1 /* $NetBSD: tcp_input.c,v 1.291.4.5 2010/06/11 23:36:07 riz Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006 The NetBSD Foundation, Inc.
74 * All rights reserved.
75 *
76 * This code is derived from software contributed to The NetBSD Foundation
77 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
78 * Facility, NASA Ames Research Center.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Charles M. Hannum.
81 * This code is derived from software contributed to The NetBSD Foundation
82 * by Rui Paulo.
83 *
84 * Redistribution and use in source and binary forms, with or without
85 * modification, are permitted provided that the following conditions
86 * are met:
87 * 1. Redistributions of source code must retain the above copyright
88 * notice, this list of conditions and the following disclaimer.
89 * 2. Redistributions in binary form must reproduce the above copyright
90 * notice, this list of conditions and the following disclaimer in the
91 * documentation and/or other materials provided with the distribution.
92 *
93 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
94 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
95 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
96 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
97 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
98 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
99 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
100 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
101 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
103 * POSSIBILITY OF SUCH DAMAGE.
104 */
105
106 /*
107 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
108 * The Regents of the University of California. All rights reserved.
109 *
110 * Redistribution and use in source and binary forms, with or without
111 * modification, are permitted provided that the following conditions
112 * are met:
113 * 1. Redistributions of source code must retain the above copyright
114 * notice, this list of conditions and the following disclaimer.
115 * 2. Redistributions in binary form must reproduce the above copyright
116 * notice, this list of conditions and the following disclaimer in the
117 * documentation and/or other materials provided with the distribution.
118 * 3. Neither the name of the University nor the names of its contributors
119 * may be used to endorse or promote products derived from this software
120 * without specific prior written permission.
121 *
122 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
123 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
124 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
125 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
126 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
127 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
128 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
129 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
130 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
131 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
132 * SUCH DAMAGE.
133 *
134 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
135 */
136
137 /*
138 * TODO list for SYN cache stuff:
139 *
140 * Find room for a "state" field, which is needed to keep a
141 * compressed state for TIME_WAIT TCBs. It's been noted already
142 * that this is fairly important for very high-volume web and
143 * mail servers, which use a large number of short-lived
144 * connections.
145 */
146
147 #include <sys/cdefs.h>
148 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.291.4.5 2010/06/11 23:36:07 riz Exp $");
149
150 #include "opt_inet.h"
151 #include "opt_ipsec.h"
152 #include "opt_inet_csum.h"
153 #include "opt_tcp_debug.h"
154
155 #include <sys/param.h>
156 #include <sys/systm.h>
157 #include <sys/malloc.h>
158 #include <sys/mbuf.h>
159 #include <sys/protosw.h>
160 #include <sys/socket.h>
161 #include <sys/socketvar.h>
162 #include <sys/errno.h>
163 #include <sys/syslog.h>
164 #include <sys/pool.h>
165 #include <sys/domain.h>
166 #include <sys/kernel.h>
167 #ifdef TCP_SIGNATURE
168 #include <sys/md5.h>
169 #endif
170 #include <sys/lwp.h> /* for lwp0 */
171
172 #include <net/if.h>
173 #include <net/route.h>
174 #include <net/if_types.h>
175
176 #include <netinet/in.h>
177 #include <netinet/in_systm.h>
178 #include <netinet/ip.h>
179 #include <netinet/in_pcb.h>
180 #include <netinet/in_var.h>
181 #include <netinet/ip_var.h>
182 #include <netinet/in_offload.h>
183
184 #ifdef INET6
185 #ifndef INET
186 #include <netinet/in.h>
187 #endif
188 #include <netinet/ip6.h>
189 #include <netinet6/ip6_var.h>
190 #include <netinet6/in6_pcb.h>
191 #include <netinet6/ip6_var.h>
192 #include <netinet6/in6_var.h>
193 #include <netinet/icmp6.h>
194 #include <netinet6/nd6.h>
195 #ifdef TCP_SIGNATURE
196 #include <netinet6/scope6_var.h>
197 #endif
198 #endif
199
200 #ifndef INET6
201 /* always need ip6.h for IP6_EXTHDR_GET */
202 #include <netinet/ip6.h>
203 #endif
204
205 #include <netinet/tcp.h>
206 #include <netinet/tcp_fsm.h>
207 #include <netinet/tcp_seq.h>
208 #include <netinet/tcp_timer.h>
209 #include <netinet/tcp_var.h>
210 #include <netinet/tcp_private.h>
211 #include <netinet/tcpip.h>
212 #include <netinet/tcp_congctl.h>
213 #include <netinet/tcp_debug.h>
214
215 #include <machine/stdarg.h>
216
217 #ifdef IPSEC
218 #include <netinet6/ipsec.h>
219 #include <netinet6/ipsec_private.h>
220 #include <netkey/key.h>
221 #endif /*IPSEC*/
222 #ifdef INET6
223 #include "faith.h"
224 #if defined(NFAITH) && NFAITH > 0
225 #include <net/if_faith.h>
226 #endif
227 #endif /* IPSEC */
228
229 #ifdef FAST_IPSEC
230 #include <netipsec/ipsec.h>
231 #include <netipsec/ipsec_var.h>
232 #include <netipsec/ipsec_private.h>
233 #include <netipsec/key.h>
234 #ifdef INET6
235 #include <netipsec/ipsec6.h>
236 #endif
237 #endif /* FAST_IPSEC*/
238
239 int tcprexmtthresh = 3;
240 int tcp_log_refused;
241
242 int tcp_do_autorcvbuf = 0;
243 int tcp_autorcvbuf_inc = 16 * 1024;
244 int tcp_autorcvbuf_max = 256 * 1024;
245 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
246
247 static int tcp_rst_ppslim_count = 0;
248 static struct timeval tcp_rst_ppslim_last;
249 static int tcp_ackdrop_ppslim_count = 0;
250 static struct timeval tcp_ackdrop_ppslim_last;
251
252 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
253
254 /* for modulo comparisons of timestamps */
255 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
256 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
257
258 /*
259 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
260 */
261 #ifdef INET6
262 static inline void
263 nd6_hint(struct tcpcb *tp)
264 {
265 struct rtentry *rt;
266
267 if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
268 (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
269 nd6_nud_hint(rt, NULL, 0);
270 }
271 #else
272 static inline void
273 nd6_hint(struct tcpcb *tp)
274 {
275 }
276 #endif
277
278 /*
279 * Compute ACK transmission behavior. Delay the ACK unless
280 * we have already delayed an ACK (must send an ACK every two segments).
281 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
282 * option is enabled.
283 */
284 static void
285 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
286 {
287
288 if (tp->t_flags & TF_DELACK ||
289 (tcp_ack_on_push && th->th_flags & TH_PUSH))
290 tp->t_flags |= TF_ACKNOW;
291 else
292 TCP_SET_DELACK(tp);
293 }
294
295 static void
296 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
297 {
298
299 /*
300 * If we had a pending ICMP message that refers to data that have
301 * just been acknowledged, disregard the recorded ICMP message.
302 */
303 if ((tp->t_flags & TF_PMTUD_PEND) &&
304 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
305 tp->t_flags &= ~TF_PMTUD_PEND;
306
307 /*
308 * Keep track of the largest chunk of data
309 * acknowledged since last PMTU update
310 */
311 if (tp->t_pmtud_mss_acked < acked)
312 tp->t_pmtud_mss_acked = acked;
313 }
314
315 /*
316 * Convert TCP protocol fields to host order for easier processing.
317 */
318 static void
319 tcp_fields_to_host(struct tcphdr *th)
320 {
321
322 NTOHL(th->th_seq);
323 NTOHL(th->th_ack);
324 NTOHS(th->th_win);
325 NTOHS(th->th_urp);
326 }
327
328 /*
329 * ... and reverse the above.
330 */
331 static void
332 tcp_fields_to_net(struct tcphdr *th)
333 {
334
335 HTONL(th->th_seq);
336 HTONL(th->th_ack);
337 HTONS(th->th_win);
338 HTONS(th->th_urp);
339 }
340
341 #ifdef TCP_CSUM_COUNTERS
342 #include <sys/device.h>
343
344 #if defined(INET)
345 extern struct evcnt tcp_hwcsum_ok;
346 extern struct evcnt tcp_hwcsum_bad;
347 extern struct evcnt tcp_hwcsum_data;
348 extern struct evcnt tcp_swcsum;
349 #endif /* defined(INET) */
350 #if defined(INET6)
351 extern struct evcnt tcp6_hwcsum_ok;
352 extern struct evcnt tcp6_hwcsum_bad;
353 extern struct evcnt tcp6_hwcsum_data;
354 extern struct evcnt tcp6_swcsum;
355 #endif /* defined(INET6) */
356
357 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
358
359 #else
360
361 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
362
363 #endif /* TCP_CSUM_COUNTERS */
364
365 #ifdef TCP_REASS_COUNTERS
366 #include <sys/device.h>
367
368 extern struct evcnt tcp_reass_;
369 extern struct evcnt tcp_reass_empty;
370 extern struct evcnt tcp_reass_iteration[8];
371 extern struct evcnt tcp_reass_prependfirst;
372 extern struct evcnt tcp_reass_prepend;
373 extern struct evcnt tcp_reass_insert;
374 extern struct evcnt tcp_reass_inserttail;
375 extern struct evcnt tcp_reass_append;
376 extern struct evcnt tcp_reass_appendtail;
377 extern struct evcnt tcp_reass_overlaptail;
378 extern struct evcnt tcp_reass_overlapfront;
379 extern struct evcnt tcp_reass_segdup;
380 extern struct evcnt tcp_reass_fragdup;
381
382 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
383
384 #else
385
386 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
387
388 #endif /* TCP_REASS_COUNTERS */
389
390 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
391 int *);
392 static int tcp_dooptions(struct tcpcb *, const u_char *, int,
393 struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *);
394
395 #ifdef INET
396 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
397 #endif
398 #ifdef INET6
399 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
400 #endif
401
402 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next
403
404 #if defined(MBUFTRACE)
405 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
406 #endif /* defined(MBUFTRACE) */
407
408 static POOL_INIT(tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
409 NULL, IPL_VM);
410
411 struct ipqent *
412 tcpipqent_alloc(void)
413 {
414 struct ipqent *ipqe;
415 int s;
416
417 s = splvm();
418 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
419 splx(s);
420
421 return ipqe;
422 }
423
424 void
425 tcpipqent_free(struct ipqent *ipqe)
426 {
427 int s;
428
429 s = splvm();
430 pool_put(&tcpipqent_pool, ipqe);
431 splx(s);
432 }
433
434 static int
435 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen)
436 {
437 struct ipqent *p, *q, *nq, *tiqe = NULL;
438 struct socket *so = NULL;
439 int pkt_flags;
440 tcp_seq pkt_seq;
441 unsigned pkt_len;
442 u_long rcvpartdupbyte = 0;
443 u_long rcvoobyte;
444 #ifdef TCP_REASS_COUNTERS
445 u_int count = 0;
446 #endif
447 uint64_t *tcps;
448
449 if (tp->t_inpcb)
450 so = tp->t_inpcb->inp_socket;
451 #ifdef INET6
452 else if (tp->t_in6pcb)
453 so = tp->t_in6pcb->in6p_socket;
454 #endif
455
456 TCP_REASS_LOCK_CHECK(tp);
457
458 /*
459 * Call with th==0 after become established to
460 * force pre-ESTABLISHED data up to user socket.
461 */
462 if (th == 0)
463 goto present;
464
465 m_claimm(m, &tcp_reass_mowner);
466
467 rcvoobyte = *tlen;
468 /*
469 * Copy these to local variables because the tcpiphdr
470 * gets munged while we are collapsing mbufs.
471 */
472 pkt_seq = th->th_seq;
473 pkt_len = *tlen;
474 pkt_flags = th->th_flags;
475
476 TCP_REASS_COUNTER_INCR(&tcp_reass_);
477
478 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
479 /*
480 * When we miss a packet, the vast majority of time we get
481 * packets that follow it in order. So optimize for that.
482 */
483 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
484 p->ipqe_len += pkt_len;
485 p->ipqe_flags |= pkt_flags;
486 m_cat(p->ipre_mlast, m);
487 TRAVERSE(p->ipre_mlast);
488 m = NULL;
489 tiqe = p;
490 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
491 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
492 goto skip_replacement;
493 }
494 /*
495 * While we're here, if the pkt is completely beyond
496 * anything we have, just insert it at the tail.
497 */
498 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
499 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
500 goto insert_it;
501 }
502 }
503
504 q = TAILQ_FIRST(&tp->segq);
505
506 if (q != NULL) {
507 /*
508 * If this segment immediately precedes the first out-of-order
509 * block, simply slap the segment in front of it and (mostly)
510 * skip the complicated logic.
511 */
512 if (pkt_seq + pkt_len == q->ipqe_seq) {
513 q->ipqe_seq = pkt_seq;
514 q->ipqe_len += pkt_len;
515 q->ipqe_flags |= pkt_flags;
516 m_cat(m, q->ipqe_m);
517 q->ipqe_m = m;
518 q->ipre_mlast = m; /* last mbuf may have changed */
519 TRAVERSE(q->ipre_mlast);
520 tiqe = q;
521 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
522 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
523 goto skip_replacement;
524 }
525 } else {
526 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
527 }
528
529 /*
530 * Find a segment which begins after this one does.
531 */
532 for (p = NULL; q != NULL; q = nq) {
533 nq = TAILQ_NEXT(q, ipqe_q);
534 #ifdef TCP_REASS_COUNTERS
535 count++;
536 #endif
537 /*
538 * If the received segment is just right after this
539 * fragment, merge the two together and then check
540 * for further overlaps.
541 */
542 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
543 #ifdef TCPREASS_DEBUG
544 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
545 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
546 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
547 #endif
548 pkt_len += q->ipqe_len;
549 pkt_flags |= q->ipqe_flags;
550 pkt_seq = q->ipqe_seq;
551 m_cat(q->ipre_mlast, m);
552 TRAVERSE(q->ipre_mlast);
553 m = q->ipqe_m;
554 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
555 goto free_ipqe;
556 }
557 /*
558 * If the received segment is completely past this
559 * fragment, we need to go the next fragment.
560 */
561 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
562 p = q;
563 continue;
564 }
565 /*
566 * If the fragment is past the received segment,
567 * it (or any following) can't be concatenated.
568 */
569 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
570 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
571 break;
572 }
573
574 /*
575 * We've received all the data in this segment before.
576 * mark it as a duplicate and return.
577 */
578 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
579 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
580 tcps = TCP_STAT_GETREF();
581 tcps[TCP_STAT_RCVDUPPACK]++;
582 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
583 TCP_STAT_PUTREF();
584 tcp_new_dsack(tp, pkt_seq, pkt_len);
585 m_freem(m);
586 if (tiqe != NULL) {
587 tcpipqent_free(tiqe);
588 }
589 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
590 return (0);
591 }
592 /*
593 * Received segment completely overlaps this fragment
594 * so we drop the fragment (this keeps the temporal
595 * ordering of segments correct).
596 */
597 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
598 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
599 rcvpartdupbyte += q->ipqe_len;
600 m_freem(q->ipqe_m);
601 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
602 goto free_ipqe;
603 }
604 /*
605 * RX'ed segment extends past the end of the
606 * fragment. Drop the overlapping bytes. Then
607 * merge the fragment and segment then treat as
608 * a longer received packet.
609 */
610 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
611 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
612 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
613 #ifdef TCPREASS_DEBUG
614 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
615 tp, overlap,
616 pkt_seq, pkt_seq + pkt_len, pkt_len);
617 #endif
618 m_adj(m, overlap);
619 rcvpartdupbyte += overlap;
620 m_cat(q->ipre_mlast, m);
621 TRAVERSE(q->ipre_mlast);
622 m = q->ipqe_m;
623 pkt_seq = q->ipqe_seq;
624 pkt_len += q->ipqe_len - overlap;
625 rcvoobyte -= overlap;
626 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
627 goto free_ipqe;
628 }
629 /*
630 * RX'ed segment extends past the front of the
631 * fragment. Drop the overlapping bytes on the
632 * received packet. The packet will then be
633 * contatentated with this fragment a bit later.
634 */
635 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
636 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
637 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
638 #ifdef TCPREASS_DEBUG
639 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
640 tp, overlap,
641 pkt_seq, pkt_seq + pkt_len, pkt_len);
642 #endif
643 m_adj(m, -overlap);
644 pkt_len -= overlap;
645 rcvpartdupbyte += overlap;
646 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
647 rcvoobyte -= overlap;
648 }
649 /*
650 * If the received segment immediates precedes this
651 * fragment then tack the fragment onto this segment
652 * and reinsert the data.
653 */
654 if (q->ipqe_seq == pkt_seq + pkt_len) {
655 #ifdef TCPREASS_DEBUG
656 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
657 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
658 pkt_seq, pkt_seq + pkt_len, pkt_len);
659 #endif
660 pkt_len += q->ipqe_len;
661 pkt_flags |= q->ipqe_flags;
662 m_cat(m, q->ipqe_m);
663 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
664 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
665 tp->t_segqlen--;
666 KASSERT(tp->t_segqlen >= 0);
667 KASSERT(tp->t_segqlen != 0 ||
668 (TAILQ_EMPTY(&tp->segq) &&
669 TAILQ_EMPTY(&tp->timeq)));
670 if (tiqe == NULL) {
671 tiqe = q;
672 } else {
673 tcpipqent_free(q);
674 }
675 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
676 break;
677 }
678 /*
679 * If the fragment is before the segment, remember it.
680 * When this loop is terminated, p will contain the
681 * pointer to fragment that is right before the received
682 * segment.
