP_RTT_BASE_SHIFT; 2684 /* 2685 * We accumulate a smoothed rtt variance (actually, a 2686 * smoothed mean difference), then set the retransmit 2687 * timer to smoothed rtt + 4 times the smoothed variance. 2688 * rttvar is stored as fixed point with 4 bits after the 2689 * binary point (scaled by 16). The following is 2690 * equivalent to rfc793 smoothing with an alpha of .75 2691 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2692 * rfc793's wired-in beta. 2693 */ 2694 if (delta < 0) 2695 delta = -delta; 2696 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 2697 if ((tp->t_rttvar += delta) <= 0) 2698 tp->t_rttvar = 1 << TCP_RTT_BASE_SHIFT; 2699 } else { 2700 /* 2701 * No rtt measurement yet - use the unsmoothed rtt. 2702 * Set the variance to half the rtt (so our first 2703 * retransmit happens at 3*rtt). 2704 */ 2705 tp->t_srtt = (rtt + 1) << (TCP_RTT_SHIFT + TCP_RTT_BASE_SHIFT); 2706 tp->t_rttvar = (rtt + 1) << 2707 (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1); 2708 } 2709 tp->t_rtttime = 0; 2710 tp->t_rxtshift = 0; 2711 2712 /* 2713 * the retransmit should happen at rtt + 4 * rttvar. 2714 * Because of the way we do the smoothing, srtt and rttvar 2715 * will each average +1/2 tick of bias. When we compute 2716 * the retransmit timer, we want 1/2 tick of rounding and 2717 * 1 extra tick because of +-1/2 tick uncertainty in the 2718 * firing of the timer. The bias will give us exactly the 2719 * 1.5 tick we need. But, because the bias is 2720 * statistical, we have to test that we don't drop below 2721 * the minimum feasible timer (which is 2 ticks). 2722 */ 2723 rttmin = min(max(rtt + 2, tp->t_rttmin), TCPTV_REXMTMAX); 2724 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 2725 2726 /* 2727 * We received an ack for a packet that wasn't retransmitted; 2728 * it is probably safe to discard any error indications we've 2729 * received recently. This isn't quite right, but close enough 2730 * for now (a route might have failed after we sent a segment, 2731 * and the return path might not be symmetrical). 2732 */ 2733 tp->t_softerror = 0; 2734 } 2735 2736 /* 2737 * Determine a reasonable value for maxseg size. 2738 * If the route is known, check route for mtu. 2739 * If none, use an mss that can be handled on the outgoing 2740 * interface without forcing IP to fragment; if bigger than 2741 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES 2742 * to utilize large mbufs. If no route is found, route has no mtu, 2743 * or the destination isn't local, use a default, hopefully conservative 2744 * size (usually 512 or the default IP max size, but no more than the mtu 2745 * of the interface), as we can't discover anything about intervening 2746 * gateways or networks. We also initialize the congestion/slow start 2747 * window to be a single segment if the destination isn't local. 2748 * While looking at the routing entry, we also initialize other path-dependent 2749 * parameters from pre-set or cached values in the routing entry. 2750 * 2751 * Also take into account the space needed for options that we 2752 * send regularly. Make maxseg shorter by that amount to assure 2753 * that we can send maxseg amount of data even when the options 2754 * are present. Store the upper limit of the length of options plus 2755 * data in maxopd. 2756 * 2757 * NOTE: offer == -1 indicates that the maxseg size changed due to 2758 * Path MTU discovery. 2759 */ 2760 int 2761 tcp_mss(struct tcpcb *tp, int offer) 2762 { 2763 struct rtentry *rt; 2764 struct ifnet *ifp = NULL; 2765 int mss, mssopt; 2766 int iphlen; 2767 struct inpcb *inp; 2768 2769 inp = tp->t_inpcb; 2770 2771 mssopt = mss = tcp_mssdflt; 2772 2773 rt = in_pcbrtentry(inp); 2774 2775 if (rt == NULL) 2776 goto out; 2777 2778 ifp = if_get(rt->rt_ifidx); 2779 if (ifp == NULL) 2780 goto out; 2781 2782 switch (tp->pf) { 2783 #ifdef INET6 2784 case AF_INET6: 2785 iphlen = sizeof(struct ip6_hdr); 2786 break; 2787 #endif 2788 case AF_INET: 2789 iphlen = sizeof(struct ip); 2790 break; 2791 default: 2792 /* the family does not support path MTU discovery */ 2793 goto out; 2794 } 2795 2796 /* 2797 * if there's an mtu associated with the route and we support 2798 * path MTU discovery for the underlying protocol family, use it. 2799 */ 2800 if (rt->rt_mtu) { 2801 /* 2802 * One may wish to lower MSS to take into account options, 2803 * especially security-related options. 2804 */ 2805 if (tp->pf == AF_INET6 && rt->rt_mtu < IPV6_MMTU) { 2806 /* 2807 * RFC2460 section 5, last paragraph: if path MTU is 2808 * smaller than 1280, use 1280 as packet size and 2809 * attach fragment header. 2810 */ 2811 mss = IPV6_MMTU - iphlen - sizeof(struct ip6_frag) - 2812 sizeof(struct tcphdr); 2813 } else { 2814 mss = rt->rt_mtu - iphlen - 2815 sizeof(struct tcphdr); 2816 } 2817 } else if (ifp->if_flags & IFF_LOOPBACK) { 2818 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 2819 } else if (tp->pf == AF_INET) { 2820 if (ip_mtudisc) 2821 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 2822 } 2823 #ifdef INET6 2824 else if (tp->pf == AF_INET6) { 2825 /* 2826 * for IPv6, path MTU discovery is always turned on, 2827 * or the node must use packet size <= 1280. 2828 */ 2829 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 2830 } 2831 #endif /* INET6 */ 2832 2833 /* Calculate the value that we offer in TCPOPT_MAXSEG */ 2834 if (offer != -1) { 2835 mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr); 2836 mssopt = max(tcp_mssdflt, mssopt); 2837 } 2838 out: 2839 if_put(ifp); 2840 /* 2841 * The current mss, t_maxseg, is initialized to the default value. 