1 /* $NetBSD: tcp_input.c,v 1.438 2022/11/04 09:01:53 ozaki-r Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006,
74 * 2011 The NetBSD Foundation, Inc.
75 * All rights reserved.
76 *
77 * This code is derived from software contributed to The NetBSD Foundation
78 * by Coyote Point Systems, Inc.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
81 * Facility, NASA Ames Research Center.
82 * This code is derived from software contributed to The NetBSD Foundation
83 * by Charles M. Hannum.
84 * This code is derived from software contributed to The NetBSD Foundation
85 * by Rui Paulo.
86 *
87 * Redistribution and use in source and binary forms, with or without
88 * modification, are permitted provided that the following conditions
89 * are met:
90 * 1. Redistributions of source code must retain the above copyright
91 * notice, this list of conditions and the following disclaimer.
92 * 2. Redistributions in binary form must reproduce the above copyright
93 * notice, this list of conditions and the following disclaimer in the
94 * documentation and/or other materials provided with the distribution.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. Neither the name of the University nor the names of its contributors
122 * may be used to endorse or promote products derived from this software
123 * without specific prior written permission.
124 *
125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135 * SUCH DAMAGE.
136 *
137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
138 */
139
140 #include <sys/cdefs.h>
141 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.438 2022/11/04 09:01:53 ozaki-r Exp $");
142
143 #ifdef _KERNEL_OPT
144 #include "opt_inet.h"
145 #include "opt_ipsec.h"
146 #include "opt_inet_csum.h"
147 #include "opt_tcp_debug.h"
148 #endif
149
150 #include <sys/param.h>
151 #include <sys/systm.h>
152 #include <sys/malloc.h>
153 #include <sys/mbuf.h>
154 #include <sys/protosw.h>
155 #include <sys/socket.h>
156 #include <sys/socketvar.h>
157 #include <sys/errno.h>
158 #include <sys/syslog.h>
159 #include <sys/pool.h>
160 #include <sys/domain.h>
161 #include <sys/kernel.h>
162 #ifdef TCP_SIGNATURE
163 #include <sys/md5.h>
164 #endif
165 #include <sys/lwp.h> /* for lwp0 */
166 #include <sys/cprng.h>
167
168 #include <net/if.h>
169 #include <net/if_types.h>
170
171 #include <netinet/in.h>
172 #include <netinet/in_systm.h>
173 #include <netinet/ip.h>
174 #include <netinet/in_pcb.h>
175 #include <netinet/in_var.h>
176 #include <netinet/ip_var.h>
177 #include <netinet/in_offload.h>
178
179 #if NARP > 0
180 #include <netinet/if_inarp.h>
181 #endif
182 #ifdef INET6
183 #include <netinet/ip6.h>
184 #include <netinet6/ip6_var.h>
185 #include <netinet6/in6_pcb.h>
186 #include <netinet6/ip6_var.h>
187 #include <netinet6/in6_var.h>
188 #include <netinet/icmp6.h>
189 #include <netinet6/nd6.h>
190 #ifdef TCP_SIGNATURE
191 #include <netinet6/scope6_var.h>
192 #endif
193 #endif
194
195 #ifndef INET6
196 #include <netinet/ip6.h>
197 #endif
198
199 #include <netinet/tcp.h>
200 #include <netinet/tcp_fsm.h>
201 #include <netinet/tcp_seq.h>
202 #include <netinet/tcp_timer.h>
203 #include <netinet/tcp_var.h>
204 #include <netinet/tcp_private.h>
205 #include <netinet/tcp_congctl.h>
206 #include <netinet/tcp_debug.h>
207 #include <netinet/tcp_syncache.h>
208
209 #ifdef INET6
210 #include "faith.h"
211 #if defined(NFAITH) && NFAITH > 0
212 #include <net/if_faith.h>
213 #endif
214 #endif
215
216 #ifdef IPSEC
217 #include <netipsec/ipsec.h>
218 #include <netipsec/key.h>
219 #ifdef INET6
220 #include <netipsec/ipsec6.h>
221 #endif
222 #endif /* IPSEC*/
223
224 #include <netinet/tcp_vtw.h>
225
226 int tcprexmtthresh = 3;
227 int tcp_log_refused;
228
229 int tcp_do_autorcvbuf = 1;
230 int tcp_autorcvbuf_inc = 16 * 1024;
231 int tcp_autorcvbuf_max = 256 * 1024;
232 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
233
234 static int tcp_rst_ppslim_count = 0;
235 static struct timeval tcp_rst_ppslim_last;
236 static int tcp_ackdrop_ppslim_count = 0;
237 static struct timeval tcp_ackdrop_ppslim_last;
238
239 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
240
241 /* for modulo comparisons of timestamps */
242 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
243 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
244
245 /*
246 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
247 */
248 static void
249 nd_hint(struct tcpcb *tp)
250 {
251 struct route *ro = NULL;
252 struct rtentry *rt;
253
254 if (tp == NULL)
255 return;
256
257 ro = &tp->t_inpcb->inp_route;
258 if (ro == NULL)
259 return;
260
261 rt = rtcache_validate(ro);
262 if (rt == NULL)
263 return;
264
265 switch (tp->t_family) {
266 #if NARP > 0
267 case AF_INET:
268 arp_nud_hint(rt);
269 break;
270 #endif
271 #ifdef INET6
272 case AF_INET6:
273 nd6_nud_hint(rt);
274 break;
275 #endif
276 }
277
278 rtcache_unref(rt, ro);
279 }
280
281 /*
282 * Compute ACK transmission behavior. Delay the ACK unless
283 * we have already delayed an ACK (must send an ACK every two segments).
284 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
285 * option is enabled.
286 */
287 static void
288 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
289 {
290
291 if (tp->t_flags & TF_DELACK ||
292 (tcp_ack_on_push && th->th_flags & TH_PUSH))
293 tp->t_flags |= TF_ACKNOW;
294 else
295 TCP_SET_DELACK(tp);
296 }
297
298 static void
299 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
300 {
301
302 /*
303 * If we had a pending ICMP message that refers to data that have
304 * just been acknowledged, disregard the recorded ICMP message.
305 */
306 if ((tp->t_flags & TF_PMTUD_PEND) &&
307 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
308 tp->t_flags &= ~TF_PMTUD_PEND;
309
310 /*
311 * Keep track of the largest chunk of data
312 * acknowledged since last PMTU update
313 */
314 if (tp->t_pmtud_mss_acked < acked)
315 tp->t_pmtud_mss_acked = acked;
316 }
317
318 /*
319 * Convert TCP protocol fields to host order for easier processing.
320 */
321 static void
322 tcp_fields_to_host(struct tcphdr *th)
323 {
324
325 NTOHL(th->th_seq);
326 NTOHL(th->th_ack);
327 NTOHS(th->th_win);
328 NTOHS(th->th_urp);
329 }
330
331 /*
332 * ... and reverse the above.
333 */
334 static void
335 tcp_fields_to_net(struct tcphdr *th)
336 {
337
338 HTONL(th->th_seq);
339 HTONL(th->th_ack);
340 HTONS(th->th_win);
341 HTONS(th->th_urp);
342 }
343
344 static void
345 tcp_urp_drop(struct tcphdr *th, int todrop, int *tiflags)
346 {
347 if (th->th_urp > todrop) {
348 th->th_urp -= todrop;
349 } else {
350 *tiflags &= ~TH_URG;
351 th->th_urp = 0;
352 }
353 }
354
355 #ifdef TCP_CSUM_COUNTERS
356 #include <sys/device.h>
357
358 extern struct evcnt tcp_hwcsum_ok;
359 extern struct evcnt tcp_hwcsum_bad;
360 extern struct evcnt tcp_hwcsum_data;
361 extern struct evcnt tcp_swcsum;
362 #if defined(INET6)
363 extern struct evcnt tcp6_hwcsum_ok;
364 extern struct evcnt tcp6_hwcsum_bad;
365 extern struct evcnt tcp6_hwcsum_data;
366 extern struct evcnt tcp6_swcsum;
367 #endif /* defined(INET6) */
368
369 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
370
371 #else
372
373 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
374
375 #endif /* TCP_CSUM_COUNTERS */
376
377 #ifdef TCP_REASS_COUNTERS
378 #include <sys/device.h>
379
380 extern struct evcnt tcp_reass_;
381 extern struct evcnt tcp_reass_empty;
382 extern struct evcnt tcp_reass_iteration[8];
383 extern struct evcnt tcp_reass_prependfirst;
384 extern struct evcnt tcp_reass_prepend;
385 extern struct evcnt tcp_reass_insert;
386 extern struct evcnt tcp_reass_inserttail;
387 extern struct evcnt tcp_reass_append;
388 extern struct evcnt tcp_reass_appendtail;
389 extern struct evcnt tcp_reass_overlaptail;
390 extern struct evcnt tcp_reass_overlapfront;
391 extern struct evcnt tcp_reass_segdup;
392 extern struct evcnt tcp_reass_fragdup;
393
394 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
395
396 #else
397
398 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
399
400 #endif /* TCP_REASS_COUNTERS */
401
402 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
403 int);
404
405 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
406 #ifdef INET6
407 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
408 #endif
409
410 #if defined(MBUFTRACE)
411 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
412 #endif /* defined(MBUFTRACE) */
413
414 static struct pool tcpipqent_pool;
415
416 void
417 tcpipqent_init(void)
418 {
419
420 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
421 NULL, IPL_VM);
422 }
423
424 struct ipqent *
425 tcpipqent_alloc(void)
426 {
427 struct ipqent *ipqe;
428 int s;
429
430 s = splvm();
431 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
432 splx(s);
433
434 return ipqe;
435 }
436
437 void
438 tcpipqent_free(struct ipqent *ipqe)
439 {
440 int s;
441
442 s = splvm();
443 pool_put(&tcpipqent_pool, ipqe);
444 splx(s);
445 }
446
447 /*
448 * Insert segment ti into reassembly queue of tcp with
449 * control block tp. Return TH_FIN if reassembly now includes
450 * a segment with FIN.
451 */
452 static int
453 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int tlen)
454 {
455 struct ipqent *p, *q, *nq, *tiqe = NULL;
456 struct socket *so = NULL;
457 int pkt_flags;
458 tcp_seq pkt_seq;
459 unsigned pkt_len;
460 u_long rcvpartdupbyte = 0;
461 u_long rcvoobyte;
462 #ifdef TCP_REASS_COUNTERS
463 u_int count = 0;
464 #endif
465 uint64_t *tcps;
466
467 so = tp->t_inpcb->inp_socket;
468
469 TCP_REASS_LOCK_CHECK(tp);
470
471 /*
472 * Call with th==NULL after become established to
473 * force pre-ESTABLISHED data up to user socket.
474 */
475 if (th == NULL)
476 goto present;
477
478 m_claimm(m, &tcp_reass_mowner);
479
480 rcvoobyte = tlen;
481 /*
482 * Copy these to local variables because the TCP header gets munged
483 * while we are collapsing mbufs.
484 */
485 pkt_seq = th->th_seq;
486 pkt_len = tlen;
487 pkt_flags = th->th_flags;
488
489 TCP_REASS_COUNTER_INCR(&tcp_reass_);
490
491 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
492 /*
493 * When we miss a packet, the vast majority of time we get
494 * packets that follow it in order. So optimize for that.
495 */
496 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
497 p->ipqe_len += pkt_len;
498 p->ipqe_flags |= pkt_flags;
499 m_cat(p->ipqe_m, m);
500 m = NULL;
501 tiqe = p;
502 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
503 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
504 goto skip_replacement;
505 }
506 /*
507 * While we're here, if the pkt is completely beyond
508 * anything we have, just insert it at the tail.
509 */
510 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
511 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
512 goto insert_it;
513 }
514 }
515
516 q = TAILQ_FIRST(&tp->segq);
517
518 if (q != NULL) {
519 /*
520 * If this segment immediately precedes the first out-of-order
521 * block, simply slap the segment in front of it and (mostly)
522 * skip the complicated logic.
523 */
524 if (pkt_seq + pkt_len == q->ipqe_seq) {
525 q->ipqe_seq = pkt_seq;
526 q->ipqe_len += pkt_len;
527 q->ipqe_flags |= pkt_flags;
528 m_cat(m, q->ipqe_m);
529 q->ipqe_m = m;
530 tiqe = q;
531 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
532 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
533 goto skip_replacement;
534 }
535 } else {
536 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
537 }
538
539 /*
540 * Find a segment which begins after this one does.
541 */
542 for (p = NULL; q != NULL; q = nq) {
543 nq = TAILQ_NEXT(q, ipqe_q);
544 #ifdef TCP_REASS_COUNTERS
545 count++;
546 #endif
547
548 /*
549 * If the received segment is just right after this
550 * fragment, merge the two together and then check
551 * for further overlaps.
552 */
553 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
554 pkt_len += q->ipqe_len;
555 pkt_flags |= q->ipqe_flags;
556 pkt_seq = q->ipqe_seq;
557 m_cat(q->ipqe_m, m);
558 m = q->ipqe_m;
559 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
560 goto free_ipqe;
561 }
562
563 /*
564 * If the received segment is completely past this
565 * fragment, we need to go to the next fragment.
566 */
567 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
568 p = q;
569 continue;
570 }
571
572 /*
573 * If the fragment is past the received segment,
574 * it (or any following) can't be concatenated.