683 */
684 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
685 p = q;
686
687 continue;
688
689 /*
690 * This is a common operation. It also will allow
691 * to save doing a malloc/free in most instances.
692 */
693 free_ipqe:
694 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
695 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
696 tp->t_segqlen--;
697 KASSERT(tp->t_segqlen >= 0);
698 KASSERT(tp->t_segqlen != 0 ||
699 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
700 if (tiqe == NULL) {
701 tiqe = q;
702 } else {
703 tcpipqent_free(q);
704 }
705 }
706
707 #ifdef TCP_REASS_COUNTERS
708 if (count > 7)
709 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
710 else if (count > 0)
711 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
712 #endif
713
714 insert_it:
715
716 /*
717 * Allocate a new queue entry since the received segment did not
718 * collapse onto any other out-of-order block; thus we are allocating
719 * a new block. If it had collapsed, tiqe would not be NULL and
720 * we would be reusing it.
721 * XXX If we can't, just drop the packet. XXX
722 */
723 if (tiqe == NULL) {
724 tiqe = tcpipqent_alloc();
725 if (tiqe == NULL) {
726 TCP_STATINC(TCP_STAT_RCVMEMDROP);
727 m_freem(m);
728 return (0);
729 }
730 }
731
732 /*
733 * Update the counters.
734 */
735 tcps = TCP_STAT_GETREF();
736 tcps[TCP_STAT_RCVOOPACK]++;
737 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
738 if (rcvpartdupbyte) {
739 tcps[TCP_STAT_RCVPARTDUPPACK]++;
740 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
741 }
742 TCP_STAT_PUTREF();
743
744 /*
745 * Insert the new fragment queue entry into both queues.
746 */
747 tiqe->ipqe_m = m;
748 tiqe->ipre_mlast = m;
749 tiqe->ipqe_seq = pkt_seq;
750 tiqe->ipqe_len = pkt_len;
751 tiqe->ipqe_flags = pkt_flags;
752 if (p == NULL) {
753 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
754 #ifdef TCPREASS_DEBUG
755 if (tiqe->ipqe_seq != tp->rcv_nxt)
756 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
757 tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
758 #endif
759 } else {
760 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
761 #ifdef TCPREASS_DEBUG
762 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
763 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
764 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
765 #endif
766 }
767 tp->t_segqlen++;
768
769 skip_replacement:
770
771 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
772
773 present:
774 /*
775 * Present data to user, advancing rcv_nxt through
776 * completed sequence space.
777 */
778 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
779 return (0);
780 q = TAILQ_FIRST(&tp->segq);
781 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
782 return (0);
783 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
784 return (0);
785
786 tp->rcv_nxt += q->ipqe_len;
787 pkt_flags = q->ipqe_flags & TH_FIN;
788 nd6_hint(tp);
789
790 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
791 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
792 tp->t_segqlen--;
793 KASSERT(tp->t_segqlen >= 0);
794 KASSERT(tp->t_segqlen != 0 ||
795 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
796 if (so->so_state & SS_CANTRCVMORE)
797 m_freem(q->ipqe_m);
798 else
799 sbappendstream(&so->so_rcv, q->ipqe_m);
800 tcpipqent_free(q);
801 sorwakeup(so);
802 return (pkt_flags);
803 }
804
805 #ifdef INET6
806 int
807 tcp6_input(struct mbuf **mp, int *offp, int proto)
808 {
809 struct mbuf *m = *mp;
810
811 /*
812 * draft-itojun-ipv6-tcp-to-anycast
813 * better place to put this in?
814 */
815 if (m->m_flags & M_ANYCAST6) {
816 struct ip6_hdr *ip6;
817 if (m->m_len < sizeof(struct ip6_hdr)) {
818 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
819 TCP_STATINC(TCP_STAT_RCVSHORT);
820 return IPPROTO_DONE;
821 }
822 }
823 ip6 = mtod(m, struct ip6_hdr *);
824 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
825 (char *)&ip6->ip6_dst - (char *)ip6);
826 return IPPROTO_DONE;
827 }
828
829 tcp_input(m, *offp, proto);
830 return IPPROTO_DONE;
831 }
832 #endif
833
834 #ifdef INET
835 static void
836 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
837 {
838 char src[4*sizeof "123"];
839 char dst[4*sizeof "123"];
840
841 if (ip) {
842 strlcpy(src, inet_ntoa(ip->ip_src), sizeof(src));
843 strlcpy(dst, inet_ntoa(ip->ip_dst), sizeof(dst));
844 }
845 else {
846 strlcpy(src, "(unknown)", sizeof(src));
847 strlcpy(dst, "(unknown)", sizeof(dst));
848 }
849 log(LOG_INFO,
850 "Connection attempt to TCP %s:%d from %s:%d\n",
851 dst, ntohs(th->th_dport),
852 src, ntohs(th->th_sport));
853 }
854 #endif
855
856 #ifdef INET6
857 static void
858 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
859 {
860 char src[INET6_ADDRSTRLEN];
861 char dst[INET6_ADDRSTRLEN];
862
863 if (ip6) {
864 strlcpy(src, ip6_sprintf(&ip6->ip6_src), sizeof(src));
865 strlcpy(dst, ip6_sprintf(&ip6->ip6_dst), sizeof(dst));
866 }
867 else {
868 strlcpy(src, "(unknown v6)", sizeof(src));
869 strlcpy(dst, "(unknown v6)", sizeof(dst));
870 }
871 log(LOG_INFO,
872 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
873 dst, ntohs(th->th_dport),
874 src, ntohs(th->th_sport));
875 }
876 #endif
877
878 /*
879 * Checksum extended TCP header and data.
880 */
881 int
882 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
883 int toff, int off, int tlen)
884 {
885
886 /*
887 * XXX it's better to record and check if this mbuf is
888 * already checked.
889 */
890
891 switch (af) {
892 #ifdef INET
893 case AF_INET:
894 switch (m->m_pkthdr.csum_flags &
895 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
896 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
897 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
898 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
899 goto badcsum;
900
901 case M_CSUM_TCPv4|M_CSUM_DATA: {
902 u_int32_t hw_csum = m->m_pkthdr.csum_data;
903
904 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
905 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
906 const struct ip *ip =
907 mtod(m, const struct ip *);
908
909 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
910 ip->ip_dst.s_addr,
911 htons(hw_csum + tlen + off + IPPROTO_TCP));
912 }
913 if ((hw_csum ^ 0xffff) != 0)
914 goto badcsum;
915 break;
916 }
917
918 case M_CSUM_TCPv4:
919 /* Checksum was okay. */
920 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
921 break;
922
923 default:
924 /*
925 * Must compute it ourselves. Maybe skip checksum
926 * on loopback interfaces.
927 */
928 if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &
929 IFF_LOOPBACK) ||
930 tcp_do_loopback_cksum)) {
931 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
932 if (in4_cksum(m, IPPROTO_TCP, toff,
933 tlen + off) != 0)
934 goto badcsum;
935 }
936 break;
937 }
938 break;
939 #endif /* INET4 */
940
941 #ifdef INET6
942 case AF_INET6:
943 switch (m->m_pkthdr.csum_flags &
944 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
945 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
946 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
947 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
948 goto badcsum;
949
950 #if 0 /* notyet */
951 case M_CSUM_TCPv6|M_CSUM_DATA:
952 #endif
953
954 case M_CSUM_TCPv6:
955 /* Checksum was okay. */
956 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
957 break;
958
959 default:
960 /*
961 * Must compute it ourselves. Maybe skip checksum
962 * on loopback interfaces.
963 */
964 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
965 tcp_do_loopback_cksum)) {
966 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
967 if (in6_cksum(m, IPPROTO_TCP, toff,
968 tlen + off) != 0)
969 goto badcsum;
970 }
971 }
972 break;
973 #endif /* INET6 */
974 }
975
976 return 0;
977
978 badcsum:
979 TCP_STATINC(TCP_STAT_RCVBADSUM);
980 return -1;
981 }
982
983 /*
984 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
985 */
986 void
987 tcp_input(struct mbuf *m, ...)
988 {
989 struct tcphdr *th;
990 struct ip *ip;
991 struct inpcb *inp;
992 #ifdef INET6
993 struct ip6_hdr *ip6;
994 struct in6pcb *in6p;
995 #endif
996 u_int8_t *optp = NULL;
997 int optlen = 0;
998 int len, tlen, toff, hdroptlen = 0;
999 struct tcpcb *tp = 0;
1000 int tiflags;
1001 struct socket *so = NULL;
1002 int todrop, dupseg, acked, ourfinisacked, needoutput = 0;
1003 #ifdef TCP_DEBUG
1004 short ostate = 0;
1005 #endif
1006 u_long tiwin;
1007 struct tcp_opt_info opti;
1008 int off, iphlen;
1009 va_list ap;
1010 int af; /* af on the wire */
1011 struct mbuf *tcp_saveti = NULL;
1012 uint32_t ts_rtt;
1013 uint8_t iptos;
1014 uint64_t *tcps;
1015
1016 MCLAIM(m, &tcp_rx_mowner);
1017 va_start(ap, m);
1018 toff = va_arg(ap, int);
1019 (void)va_arg(ap, int); /* ignore value, advance ap */
1020 va_end(ap);
1021
1022 TCP_STATINC(TCP_STAT_RCVTOTAL);
1023
1024 bzero(&opti, sizeof(opti));
1025 opti.ts_present = 0;
1026 opti.maxseg = 0;
1027
1028 /*
1029 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1030 *
1031 * TCP is, by definition, unicast, so we reject all
1032 * multicast outright.
1033 *
1034 * Note, there are additional src/dst address checks in
1035 * the AF-specific code below.
1036 */
1037 if (m->m_flags & (M_BCAST|M_MCAST)) {
1038 /* XXX stat */
1039 goto drop;
1040 }
1041 #ifdef INET6
1042 if (m->m_flags & M_ANYCAST6) {
1043 /* XXX stat */
1044 goto drop;
1045 }
1046 #endif
1047
1048 /*
1049 * Get IP and TCP header.
1050 * Note: IP leaves IP header in first mbuf.
1051 */
1052 ip = mtod(m, struct ip *);
1053 #ifdef INET6
1054 ip6 = NULL;
1055 #endif
1056 switch (ip->ip_v) {
1057 #ifdef INET
1058 case 4:
1059 af = AF_INET;
1060 iphlen = sizeof(struct ip);
1061 ip = mtod(m, struct ip *);
1062 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1063 sizeof(struct tcphdr));
1064 if (th == NULL) {
1065 TCP_STATINC(TCP_STAT_RCVSHORT);
1066 return;
1067 }
1068 /* We do the checksum after PCB lookup... */
1069 len = ntohs(ip->ip_len);
1070 tlen = len - toff;
1071 iptos = ip->ip_tos;
1072 break;
1073 #endif
1074 #ifdef INET6
1075 case 6:
1076 ip = NULL;
1077 iphlen = sizeof(struct ip6_hdr);
1078 af = AF_INET6;
1079 ip6 = mtod(m, struct ip6_hdr *);
1080 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1081 sizeof(struct tcphdr));
1082 if (th == NULL) {
1083 TCP_STATINC(TCP_STAT_RCVSHORT);
1084 return;
1085 }
1086
1087 /* Be proactive about malicious use of IPv4 mapped address */
1088 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
1089 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
1090 /* XXX stat */
1091 goto drop;
1092 }
1093
1094 /*
1095 * Be proactive about unspecified IPv6 address in source.
1096 * As we use all-zero to indicate unbounded/unconnected pcb,
1097 * unspecified IPv6 address can be used to confuse us.
1098 *
1099 * Note that packets with unspecified IPv6 destination is
1100 * already dropped in ip6_input.
1101 */
1102 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1103 /* XXX stat */
1104 goto drop;
1105 }
1106
1107 /*
1108 * Make sure destination address is not multicast.
1109 * Source address checked in ip6_input().
1110 */
1111 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1112 /* XXX stat */
1113 goto drop;
1114 }
1115
1116 /* We do the checksum after PCB lookup... */
1117 len = m->m_pkthdr.len;
1118 tlen = len - toff;
1119 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1120 break;
1121 #endif
1122 default:
1123 m_freem(m);
1124 return;
1125 }
1126
1127 KASSERT(TCP_HDR_ALIGNED_P(th));
1128
1129 /*
1130 * Check that TCP offset makes sense,
1131 * pull out TCP options and adjust length. XXX
1132 */
1133 off = th->th_off << 2;
1134 if (off < sizeof (struct tcphdr) || off > tlen) {
1135 TCP_STATINC(TCP_STAT_RCVBADOFF);
1136 goto drop;
1137 }
1138 tlen -= off;
1139
1140 /*
1141 * tcp_input() has been modified to use tlen to mean the TCP data
1142 * length throughout the function. Other functions can use
1143 * m->m_pkthdr.len as the basis for calculating the TCP data length.
1144 * rja
1145 */
1146
1147 if (off > sizeof (struct tcphdr)) {
1148 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
1149 if (th == NULL) {
1150 TCP_STATINC(TCP_STAT_RCVSHORT);
1151 return;
1152 }
1153 /*
1154 * NOTE: ip/ip6 will not be affected by m_pulldown()
1155 * (as they're before toff) and we don't need to update those.
1156 */
1157 KASSERT(TCP_HDR_ALIGNED_P(th));
1158 optlen = off - sizeof (struct tcphdr);
1159 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1160 /*
1161 * Do quick retrieval of timestamp options ("options
1162 * prediction?"). If timestamp is the only option and it's
1163 * formatted as recommended in RFC 1323 appendix A, we
1164 * quickly get the values now and not bother calling
1165 * tcp_dooptions(), etc.
1166 */
1167 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1168 (optlen > TCPOLEN_TSTAMP_APPA &&
1169 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1170 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
1171 (th->th_flags & TH_SYN) == 0) {
1172 opti.ts_present = 1;
1173 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
1174 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
1175 optp = NULL; /* we've parsed the options */
1176 }
1177 }
1178 tiflags = th->th_flags;
1179
1180 /*
1181 * Locate pcb for segment.
1182 */
1183 findpcb:
1184 inp = NULL;
1185 #ifdef INET6
1186 in6p = NULL;
1187 #endif
1188 switch (af) {
1189 #ifdef INET
1190 case AF_INET:
1191 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
1192 ip->ip_dst, th->th_dport);
1193 if (inp == 0) {
1194 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1195 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
1196 }
1197 #ifdef INET6
1198 if (inp == 0) {
1199 struct in6_addr s, d;
1200
1201 /* mapped addr case */
1202 bzero(&s, sizeof(s));
1203 s.s6_addr16[5] = htons(0xffff);
1204 bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
1205 bzero(&d, sizeof(d));
1206 d.s6_addr16[5] = htons(0xffff);
1207 bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
1208 in6p = in6_pcblookup_connect(&tcbtable, &s,
1209 th->th_sport, &d, th->th_dport, 0);
1210 if (in6p == 0) {
1211 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1212 in6p = in6_pcblookup_bind(&tcbtable, &d,
1213 th->th_dport, 0);
1214 }
1215 }
1216 #endif
1217 #ifndef INET6
1218 if (inp == 0)
1219 #else
1220 if (inp == 0 && in6p == 0)
1221 #endif
1222 {
1223 TCP_STATINC(TCP_STAT_NOPORT);
1224 if (tcp_log_refused &&
1225 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1226 tcp4_log_refused(ip, th);
1227 }
1228 tcp_fields_to_host(th);
1229 goto dropwithreset_ratelim;
1230 }
1231 #if defined(IPSEC) || defined(FAST_IPSEC)
1232 if (inp && (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0 &&
1233 ipsec4_in_reject(m, inp)) {
1234 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1235 goto drop;
1236 }
1237 #ifdef INET6
1238 else if (in6p &&
1239 (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 &&
1240 ipsec6_in_reject_so(m, in6p->in6p_socket)) {
1241 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1242 goto drop;
1243 }
1244 #endif
1245 #endif /*IPSEC*/
1246 break;
1247 #endif /*INET*/
1248 #ifdef INET6
1249 case AF_INET6:
1250 {
1251 int faith;
1252
1253 #if defined(NFAITH) && NFAITH > 0
1254 faith = faithprefix(&ip6->ip6_dst);
1255 #else
1256 faith = 0;
1257 #endif
1258 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src,
1259 th->th_sport, &ip6->ip6_dst, th->th_dport, faith);
1260 if (in6p == NULL) {
1261 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1262 in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst,
1263 th->th_dport, faith);
1264 }
1265 if (in6p == NULL) {
1266 TCP_STATINC(TCP_STAT_NOPORT);
1267 if (tcp_log_refused &&
1268 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1269 tcp6_log_refused(ip6, th);
1270 }
1271 tcp_fields_to_host(th);
1272 goto dropwithreset_ratelim;
1273 }
1274 #if defined(IPSEC) || defined(FAST_IPSEC)
1275 if ((in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 &&
1276 ipsec6_in_reject(m, in6p)) {
1277 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1278 goto drop;
1279 }
1280 #endif /*IPSEC*/
1281 break;
1282 }
1283 #endif
1284 }
1285
1286 /*
1287 * If the state is CLOSED (i.e., TCB does not exist) then
1288 * all data in the incoming segment is discarded.
1289 * If the TCB exists but is in CLOSED state, it is embryonic,
1290 * but should either do a listen or a connect soon.
1291 */
1292 tp = NULL;
1293 so = NULL;
1294 if (inp) {
1295 tp = intotcpcb(inp);
1296 so = inp->inp_socket;
1297 }
1298 #ifdef INET6
1299 else if (in6p) {
1300 tp = in6totcpcb(in6p);
1301 so = in6p->in6p_socket;
1302 }
1303 #endif
1304 if (tp == 0) {
1305 tcp_fields_to_host(th);
1306 goto dropwithreset_ratelim;
1307 }
1308 if (tp->t_state == TCPS_CLOSED)
1309 goto drop;
1310
1311 KASSERT(so->so_lock == softnet_lock);
1312 KASSERT(solocked(so));
1313
1314 /*
1315 * Checksum extended TCP header and data.