2842 * If we compute a smaller value, reduce the current mss. 2843 * If we compute a larger value, return it for use in sending 2844 * a max seg size option, but don't store it for use 2845 * unless we received an offer at least that large from peer. 2846 * 2847 * However, do not accept offers lower than the minimum of 2848 * the interface MTU and 216. 2849 */ 2850 if (offer > 0) 2851 tp->t_peermss = offer; 2852 if (tp->t_peermss) 2853 mss = min(mss, max(tp->t_peermss, 216)); 2854 2855 /* sanity - at least max opt. space */ 2856 mss = max(mss, 64); 2857 2858 /* 2859 * maxopd stores the maximum length of data AND options 2860 * in a segment; maxseg is the amount of data in a normal 2861 * segment. We need to store this value (maxopd) apart 2862 * from maxseg, because now every segment carries options 2863 * and thus we normally have somewhat less data in segments. 2864 */ 2865 tp->t_maxopd = mss; 2866 2867 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 2868 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 2869 mss -= TCPOLEN_TSTAMP_APPA; 2870 #ifdef TCP_SIGNATURE 2871 if (tp->t_flags & TF_SIGNATURE) 2872 mss -= TCPOLEN_SIGLEN; 2873 #endif 2874 2875 if (offer == -1) { 2876 /* mss changed due to Path MTU discovery */ 2877 tp->t_flags &= ~TF_PMTUD_PEND; 2878 tp->t_pmtud_mtu_sent = 0; 2879 tp->t_pmtud_mss_acked = 0; 2880 if (mss < tp->t_maxseg) { 2881 /* 2882 * Follow suggestion in RFC 2414 to reduce the 2883 * congestion window by the ratio of the old 2884 * segment size to the new segment size. 2885 */ 2886 tp->snd_cwnd = ulmax((tp->snd_cwnd / tp->t_maxseg) * 2887 mss, mss); 2888 } 2889 } else if (tcp_do_rfc3390 == 2) { 2890 /* increase initial window */ 2891 tp->snd_cwnd = ulmin(10 * mss, ulmax(2 * mss, 14600)); 2892 } else if (tcp_do_rfc3390) { 2893 /* increase initial window */ 2894 tp->snd_cwnd = ulmin(4 * mss, ulmax(2 * mss, 4380)); 2895 } else 2896 tp->snd_cwnd = mss; 2897 2898 tp->t_maxseg = mss; 2899 2900 return (offer != -1 ? mssopt : mss); 2901 } 2902 2903 u_int 2904 tcp_hdrsz(struct tcpcb *tp) 2905 { 2906 u_int hlen; 2907 2908 switch (tp->pf) { 2909 #ifdef INET6 2910 case AF_INET6: 2911 hlen = sizeof(struct ip6_hdr); 2912 break; 2913 #endif 2914 case AF_INET: 2915 hlen = sizeof(struct ip); 2916 break; 2917 default: 2918 hlen = 0; 2919 break; 2920 } 2921 hlen += sizeof(struct tcphdr); 2922 2923 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && 2924 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP) 2925 hlen += TCPOLEN_TSTAMP_APPA; 2926 #ifdef TCP_SIGNATURE 2927 if (tp->t_flags & TF_SIGNATURE) 2928 hlen += TCPOLEN_SIGLEN; 2929 #endif 2930 return (hlen); 2931 } 2932 2933 /* 2934 * Set connection variables based on the effective MSS. 2935 * We are passed the TCPCB for the actual connection. If we 2936 * are the server, we are called by the compressed state engine 2937 * when the 3-way handshake is complete. If we are the client, 2938 * we are called when we receive the SYN,ACK from the server. 2939 * 2940 * NOTE: The t_maxseg value must be initialized in the TCPCB 2941 * before this routine is called! 2942 */ 2943 void 2944 tcp_mss_update(struct tcpcb *tp) 2945 { 2946 int mss; 2947 u_long bufsize; 2948 struct rtentry *rt; 2949 struct socket *so; 2950 2951 so = tp->t_inpcb->inp_socket; 2952 mss = tp->t_maxseg; 2953 2954 rt = in_pcbrtentry(tp->t_inpcb); 2955 2956 if (rt == NULL) 2957 return; 2958 2959 bufsize = so->so_snd.sb_hiwat; 2960 if (bufsize < mss) { 2961 mss = bufsize; 2962 /* Update t_maxseg and t_maxopd */ 2963 tcp_mss(tp, mss); 2964 } else { 2965 bufsize = roundup(bufsize, mss); 2966 if (bufsize > sb_max) 2967 bufsize = sb_max; 2968 (void)sbreserve(so, &so->so_snd, bufsize); 2969 } 2970 2971 bufsize = so->so_rcv.sb_hiwat; 2972 if (bufsize > mss) { 2973 bufsize = roundup(bufsize, mss); 2974 if (bufsize > sb_max) 2975 bufsize = sb_max; 2976 (void)sbreserve(so, &so->so_rcv, bufsize); 2977 } 2978 2979 } 2980 2981 /* 2982 * When a partial ack arrives, force the retransmission of the 2983 * next unacknowledged segment. Do not clear tp->t_dupacks. 2984 * By setting snd_nxt to ti_ack, this forces retransmission timer 2985 * to be started again. 2986 */ 2987 void 2988 tcp_newreno_partialack(struct tcpcb *tp, struct tcphdr *th) 2989 { 2990 /* 2991 * snd_una has not been updated and the socket send buffer 2992 * not yet drained of the acked data, so we have to leave 2993 * snd_una as it was to get the correct data offset in 2994 * tcp_output(). 2995 */ 2996 tcp_seq onxt = tp->snd_nxt; 2997 u_long ocwnd = tp->snd_cwnd; 2998 2999 TCP_TIMER_DISARM(tp, TCPT_REXMT); 3000 tp->t_rtttime = 0; 3001 tp->snd_nxt = th->th_ack; 3002 /* 3003 * Set snd_cwnd to one segment beyond acknowledged offset 3004 * (tp->snd_una not yet updated when this function is called) 3005 */ 3006 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una); 3007 (void)tcp_output(tp); 3008 tp->snd_cwnd = ocwnd; 3009 if (SEQ_GT(onxt, tp->snd_nxt)) 3010 tp->snd_nxt = onxt; 3011 /* 3012 * Partial window deflation. Relies on fact that tp->snd_una 3013 * not updated yet. 3014 */ 3015 if (tp->snd_cwnd > th->th_ack - tp->snd_una) 3016 tp->snd_cwnd -= th->th_ack - tp->snd_una; 3017 else 3018 tp->snd_cwnd = 0; 3019 tp->snd_cwnd += tp->t_maxseg; 3020 } 3021 3022 int 3023 tcp_mss_adv(struct mbuf *m, int af) 3024 { 3025 int mss = 0; 3026 int iphlen; 3027 struct ifnet *ifp = NULL; 3028 3029 if (m && (m->m_flags & M_PKTHDR)) 3030 ifp = if_get(m->m_pkthdr.ph_ifidx); 3031 3032 switch (af) { 3033 case AF_INET: 3034 if (ifp != NULL) 3035 mss = ifp->if_mtu; 3036 iphlen = sizeof(struct ip); 3037 break; 3038 #ifdef INET6 3039 case AF_INET6: 3040 if (ifp != NULL) 3041 mss = ifp->if_mtu; 3042 iphlen = sizeof(struct ip6_hdr); 3043 break; 3044 #endif 3045 default: 3046 unhandled_af(af); 3047 } 3048 if_put(ifp); 3049 mss = mss - iphlen - sizeof(struct tcphdr); 3050 return (max(mss, tcp_mssdflt)); 3051 } 3052 3053 /* 3054 * TCP compressed state engine. Currently used to hold compressed 3055 * state for SYN_RECEIVED. 