575 */
576 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
577 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
578 break;
579 }
580
581 /*
582 * We've received all the data in this segment before.
583 * Mark it as a duplicate and return.
584 */
585 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
586 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
587 tcps = TCP_STAT_GETREF();
588 tcps[TCP_STAT_RCVDUPPACK]++;
589 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
590 TCP_STAT_PUTREF();
591 tcp_new_dsack(tp, pkt_seq, pkt_len);
592 m_freem(m);
593 if (tiqe != NULL) {
594 tcpipqent_free(tiqe);
595 }
596 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
597 goto out;
598 }
599
600 /*
601 * Received segment completely overlaps this fragment
602 * so we drop the fragment (this keeps the temporal
603 * ordering of segments correct).
604 */
605 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
606 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
607 rcvpartdupbyte += q->ipqe_len;
608 m_freem(q->ipqe_m);
609 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
610 goto free_ipqe;
611 }
612
613 /*
614 * Received segment extends past the end of the fragment.
615 * Drop the overlapping bytes, merge the fragment and
616 * segment, and treat as a longer received packet.
617 */
618 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
619 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
620 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
621 m_adj(m, overlap);
622 rcvpartdupbyte += overlap;
623 m_cat(q->ipqe_m, m);
624 m = q->ipqe_m;
625 pkt_seq = q->ipqe_seq;
626 pkt_len += q->ipqe_len - overlap;
627 rcvoobyte -= overlap;
628 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
629 goto free_ipqe;
630 }
631
632 /*
633 * Received segment extends past the front of the fragment.
634 * Drop the overlapping bytes on the received packet. The
635 * packet will then be concatenated with this fragment a
636 * bit later.
637 */
638 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
639 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
640 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
641 m_adj(m, -overlap);
642 pkt_len -= overlap;
643 rcvpartdupbyte += overlap;
644 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
645 rcvoobyte -= overlap;
646 }
647
648 /*
649 * If the received segment immediately precedes this
650 * fragment then tack the fragment onto this segment
651 * and reinsert the data.
652 */
653 if (q->ipqe_seq == pkt_seq + pkt_len) {
654 pkt_len += q->ipqe_len;
655 pkt_flags |= q->ipqe_flags;
656 m_cat(m, q->ipqe_m);
657 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
658 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
659 tp->t_segqlen--;
660 KASSERT(tp->t_segqlen >= 0);
661 KASSERT(tp->t_segqlen != 0 ||
662 (TAILQ_EMPTY(&tp->segq) &&
663 TAILQ_EMPTY(&tp->timeq)));
664 if (tiqe == NULL) {
665 tiqe = q;
666 } else {
667 tcpipqent_free(q);
668 }
669 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
670 break;
671 }
672
673 /*
674 * If the fragment is before the segment, remember it.
675 * When this loop is terminated, p will contain the
676 * pointer to the fragment that is right before the
677 * received segment.
678 */
679 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
680 p = q;
681
682 continue;
683
684 /*
685 * This is a common operation. It also will allow
686 * to save doing a malloc/free in most instances.
687 */
688 free_ipqe:
689 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
690 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
691 tp->t_segqlen--;
692 KASSERT(tp->t_segqlen >= 0);
693 KASSERT(tp->t_segqlen != 0 ||
694 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
695 if (tiqe == NULL) {
696 tiqe = q;
697 } else {
698 tcpipqent_free(q);
699 }
700 }
701
702 #ifdef TCP_REASS_COUNTERS
703 if (count > 7)
704 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
705 else if (count > 0)
706 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
707 #endif
708
709 insert_it:
710 /*
711 * Allocate a new queue entry (block) since the received segment
712 * did not collapse onto any other out-of-order block. If it had
713 * collapsed, tiqe would not be NULL and we would be reusing it.
714 *
715 * If the allocation fails, drop the packet.
716 */
717 if (tiqe == NULL) {
718 tiqe = tcpipqent_alloc();
719 if (tiqe == NULL) {
720 TCP_STATINC(TCP_STAT_RCVMEMDROP);
721 m_freem(m);
722 goto out;
723 }
724 }
725
726 /*
727 * Update the counters.
728 */
729 tp->t_rcvoopack++;
730 tcps = TCP_STAT_GETREF();
731 tcps[TCP_STAT_RCVOOPACK]++;
732 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
733 if (rcvpartdupbyte) {
734 tcps[TCP_STAT_RCVPARTDUPPACK]++;
735 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
736 }
737 TCP_STAT_PUTREF();
738
739 /*
740 * Insert the new fragment queue entry into both queues.
741 */
742 tiqe->ipqe_m = m;
743 tiqe->ipqe_seq = pkt_seq;
744 tiqe->ipqe_len = pkt_len;
745 tiqe->ipqe_flags = pkt_flags;
746 if (p == NULL) {
747 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
748 } else {
749 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
750 }
751 tp->t_segqlen++;
752
753 skip_replacement:
754 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
755
756 present:
757 /*
758 * Present data to user, advancing rcv_nxt through
759 * completed sequence space.
760 */
761 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
762 goto out;
763 q = TAILQ_FIRST(&tp->segq);
764 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
765 goto out;
766 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
767 goto out;
768
769 tp->rcv_nxt += q->ipqe_len;
770 pkt_flags = q->ipqe_flags & TH_FIN;
771 nd_hint(tp);
772
773 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
774 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
775 tp->t_segqlen--;
776 KASSERT(tp->t_segqlen >= 0);
777 KASSERT(tp->t_segqlen != 0 ||
778 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
779 if (so->so_state & SS_CANTRCVMORE)
780 m_freem(q->ipqe_m);
781 else
782 sbappendstream(&so->so_rcv, q->ipqe_m);
783 tcpipqent_free(q);
784 TCP_REASS_UNLOCK(tp);
785 sorwakeup(so);
786 return pkt_flags;
787
788 out:
789 TCP_REASS_UNLOCK(tp);
790 return 0;
791 }
792
793 #ifdef INET6
794 int
795 tcp6_input(struct mbuf **mp, int *offp, int proto)
796 {
797 struct mbuf *m = *mp;
798
799 /*
800 * draft-itojun-ipv6-tcp-to-anycast
801 * better place to put this in?
802 */
803 if (m->m_flags & M_ANYCAST6) {
804 struct ip6_hdr *ip6;
805 if (m->m_len < sizeof(struct ip6_hdr)) {
806 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
807 TCP_STATINC(TCP_STAT_RCVSHORT);
808 return IPPROTO_DONE;
809 }
810 }
811 ip6 = mtod(m, struct ip6_hdr *);
812 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
813 (char *)&ip6->ip6_dst - (char *)ip6);
814 return IPPROTO_DONE;
815 }
816
817 tcp_input(m, *offp, proto);
818 return IPPROTO_DONE;
819 }
820 #endif
821
822 static void
823 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
824 {
825 char src[INET_ADDRSTRLEN];
826 char dst[INET_ADDRSTRLEN];
827
828 if (ip) {
829 in_print(src, sizeof(src), &ip->ip_src);
830 in_print(dst, sizeof(dst), &ip->ip_dst);
831 } else {
832 strlcpy(src, "(unknown)", sizeof(src));
833 strlcpy(dst, "(unknown)", sizeof(dst));
834 }
835 log(LOG_INFO,
836 "Connection attempt to TCP %s:%d from %s:%d\n",
837 dst, ntohs(th->th_dport),
838 src, ntohs(th->th_sport));
839 }
840
841 #ifdef INET6
842 static void
843 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
844 {
845 char src[INET6_ADDRSTRLEN];
846 char dst[INET6_ADDRSTRLEN];
847
848 if (ip6) {
849 in6_print(src, sizeof(src), &ip6->ip6_src);
850 in6_print(dst, sizeof(dst), &ip6->ip6_dst);
851 } else {
852 strlcpy(src, "(unknown v6)", sizeof(src));
853 strlcpy(dst, "(unknown v6)", sizeof(dst));
854 }
855 log(LOG_INFO,
856 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
857 dst, ntohs(th->th_dport),
858 src, ntohs(th->th_sport));
859 }
860 #endif
861
862 /*
863 * Checksum extended TCP header and data.
864 */
865 int
866 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
867 int toff, int off, int tlen)
868 {
869 struct ifnet *rcvif;
870 int s;
871
872 /*
873 * XXX it's better to record and check if this mbuf is
874 * already checked.
875 */
876
877 rcvif = m_get_rcvif(m, &s);
878 if (__predict_false(rcvif == NULL))
879 goto badcsum; /* XXX */
880
881 switch (af) {
882 case AF_INET:
883 switch (m->m_pkthdr.csum_flags &
884 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
885 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
886 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
887 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
888 goto badcsum;
889
890 case M_CSUM_TCPv4|M_CSUM_DATA: {
891 u_int32_t hw_csum = m->m_pkthdr.csum_data;
892
893 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
894 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
895 const struct ip *ip =
896 mtod(m, const struct ip *);
897
898 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
899 ip->ip_dst.s_addr,
900 htons(hw_csum + tlen + off + IPPROTO_TCP));
901 }
902 if ((hw_csum ^ 0xffff) != 0)
903 goto badcsum;
904 break;
905 }
906
907 case M_CSUM_TCPv4:
908 /* Checksum was okay. */
909 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
910 break;
911
912 default:
913 /*
914 * Must compute it ourselves. Maybe skip checksum
915 * on loopback interfaces.
916 */
917 if (__predict_true(!(rcvif->if_flags & IFF_LOOPBACK) ||
918 tcp_do_loopback_cksum)) {
919 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
920 if (in4_cksum(m, IPPROTO_TCP, toff,
921 tlen + off) != 0)
922 goto badcsum;
923 }
924 break;
925 }
926 break;
927
928 #ifdef INET6
929 case AF_INET6:
930 switch (m->m_pkthdr.csum_flags &
931 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
932 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
933 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
934 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
935 goto badcsum;
936
937 #if 0 /* notyet */
938 case M_CSUM_TCPv6|M_CSUM_DATA:
939 #endif
940
941 case M_CSUM_TCPv6:
942 /* Checksum was okay. */
943 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
944 break;
945
946 default:
947 /*
948 * Must compute it ourselves. Maybe skip checksum
949 * on loopback interfaces.
950 */
951 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
952 tcp_do_loopback_cksum)) {
953 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
954 if (in6_cksum(m, IPPROTO_TCP, toff,
955 tlen + off) != 0)
956 goto badcsum;
957 }
958 }
959 break;
960 #endif /* INET6 */
961 }
962 m_put_rcvif(rcvif, &s);
963
964 return 0;
965
966 badcsum:
967 m_put_rcvif(rcvif, &s);
968 TCP_STATINC(TCP_STAT_RCVBADSUM);
969 return -1;
970 }
971
972 /*
973 * When a packet arrives addressed to a vestigial tcpbp, we
974 * nevertheless have to respond to it per the spec.
975 *
976 * This code is duplicated from the one in tcp_input().
977 */
978 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp,
979 struct mbuf *m, int tlen)
980 {
981 int tiflags;
982 int todrop;
983 uint32_t t_flags = 0;
984 uint64_t *tcps;
985
986 tiflags = th->th_flags;
987 todrop = vp->rcv_nxt - th->th_seq;
988
989 if (todrop > 0) {
990 if (tiflags & TH_SYN) {
991 tiflags &= ~TH_SYN;
992 th->th_seq++;
993 tcp_urp_drop(th, 1, &tiflags);
994 todrop--;
995 }
996 if (todrop > tlen ||
997 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
998 /*
999 * Any valid FIN or RST must be to the left of the
1000 * window. At this point the FIN or RST must be a
1001 * duplicate or out of sequence; drop it.
1002 */
1003 if (tiflags & TH_RST)
1004 goto drop;
1005 tiflags &= ~(TH_FIN|TH_RST);
1006
1007 /*
1008 * Send an ACK to resynchronize and drop any data.
1009 * But keep on processing for RST or ACK.
1010 */
1011 t_flags |= TF_ACKNOW;
1012 todrop = tlen;
1013 tcps = TCP_STAT_GETREF();
1014 tcps[TCP_STAT_RCVDUPPACK] += 1;
1015 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
1016 TCP_STAT_PUTREF();
1017 } else if ((tiflags & TH_RST) &&
1018 th->th_seq != vp->rcv_nxt) {
1019 /*
1020 * Test for reset before adjusting the sequence
1021 * number for overlapping data.
1022 */
1023 goto dropafterack_ratelim;
1024 } else {
1025 tcps = TCP_STAT_GETREF();
1026 tcps[TCP_STAT_RCVPARTDUPPACK] += 1;
1027 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
1028 TCP_STAT_PUTREF();
1029 }
1030
1031 // tcp_new_dsack(tp, th->th_seq, todrop);
1032 // hdroptlen += todrop; /*drop from head afterwards*/
1033
1034 th->th_seq += todrop;
1035 tlen -= todrop;
1036 tcp_urp_drop(th, todrop, &tiflags);
1037 }
1038
1039 /*
1040 * If new data are received on a connection after the
1041 * user processes are gone, then RST the other end.
1042 */
1043 if (tlen) {
1044 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
1045 goto dropwithreset;
1046 }
1047
1048 /*
1049 * If segment ends after window, drop trailing data
1050 * (and PUSH and FIN); if nothing left, just ACK.