1316 */
1317 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1318 goto badcsum;
1319
1320 tcp_fields_to_host(th);
1321
1322 /* Unscale the window into a 32-bit value. */
1323 if ((tiflags & TH_SYN) == 0)
1324 tiwin = th->th_win << tp->snd_scale;
1325 else
1326 tiwin = th->th_win;
1327
1328 #ifdef INET6
1329 /* save packet options if user wanted */
1330 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1331 if (in6p->in6p_options) {
1332 m_freem(in6p->in6p_options);
1333 in6p->in6p_options = 0;
1334 }
1335 KASSERT(ip6 != NULL);
1336 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1337 }
1338 #endif
1339
1340 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1341 union syn_cache_sa src;
1342 union syn_cache_sa dst;
1343
1344 bzero(&src, sizeof(src));
1345 bzero(&dst, sizeof(dst));
1346 switch (af) {
1347 #ifdef INET
1348 case AF_INET:
1349 src.sin.sin_len = sizeof(struct sockaddr_in);
1350 src.sin.sin_family = AF_INET;
1351 src.sin.sin_addr = ip->ip_src;
1352 src.sin.sin_port = th->th_sport;
1353
1354 dst.sin.sin_len = sizeof(struct sockaddr_in);
1355 dst.sin.sin_family = AF_INET;
1356 dst.sin.sin_addr = ip->ip_dst;
1357 dst.sin.sin_port = th->th_dport;
1358 break;
1359 #endif
1360 #ifdef INET6
1361 case AF_INET6:
1362 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1363 src.sin6.sin6_family = AF_INET6;
1364 src.sin6.sin6_addr = ip6->ip6_src;
1365 src.sin6.sin6_port = th->th_sport;
1366
1367 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1368 dst.sin6.sin6_family = AF_INET6;
1369 dst.sin6.sin6_addr = ip6->ip6_dst;
1370 dst.sin6.sin6_port = th->th_dport;
1371 break;
1372 #endif /* INET6 */
1373 default:
1374 goto badsyn; /*sanity*/
1375 }
1376
1377 if (so->so_options & SO_DEBUG) {
1378 #ifdef TCP_DEBUG
1379 ostate = tp->t_state;
1380 #endif
1381
1382 tcp_saveti = NULL;
1383 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1384 goto nosave;
1385
1386 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1387 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1388 if (!tcp_saveti)
1389 goto nosave;
1390 } else {
1391 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1392 if (!tcp_saveti)
1393 goto nosave;
1394 MCLAIM(m, &tcp_mowner);
1395 tcp_saveti->m_len = iphlen;
1396 m_copydata(m, 0, iphlen,
1397 mtod(tcp_saveti, void *));
1398 }
1399
1400 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1401 m_freem(tcp_saveti);
1402 tcp_saveti = NULL;
1403 } else {
1404 tcp_saveti->m_len += sizeof(struct tcphdr);
1405 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1406 sizeof(struct tcphdr));
1407 }
1408 nosave:;
1409 }
1410 if (so->so_options & SO_ACCEPTCONN) {
1411 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1412 if (tiflags & TH_RST) {
1413 syn_cache_reset(&src.sa, &dst.sa, th);
1414 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1415 (TH_ACK|TH_SYN)) {
1416 /*
1417 * Received a SYN,ACK. This should
1418 * never happen while we are in
1419 * LISTEN. Send an RST.
1420 */
1421 goto badsyn;
1422 } else if (tiflags & TH_ACK) {
1423 so = syn_cache_get(&src.sa, &dst.sa,
1424 th, toff, tlen, so, m);
1425 if (so == NULL) {
1426 /*
1427 * We don't have a SYN for
1428 * this ACK; send an RST.
1429 */
1430 goto badsyn;
1431 } else if (so ==
1432 (struct socket *)(-1)) {
1433 /*
1434 * We were unable to create
1435 * the connection. If the
1436 * 3-way handshake was
1437 * completed, and RST has
1438 * been sent to the peer.
1439 * Since the mbuf might be
1440 * in use for the reply,
1441 * do not free it.
1442 */
1443 m = NULL;
1444 } else {
1445 /*
1446 * We have created a
1447 * full-blown connection.
1448 */
1449 tp = NULL;
1450 inp = NULL;
1451 #ifdef INET6
1452 in6p = NULL;
1453 #endif
1454 switch (so->so_proto->pr_domain->dom_family) {
1455 #ifdef INET
1456 case AF_INET:
1457 inp = sotoinpcb(so);
1458 tp = intotcpcb(inp);
1459 break;
1460 #endif
1461 #ifdef INET6
1462 case AF_INET6:
1463 in6p = sotoin6pcb(so);
1464 tp = in6totcpcb(in6p);
1465 break;
1466 #endif
1467 }
1468 if (tp == NULL)
1469 goto badsyn; /*XXX*/
1470 tiwin <<= tp->snd_scale;
1471 goto after_listen;
1472 }
1473 } else {
1474 /*
1475 * None of RST, SYN or ACK was set.
1476 * This is an invalid packet for a
1477 * TCB in LISTEN state. Send a RST.
1478 */
1479 goto badsyn;
1480 }
1481 } else {
1482 /*
1483 * Received a SYN.
1484 *
1485 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1486 */
1487 if (m->m_flags & (M_BCAST|M_MCAST))
1488 goto drop;
1489
1490 switch (af) {
1491 #ifdef INET6
1492 case AF_INET6:
1493 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1494 goto drop;
1495 break;
1496 #endif /* INET6 */
1497 case AF_INET:
1498 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1499 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
1500 goto drop;
1501 break;
1502 }
1503
1504 #ifdef INET6
1505 /*
1506 * If deprecated address is forbidden, we do
1507 * not accept SYN to deprecated interface
1508 * address to prevent any new inbound
1509 * connection from getting established.
1510 * When we do not accept SYN, we send a TCP
1511 * RST, with deprecated source address (instead
1512 * of dropping it). We compromise it as it is
1513 * much better for peer to send a RST, and
1514 * RST will be the final packet for the
1515 * exchange.
1516 *
1517 * If we do not forbid deprecated addresses, we
1518 * accept the SYN packet. RFC2462 does not
1519 * suggest dropping SYN in this case.
1520 * If we decipher RFC2462 5.5.4, it says like
1521 * this:
1522 * 1. use of deprecated addr with existing
1523 * communication is okay - "SHOULD continue
1524 * to be used"
1525 * 2. use of it with new communication:
1526 * (2a) "SHOULD NOT be used if alternate
1527 * address with sufficient scope is
1528 * available"
1529 * (2b) nothing mentioned otherwise.
1530 * Here we fall into (2b) case as we have no
1531 * choice in our source address selection - we
1532 * must obey the peer.
1533 *
1534 * The wording in RFC2462 is confusing, and
1535 * there are multiple description text for
1536 * deprecated address handling - worse, they
1537 * are not exactly the same. I believe 5.5.4
1538 * is the best one, so we follow 5.5.4.
1539 */
1540 if (af == AF_INET6 && !ip6_use_deprecated) {
1541 struct in6_ifaddr *ia6;
1542 if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
1543 &ip6->ip6_dst)) &&
1544 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1545 tp = NULL;
1546 goto dropwithreset;
1547 }
1548 }
1549 #endif
1550
1551 #if defined(IPSEC) || defined(FAST_IPSEC)
1552 switch (af) {
1553 #ifdef INET
1554 case AF_INET:
1555 if (ipsec4_in_reject_so(m, so)) {
1556 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1557 tp = NULL;
1558 goto dropwithreset;
1559 }
1560 break;
1561 #endif
1562 #ifdef INET6
1563 case AF_INET6:
1564 if (ipsec6_in_reject_so(m, so)) {
1565 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1566 tp = NULL;
1567 goto dropwithreset;
1568 }
1569 break;
1570 #endif /*INET6*/
1571 }
1572 #endif /*IPSEC*/
1573
1574 /*
1575 * LISTEN socket received a SYN
1576 * from itself? This can't possibly
1577 * be valid; drop the packet.
1578 */
1579 if (th->th_sport == th->th_dport) {
1580 int i;
1581
1582 switch (af) {
1583 #ifdef INET
1584 case AF_INET:
1585 i = in_hosteq(ip->ip_src, ip->ip_dst);
1586 break;
1587 #endif
1588 #ifdef INET6
1589 case AF_INET6:
1590 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1591 break;
1592 #endif
1593 default:
1594 i = 1;
1595 }
1596 if (i) {
1597 TCP_STATINC(TCP_STAT_BADSYN);
1598 goto drop;
1599 }
1600 }
1601
1602 /*
1603 * SYN looks ok; create compressed TCP
1604 * state for it.
1605 */
1606 if (so->so_qlen <= so->so_qlimit &&
1607 syn_cache_add(&src.sa, &dst.sa, th, tlen,
1608 so, m, optp, optlen, &opti))
1609 m = NULL;
1610 }
1611 goto drop;
1612 }
1613 }
1614
1615 after_listen:
1616 #ifdef DIAGNOSTIC
1617 /*
1618 * Should not happen now that all embryonic connections
1619 * are handled with compressed state.
1620 */
1621 if (tp->t_state == TCPS_LISTEN)
1622 panic("tcp_input: TCPS_LISTEN");
1623 #endif
1624
1625 /*
1626 * Segment received on connection.
1627 * Reset idle time and keep-alive timer.
1628 */
1629 tp->t_rcvtime = tcp_now;
1630 if (TCPS_HAVEESTABLISHED(tp->t_state))
1631 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1632
1633 /*
1634 * Process options.
1635 */
1636 #ifdef TCP_SIGNATURE
1637 if (optp || (tp->t_flags & TF_SIGNATURE))
1638 #else
1639 if (optp)
1640 #endif
1641 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0)
1642 goto drop;
1643
1644 if (TCP_SACK_ENABLED(tp)) {
1645 tcp_del_sackholes(tp, th);
1646 }
1647
1648 if (TCP_ECN_ALLOWED(tp)) {
1649 switch (iptos & IPTOS_ECN_MASK) {
1650 case IPTOS_ECN_CE:
1651 tp->t_flags |= TF_ECN_SND_ECE;
1652 TCP_STATINC(TCP_STAT_ECN_CE);
1653 break;
1654 case IPTOS_ECN_ECT0:
1655 TCP_STATINC(TCP_STAT_ECN_ECT);
1656 break;
1657 case IPTOS_ECN_ECT1:
1658 /* XXX: ignore for now -- rpaulo */
1659 break;
1660 }
1661
1662 if (tiflags & TH_CWR)
1663 tp->t_flags &= ~TF_ECN_SND_ECE;
1664
1665 /*
1666 * Congestion experienced.
1667 * Ignore if we are already trying to recover.
1668 */
1669 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1670 tp->t_congctl->cong_exp(tp);
1671 }
1672
1673 if (opti.ts_present && opti.ts_ecr) {
1674 /*
1675 * Calculate the RTT from the returned time stamp and the
1676 * connection's time base. If the time stamp is later than
1677 * the current time, or is extremely old, fall back to non-1323
1678 * RTT calculation. Since ts_ecr is unsigned, we can test both
1679 * at the same time.
1680 */
1681 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1682 if (ts_rtt > TCP_PAWS_IDLE)
1683 ts_rtt = 0;
1684 } else {
1685 ts_rtt = 0;
1686 }
1687
1688 /*
1689 * Header prediction: check for the two common cases
1690 * of a uni-directional data xfer. If the packet has
1691 * no control flags, is in-sequence, the window didn't
1692 * change and we're not retransmitting, it's a
1693 * candidate. If the length is zero and the ack moved
1694 * forward, we're the sender side of the xfer. Just
1695 * free the data acked & wake any higher level process
1696 * that was blocked waiting for space. If the length
1697 * is non-zero and the ack didn't move, we're the
1698 * receiver side. If we're getting packets in-order
1699 * (the reassembly queue is empty), add the data to
1700 * the socket buffer and note that we need a delayed ack.
1701 */
1702 if (tp->t_state == TCPS_ESTABLISHED &&
1703 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1704 == TH_ACK &&
1705 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1706 th->th_seq == tp->rcv_nxt &&
1707 tiwin && tiwin == tp->snd_wnd &&
1708 tp->snd_nxt == tp->snd_max) {
1709
1710 /*
1711 * If last ACK falls within this segment's sequence numbers,
1712 * record the timestamp.
1713 * NOTE that the test is modified according to the latest
1714 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1715 *
1716 * note that we already know
1717 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1718 */
1719 if (opti.ts_present &&
1720 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1721 tp->ts_recent_age = tcp_now;
1722 tp->ts_recent = opti.ts_val;
1723 }
1724
1725 if (tlen == 0) {
1726 /* Ack prediction. */
1727 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1728 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1729 tp->snd_cwnd >= tp->snd_wnd &&
1730 tp->t_partialacks < 0) {
1731 /*
1732 * this is a pure ack for outstanding data.
1733 */
1734 if (ts_rtt)
1735 tcp_xmit_timer(tp, ts_rtt);
1736 else if (tp->t_rtttime &&
1737 SEQ_GT(th->th_ack, tp->t_rtseq))
1738 tcp_xmit_timer(tp,
1739 tcp_now - tp->t_rtttime);
1740 acked = th->th_ack - tp->snd_una;
1741 tcps = TCP_STAT_GETREF();
1742 tcps[TCP_STAT_PREDACK]++;
1743 tcps[TCP_STAT_RCVACKPACK]++;
1744 tcps[TCP_STAT_RCVACKBYTE] += acked;
1745 TCP_STAT_PUTREF();
1746 nd6_hint(tp);
1747
1748 if (acked > (tp->t_lastoff - tp->t_inoff))
1749 tp->t_lastm = NULL;
1750 sbdrop(&so->so_snd, acked);
1751 tp->t_lastoff -= acked;
1752
1753 icmp_check(tp, th, acked);
1754
1755 tp->snd_una = th->th_ack;
1756 tp->snd_fack = tp->snd_una;
1757 if (SEQ_LT(tp->snd_high, tp->snd_una))
1758 tp->snd_high = tp->snd_una;
1759 m_freem(m);
1760
1761 /*
1762 * If all outstanding data are acked, stop
1763 * retransmit timer, otherwise restart timer
1764 * using current (possibly backed-off) value.
1765 * If process is waiting for space,
1766 * wakeup/selnotify/signal. If data
1767 * are ready to send, let tcp_output
1768 * decide between more output or persist.
1769 */
1770 if (tp->snd_una == tp->snd_max)
1771 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1772 else if (TCP_TIMER_ISARMED(tp,
1773 TCPT_PERSIST) == 0)
1774 TCP_TIMER_ARM(tp, TCPT_REXMT,
1775 tp->t_rxtcur);
1776
1777 sowwakeup(so);
1778 if (so->so_snd.sb_cc)
1779 (void) tcp_output(tp);
1780 if (tcp_saveti)
1781 m_freem(tcp_saveti);
1782 return;
1783 }
1784 } else if (th->th_ack == tp->snd_una &&
1785 TAILQ_FIRST(&tp->segq) == NULL &&
1786 tlen <= sbspace(&so->so_rcv)) {
1787 int newsize = 0; /* automatic sockbuf scaling */
1788
1789 /*
1790 * this is a pure, in-sequence data packet
1791 * with nothing on the reassembly queue and
1792 * we have enough buffer space to take it.
1793 */
1794 tp->rcv_nxt += tlen;
1795 tcps = TCP_STAT_GETREF();
1796 tcps[TCP_STAT_PREDDAT]++;
1797 tcps[TCP_STAT_RCVPACK]++;
1798 tcps[TCP_STAT_RCVBYTE] += tlen;
1799 TCP_STAT_PUTREF();
1800 nd6_hint(tp);
1801
1802 /*
1803 * Automatic sizing enables the performance of large buffers
1804 * and most of the efficiency of small ones by only allocating
1805 * space when it is needed.
1806 *
1807 * On the receive side the socket buffer memory is only rarely
1808 * used to any significant extent. This allows us to be much
1809 * more aggressive in scaling the receive socket buffer. For
1810 * the case that the buffer space is actually used to a large
1811 * extent and we run out of kernel memory we can simply drop
1812 * the new segments; TCP on the sender will just retransmit it
1813 * later. Setting the buffer size too big may only consume too
1814 * much kernel memory if the application doesn't read() from
1815 * the socket or packet loss or reordering makes use of the
1816 * reassembly queue.
1817 *
1818 * The criteria to step up the receive buffer one notch are:
1819 * 1. the number of bytes received during the time it takes
1820 * one timestamp to be reflected back to us (the RTT);
1821 * 2. received bytes per RTT is within seven eighth of the
1822 * current socket buffer size;
1823 * 3. receive buffer size has not hit maximal automatic size;
1824 *
1825 * This algorithm does one step per RTT at most and only if
1826 * we receive a bulk stream w/o packet losses or reorderings.
1827 * Shrinking the buffer during idle times is not necessary as
1828 * it doesn't consume any memory when idle.
1829 *
1830 * TODO: Only step up if the application is actually serving
1831 * the buffer to better manage the socket buffer resources.