3056 */ 3057 3058 /* syn hash parameters */ 3059 int tcp_syn_hash_size = TCP_SYN_HASH_SIZE; 3060 int tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE; 3061 int tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE; 3062 int tcp_syn_use_limit = 100000; 3063 3064 struct syn_cache_set tcp_syn_cache[2]; 3065 int tcp_syn_cache_active; 3066 3067 #define SYN_HASH(sa, sp, dp, rand) \ 3068 (((sa)->s_addr ^ (rand)[0]) * \ 3069 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4])) 3070 #ifndef INET6 3071 #define SYN_HASHALL(hash, src, dst, rand) \ 3072 do { \ 3073 hash = SYN_HASH(&satosin(src)->sin_addr, \ 3074 satosin(src)->sin_port, \ 3075 satosin(dst)->sin_port, (rand)); \ 3076 } while (/*CONSTCOND*/ 0) 3077 #else 3078 #define SYN_HASH6(sa, sp, dp, rand) \ 3079 (((sa)->s6_addr32[0] ^ (rand)[0]) * \ 3080 ((sa)->s6_addr32[1] ^ (rand)[1]) * \ 3081 ((sa)->s6_addr32[2] ^ (rand)[2]) * \ 3082 ((sa)->s6_addr32[3] ^ (rand)[3]) * \ 3083 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4])) 3084 3085 #define SYN_HASHALL(hash, src, dst, rand) \ 3086 do { \ 3087 switch ((src)->sa_family) { \ 3088 case AF_INET: \ 3089 hash = SYN_HASH(&satosin(src)->sin_addr, \ 3090 satosin(src)->sin_port, \ 3091 satosin(dst)->sin_port, (rand)); \ 3092 break; \ 3093 case AF_INET6: \ 3094 hash = SYN_HASH6(&satosin6(src)->sin6_addr, \ 3095 satosin6(src)->sin6_port, \ 3096 satosin6(dst)->sin6_port, (rand)); \ 3097 break; \ 3098 default: \ 3099 hash = 0; \ 3100 } \ 3101 } while (/*CONSTCOND*/0) 3102 #endif /* INET6 */ 3103 3104 void 3105 syn_cache_rm(struct syn_cache *sc) 3106 { 3107 sc->sc_flags |= SCF_DEAD; 3108 TAILQ_REMOVE(&sc->sc_buckethead->sch_bucket, sc, sc_bucketq); 3109 sc->sc_tp = NULL; 3110 LIST_REMOVE(sc, sc_tpq); 3111 sc->sc_buckethead->sch_length--; 3112 timeout_del(&sc->sc_timer); 3113 sc->sc_set->scs_count--; 3114 } 3115 3116 void 3117 syn_cache_put(struct syn_cache *sc) 3118 { 3119 m_free(sc->sc_ipopts); 3120 if (sc->sc_route4.ro_rt != NULL) { 3121 rtfree(sc->sc_route4.ro_rt); 3122 sc->sc_route4.ro_rt = NULL; 3123 } 3124 timeout_set(&sc->sc_timer, syn_cache_reaper, sc); 3125 timeout_add(&sc->sc_timer, 0); 3126 } 3127 3128 struct pool syn_cache_pool; 3129 3130 /* 3131 * We don't estimate RTT with SYNs, so each packet starts with the default 3132 * RTT and each timer step has a fixed timeout value. 3133 */ 3134 #define SYN_CACHE_TIMER_ARM(sc) \ 3135 do { \ 3136 TCPT_RANGESET((sc)->sc_rxtcur, \ 3137 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \ 3138 TCPTV_REXMTMAX); \ 3139 if (!timeout_initialized(&(sc)->sc_timer)) \ 3140 timeout_set_proc(&(sc)->sc_timer, syn_cache_timer, (sc)); \ 3141 timeout_add(&(sc)->sc_timer, (sc)->sc_rxtcur * (hz / PR_SLOWHZ)); \ 3142 } while (/*CONSTCOND*/0) 3143 3144 #define SYN_CACHE_TIMESTAMP(sc) tcp_now + (sc)->sc_modulate 3145 3146 void 3147 syn_cache_init(void) 3148 { 3149 int i; 3150 3151 /* Initialize the hash buckets. */ 3152 tcp_syn_cache[0].scs_buckethead = mallocarray(tcp_syn_hash_size, 3153 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO); 3154 tcp_syn_cache[1].scs_buckethead = mallocarray(tcp_syn_hash_size, 3155 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO); 3156 tcp_syn_cache[0].scs_size = tcp_syn_hash_size; 3157 tcp_syn_cache[1].scs_size = tcp_syn_hash_size; 3158 for (i = 0; i < tcp_syn_hash_size; i++) { 3159 TAILQ_INIT(&tcp_syn_cache[0].scs_buckethead[i].sch_bucket); 3160 TAILQ_INIT(&tcp_syn_cache[1].scs_buckethead[i].sch_bucket); 3161 } 3162 3163 /* Initialize the syn cache pool. */ 3164 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, IPL_SOFTNET, 3165 0, "syncache", NULL); 3166 } 3167 3168 void 3169 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp) 3170 { 3171 struct syn_cache_set *set = &tcp_syn_cache[tcp_syn_cache_active]; 3172 struct syn_cache_head *scp; 3173 struct syn_cache *sc2; 3174 int i; 3175 3176 NET_ASSERT_LOCKED(); 3177 3178 /* 3179 * If there are no entries in the hash table, reinitialize 3180 * the hash secrets. To avoid useless cache swaps and 3181 * reinitialization, use it until the limit is reached. 3182 * An emtpy cache is also the oportunity to resize the hash. 3183 */ 3184 if (set->scs_count == 0 && set->scs_use <= 0) { 3185 set->scs_use = tcp_syn_use_limit; 3186 if (set->scs_size != tcp_syn_hash_size) { 3187 scp = mallocarray(tcp_syn_hash_size, sizeof(struct 3188 syn_cache_head), M_SYNCACHE, M_NOWAIT|M_ZERO); 3189 if (scp == NULL) { 3190 /* Try again next time. */ 3191 set->scs_use = 0; 3192 } else { 3193 free(set->scs_buckethead, M_SYNCACHE, 3194 set->scs_size * 3195 sizeof(struct syn_cache_head)); 3196 set->scs_buckethead = scp; 3197 set->scs_size = tcp_syn_hash_size; 3198 for (i = 0; i < tcp_syn_hash_size; i++) 3199 TAILQ_INIT(&scp[i].sch_bucket); 3200 } 3201 } 3202 arc4random_buf(set->scs_random, sizeof(set->scs_random)); 3203 tcpstat_inc(tcps_sc_seedrandom); 3204 } 3205 3206 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa, 3207 set->scs_random); 3208 scp = &set->scs_buckethead[sc->sc_hash % set->scs_size]; 3209 sc->sc_buckethead = scp; 3210 3211 /* 3212 * Make sure that we don't overflow the per-bucket 3213 * limit or the total cache size limit. 