1051 */
1052 todrop = (th->th_seq + tlen) - (vp->rcv_nxt + vp->rcv_wnd);
1053
1054 if (todrop > 0) {
1055 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
1056 if (todrop >= tlen) {
1057 /*
1058 * The segment actually starts after the window.
1059 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen
1060 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0
1061 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd
1062 */
1063 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
1064
1065 /*
1066 * If a new connection request is received
1067 * while in TIME_WAIT, drop the old connection
1068 * and start over if the sequence numbers
1069 * are above the previous ones.
1070 */
1071 if ((tiflags & TH_SYN) &&
1072 SEQ_GT(th->th_seq, vp->rcv_nxt)) {
1073 /*
1074 * We only support this in the !NOFDREF case, which
1075 * is to say: not here.
1076 */
1077 goto dropwithreset;
1078 }
1079
1080 /*
1081 * If window is closed can only take segments at
1082 * window edge, and have to drop data and PUSH from
1083 * incoming segments. Continue processing, but
1084 * remember to ack. Otherwise, drop segment
1085 * and (if not RST) ack.
1086 */
1087 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) {
1088 t_flags |= TF_ACKNOW;
1089 TCP_STATINC(TCP_STAT_RCVWINPROBE);
1090 } else {
1091 goto dropafterack;
1092 }
1093 } else {
1094 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
1095 }
1096 m_adj(m, -todrop);
1097 tlen -= todrop;
1098 tiflags &= ~(TH_PUSH|TH_FIN);
1099 }
1100
1101 if (tiflags & TH_RST) {
1102 if (th->th_seq != vp->rcv_nxt)
1103 goto dropafterack_ratelim;
1104
1105 vtw_del(vp->ctl, vp->vtw);
1106 goto drop;
1107 }
1108
1109 /*
1110 * If the ACK bit is off we drop the segment and return.
1111 */
1112 if ((tiflags & TH_ACK) == 0) {
1113 if (t_flags & TF_ACKNOW)
1114 goto dropafterack;
1115 goto drop;
1116 }
1117
1118 /*
1119 * In TIME_WAIT state the only thing that should arrive
1120 * is a retransmission of the remote FIN. Acknowledge
1121 * it and restart the finack timer.
1122 */
1123 vtw_restart(vp);
1124 goto dropafterack;
1125
1126 dropafterack:
1127 /*
1128 * Generate an ACK dropping incoming segment if it occupies
1129 * sequence space, where the ACK reflects our state.
1130 */
1131 if (tiflags & TH_RST)
1132 goto drop;
1133 goto dropafterack2;
1134
1135 dropafterack_ratelim:
1136 /*
1137 * We may want to rate-limit ACKs against SYN/RST attack.
1138 */
1139 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
1140 tcp_ackdrop_ppslim) == 0) {
1141 /* XXX stat */
1142 goto drop;
1143 }
1144 /* ...fall into dropafterack2... */
1145
1146 dropafterack2:
1147 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack, TH_ACK);
1148 return;
1149
1150 dropwithreset:
1151 /*
1152 * Generate a RST, dropping incoming segment.
1153 * Make ACK acceptable to originator of segment.
1154 */
1155 if (tiflags & TH_RST)
1156 goto drop;
1157
1158 if (tiflags & TH_ACK) {
1159 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
1160 } else {
1161 if (tiflags & TH_SYN)
1162 ++tlen;
1163 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0,
1164 TH_RST|TH_ACK);
1165 }
1166 return;
1167 drop:
1168 m_freem(m);
1169 }
1170
1171 /*
1172 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
1173 */
1174 void
1175 tcp_input(struct mbuf *m, int off, int proto)
1176 {
1177 struct tcphdr *th;
1178 struct ip *ip;
1179 struct inpcb *inp;
1180 #ifdef INET6
1181 struct ip6_hdr *ip6;
1182 #endif
1183 u_int8_t *optp = NULL;
1184 int optlen = 0;
1185 int len, tlen, hdroptlen = 0;
1186 struct tcpcb *tp = NULL;
1187 int tiflags;
1188 struct socket *so = NULL;
1189 int todrop, acked, ourfinisacked, needoutput = 0;
1190 bool dupseg;
1191 #ifdef TCP_DEBUG
1192 short ostate = 0;
1193 #endif
1194 u_long tiwin;
1195 struct tcp_opt_info opti;
1196 int thlen, iphlen;
1197 int af; /* af on the wire */
1198 struct mbuf *tcp_saveti = NULL;
1199 uint32_t ts_rtt;
1200 uint8_t iptos;
1201 uint64_t *tcps;
1202 vestigial_inpcb_t vestige;
1203
1204 vestige.valid = 0;
1205
1206 MCLAIM(m, &tcp_rx_mowner);
1207
1208 TCP_STATINC(TCP_STAT_RCVTOTAL);
1209
1210 memset(&opti, 0, sizeof(opti));
1211 opti.ts_present = 0;
1212 opti.maxseg = 0;
1213
1214 /*
1215 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1216 *
1217 * TCP is, by definition, unicast, so we reject all
1218 * multicast outright.
1219 *
1220 * Note, there are additional src/dst address checks in
1221 * the AF-specific code below.
1222 */
1223 if (m->m_flags & (M_BCAST|M_MCAST)) {
1224 /* XXX stat */
1225 goto drop;
1226 }
1227 #ifdef INET6
1228 if (m->m_flags & M_ANYCAST6) {
1229 /* XXX stat */
1230 goto drop;
1231 }
1232 #endif
1233
1234 M_REGION_GET(th, struct tcphdr *, m, off, sizeof(struct tcphdr));
1235 if (th == NULL) {
1236 TCP_STATINC(TCP_STAT_RCVSHORT);
1237 return;
1238 }
1239
1240 /*
1241 * Enforce alignment requirements that are violated in
1242 * some cases, see kern/50766 for details.
1243 */
1244 if (ACCESSIBLE_POINTER(th, struct tcphdr) == 0) {
1245 m = m_copyup(m, off + sizeof(struct tcphdr), 0);
1246 if (m == NULL) {
1247 TCP_STATINC(TCP_STAT_RCVSHORT);
1248 return;
1249 }
1250 th = (struct tcphdr *)(mtod(m, char *) + off);
1251 }
1252 KASSERT(ACCESSIBLE_POINTER(th, struct tcphdr));
1253
1254 /*
1255 * Get IP and TCP header.
1256 * Note: IP leaves IP header in first mbuf.
1257 */
1258 ip = mtod(m, struct ip *);
1259 #ifdef INET6
1260 ip6 = mtod(m, struct ip6_hdr *);
1261 #endif
1262 switch (ip->ip_v) {
1263 case 4:
1264 af = AF_INET;
1265 iphlen = sizeof(struct ip);
1266
1267 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1268 in_broadcast(ip->ip_dst, m_get_rcvif_NOMPSAFE(m)))
1269 goto drop;
1270
1271 /* We do the checksum after PCB lookup... */
1272 len = ntohs(ip->ip_len);
1273 tlen = len - off;
1274 iptos = ip->ip_tos;
1275 break;
1276 #ifdef INET6
1277 case 6:
1278 iphlen = sizeof(struct ip6_hdr);
1279 af = AF_INET6;
1280
1281 /*
1282 * Be proactive about unspecified IPv6 address in source.
1283 * As we use all-zero to indicate unbounded/unconnected pcb,
1284 * unspecified IPv6 address can be used to confuse us.
1285 *
1286 * Note that packets with unspecified IPv6 destination is
1287 * already dropped in ip6_input.
1288 */
1289 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1290 /* XXX stat */
1291 goto drop;
1292 }
1293
1294 /*
1295 * Make sure destination address is not multicast.
1296 * Source address checked in ip6_input().
1297 */
1298 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1299 /* XXX stat */
1300 goto drop;
1301 }
1302
1303 /* We do the checksum after PCB lookup... */
1304 len = m->m_pkthdr.len;
1305 tlen = len - off;
1306 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1307 break;
1308 #endif
1309 default:
1310 m_freem(m);
1311 return;
1312 }
1313
1314
1315 /*
1316 * Check that TCP offset makes sense, pull out TCP options and
1317 * adjust length.
1318 */
1319 thlen = th->th_off << 2;
1320 if (thlen < sizeof(struct tcphdr) || thlen > tlen) {
1321 TCP_STATINC(TCP_STAT_RCVBADOFF);
1322 goto drop;
1323 }
1324 tlen -= thlen;
1325
1326 if (thlen > sizeof(struct tcphdr)) {
1327 M_REGION_GET(th, struct tcphdr *, m, off, thlen);
1328 if (th == NULL) {
1329 TCP_STATINC(TCP_STAT_RCVSHORT);
1330 return;
1331 }
1332 KASSERT(ACCESSIBLE_POINTER(th, struct tcphdr));
1333 optlen = thlen - sizeof(struct tcphdr);
1334 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1335
1336 /*
1337 * Do quick retrieval of timestamp options.
1338 *
1339 * If timestamp is the only option and it's formatted as
1340 * recommended in RFC 1323 appendix A, we quickly get the
1341 * values now and don't bother calling tcp_dooptions(),
1342 * etc.
1343 */
1344 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1345 (optlen > TCPOLEN_TSTAMP_APPA &&
1346 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1347 be32dec(optp) == TCPOPT_TSTAMP_HDR &&
1348 (th->th_flags & TH_SYN) == 0) {
1349 opti.ts_present = 1;
1350 opti.ts_val = be32dec(optp + 4);
1351 opti.ts_ecr = be32dec(optp + 8);
1352 optp = NULL; /* we've parsed the options */
1353 }
1354 }
1355 tiflags = th->th_flags;
1356
1357 /*
1358 * Checksum extended TCP header and data
1359 */
1360 if (tcp_input_checksum(af, m, th, off, thlen, tlen))
1361 goto badcsum;
1362
1363 /*
1364 * Locate pcb for segment.
1365 */
1366 findpcb:
1367 inp = NULL;
1368 switch (af) {
1369 case AF_INET:
1370 inp = inpcb_lookup(&tcbtable, ip->ip_src, th->th_sport,
1371 ip->ip_dst, th->th_dport, &vestige);
1372 if (inp == NULL && !vestige.valid) {
1373 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1374 inp = inpcb_lookup_bound(&tcbtable, ip->ip_dst,
1375 th->th_dport);
1376 }
1377 #ifdef INET6
1378 if (inp == NULL && !vestige.valid) {
1379 struct in6_addr s, d;
1380
1381 /* mapped addr case */
1382 in6_in_2_v4mapin6(&ip->ip_src, &s);
1383 in6_in_2_v4mapin6(&ip->ip_dst, &d);
1384 inp = in6pcb_lookup(&tcbtable, &s,
1385 th->th_sport, &d, th->th_dport, 0, &vestige);
1386 if (inp == NULL && !vestige.valid) {
1387 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1388 inp = in6pcb_lookup_bound(&tcbtable, &d,
1389 th->th_dport, 0);
1390 }
1391 }
1392 #endif
1393 if (inp == NULL && !vestige.valid) {
1394 TCP_STATINC(TCP_STAT_NOPORT);
1395 if (tcp_log_refused &&
1396 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1397 tcp4_log_refused(ip, th);
1398 }
1399 tcp_fields_to_host(th);
1400 goto dropwithreset_ratelim;
1401 }
1402 #if defined(IPSEC)
1403 if (ipsec_used) {
1404 if (inp && ipsec_in_reject(m, inp))
1405 goto drop;
1406 }
1407 #endif /*IPSEC*/
1408 break;
1409 #ifdef INET6
1410 case AF_INET6:
1411 {
1412 int faith;
1413
1414 #if defined(NFAITH) && NFAITH > 0
1415 faith = faithprefix(&ip6->ip6_dst);
1416 #else
1417 faith = 0;
1418 #endif
1419 inp = in6pcb_lookup(&tcbtable, &ip6->ip6_src,
1420 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige);
1421 if (inp == NULL && !vestige.valid) {
1422 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1423 inp = in6pcb_lookup_bound(&tcbtable, &ip6->ip6_dst,
1424 th->th_dport, faith);
1425 }
1426 if (inp == NULL && !vestige.valid) {
1427 TCP_STATINC(TCP_STAT_NOPORT);
1428 if (tcp_log_refused &&
1429 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1430 tcp6_log_refused(ip6, th);
1431 }
1432 tcp_fields_to_host(th);
1433 goto dropwithreset_ratelim;
1434 }
1435 #if defined(IPSEC)
1436 if (ipsec_used && inp && ipsec_in_reject(m, inp))
1437 goto drop;
1438 #endif
1439 break;
1440 }
1441 #endif
1442 }
1443
1444 tcp_fields_to_host(th);
1445
1446 /*
1447 * If the state is CLOSED (i.e., TCB does not exist) then
1448 * all data in the incoming segment is discarded.
1449 * If the TCB exists but is in CLOSED state, it is embryonic,
1450 * but should either do a listen or a connect soon.