1832 */
1833 if (tcp_do_autorcvbuf &&
1834 opti.ts_ecr &&
1835 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1836 if (opti.ts_ecr > tp->rfbuf_ts &&
1837 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
1838 if (tp->rfbuf_cnt >
1839 (so->so_rcv.sb_hiwat / 8 * 7) &&
1840 so->so_rcv.sb_hiwat <
1841 tcp_autorcvbuf_max) {
1842 newsize =
1843 min(so->so_rcv.sb_hiwat +
1844 tcp_autorcvbuf_inc,
1845 tcp_autorcvbuf_max);
1846 }
1847 /* Start over with next RTT. */
1848 tp->rfbuf_ts = 0;
1849 tp->rfbuf_cnt = 0;
1850 } else
1851 tp->rfbuf_cnt += tlen; /* add up */
1852 }
1853
1854 /*
1855 * Drop TCP, IP headers and TCP options then add data
1856 * to socket buffer.
1857 */
1858 if (so->so_state & SS_CANTRCVMORE)
1859 m_freem(m);
1860 else {
1861 /*
1862 * Set new socket buffer size.
1863 * Give up when limit is reached.
1864 */
1865 if (newsize)
1866 if (!sbreserve(&so->so_rcv,
1867 newsize, so))
1868 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1869 m_adj(m, toff + off);
1870 sbappendstream(&so->so_rcv, m);
1871 }
1872 sorwakeup(so);
1873 tcp_setup_ack(tp, th);
1874 if (tp->t_flags & TF_ACKNOW)
1875 (void) tcp_output(tp);
1876 if (tcp_saveti)
1877 m_freem(tcp_saveti);
1878 return;
1879 }
1880 }
1881
1882 /*
1883 * Compute mbuf offset to TCP data segment.
1884 */
1885 hdroptlen = toff + off;
1886
1887 /*
1888 * Calculate amount of space in receive window,
1889 * and then do TCP input processing.
1890 * Receive window is amount of space in rcv queue,
1891 * but not less than advertised window.
1892 */
1893 { int win;
1894
1895 win = sbspace(&so->so_rcv);
1896 if (win < 0)
1897 win = 0;
1898 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1899 }
1900
1901 /* Reset receive buffer auto scaling when not in bulk receive mode. */
1902 tp->rfbuf_ts = 0;
1903 tp->rfbuf_cnt = 0;
1904
1905 switch (tp->t_state) {
1906 /*
1907 * If the state is SYN_SENT:
1908 * if seg contains an ACK, but not for our SYN, drop the input.
1909 * if seg contains a RST, then drop the connection.
1910 * if seg does not contain SYN, then drop it.
1911 * Otherwise this is an acceptable SYN segment
1912 * initialize tp->rcv_nxt and tp->irs
1913 * if seg contains ack then advance tp->snd_una
1914 * if seg contains a ECE and ECN support is enabled, the stream
1915 * is ECN capable.
1916 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1917 * arrange for segment to be acked (eventually)
1918 * continue processing rest of data/controls, beginning with URG
1919 */
1920 case TCPS_SYN_SENT:
1921 if ((tiflags & TH_ACK) &&
1922 (SEQ_LEQ(th->th_ack, tp->iss) ||
1923 SEQ_GT(th->th_ack, tp->snd_max)))
1924 goto dropwithreset;
1925 if (tiflags & TH_RST) {
1926 if (tiflags & TH_ACK)
1927 tp = tcp_drop(tp, ECONNREFUSED);
1928 goto drop;
1929 }
1930 if ((tiflags & TH_SYN) == 0)
1931 goto drop;
1932 if (tiflags & TH_ACK) {
1933 tp->snd_una = th->th_ack;
1934 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1935 tp->snd_nxt = tp->snd_una;
1936 if (SEQ_LT(tp->snd_high, tp->snd_una))
1937 tp->snd_high = tp->snd_una;
1938 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1939
1940 if ((tiflags & TH_ECE) && tcp_do_ecn) {
1941 tp->t_flags |= TF_ECN_PERMIT;
1942 TCP_STATINC(TCP_STAT_ECN_SHS);
1943 }
1944
1945 }
1946 tp->irs = th->th_seq;
1947 tcp_rcvseqinit(tp);
1948 tp->t_flags |= TF_ACKNOW;
1949 tcp_mss_from_peer(tp, opti.maxseg);
1950
1951 /*
1952 * Initialize the initial congestion window. If we
1953 * had to retransmit the SYN, we must initialize cwnd
1954 * to 1 segment (i.e. the Loss Window).
1955 */
1956 if (tp->t_flags & TF_SYN_REXMT)
1957 tp->snd_cwnd = tp->t_peermss;
1958 else {
1959 int ss = tcp_init_win;
1960 #ifdef INET
1961 if (inp != NULL && in_localaddr(inp->inp_faddr))
1962 ss = tcp_init_win_local;
1963 #endif
1964 #ifdef INET6
1965 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
1966 ss = tcp_init_win_local;
1967 #endif
1968 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
1969 }
1970
1971 tcp_rmx_rtt(tp);
1972 if (tiflags & TH_ACK) {
1973 TCP_STATINC(TCP_STAT_CONNECTS);
1974 soisconnected(so);
1975 tcp_established(tp);
1976 /* Do window scaling on this connection? */
1977 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1978 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1979 tp->snd_scale = tp->requested_s_scale;
1980 tp->rcv_scale = tp->request_r_scale;
1981 }
1982 TCP_REASS_LOCK(tp);
1983 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
1984 TCP_REASS_UNLOCK(tp);
1985 /*
1986 * if we didn't have to retransmit the SYN,
1987 * use its rtt as our initial srtt & rtt var.
1988 */
1989 if (tp->t_rtttime)
1990 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
1991 } else
1992 tp->t_state = TCPS_SYN_RECEIVED;
1993
1994 /*
1995 * Advance th->th_seq to correspond to first data byte.
1996 * If data, trim to stay within window,
1997 * dropping FIN if necessary.
1998 */
1999 th->th_seq++;
2000 if (tlen > tp->rcv_wnd) {
2001 todrop = tlen - tp->rcv_wnd;
2002 m_adj(m, -todrop);
2003 tlen = tp->rcv_wnd;
2004 tiflags &= ~TH_FIN;
2005 tcps = TCP_STAT_GETREF();
2006 tcps[TCP_STAT_RCVPACKAFTERWIN]++;
2007 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
2008 TCP_STAT_PUTREF();
2009 }
2010 tp->snd_wl1 = th->th_seq - 1;
2011 tp->rcv_up = th->th_seq;
2012 goto step6;
2013
2014 /*
2015 * If the state is SYN_RECEIVED:
2016 * If seg contains an ACK, but not for our SYN, drop the input
2017 * and generate an RST. See page 36, rfc793
2018 */
2019 case TCPS_SYN_RECEIVED:
2020 if ((tiflags & TH_ACK) &&
2021 (SEQ_LEQ(th->th_ack, tp->iss) ||
2022 SEQ_GT(th->th_ack, tp->snd_max)))
2023 goto dropwithreset;
2024 break;
2025 }
2026
2027 /*
2028 * States other than LISTEN or SYN_SENT.
2029 * First check timestamp, if present.
2030 * Then check that at least some bytes of segment are within
2031 * receive window. If segment begins before rcv_nxt,
2032 * drop leading data (and SYN); if nothing left, just ack.
2033 *
2034 * RFC 1323 PAWS: If we have a timestamp reply on this segment
2035 * and it's less than ts_recent, drop it.
2036 */
2037 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2038 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2039
2040 /* Check to see if ts_recent is over 24 days old. */
2041 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2042 /*
2043 * Invalidate ts_recent. If this segment updates
2044 * ts_recent, the age will be reset later and ts_recent
2045 * will get a valid value. If it does not, setting
2046 * ts_recent to zero will at least satisfy the
2047 * requirement that zero be placed in the timestamp
2048 * echo reply when ts_recent isn't valid. The
2049 * age isn't reset until we get a valid ts_recent
2050 * because we don't want out-of-order segments to be
2051 * dropped when ts_recent is old.
2052 */
2053 tp->ts_recent = 0;
2054 } else {
2055 tcps = TCP_STAT_GETREF();
2056 tcps[TCP_STAT_RCVDUPPACK]++;
2057 tcps[TCP_STAT_RCVDUPBYTE] += tlen;
2058 tcps[TCP_STAT_PAWSDROP]++;
2059 TCP_STAT_PUTREF();
2060 tcp_new_dsack(tp, th->th_seq, tlen);
2061 goto dropafterack;
2062 }
2063 }
2064
2065 todrop = tp->rcv_nxt - th->th_seq;
2066 dupseg = false;
2067 if (todrop > 0) {
2068 if (tiflags & TH_SYN) {
2069 tiflags &= ~TH_SYN;
2070 th->th_seq++;
2071 if (th->th_urp > 1)
2072 th->th_urp--;
2073 else {
2074 tiflags &= ~TH_URG;
2075 th->th_urp = 0;
2076 }
2077 todrop--;
2078 }
2079 if (todrop > tlen ||
2080 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2081 /*
2082 * Any valid FIN or RST must be to the left of the
2083 * window. At this point the FIN or RST must be a
2084 * duplicate or out of sequence; drop it.
2085 */
2086 if (tiflags & TH_RST)
2087 goto drop;
2088 tiflags &= ~(TH_FIN|TH_RST);
2089 /*
2090 * Send an ACK to resynchronize and drop any data.
2091 * But keep on processing for RST or ACK.
2092 */
2093 tp->t_flags |= TF_ACKNOW;
2094 todrop = tlen;
2095 dupseg = true;
2096 tcps = TCP_STAT_GETREF();
2097 tcps[TCP_STAT_RCVDUPPACK]++;
2098 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
2099 TCP_STAT_PUTREF();
2100 } else if ((tiflags & TH_RST) &&
2101 th->th_seq != tp->rcv_nxt) {
2102 /*
2103 * Test for reset before adjusting the sequence
2104 * number for overlapping data.
2105 */
2106 goto dropafterack_ratelim;
2107 } else {
2108 tcps = TCP_STAT_GETREF();
2109 tcps[TCP_STAT_RCVPARTDUPPACK]++;
2110 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
2111 TCP_STAT_PUTREF();
2112 }
2113 tcp_new_dsack(tp, th->th_seq, todrop);
2114 hdroptlen += todrop; /*drop from head afterwards*/
2115 th->th_seq += todrop;
2116 tlen -= todrop;
2117 if (th->th_urp > todrop)
2118 th->th_urp -= todrop;
2119 else {
2120 tiflags &= ~TH_URG;
2121 th->th_urp = 0;
2122 }
2123 }
2124
2125 /*
2126 * If new data are received on a connection after the
2127 * user processes are gone, then RST the other end.
2128 */
2129 if ((so->so_state & SS_NOFDREF) &&
2130 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2131 tp = tcp_close(tp);
2132 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2133 goto dropwithreset;
2134 }
2135
2136 /*
2137 * If segment ends after window, drop trailing data
2138 * (and PUSH and FIN); if nothing left, just ACK.
2139 */
2140 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
2141 if (todrop > 0) {
2142 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2143 if (todrop >= tlen) {
2144 /*
2145 * The segment actually starts after the window.
2146 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2147 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2148 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2149 */
2150 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2151 /*
2152 * If a new connection request is received
2153 * while in TIME_WAIT, drop the old connection
2154 * and start over if the sequence numbers
2155 * are above the previous ones.
2156 *
2157 * NOTE: We will checksum the packet again, and
2158 * so we need to put the header fields back into
2159 * network order!
2160 * XXX This kind of sucks, but we don't expect
2161 * XXX this to happen very often, so maybe it
2162 * XXX doesn't matter so much.
2163 */
2164 if (tiflags & TH_SYN &&
2165 tp->t_state == TCPS_TIME_WAIT &&
2166 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2167 tp = tcp_close(tp);
2168 tcp_fields_to_net(th);
2169 goto findpcb;
2170 }
2171 /*
2172 * If window is closed can only take segments at
2173 * window edge, and have to drop data and PUSH from
2174 * incoming segments. Continue processing, but
2175 * remember to ack. Otherwise, drop segment
2176 * and (if not RST) ack.
2177 */
2178 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2179 tp->t_flags |= TF_ACKNOW;
2180 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2181 } else
2182 goto dropafterack;
2183 } else
2184 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2185 m_adj(m, -todrop);
2186 tlen -= todrop;
2187 tiflags &= ~(TH_PUSH|TH_FIN);
2188 }
2189
2190 /*
2191 * If last ACK falls within this segment's sequence numbers,
2192 * record the timestamp.
2193 * NOTE:
2194 * 1) That the test incorporates suggestions from the latest
2195 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
2196 * 2) That updating only on newer timestamps interferes with
2197 * our earlier PAWS tests, so this check should be solely
2198 * predicated on the sequence space of this segment.
2199 * 3) That we modify the segment boundary check to be
2200 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2201 * instead of RFC1323's
2202 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2203 * This modified check allows us to overcome RFC1323's
2204 * limitations as described in Stevens TCP/IP Illustrated
2205 * Vol. 2 p.869. In such cases, we can still calculate the
2206 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2207 */
2208 if (opti.ts_present &&
2209 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2210 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2211 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2212 tp->ts_recent_age = tcp_now;
2213 tp->ts_recent = opti.ts_val;
2214 }
2215
2216 /*
2217 * If the RST bit is set examine the state:
2218 * SYN_RECEIVED STATE:
2219 * If passive open, return to LISTEN state.
2220 * If active open, inform user that connection was refused.
2221 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
2222 * Inform user that connection was reset, and close tcb.
2223 * CLOSING, LAST_ACK, TIME_WAIT STATES
2224 * Close the tcb.
2225 */
2226 if (tiflags & TH_RST) {
2227 if (th->th_seq != tp->rcv_nxt)
2228 goto dropafterack_ratelim;
2229
2230 switch (tp->t_state) {
2231 case TCPS_SYN_RECEIVED:
2232 so->so_error = ECONNREFUSED;
2233 goto close;
2234
2235 case TCPS_ESTABLISHED:
2236 case TCPS_FIN_WAIT_1:
2237 case TCPS_FIN_WAIT_2:
2238 case TCPS_CLOSE_WAIT:
2239 so->so_error = ECONNRESET;
2240 close:
2241 tp->t_state = TCPS_CLOSED;
2242 TCP_STATINC(TCP_STAT_DROPS);
2243 tp = tcp_close(tp);
2244 goto drop;
2245
2246 case TCPS_CLOSING:
2247 case TCPS_LAST_ACK:
2248 case TCPS_TIME_WAIT:
2249 tp = tcp_close(tp);
2250 goto drop;
2251 }
2252 }
2253
2254 /*
2255 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2256 * we must be in a synchronized state. RFC791 states (under RST
2257 * generation) that any unacceptable segment (an out-of-order SYN
2258 * qualifies) received in a synchronized state must elicit only an
2259 * empty acknowledgment segment ... and the connection remains in
2260 * the same state.
2261 */
2262 if (tiflags & TH_SYN) {
2263 if (tp->rcv_nxt == th->th_seq) {
2264 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2265 TH_ACK);
2266 if (tcp_saveti)
2267 m_freem(tcp_saveti);
2268 return;
2269 }
2270
2271 goto dropafterack_ratelim;
2272 }
2273
2274 /*
2275 * If the ACK bit is off we drop the segment and return.
2276 */
2277 if ((tiflags & TH_ACK) == 0) {
2278 if (tp->t_flags & TF_ACKNOW)
2279 goto dropafterack;
2280 else
2281 goto drop;
2282 }
2283
2284 /*
2285 * Ack processing.
2286 */
2287 switch (tp->t_state) {
2288
2289 /*
2290 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2291 * ESTABLISHED state and continue processing, otherwise
2292 * send an RST.
2293 */
2294 case TCPS_SYN_RECEIVED:
2295 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2296 SEQ_GT(th->th_ack, tp->snd_max))
2297 goto dropwithreset;
2298 TCP_STATINC(TCP_STAT_CONNECTS);
2299 soisconnected(so);
2300 tcp_established(tp);
2301 /* Do window scaling? */
2302 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2303 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2304 tp->snd_scale = tp->requested_s_scale;
2305 tp->rcv_scale = tp->request_r_scale;
2306 }
2307 TCP_REASS_LOCK(tp);
2308 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
2309 TCP_REASS_UNLOCK(tp);
2310 tp->snd_wl1 = th->th_seq - 1;
2311 /* fall into ... */
2312
2313 /*
2314 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2315 * ACKs. If the ack is in the range
2316 * tp->snd_una < th->th_ack <= tp->snd_max
2317 * then advance tp->snd_una to th->th_ack and drop
2318 * data from the retransmission queue. If this ACK reflects
2319 * more up to date window information we update our window information.
2320 */
2321 case TCPS_ESTABLISHED:
2322 case TCPS_FIN_WAIT_1:
2323 case TCPS_FIN_WAIT_2:
2324 case TCPS_CLOSE_WAIT:
2325 case TCPS_CLOSING:
2326 case TCPS_LAST_ACK:
2327 case TCPS_TIME_WAIT:
2328
2329 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2330 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2331 TCP_STATINC(TCP_STAT_RCVDUPPACK);
2332 /*
2333 * If we have outstanding data (other than
2334 * a window probe), this is a completely
2335 * duplicate ack (ie, window info didn't
2336 * change), the ack is the biggest we've
2337 * seen and we've seen exactly our rexmt
2338 * threshhold of them, assume a packet
2339 * has been dropped and retransmit it.
2340 * Kludge snd_nxt & the congestion
2341 * window so we send only this one
2342 * packet.
2343 */
2344 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2345 th->th_ack != tp->snd_una)
2346 tp->t_dupacks = 0;
2347 else if (tp->t_partialacks < 0 &&
2348 (++tp->t_dupacks == tcprexmtthresh ||
2349 TCP_FACK_FASTRECOV(tp))) {
2350 /*
2351 * Do the fast retransmit, and adjust
2352 * congestion control paramenters.