3214 */ 3215 if (scp->sch_length >= tcp_syn_bucket_limit) { 3216 tcpstat_inc(tcps_sc_bucketoverflow); 3217 /* 3218 * Someone might attack our bucket hash function. Reseed 3219 * with random as soon as the passive syn cache gets empty. 3220 */ 3221 set->scs_use = 0; 3222 /* 3223 * The bucket is full. Toss the oldest element in the 3224 * bucket. This will be the first entry in the bucket. 3225 */ 3226 sc2 = TAILQ_FIRST(&scp->sch_bucket); 3227 #ifdef DIAGNOSTIC 3228 /* 3229 * This should never happen; we should always find an 3230 * entry in our bucket. 3231 */ 3232 if (sc2 == NULL) 3233 panic("%s: bucketoverflow: impossible", __func__); 3234 #endif 3235 syn_cache_rm(sc2); 3236 syn_cache_put(sc2); 3237 } else if (set->scs_count >= tcp_syn_cache_limit) { 3238 struct syn_cache_head *scp2, *sce; 3239 3240 tcpstat_inc(tcps_sc_overflowed); 3241 /* 3242 * The cache is full. Toss the oldest entry in the 3243 * first non-empty bucket we can find. 3244 * 3245 * XXX We would really like to toss the oldest 3246 * entry in the cache, but we hope that this 3247 * condition doesn't happen very often. 3248 */ 3249 scp2 = scp; 3250 if (TAILQ_EMPTY(&scp2->sch_bucket)) { 3251 sce = &set->scs_buckethead[set->scs_size]; 3252 for (++scp2; scp2 != scp; scp2++) { 3253 if (scp2 >= sce) 3254 scp2 = &set->scs_buckethead[0]; 3255 if (! TAILQ_EMPTY(&scp2->sch_bucket)) 3256 break; 3257 } 3258 #ifdef DIAGNOSTIC 3259 /* 3260 * This should never happen; we should always find a 3261 * non-empty bucket. 3262 */ 3263 if (scp2 == scp) 3264 panic("%s: cacheoverflow: impossible", 3265 __func__); 3266 #endif 3267 } 3268 sc2 = TAILQ_FIRST(&scp2->sch_bucket); 3269 syn_cache_rm(sc2); 3270 syn_cache_put(sc2); 3271 } 3272 3273 /* 3274 * Initialize the entry's timer. 3275 */ 3276 sc->sc_rxttot = 0; 3277 sc->sc_rxtshift = 0; 3278 SYN_CACHE_TIMER_ARM(sc); 3279 3280 /* Link it from tcpcb entry */ 3281 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 3282 3283 /* Put it into the bucket. */ 3284 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq); 3285 scp->sch_length++; 3286 sc->sc_set = set; 3287 set->scs_count++; 3288 set->scs_use--; 3289 3290 tcpstat_inc(tcps_sc_added); 3291 3292 /* 3293 * If the active cache has exceeded its use limit and 3294 * the passive syn cache is empty, exchange their roles. 3295 */ 3296 if (set->scs_use <= 0 && 3297 tcp_syn_cache[!tcp_syn_cache_active].scs_count == 0) 3298 tcp_syn_cache_active = !tcp_syn_cache_active; 3299 } 3300 3301 /* 3302 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 3303 * If we have retransmitted an entry the maximum number of times, expire 3304 * that entry. 3305 */ 3306 void 3307 syn_cache_timer(void *arg) 3308 { 3309 struct syn_cache *sc = arg; 3310 3311 NET_LOCK(); 3312 if (sc->sc_flags & SCF_DEAD) 3313 goto out; 3314 3315 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) { 3316 /* Drop it -- too many retransmissions. */ 3317 goto dropit; 3318 } 3319 3320 /* 3321 * Compute the total amount of time this entry has 3322 * been on a queue. If this entry has been on longer 3323 * than the keep alive timer would allow, expire it. 3324 */ 3325 sc->sc_rxttot += sc->sc_rxtcur; 3326 if (sc->sc_rxttot >= tcptv_keep_init) 3327 goto dropit; 3328 3329 tcpstat_inc(tcps_sc_retransmitted); 3330 (void) syn_cache_respond(sc, NULL); 3331 3332 /* Advance the timer back-off. */ 3333 sc->sc_rxtshift++; 3334 SYN_CACHE_TIMER_ARM(sc); 3335 3336 out: 3337 NET_UNLOCK(); 3338 return; 3339 3340 dropit: 3341 tcpstat_inc(tcps_sc_timed_out); 3342 syn_cache_rm(sc); 3343 syn_cache_put(sc); 3344 NET_UNLOCK(); 3345 } 3346 3347 void 3348 syn_cache_reaper(void *arg) 3349 { 3350 struct syn_cache *sc = arg; 3351 3352 pool_put(&syn_cache_pool, (sc)); 3353 return; 3354 } 3355 3356 /* 3357 * Remove syn cache created by the specified tcb entry, 3358 * because this does not make sense to keep them 3359 * (if there's no tcb entry, syn cache entry will never be used) 3360 */ 3361 void 3362 syn_cache_cleanup(struct tcpcb *tp) 3363 { 3364 struct syn_cache *sc, *nsc; 3365 3366 NET_ASSERT_LOCKED(); 3367 3368 LIST_FOREACH_SAFE(sc, &tp->t_sc, sc_tpq, nsc) { 3369 #ifdef DIAGNOSTIC 3370 if (sc->sc_tp != tp) 3371 panic("invalid sc_tp in syn_cache_cleanup"); 3372 #endif 3373 syn_cache_rm(sc); 3374 syn_cache_put(sc); 3375 } 3376 /* just for safety */ 3377 LIST_INIT(&tp->t_sc); 3378 } 3379 3380 /* 3381 * Find an entry in the syn cache. 3382 */ 3383 struct syn_cache * 3384 syn_cache_lookup(struct sockaddr *src, struct sockaddr *dst, 3385 struct syn_cache_head **headp, u_int rtableid) 3386 { 3387 struct syn_cache_set *sets[2]; 3388 struct syn_cache *sc; 3389 struct syn_cache_head *scp; 3390 u_int32_t hash; 3391 int i; 3392 3393 NET_ASSERT_LOCKED(); 3394 3395 /* Check the active cache first, the passive cache is likely emtpy. */ 3396 sets[0] = &tcp_syn_cache[tcp_syn_cache_active]; 3397 sets[1] = &tcp_syn_cache[!tcp_syn_cache_active]; 3398 for (i = 0; i < 2; i++) { 3399 if (sets[i]->scs_count == 0) 3400 continue; 3401 SYN_HASHALL(hash, src, dst, sets[i]->scs_random); 3402 scp = &sets[i]->scs_buckethead[hash % sets[i]->scs_size]; 3403 *headp = scp; 3404 TAILQ_FOREACH(sc, &scp->sch_bucket, sc_bucketq) { 3405 if (sc->sc_hash != hash) 3406 continue; 3407 if (!bcmp(&sc->sc_src, src, src->sa_len) && 3408 !bcmp(&sc->sc_dst, dst, dst->sa_len) && 3409 rtable_l2(rtableid) == rtable_l2(sc->sc_rtableid)) 3410 return (sc); 3411 } 3412 } 3413 return (NULL); 3414 } 3415 3416 /* 3417 * This function gets called when we receive an ACK for a 3418 * socket in the LISTEN state. We look up the connection 3419 * in the syn cache, and if its there, we pull it out of 3420 * the cache and turn it into a full-blown connection in 3421 * the SYN-RECEIVED state. 