1451 */
1452 tp = NULL;
1453 so = NULL;
1454 if (inp) {
1455 /* Check the minimum TTL for socket. */
1456 if (inp->inp_af == AF_INET && ip->ip_ttl < in4p_ip_minttl(inp))
1457 goto drop;
1458
1459 tp = intotcpcb(inp);
1460 so = inp->inp_socket;
1461 } else if (vestige.valid) {
1462 /* We do not support the resurrection of vtw tcpcps. */
1463 tcp_vtw_input(th, &vestige, m, tlen);
1464 m = NULL;
1465 goto drop;
1466 }
1467
1468 if (tp == NULL)
1469 goto dropwithreset_ratelim;
1470 if (tp->t_state == TCPS_CLOSED)
1471 goto drop;
1472
1473 KASSERT(so->so_lock == softnet_lock);
1474 KASSERT(solocked(so));
1475
1476 /* Unscale the window into a 32-bit value. */
1477 if ((tiflags & TH_SYN) == 0)
1478 tiwin = th->th_win << tp->snd_scale;
1479 else
1480 tiwin = th->th_win;
1481
1482 #ifdef INET6
1483 /* save packet options if user wanted */
1484 if (inp->inp_af == AF_INET6 && (inp->inp_flags & IN6P_CONTROLOPTS)) {
1485 if (inp->inp_options) {
1486 m_freem(inp->inp_options);
1487 inp->inp_options = NULL;
1488 }
1489 ip6_savecontrol(inp, &inp->inp_options, ip6, m);
1490 }
1491 #endif
1492
1493 if (so->so_options & SO_DEBUG) {
1494 #ifdef TCP_DEBUG
1495 ostate = tp->t_state;
1496 #endif
1497
1498 tcp_saveti = NULL;
1499 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1500 goto nosave;
1501
1502 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1503 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1504 if (tcp_saveti == NULL)
1505 goto nosave;
1506 } else {
1507 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1508 if (tcp_saveti == NULL)
1509 goto nosave;
1510 MCLAIM(m, &tcp_mowner);
1511 tcp_saveti->m_len = iphlen;
1512 m_copydata(m, 0, iphlen,
1513 mtod(tcp_saveti, void *));
1514 }
1515
1516 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1517 m_freem(tcp_saveti);
1518 tcp_saveti = NULL;
1519 } else {
1520 tcp_saveti->m_len += sizeof(struct tcphdr);
1521 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1522 sizeof(struct tcphdr));
1523 }
1524 nosave:;
1525 }
1526
1527 if (so->so_options & SO_ACCEPTCONN) {
1528 union syn_cache_sa src;
1529 union syn_cache_sa dst;
1530
1531 KASSERT(tp->t_state == TCPS_LISTEN);
1532
1533 memset(&src, 0, sizeof(src));
1534 memset(&dst, 0, sizeof(dst));
1535 switch (af) {
1536 case AF_INET:
1537 src.sin.sin_len = sizeof(struct sockaddr_in);
1538 src.sin.sin_family = AF_INET;
1539 src.sin.sin_addr = ip->ip_src;
1540 src.sin.sin_port = th->th_sport;
1541
1542 dst.sin.sin_len = sizeof(struct sockaddr_in);
1543 dst.sin.sin_family = AF_INET;
1544 dst.sin.sin_addr = ip->ip_dst;
1545 dst.sin.sin_port = th->th_dport;
1546 break;
1547 #ifdef INET6
1548 case AF_INET6:
1549 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1550 src.sin6.sin6_family = AF_INET6;
1551 src.sin6.sin6_addr = ip6->ip6_src;
1552 src.sin6.sin6_port = th->th_sport;
1553
1554 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1555 dst.sin6.sin6_family = AF_INET6;
1556 dst.sin6.sin6_addr = ip6->ip6_dst;
1557 dst.sin6.sin6_port = th->th_dport;
1558 break;
1559 #endif
1560 }
1561
1562 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1563 if (tiflags & TH_RST) {
1564 syn_cache_reset(&src.sa, &dst.sa, th);
1565 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1566 (TH_ACK|TH_SYN)) {
1567 /*
1568 * Received a SYN,ACK. This should never
1569 * happen while we are in LISTEN. Send an RST.
1570 */
1571 goto badsyn;
1572 } else if (tiflags & TH_ACK) {
1573 so = syn_cache_get(&src.sa, &dst.sa, th, so, m);
1574 if (so == NULL) {
1575 /*
1576 * We don't have a SYN for this ACK;
1577 * send an RST.
1578 */
1579 goto badsyn;
1580 } else if (so == (struct socket *)(-1)) {
1581 /*
1582 * We were unable to create the
1583 * connection. If the 3-way handshake
1584 * was completed, and RST has been
1585 * sent to the peer. Since the mbuf
1586 * might be in use for the reply, do
1587 * not free it.
1588 */
1589 m = NULL;
1590 } else {
1591 /*
1592 * We have created a full-blown
1593 * connection.
1594 */
1595 inp = sotoinpcb(so);
1596 tp = intotcpcb(inp);
1597 if (tp == NULL)
1598 goto badsyn; /*XXX*/
1599 tiwin <<= tp->snd_scale;
1600 goto after_listen;
1601 }
1602 } else {
1603 /*
1604 * None of RST, SYN or ACK was set.
1605 * This is an invalid packet for a
1606 * TCB in LISTEN state. Send a RST.
1607 */
1608 goto badsyn;
1609 }
1610 } else {
1611 /*
1612 * Received a SYN.
1613 */
1614
1615 #ifdef INET6
1616 /*
1617 * If deprecated address is forbidden, we do
1618 * not accept SYN to deprecated interface
1619 * address to prevent any new inbound
1620 * connection from getting established.
1621 * When we do not accept SYN, we send a TCP
1622 * RST, with deprecated source address (instead
1623 * of dropping it). We compromise it as it is
1624 * much better for peer to send a RST, and
1625 * RST will be the final packet for the
1626 * exchange.
1627 *
1628 * If we do not forbid deprecated addresses, we
1629 * accept the SYN packet. RFC2462 does not
1630 * suggest dropping SYN in this case.
1631 * If we decipher RFC2462 5.5.4, it says like
1632 * this:
1633 * 1. use of deprecated addr with existing
1634 * communication is okay - "SHOULD continue
1635 * to be used"
1636 * 2. use of it with new communication:
1637 * (2a) "SHOULD NOT be used if alternate
1638 * address with sufficient scope is
1639 * available"
1640 * (2b) nothing mentioned otherwise.
1641 * Here we fall into (2b) case as we have no
1642 * choice in our source address selection - we
1643 * must obey the peer.
1644 *
1645 * The wording in RFC2462 is confusing, and
1646 * there are multiple description text for
1647 * deprecated address handling - worse, they
1648 * are not exactly the same. I believe 5.5.4
1649 * is the best one, so we follow 5.5.4.
1650 */
1651 if (af == AF_INET6 && !ip6_use_deprecated) {
1652 struct in6_ifaddr *ia6;
1653 int s;
1654 struct ifnet *rcvif = m_get_rcvif(m, &s);
1655 if (rcvif == NULL)
1656 goto dropwithreset; /* XXX */
1657 if ((ia6 = in6ifa_ifpwithaddr(rcvif,
1658 &ip6->ip6_dst)) &&
1659 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1660 tp = NULL;
1661 m_put_rcvif(rcvif, &s);
1662 goto dropwithreset;
1663 }
1664 m_put_rcvif(rcvif, &s);
1665 }
1666 #endif
1667
1668 /*
1669 * LISTEN socket received a SYN from itself? This
1670 * can't possibly be valid; drop the packet.
1671 */
1672 if (th->th_sport == th->th_dport) {
1673 int eq = 0;
1674
1675 switch (af) {
1676 case AF_INET:
1677 eq = in_hosteq(ip->ip_src, ip->ip_dst);
1678 break;
1679 #ifdef INET6
1680 case AF_INET6:
1681 eq = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src,
1682 &ip6->ip6_dst);
1683 break;
1684 #endif
1685 }
1686 if (eq) {
1687 TCP_STATINC(TCP_STAT_BADSYN);
1688 goto drop;
1689 }
1690 }
1691
1692 /*
1693 * SYN looks ok; create compressed TCP
1694 * state for it.
1695 */
1696 if (so->so_qlen <= so->so_qlimit &&
1697 syn_cache_add(&src.sa, &dst.sa, th, off,
1698 so, m, optp, optlen, &opti))
1699 m = NULL;
1700 }
1701
1702 goto drop;
1703 }
1704
1705 after_listen:
1706 /*
1707 * From here on, we're dealing with !LISTEN.
1708 */
1709 KASSERT(tp->t_state != TCPS_LISTEN);
1710
1711 /*
1712 * Segment received on connection.
1713 * Reset idle time and keep-alive timer.
1714 */
1715 tp->t_rcvtime = tcp_now;
1716 if (TCPS_HAVEESTABLISHED(tp->t_state))
1717 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1718
1719 /*
1720 * Process options.
1721 */
1722 #ifdef TCP_SIGNATURE
1723 if (optp || (tp->t_flags & TF_SIGNATURE))
1724 #else
1725 if (optp)
1726 #endif
1727 if (tcp_dooptions(tp, optp, optlen, th, m, off, &opti) < 0)
1728 goto drop;
1729
1730 if (TCP_SACK_ENABLED(tp)) {
1731 tcp_del_sackholes(tp, th);
1732 }
1733
1734 if (TCP_ECN_ALLOWED(tp)) {
1735 if (tiflags & TH_CWR) {
1736 tp->t_flags &= ~TF_ECN_SND_ECE;
1737 }
1738 switch (iptos & IPTOS_ECN_MASK) {
1739 case IPTOS_ECN_CE:
1740 tp->t_flags |= TF_ECN_SND_ECE;
1741 TCP_STATINC(TCP_STAT_ECN_CE);
1742 break;
1743 case IPTOS_ECN_ECT0:
1744 TCP_STATINC(TCP_STAT_ECN_ECT);
1745 break;
1746 case IPTOS_ECN_ECT1:
1747 /* XXX: ignore for now -- rpaulo */
1748 break;
1749 }
1750 /*
1751 * Congestion experienced.
1752 * Ignore if we are already trying to recover.
1753 */
1754 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1755 tp->t_congctl->cong_exp(tp);
1756 }
1757
1758 if (opti.ts_present && opti.ts_ecr) {
1759 /*
1760 * Calculate the RTT from the returned time stamp and the
1761 * connection's time base. If the time stamp is later than
1762 * the current time, or is extremely old, fall back to non-1323
1763 * RTT calculation. Since ts_rtt is unsigned, we can test both
1764 * at the same time.
1765 *
1766 * Note that ts_rtt is in units of slow ticks (500
1767 * ms). Since most earthbound RTTs are < 500 ms,
1768 * observed values will have large quantization noise.
1769 * Our smoothed RTT is then the fraction of observed
1770 * samples that are 1 tick instead of 0 (times 500
1771 * ms).
1772 *
1773 * ts_rtt is increased by 1 to denote a valid sample,
1774 * with 0 indicating an invalid measurement. This
1775 * extra 1 must be removed when ts_rtt is used, or
1776 * else an erroneous extra 500 ms will result.
1777 */
1778 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1779 if (ts_rtt > TCP_PAWS_IDLE)
1780 ts_rtt = 0;
1781 } else {
1782 ts_rtt = 0;
1783 }
1784
1785 /*
1786 * Fast path: check for the two common cases of a uni-directional
1787 * data transfer. If:
1788 * o We are in the ESTABLISHED state, and
1789 * o The packet has no control flags, and
1790 * o The packet is in-sequence, and
1791 * o The window didn't change, and
1792 * o We are not retransmitting
1793 * It's a candidate.
1794 *
1795 * If the length (tlen) is zero and the ack moved forward, we're
1796 * the sender side of the transfer. Just free the data acked and
1797 * wake any higher level process that was blocked waiting for
1798 * space.
1799 *
1800 * If the length is non-zero and the ack didn't move, we're the
1801 * receiver side. If we're getting packets in-order (the reassembly
1802 * queue is empty), add the data to the socket buffer and note
1803 * that we need a delayed ack.
1804 */
1805 if (tp->t_state == TCPS_ESTABLISHED &&
1806 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1807 == TH_ACK &&
1808 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1809 th->th_seq == tp->rcv_nxt &&
1810 tiwin && tiwin == tp->snd_wnd &&
1811 tp->snd_nxt == tp->snd_max) {
1812
1813 /*
1814 * If last ACK falls within this segment's sequence numbers,
1815 * record the timestamp.
1816 * NOTE that the test is modified according to the latest
1817 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1818 *
1819 * note that we already know
1820 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1821 */
1822 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1823 tp->ts_recent_age = tcp_now;
1824 tp->ts_recent = opti.ts_val;
1825 }
1826
1827 if (tlen == 0) {
1828 /* Ack prediction. */
1829 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1830 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1831 tp->snd_cwnd >= tp->snd_wnd &&
1832 tp->t_partialacks < 0) {
1833 /*
1834 * this is a pure ack for outstanding data.
1835 */
1836 if (ts_rtt)
1837 tcp_xmit_timer(tp, ts_rtt - 1);
1838 else if (tp->t_rtttime &&
1839 SEQ_GT(th->th_ack, tp->t_rtseq))
1840 tcp_xmit_timer(tp,
1841 tcp_now - tp->t_rtttime);
1842 acked = th->th_ack - tp->snd_una;
1843 tcps = TCP_STAT_GETREF();
1844 tcps[TCP_STAT_PREDACK]++;
1845 tcps[TCP_STAT_RCVACKPACK]++;
1846 tcps[TCP_STAT_RCVACKBYTE] += acked;
1847 TCP_STAT_PUTREF();
1848 nd_hint(tp);
1849
1850 if (acked > (tp->t_lastoff - tp->t_inoff))
1851 tp->t_lastm = NULL;
1852 sbdrop(&so->so_snd, acked);
1853 tp->t_lastoff -= acked;
1854
1855 icmp_check(tp, th, acked);
1856
1857 tp->snd_una = th->th_ack;
1858 tp->snd_fack = tp->snd_una;
1859 if (SEQ_LT(tp->snd_high, tp->snd_una))
1860 tp->snd_high = tp->snd_una;
1861 /*
1862 * drag snd_wl2 along so only newer
1863 * ACKs can update the window size.