2353 */
2354 if (tp->t_congctl->fast_retransmit(tp, th)) {
2355 /* False fast retransmit */
2356 break;
2357 } else
2358 goto drop;
2359 } else if (tp->t_dupacks > tcprexmtthresh) {
2360 tp->snd_cwnd += tp->t_segsz;
2361 (void) tcp_output(tp);
2362 goto drop;
2363 }
2364 } else {
2365 /*
2366 * If the ack appears to be very old, only
2367 * allow data that is in-sequence. This
2368 * makes it somewhat more difficult to insert
2369 * forged data by guessing sequence numbers.
2370 * Sent an ack to try to update the send
2371 * sequence number on the other side.
2372 */
2373 if (tlen && th->th_seq != tp->rcv_nxt &&
2374 SEQ_LT(th->th_ack,
2375 tp->snd_una - tp->max_sndwnd))
2376 goto dropafterack;
2377 }
2378 break;
2379 }
2380 /*
2381 * If the congestion window was inflated to account
2382 * for the other side's cached packets, retract it.
2383 */
2384 /* XXX: make SACK have his own congestion control
2385 * struct -- rpaulo */
2386 if (TCP_SACK_ENABLED(tp))
2387 tcp_sack_newack(tp, th);
2388 else
2389 tp->t_congctl->fast_retransmit_newack(tp, th);
2390 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2391 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2392 goto dropafterack;
2393 }
2394 acked = th->th_ack - tp->snd_una;
2395 tcps = TCP_STAT_GETREF();
2396 tcps[TCP_STAT_RCVACKPACK]++;
2397 tcps[TCP_STAT_RCVACKBYTE] += acked;
2398 TCP_STAT_PUTREF();
2399
2400 /*
2401 * If we have a timestamp reply, update smoothed
2402 * round trip time. If no timestamp is present but
2403 * transmit timer is running and timed sequence
2404 * number was acked, update smoothed round trip time.
2405 * Since we now have an rtt measurement, cancel the
2406 * timer backoff (cf., Phil Karn's retransmit alg.).
2407 * Recompute the initial retransmit timer.
2408 */
2409 if (ts_rtt)
2410 tcp_xmit_timer(tp, ts_rtt);
2411 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2412 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2413
2414 /*
2415 * If all outstanding data is acked, stop retransmit
2416 * timer and remember to restart (more output or persist).
2417 * If there is more data to be acked, restart retransmit
2418 * timer, using current (possibly backed-off) value.
2419 */
2420 if (th->th_ack == tp->snd_max) {
2421 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2422 needoutput = 1;
2423 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2424 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2425
2426 /*
2427 * New data has been acked, adjust the congestion window.
2428 */
2429 tp->t_congctl->newack(tp, th);
2430
2431 nd6_hint(tp);
2432 if (acked > so->so_snd.sb_cc) {
2433 tp->snd_wnd -= so->so_snd.sb_cc;
2434 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2435 ourfinisacked = 1;
2436 } else {
2437 if (acked > (tp->t_lastoff - tp->t_inoff))
2438 tp->t_lastm = NULL;
2439 sbdrop(&so->so_snd, acked);
2440 tp->t_lastoff -= acked;
2441 tp->snd_wnd -= acked;
2442 ourfinisacked = 0;
2443 }
2444 sowwakeup(so);
2445
2446 icmp_check(tp, th, acked);
2447
2448 tp->snd_una = th->th_ack;
2449 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2450 tp->snd_fack = tp->snd_una;
2451 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2452 tp->snd_nxt = tp->snd_una;
2453 if (SEQ_LT(tp->snd_high, tp->snd_una))
2454 tp->snd_high = tp->snd_una;
2455
2456 switch (tp->t_state) {
2457
2458 /*
2459 * In FIN_WAIT_1 STATE in addition to the processing
2460 * for the ESTABLISHED state if our FIN is now acknowledged
2461 * then enter FIN_WAIT_2.
2462 */
2463 case TCPS_FIN_WAIT_1:
2464 if (ourfinisacked) {
2465 /*
2466 * If we can't receive any more
2467 * data, then closing user can proceed.
2468 * Starting the timer is contrary to the
2469 * specification, but if we don't get a FIN
2470 * we'll hang forever.
2471 */
2472 if (so->so_state & SS_CANTRCVMORE) {
2473 soisdisconnected(so);
2474 if (tp->t_maxidle > 0)
2475 TCP_TIMER_ARM(tp, TCPT_2MSL,
2476 tp->t_maxidle);
2477 }
2478 tp->t_state = TCPS_FIN_WAIT_2;
2479 }
2480 break;
2481
2482 /*
2483 * In CLOSING STATE in addition to the processing for
2484 * the ESTABLISHED state if the ACK acknowledges our FIN
2485 * then enter the TIME-WAIT state, otherwise ignore
2486 * the segment.
2487 */
2488 case TCPS_CLOSING:
2489 if (ourfinisacked) {
2490 tp->t_state = TCPS_TIME_WAIT;
2491 tcp_canceltimers(tp);
2492 TCP_TIMER_ARM(tp, TCPT_2MSL,
2493 2 * PR_SLOWHZ * tcp_msl);
2494 soisdisconnected(so);
2495 }
2496 break;
2497
2498 /*
2499 * In LAST_ACK, we may still be waiting for data to drain
2500 * and/or to be acked, as well as for the ack of our FIN.
2501 * If our FIN is now acknowledged, delete the TCB,
2502 * enter the closed state and return.
2503 */
2504 case TCPS_LAST_ACK:
2505 if (ourfinisacked) {
2506 tp = tcp_close(tp);
2507 goto drop;
2508 }
2509 break;
2510
2511 /*
2512 * In TIME_WAIT state the only thing that should arrive
2513 * is a retransmission of the remote FIN. Acknowledge
2514 * it and restart the finack timer.
2515 */
2516 case TCPS_TIME_WAIT:
2517 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
2518 goto dropafterack;
2519 }
2520 }
2521
2522 step6:
2523 /*
2524 * Update window information.
2525 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2526 */
2527 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2528 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2529 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2530 /* keep track of pure window updates */
2531 if (tlen == 0 &&
2532 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2533 TCP_STATINC(TCP_STAT_RCVWINUPD);
2534 tp->snd_wnd = tiwin;
2535 tp->snd_wl1 = th->th_seq;
2536 tp->snd_wl2 = th->th_ack;
2537 if (tp->snd_wnd > tp->max_sndwnd)
2538 tp->max_sndwnd = tp->snd_wnd;
2539 needoutput = 1;
2540 }
2541
2542 /*
2543 * Process segments with URG.
2544 */
2545 if ((tiflags & TH_URG) && th->th_urp &&
2546 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2547 /*
2548 * This is a kludge, but if we receive and accept
2549 * random urgent pointers, we'll crash in
2550 * soreceive. It's hard to imagine someone
2551 * actually wanting to send this much urgent data.
2552 */
2553 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2554 th->th_urp = 0; /* XXX */
2555 tiflags &= ~TH_URG; /* XXX */
2556 goto dodata; /* XXX */
2557 }
2558 /*
2559 * If this segment advances the known urgent pointer,
2560 * then mark the data stream. This should not happen
2561 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2562 * a FIN has been received from the remote side.
2563 * In these states we ignore the URG.
2564 *
2565 * According to RFC961 (Assigned Protocols),
2566 * the urgent pointer points to the last octet
2567 * of urgent data. We continue, however,
2568 * to consider it to indicate the first octet
2569 * of data past the urgent section as the original
2570 * spec states (in one of two places).
2571 */
2572 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2573 tp->rcv_up = th->th_seq + th->th_urp;
2574 so->so_oobmark = so->so_rcv.sb_cc +
2575 (tp->rcv_up - tp->rcv_nxt) - 1;
2576 if (so->so_oobmark == 0)
2577 so->so_state |= SS_RCVATMARK;
2578 sohasoutofband(so);
2579 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2580 }
2581 /*
2582 * Remove out of band data so doesn't get presented to user.
2583 * This can happen independent of advancing the URG pointer,
2584 * but if two URG's are pending at once, some out-of-band
2585 * data may creep in... ick.
2586 */
2587 if (th->th_urp <= (u_int16_t) tlen
2588 #ifdef SO_OOBINLINE
2589 && (so->so_options & SO_OOBINLINE) == 0
2590 #endif
2591 )
2592 tcp_pulloutofband(so, th, m, hdroptlen);
2593 } else
2594 /*
2595 * If no out of band data is expected,
2596 * pull receive urgent pointer along
2597 * with the receive window.
2598 */
2599 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2600 tp->rcv_up = tp->rcv_nxt;
2601 dodata: /* XXX */
2602
2603 /*
2604 * Process the segment text, merging it into the TCP sequencing queue,
2605 * and arranging for acknowledgement of receipt if necessary.
2606 * This process logically involves adjusting tp->rcv_wnd as data
2607 * is presented to the user (this happens in tcp_usrreq.c,
2608 * case PRU_RCVD). If a FIN has already been received on this
2609 * connection then we just ignore the text.
2610 */
2611 if ((tlen || (tiflags & TH_FIN)) &&
2612 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2613 /*
2614 * Insert segment ti into reassembly queue of tcp with
2615 * control block tp. Return TH_FIN if reassembly now includes
2616 * a segment with FIN. The macro form does the common case
2617 * inline (segment is the next to be received on an
2618 * established connection, and the queue is empty),
2619 * avoiding linkage into and removal from the queue and
2620 * repetition of various conversions.
2621 * Set DELACK for segments received in order, but ack
2622 * immediately when segments are out of order
2623 * (so fast retransmit can work).
2624 */
2625 /* NOTE: this was TCP_REASS() macro, but used only once */
2626 TCP_REASS_LOCK(tp);
2627 if (th->th_seq == tp->rcv_nxt &&
2628 TAILQ_FIRST(&tp->segq) == NULL &&
2629 tp->t_state == TCPS_ESTABLISHED) {
2630 tcp_setup_ack(tp, th);
2631 tp->rcv_nxt += tlen;
2632 tiflags = th->th_flags & TH_FIN;
2633 tcps = TCP_STAT_GETREF();
2634 tcps[TCP_STAT_RCVPACK]++;
2635 tcps[TCP_STAT_RCVBYTE] += tlen;
2636 TCP_STAT_PUTREF();
2637 nd6_hint(tp);
2638 if (so->so_state & SS_CANTRCVMORE)
2639 m_freem(m);
2640 else {
2641 m_adj(m, hdroptlen);
2642 sbappendstream(&(so)->so_rcv, m);
2643 }
2644 TCP_REASS_UNLOCK(tp);
2645 sorwakeup(so);
2646 } else {
2647 m_adj(m, hdroptlen);
2648 tiflags = tcp_reass(tp, th, m, &tlen);
2649 tp->t_flags |= TF_ACKNOW;
2650 TCP_REASS_UNLOCK(tp);
2651 }
2652
2653 /*
2654 * Note the amount of data that peer has sent into
2655 * our window, in order to estimate the sender's
2656 * buffer size.
2657 */
2658 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2659 } else {
2660 m_freem(m);
2661 m = NULL;
2662 tiflags &= ~TH_FIN;
2663 }
2664
2665 /*
2666 * If FIN is received ACK the FIN and let the user know
2667 * that the connection is closing. Ignore a FIN received before
2668 * the connection is fully established.
2669 */
2670 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2671 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2672 socantrcvmore(so);
2673 tp->t_flags |= TF_ACKNOW;
2674 tp->rcv_nxt++;
2675 }
2676 switch (tp->t_state) {
2677
2678 /*
2679 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2680 */
2681 case TCPS_ESTABLISHED:
2682 tp->t_state = TCPS_CLOSE_WAIT;
2683 break;
2684
2685 /*
2686 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2687 * enter the CLOSING state.
2688 */
2689 case TCPS_FIN_WAIT_1:
2690 tp->t_state = TCPS_CLOSING;
2691 break;
2692
2693 /*
2694 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2695 * starting the time-wait timer, turning off the other
2696 * standard timers.
2697 */
2698 case TCPS_FIN_WAIT_2:
2699 tp->t_state = TCPS_TIME_WAIT;
2700 tcp_canceltimers(tp);
2701 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
2702 soisdisconnected(so);
2703 break;
2704
2705 /*
2706 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2707 */
2708 case TCPS_TIME_WAIT:
2709 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
2710 break;
2711 }
2712 }
2713 #ifdef TCP_DEBUG
2714 if (so->so_options & SO_DEBUG)
2715 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2716 #endif
2717
2718 /*
2719 * Return any desired output.
2720 */
2721 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
2722 (void) tcp_output(tp);
2723 }
2724 if (tcp_saveti)
2725 m_freem(tcp_saveti);
2726 return;
2727
2728 badsyn:
2729 /*
2730 * Received a bad SYN. Increment counters and dropwithreset.
2731 */
2732 TCP_STATINC(TCP_STAT_BADSYN);
2733 tp = NULL;
2734 goto dropwithreset;
2735
2736 dropafterack:
2737 /*
2738 * Generate an ACK dropping incoming segment if it occupies
2739 * sequence space, where the ACK reflects our state.
2740 */
2741 if (tiflags & TH_RST)
2742 goto drop;
2743 goto dropafterack2;
2744
2745 dropafterack_ratelim:
2746 /*
2747 * We may want to rate-limit ACKs against SYN/RST attack.
2748 */
2749 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
2750 tcp_ackdrop_ppslim) == 0) {
2751 /* XXX stat */
2752 goto drop;
2753 }
2754 /* ...fall into dropafterack2... */
2755
2756 dropafterack2:
2757 m_freem(m);
2758 tp->t_flags |= TF_ACKNOW;
2759 (void) tcp_output(tp);
2760 if (tcp_saveti)
2761 m_freem(tcp_saveti);
2762 return;
2763
2764 dropwithreset_ratelim:
2765 /*
2766 * We may want to rate-limit RSTs in certain situations,
2767 * particularly if we are sending an RST in response to
2768 * an attempt to connect to or otherwise communicate with
2769 * a port for which we have no socket.
2770 */
2771 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2772 tcp_rst_ppslim) == 0) {
2773 /* XXX stat */
2774 goto drop;
2775 }
2776 /* ...fall into dropwithreset... */
2777
2778 dropwithreset:
2779 /*
2780 * Generate a RST, dropping incoming segment.
2781 * Make ACK acceptable to originator of segment.
2782 */
2783 if (tiflags & TH_RST)
2784 goto drop;
2785
2786 switch (af) {
2787 #ifdef INET6
2788 case AF_INET6:
2789 /* For following calls to tcp_respond */
2790 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
2791 goto drop;
2792 break;
2793 #endif /* INET6 */
2794 case AF_INET:
2795 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
2796 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2797 goto drop;
2798 }
2799
2800 if (tiflags & TH_ACK)
2801 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
2802 else {
2803 if (tiflags & TH_SYN)
2804 tlen++;
2805 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
2806 TH_RST|TH_ACK);
2807 }
2808 if (tcp_saveti)
2809 m_freem(tcp_saveti);
2810 return;
2811
2812 badcsum:
2813 drop:
2814 /*
2815 * Drop space held by incoming segment and return.
2816 */
2817 if (tp) {
2818 if (tp->t_inpcb)
2819 so = tp->t_inpcb->inp_socket;
2820 #ifdef INET6
2821 else if (tp->t_in6pcb)
2822 so = tp->t_in6pcb->in6p_socket;
2823 #endif
2824 else
2825 so = NULL;
2826 #ifdef TCP_DEBUG
2827 if (so && (so->so_options & SO_DEBUG) != 0)
2828 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
2829 #endif
2830 }
2831 if (tcp_saveti)
2832 m_freem(tcp_saveti);
2833 m_freem(m);
2834 return;
2835 }
2836
2837 #ifdef TCP_SIGNATURE
2838 int
2839 tcp_signature_apply(void *fstate, void *data, u_int len)
2840 {
2841
2842 MD5Update(fstate, (u_char *)data, len);
2843 return (0);
2844 }
2845
2846 struct secasvar *
2847 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th)
2848 {
2849 struct secasvar *sav;
2850 #ifdef FAST_IPSEC
2851 union sockaddr_union dst;
2852 #endif
2853 struct ip *ip;
2854 struct ip6_hdr *ip6;
2855
2856 ip = mtod(m, struct ip *);
2857 switch (ip->ip_v) {
2858 case 4:
2859 ip = mtod(m, struct ip *);
2860 ip6 = NULL;
2861 break;
2862 case 6:
2863 ip = NULL;
2864 ip6 = mtod(m, struct ip6_hdr *);
2865 break;
2866 default:
2867 return (NULL);
2868 }
2869
2870 #ifdef FAST_IPSEC
2871 /* Extract the destination from the IP header in the mbuf. */
2872 bzero(&dst, sizeof(union sockaddr_union));
2873 if (ip !=NULL) {
2874 dst.sa.sa_len = sizeof(struct sockaddr_in);
2875 dst.sa.sa_family = AF_INET;
2876 dst.sin.sin_addr = ip->ip_dst;
2877 } else {
2878 dst.sa.sa_len = sizeof(struct sockaddr_in6);
2879 dst.sa.sa_family = AF_INET6;
2880 dst.sin6.sin6_addr = ip6->ip6_dst;
2881 }
2882
2883 /*
2884 * Look up an SADB entry which matches the address of the peer.