3422 * 3423 * The return values may not be immediately obvious, and their effects 3424 * can be subtle, so here they are: 3425 * 3426 * NULL SYN was not found in cache; caller should drop the 3427 * packet and send an RST. 3428 * 3429 * -1 We were unable to create the new connection, and are 3430 * aborting it. An ACK,RST is being sent to the peer 3431 * (unless we got screwey sequence numbners; see below), 3432 * because the 3-way handshake has been completed. Caller 3433 * should not free the mbuf, since we may be using it. If 3434 * we are not, we will free it. 3435 * 3436 * Otherwise, the return value is a pointer to the new socket 3437 * associated with the connection. 3438 */ 3439 struct socket * 3440 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3441 u_int hlen, u_int tlen, struct socket *so, struct mbuf *m) 3442 { 3443 struct syn_cache *sc; 3444 struct syn_cache_head *scp; 3445 struct inpcb *inp, *oldinp; 3446 struct tcpcb *tp = NULL; 3447 struct mbuf *am; 3448 struct socket *oso; 3449 #if NPF > 0 3450 struct pf_divert *divert = NULL; 3451 #endif 3452 3453 NET_ASSERT_LOCKED(); 3454 3455 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid); 3456 if (sc == NULL) 3457 return (NULL); 3458 3459 /* 3460 * Verify the sequence and ack numbers. Try getting the correct 3461 * response again. 3462 */ 3463 if ((th->th_ack != sc->sc_iss + 1) || 3464 SEQ_LEQ(th->th_seq, sc->sc_irs) || 3465 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 3466 (void) syn_cache_respond(sc, m); 3467 return ((struct socket *)(-1)); 3468 } 3469 3470 /* Remove this cache entry */ 3471 syn_cache_rm(sc); 3472 3473 /* 3474 * Ok, create the full blown connection, and set things up 3475 * as they would have been set up if we had created the 3476 * connection when the SYN arrived. If we can't create 3477 * the connection, abort it. 3478 */ 3479 oso = so; 3480 so = sonewconn(so, SS_ISCONNECTED); 3481 if (so == NULL) 3482 goto resetandabort; 3483 3484 oldinp = sotoinpcb(oso); 3485 inp = sotoinpcb(so); 3486 3487 #ifdef IPSEC 3488 /* 3489 * We need to copy the required security levels 3490 * from the old pcb. Ditto for any other 3491 * IPsec-related information. 3492 */ 3493 memcpy(inp->inp_seclevel, oldinp->inp_seclevel, 3494 sizeof(oldinp->inp_seclevel)); 3495 #endif /* IPSEC */ 3496 #ifdef INET6 3497 /* 3498 * inp still has the OLD in_pcb stuff, set the 3499 * v6-related flags on the new guy, too. 3500 */ 3501 inp->inp_flags |= (oldinp->inp_flags & INP_IPV6); 3502 if (inp->inp_flags & INP_IPV6) { 3503 inp->inp_ipv6.ip6_hlim = oldinp->inp_ipv6.ip6_hlim; 3504 inp->inp_hops = oldinp->inp_hops; 3505 } else 3506 #endif /* INET6 */ 3507 { 3508 inp->inp_ip.ip_ttl = oldinp->inp_ip.ip_ttl; 3509 } 3510 3511 #if NPF > 0 3512 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED && 3513 (divert = pf_find_divert(m)) != NULL) 3514 inp->inp_rtableid = divert->rdomain; 3515 else 3516 #endif 3517 /* inherit rtable from listening socket */ 3518 inp->inp_rtableid = sc->sc_rtableid; 3519 3520 inp->inp_lport = th->th_dport; 3521 switch (src->sa_family) { 3522 #ifdef INET6 3523 case AF_INET6: 3524 inp->inp_laddr6 = satosin6(dst)->sin6_addr; 3525 break; 3526 #endif /* INET6 */ 3527 case AF_INET: 3528 inp->inp_laddr = satosin(dst)->sin_addr; 3529 inp->inp_options = ip_srcroute(m); 3530 if (inp->inp_options == NULL) { 3531 inp->inp_options = sc->sc_ipopts; 3532 sc->sc_ipopts = NULL; 3533 } 3534 break; 3535 } 3536 in_pcbrehash(inp); 3537 3538 /* 3539 * Give the new socket our cached route reference. 3540 */ 3541 if (src->sa_family == AF_INET) 3542 inp->inp_route = sc->sc_route4; /* struct assignment */ 3543 #ifdef INET6 3544 else 3545 inp->inp_route6 = sc->sc_route6; 3546 #endif 3547 sc->sc_route4.ro_rt = NULL; 3548 3549 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 3550 if (am == NULL) 3551 goto resetandabort; 3552 am->m_len = src->sa_len; 3553 memcpy(mtod(am, caddr_t), src, src->sa_len); 3554 3555 switch (src->sa_family) { 3556 case AF_INET: 3557 /* drop IPv4 packet to AF_INET6 socket */ 3558 if (inp->inp_flags & INP_IPV6) { 3559 (void) m_free(am); 3560 goto resetandabort; 3561 } 3562 if (in_pcbconnect(inp, am)) { 3563 (void) m_free(am); 3564 goto resetandabort; 3565 } 3566 break; 3567 #ifdef INET6 3568 case AF_INET6: 3569 if (in6_pcbconnect(inp, am)) { 3570 (void) m_free(am); 3571 goto resetandabort; 3572 } 3573 break; 3574 #endif 3575 } 3576 (void) m_free(am); 3577 3578 tp = intotcpcb(inp); 3579 tp->t_flags = sototcpcb(oso)->t_flags & (TF_NOPUSH|TF_NODELAY); 3580 if (sc->sc_request_r_scale != 15) { 3581 tp->requested_s_scale = sc->sc_requested_s_scale; 3582 tp->request_r_scale = sc->sc_request_r_scale; 3583 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE; 3584 } 3585 if (sc->sc_flags & SCF_TIMESTAMP) 3586 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP; 3587 