1864 * also avoids the state where snd_wl2
1865 * is eventually larger than th_ack and thus
1866 * blocking the window update mechanism and
1867 * the connection gets stuck for a loooong
1868 * time in the zero sized send window state.
1869 *
1870 * see PR/kern 55567
1871 */
1872 tp->snd_wl2 = tp->snd_una;
1873
1874 m_freem(m);
1875
1876 /*
1877 * If all outstanding data are acked, stop
1878 * retransmit timer, otherwise restart timer
1879 * using current (possibly backed-off) value.
1880 * If process is waiting for space,
1881 * wakeup/selnotify/signal. If data
1882 * are ready to send, let tcp_output
1883 * decide between more output or persist.
1884 */
1885 if (tp->snd_una == tp->snd_max)
1886 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1887 else if (TCP_TIMER_ISARMED(tp,
1888 TCPT_PERSIST) == 0)
1889 TCP_TIMER_ARM(tp, TCPT_REXMT,
1890 tp->t_rxtcur);
1891
1892 sowwakeup(so);
1893 if (so->so_snd.sb_cc) {
1894 KERNEL_LOCK(1, NULL);
1895 (void)tcp_output(tp);
1896 KERNEL_UNLOCK_ONE(NULL);
1897 }
1898 if (tcp_saveti)
1899 m_freem(tcp_saveti);
1900 return;
1901 }
1902 } else if (th->th_ack == tp->snd_una &&
1903 TAILQ_FIRST(&tp->segq) == NULL &&
1904 tlen <= sbspace(&so->so_rcv)) {
1905 int newsize = 0;
1906
1907 /*
1908 * this is a pure, in-sequence data packet
1909 * with nothing on the reassembly queue and
1910 * we have enough buffer space to take it.
1911 */
1912 tp->rcv_nxt += tlen;
1913
1914 /*
1915 * Pull rcv_up up to prevent seq wrap relative to
1916 * rcv_nxt.
1917 */
1918 tp->rcv_up = tp->rcv_nxt;
1919
1920 /*
1921 * Pull snd_wl1 up to prevent seq wrap relative to
1922 * th_seq.
1923 */
1924 tp->snd_wl1 = th->th_seq;
1925
1926 tcps = TCP_STAT_GETREF();
1927 tcps[TCP_STAT_PREDDAT]++;
1928 tcps[TCP_STAT_RCVPACK]++;
1929 tcps[TCP_STAT_RCVBYTE] += tlen;
1930 TCP_STAT_PUTREF();
1931 nd_hint(tp);
1932 /*
1933 * Automatic sizing enables the performance of large buffers
1934 * and most of the efficiency of small ones by only allocating
1935 * space when it is needed.
1936 *
1937 * On the receive side the socket buffer memory is only rarely
1938 * used to any significant extent. This allows us to be much
1939 * more aggressive in scaling the receive socket buffer. For
1940 * the case that the buffer space is actually used to a large
1941 * extent and we run out of kernel memory we can simply drop
1942 * the new segments; TCP on the sender will just retransmit it
1943 * later. Setting the buffer size too big may only consume too
1944 * much kernel memory if the application doesn't read() from
1945 * the socket or packet loss or reordering makes use of the
1946 * reassembly queue.
1947 *
1948 * The criteria to step up the receive buffer one notch are:
1949 * 1. the number of bytes received during the time it takes
1950 * one timestamp to be reflected back to us (the RTT);
1951 * 2. received bytes per RTT is within seven eighth of the
1952 * current socket buffer size;
1953 * 3. receive buffer size has not hit maximal automatic size;
1954 *
1955 * This algorithm does one step per RTT at most and only if
1956 * we receive a bulk stream w/o packet losses or reorderings.
1957 * Shrinking the buffer during idle times is not necessary as
1958 * it doesn't consume any memory when idle.
1959 *
1960 * TODO: Only step up if the application is actually serving
1961 * the buffer to better manage the socket buffer resources.
1962 */
1963 if (tcp_do_autorcvbuf &&
1964 opti.ts_ecr &&
1965 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1966 if (opti.ts_ecr > tp->rfbuf_ts &&
1967 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
1968 if (tp->rfbuf_cnt >
1969 (so->so_rcv.sb_hiwat / 8 * 7) &&
1970 so->so_rcv.sb_hiwat <
1971 tcp_autorcvbuf_max) {
1972 newsize =
1973 uimin(so->so_rcv.sb_hiwat +
1974 tcp_autorcvbuf_inc,
1975 tcp_autorcvbuf_max);
1976 }
1977 /* Start over with next RTT. */
1978 tp->rfbuf_ts = 0;
1979 tp->rfbuf_cnt = 0;
1980 } else
1981 tp->rfbuf_cnt += tlen; /* add up */
1982 }
1983
1984 /*
1985 * Drop TCP, IP headers and TCP options then add data
1986 * to socket buffer.
1987 */
1988 if (so->so_state & SS_CANTRCVMORE) {
1989 m_freem(m);
1990 } else {
1991 /*
1992 * Set new socket buffer size.
1993 * Give up when limit is reached.
1994 */
1995 if (newsize)
1996 if (!sbreserve(&so->so_rcv,
1997 newsize, so))
1998 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1999 m_adj(m, off + thlen);
2000 sbappendstream(&so->so_rcv, m);
2001 }
2002 sorwakeup(so);
2003 tcp_setup_ack(tp, th);
2004 if (tp->t_flags & TF_ACKNOW) {
2005 KERNEL_LOCK(1, NULL);
2006 (void)tcp_output(tp);
2007 KERNEL_UNLOCK_ONE(NULL);
2008 }
2009 if (tcp_saveti)
2010 m_freem(tcp_saveti);
2011 return;
2012 }
2013 }
2014
2015 /*
2016 * Compute mbuf offset to TCP data segment.
2017 */
2018 hdroptlen = off + thlen;
2019
2020 /*
2021 * Calculate amount of space in receive window. Receive window is
2022 * amount of space in rcv queue, but not less than advertised
2023 * window.
2024 */
2025 {
2026 int win;
2027 win = sbspace(&so->so_rcv);
2028 if (win < 0)
2029 win = 0;
2030 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2031 }
2032
2033 /* Reset receive buffer auto scaling when not in bulk receive mode. */
2034 tp->rfbuf_ts = 0;
2035 tp->rfbuf_cnt = 0;
2036
2037 switch (tp->t_state) {
2038 /*
2039 * If the state is SYN_SENT:
2040 * if seg contains an ACK, but not for our SYN, drop the input.
2041 * if seg contains a RST, then drop the connection.
2042 * if seg does not contain SYN, then drop it.
2043 * Otherwise this is an acceptable SYN segment
2044 * initialize tp->rcv_nxt and tp->irs
2045 * if seg contains ack then advance tp->snd_una
2046 * if seg contains a ECE and ECN support is enabled, the stream
2047 * is ECN capable.
2048 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2049 * arrange for segment to be acked (eventually)
2050 * continue processing rest of data/controls, beginning with URG
2051 */
2052 case TCPS_SYN_SENT:
2053 if ((tiflags & TH_ACK) &&
2054 (SEQ_LEQ(th->th_ack, tp->iss) ||
2055 SEQ_GT(th->th_ack, tp->snd_max)))
2056 goto dropwithreset;
2057 if (tiflags & TH_RST) {
2058 if (tiflags & TH_ACK)
2059 tp = tcp_drop(tp, ECONNREFUSED);
2060 goto drop;
2061 }
2062 if ((tiflags & TH_SYN) == 0)
2063 goto drop;
2064 if (tiflags & TH_ACK) {
2065 tp->snd_una = th->th_ack;
2066 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2067 tp->snd_nxt = tp->snd_una;
2068 if (SEQ_LT(tp->snd_high, tp->snd_una))
2069 tp->snd_high = tp->snd_una;
2070 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2071
2072 if ((tiflags & TH_ECE) && tcp_do_ecn) {
2073 tp->t_flags |= TF_ECN_PERMIT;
2074 TCP_STATINC(TCP_STAT_ECN_SHS);
2075 }
2076 }
2077 tp->irs = th->th_seq;
2078 tcp_rcvseqinit(tp);
2079 tp->t_flags |= TF_ACKNOW;
2080 tcp_mss_from_peer(tp, opti.maxseg);
2081
2082 /*
2083 * Initialize the initial congestion window. If we
2084 * had to retransmit the SYN, we must initialize cwnd
2085 * to 1 segment (i.e. the Loss Window).
2086 */
2087 if (tp->t_flags & TF_SYN_REXMT)
2088 tp->snd_cwnd = tp->t_peermss;
2089 else {
2090 int ss = tcp_init_win;
2091 if (inp->inp_af == AF_INET && in_localaddr(in4p_faddr(inp)))
2092 ss = tcp_init_win_local;
2093 #ifdef INET6
2094 else if (inp->inp_af == AF_INET6 && in6_localaddr(&in6p_faddr(inp)))
2095 ss = tcp_init_win_local;
2096 #endif
2097 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
2098 }
2099
2100 tcp_rmx_rtt(tp);
2101 if (tiflags & TH_ACK) {
2102 TCP_STATINC(TCP_STAT_CONNECTS);
2103 /*
2104 * move tcp_established before soisconnected
2105 * because upcall handler can drive tcp_output
2106 * functionality.
2107 * XXX we might call soisconnected at the end of
2108 * all processing
2109 */
2110 tcp_established(tp);
2111 soisconnected(so);
2112 /* Do window scaling on this connection? */
2113 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2114 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2115 tp->snd_scale = tp->requested_s_scale;
2116 tp->rcv_scale = tp->request_r_scale;
2117 }
2118 TCP_REASS_LOCK(tp);
2119 (void)tcp_reass(tp, NULL, NULL, tlen);
2120 /*
2121 * if we didn't have to retransmit the SYN,
2122 * use its rtt as our initial srtt & rtt var.
2123 */
2124 if (tp->t_rtttime)
2125 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2126 } else {
2127 tp->t_state = TCPS_SYN_RECEIVED;
2128 }
2129
2130 /*
2131 * Advance th->th_seq to correspond to first data byte.
2132 * If data, trim to stay within window,
2133 * dropping FIN if necessary.
2134 */
2135 th->th_seq++;
2136 if (tlen > tp->rcv_wnd) {
2137 todrop = tlen - tp->rcv_wnd;
2138 m_adj(m, -todrop);
2139 tlen = tp->rcv_wnd;
2140 tiflags &= ~TH_FIN;
2141 tcps = TCP_STAT_GETREF();
2142 tcps[TCP_STAT_RCVPACKAFTERWIN]++;
2143 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
2144 TCP_STAT_PUTREF();
2145 }
2146 tp->snd_wl1 = th->th_seq - 1;
2147 tp->rcv_up = th->th_seq;
2148 goto step6;
2149
2150 /*
2151 * If the state is SYN_RECEIVED:
2152 * If seg contains an ACK, but not for our SYN, drop the input
2153 * and generate an RST. See page 36, rfc793
2154 */
2155 case TCPS_SYN_RECEIVED:
2156 if ((tiflags & TH_ACK) &&
2157 (SEQ_LEQ(th->th_ack, tp->iss) ||
2158 SEQ_GT(th->th_ack, tp->snd_max)))
2159 goto dropwithreset;
2160 break;
2161 }
2162
2163 /*
2164 * From here on, we're dealing with !LISTEN and !SYN_SENT.
2165 */
2166 KASSERT(tp->t_state != TCPS_LISTEN &&
2167 tp->t_state != TCPS_SYN_SENT);
2168
2169 /*
2170 * RFC1323 PAWS: if we have a timestamp reply on this segment and
2171 * it's less than ts_recent, drop it.
2172 */
2173 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2174 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2175 /* Check to see if ts_recent is over 24 days old. */
2176 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2177 /*
2178 * Invalidate ts_recent. If this segment updates
2179 * ts_recent, the age will be reset later and ts_recent
2180 * will get a valid value. If it does not, setting
2181 * ts_recent to zero will at least satisfy the
2182 * requirement that zero be placed in the timestamp
2183 * echo reply when ts_recent isn't valid. The
2184 * age isn't reset until we get a valid ts_recent
2185 * because we don't want out-of-order segments to be
2186 * dropped when ts_recent is old.
2187 */
2188 tp->ts_recent = 0;
2189 } else {
2190 tcps = TCP_STAT_GETREF();
2191 tcps[TCP_STAT_RCVDUPPACK]++;
2192 tcps[TCP_STAT_RCVDUPBYTE] += tlen;
2193 tcps[TCP_STAT_PAWSDROP]++;
2194 TCP_STAT_PUTREF();
2195 tcp_new_dsack(tp, th->th_seq, tlen);
2196 goto dropafterack;
2197 }
2198 }
2199
2200 /*
2201 * Check that at least some bytes of the segment are within the
2202 * receive window. If segment begins before rcv_nxt, drop leading
2203 * data (and SYN); if nothing left, just ack.