2885 */
2886 sav = KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI));
2887 #else
2888 if (ip)
2889 sav = key_allocsa(AF_INET, (void *)&ip->ip_src,
2890 (void *)&ip->ip_dst, IPPROTO_TCP,
2891 htonl(TCP_SIG_SPI), 0, 0);
2892 else
2893 sav = key_allocsa(AF_INET6, (void *)&ip6->ip6_src,
2894 (void *)&ip6->ip6_dst, IPPROTO_TCP,
2895 htonl(TCP_SIG_SPI), 0, 0);
2896 #endif
2897
2898 return (sav); /* freesav must be performed by caller */
2899 }
2900
2901 int
2902 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
2903 struct secasvar *sav, char *sig)
2904 {
2905 MD5_CTX ctx;
2906 struct ip *ip;
2907 struct ipovly *ipovly;
2908 struct ip6_hdr *ip6;
2909 struct ippseudo ippseudo;
2910 struct ip6_hdr_pseudo ip6pseudo;
2911 struct tcphdr th0;
2912 int l, tcphdrlen;
2913
2914 if (sav == NULL)
2915 return (-1);
2916
2917 tcphdrlen = th->th_off * 4;
2918
2919 switch (mtod(m, struct ip *)->ip_v) {
2920 case 4:
2921 ip = mtod(m, struct ip *);
2922 ip6 = NULL;
2923 break;
2924 case 6:
2925 ip = NULL;
2926 ip6 = mtod(m, struct ip6_hdr *);
2927 break;
2928 default:
2929 return (-1);
2930 }
2931
2932 MD5Init(&ctx);
2933
2934 if (ip) {
2935 memset(&ippseudo, 0, sizeof(ippseudo));
2936 ipovly = (struct ipovly *)ip;
2937 ippseudo.ippseudo_src = ipovly->ih_src;
2938 ippseudo.ippseudo_dst = ipovly->ih_dst;
2939 ippseudo.ippseudo_pad = 0;
2940 ippseudo.ippseudo_p = IPPROTO_TCP;
2941 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
2942 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
2943 } else {
2944 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
2945 ip6pseudo.ip6ph_src = ip6->ip6_src;
2946 in6_clearscope(&ip6pseudo.ip6ph_src);
2947 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
2948 in6_clearscope(&ip6pseudo.ip6ph_dst);
2949 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
2950 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
2951 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
2952 }
2953
2954 th0 = *th;
2955 th0.th_sum = 0;
2956 MD5Update(&ctx, (char *)&th0, sizeof(th0));
2957
2958 l = m->m_pkthdr.len - thoff - tcphdrlen;
2959 if (l > 0)
2960 m_apply(m, thoff + tcphdrlen,
2961 m->m_pkthdr.len - thoff - tcphdrlen,
2962 tcp_signature_apply, &ctx);
2963
2964 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
2965 MD5Final(sig, &ctx);
2966
2967 return (0);
2968 }
2969 #endif
2970
2971 static int
2972 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt,
2973 struct tcphdr *th,
2974 struct mbuf *m, int toff, struct tcp_opt_info *oi)
2975 {
2976 u_int16_t mss;
2977 int opt, optlen = 0;
2978 #ifdef TCP_SIGNATURE
2979 void *sigp = NULL;
2980 char sigbuf[TCP_SIGLEN];
2981 struct secasvar *sav = NULL;
2982 #endif
2983
2984 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
2985 opt = cp[0];
2986 if (opt == TCPOPT_EOL)
2987 break;
2988 if (opt == TCPOPT_NOP)
2989 optlen = 1;
2990 else {
2991 if (cnt < 2)
2992 break;
2993 optlen = cp[1];
2994 if (optlen < 2 || optlen > cnt)
2995 break;
2996 }
2997 switch (opt) {
2998
2999 default:
3000 continue;
3001
3002 case TCPOPT_MAXSEG:
3003 if (optlen != TCPOLEN_MAXSEG)
3004 continue;
3005 if (!(th->th_flags & TH_SYN))
3006 continue;
3007 if (TCPS_HAVERCVDSYN(tp->t_state))
3008 continue;
3009 bcopy(cp + 2, &mss, sizeof(mss));
3010 oi->maxseg = ntohs(mss);
3011 break;
3012
3013 case TCPOPT_WINDOW:
3014 if (optlen != TCPOLEN_WINDOW)
3015 continue;
3016 if (!(th->th_flags & TH_SYN))
3017 continue;
3018 if (TCPS_HAVERCVDSYN(tp->t_state))
3019 continue;
3020 tp->t_flags |= TF_RCVD_SCALE;
3021 tp->requested_s_scale = cp[2];
3022 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3023 #if 0 /*XXX*/
3024 char *p;
3025
3026 if (ip)
3027 p = ntohl(ip->ip_src);
3028 #ifdef INET6
3029 else if (ip6)
3030 p = ip6_sprintf(&ip6->ip6_src);
3031 #endif
3032 else
3033 p = "(unknown)";
3034 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3035 "assuming %d\n",
3036 tp->requested_s_scale, p,
3037 TCP_MAX_WINSHIFT);
3038 #else
3039 log(LOG_ERR, "TCP: invalid wscale %d, "
3040 "assuming %d\n",
3041 tp->requested_s_scale,
3042 TCP_MAX_WINSHIFT);
3043 #endif
3044 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3045 }
3046 break;
3047
3048 case TCPOPT_TIMESTAMP:
3049 if (optlen != TCPOLEN_TIMESTAMP)
3050 continue;
3051 oi->ts_present = 1;
3052 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
3053 NTOHL(oi->ts_val);
3054 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
3055 NTOHL(oi->ts_ecr);
3056
3057 if (!(th->th_flags & TH_SYN))
3058 continue;
3059 if (TCPS_HAVERCVDSYN(tp->t_state))
3060 continue;
3061 /*
3062 * A timestamp received in a SYN makes
3063 * it ok to send timestamp requests and replies.
3064 */
3065 tp->t_flags |= TF_RCVD_TSTMP;
3066 tp->ts_recent = oi->ts_val;
3067 tp->ts_recent_age = tcp_now;
3068 break;
3069
3070 case TCPOPT_SACK_PERMITTED:
3071 if (optlen != TCPOLEN_SACK_PERMITTED)
3072 continue;
3073 if (!(th->th_flags & TH_SYN))
3074 continue;
3075 if (TCPS_HAVERCVDSYN(tp->t_state))
3076 continue;
3077 if (tcp_do_sack) {
3078 tp->t_flags |= TF_SACK_PERMIT;
3079 tp->t_flags |= TF_WILL_SACK;
3080 }
3081 break;
3082
3083 case TCPOPT_SACK:
3084 tcp_sack_option(tp, th, cp, optlen);
3085 break;
3086 #ifdef TCP_SIGNATURE
3087 case TCPOPT_SIGNATURE:
3088 if (optlen != TCPOLEN_SIGNATURE)
3089 continue;
3090 if (sigp && bcmp(sigp, cp + 2, TCP_SIGLEN))
3091 return (-1);
3092
3093 sigp = sigbuf;
3094 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3095 tp->t_flags |= TF_SIGNATURE;
3096 break;
3097 #endif
3098 }
3099 }
3100
3101 #ifdef TCP_SIGNATURE
3102 if (tp->t_flags & TF_SIGNATURE) {
3103
3104 sav = tcp_signature_getsav(m, th);
3105
3106 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3107 return (-1);
3108 }
3109
3110 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) {
3111 if (sav == NULL)
3112 return (-1);
3113 #ifdef FAST_IPSEC
3114 KEY_FREESAV(&sav);
3115 #else
3116 key_freesav(sav);
3117 #endif
3118 return (-1);
3119 }
3120
3121 if (sigp) {
3122 char sig[TCP_SIGLEN];
3123
3124 tcp_fields_to_net(th);
3125 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3126 tcp_fields_to_host(th);
3127 if (sav == NULL)
3128 return (-1);
3129 #ifdef FAST_IPSEC
3130 KEY_FREESAV(&sav);
3131 #else
3132 key_freesav(sav);
3133 #endif
3134 return (-1);
3135 }
3136 tcp_fields_to_host(th);
3137
3138 if (bcmp(sig, sigp, TCP_SIGLEN)) {
3139 TCP_STATINC(TCP_STAT_BADSIG);
3140 if (sav == NULL)
3141 return (-1);
3142 #ifdef FAST_IPSEC
3143 KEY_FREESAV(&sav);
3144 #else
3145 key_freesav(sav);
3146 #endif
3147 return (-1);
3148 } else
3149 TCP_STATINC(TCP_STAT_GOODSIG);
3150
3151 key_sa_recordxfer(sav, m);
3152 #ifdef FAST_IPSEC
3153 KEY_FREESAV(&sav);
3154 #else
3155 key_freesav(sav);
3156 #endif
3157 }
3158 #endif
3159
3160 return (0);
3161 }
3162
3163 /*
3164 * Pull out of band byte out of a segment so
3165 * it doesn't appear in the user's data queue.
3166 * It is still reflected in the segment length for
3167 * sequencing purposes.
3168 */
3169 void
3170 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3171 struct mbuf *m, int off)
3172 {
3173 int cnt = off + th->th_urp - 1;
3174
3175 while (cnt >= 0) {
3176 if (m->m_len > cnt) {
3177 char *cp = mtod(m, char *) + cnt;
3178 struct tcpcb *tp = sototcpcb(so);
3179
3180 tp->t_iobc = *cp;
3181 tp->t_oobflags |= TCPOOB_HAVEDATA;
3182 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3183 m->m_len--;
3184 return;
3185 }
3186 cnt -= m->m_len;
3187 m = m->m_next;
3188 if (m == 0)
3189 break;
3190 }
3191 panic("tcp_pulloutofband");
3192 }
3193
3194 /*
3195 * Collect new round-trip time estimate
3196 * and update averages and current timeout.
3197 */
3198 void
3199 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3200 {
3201 int32_t delta;
3202
3203 TCP_STATINC(TCP_STAT_RTTUPDATED);
3204 if (tp->t_srtt != 0) {
3205 /*
3206 * srtt is stored as fixed point with 3 bits after the
3207 * binary point (i.e., scaled by 8). The following magic
3208 * is equivalent to the smoothing algorithm in rfc793 with
3209 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
3210 * point). Adjust rtt to origin 0.
3211 */
3212 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3213 if ((tp->t_srtt += delta) <= 0)
3214 tp->t_srtt = 1 << 2;
3215 /*
3216 * We accumulate a smoothed rtt variance (actually, a
3217 * smoothed mean difference), then set the retransmit
3218 * timer to smoothed rtt + 4 times the smoothed variance.
3219 * rttvar is stored as fixed point with 2 bits after the
3220 * binary point (scaled by 4). The following is
3221 * equivalent to rfc793 smoothing with an alpha of .75
3222 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
3223 * rfc793's wired-in beta.
3224 */
3225 if (delta < 0)
3226 delta = -delta;
3227 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3228 if ((tp->t_rttvar += delta) <= 0)
3229 tp->t_rttvar = 1 << 2;
3230 } else {
3231 /*
3232 * No rtt measurement yet - use the unsmoothed rtt.
3233 * Set the variance to half the rtt (so our first
3234 * retransmit happens at 3*rtt).
3235 */
3236 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3237 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3238 }
3239 tp->t_rtttime = 0;
3240 tp->t_rxtshift = 0;
3241
3242 /*
3243 * the retransmit should happen at rtt + 4 * rttvar.
3244 * Because of the way we do the smoothing, srtt and rttvar
3245 * will each average +1/2 tick of bias. When we compute
3246 * the retransmit timer, we want 1/2 tick of rounding and
3247 * 1 extra tick because of +-1/2 tick uncertainty in the
3248 * firing of the timer. The bias will give us exactly the
3249 * 1.5 tick we need. But, because the bias is
3250 * statistical, we have to test that we don't drop below
3251 * the minimum feasible timer (which is 2 ticks).
3252 */
3253 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3254 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3255
3256 /*
3257 * We received an ack for a packet that wasn't retransmitted;
3258 * it is probably safe to discard any error indications we've
3259 * received recently. This isn't quite right, but close enough
3260 * for now (a route might have failed after we sent a segment,
3261 * and the return path might not be symmetrical).
3262 */
3263 tp->t_softerror = 0;
3264 }
3265
3266
3267 /*
3268 * TCP compressed state engine. Currently used to hold compressed
3269 * state for SYN_RECEIVED.
3270 */
3271
3272 u_long syn_cache_count;
3273 u_int32_t syn_hash1, syn_hash2;
3274
3275 #define SYN_HASH(sa, sp, dp) \
3276 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
3277 ((u_int32_t)(sp)))^syn_hash2)))
3278 #ifndef INET6
3279 #define SYN_HASHALL(hash, src, dst) \
3280 do { \
3281 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3282 ((const struct sockaddr_in *)(src))->sin_port, \
3283 ((const struct sockaddr_in *)(dst))->sin_port); \
3284 } while (/*CONSTCOND*/ 0)
3285 #else
3286 #define SYN_HASH6(sa, sp, dp) \
3287 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
3288 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
3289 & 0x7fffffff)
3290
3291 #define SYN_HASHALL(hash, src, dst) \
3292 do { \
3293 switch ((src)->sa_family) { \
3294 case AF_INET: \
3295 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3296 ((const struct sockaddr_in *)(src))->sin_port, \
3297 ((const struct sockaddr_in *)(dst))->sin_port); \
3298 break; \
3299 case AF_INET6: \
3300 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \
3301 ((const struct sockaddr_in6 *)(src))->sin6_port, \
3302 ((const struct sockaddr_in6 *)(dst))->sin6_port); \
3303 break; \
3304 default: \
3305 hash = 0; \
3306 } \
3307 } while (/*CONSTCOND*/0)
3308 #endif /* INET6 */
3309
3310 POOL_INIT(syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, "synpl", NULL,
3311 IPL_SOFTNET);
3312
3313 /*
3314 * We don't estimate RTT with SYNs, so each packet starts with the default
3315 * RTT and each timer step has a fixed timeout value.
3316 */
3317 #define SYN_CACHE_TIMER_ARM(sc) \
3318 do { \
3319 TCPT_RANGESET((sc)->sc_rxtcur, \
3320 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
3321 TCPTV_REXMTMAX); \
3322 callout_reset(&(sc)->sc_timer, \
3323 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
3324 } while (/*CONSTCOND*/0)
3325
3326 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
3327
3328 static inline void
3329 syn_cache_rm(struct syn_cache *sc)
3330 {
3331 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket,
3332 sc, sc_bucketq);
3333 sc->sc_tp = NULL;
3334 LIST_REMOVE(sc, sc_tpq);
3335 tcp_syn_cache[sc->sc_bucketidx].sch_length--;
3336 callout_stop(&sc->sc_timer);
3337 syn_cache_count--;
3338 }
3339
3340 static inline void
3341 syn_cache_put(struct syn_cache *sc)
3342 {
3343 if (sc->sc_ipopts)
3344 (void) m_free(sc->sc_ipopts);
3345 rtcache_free(&sc->sc_route);
3346 sc->sc_flags |= SCF_DEAD;
3347 if (!callout_invoking(&sc->sc_timer))
3348 callout_schedule(&(sc)->sc_timer, 1);
3349 }
3350
3351 void
3352 syn_cache_init(void)
3353 {
3354 int i;
3355
3356 /* Initialize the hash buckets. */
3357 for (i = 0; i < tcp_syn_cache_size; i++)
3358 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
3359 }
3360
3361 void
3362 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
3363 {
3364 struct syn_cache_head *scp;
3365 struct syn_cache *sc2;
3366 int s;
3367
3368 /*
3369 * If there are no entries in the hash table, reinitialize
3370 * the hash secrets.
3371 */
3372 if (syn_cache_count == 0) {
3373 syn_hash1 = arc4random();
3374 syn_hash2 = arc4random();
3375 }
3376
3377 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
3378 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
3379 scp = &tcp_syn_cache[sc->sc_bucketidx];
3380
3381 /*
3382 * Make sure that we don't overflow the per-bucket
3383 * limit or the total cache size limit.
3384 */
3385 s = splsoftnet();
3386 if (scp->sch_length >= tcp_syn_bucket_limit) {
3387 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW);
3388 /*
3389 * The bucket is full. Toss the oldest element in the
3390 * bucket. This will be the first entry in the bucket.
3391 */
3392 sc2 = TAILQ_FIRST(&scp->sch_bucket);
3393 #ifdef DIAGNOSTIC
3394 /*
3395 * This should never happen; we should always find an
3396 * entry in our bucket.
3397 */
3398 if (sc2 == NULL)
3399 panic("syn_cache_insert: bucketoverflow: impossible");
3400 #endif
3401 syn_cache_rm(sc2);
3402 syn_cache_put(sc2); /* calls pool_put but see spl above */
3403 } else if (syn_cache_count >= tcp_syn_cache_limit) {
3404 struct syn_cache_head *scp2, *sce;
3405
3406 TCP_STATINC(TCP_STAT_SC_OVERFLOWED);
3407 /*
3408 * The cache is full. Toss the oldest entry in the
3409 * first non-empty bucket we can find.
3410 *
3411 * XXX We would really like to toss the oldest
3412 * entry in the cache, but we hope that this
3413 * condition doesn't happen very often.
3414 */
3415 scp2 = scp;
3416 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
3417 sce = &tcp_syn_cache[tcp_syn_cache_size];
3418 for (++scp2; scp2 != scp; scp2++) {
3419 if (scp2 >= sce)
3420 scp2 = &tcp_syn_cache[0];
3421 if (! TAILQ_EMPTY(&scp2->sch_bucket))
3422 break;
3423 }
3424 #ifdef DIAGNOSTIC
3425 /*
3426 * This should never happen; we should always find a
3427 * non-empty bucket.
3428 */
3429 if (scp2 == scp)
3430 panic("syn_cache_insert: cacheoverflow: "
3431 "impossible");
3432 #endif
3433 }
3434 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
3435 syn_cache_rm(sc2);
3436 syn_cache_put(sc2); /* calls pool_put but see spl above */
3437 }
3438
3439 /*
3440 * Initialize the entry's timer.