3588 tp->t_template = tcp_template(tp); 3589 if (tp->t_template == 0) { 3590 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 3591 so = NULL; 3592 m_freem(m); 3593 goto abort; 3594 } 3595 tp->sack_enable = sc->sc_flags & SCF_SACK_PERMIT; 3596 tp->ts_modulate = sc->sc_modulate; 3597 tp->ts_recent = sc->sc_timestamp; 3598 tp->iss = sc->sc_iss; 3599 tp->irs = sc->sc_irs; 3600 tcp_sendseqinit(tp); 3601 tp->snd_last = tp->snd_una; 3602 #ifdef TCP_ECN 3603 if (sc->sc_flags & SCF_ECN_PERMIT) { 3604 tp->t_flags |= TF_ECN_PERMIT; 3605 tcpstat_inc(tcps_ecn_accepts); 3606 } 3607 #endif 3608 if (sc->sc_flags & SCF_SACK_PERMIT) 3609 tp->t_flags |= TF_SACK_PERMIT; 3610 #ifdef TCP_SIGNATURE 3611 if (sc->sc_flags & SCF_SIGNATURE) 3612 tp->t_flags |= TF_SIGNATURE; 3613 #endif 3614 tcp_rcvseqinit(tp); 3615 tp->t_state = TCPS_SYN_RECEIVED; 3616 tp->t_rcvtime = tcp_now; 3617 TCP_TIMER_ARM(tp, TCPT_KEEP, tcptv_keep_init); 3618 tcpstat_inc(tcps_accepts); 3619 3620 tcp_mss(tp, sc->sc_peermaxseg); /* sets t_maxseg */ 3621 if (sc->sc_peermaxseg) 3622 tcp_mss_update(tp); 3623 /* Reset initial window to 1 segment for retransmit */ 3624 if (sc->sc_rxtshift > 0) 3625 tp->snd_cwnd = tp->t_maxseg; 3626 tp->snd_wl1 = sc->sc_irs; 3627 tp->rcv_up = sc->sc_irs + 1; 3628 3629 /* 3630 * This is what whould have happened in tcp_output() when 3631 * the SYN,ACK was sent. 3632 */ 3633 tp->snd_up = tp->snd_una; 3634 tp->snd_max = tp->snd_nxt = tp->iss+1; 3635 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 3636 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 3637 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 3638 tp->last_ack_sent = tp->rcv_nxt; 3639 3640 tcpstat_inc(tcps_sc_completed); 3641 syn_cache_put(sc); 3642 return (so); 3643 3644 resetandabort: 3645 tcp_respond(NULL, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, TH_RST, 3646 m->m_pkthdr.ph_rtableid); 3647 m_freem(m); 3648 abort: 3649 if (so != NULL) 3650 (void) soabort(so); 3651 syn_cache_put(sc); 3652 tcpstat_inc(tcps_sc_aborted); 3653 return ((struct socket *)(-1)); 3654 } 3655 3656 /* 3657 * This function is called when we get a RST for a 3658 * non-existent connection, so that we can see if the 3659 * connection is in the syn cache. If it is, zap it. 3660 */ 3661 3662 void 3663 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3664 u_int rtableid) 3665 { 3666 struct syn_cache *sc; 3667 struct syn_cache_head *scp; 3668 3669 NET_ASSERT_LOCKED(); 3670 3671 if ((sc = syn_cache_lookup(src, dst, &scp, rtableid)) == NULL) 3672 return; 3673 if (SEQ_LT(th->th_seq, sc->sc_irs) || 3674 SEQ_GT(th->th_seq, sc->sc_irs + 1)) 3675 return; 3676 syn_cache_rm(sc); 3677 tcpstat_inc(tcps_sc_reset); 3678 syn_cache_put(sc); 3679 } 3680 3681 void 3682 syn_cache_unreach(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3683 u_int rtableid) 3684 { 3685 struct syn_cache *sc; 3686 struct syn_cache_head *scp; 3687 3688 NET_ASSERT_LOCKED(); 3689 3690 if ((sc = syn_cache_lookup(src, dst, &scp, rtableid)) == NULL) 3691 return; 3692 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 3693 if (ntohl (th->th_seq) != sc->sc_iss) { 3694 return; 3695 } 3696 3697 /* 3698 * If we've retransmitted 3 times and this is our second error, 3699 * we remove the entry. Otherwise, we allow it to continue on. 3700 * This prevents us from incorrectly nuking an entry during a 3701 * spurious network outage. 3702 * 3703 * See tcp_notify(). 3704 */ 3705 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 3706 sc->sc_flags |= SCF_UNREACH; 3707 return; 3708 } 3709 3710 syn_cache_rm(sc); 3711 tcpstat_inc(tcps_sc_unreach); 3712 syn_cache_put(sc); 3713 } 3714 3715 /* 3716 * Given a LISTEN socket and an inbound SYN request, add 3717 * this to the syn cache, and send back a segment: 3718 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 3719 * to the source. 3720 * 3721 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 3722 * Doing so would require that we hold onto the data and deliver it 3723 * to the application. However, if we are the target of a SYN-flood 3724 * DoS attack, an attacker could send data which would eventually 3725 * consume all available buffer space if it were ACKed. By not ACKing 3726 * the data, we avoid this DoS scenario. 3727 */ 3728 3729 int 3730 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th, 3731 u_int iphlen, struct socket *so, struct mbuf *m, u_char *optp, int optlen, 3732 struct tcp_opt_info *oi, tcp_seq *issp) 3733 { 3734 struct tcpcb tb, *tp; 3735 long win; 3736 struct syn_cache *sc; 3737 struct syn_cache_head *scp; 3738 struct mbuf *ipopts; 3739 3740 tp = sototcpcb(so); 3741 3742 /* 3743 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 3744 * 3745 * Note this check is performed in tcp_input() very early on. 3746 */ 3747 3748 /* 3749 * Initialize some local state. 3750 */ 3751 win = sbspace(so, &so->so_rcv); 3752 if (win > TCP_MAXWIN) 3753 win = TCP_MAXWIN; 3754 3755 bzero(&tb, sizeof(tb)); 3756 #ifdef TCP_SIGNATURE 3757 if (optp || (tp->t_flags & TF_SIGNATURE)) { 3758 #else 3759 if (optp) { 3760 #endif 3761 tb.pf = tp->pf; 3762 tb.sack_enable = tp->sack_enable; 3763 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 3764 #ifdef TCP_SIGNATURE 3765 if (tp->t_flags & TF_SIGNATURE) 3766 tb.t_flags |= TF_SIGNATURE; 3767 #endif 3768 tb.t_state = TCPS_LISTEN; 3769 if (tcp_dooptions(&tb, optp, optlen, th, m, iphlen, oi, 3770 sotoinpcb(so)->inp_rtableid)) 3771 return (-1); 3772 } 3773 3774 switch (src->sa_family) { 3775 case AF_INET: 3776 /* 3777 * Remember the IP options, if any. 3778 */ 3779 ipopts = ip_srcroute(m); 3780 break; 3781 default: 3782 ipopts = NULL; 3783 } 3784 3785 /* 3786 * See if we already have an entry for this connection. 