2204 */
2205 todrop = tp->rcv_nxt - th->th_seq;
2206 dupseg = false;
2207 if (todrop > 0) {
2208 if (tiflags & TH_SYN) {
2209 tiflags &= ~TH_SYN;
2210 th->th_seq++;
2211 tcp_urp_drop(th, 1, &tiflags);
2212 todrop--;
2213 }
2214 if (todrop > tlen ||
2215 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2216 /*
2217 * Any valid FIN or RST must be to the left of the
2218 * window. At this point the FIN or RST must be a
2219 * duplicate or out of sequence; drop it.
2220 */
2221 if (tiflags & TH_RST)
2222 goto drop;
2223 tiflags &= ~(TH_FIN|TH_RST);
2224
2225 /*
2226 * Send an ACK to resynchronize and drop any data.
2227 * But keep on processing for RST or ACK.
2228 */
2229 tp->t_flags |= TF_ACKNOW;
2230 todrop = tlen;
2231 dupseg = true;
2232 tcps = TCP_STAT_GETREF();
2233 tcps[TCP_STAT_RCVDUPPACK]++;
2234 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
2235 TCP_STAT_PUTREF();
2236 } else if ((tiflags & TH_RST) && th->th_seq != tp->rcv_nxt) {
2237 /*
2238 * Test for reset before adjusting the sequence
2239 * number for overlapping data.
2240 */
2241 goto dropafterack_ratelim;
2242 } else {
2243 tcps = TCP_STAT_GETREF();
2244 tcps[TCP_STAT_RCVPARTDUPPACK]++;
2245 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
2246 TCP_STAT_PUTREF();
2247 }
2248 tcp_new_dsack(tp, th->th_seq, todrop);
2249 hdroptlen += todrop; /* drop from head afterwards (m_adj) */
2250 th->th_seq += todrop;
2251 tlen -= todrop;
2252 tcp_urp_drop(th, todrop, &tiflags);
2253 }
2254
2255 /*
2256 * If new data is received on a connection after the user processes
2257 * are gone, then RST the other end.
2258 */
2259 if ((so->so_state & SS_NOFDREF) &&
2260 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2261 tp = tcp_close(tp);
2262 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2263 goto dropwithreset;
2264 }
2265
2266 /*
2267 * If the segment ends after the window, drop trailing data (and
2268 * PUSH and FIN); if nothing left, just ACK.
2269 */
2270 todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
2271 if (todrop > 0) {
2272 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2273 if (todrop >= tlen) {
2274 /*
2275 * The segment actually starts after the window.
2276 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2277 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2278 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2279 */
2280 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2281
2282 /*
2283 * If a new connection request is received while in
2284 * TIME_WAIT, drop the old connection and start over
2285 * if the sequence numbers are above the previous
2286 * ones.
2287 *
2288 * NOTE: We need to put the header fields back into
2289 * network order.
2290 */
2291 if ((tiflags & TH_SYN) &&
2292 tp->t_state == TCPS_TIME_WAIT &&
2293 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2294 tp = tcp_close(tp);
2295 tcp_fields_to_net(th);
2296 m_freem(tcp_saveti);
2297 tcp_saveti = NULL;
2298 goto findpcb;
2299 }
2300
2301 /*
2302 * If window is closed can only take segments at
2303 * window edge, and have to drop data and PUSH from
2304 * incoming segments. Continue processing, but
2305 * remember to ack. Otherwise, drop segment
2306 * and (if not RST) ack.
2307 */
2308 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2309 KASSERT(todrop == tlen);
2310 tp->t_flags |= TF_ACKNOW;
2311 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2312 } else {
2313 goto dropafterack;
2314 }
2315 } else {
2316 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2317 }
2318 m_adj(m, -todrop);
2319 tlen -= todrop;
2320 tiflags &= ~(TH_PUSH|TH_FIN);
2321 }
2322
2323 /*
2324 * If last ACK falls within this segment's sequence numbers,
2325 * record the timestamp.
2326 * NOTE:
2327 * 1) That the test incorporates suggestions from the latest
2328 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
2329 * 2) That updating only on newer timestamps interferes with
2330 * our earlier PAWS tests, so this check should be solely
2331 * predicated on the sequence space of this segment.
2332 * 3) That we modify the segment boundary check to be
2333 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2334 * instead of RFC1323's
2335 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2336 * This modified check allows us to overcome RFC1323's
2337 * limitations as described in Stevens TCP/IP Illustrated
2338 * Vol. 2 p.869. In such cases, we can still calculate the
2339 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2340 */
2341 if (opti.ts_present &&
2342 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2343 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2344 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2345 tp->ts_recent_age = tcp_now;
2346 tp->ts_recent = opti.ts_val;
2347 }
2348
2349 /*
2350 * If the RST bit is set examine the state:
2351 * RECEIVED state:
2352 * If passive open, return to LISTEN state.
2353 * If active open, inform user that connection was refused.
2354 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT states:
2355 * Inform user that connection was reset, and close tcb.
2356 * CLOSING, LAST_ACK, TIME_WAIT states:
2357 * Close the tcb.
2358 */
2359 if (tiflags & TH_RST) {
2360 if (th->th_seq != tp->rcv_nxt)
2361 goto dropafterack_ratelim;
2362
2363 switch (tp->t_state) {
2364 case TCPS_SYN_RECEIVED:
2365 so->so_error = ECONNREFUSED;
2366 goto close;
2367
2368 case TCPS_ESTABLISHED:
2369 case TCPS_FIN_WAIT_1:
2370 case TCPS_FIN_WAIT_2:
2371 case TCPS_CLOSE_WAIT:
2372 so->so_error = ECONNRESET;
2373 close:
2374 tp->t_state = TCPS_CLOSED;
2375 TCP_STATINC(TCP_STAT_DROPS);
2376 tp = tcp_close(tp);
2377 goto drop;
2378
2379 case TCPS_CLOSING:
2380 case TCPS_LAST_ACK:
2381 case TCPS_TIME_WAIT:
2382 tp = tcp_close(tp);
2383 goto drop;
2384 }
2385 }
2386
2387 /*
2388 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2389 * we must be in a synchronized state. RFC793 states (under Reset
2390 * Generation) that any unacceptable segment (an out-of-order SYN
2391 * qualifies) received in a synchronized state must elicit only an
2392 * empty acknowledgment segment ... and the connection remains in
2393 * the same state.
2394 */
2395 if (tiflags & TH_SYN) {
2396 if (tp->rcv_nxt == th->th_seq) {
2397 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2398 TH_ACK);
2399 if (tcp_saveti)
2400 m_freem(tcp_saveti);
2401 return;
2402 }
2403
2404 goto dropafterack_ratelim;
2405 }
2406
2407 /*
2408 * If the ACK bit is off we drop the segment and return.
2409 */
2410 if ((tiflags & TH_ACK) == 0) {
2411 if (tp->t_flags & TF_ACKNOW)
2412 goto dropafterack;
2413 goto drop;
2414 }
2415
2416 /*
2417 * From here on, we're doing ACK processing.
2418 */
2419
2420 switch (tp->t_state) {
2421 /*
2422 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2423 * ESTABLISHED state and continue processing, otherwise
2424 * send an RST.
2425 */
2426 case TCPS_SYN_RECEIVED:
2427 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2428 SEQ_GT(th->th_ack, tp->snd_max))
2429 goto dropwithreset;
2430 TCP_STATINC(TCP_STAT_CONNECTS);
2431 soisconnected(so);
2432 tcp_established(tp);
2433 /* Do window scaling? */
2434 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2435 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2436 tp->snd_scale = tp->requested_s_scale;
2437 tp->rcv_scale = tp->request_r_scale;
2438 }
2439 TCP_REASS_LOCK(tp);
2440 (void)tcp_reass(tp, NULL, NULL, tlen);
2441 tp->snd_wl1 = th->th_seq - 1;
2442 /* FALLTHROUGH */
2443
2444 /*
2445 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2446 * ACKs. If the ack is in the range
2447 * tp->snd_una < th->th_ack <= tp->snd_max
2448 * then advance tp->snd_una to th->th_ack and drop
2449 * data from the retransmission queue. If this ACK reflects
2450 * more up to date window information we update our window information.
2451 */
2452 case TCPS_ESTABLISHED:
2453 case TCPS_FIN_WAIT_1:
2454 case TCPS_FIN_WAIT_2:
2455 case TCPS_CLOSE_WAIT:
2456 case TCPS_CLOSING:
2457 case TCPS_LAST_ACK:
2458 case TCPS_TIME_WAIT:
2459 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2460 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2461 TCP_STATINC(TCP_STAT_RCVDUPACK);
2462 /*
2463 * If we have outstanding data (other than
2464 * a window probe), this is a completely
2465 * duplicate ack (ie, window info didn't
2466 * change), the ack is the biggest we've
2467 * seen and we've seen exactly our rexmt
2468 * threshold of them, assume a packet
2469 * has been dropped and retransmit it.
2470 * Kludge snd_nxt & the congestion
2471 * window so we send only this one
2472 * packet.
2473 */
2474 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2475 th->th_ack != tp->snd_una)
2476 tp->t_dupacks = 0;
2477 else if (tp->t_partialacks < 0 &&
2478 (++tp->t_dupacks == tcprexmtthresh ||
2479 TCP_FACK_FASTRECOV(tp))) {
2480 /*
2481 * Do the fast retransmit, and adjust
2482 * congestion control parameters.
2483 */
2484 if (tp->t_congctl->fast_retransmit(tp, th)) {
2485 /* False fast retransmit */
2486 break;
2487 }
2488 goto drop;
2489 } else if (tp->t_dupacks > tcprexmtthresh) {
2490 tp->snd_cwnd += tp->t_segsz;
2491 KERNEL_LOCK(1, NULL);
2492 (void)tcp_output(tp);
2493 KERNEL_UNLOCK_ONE(NULL);
2494 goto drop;
2495 }
2496 } else {
2497 /*
2498 * If the ack appears to be very old, only
2499 * allow data that is in-sequence. This
2500 * makes it somewhat more difficult to insert
2501 * forged data by guessing sequence numbers.
2502 * Sent an ack to try to update the send
2503 * sequence number on the other side.
2504 */
2505 if (tlen && th->th_seq != tp->rcv_nxt &&
2506 SEQ_LT(th->th_ack,
2507 tp->snd_una - tp->max_sndwnd))
2508 goto dropafterack;
2509 }
2510 break;
2511 }
2512 /*
2513 * If the congestion window was inflated to account
2514 * for the other side's cached packets, retract it.
2515 */
2516 tp->t_congctl->fast_retransmit_newack(tp, th);
2517
2518 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2519 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2520 goto dropafterack;
2521 }
2522 acked = th->th_ack - tp->snd_una;
2523 tcps = TCP_STAT_GETREF();
2524 tcps[TCP_STAT_RCVACKPACK]++;
2525 tcps[TCP_STAT_RCVACKBYTE] += acked;
2526 TCP_STAT_PUTREF();
2527
2528 /*
2529 * If we have a timestamp reply, update smoothed
2530 * round trip time. If no timestamp is present but
2531 * transmit timer is running and timed sequence
2532 * number was acked, update smoothed round trip time.
2533 * Since we now have an rtt measurement, cancel the
2534 * timer backoff (cf., Phil Karn's retransmit alg.).
2535 * Recompute the initial retransmit timer.
2536 */
2537 if (ts_rtt)
2538 tcp_xmit_timer(tp, ts_rtt - 1);
2539 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2540 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2541
2542 /*
2543 * If all outstanding data is acked, stop retransmit
2544 * timer and remember to restart (more output or persist).
2545 * If there is more data to be acked, restart retransmit
2546 * timer, using current (possibly backed-off) value.
2547 */
2548 if (th->th_ack == tp->snd_max) {
2549 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2550 needoutput = 1;
2551 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2552 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2553
2554 /*
2555 * New data has been acked, adjust the congestion window.
2556 */
2557 tp->t_congctl->newack(tp, th);
2558
2559 nd_hint(tp);
2560 if (acked > so->so_snd.sb_cc) {
2561 tp->snd_wnd -= so->so_snd.sb_cc;
2562 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2563 ourfinisacked = 1;
2564 } else {
2565 if (acked > (tp->t_lastoff - tp->t_inoff))
2566 tp->t_lastm = NULL;
2567 sbdrop(&so->so_snd, acked);
2568 tp->t_lastoff -= acked;
2569 if (tp->snd_wnd > acked)
2570 tp->snd_wnd -= acked;
2571 else
2572 tp->snd_wnd = 0;
2573 ourfinisacked = 0;
2574 }
2575 sowwakeup(so);
2576
2577 icmp_check(tp, th, acked);
2578
2579 tp->snd_una = th->th_ack;
2580 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2581 tp->snd_fack = tp->snd_una;
2582 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2583 tp->snd_nxt = tp->snd_una;
2584 if (SEQ_LT(tp->snd_high, tp->snd_una))
2585 tp->snd_high = tp->snd_una;
2586
2587 switch (tp->t_state) {
2588
2589 /*
2590 * In FIN_WAIT_1 STATE in addition to the processing
2591 * for the ESTABLISHED state if our FIN is now acknowledged
2592 * then enter FIN_WAIT_2.