3441 */
3442 sc->sc_rxttot = 0;
3443 sc->sc_rxtshift = 0;
3444 SYN_CACHE_TIMER_ARM(sc);
3445
3446 /* Link it from tcpcb entry */
3447 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
3448
3449 /* Put it into the bucket. */
3450 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
3451 scp->sch_length++;
3452 syn_cache_count++;
3453
3454 TCP_STATINC(TCP_STAT_SC_ADDED);
3455 splx(s);
3456 }
3457
3458 /*
3459 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
3460 * If we have retransmitted an entry the maximum number of times, expire
3461 * that entry.
3462 */
3463 void
3464 syn_cache_timer(void *arg)
3465 {
3466 struct syn_cache *sc = arg;
3467
3468 mutex_enter(softnet_lock);
3469 KERNEL_LOCK(1, NULL);
3470 callout_ack(&sc->sc_timer);
3471
3472 if (__predict_false(sc->sc_flags & SCF_DEAD)) {
3473 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE);
3474 callout_destroy(&sc->sc_timer);
3475 pool_put(&syn_cache_pool, sc);
3476 KERNEL_UNLOCK_ONE(NULL);
3477 mutex_exit(softnet_lock);
3478 return;
3479 }
3480
3481 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3482 /* Drop it -- too many retransmissions. */
3483 goto dropit;
3484 }
3485
3486 /*
3487 * Compute the total amount of time this entry has
3488 * been on a queue. If this entry has been on longer
3489 * than the keep alive timer would allow, expire it.
3490 */
3491 sc->sc_rxttot += sc->sc_rxtcur;
3492 if (sc->sc_rxttot >= tcp_keepinit)
3493 goto dropit;
3494
3495 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED);
3496 (void) syn_cache_respond(sc, NULL);
3497
3498 /* Advance the timer back-off. */
3499 sc->sc_rxtshift++;
3500 SYN_CACHE_TIMER_ARM(sc);
3501
3502 KERNEL_UNLOCK_ONE(NULL);
3503 mutex_exit(softnet_lock);
3504 return;
3505
3506 dropit:
3507 TCP_STATINC(TCP_STAT_SC_TIMED_OUT);
3508 syn_cache_rm(sc);
3509 if (sc->sc_ipopts)
3510 (void) m_free(sc->sc_ipopts);
3511 rtcache_free(&sc->sc_route);
3512 callout_destroy(&sc->sc_timer);
3513 pool_put(&syn_cache_pool, sc);
3514 KERNEL_UNLOCK_ONE(NULL);
3515 mutex_exit(softnet_lock);
3516 }
3517
3518 /*
3519 * Remove syn cache created by the specified tcb entry,
3520 * because this does not make sense to keep them
3521 * (if there's no tcb entry, syn cache entry will never be used)
3522 */
3523 void
3524 syn_cache_cleanup(struct tcpcb *tp)
3525 {
3526 struct syn_cache *sc, *nsc;
3527 int s;
3528
3529 s = splsoftnet();
3530
3531 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3532 nsc = LIST_NEXT(sc, sc_tpq);
3533
3534 #ifdef DIAGNOSTIC
3535 if (sc->sc_tp != tp)
3536 panic("invalid sc_tp in syn_cache_cleanup");
3537 #endif
3538 syn_cache_rm(sc);
3539 syn_cache_put(sc); /* calls pool_put but see spl above */
3540 }
3541 /* just for safety */
3542 LIST_INIT(&tp->t_sc);
3543
3544 splx(s);
3545 }
3546
3547 /*
3548 * Find an entry in the syn cache.
3549 */
3550 struct syn_cache *
3551 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
3552 struct syn_cache_head **headp)
3553 {
3554 struct syn_cache *sc;
3555 struct syn_cache_head *scp;
3556 u_int32_t hash;
3557 int s;
3558
3559 SYN_HASHALL(hash, src, dst);
3560
3561 scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3562 *headp = scp;
3563 s = splsoftnet();
3564 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3565 sc = TAILQ_NEXT(sc, sc_bucketq)) {
3566 if (sc->sc_hash != hash)
3567 continue;
3568 if (!bcmp(&sc->sc_src, src, src->sa_len) &&
3569 !bcmp(&sc->sc_dst, dst, dst->sa_len)) {
3570 splx(s);
3571 return (sc);
3572 }
3573 }
3574 splx(s);
3575 return (NULL);
3576 }
3577
3578 /*
3579 * This function gets called when we receive an ACK for a
3580 * socket in the LISTEN state. We look up the connection
3581 * in the syn cache, and if its there, we pull it out of
3582 * the cache and turn it into a full-blown connection in
3583 * the SYN-RECEIVED state.
3584 *
3585 * The return values may not be immediately obvious, and their effects
3586 * can be subtle, so here they are:
3587 *
3588 * NULL SYN was not found in cache; caller should drop the
3589 * packet and send an RST.
3590 *
3591 * -1 We were unable to create the new connection, and are
3592 * aborting it. An ACK,RST is being sent to the peer
3593 * (unless we got screwey sequence numbners; see below),
3594 * because the 3-way handshake has been completed. Caller
3595 * should not free the mbuf, since we may be using it. If
3596 * we are not, we will free it.
3597 *
3598 * Otherwise, the return value is a pointer to the new socket
3599 * associated with the connection.
3600 */
3601 struct socket *
3602 syn_cache_get(struct sockaddr *src, struct sockaddr *dst,
3603 struct tcphdr *th, unsigned int hlen, unsigned int tlen,
3604 struct socket *so, struct mbuf *m)
3605 {
3606 struct syn_cache *sc;
3607 struct syn_cache_head *scp;
3608 struct inpcb *inp = NULL;
3609 #ifdef INET6
3610 struct in6pcb *in6p = NULL;
3611 #endif
3612 struct tcpcb *tp = 0;
3613 struct mbuf *am;
3614 int s;
3615 struct socket *oso;
3616
3617 s = splsoftnet();
3618 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3619 splx(s);
3620 return (NULL);
3621 }
3622
3623 /*
3624 * Verify the sequence and ack numbers. Try getting the correct
3625 * response again.
3626 */
3627 if ((th->th_ack != sc->sc_iss + 1) ||
3628 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3629 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3630 (void) syn_cache_respond(sc, m);
3631 splx(s);
3632 return ((struct socket *)(-1));
3633 }
3634
3635 /* Remove this cache entry */
3636 syn_cache_rm(sc);
3637 splx(s);
3638
3639 /*
3640 * Ok, create the full blown connection, and set things up
3641 * as they would have been set up if we had created the
3642 * connection when the SYN arrived. If we can't create
3643 * the connection, abort it.
3644 */
3645 /*
3646 * inp still has the OLD in_pcb stuff, set the
3647 * v6-related flags on the new guy, too. This is
3648 * done particularly for the case where an AF_INET6
3649 * socket is bound only to a port, and a v4 connection
3650 * comes in on that port.
3651 * we also copy the flowinfo from the original pcb
3652 * to the new one.
3653 */
3654 oso = so;
3655 so = sonewconn(so, SS_ISCONNECTED);
3656 if (so == NULL)
3657 goto resetandabort;
3658
3659 switch (so->so_proto->pr_domain->dom_family) {
3660 #ifdef INET
3661 case AF_INET:
3662 inp = sotoinpcb(so);
3663 break;
3664 #endif
3665 #ifdef INET6
3666 case AF_INET6:
3667 in6p = sotoin6pcb(so);
3668 break;
3669 #endif
3670 }
3671 switch (src->sa_family) {
3672 #ifdef INET
3673 case AF_INET:
3674 if (inp) {
3675 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
3676 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
3677 inp->inp_options = ip_srcroute();
3678 in_pcbstate(inp, INP_BOUND);
3679 if (inp->inp_options == NULL) {
3680 inp->inp_options = sc->sc_ipopts;
3681 sc->sc_ipopts = NULL;
3682 }
3683 }
3684 #ifdef INET6
3685 else if (in6p) {
3686 /* IPv4 packet to AF_INET6 socket */
3687 bzero(&in6p->in6p_laddr, sizeof(in6p->in6p_laddr));
3688 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
3689 bcopy(&((struct sockaddr_in *)dst)->sin_addr,
3690 &in6p->in6p_laddr.s6_addr32[3],
3691 sizeof(((struct sockaddr_in *)dst)->sin_addr));
3692 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
3693 in6totcpcb(in6p)->t_family = AF_INET;
3694 if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
3695 in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
3696 else
3697 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
3698 in6_pcbstate(in6p, IN6P_BOUND);
3699 }
3700 #endif
3701 break;
3702 #endif
3703 #ifdef INET6
3704 case AF_INET6:
3705 if (in6p) {
3706 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
3707 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
3708 in6_pcbstate(in6p, IN6P_BOUND);
3709 }
3710 break;
3711 #endif
3712 }
3713 #ifdef INET6
3714 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
3715 struct in6pcb *oin6p = sotoin6pcb(oso);
3716 /* inherit socket options from the listening socket */
3717 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
3718 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
3719 m_freem(in6p->in6p_options);
3720 in6p->in6p_options = 0;
3721 }
3722 ip6_savecontrol(in6p, &in6p->in6p_options,
3723 mtod(m, struct ip6_hdr *), m);
3724 }
3725 #endif
3726
3727 #if defined(IPSEC) || defined(FAST_IPSEC)
3728 /*
3729 * we make a copy of policy, instead of sharing the policy,
3730 * for better behavior in terms of SA lookup and dead SA removal.
3731 */
3732 if (inp) {
3733 /* copy old policy into new socket's */
3734 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
3735 printf("tcp_input: could not copy policy\n");
3736 }
3737 #ifdef INET6
3738 else if (in6p) {
3739 /* copy old policy into new socket's */
3740 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
3741 in6p->in6p_sp))
3742 printf("tcp_input: could not copy policy\n");
3743 }
3744 #endif
3745 #endif
3746
3747 /*
3748 * Give the new socket our cached route reference.
3749 */
3750 if (inp) {
3751 rtcache_copy(&inp->inp_route, &sc->sc_route);
3752 rtcache_free(&sc->sc_route);
3753 }
3754 #ifdef INET6
3755 else {
3756 rtcache_copy(&in6p->in6p_route, &sc->sc_route);
3757 rtcache_free(&sc->sc_route);
3758 }
3759 #endif
3760
3761 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
3762 if (am == NULL)
3763 goto resetandabort;
3764 MCLAIM(am, &tcp_mowner);
3765 am->m_len = src->sa_len;
3766 bcopy(src, mtod(am, void *), src->sa_len);
3767 if (inp) {
3768 if (in_pcbconnect(inp, am, &lwp0)) {
3769 (void) m_free(am);
3770 goto resetandabort;
3771 }
3772 }
3773 #ifdef INET6
3774 else if (in6p) {
3775 if (src->sa_family == AF_INET) {
3776 /* IPv4 packet to AF_INET6 socket */
3777 struct sockaddr_in6 *sin6;
3778 sin6 = mtod(am, struct sockaddr_in6 *);
3779 am->m_len = sizeof(*sin6);
3780 bzero(sin6, sizeof(*sin6));
3781 sin6->sin6_family = AF_INET6;
3782 sin6->sin6_len = sizeof(*sin6);
3783 sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
3784 sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
3785 bcopy(&((struct sockaddr_in *)src)->sin_addr,
3786 &sin6->sin6_addr.s6_addr32[3],
3787 sizeof(sin6->sin6_addr.s6_addr32[3]));
3788 }
3789 if (in6_pcbconnect(in6p, am, NULL)) {
3790 (void) m_free(am);
3791 goto resetandabort;
3792 }
3793 }
3794 #endif
3795 else {
3796 (void) m_free(am);
3797 goto resetandabort;
3798 }
3799 (void) m_free(am);
3800
3801 if (inp)
3802 tp = intotcpcb(inp);
3803 #ifdef INET6
3804 else if (in6p)
3805 tp = in6totcpcb(in6p);
3806 #endif
3807 else
3808 tp = NULL;
3809 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
3810 if (sc->sc_request_r_scale != 15) {
3811 tp->requested_s_scale = sc->sc_requested_s_scale;
3812 tp->request_r_scale = sc->sc_request_r_scale;
3813 tp->snd_scale = sc->sc_requested_s_scale;
3814 tp->rcv_scale = sc->sc_request_r_scale;
3815 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
3816 }
3817 if (sc->sc_flags & SCF_TIMESTAMP)
3818 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
3819 tp->ts_timebase = sc->sc_timebase;
3820
3821 tp->t_template = tcp_template(tp);
3822 if (tp->t_template == 0) {
3823 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
3824 so = NULL;
3825 m_freem(m);
3826 goto abort;
3827 }
3828
3829 tp->iss = sc->sc_iss;
3830 tp->irs = sc->sc_irs;
3831 tcp_sendseqinit(tp);
3832 tcp_rcvseqinit(tp);
3833 tp->t_state = TCPS_SYN_RECEIVED;
3834 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit);
3835 TCP_STATINC(TCP_STAT_ACCEPTS);
3836
3837 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack)
3838 tp->t_flags |= TF_WILL_SACK;
3839
3840 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn)
3841 tp->t_flags |= TF_ECN_PERMIT;
3842
3843 #ifdef TCP_SIGNATURE
3844 if (sc->sc_flags & SCF_SIGNATURE)
3845 tp->t_flags |= TF_SIGNATURE;
3846 #endif
3847
3848 /* Initialize tp->t_ourmss before we deal with the peer's! */
3849 tp->t_ourmss = sc->sc_ourmaxseg;
3850 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
3851
3852 /*
3853 * Initialize the initial congestion window. If we
3854 * had to retransmit the SYN,ACK, we must initialize cwnd
3855 * to 1 segment (i.e. the Loss Window).
3856 */
3857 if (sc->sc_rxtshift)
3858 tp->snd_cwnd = tp->t_peermss;
3859 else {
3860 int ss = tcp_init_win;
3861 #ifdef INET
3862 if (inp != NULL && in_localaddr(inp->inp_faddr))
3863 ss = tcp_init_win_local;
3864 #endif
3865 #ifdef INET6
3866 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
3867 ss = tcp_init_win_local;
3868 #endif
3869 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
3870 }
3871
3872 tcp_rmx_rtt(tp);
3873 tp->snd_wl1 = sc->sc_irs;
3874 tp->rcv_up = sc->sc_irs + 1;
3875
3876 /*
3877 * This is what whould have happened in tcp_output() when
3878 * the SYN,ACK was sent.
3879 */
3880 tp->snd_up = tp->snd_una;
3881 tp->snd_max = tp->snd_nxt = tp->iss+1;
3882 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
3883 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
3884 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
3885 tp->last_ack_sent = tp->rcv_nxt;
3886 tp->t_partialacks = -1;
3887 tp->t_dupacks = 0;
3888
3889 TCP_STATINC(TCP_STAT_SC_COMPLETED);
3890 s = splsoftnet();
3891 syn_cache_put(sc);
3892 splx(s);
3893 return (so);
3894
3895 resetandabort:
3896 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
3897 abort:
3898 if (so != NULL) {
3899 (void) soqremque(so, 1);
3900 (void) soabort(so);
3901 mutex_enter(softnet_lock);
3902 }
3903 s = splsoftnet();
3904 syn_cache_put(sc);
3905 splx(s);
3906 TCP_STATINC(TCP_STAT_SC_ABORTED);
3907 return ((struct socket *)(-1));
3908 }
3909
3910 /*
3911 * This function is called when we get a RST for a
3912 * non-existent connection, so that we can see if the
3913 * connection is in the syn cache. If it is, zap it.
3914 */
3915
3916 void
3917 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th)
3918 {
3919 struct syn_cache *sc;
3920 struct syn_cache_head *scp;
3921 int s = splsoftnet();
3922
3923 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3924 splx(s);
3925 return;
3926 }
3927 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
3928 SEQ_GT(th->th_seq, sc->sc_irs+1)) {
3929 splx(s);
3930 return;
3931 }
3932 syn_cache_rm(sc);
3933 TCP_STATINC(TCP_STAT_SC_RESET);
3934 syn_cache_put(sc); /* calls pool_put but see spl above */
3935 splx(s);
3936 }
3937
3938 void
3939 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
3940 struct tcphdr *th)
3941 {
3942 struct syn_cache *sc;
3943 struct syn_cache_head *scp;
3944 int s;
3945
3946 s = splsoftnet();
3947 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3948 splx(s);
3949 return;
3950 }
3951 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
3952 if (ntohl (th->th_seq) != sc->sc_iss) {
3953 splx(s);
3954 return;
3955 }
3956
3957 /*
3958 * If we've retransmitted 3 times and this is our second error,
3959 * we remove the entry. Otherwise, we allow it to continue on.
3960 * This prevents us from incorrectly nuking an entry during a
3961 * spurious network outage.
3962 *
3963 * See tcp_notify().
3964 */
3965 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
3966 sc->sc_flags |= SCF_UNREACH;
3967 splx(s);
3968 return;
3969 }
3970
3971 syn_cache_rm(sc);
3972 TCP_STATINC(TCP_STAT_SC_UNREACH);
3973 syn_cache_put(sc); /* calls pool_put but see spl above */
3974 splx(s);
3975 }
3976
3977 /*
3978 * Given a LISTEN socket and an inbound SYN request, add
3979 * this to the syn cache, and send back a segment:
3980 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
3981 * to the source.
3982 *
3983 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
3984 * Doing so would require that we hold onto the data and deliver it
3985 * to the application. However, if we are the target of a SYN-flood
3986 * DoS attack, an attacker could send data which would eventually
3987 * consume all available buffer space if it were ACKed. By not ACKing
3988 * the data, we avoid this DoS scenario.