3787 * If we do, resend the SYN,ACK. We do not count this 3788 * as a retransmission (XXX though maybe we should). 3789 */ 3790 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid); 3791 if (sc != NULL) { 3792 tcpstat_inc(tcps_sc_dupesyn); 3793 if (ipopts) { 3794 /* 3795 * If we were remembering a previous source route, 3796 * forget it and use the new one we've been given. 3797 */ 3798 m_free(sc->sc_ipopts); 3799 sc->sc_ipopts = ipopts; 3800 } 3801 sc->sc_timestamp = tb.ts_recent; 3802 if (syn_cache_respond(sc, m) == 0) { 3803 tcpstat_inc(tcps_sndacks); 3804 tcpstat_inc(tcps_sndtotal); 3805 } 3806 return (0); 3807 } 3808 3809 sc = pool_get(&syn_cache_pool, PR_NOWAIT|PR_ZERO); 3810 if (sc == NULL) { 3811 m_free(ipopts); 3812 return (-1); 3813 } 3814 3815 /* 3816 * Fill in the cache, and put the necessary IP and TCP 3817 * options into the reply. 3818 */ 3819 memcpy(&sc->sc_src, src, src->sa_len); 3820 memcpy(&sc->sc_dst, dst, dst->sa_len); 3821 sc->sc_rtableid = sotoinpcb(so)->inp_rtableid; 3822 sc->sc_flags = 0; 3823 sc->sc_ipopts = ipopts; 3824 sc->sc_irs = th->th_seq; 3825 3826 sc->sc_iss = issp ? *issp : arc4random(); 3827 sc->sc_peermaxseg = oi->maxseg; 3828 sc->sc_ourmaxseg = tcp_mss_adv(m, sc->sc_src.sa.sa_family); 3829 sc->sc_win = win; 3830 sc->sc_timestamp = tb.ts_recent; 3831 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) == 3832 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) { 3833 sc->sc_flags |= SCF_TIMESTAMP; 3834 sc->sc_modulate = arc4random(); 3835 } 3836 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 3837 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 3838 sc->sc_requested_s_scale = tb.requested_s_scale; 3839 sc->sc_request_r_scale = 0; 3840 /* 3841 * Pick the smallest possible scaling factor that 3842 * will still allow us to scale up to sb_max. 3843 * 3844 * We do this because there are broken firewalls that 3845 * will corrupt the window scale option, leading to 3846 * the other endpoint believing that our advertised 3847 * window is unscaled. At scale factors larger than 3848 * 5 the unscaled window will drop below 1500 bytes, 3849 * leading to serious problems when traversing these 3850 * broken firewalls. 3851 * 3852 * With the default sbmax of 256K, a scale factor 3853 * of 3 will be chosen by this algorithm. Those who 3854 * choose a larger sbmax should watch out 3855 * for the compatiblity problems mentioned above. 3856 * 3857 * RFC1323: The Window field in a SYN (i.e., a <SYN> 3858 * or <SYN,ACK>) segment itself is never scaled. 3859 */ 3860 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 3861 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max) 3862 sc->sc_request_r_scale++; 3863 } else { 3864 sc->sc_requested_s_scale = 15; 3865 sc->sc_request_r_scale = 15; 3866 } 3867 #ifdef TCP_ECN 3868 /* 3869 * if both ECE and CWR flag bits are set, peer is ECN capable. 3870 */ 3871 if (tcp_do_ecn && 3872 (th->th_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) 3873 sc->sc_flags |= SCF_ECN_PERMIT; 3874 #endif 3875 /* 3876 * Set SCF_SACK_PERMIT if peer did send a SACK_PERMITTED option 3877 * (i.e., if tcp_dooptions() did set TF_SACK_PERMIT). 3878 */ 3879 if (tb.sack_enable && (tb.t_flags & TF_SACK_PERMIT)) 3880 sc->sc_flags |= SCF_SACK_PERMIT; 3881 #ifdef TCP_SIGNATURE 3882 if (tb.t_flags & TF_SIGNATURE) 3883 sc->sc_flags |= SCF_SIGNATURE; 3884 #endif 3885 sc->sc_tp = tp; 3886 if (syn_cache_respond(sc, m) == 0) { 3887 syn_cache_insert(sc, tp); 3888 tcpstat_inc(tcps_sndacks); 3889 tcpstat_inc(tcps_sndtotal); 3890 } else { 3891 syn_cache_put(sc); 3892 tcpstat_inc(tcps_sc_dropped); 3893 } 3894 3895 return (0); 3896 } 3897 3898 int 3899 syn_cache_respond(struct syn_cache *sc, struct mbuf *m) 3900 { 3901 u_int8_t *optp; 3902 int optlen, error; 3903 u_int16_t tlen; 3904 struct ip *ip = NULL; 3905 #ifdef INET6 3906 struct ip6_hdr *ip6 = NULL; 3907 #endif 3908 struct tcphdr *th; 3909 u_int hlen; 3910 struct inpcb *inp; 3911 3912 switch (sc->sc_src.sa.sa_family) { 3913 case AF_INET: 3914 hlen = sizeof(struct ip); 3915 break; 3916 #ifdef INET6 3917 case AF_INET6: 3918 hlen = sizeof(struct ip6_hdr); 3919 break; 3920 #endif 3921 default: 3922 m_freem(m); 3923 return (EAFNOSUPPORT); 3924 } 3925 3926 /* Compute the size of the TCP options. */ 3927 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 3928 ((sc->sc_flags & SCF_SACK_PERMIT) ? 4 : 0) + 3929 #ifdef TCP_SIGNATURE 3930 ((sc->sc_flags & SCF_SIGNATURE) ? TCPOLEN_SIGLEN : 0) + 3931 #endif 3932 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 3933 3934 tlen = hlen + sizeof(struct tcphdr) + optlen; 3935 3936 /* 3937 * Create the IP+TCP header from scratch. 