2593 */
2594 case TCPS_FIN_WAIT_1:
2595 if (ourfinisacked) {
2596 /*
2597 * If we can't receive any more
2598 * data, then closing user can proceed.
2599 * Starting the timer is contrary to the
2600 * specification, but if we don't get a FIN
2601 * we'll hang forever.
2602 */
2603 if (so->so_state & SS_CANTRCVMORE) {
2604 soisdisconnected(so);
2605 if (tp->t_maxidle > 0)
2606 TCP_TIMER_ARM(tp, TCPT_2MSL,
2607 tp->t_maxidle);
2608 }
2609 tp->t_state = TCPS_FIN_WAIT_2;
2610 }
2611 break;
2612
2613 /*
2614 * In CLOSING STATE in addition to the processing for
2615 * the ESTABLISHED state if the ACK acknowledges our FIN
2616 * then enter the TIME-WAIT state, otherwise ignore
2617 * the segment.
2618 */
2619 case TCPS_CLOSING:
2620 if (ourfinisacked) {
2621 tp->t_state = TCPS_TIME_WAIT;
2622 tcp_canceltimers(tp);
2623 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2624 soisdisconnected(so);
2625 }
2626 break;
2627
2628 /*
2629 * In LAST_ACK, we may still be waiting for data to drain
2630 * and/or to be acked, as well as for the ack of our FIN.
2631 * If our FIN is now acknowledged, delete the TCB,
2632 * enter the closed state and return.
2633 */
2634 case TCPS_LAST_ACK:
2635 if (ourfinisacked) {
2636 tp = tcp_close(tp);
2637 goto drop;
2638 }
2639 break;
2640
2641 /*
2642 * In TIME_WAIT state the only thing that should arrive
2643 * is a retransmission of the remote FIN. Acknowledge
2644 * it and restart the finack timer.
2645 */
2646 case TCPS_TIME_WAIT:
2647 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2648 goto dropafterack;
2649 }
2650 }
2651
2652 step6:
2653 /*
2654 * Update window information.
2655 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2656 */
2657 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2658 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2659 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2660 /* keep track of pure window updates */
2661 if (tlen == 0 &&
2662 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2663 TCP_STATINC(TCP_STAT_RCVWINUPD);
2664 tp->snd_wnd = tiwin;
2665 tp->snd_wl1 = th->th_seq;
2666 tp->snd_wl2 = th->th_ack;
2667 if (tp->snd_wnd > tp->max_sndwnd)
2668 tp->max_sndwnd = tp->snd_wnd;
2669 needoutput = 1;
2670 }
2671
2672 /*
2673 * Process segments with URG.
2674 */
2675 if ((tiflags & TH_URG) && th->th_urp &&
2676 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2677 /*
2678 * This is a kludge, but if we receive and accept
2679 * random urgent pointers, we'll crash in
2680 * soreceive. It's hard to imagine someone
2681 * actually wanting to send this much urgent data.
2682 */
2683 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2684 th->th_urp = 0; /* XXX */
2685 tiflags &= ~TH_URG; /* XXX */
2686 goto dodata; /* XXX */
2687 }
2688
2689 /*
2690 * If this segment advances the known urgent pointer,
2691 * then mark the data stream. This should not happen
2692 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2693 * a FIN has been received from the remote side.
2694 * In these states we ignore the URG.
2695 *
2696 * According to RFC961 (Assigned Protocols),
2697 * the urgent pointer points to the last octet
2698 * of urgent data. We continue, however,
2699 * to consider it to indicate the first octet
2700 * of data past the urgent section as the original
2701 * spec states (in one of two places).
2702 */
2703 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2704 tp->rcv_up = th->th_seq + th->th_urp;
2705 so->so_oobmark = so->so_rcv.sb_cc +
2706 (tp->rcv_up - tp->rcv_nxt) - 1;
2707 if (so->so_oobmark == 0)
2708 so->so_state |= SS_RCVATMARK;
2709 sohasoutofband(so);
2710 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2711 }
2712
2713 /*
2714 * Remove out of band data so doesn't get presented to user.
2715 * This can happen independent of advancing the URG pointer,
2716 * but if two URG's are pending at once, some out-of-band
2717 * data may creep in... ick.
2718 */
2719 if (th->th_urp <= (u_int16_t)tlen &&
2720 (so->so_options & SO_OOBINLINE) == 0)
2721 tcp_pulloutofband(so, th, m, hdroptlen);
2722 } else {
2723 /*
2724 * If no out of band data is expected,
2725 * pull receive urgent pointer along
2726 * with the receive window.
2727 */
2728 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2729 tp->rcv_up = tp->rcv_nxt;
2730 }
2731 dodata:
2732
2733 /*
2734 * Process the segment text, merging it into the TCP sequencing queue,
2735 * and arranging for acknowledgement of receipt if necessary.
2736 * This process logically involves adjusting tp->rcv_wnd as data
2737 * is presented to the user (this happens in tcp_usrreq.c,
2738 * tcp_rcvd()). If a FIN has already been received on this
2739 * connection then we just ignore the text.
2740 */
2741 if ((tlen || (tiflags & TH_FIN)) &&
2742 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2743 /*
2744 * Handle the common case:
2745 * o Segment is the next to be received, and
2746 * o The queue is empty, and
2747 * o The connection is established
2748 * In this case, we avoid calling tcp_reass.
2749 *
2750 * tcp_setup_ack: set DELACK for segments received in order,
2751 * but ack immediately when segments are out of order (so that
2752 * fast retransmit can work).
2753 */
2754 TCP_REASS_LOCK(tp);
2755 if (th->th_seq == tp->rcv_nxt &&
2756 TAILQ_FIRST(&tp->segq) == NULL &&
2757 tp->t_state == TCPS_ESTABLISHED) {
2758 tcp_setup_ack(tp, th);
2759 tp->rcv_nxt += tlen;
2760 tiflags = th->th_flags & TH_FIN;
2761 tcps = TCP_STAT_GETREF();
2762 tcps[TCP_STAT_RCVPACK]++;
2763 tcps[TCP_STAT_RCVBYTE] += tlen;
2764 TCP_STAT_PUTREF();
2765 nd_hint(tp);
2766 if (so->so_state & SS_CANTRCVMORE) {
2767 m_freem(m);
2768 } else {
2769 m_adj(m, hdroptlen);
2770 sbappendstream(&(so)->so_rcv, m);
2771 }
2772 TCP_REASS_UNLOCK(tp);
2773 sorwakeup(so);
2774 } else {
2775 m_adj(m, hdroptlen);
2776 tiflags = tcp_reass(tp, th, m, tlen);
2777 tp->t_flags |= TF_ACKNOW;
2778 }
2779
2780 /*
2781 * Note the amount of data that peer has sent into
2782 * our window, in order to estimate the sender's
2783 * buffer size.
2784 */
2785 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2786 } else {
2787 m_freem(m);
2788 m = NULL;
2789 tiflags &= ~TH_FIN;
2790 }
2791
2792 /*
2793 * If FIN is received ACK the FIN and let the user know
2794 * that the connection is closing. Ignore a FIN received before
2795 * the connection is fully established.
2796 */
2797 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2798 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2799 socantrcvmore(so);
2800 tp->t_flags |= TF_ACKNOW;
2801 tp->rcv_nxt++;
2802 }
2803 switch (tp->t_state) {
2804
2805 /*
2806 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2807 */
2808 case TCPS_ESTABLISHED:
2809 tp->t_state = TCPS_CLOSE_WAIT;
2810 break;
2811
2812 /*
2813 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2814 * enter the CLOSING state.
2815 */
2816 case TCPS_FIN_WAIT_1:
2817 tp->t_state = TCPS_CLOSING;
2818 break;
2819
2820 /*
2821 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2822 * starting the time-wait timer, turning off the other
2823 * standard timers.
2824 */
2825 case TCPS_FIN_WAIT_2:
2826 tp->t_state = TCPS_TIME_WAIT;
2827 tcp_canceltimers(tp);
2828 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2829 soisdisconnected(so);
2830 break;
2831
2832 /*
2833 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2834 */
2835 case TCPS_TIME_WAIT:
2836 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2837 break;
2838 }
2839 }
2840 #ifdef TCP_DEBUG
2841 if (so->so_options & SO_DEBUG)
2842 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2843 #endif
2844
2845 /*
2846 * Return any desired output.
2847 */
2848 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
2849 KERNEL_LOCK(1, NULL);
2850 (void)tcp_output(tp);
2851 KERNEL_UNLOCK_ONE(NULL);
2852 }
2853 if (tcp_saveti)
2854 m_freem(tcp_saveti);
2855
2856 if (tp->t_state == TCPS_TIME_WAIT
2857 && (so->so_state & SS_NOFDREF)
2858 && (tp->t_inpcb || af != AF_INET || af != AF_INET6)
2859 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0
2860 && TAILQ_EMPTY(&tp->segq)
2861 && vtw_add(af, tp)) {
2862 ;
2863 }
2864 return;
2865
2866 badsyn:
2867 /*
2868 * Received a bad SYN. Increment counters and dropwithreset.
2869 */
2870 TCP_STATINC(TCP_STAT_BADSYN);
2871 tp = NULL;
2872 goto dropwithreset;
2873
2874 dropafterack:
2875 /*
2876 * Generate an ACK dropping incoming segment if it occupies
2877 * sequence space, where the ACK reflects our state.
2878 */
2879 if (tiflags & TH_RST)
2880 goto drop;
2881 goto dropafterack2;
2882
2883 dropafterack_ratelim:
2884 /*
2885 * We may want to rate-limit ACKs against SYN/RST attack.
2886 */
2887 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
2888 tcp_ackdrop_ppslim) == 0) {
2889 /* XXX stat */
2890 goto drop;
2891 }
2892
2893 dropafterack2:
2894 m_freem(m);
2895 tp->t_flags |= TF_ACKNOW;
2896 KERNEL_LOCK(1, NULL);
2897 (void)tcp_output(tp);
2898 KERNEL_UNLOCK_ONE(NULL);
2899 if (tcp_saveti)
2900 m_freem(tcp_saveti);
2901 return;
2902
2903 dropwithreset_ratelim:
2904 /*
2905 * We may want to rate-limit RSTs in certain situations,
2906 * particularly if we are sending an RST in response to
2907 * an attempt to connect to or otherwise communicate with
2908 * a port for which we have no socket.
2909 */
2910 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2911 tcp_rst_ppslim) == 0) {
2912 /* XXX stat */
2913 goto drop;
2914 }
2915
2916 dropwithreset:
2917 /*
2918 * Generate a RST, dropping incoming segment.
2919 * Make ACK acceptable to originator of segment.
2920 */
2921 if (tiflags & TH_RST)
2922 goto drop;
2923 if (tiflags & TH_ACK) {
2924 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
2925 } else {
2926 if (tiflags & TH_SYN)
2927 tlen++;
2928 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
2929 TH_RST|TH_ACK);
2930 }
2931 if (tcp_saveti)
2932 m_freem(tcp_saveti);
2933 return;
2934
2935 badcsum:
2936 drop:
2937 /*
2938 * Drop space held by incoming segment and return.
2939 */
2940 if (tp) {
2941 so = tp->t_inpcb->inp_socket;
2942 #ifdef TCP_DEBUG
2943 if (so && (so->so_options & SO_DEBUG) != 0)
2944 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
2945 #endif
2946 }
2947 if (tcp_saveti)
2948 m_freem(tcp_saveti);
2949 m_freem(m);
2950 return;
2951 }
2952
2953 #ifdef TCP_SIGNATURE
2954 int
2955 tcp_signature_apply(void *fstate, void *data, u_int len)
2956 {
2957
2958 MD5Update(fstate, (u_char *)data, len);
2959 return (0);
2960 }
2961
2962 struct secasvar *
2963 tcp_signature_getsav(struct mbuf *m)
2964 {
2965 struct ip *ip;
2966 struct ip6_hdr *ip6;
2967
2968 ip = mtod(m, struct ip *);
2969 switch (ip->ip_v) {
2970 case 4:
2971 ip = mtod(m, struct ip *);
2972 ip6 = NULL;
2973 break;
2974 case 6:
2975 ip = NULL;
2976 ip6 = mtod(m, struct ip6_hdr *);
2977 break;
2978 default:
2979 return (NULL);
2980 }
2981
2982 #ifdef IPSEC
2983 union sockaddr_union dst;
2984
2985 /* Extract the destination from the IP header in the mbuf. */
2986 memset(&dst, 0, sizeof(union sockaddr_union));
2987 if (ip != NULL) {
2988 dst.sa.sa_len = sizeof(struct sockaddr_in);
2989 dst.sa.sa_family = AF_INET;
2990 dst.sin.sin_addr = ip->ip_dst;
2991 } else {
2992 dst.sa.sa_len = sizeof(struct sockaddr_in6);
2993 dst.sa.sa_family = AF_INET6;
2994 dst.sin6.sin6_addr = ip6->ip6_dst;
2995 }
2996
2997 /*
2998 * Look up an SADB entry which matches the address of the peer.