3989 */
3990
3991 int
3992 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
3993 unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp,
3994 int optlen, struct tcp_opt_info *oi)
3995 {
3996 struct tcpcb tb, *tp;
3997 long win;
3998 struct syn_cache *sc;
3999 struct syn_cache_head *scp;
4000 struct mbuf *ipopts;
4001 struct tcp_opt_info opti;
4002 int s;
4003
4004 tp = sototcpcb(so);
4005
4006 bzero(&opti, sizeof(opti));
4007
4008 /*
4009 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
4010 *
4011 * Note this check is performed in tcp_input() very early on.
4012 */
4013
4014 /*
4015 * Initialize some local state.
4016 */
4017 win = sbspace(&so->so_rcv);
4018 if (win > TCP_MAXWIN)
4019 win = TCP_MAXWIN;
4020
4021 switch (src->sa_family) {
4022 #ifdef INET
4023 case AF_INET:
4024 /*
4025 * Remember the IP options, if any.
4026 */
4027 ipopts = ip_srcroute();
4028 break;
4029 #endif
4030 default:
4031 ipopts = NULL;
4032 }
4033
4034 #ifdef TCP_SIGNATURE
4035 if (optp || (tp->t_flags & TF_SIGNATURE))
4036 #else
4037 if (optp)
4038 #endif
4039 {
4040 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
4041 #ifdef TCP_SIGNATURE
4042 tb.t_flags |= (tp->t_flags & TF_SIGNATURE);
4043 #endif
4044 tb.t_state = TCPS_LISTEN;
4045 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len -
4046 sizeof(struct tcphdr) - optlen - hlen, oi) < 0)
4047 return (0);
4048 } else
4049 tb.t_flags = 0;
4050
4051 /*
4052 * See if we already have an entry for this connection.
4053 * If we do, resend the SYN,ACK. We do not count this
4054 * as a retransmission (XXX though maybe we should).
4055 */
4056 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
4057 TCP_STATINC(TCP_STAT_SC_DUPESYN);
4058 if (ipopts) {
4059 /*
4060 * If we were remembering a previous source route,
4061 * forget it and use the new one we've been given.
4062 */
4063 if (sc->sc_ipopts)
4064 (void) m_free(sc->sc_ipopts);
4065 sc->sc_ipopts = ipopts;
4066 }
4067 sc->sc_timestamp = tb.ts_recent;
4068 if (syn_cache_respond(sc, m) == 0) {
4069 uint64_t *tcps = TCP_STAT_GETREF();
4070 tcps[TCP_STAT_SNDACKS]++;
4071 tcps[TCP_STAT_SNDTOTAL]++;
4072 TCP_STAT_PUTREF();
4073 }
4074 return (1);
4075 }
4076
4077 s = splsoftnet();
4078 sc = pool_get(&syn_cache_pool, PR_NOWAIT);
4079 splx(s);
4080 if (sc == NULL) {
4081 if (ipopts)
4082 (void) m_free(ipopts);
4083 return (0);
4084 }
4085
4086 /*
4087 * Fill in the cache, and put the necessary IP and TCP
4088 * options into the reply.
4089 */
4090 bzero(sc, sizeof(struct syn_cache));
4091 callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
4092 bcopy(src, &sc->sc_src, src->sa_len);
4093 bcopy(dst, &sc->sc_dst, dst->sa_len);
4094 sc->sc_flags = 0;
4095 sc->sc_ipopts = ipopts;
4096 sc->sc_irs = th->th_seq;
4097 switch (src->sa_family) {
4098 #ifdef INET
4099 case AF_INET:
4100 {
4101 struct sockaddr_in *srcin = (void *) src;
4102 struct sockaddr_in *dstin = (void *) dst;
4103
4104 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
4105 &srcin->sin_addr, dstin->sin_port,
4106 srcin->sin_port, sizeof(dstin->sin_addr), 0);
4107 break;
4108 }
4109 #endif /* INET */
4110 #ifdef INET6
4111 case AF_INET6:
4112 {
4113 struct sockaddr_in6 *srcin6 = (void *) src;
4114 struct sockaddr_in6 *dstin6 = (void *) dst;
4115
4116 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
4117 &srcin6->sin6_addr, dstin6->sin6_port,
4118 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
4119 break;
4120 }
4121 #endif /* INET6 */
4122 }
4123 sc->sc_peermaxseg = oi->maxseg;
4124 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
4125 m->m_pkthdr.rcvif : NULL,
4126 sc->sc_src.sa.sa_family);
4127 sc->sc_win = win;
4128 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */
4129 sc->sc_timestamp = tb.ts_recent;
4130 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
4131 (TF_REQ_TSTMP|TF_RCVD_TSTMP))
4132 sc->sc_flags |= SCF_TIMESTAMP;
4133 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
4134 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
4135 sc->sc_requested_s_scale = tb.requested_s_scale;
4136 sc->sc_request_r_scale = 0;
4137 /*
4138 * Pick the smallest possible scaling factor that
4139 * will still allow us to scale up to sb_max.
4140 *
4141 * We do this because there are broken firewalls that
4142 * will corrupt the window scale option, leading to
4143 * the other endpoint believing that our advertised
4144 * window is unscaled. At scale factors larger than
4145 * 5 the unscaled window will drop below 1500 bytes,
4146 * leading to serious problems when traversing these
4147 * broken firewalls.
4148 *
4149 * With the default sbmax of 256K, a scale factor
4150 * of 3 will be chosen by this algorithm. Those who
4151 * choose a larger sbmax should watch out
4152 * for the compatiblity problems mentioned above.
4153 *
4154 * RFC1323: The Window field in a SYN (i.e., a <SYN>
4155 * or <SYN,ACK>) segment itself is never scaled.
4156 */
4157 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
4158 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
4159 sc->sc_request_r_scale++;
4160 } else {
4161 sc->sc_requested_s_scale = 15;
4162 sc->sc_request_r_scale = 15;
4163 }
4164 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack)
4165 sc->sc_flags |= SCF_SACK_PERMIT;
4166
4167 /*
4168 * ECN setup packet recieved.
4169 */
4170 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn)
4171 sc->sc_flags |= SCF_ECN_PERMIT;
4172
4173 #ifdef TCP_SIGNATURE
4174 if (tb.t_flags & TF_SIGNATURE)
4175 sc->sc_flags |= SCF_SIGNATURE;
4176 #endif
4177 sc->sc_tp = tp;
4178 if (syn_cache_respond(sc, m) == 0) {
4179 uint64_t *tcps = TCP_STAT_GETREF();
4180 tcps[TCP_STAT_SNDACKS]++;
4181 tcps[TCP_STAT_SNDTOTAL]++;
4182 TCP_STAT_PUTREF();
4183 syn_cache_insert(sc, tp);
4184 } else {
4185 s = splsoftnet();
4186 /*
4187 * syn_cache_put() will try to schedule the timer, so
4188 * we need to initialize it
4189 */
4190 SYN_CACHE_TIMER_ARM(sc);
4191 syn_cache_put(sc);
4192 splx(s);
4193 TCP_STATINC(TCP_STAT_SC_DROPPED);
4194 }
4195 return (1);
4196 }
4197
4198 int
4199 syn_cache_respond(struct syn_cache *sc, struct mbuf *m)
4200 {
4201 #ifdef INET6
4202 struct rtentry *rt;
4203 #endif
4204 struct route *ro;
4205 u_int8_t *optp;
4206 int optlen, error;
4207 u_int16_t tlen;
4208 struct ip *ip = NULL;
4209 #ifdef INET6
4210 struct ip6_hdr *ip6 = NULL;
4211 #endif
4212 struct tcpcb *tp = NULL;
4213 struct tcphdr *th;
4214 u_int hlen;
4215 struct socket *so;
4216
4217 ro = &sc->sc_route;
4218 switch (sc->sc_src.sa.sa_family) {
4219 case AF_INET:
4220 hlen = sizeof(struct ip);
4221 break;
4222 #ifdef INET6
4223 case AF_INET6:
4224 hlen = sizeof(struct ip6_hdr);
4225 break;
4226 #endif
4227 default:
4228 if (m)
4229 m_freem(m);
4230 return (EAFNOSUPPORT);
4231 }
4232
4233 /* Compute the size of the TCP options. */
4234 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
4235 ((sc->sc_flags & SCF_SACK_PERMIT) ? (TCPOLEN_SACK_PERMITTED + 2) : 0) +
4236 #ifdef TCP_SIGNATURE
4237 ((sc->sc_flags & SCF_SIGNATURE) ? (TCPOLEN_SIGNATURE + 2) : 0) +
4238 #endif
4239 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
4240
4241 tlen = hlen + sizeof(struct tcphdr) + optlen;
4242
4243 /*
4244 * Create the IP+TCP header from scratch.
4245 */
4246 if (m)
4247 m_freem(m);
4248 #ifdef DIAGNOSTIC
4249 if (max_linkhdr + tlen > MCLBYTES)
4250 return (ENOBUFS);
4251 #endif
4252 MGETHDR(m, M_DONTWAIT, MT_DATA);
4253 if (m && tlen > MHLEN) {
4254 MCLGET(m, M_DONTWAIT);
4255 if ((m->m_flags & M_EXT) == 0) {
4256 m_freem(m);
4257 m = NULL;
4258 }
4259 }
4260 if (m == NULL)
4261 return (ENOBUFS);
4262 MCLAIM(m, &tcp_tx_mowner);
4263
4264 /* Fixup the mbuf. */
4265 m->m_data += max_linkhdr;
4266 m->m_len = m->m_pkthdr.len = tlen;
4267 if (sc->sc_tp) {
4268 tp = sc->sc_tp;
4269 if (tp->t_inpcb)
4270 so = tp->t_inpcb->inp_socket;
4271 #ifdef INET6
4272 else if (tp->t_in6pcb)
4273 so = tp->t_in6pcb->in6p_socket;
4274 #endif
4275 else
4276 so = NULL;
4277 } else
4278 so = NULL;
4279 m->m_pkthdr.rcvif = NULL;
4280 memset(mtod(m, u_char *), 0, tlen);
4281
4282 switch (sc->sc_src.sa.sa_family) {
4283 case AF_INET:
4284 ip = mtod(m, struct ip *);
4285 ip->ip_v = 4;
4286 ip->ip_dst = sc->sc_src.sin.sin_addr;
4287 ip->ip_src = sc->sc_dst.sin.sin_addr;
4288 ip->ip_p = IPPROTO_TCP;
4289 th = (struct tcphdr *)(ip + 1);
4290 th->th_dport = sc->sc_src.sin.sin_port;
4291 th->th_sport = sc->sc_dst.sin.sin_port;
4292 break;
4293 #ifdef INET6
4294 case AF_INET6:
4295 ip6 = mtod(m, struct ip6_hdr *);
4296 ip6->ip6_vfc = IPV6_VERSION;
4297 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
4298 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
4299 ip6->ip6_nxt = IPPROTO_TCP;
4300 /* ip6_plen will be updated in ip6_output() */
4301 th = (struct tcphdr *)(ip6 + 1);
4302 th->th_dport = sc->sc_src.sin6.sin6_port;
4303 th->th_sport = sc->sc_dst.sin6.sin6_port;
4304 break;
4305 #endif
4306 default:
4307 th = NULL;
4308 }
4309
4310 th->th_seq = htonl(sc->sc_iss);
4311 th->th_ack = htonl(sc->sc_irs + 1);
4312 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
4313 th->th_flags = TH_SYN|TH_ACK;
4314 th->th_win = htons(sc->sc_win);
4315 /* th_sum already 0 */
4316 /* th_urp already 0 */
4317
4318 /* Tack on the TCP options. */
4319 optp = (u_int8_t *)(th + 1);
4320 *optp++ = TCPOPT_MAXSEG;
4321 *optp++ = 4;
4322 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
4323 *optp++ = sc->sc_ourmaxseg & 0xff;
4324
4325 if (sc->sc_request_r_scale != 15) {
4326 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
4327 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
4328 sc->sc_request_r_scale);
4329 optp += 4;
4330 }
4331
4332 if (sc->sc_flags & SCF_TIMESTAMP) {
4333 u_int32_t *lp = (u_int32_t *)(optp);
4334 /* Form timestamp option as shown in appendix A of RFC 1323. */
4335 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
4336 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
4337 *lp = htonl(sc->sc_timestamp);
4338 optp += TCPOLEN_TSTAMP_APPA;
4339 }
4340
4341 if (sc->sc_flags & SCF_SACK_PERMIT) {
4342 u_int8_t *p = optp;
4343
4344 /* Let the peer know that we will SACK. */
4345 p[0] = TCPOPT_SACK_PERMITTED;
4346 p[1] = 2;
4347 p[2] = TCPOPT_NOP;
4348 p[3] = TCPOPT_NOP;
4349 optp += 4;
4350 }
4351
4352 /*
4353 * Send ECN SYN-ACK setup packet.
4354 * Routes can be asymetric, so, even if we receive a packet
4355 * with ECE and CWR set, we must not assume no one will block
4356 * the ECE packet we are about to send.
4357 */
4358 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp &&
4359 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) {
4360 th->th_flags |= TH_ECE;
4361 TCP_STATINC(TCP_STAT_ECN_SHS);
4362
4363 /*
4364 * draft-ietf-tcpm-ecnsyn-00.txt
4365 *
4366 * "[...] a TCP node MAY respond to an ECN-setup
4367 * SYN packet by setting ECT in the responding
4368 * ECN-setup SYN/ACK packet, indicating to routers
4369 * that the SYN/ACK packet is ECN-Capable.
4370 * This allows a congested router along the path
4371 * to mark the packet instead of dropping the
4372 * packet as an indication of congestion."
4373 *
4374 * "[...] There can be a great benefit in setting
4375 * an ECN-capable codepoint in SYN/ACK packets [...]
4376 * Congestion is most likely to occur in
4377 * the server-to-client direction. As a result,
4378 * setting an ECN-capable codepoint in SYN/ACK
4379 * packets can reduce the occurence of three-second
4380 * retransmit timeouts resulting from the drop
4381 * of SYN/ACK packets."
4382 *
4383 * Page 4 and 6, January 2006.
4384 */
4385
4386 switch (sc->sc_src.sa.sa_family) {
4387 #ifdef INET
4388 case AF_INET:
4389 ip->ip_tos |= IPTOS_ECN_ECT0;
4390 break;
4391 #endif
4392 #ifdef INET6
4393 case AF_INET6:
4394 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
4395 break;
4396 #endif
4397 }
4398 TCP_STATINC(TCP_STAT_ECN_ECT);
4399 }
4400
4401 #ifdef TCP_SIGNATURE
4402 if (sc->sc_flags & SCF_SIGNATURE) {
4403 struct secasvar *sav;
4404 u_int8_t *sigp;
4405
4406 sav = tcp_signature_getsav(m, th);
4407
4408 if (sav == NULL) {
4409 if (m)
4410 m_freem(m);
4411 return (EPERM);
4412 }
4413
4414 *optp++ = TCPOPT_SIGNATURE;
4415 *optp++ = TCPOLEN_SIGNATURE;
4416 sigp = optp;
4417 bzero(optp, TCP_SIGLEN);
4418 optp += TCP_SIGLEN;
4419 *optp++ = TCPOPT_NOP;
4420 *optp++ = TCPOPT_EOL;
4421
4422 (void)tcp_signature(m, th, hlen, sav, sigp);
4423
4424 key_sa_recordxfer(sav, m);
4425 #ifdef FAST_IPSEC
4426 KEY_FREESAV(&sav);
4427 #else
4428 key_freesav(sav);
4429 #endif
4430 }
4431 #endif
4432
4433 /* Compute the packet's checksum. */
4434 switch (sc->sc_src.sa.sa_family) {
4435 case AF_INET:
4436 ip->ip_len = htons(tlen - hlen);
4437 th->th_sum = 0;
4438 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4439 break;
4440 #ifdef INET6
4441 case AF_INET6:
4442 ip6->ip6_plen = htons(tlen - hlen);
4443 th->th_sum = 0;
4444 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4445 break;
4446 #endif
4447 }
4448
4449 /*
4450 * Fill in some straggling IP bits. Note the stack expects
4451 * ip_len to be in host order, for convenience.
4452 */
4453 switch (sc->sc_src.sa.sa_family) {
4454 #ifdef INET
4455 case AF_INET:
4456 ip->ip_len = htons(tlen);
4457 ip->ip_ttl = ip_defttl;
4458 /* XXX tos? */
4459 break;
4460 #endif
4461 #ifdef INET6
4462 case AF_INET6:
4463 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
4464 ip6->ip6_vfc |= IPV6_VERSION;
4465 ip6->ip6_plen = htons(tlen - hlen);
4466 /* ip6_hlim will be initialized afterwards */
4467 /* XXX flowlabel? */
4468 break;
4469 #endif
4470 }
4471
4472 /* XXX use IPsec policy on listening socket, on SYN ACK */
4473 tp = sc->sc_tp;
4474
4475 switch (sc->sc_src.sa.sa_family) {
4476 #ifdef INET
4477 case AF_INET:
4478 error = ip_output(m, sc->sc_ipopts, ro,
4479 (ip_mtudisc ? IP_MTUDISC : 0),
4480 (struct ip_moptions *)NULL, so);
4481 break;
4482 #endif
4483 #ifdef INET6
4484 case AF_INET6:
4485 ip6->ip6_hlim = in6_selecthlim(NULL,
4486 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
4487 : NULL);
4488
4489 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, so, NULL);
4490 break;
4491 #endif
4492 default:
4493 error = EAFNOSUPPORT;
4494 break;
4495 }
4496 return (error);
4497 }
Cache object: c394606657c8cb6360b3d8e346761321
|