3938 */ 3939 m_freem(m); 3940 #ifdef DIAGNOSTIC 3941 if (max_linkhdr + tlen > MCLBYTES) 3942 return (ENOBUFS); 3943 #endif 3944 MGETHDR(m, M_DONTWAIT, MT_DATA); 3945 if (m && max_linkhdr + tlen > MHLEN) { 3946 MCLGET(m, M_DONTWAIT); 3947 if ((m->m_flags & M_EXT) == 0) { 3948 m_freem(m); 3949 m = NULL; 3950 } 3951 } 3952 if (m == NULL) 3953 return (ENOBUFS); 3954 3955 /* Fixup the mbuf. */ 3956 m->m_data += max_linkhdr; 3957 m->m_len = m->m_pkthdr.len = tlen; 3958 m->m_pkthdr.ph_ifidx = 0; 3959 m->m_pkthdr.ph_rtableid = sc->sc_rtableid; 3960 memset(mtod(m, u_char *), 0, tlen); 3961 3962 switch (sc->sc_src.sa.sa_family) { 3963 case AF_INET: 3964 ip = mtod(m, struct ip *); 3965 ip->ip_dst = sc->sc_src.sin.sin_addr; 3966 ip->ip_src = sc->sc_dst.sin.sin_addr; 3967 ip->ip_p = IPPROTO_TCP; 3968 th = (struct tcphdr *)(ip + 1); 3969 th->th_dport = sc->sc_src.sin.sin_port; 3970 th->th_sport = sc->sc_dst.sin.sin_port; 3971 break; 3972 #ifdef INET6 3973 case AF_INET6: 3974 ip6 = mtod(m, struct ip6_hdr *); 3975 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 3976 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 3977 ip6->ip6_nxt = IPPROTO_TCP; 3978 /* ip6_plen will be updated in ip6_output() */ 3979 th = (struct tcphdr *)(ip6 + 1); 3980 th->th_dport = sc->sc_src.sin6.sin6_port; 3981 th->th_sport = sc->sc_dst.sin6.sin6_port; 3982 break; 3983 #endif 3984 default: 3985 unhandled_af(sc->sc_src.sa.sa_family); 3986 } 3987 3988 th->th_seq = htonl(sc->sc_iss); 3989 th->th_ack = htonl(sc->sc_irs + 1); 3990 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 3991 th->th_flags = TH_SYN|TH_ACK; 3992 #ifdef TCP_ECN 3993 /* Set ECE for SYN-ACK if peer supports ECN. */ 3994 if (tcp_do_ecn && (sc->sc_flags & SCF_ECN_PERMIT)) 3995 th->th_flags |= TH_ECE; 3996 #endif 3997 th->th_win = htons(sc->sc_win); 3998 /* th_sum already 0 */ 3999 /* th_urp already 0 */ 4000 4001 /* Tack on the TCP options. */ 4002 optp = (u_int8_t *)(th + 1); 4003 *optp++ = TCPOPT_MAXSEG; 4004 *optp++ = 4; 4005 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 4006 *optp++ = sc->sc_ourmaxseg & 0xff; 4007 4008 /* Include SACK_PERMIT_HDR option if peer has already done so. */ 4009 if (sc->sc_flags & SCF_SACK_PERMIT) { 4010 *((u_int32_t *)optp) = htonl(TCPOPT_SACK_PERMIT_HDR); 4011 optp += 4; 4012 } 4013 4014 if (sc->sc_request_r_scale != 15) { 4015 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 4016 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 4017 sc->sc_request_r_scale); 4018 optp += 4; 4019 } 4020 4021 if (sc->sc_flags & SCF_TIMESTAMP) { 4022 u_int32_t *lp = (u_int32_t *)(optp); 4023 /* Form timestamp option as shown in appendix A of RFC 1323. */ 4024 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 4025 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc)); 4026 *lp = htonl(sc->sc_timestamp); 4027 optp += TCPOLEN_TSTAMP_APPA; 4028 } 4029 4030 #ifdef TCP_SIGNATURE 4031 if (sc->sc_flags & SCF_SIGNATURE) { 4032 union sockaddr_union src, dst; 4033 struct tdb *tdb; 4034 4035 bzero(&src, sizeof(union sockaddr_union)); 4036 bzero(&dst, sizeof(union sockaddr_union)); 4037 src.sa.sa_len = sc->sc_src.sa.sa_len; 4038 src.sa.sa_family = sc->sc_src.sa.sa_family; 4039 dst.sa.sa_len = sc->sc_dst.sa.sa_len; 4040 dst.sa.sa_family = sc->sc_dst.sa.sa_family; 4041 4042 switch (sc->sc_src.sa.sa_family) { 4043 case 0: /*default to PF_INET*/ 4044 case AF_INET: 4045 src.sin.sin_addr = mtod(m, struct ip *)->ip_src; 4046 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst; 4047 break; 4048 #ifdef INET6 4049 case AF_INET6: 4050 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src; 4051 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst; 4052 break; 4053 #endif /* INET6 */ 4054 } 4055 4056 tdb = gettdbbysrcdst(rtable_l2(sc->sc_rtableid), 4057 0, &src, &dst, IPPROTO_TCP); 4058 if (tdb == NULL) { 4059 m_freem(m); 4060 return (EPERM); 4061 } 4062 4063 /* Send signature option */ 4064 *(optp++) = TCPOPT_SIGNATURE; 4065 *(optp++) = TCPOLEN_SIGNATURE; 4066 4067 if (tcp_signature(tdb, sc->sc_src.sa.sa_family, m, th, 4068 hlen, 0, optp) < 0) { 4069 m_freem(m); 4070 return (EINVAL); 4071 } 4072 optp += 16; 4073 4074 /* Pad options list to the next 32 bit boundary and 4075 * terminate it. 4076 */ 4077 *optp++ = TCPOPT_NOP; 4078 *optp++ = TCPOPT_EOL; 4079 } 4080 #endif /* TCP_SIGNATURE */ 4081 4082 /* Compute the packet's checksum. */ 4083 switch (sc->sc_src.sa.sa_family) { 4084 case AF_INET: 4085 ip->ip_len = htons(tlen - hlen); 4086 th->th_sum = 0; 4087 th->th_sum = in_cksum(m, tlen); 4088 break; 4089 #ifdef INET6 4090 case AF_INET6: 4091 ip6->ip6_plen = htons(tlen - hlen); 4092 th->th_sum = 0; 4093 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 4094 break; 4095 #endif 4096 } 4097 4098 /* use IPsec policy and ttl from listening socket, on SYN ACK */ 4099 inp = sc->sc_tp ? sc->sc_tp->t_inpcb : NULL; 4100 4101 /* 4102 * Fill in some straggling IP bits. Note the stack expects 4103 * ip_len to be in host order, for convenience. 4104 */ 4105 switch (sc->sc_src.sa.sa_family) { 4106 case AF_INET: 4107 ip->ip_len = htons(tlen); 4108 ip->ip_ttl = inp ? inp->inp_ip.ip_ttl : ip_defttl; 4109 if (inp != NULL) 4110 ip->ip_tos = inp->inp_ip.ip_tos; 4111 break; 4112 #ifdef INET6 4113 case AF_INET6: 4114 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 4115 ip6->ip6_vfc |= IPV6_VERSION; 4116 ip6->ip6_plen = htons(tlen - hlen); 4117 /* ip6_hlim will be initialized afterwards */ 4118 /* leave flowlabel = 0, it is legal and require no state mgmt */ 4119 break; 4120 #endif 4121 } 4122 4123 switch (sc->sc_src.sa.sa_family) { 4124 case AF_INET: 4125 error = ip_output(m, sc->sc_ipopts, &sc->sc_route4, 4126 (ip_mtudisc ? IP_MTUDISC : 0), NULL, inp, 0); 4127 break; 4128 #ifdef INET6 4129 case AF_INET6: 4130 ip6->ip6_hlim = in6_selecthlim(inp); 4131 4132 error = ip6_output(m, NULL /*XXX*/, &sc->sc_route6, 0, 4133 NULL, NULL); 4134 break; 4135 #endif 4136 default: 4137 error = EAFNOSUPPORT; 4138 break; 4139 } 4140 return (error); 4141 } 4142