2999 */
3000 return KEY_LOOKUP_SA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0);
3001 #else
3002 return NULL;
3003 #endif
3004 }
3005
3006 int
3007 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
3008 struct secasvar *sav, char *sig)
3009 {
3010 MD5_CTX ctx;
3011 struct ip *ip;
3012 struct ipovly *ipovly;
3013 #ifdef INET6
3014 struct ip6_hdr *ip6;
3015 struct ip6_hdr_pseudo ip6pseudo;
3016 #endif
3017 struct ippseudo ippseudo;
3018 struct tcphdr th0;
3019 int l, tcphdrlen;
3020
3021 if (sav == NULL)
3022 return (-1);
3023
3024 tcphdrlen = th->th_off * 4;
3025
3026 switch (mtod(m, struct ip *)->ip_v) {
3027 case 4:
3028 MD5Init(&ctx);
3029 ip = mtod(m, struct ip *);
3030 memset(&ippseudo, 0, sizeof(ippseudo));
3031 ipovly = (struct ipovly *)ip;
3032 ippseudo.ippseudo_src = ipovly->ih_src;
3033 ippseudo.ippseudo_dst = ipovly->ih_dst;
3034 ippseudo.ippseudo_pad = 0;
3035 ippseudo.ippseudo_p = IPPROTO_TCP;
3036 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
3037 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
3038 break;
3039 #if INET6
3040 case 6:
3041 MD5Init(&ctx);
3042 ip6 = mtod(m, struct ip6_hdr *);
3043 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
3044 ip6pseudo.ip6ph_src = ip6->ip6_src;
3045 in6_clearscope(&ip6pseudo.ip6ph_src);
3046 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
3047 in6_clearscope(&ip6pseudo.ip6ph_dst);
3048 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
3049 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
3050 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
3051 break;
3052 #endif
3053 default:
3054 return (-1);
3055 }
3056
3057 th0 = *th;
3058 th0.th_sum = 0;
3059 MD5Update(&ctx, (char *)&th0, sizeof(th0));
3060
3061 l = m->m_pkthdr.len - thoff - tcphdrlen;
3062 if (l > 0)
3063 m_apply(m, thoff + tcphdrlen,
3064 m->m_pkthdr.len - thoff - tcphdrlen,
3065 tcp_signature_apply, &ctx);
3066
3067 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
3068 MD5Final(sig, &ctx);
3069
3070 return (0);
3071 }
3072 #endif
3073
3074 /*
3075 * Parse and process tcp options.
3076 *
3077 * Returns -1 if this segment should be dropped. (eg. wrong signature)
3078 * Otherwise returns 0.
3079 */
3080 int
3081 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt, struct tcphdr *th,
3082 struct mbuf *m, int toff, struct tcp_opt_info *oi)
3083 {
3084 u_int16_t mss;
3085 int opt, optlen = 0;
3086 #ifdef TCP_SIGNATURE
3087 void *sigp = NULL;
3088 char sigbuf[TCP_SIGLEN];
3089 struct secasvar *sav = NULL;
3090 #endif
3091
3092 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
3093 opt = cp[0];
3094 if (opt == TCPOPT_EOL)
3095 break;
3096 if (opt == TCPOPT_NOP)
3097 optlen = 1;
3098 else {
3099 if (cnt < 2)
3100 break;
3101 optlen = cp[1];
3102 if (optlen < 2 || optlen > cnt)
3103 break;
3104 }
3105 switch (opt) {
3106
3107 default:
3108 continue;
3109
3110 case TCPOPT_MAXSEG:
3111 if (optlen != TCPOLEN_MAXSEG)
3112 continue;
3113 if (!(th->th_flags & TH_SYN))
3114 continue;
3115 if (TCPS_HAVERCVDSYN(tp->t_state))
3116 continue;
3117 memcpy(&mss, cp + 2, sizeof(mss));
3118 oi->maxseg = ntohs(mss);
3119 break;
3120
3121 case TCPOPT_WINDOW:
3122 if (optlen != TCPOLEN_WINDOW)
3123 continue;
3124 if (!(th->th_flags & TH_SYN))
3125 continue;
3126 if (TCPS_HAVERCVDSYN(tp->t_state))
3127 continue;
3128 tp->t_flags |= TF_RCVD_SCALE;
3129 tp->requested_s_scale = cp[2];
3130 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3131 char buf[INET6_ADDRSTRLEN];
3132 struct ip *ip = mtod(m, struct ip *);
3133 #ifdef INET6
3134 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
3135 #endif
3136
3137 switch (ip->ip_v) {
3138 case 4:
3139 in_print(buf, sizeof(buf),
3140 &ip->ip_src);
3141 break;
3142 #ifdef INET6
3143 case 6:
3144 in6_print(buf, sizeof(buf),
3145 &ip6->ip6_src);
3146 break;
3147 #endif
3148 default:
3149 strlcpy(buf, "(unknown)", sizeof(buf));
3150 break;
3151 }
3152
3153 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3154 "assuming %d\n",
3155 tp->requested_s_scale, buf,
3156 TCP_MAX_WINSHIFT);
3157 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3158 }
3159 break;
3160
3161 case TCPOPT_TIMESTAMP:
3162 if (optlen != TCPOLEN_TIMESTAMP)
3163 continue;
3164 oi->ts_present = 1;
3165 memcpy(&oi->ts_val, cp + 2, sizeof(oi->ts_val));
3166 NTOHL(oi->ts_val);
3167 memcpy(&oi->ts_ecr, cp + 6, sizeof(oi->ts_ecr));
3168 NTOHL(oi->ts_ecr);
3169
3170 if (!(th->th_flags & TH_SYN))
3171 continue;
3172 if (TCPS_HAVERCVDSYN(tp->t_state))
3173 continue;
3174 /*
3175 * A timestamp received in a SYN makes
3176 * it ok to send timestamp requests and replies.
3177 */
3178 tp->t_flags |= TF_RCVD_TSTMP;
3179 tp->ts_recent = oi->ts_val;
3180 tp->ts_recent_age = tcp_now;
3181 break;
3182
3183 case TCPOPT_SACK_PERMITTED:
3184 if (optlen != TCPOLEN_SACK_PERMITTED)
3185 continue;
3186 if (!(th->th_flags & TH_SYN))
3187 continue;
3188 if (TCPS_HAVERCVDSYN(tp->t_state))
3189 continue;
3190 if (tcp_do_sack) {
3191 tp->t_flags |= TF_SACK_PERMIT;
3192 tp->t_flags |= TF_WILL_SACK;
3193 }
3194 break;
3195
3196 case TCPOPT_SACK:
3197 tcp_sack_option(tp, th, cp, optlen);
3198 break;
3199 #ifdef TCP_SIGNATURE
3200 case TCPOPT_SIGNATURE:
3201 if (optlen != TCPOLEN_SIGNATURE)
3202 continue;
3203 if (sigp &&
3204 !consttime_memequal(sigp, cp + 2, TCP_SIGLEN))
3205 return (-1);
3206
3207 sigp = sigbuf;
3208 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3209 tp->t_flags |= TF_SIGNATURE;
3210 break;
3211 #endif
3212 }
3213 }
3214
3215 #ifndef TCP_SIGNATURE
3216 return 0;
3217 #else
3218 if (tp->t_flags & TF_SIGNATURE) {
3219 sav = tcp_signature_getsav(m);
3220 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3221 return (-1);
3222 }
3223
3224 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE))
3225 goto out;
3226
3227 if (sigp) {
3228 char sig[TCP_SIGLEN];
3229
3230 tcp_fields_to_net(th);
3231 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3232 tcp_fields_to_host(th);
3233 goto out;
3234 }
3235 tcp_fields_to_host(th);
3236
3237 if (!consttime_memequal(sig, sigp, TCP_SIGLEN)) {
3238 TCP_STATINC(TCP_STAT_BADSIG);
3239 goto out;
3240 } else
3241 TCP_STATINC(TCP_STAT_GOODSIG);
3242
3243 key_sa_recordxfer(sav, m);
3244 KEY_SA_UNREF(&sav);
3245 }
3246 return 0;
3247 out:
3248 if (sav != NULL)
3249 KEY_SA_UNREF(&sav);
3250 return -1;
3251 #endif
3252 }
3253
3254 /*
3255 * Pull out of band byte out of a segment so
3256 * it doesn't appear in the user's data queue.
3257 * It is still reflected in the segment length for
3258 * sequencing purposes.
3259 */
3260 void
3261 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3262 struct mbuf *m, int off)
3263 {
3264 int cnt = off + th->th_urp - 1;
3265
3266 while (cnt >= 0) {
3267 if (m->m_len > cnt) {
3268 char *cp = mtod(m, char *) + cnt;
3269 struct tcpcb *tp = sototcpcb(so);
3270
3271 tp->t_iobc = *cp;
3272 tp->t_oobflags |= TCPOOB_HAVEDATA;
3273 memmove(cp, cp + 1, (unsigned)(m->m_len - cnt - 1));
3274 m->m_len--;
3275 return;
3276 }
3277 cnt -= m->m_len;
3278 m = m->m_next;
3279 if (m == NULL)
3280 break;
3281 }
3282 panic("tcp_pulloutofband");
3283 }
3284
3285 /*
3286 * Collect new round-trip time estimate
3287 * and update averages and current timeout.
3288 *
3289 * rtt is in units of slow ticks (typically 500 ms) -- essentially the
3290 * difference of two timestamps.
3291 */
3292 void
3293 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3294 {
3295 int32_t delta;
3296
3297 TCP_STATINC(TCP_STAT_RTTUPDATED);
3298 if (tp->t_srtt != 0) {
3299 /*
3300 * Compute the amount to add to srtt for smoothing,
3301 * *alpha, or 2^(-TCP_RTT_SHIFT). Because
3302 * srtt is stored in 1/32 slow ticks, we conceptually
3303 * shift left 5 bits, subtract srtt to get the
3304 * difference, and then shift right by TCP_RTT_SHIFT
3305 * (3) to obtain 1/8 of the difference.
3306 */
3307 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3308 /*
3309 * This can never happen, because delta's lowest
3310 * possible value is 1/8 of t_srtt. But if it does,
3311 * set srtt to some reasonable value, here chosen
3312 * as 1/8 tick.
3313 */
3314 if ((tp->t_srtt += delta) <= 0)
3315 tp->t_srtt = 1 << 2;
3316 /*
3317 * RFC2988 requires that rttvar be updated first.
3318 * This code is compliant because "delta" is the old
3319 * srtt minus the new observation (scaled).
3320 *
3321 * RFC2988 says:
3322 * rttvar = (1-beta) * rttvar + beta * |srtt-observed|
3323 *
3324 * delta is in units of 1/32 ticks, and has then been
3325 * divided by 8. This is equivalent to being in 1/16s
3326 * units and divided by 4. Subtract from it 1/4 of
3327 * the existing rttvar to form the (signed) amount to
3328 * adjust.
3329 */
3330 if (delta < 0)
3331 delta = -delta;
3332 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3333 /*
3334 * As with srtt, this should never happen. There is
3335 * no support in RFC2988 for this operation. But 1/4s
3336 * as rttvar when faced with something arguably wrong
3337 * is ok.
3338 */
3339 if ((tp->t_rttvar += delta) <= 0)
3340 tp->t_rttvar = 1 << 2;
3341
3342 /*
3343 * If srtt exceeds .01 second, ensure we use the 'remote' MSL
3344 * Problem is: it doesn't work. Disabled by defaulting
3345 * tcp_rttlocal to 0; see corresponding code in
3346 * tcp_subr that selects local vs remote in a different way.
3347 *
3348 * The static branch prediction hint here should be removed
3349 * when the rtt estimator is fixed and the rtt_enable code
3350 * is turned back on.
3351 */
3352 if (__predict_false(tcp_rttlocal) && tcp_msl_enable
3353 && tp->t_srtt > tcp_msl_remote_threshold
3354 && tp->t_msl < tcp_msl_remote) {
3355 tp->t_msl = MIN(tcp_msl_remote, TCP_MAXMSL);
3356 }
3357 } else {
3358 /*
3359 * This is the first measurement. Per RFC2988, 2.2,
3360 * set rtt=R and srtt=R/2.
3361 * For srtt, storage representation is 1/32 ticks,
3362 * so shift left by 5.
3363 * For rttvar, storage representation is 1/16 ticks,
3364 * So shift left by 4, but then right by 1 to halve.
3365 */
3366 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3367 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3368 }
3369 tp->t_rtttime = 0;
3370 tp->t_rxtshift = 0;
3371
3372 /*
3373 * the retransmit should happen at rtt + 4 * rttvar.
3374 * Because of the way we do the smoothing, srtt and rttvar
3375 * will each average +1/2 tick of bias. When we compute
3376 * the retransmit timer, we want 1/2 tick of rounding and
3377 * 1 extra tick because of +-1/2 tick uncertainty in the
3378 * firing of the timer. The bias will give us exactly the
3379 * 1.5 tick we need. But, because the bias is
3380 * statistical, we have to test that we don't drop below
3381 * the minimum feasible timer (which is 2 ticks).
3382 */
3383 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3384 uimax(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3385
3386 /*
3387 * We received an ack for a packet that wasn't retransmitted;
3388 * it is probably safe to discard any error indications we've
3389 * received recently. This isn't quite right, but close enough
3390 * for now (a route might have failed after we sent a segment,
3391 * and the return path might not be symmetrical).
3392 */
3393 tp->t_softerror = 0;
3394 }
Cache object: fb3bd1fd9c25e5789f3bb50f6c7dd471
|